Re: [FFmpeg-devel] [PATCH 3/3] avcodec/mpeg4video: Detect reference studio streams as studio streams

[Kieran Kunhya]

On Sun, 29 Apr 2018 at 22:57 Michael Niedermayer 
wrote:

> Signed-off-by: Michael Niedermayer 
> ---
>  libavcodec/mpeg4video.h|  2 ++
>  libavcodec/mpeg4videodec.c | 25 -
>  2 files changed, 18 insertions(+), 9 deletions(-)
>
> diff --git a/libavcodec/mpeg4video.h b/libavcodec/mpeg4video.h
> index f974792887..dd0a59038d 100644
> --- a/libavcodec/mpeg4video.h
> +++ b/libavcodec/mpeg4video.h
> @@ -41,6 +41,8 @@
>  #define NBIT_VO_TYPE 5
>  #define ARTS_VO_TYPE10
>  #define ACE_VO_TYPE 12
> +#define SIMPLE_STUDIO_VO_TYPE   14
> +#define CORE_STUDIO_VO_TYPE 15
>  #define ADV_SIMPLE_VO_TYPE  17
>
>  #define VOT_VIDEO_ID 1
> diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c
> index ada5cdc6fa..d2b5e90331 100644
> --- a/libavcodec/mpeg4videodec.c
> +++ b/libavcodec/mpeg4videodec.c
> @@ -46,6 +46,8 @@
>  #define MB_TYPE_B_VLC_BITS 4
>  #define STUDIO_INTRA_BITS 9
>
> +static int decode_studio_vol_header(Mpeg4DecContext *ctx, GetBitContext
> *gb);
> +
>  static VLC dc_lum, dc_chrom;
>  static VLC sprite_trajectory;
>  static VLC mb_type_b_vlc;
> @@ -2049,6 +2051,18 @@ static int decode_vol_header(Mpeg4DecContext *ctx,
> GetBitContext *gb)
>  /* vol header */
>  skip_bits(gb, 1);   /* random access */
>  s->vo_type = get_bits(gb, 8);
> +
> +if (s->vo_type == CORE_STUDIO_VO_TYPE ||
> +s->vo_type == SIMPLE_STUDIO_VO_TYPE) {
> +if (s->avctx->profile != FF_PROFILE_UNKNOWN && s->avctx->profile
> != FF_PROFILE_MPEG4_SIMPLE_STUDIO)
> +return AVERROR_INVALIDDATA;
> +s->studio_profile = 1;
> +s->avctx->profile = FF_PROFILE_MPEG4_SIMPLE_STUDIO;
> +return decode_studio_vol_header(ctx, gb);
> +} else if (s->studio_profile) {
> +return AVERROR_PATCHWELCOME;
> +}
> +
>  if (get_bits1(gb) != 0) {   /* is_ol_id */
>  vo_ver_id = get_bits(gb, 4);/* vo_ver_id */
>  skip_bits(gb, 3);   /* vo_priority */
> @@ -3001,8 +3015,6 @@ static int decode_studio_vol_header(Mpeg4DecContext
> *ctx, GetBitContext *gb)
>  int width, height;
>  int bits_per_raw_sample;
>
> -skip_bits1(gb); /* random_accessible_vol */
> -skip_bits(gb, 8); /* video_object_type_indication */
>  skip_bits(gb, 4); /* video_object_layer_verid */
>

Please add a comment explaining what you've done here, someone might look
at this code in 10 years time (exactly like I did) and not understand why
you are mixing normal vol header and studio vol header.

Kieran
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

Re: [FFmpeg-devel] [PATCH 3/5] avcodec/mpeg4videode: Eliminate out of loop VOP startcode reading for studio profile

[Kieran Kunhya]

On Sun, 29 Apr 2018 at 20:20 Michael Niedermayer 
wrote:

> Signed-off-by: Michael Niedermayer 
> ---
>  libavcodec/mpeg4videodec.c | 4 
>  1 file changed, 4 deletions(-)
>
> diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c
> index 9ee2f37c69..9318d7bd4e 100644
> --- a/libavcodec/mpeg4videodec.c
> +++ b/libavcodec/mpeg4videodec.c
> @@ -2931,9 +2931,6 @@ static int decode_studio_vop_header(Mpeg4DecContext
> *ctx, GetBitContext *gb)
>  if (get_bits_left(gb) <= 32)
>  return 0;
>
> -if (get_bits_long(gb, 32) != VOP_STARTCODE)
> -return AVERROR_INVALIDDATA;
> -
>  s->decode_mb = mpeg4_decode_studio_mb;
>
>  decode_smpte_tc(ctx, gb);
> @@ -3183,7 +3180,6 @@ int ff_mpeg4_decode_picture_header(Mpeg4DecContext
> *ctx, GetBitContext *gb)
>  if (s->studio_profile) {
>  if ((ret = decode_studio_vol_header(ctx, gb)) < 0)
>  return ret;
> -break;
>  } else {
>  if ((ret = decode_vol_header(ctx, gb)) < 0)
>  return ret;
> --
> 2.17.0
>
> ___
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel


I appreciate you are going to ram this through as "maintainer" but many of
these changes do not reflect the intentions of the specification and build
on bad design decisions in mpeg4videodec from 10-15 years ago.

