Compare commits

..

1805 Commits

Author SHA1 Message Date
Michael Niedermayer
665f4908a8 Update for FFmpeg 3.2.18
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-05-11 02:16:45 +02:00
Paul B Mahol
64d2e0b200 avfilter/vf_colorspace: fix memmory leaks
Fixes #8303

(cherry picked from commit fddef964e8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-05-04 19:57:11 +02:00
Andreas Rheinhardt
bbc9751da6 avcodec/ac3enc: Fix memleak
Fixes ticket #8294.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 097c917c14)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-05-04 19:54:57 +02:00
James Almer
c7c2f4975b avformat/nutenc: don't allocate a dynamic AVIOContext if no index is going to be written
Fixes ticket #8295

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 1d479300cb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-05-04 19:38:44 +02:00
Paul B Mahol
5b4100cbae avfilter/vf_random: fix memory leaks
Fixes #8296

(cherry picked from commit 3488e0977c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-05-04 19:35:02 +02:00
Paul B Mahol
7004a214d0 avfilter/vf_bwdif: fix heap-buffer overflow
Fixes #8261

(cherry picked from commit 8c3166e1c3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-05-04 19:32:01 +02:00
Andreas Rheinhardt
ee92ee3b5a fftools/ffmpeg_opt: Fix leak of options when parsing options fails
Fixes #8094.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 21265f42ec)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-05-04 19:28:24 +02:00
Paul B Mahol
e998d8c90d avfilter/vf_edgedetect: fix heap-buffer overflow
Fixes #8275

(cherry picked from commit de598f82f8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-05-04 19:25:32 +02:00
Paul B Mahol
fd8b08ebbb avfilter/vf_w3fdif: deny processing small videos
Fixes #8243

(cherry picked from commit 0e68e8c93f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-05-04 19:23:51 +02:00
Paul B Mahol
ff93d6f710 avfilter/vf_avgblur: fix heap-buffer overflow
Fixes #8274

(cherry picked from commit f069a9c2a6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-05-04 18:49:27 +02:00
Paul B Mahol
a9b8eda773 avfilter/af_tremolo: fix heap-buffer overflow
Fixes #8317

(cherry picked from commit 58bb9d3a3a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-05-04 18:47:06 +02:00
Paul B Mahol
7cab59a34f avfilter/vf_edgedetect: check if height is big enough
Fixes #8260

(cherry picked from commit ccf4ab8c9a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-05-04 18:42:56 +02:00
Paul B Mahol
ab0b268bb7 avfilter/vf_bitplanenoise: fix overreads
Fixes #8244

(cherry picked from commit 0b56723874)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-05-04 18:40:20 +02:00
Paul B Mahol
07bc7b2c07 avfilter/vf_fieldorder: fix heap-buffer overflow
Fixes #8264

(cherry picked from commit 07050d7bdc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-05-04 18:37:34 +02:00
Paul B Mahol
0744d7176a avfilter/vf_fieldmatch: fix heap-buffer overflow
Also fix use of uninitialized values.

Fixes #8239

(cherry picked from commit ce5274c138)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-05-04 18:34:53 +02:00
James Almer
a95d2099b8 aformat/movenc: add missing padding to output track extradata
Fixes ticket #8183.

Tested-by: Thierry Foucu <tfoucu@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 58aa0ed8f1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-05-04 18:21:01 +02:00
Paul B Mahol
322b066d65 avcodec/pngenc: remove monowhite from apng formats
Monowhite pixel format is not supported, and it does not make sense
to add support for it.

Fixes #7989

(cherry picked from commit 5d9f44da46)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-05-04 18:17:48 +02:00
Michael Niedermayer
799cd3e2fe Update for 3.2.17
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-22 21:34:01 +02:00
Gyan Doshi
a82872c283 configure: bump year
(cherry picked from commit 2f6360ff21)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-16 10:49:30 +02:00
Paul B Mahol
350f2378c3 avfilter/vf_lenscorrection: make width/height int
Somehow previous correct fix broke usage.

(cherry picked from commit 79522411fa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-07 23:54:50 +02:00
Michael Niedermayer
07d533880c avcodec/diracdec: avoid signed integer overflow in global mv
Fixes: signed integer overflow: -128275513086 * -76056576 cannot be represented in type 'long'
Fixes: 45818/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5129799149944832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7f1279684e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-03 23:56:10 +02:00
Michael Niedermayer
7221c80aae avcodec/takdsp: Fix integer overflow in decorrelate_sf()
Fixes: signed integer overflow: -101 * 71041254 cannot be represented in type 'int'
Fixes: 45938/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-4687974320701440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 01d8c887f6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-03 23:55:55 +02:00
Michael Niedermayer
6a6bb09a95 avcodec/apedec: fix a integer overflow in long_filter_high_3800()
Fixes: signed integer overflow: -2146549696 - 3923884 cannot be represented in type 'int'
Fixes: 45907/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5992380584558592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b085b400be)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-03 23:55:28 +02:00
Michael Niedermayer
e3f08b4162 avformat/aqtitledec: Skip unrepresentable durations
Fixes: signed integer overflow: -5 - 9223372036854775807 cannot be represented in type 'long'
Fixes: 45665/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-475618463934054