Kieran
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

Re: [FFmpeg-devel] [PATCH 1/3] avformat/m4vdec: Fix detection of raw MPEG-4 ES Studio

[Kieran Kunhya]

On Sun, 29 Apr 2018 at 22:57 Michael Niedermayer 
wrote:

> Signed-off-by: Michael Niedermayer 
> ---
>  libavformat/m4vdec.c | 6 ++
>  1 file changed, 6 insertions(+)
>
> diff --git a/libavformat/m4vdec.c b/libavformat/m4vdec.c
> index 34d434f7d2..be30f86a5c 100644
> --- a/libavformat/m4vdec.c
> +++ b/libavformat/m4vdec.c
> @@ -29,6 +29,7 @@ static int mpeg4video_probe(AVProbeData *probe_packet)
>  {
>  uint32_t temp_buffer = -1;
>  int VO = 0, VOL = 0, VOP = 0, VISO = 0, res = 0;
> +int res_main = 0;
>  int i;
>
>  for (i = 0; i < probe_packet->buf_size; i++) {
> @@ -46,11 +47,16 @@ static int mpeg4video_probe(AVProbeData *probe_packet)
>  VO++;
>  else if (temp_buffer >= 0x120 && temp_buffer < 0x130)
>  VOL++;
> +else if (temp_buffer == 0x1B7 || temp_buffer == 0x1B8)
> +res_main++;
>  else if (!(0x1AF < temp_buffer && temp_buffer < 0x1B7) &&
>   !(0x1B9 < temp_buffer && temp_buffer < 0x1C4))
>  res++;
>  }
>
> +if (res_main && 2*res_main < VOP)
> +res += res_main;
> +
>  if (VOP >= VISO && VOP >= VOL && VO >= VOL && VOL > 0 && res == 0)
>  return VOP+VO > 4 ? AVPROBE_SCORE_EXTENSION :
> AVPROBE_SCORE_EXTENSION/2;
>

Lots of interesting made up numbers here, explanation would be great.
Kieran
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

Re: [FFmpeg-devel] [PATCH 2/3] avcodec/mpeg4video_parser: Fix incorrect spliting of MPEG-4 studio frames

[Kieran Kunhya]

On Sun, 29 Apr 2018 at 22:57 Michael Niedermayer 
wrote:

> Signed-off-by: Michael Niedermayer 
> ---
>  libavcodec/mpeg4video_parser.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/libavcodec/mpeg4video_parser.c
> b/libavcodec/mpeg4video_parser.c
> index b7d6da1f75..453d373e6e 100644
> --- a/libavcodec/mpeg4video_parser.c
> +++ b/libavcodec/mpeg4video_parser.c
> @@ -61,6 +61,8 @@ int ff_mpeg4_find_frame_end(ParseContext *pc, const
> uint8_t *buf, int buf_size)
>  for (; i < buf_size; i++) {
>  state = (state << 8) | buf[i];
>  if ((state & 0xFF00) == 0x100) {
> +if (state == 0x1B7 || state == 0x1B8)
> +continue;
>  pc->frame_start_found = 0;
>  pc->state = -1;
>  return i - 3;
> --
>

Add a comment explaining what you are doing here please.
Kieran
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

[FFmpeg-devel] [PATCH] fftools/ffmpeg: fix mixed code and declarations

[James Almer]

Signed-off-by: James Almer 
---
 fftools/ffmpeg.c | 10 +-
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/fftools/ffmpeg.c b/fftools/ffmpeg.c
index d3054092ba..4be6e46d9b 100644
--- a/fftools/ffmpeg.c
+++ b/fftools/ffmpeg.c
@@ -4727,8 +4727,7 @@ static int transcode(void)
 
 static BenchmarkTimeStamps get_benchmark_time_stamps(void)
 {
-BenchmarkTimeStamps time_stamps;
-time_stamps.real_usec = av_gettime_relative();
+BenchmarkTimeStamps time_stamps = { av_gettime_relative() };
 #if HAVE_GETRUSAGE
 struct rusage rusage;
 
@@ -4833,10 +4832,11 @@ int main(int argc, char **argv)
 if (transcode() < 0)
 exit_program(1);
 if (do_benchmark) {
+int64_t utime, stime, rtime;
 current_time = get_benchmark_time_stamps();
-int64_t utime = current_time.user_usec - ti.user_usec;
-int64_t stime = current_time.sys_usec - ti.sys_usec;
-int64_t rtime = current_time.real_usec - ti.real_usec;
+utime = current_time.user_usec - ti.user_usec;
+stime = current_time.sys_usec - ti.sys_usec;
+rtime = current_time.real_usec - ti.real_usec;
 av_log(NULL, AV_LOG_INFO,
"bench: utime=%0.3fs stime=%0.3fs rtime=%0.3fs\n",
utime / 100.0, stime / 100.0, rtime / 100.0);
-- 
2.17.0

___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

[FFmpeg-devel] [PATCH 3/3] avcodec/mpeg4video: Detect reference studio streams as studio streams

[Michael Niedermayer]

Signed-off-by: Michael Niedermayer 
---
 libavcodec/mpeg4video.h|  2 ++
 libavcodec/mpeg4videodec.c | 25 -
 2 files changed, 18 insertions(+), 9 deletions(-)

diff --git a/libavcodec/mpeg4video.h b/libavcodec/mpeg4video.h
index f974792887..dd0a59038d 100644
--- a/libavcodec/mpeg4video.h
+++ b/libavcodec/mpeg4video.h
@@ -41,6 +41,8 @@
 #define NBIT_VO_TYPE 5
 #define ARTS_VO_TYPE10
 #define ACE_VO_TYPE 12
+#define SIMPLE_STUDIO_VO_TYPE   14
+#define CORE_STUDIO_VO_TYPE 15
 #define ADV_SIMPLE_VO_TYPE  17
 
 #define VOT_VIDEO_ID 1
diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c
index ada5cdc6fa..d2b5e90331 100644
--- a/libavcodec/mpeg4videodec.c
+++ b/libavcodec/mpeg4videodec.c
@@ -46,6 +46,8 @@
 #define MB_TYPE_B_VLC_BITS 4
 #define STUDIO_INTRA_BITS 9
 