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c2d1597a8a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-03-28 23:17:54 +02:00
Michael Niedermayer
f7dbbbdaf0 avformat/cafdec: Do not store empty keys in read_info_chunk()
Fixes: Timeout
Fixes: 45543/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5684953164152832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7ec28e1d4c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-03-28 23:16:44 +02:00
Michael Niedermayer
6d4c5f4e2b avformat/hls: Check target_duration
Fixes: signed integer overflow: 77777777777777 * 1000000 cannot be represented in type 'long long'
Fixes: 45545/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-6438101247983616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a8fd3f7fab)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-03-28 23:14:15 +02:00
Michael Niedermayer
73bb1853b2 avformat/matroskadec: Check pre_ns
Fixes: division by 0
Fixes: 44615/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6681108677263360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 710e51677a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-03-28 23:13:16 +02:00
Michael Niedermayer
8e68f7f7ba avcodec/sonic: Use unsigned for predictor_k to avoid undefined behavior
Fixes: signed integer overflow: -1094995529 * 24 cannot be represented in type 'int'
Fixes: 44436/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-4874459459223552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 28008bf95e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-03-28 23:11:36 +02:00
Michael Niedermayer
aee90d4064 avformat/matroskadec: Use rounded down duration in get_cue_desc() check
Floating point is evil, it would be better if duration was not a double

Fixes: Infinite loop
Fixes: 45123/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6725052291219456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bd3a03db9a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-03-28 23:07:05 +02:00
Michael Niedermayer
34f075f3ff avformat/avidec: Check height
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: Ticket8486

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ec8ff659f5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-03-28 22:51:59 +02:00
Michael Niedermayer
2063db041e avformat/rmdec: Better duplicate tags check
Fixes: memleaks
Fixes: 44810/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5619494647627776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 15a646e501)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-03-28 22:47:35 +02:00
Michael Niedermayer
4e7092faaa avformat/mov: Disallow empty sidx
It appears this is not allowed "Each Segment Index box documents how a (sub)segment is divided into one or more subsegments
(which may themselves be further subdivided using Segment Index boxes)."
Fixes: Null pointer dereference
Fixes: Ticket9517

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4419433d77)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-03-28 22:40:33 +02:00
Michael Niedermayer
a874429298 avformat/matroskadec: Check duration
Fixes: -nan is outside the range of representable values of type 'long'
Fixes: 44614/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6216204841254912

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 36680078ca)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-03-28 22:18:10 +02:00
Michael Niedermayer
d1234b92b3 avcodec/jpeglsdec: Fix if( code style
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f306b8e80a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-02-16 20:14:35 +01:00
Michael Niedermayer
df52930a84 avcodec/jpeglsdec: Check get_ur_golomb_jpegls() for error
Fixes: Timeout
Fixes: Invalid shift
Fixes: 44548/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-556487680891289
Fixes: 44569/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMV_fuzzer-6302543246917632
Fixes: 44570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-4550196556595200
Fixes: 44592/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5651610385121280
Fixes: 44571/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5094698987945984
Fixes: 44607/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5341352013987840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 151f83584e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-02-16 20:13:53 +01:00
Michael Niedermayer
0915353777 avcodec/motion_est: fix indention of ff_get_best_fcode()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce43e1c581)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-02-16 20:12:37 +01:00
Michael Niedermayer
a198d7ab26 avcodec/motion_est: Fix xy indexing on range violation in ff_get_best_fcode()
This codepath seems untested, no testcases change

Found-by: <mkver>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 634312a70f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-02-16 20:11:55 +01:00
Michael Niedermayer
fbffe56476 avcodec/jpeglsdec: Increase range for N in ls_get_code_runterm() by using unsigned
Fixes: left shift of 32768 by 16 places cannot be represented in type 'int'
Fixes: Timeout
Fixes: 44219/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-4679455379947520
Fixes: 44088/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-4885976600674304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6ee283d7d0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-02-16 20:10:53 +01:00
Michael Niedermayer
c787a27335 avformat/matroskadec: Check desc_bytes
Fixes: Division by 0
Fixes: 44035/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4826721386364928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5038933977)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-02-16 20:10:27 +01:00
Michael Niedermayer
73ca8b9a02 avformat/utils: Fix invalid NULL pointer operation in ff_parse_key_value()
Fixes: pointer index expression with base 0x000000000000 overflowed to 0xffffffffffffffff
Fixes: 44012/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-5670607746891776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 59328aabd2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-02-16 20:09:34 +01:00
Michael Niedermayer
28a1cc8138 avformat/matroskadec: Fix infinite loop with bz decompression
The same check is added to zlib too, it seems not needed there though