+static int decode_studio_vol_header(Mpeg4DecContext *ctx, GetBitContext *gb);
+
 static VLC dc_lum, dc_chrom;
 static VLC sprite_trajectory;
 static VLC mb_type_b_vlc;
@@ -2049,6 +2051,18 @@ static int decode_vol_header(Mpeg4DecContext *ctx, 
GetBitContext *gb)
 /* vol header */
 skip_bits(gb, 1);   /* random access */
 s->vo_type = get_bits(gb, 8);
+
+if (s->vo_type == CORE_STUDIO_VO_TYPE ||
+s->vo_type == SIMPLE_STUDIO_VO_TYPE) {
+if (s->avctx->profile != FF_PROFILE_UNKNOWN && s->avctx->profile != 
FF_PROFILE_MPEG4_SIMPLE_STUDIO)
+return AVERROR_INVALIDDATA;
+s->studio_profile = 1;
+s->avctx->profile = FF_PROFILE_MPEG4_SIMPLE_STUDIO;
+return decode_studio_vol_header(ctx, gb);
+} else if (s->studio_profile) {
+return AVERROR_PATCHWELCOME;
+}
+
 if (get_bits1(gb) != 0) {   /* is_ol_id */
 vo_ver_id = get_bits(gb, 4);/* vo_ver_id */
 skip_bits(gb, 3);   /* vo_priority */
@@ -3001,8 +3015,6 @@ static int decode_studio_vol_header(Mpeg4DecContext *ctx, 
GetBitContext *gb)
 int width, height;
 int bits_per_raw_sample;
 
-skip_bits1(gb); /* random_accessible_vol */
-skip_bits(gb, 8); /* video_object_type_indication */
 skip_bits(gb, 4); /* video_object_layer_verid */
 ctx->shape = get_bits(gb, 2); /* video_object_layer_shape */
 skip_bits(gb, 4); /* video_object_layer_shape_extension */
@@ -3179,13 +3191,8 @@ int ff_mpeg4_decode_picture_header(Mpeg4DecContext *ctx, 
GetBitContext *gb)
 continue;
 }
 vol++;
-if (s->studio_profile) {
-if ((ret = decode_studio_vol_header(ctx, gb)) < 0)
-return ret;
-} else {
-if ((ret = decode_vol_header(ctx, gb)) < 0)
-return ret;
-}
+if ((ret = decode_vol_header(ctx, gb)) < 0)
+return ret;
 } else if (startcode == USER_DATA_STARTCODE) {
 decode_user_data(ctx, gb);
 } else if (startcode == GOP_STARTCODE) {
-- 
2.17.0

___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

[FFmpeg-devel] [PATCH 1/3] avformat/m4vdec: Fix detection of raw MPEG-4 ES Studio

[Michael Niedermayer]

Signed-off-by: Michael Niedermayer 
---
 libavformat/m4vdec.c | 6 ++
 1 file changed, 6 insertions(+)

diff --git a/libavformat/m4vdec.c b/libavformat/m4vdec.c
index 34d434f7d2..be30f86a5c 100644
--- a/libavformat/m4vdec.c
+++ b/libavformat/m4vdec.c
@@ -29,6 +29,7 @@ static int mpeg4video_probe(AVProbeData *probe_packet)
 {
 uint32_t temp_buffer = -1;
 int VO = 0, VOL = 0, VOP = 0, VISO = 0, res = 0;
+int res_main = 0;
 int i;
 
 for (i = 0; i < probe_packet->buf_size; i++) {
@@ -46,11 +47,16 @@ static int mpeg4video_probe(AVProbeData *probe_packet)
 VO++;
 else if (temp_buffer >= 0x120 && temp_buffer < 0x130)
 VOL++;
+else if (temp_buffer == 0x1B7 || temp_buffer == 0x1B8)
+res_main++;
 else if (!(0x1AF < temp_buffer && temp_buffer < 0x1B7) &&
  !(0x1B9 < temp_buffer && temp_buffer < 0x1C4))
 res++;
 }
 
+if (res_main && 2*res_main < VOP)
+res += res_main;
+
 if (VOP >= VISO && VOP >= VOL && VO >= VOL && VOL > 0 && res == 0)
 return VOP+VO > 4 ? AVPROBE_SCORE_EXTENSION : 
AVPROBE_SCORE_EXTENSION/2;
 
-- 
2.17.0

___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

[FFmpeg-devel] [PATCH 2/3] avcodec/mpeg4video_parser: Fix incorrect spliting of MPEG-4 studio frames

[Michael Niedermayer]

Signed-off-by: Michael Niedermayer 
---
 libavcodec/mpeg4video_parser.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/mpeg4video_parser.c b/libavcodec/mpeg4video_parser.c
index b7d6da1f75..453d373e6e 100644
--- a/libavcodec/mpeg4video_parser.c
+++ b/libavcodec/mpeg4video_parser.c
@@ -61,6 +61,8 @@ int ff_mpeg4_find_frame_end(ParseContext *pc, const uint8_t 
*buf, int buf_size)
 for (; i < buf_size; i++) {
 state = (state << 8) | buf[i];
 if ((state & 0xFF00) == 0x100) {
+if (state == 0x1B7 || state == 0x1B8)
+continue;
 pc->frame_start_found = 0;
 pc->state = -1;
 return i - 3;
-- 
2.17.0

___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

Re: [FFmpeg-devel] [PATCH 1/5] avcodec/mpeg4videodec: Move decode_studiovisualobject() parsing in the branch for visual object parsing

[Kieran Kunhya]

On Sun, 29 Apr 2018 at 20:20 Michael Niedermayer 
wrote:

> Fixes: runtime error: shift exponent -1 is negative
> Fixes:
> 7510/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5024523356209152
>
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by
> :
> Michael Niedermayer 
>

No, this is wrong, extension_and_user_data( 0 ) may precede
StudioVisualObject.

Kieran
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

Re: [FFmpeg-devel] [PATCH 4/5] avcodec/mpeg4videodec: Do not corrupt bits_per_raw_sample

[Kieran Kunhya]

On Sun, 29 Apr 2018 at 20:20 Michael Niedermayer 
wrote:

> Signed-off-by: Michael Niedermayer 
> ---
>  libavcodec/mpeg4videodec.c | 8 +---
>  1 file changed, 5 insertions(+), 3 deletions(-)
>

OK
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

[FFmpeg-devel] [PATCH 5/5] avcodec/mpeg4videodec: Check bps (VOL header) before VOP for studio profile

[Michael Niedermayer]

Fixes: runtime error: shift exponent -1 is negative
Fixes: 
7486/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4977380939530240

Fixes: runtime error: index 36 out of bounds for type 'const uint8_t [32]'
Fixes: 
7566/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-6536620682510336

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
---
 libavcodec/mpeg4videodec.c | 8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c
index 33cdc7a1b2..ada5cdc6fa 100644
--- a/libavcodec/mpeg4videodec.c
+++ b/libavcodec/mpeg4videodec.c
@@ -3217,9 +3217,13 @@ end:
 s->low_delay = 1;
 s->avctx->has_b_frames = !s->low_delay;
 
-if (s->studio_profile)
+if (s->studio_profile) {
+if (!s->avctx->bits_per_raw_sample) {
+av_log(s->avctx, AV_LOG_ERROR, "Missing VOL header\n");
+return AVERROR_INVALIDDATA;
+}
 return decode_studio_vop_header(ctx, gb);
-else
+} else
 return decode_vop_header(ctx, gb);
 }
 
-- 
2.17.0

___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

[FFmpeg-devel] [PATCH 2/5] avcodec/mpeg4videodec: Split decode_studio_vol_header() out of decode_studiovisualobject()

[Michael Niedermayer]

Signed-off-by: Michael Niedermayer 
---
 libavcodec/mpeg4videodec.c | 30 +-
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c
index 27602e8542..9ee2f37c69 100644
--- a/libavcodec/mpeg4videodec.c
+++ b/libavcodec/mpeg4videodec.c
@@ -2983,18 +2983,26 @@ static int decode_studio_vop_header(Mpeg4DecContext 
*ctx, GetBitContext *gb)
 static int decode_studiovisualobject(Mpeg4DecContext *ctx, GetBitContext *gb)
 {
 MpegEncContext *s = &ctx->m;
-int visual_object_type, width, height;
+int visual_object_type;
 
 skip_bits(gb, 4); /* visual_object_verid */
 visual_object_type = get_bits(gb, 4);
+if (visual_object_type != VOT_VIDEO_ID) {
+avpriv_request_sample(s->avctx, "VO type %u", visual_object_type);
+return AVERROR_PATCHWELCOME;
+}
 
 next_start_code_studio(gb);
 extension_and_user_data(s, gb, 1);
 
-if (visual_object_type == VOT_VIDEO_ID) {
-/* StudioVideoObjectLayer */
-skip_bits_long(gb, 32); /* video_object_start_code */
-skip_bits_long(gb, 32); /* video_object_layer_start_code */
+return 0;
+}
+
+static int decode_studio_vol_header(Mpeg4DecContext *ctx, GetBitContext *gb)
+{
+MpegEncContext *s = &ctx->m;
+int width, height;
+
 skip_bits1(gb); /* random_accessible_vol */
 skip_bits(gb, 8); /* video_object_type_indication */
 skip_bits(gb, 4); /* video_object_layer_verid */
@@ -3063,7 +3071,6 @@ static int decode_studiovisualobject(Mpeg4DecContext 
*ctx, GetBitContext *gb)
 
 next_start_code_studio(gb);
 extension_and_user_data(s, gb, 2);
-}
 
 return 0;
 }
@@ -3173,8 +3180,14 @@ int ff_mpeg4_decode_picture_header(Mpeg4DecContext *ctx, 
GetBitContext *gb)
 continue;
 }
 vol++;
-if ((ret = decode_vol_header(ctx, gb)) < 0)
-return ret;
+if (s->studio_profile) {
+if ((ret = decode_studio_vol_header(ctx, gb)) < 0)
+return ret;
+break;
+} else {
+if ((ret = decode_vol_header(ctx, gb)) < 0)
+return ret;
+}
 } else if (startcode == USER_DATA_STARTCODE) {
 decode_user_data(ctx, gb);
 } else if (startcode == GOP_STARTCODE) {
@@ -3191,7 +3204,6 @@ int ff_mpeg4_decode_picture_header(Mpeg4DecContext *ctx, 
GetBitContext *gb)
 if (s->studio_profile) {
 if ((ret = decode_studiovisualobject(ctx, gb)) < 0)
 return ret;
-break;
 } else
 mpeg4_decode_visual_object(s, gb);
 } else if (startcode == VOP_STARTCODE) {
-- 
2.17.0

___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

[FFmpeg-devel] [PATCH 1/5] avcodec/mpeg4videodec: Move decode_studiovisualobject() parsing in the branch for visual object parsing

[Michael Niedermayer]

Fixes: runtime error: shift exponent -1 is negative
Fixes: 
7510/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5024523356209152

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
---
 libavcodec/mpeg4videodec.c | 15 +--
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c
index 32eb3d1ca8..27602e8542 100644
--- a/libavcodec/mpeg4videodec.c
+++ b/libavcodec/mpeg4videodec.c
@@ -2982,14 +2982,9 @@ static int decode_studio_vop_header(Mpeg4DecContext 
*ctx, GetBitContext *gb)
 
 static int decode_studiovisualobject(Mpeg4DecContext *ctx, GetBitContext *gb)
 {
-uint32_t startcode;
 MpegEncContext *s = &ctx->m;
 int visual_object_type, width, height;
 
-startcode = get_bits_long(gb, 32);
-
-/* StudioVisualObject() */
-if (startcode == VISUAL_OBJ_STARTCODE) {
 skip_bits(gb, 4); /* visual_object_verid */
 visual_object_type = get_bits(gb, 4);
 
@@ -3069,7 +3064,6 @@ static int decode_studiovisualobject(Mpeg4DecContext 
*ctx, GetBitContext *gb)
 next_start_code_studio(gb);
 extension_and_user_data(s, gb, 2);
 }
-}
 
 return 0;
 }
@@ -3192,13 +3186,14 @@ int ff_mpeg4_decode_picture_header(Mpeg4DecContext 
*ctx, GetBitContext *gb)
 s->studio_profile = 1;
 next_start_code_studio(gb);
 extension_and_user_data(s, gb, 0);
-
+}
+} else if (startcode == VISUAL_OBJ_STARTCODE) {
+if (s->studio_profile) {
 if ((ret = decode_studiovisualobject(ctx, gb)) < 0)
 return ret;
 break;
-}
-} else if (startcode == VISUAL_OBJ_STARTCODE) {
-mpeg4_decode_visual_object(s, gb);
+} else
+mpeg4_decode_visual_object(s, gb);
 } else if (startcode == VOP_STARTCODE) {
 break;
 }
-- 
2.17.0

___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

[FFmpeg-devel] [PATCH 4/5] avcodec/mpeg4videodec: Do not corrupt bits_per_raw_sample

[Michael Niedermayer]

Signed-off-by: Michael Niedermayer 
---
 libavcodec/mpeg4videodec.c | 8 +---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c
index 9318d7bd4e..33cdc7a1b2 100644
--- a/libavcodec/mpeg4videodec.c
+++ b/libavcodec/mpeg4videodec.c
@@ -2999,6 +2999,7 @@ static int decode_studio_vol_header(Mpeg4DecContext *ctx, 
GetBitContext *gb)
 {
 MpegEncContext *s = &ctx->m;
 int width, height;
+int bits_per_raw_sample;
 
 skip_bits1(gb); /* random_accessible_vol */
 skip_bits(gb, 8); /* video_object_type_indication */
@@ -3014,8 +3015,8 @@ static int decode_studio_vol_header(Mpeg4DecContext *ctx, 
GetBitContext *gb)
 return AVERROR_INVALIDDATA;
 }
 
-s->avctx->bits_per_raw_sample = get_bits(gb, 4); /* bit_depth 
*/
-if (s->avctx->bits_per_raw_sample == 10) {
+bits_per_raw_sample = get_bits(gb, 4); /* bit_depth */
+if (bits_per_raw_sample == 10) {
 if (ctx->rgb) {
 s->avctx->pix_fmt = AV_PIX_FMT_GBRP10;
 }
@@ -3024,9 +3025,10 @@ static int decode_studio_vol_header(Mpeg4DecContext 
*ctx, GetBitContext *gb)
 }
 }
 else {
-avpriv_request_sample(s->avctx, "MPEG-4 Studio profile 
bit-depth %u", s->avctx->bits_per_raw_sample);
+avpriv_request_sample(s->avctx, "MPEG-4 Studio profile 
bit-depth %u", bits_per_raw_sample);
 return AVERROR_PATCHWELCOME;
 }
+s->avctx->bits_per_raw_sample = bits_per_raw_sample;
 }
 if (ctx->shape == RECT_SHAPE) {
 check_marker(s->avctx, gb, "before video_object_layer_width");
-- 
2.17.0

___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

[FFmpeg-devel] [PATCH 3/5] avcodec/mpeg4videode: Eliminate out of loop VOP startcode reading for studio profile

[Michael Niedermayer]

Signed-off-by: Michael Niedermayer 
---
 libavcodec/mpeg4videodec.c | 4 
 1 file changed, 4 deletions(-)

diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c
index 9ee2f37c69..9318d7bd4e 100644
--- a/libavcodec/mpeg4videodec.c
+++ b/libavcodec/mpeg4videodec.c
@@ -2931,9 +2931,6 @@ static int decode_studio_vop_header(Mpeg4DecContext *ctx, 
GetBitContext *gb)
 if (get_bits_left(gb) <= 32)
 return 0;
 
-if (get_bits_long(gb, 32) != VOP_STARTCODE)
-return AVERROR_INVALIDDATA;
-
 s->decode_mb = mpeg4_decode_studio_mb;
 
 decode_smpte_tc(ctx, gb);
@@ -3183,7 +3180,6 @@ int ff_mpeg4_decode_picture_header(Mpeg4DecContext *ctx, 
GetBitContext *gb)
 if (s->studio_profile) {
 if ((ret = decode_studio_vol_header(ctx, gb)) < 0)
 return ret;
-break;
 } else {
 if ((ret = decode_vol_header(ctx, gb)) < 0)
 return ret;
-- 
2.17.0

___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

Re: [FFmpeg-devel] [PATCH] avformat: add vapoursynth wrapper

[James Almer]

On 4/28/2018 2:05 PM, wm4 wrote:
> This can "demux" .vpy files.
> 
> Some minor code copied from other LGPL parts of FFmpeg.
> 
> I did not found a good way to test a few of the more obscure features,
> like VFR nodes, compat pixel formats, or nodes with dynamic size/format
> changes. These can be easily implemented on demand.
> ---
>  configure |   5 +
>  libavformat/Makefile  |   1 +
>  libavformat/allformats.c  |   1 +
>  libavformat/vapoursynth.c | 421 
> ++
>  4 files changed, 428 insertions(+)
>  create mode 100644 libavformat/vapoursynth.c

https://forum.doom9.org/showthread.php?p=1838296#post1838296

Somebody wrote a similar wrapper by properly assembling rawvideo packets
instead, in a similar way we already do with avisynth.
Could you use that implementation instead? It would be consistent with
existing similar demuxers and much better than using wrapped_avframe.
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

Re: [FFmpeg-devel] [PATCH 1/3] avcodec/g2meet: Check RGB upper limit

[Tomas Härdin]

sön 2018-04-29 klockan 16:41 +0200 skrev Michael Niedermayer:
> On Fri, Apr 27, 2018 at 09:44:05PM +0200, Michael Niedermayer wrote:
> > Fixes: runtime error: left shift of 1876744317 by 16 places cannot
> > be represented in type 'int'
> > Fixes: 6799/clusterfuzz-testcase-minimized-
> > ffmpeg_AV_CODEC_ID_G2M_fuzzer-5115274731716608
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-
> > fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer 
> > ---
> >  libavcodec/g2meet.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c
> > index b409dae813..105a40278f 100644
> > --- a/libavcodec/g2meet.c
> > +++ b/libavcodec/g2meet.c
> > @@ -556,7 +556,7 @@ static uint32_t
> > epic_decode_pixel_pred(ePICContext *dc, int x, int y,
> >  B = ((pred >> B_shift) & 0xFF) - TOSIGNED(delta);
> >  }
> >  
> > -if (R<0 || G<0 || B<0) {
> > +if (R<0 || G<0 || B<0 || R > 255 || G > 255 || B > 255) {
> >  av_log(NULL, AV_LOG_ERROR, "RGB %d %d %d is out of
> > range\n", R, G, B);
> >  return 0;
> 
> i saw someone asked why this doesnt clip on the IRC backlog
> 
> There is AFAIK no public spec so theres nothing really solid to base
> a 
> preferrance on.
> 
> I favor a hard error as it is easier t debug in case it misbehaves.
> silently cliping (if its wrong) leads to more difficult to trace
> issues.
> 
> But if people prefer i can change it to clip of course.

Be as strict as possible and ask for samples if someone has a file that
breaks these expectations

/Tomas
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

Re: [FFmpeg-devel] [PATCH 3/3] avcodec/wavpack: Fix integer overflow in DEC_MED() / INC_MED()

[Michael Niedermayer]

On Fri, Apr 27, 2018 at 09:44:07PM +0200, Michael Niedermayer wrote:
> Fixes: runtime error: signed integer overflow: 2147483637 + 128 cannot be 
> represented in type 'int'
> Fixes: 
> 6701/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5358324934508544
> 
> Found-by: continuous fuzzing process 
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer 
> ---
>  libavcodec/wavpack.h | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

will apply

[...]
-- 
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Awnsering whenever a program halts or runs forever is
On a turing machine, in general impossible (turings halting problem).
On any real computer, always possible as a real computer has a finite number
of states N, and will either halt in less than N cycles or never halt.


signature.asc
Description: PGP signature
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

Re: [FFmpeg-devel] [PATCH 2/3] avcodec/wavpack: Fix integer overflow in wv_unpack_stereo()

[Michael Niedermayer]

On Fri, Apr 27, 2018 at 09:44:06PM +0200, Michael Niedermayer wrote:
> Fixes: runtime error: signed integer overflow: 2147483531 + 16384 cannot be 
> represented in type 'int'
> Fixes: 
> 6615/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5165715515506688
> 
> Found-by: continuous fuzzing process 
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer 
> ---
>  libavcodec/wavpack.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

will apply

[...]
-- 
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

There will always be a question for which you do not know the correct answer.


signature.asc
Description: PGP signature
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

Re: [FFmpeg-devel] [PATCH 1/3] avcodec/g2meet: Check RGB upper limit

[Michael Niedermayer]

On Fri, Apr 27, 2018 at 09:44:05PM +0200, Michael Niedermayer wrote:
> Fixes: runtime error: left shift of 1876744317 by 16 places cannot be 
> represented in type 'int'
> Fixes: 
> 6799/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5115274731716608
> 
> Found-by: continuous fuzzing process 
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer 
> ---
>  libavcodec/g2meet.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c
> index b409dae813..105a40278f 100644
> --- a/libavcodec/g2meet.c
> +++ b/libavcodec/g2meet.c
> @@ -556,7 +556,7 @@ static uint32_t epic_decode_pixel_pred(ePICContext *dc, 
> int x, int y,
>  B = ((pred >> B_shift) & 0xFF) - TOSIGNED(delta);
>  }
>  
> -if (R<0 || G<0 || B<0) {
> +if (R<0 || G<0 || B<0 || R > 255 || G > 255 || B > 255) {
>  av_log(NULL, AV_LOG_ERROR, "RGB %d %d %d is out of range\n", R, G, 
> B);
>  return 0;

i saw someone asked why this doesnt clip on the IRC backlog

There is AFAIK no public spec so theres nothing really solid to base a 
preferrance on.

I favor a hard error as it is easier t debug in case it misbehaves.
silently cliping (if its wrong) leads to more difficult to trace issues.

But if people prefer i can change it to clip of course.

Thanks

[...]
-- 
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

He who knows, does not speak. He who speaks, does not know. -- Lao Tsu


signature.asc
Description: PGP signature
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

Re: [FFmpeg-devel] [PATCH] fftools/ffmpeg: fix mixed code and declarations

[Hendrik Leppkes]

On Sun, Apr 29, 2018 at 4:00 PM, James Almer  wrote:
> On 4/29/2018 8:08 AM, Derek Buitenhuis wrote:
>> On 4/29/2018 3:21 AM, James Almer wrote:
>>> +BenchmarkTimeStamps time_stamps = { .real_usec = av_gettime_relative() 
>>> };
>>
>> Does this build on supported versions of MSVC?
>
> I don't know, i don't have MSVC to test. And afaik we support only 2013
> or newer (or at least stopped caring about the older, non c99 compliant
> ones).

real_usec is the first field in the struct, just skip the designated
initializer entirely.

- Hendrik
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

Re: [FFmpeg-devel] [PATCH] fftools/ffmpeg: fix mixed code and declarations

[wm4]

On Sat, 28 Apr 2018 23:21:27 -0300
James Almer  wrote:

> Signed-off-by: James Almer 
> ---
>  fftools/ffmpeg.c | 10 +-
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/fftools/ffmpeg.c b/fftools/ffmpeg.c
> index d3054092ba..9b3e9d121e 100644
> --- a/fftools/ffmpeg.c
> +++ b/fftools/ffmpeg.c
> @@ -4727,8 +4727,7 @@ static int transcode(void)
>  
>  static BenchmarkTimeStamps get_benchmark_time_stamps(void)
>  {
> -BenchmarkTimeStamps time_stamps;
> -time_stamps.real_usec = av_gettime_relative();
> +BenchmarkTimeStamps time_stamps = { .real_usec = av_gettime_relative() };
>  #if HAVE_GETRUSAGE
>  struct rusage rusage;
>  
> @@ -4833,10 +4832,11 @@ int main(int argc, char **argv)
>  if (transcode() < 0)
>  exit_program(1);
>  if (do_benchmark) {
> +int64_t utime, stime, rtime;
>  current_time = get_benchmark_time_stamps();
> -int64_t utime = current_time.user_usec - ti.user_usec;
> -int64_t stime = current_time.sys_usec - ti.sys_usec;
> -int64_t rtime = current_time.real_usec - ti.real_usec;
> +utime = current_time.user_usec - ti.user_usec;
> +stime = current_time.sys_usec - ti.sys_usec;
> +rtime = current_time.real_usec - ti.real_usec;
>  av_log(NULL, AV_LOG_INFO,
> "bench: utime=%0.3fs stime=%0.3fs rtime=%0.3fs\n",
> utime / 100.0, stime / 100.0, rtime / 100.0);

It's pretty funny that we change something because it's not allowed in
C89 (but in C99), and add use of a C99 only feature in the same fix.
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

Re: [FFmpeg-devel] [PATCH] fftools/ffmpeg: fix mixed code and declarations

[James Almer]

On 4/29/2018 8:08 AM, Derek Buitenhuis wrote:
> On 4/29/2018 3:21 AM, James Almer wrote:
>> +BenchmarkTimeStamps time_stamps = { .real_usec = av_gettime_relative() 
>> };
> 
> Does this build on supported versions of MSVC?

I don't know, i don't have MSVC to test. And afaik we support only 2013
or newer (or at least stopped caring about the older, non c99 compliant
ones).
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

Re: [FFmpeg-devel] [PATCH] avformat/hls: don't propagate deprecated "user-agent" AVOption

[Clément Bœsch]

On Sat, Apr 28, 2018 at 08:37:06PM +0200, wm4 wrote:
> This code will print a warning if any user agent is set - even if the
> API user used the proper non-deprecated "user_agent" option.
> 
> This change should not even break anything, because even if the user
> sets the deprecated "user-agent" option, http.c copies it to the
> "user_agent" option anyway.
> ---
>  libavformat/hls.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavformat/hls.c b/libavformat/hls.c
> index ffec124818..4ee4be769d 100644
> --- a/libavformat/hls.c
> +++ b/libavformat/hls.c
> @@ -1593,7 +1593,7 @@ static int save_avio_options(AVFormatContext *s)
>  {
>  HLSContext *c = s->priv_data;
>  static const char * const opts[] = {
> -"headers", "http_proxy", "user_agent", "user-agent", "cookies", 
> "referer", "rw_timeout", NULL };
> +"headers", "http_proxy", "user_agent", "cookies", "referer", 
> "rw_timeout", NULL };
>  const char * const * opt = opts;
>  uint8_t *buf;
>  int ret = 0;

Should be fine, thanks.

-- 
Clément B.


signature.asc
Description: PGP signature
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

Re: [FFmpeg-devel] [PATCH 1/1] add CUgraphicsRegisterFlags enum

[Timo Rothenpieler]

pushed equivalent changes as part of a different patch

Also started an sdk/8.0 branch and backported all non-video-sdk changes 
there.




smime.p7s
Description: S/MIME Cryptographic Signature
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

Re: [FFmpeg-devel] [PATCH] fftools/ffmpeg: fix mixed code and declarations

[Derek Buitenhuis]

On 4/29/2018 3:21 AM, James Almer wrote:
> +BenchmarkTimeStamps time_stamps = { .real_usec = av_gettime_relative() };

Does this build on supported versions of MSVC?

- Derek
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

Re: [FFmpeg-devel] [PATCH] avfilter/vf_overlay: add slice threading

[Paul B Mahol]

On 4/29/18, Michael Niedermayer  wrote:
> On Sat, Apr 28, 2018 at 12:00:46PM +0200, Paul B Mahol wrote:
>> Signed-off-by: Paul B Mahol 
>> ---
>>  libavfilter/vf_overlay.c | 281
>> ---
>>  1 file changed, 190 insertions(+), 91 deletions(-)
>>
>> diff --git a/libavfilter/vf_overlay.c b/libavfilter/vf_overlay.c
>> index c6a6ac82f3..cb304e9522 100644
>> --- a/libavfilter/vf_overlay.c
>> +++ b/libavfilter/vf_overlay.c
>> @@ -40,6 +40,10 @@
>>  #include "framesync.h"
>>  #include "video.h"
>>
>> +typedef struct ThreadData {
>> +AVFrame *dst, *src;
>> +} ThreadData;
>> +
>>  static const char *const var_names[] = {
>>  "main_w","W", ///< width  of the mainvideo
>>  "main_h","H", ///< height of the mainvideo
>> @@ -124,7 +128,7 @@ typedef struct OverlayContext {
>>
>>  AVExpr *x_pexpr, *y_pexpr;
>>
>> -void (*blend_image)(AVFilterContext *ctx, AVFrame *dst, const AVFrame
>> *src, int x, int y);
>> +int (*blend_slice)(AVFilterContext *ctx, void *arg, int jobnr, int
>> nb_jobs);
>>  } OverlayContext;
>>
>>  static av_cold void uninit(AVFilterContext *ctx)
>> @@ -403,10 +407,10 @@ static int config_output(AVFilterLink *outlink)
>>   * Blend image in src to destination buffer dst at position (x, y).
>>   */
>>
>> -static av_always_inline void blend_image_packed_rgb(AVFilterContext
>> *ctx,
>> +static av_always_inline void blend_slice_packed_rgb(AVFilterContext
>> *ctx,
>> AVFrame *dst, const AVFrame *src,
>> int main_has_alpha, int x, int y,
>> -   int is_straight)
>> +   int is_straight, int jobnr, int
>> nb_jobs)
>>  {
>>  OverlayContext *s = ctx->priv;
>>  int i, imax, j, jmax;
>> @@ -425,13 +429,19 @@ static av_always_inline void
>> blend_image_packed_rgb(AVFilterContext *ctx,
>>  const int sb = s->overlay_rgba_map[B];
>>  const int sa = s->overlay_rgba_map[A];
>>  const int sstep = s->overlay_pix_step[0];
>> +int slice_start, slice_end;
>>  uint8_t *S, *sp, *d, *dp;
>>
>>  i = FFMAX(-y, 0);
>> -sp = src->data[0] + i * src->linesize[0];
>> -dp = dst->data[0] + (y+i) * dst->linesize[0];
>> +imax = FFMIN(-y + dst_h, src_h);
>> +
>> +slice_start = (imax * jobnr) / nb_jobs;
>> +slice_end = (imax * (jobnr+1)) / nb_jobs;
>> +
>> +sp = src->data[0] + (i + slice_start) * src->linesize[0];
>> +dp = dst->data[0] + (y + i + slice_start) * dst->linesize[0];
>>
>> -for (imax = FFMIN(-y + dst_h, src_h); i < imax; i++) {
>> +for (i = i + slice_start; i < slice_end; i++) {
>>  j = FFMAX(-x, 0);
>>  S = sp + j * sstep;
>>  d = dp + (x+j) * dstep;
>> @@ -495,7 +505,9 @@ static av_always_inline void
>> blend_plane(AVFilterContext *ctx,
>>   int dst_offset,
>>   int dst_step,
>>   int straight,
>> - int yuv)
>> + int yuv,
>> + int jobnr,
>> + int nb_jobs)
>>  {
>>  int src_wp = AV_CEIL_RSHIFT(src_w, hsub);
>>  int src_hp = AV_CEIL_RSHIFT(src_h, vsub);
>> @@ -505,16 +517,22 @@ static av_always_inline void
>> blend_plane(AVFilterContext *ctx,
>>  int xp = x>>hsub;
>>  uint8_t *s, *sp, *d, *dp, *dap, *a, *da, *ap;
>>  int jmax, j, k, kmax;
>> +int slice_start, slice_end;
>>
>>  j = FFMAX(-yp, 0);
>> -sp = src->data[i] + j * src->linesize[i];
>> +jmax = FFMIN(-yp + dst_hp, src_hp);
>> +
>> +slice_start = (jmax * jobnr) / nb_jobs;
>> +slice_end = ((jmax * (jobnr+1)) / nb_jobs);
>> +
>> +sp = src->data[i] + slice_start * src->linesize[i];
>>  dp = dst->data[dst_plane]
>> -  + (yp+j)* dst->linesize[dst_plane]
>> +  + (yp + slice_start) * dst->linesize[dst_plane]
>>+ dst_offset;
>> -ap = src->data[3] + (j> -dap = dst->data[3] + ((yp+j) << vsub) * dst->linesize[3];
>> +ap = src->data[3] + (slice_start << vsub) * src->linesize[3];
>> +dap = dst->data[3] + ((yp + slice_start) << vsub) *
>> dst->linesize[3];
>>
>> -for (jmax = FFMIN(-yp + dst_hp, src_hp); j < jmax; j++) {
>> +for (j = j + slice_start; j < slice_end; j++) {
>>  k = FFMAX(-xp, 0);
>>  d = dp + (xp+k) * dst_step;
>>  s = sp + k;
>> @@ -577,17 +595,23 @@ static av_always_inline void
>> blend_plane(AVFilterContext *ctx,
>>  static inline void alpha_composite(const AVFrame *src, const AVFrame
>> *dst,
>> int src_w, int src_h,
>> int dst_w, int dst_h,
>> -   int x, int y)
>> +