Fixes: Infinite loop
Fixes: 43932/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-6175167573786624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9c3d2cbb51)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-02-16 18:57:01 +01:00
Michael Niedermayer
446cfcf01a avformat/mov: Check size before subtraction
Fixes: signed integer overflow: -9223372036854775808 - 8 cannot be represented in type 'long'
Fixes: 43542/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5237670148702208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d8d9d506a3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-02-16 18:55:55 +01:00
Michael Niedermayer
d577bde974 avcodec/apedec: Fix integer overflows in predictor_update_3930()
Fixes: signed integer overflow: 1074134419 - -1075212485 cannot be represented in type 'int'
Fixes: 43273/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-4706880883130368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0c9c9bbd01)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-01-13 23:23:23 +01:00
Michael Niedermayer
ee84c87edf avcodec/apedec: fix integer overflow in 8bit samples
Fixes: signed integer overflow: 2147483542 + 128 cannot be represented in type 'int'
Fixes: 42812/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6344057861832704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7cee3b3718)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-01-13 23:13:02 +01:00
Michael Niedermayer
da356c4eda avformat/flvdec: timestamps cannot use the full int64 range
We do not support this as we multiply by 1000
Fixes: signed integer overflow: -45318575073853696 * 1000 cannot be represented in type 'long'
Fixes: 42804/clusterfuzz-testcase-minimized-ffmpeg_dem_LIVE_FLV_fuzzer-4630325425209344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c217ca7718)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-01-13 23:10:57 +01:00
Michael Niedermayer
5650737134 avcodec/vqavideo: reset accounting on error
Fixes: Timeout (same growing chunk is decoded to failure repeatedly)
Fixes: 42582/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-6531195591065600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d8ea7a67ba)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-01-13 23:06:10 +01:00
Michael Niedermayer
3541d4960b avcodec/alacdsp: fix integer overflow in decorrelate_stereo()
Fixes: signed integer overflow: -16777216 * 131 cannot be represented in type 'int'
Fixes: 23835/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5669943160078336
Fixes: 41101/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-4636330705944576

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 68457c1e85)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-01-13 22:51:18 +01:00
Michael Niedermayer
dc78fd9404 avformat/4xm: Check for duplicate track ids
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dd94912479)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-01-13 22:50:49 +01:00
Michael Niedermayer
0bcd3550a4 avformat/4xm: Consider max_streams on reallocating tracks array
Fixes: OOM
Fixes: 41595/clusterfuzz-testcase-minimized-ffmpeg_dem_FOURXM_fuzzer-6355979363549184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0dcd95ef8a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-01-13 22:50:16 +01:00
Michael Niedermayer
6cdc8b3c13 avformat/mov: Check next offset in mov_read_dref()
Fixes: signed integer overflow: 9223372036200463215 + 1109914409 cannot be represented in type 'long'
Fixes: 41480/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6553086177443840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 562021e2fd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-01-13 22:46:52 +01:00
Michael Niedermayer
19a307f68d avformat/mxfdec: Check for duplicate mxf_read_index_entry_array()
Fixes: memleak
Fixes: 41596/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6439060204290048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4f44a218e5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-01-13 22:44:11 +01:00
Michael Niedermayer
5e8556dd36 avcodec/apedec: Change avg to uint32_t
Fixes: Integer overflow
Fixes: 40973/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6739312704618496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ec75723a4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-01-13 22:43:27 +01:00
Michael Niedermayer
8e09257dca avformat/mov: Check for EOF in mov_read_glbl()
Fixes: Infinite loop
Fixes: 41351/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5433895854669824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 59b4e7cbd8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-12-06 22:06:45 +01:00
Michael Niedermayer
fe11596a73 avformat/aiffdec: sanity check block_align
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 93f7776921)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-12-01 22:02:37 +01:00
Michael Niedermayer
2d2ed8b045 avformat/aiffdec: Check sample_rate
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b04836dff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-12-01 22:02:17 +01:00
Paul B Mahol
f8b4426c10 avfilter/vf_gblur: fix heap-buffer overflow
Fixes #8282

(cherry picked from commit 64a805883d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-31 19:22:45 +01:00
Paul B Mahol
94e502e96b avfilter/vf_lenscorrection: fix division by zero
Fixes #8265

(cherry picked from commit 19587c9332)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-31 19:20:23 +01:00
Michael Niedermayer
abf9627f70 avcodec/g729dec: Avoid computing invalid temporary pointers for ff_acelp_weighted_vector_sum()
Fixes: Ticket8176

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2c78a76cb0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-31 19:05:00 +01:00
Andreas Rheinhardt
f1a77222da avformat/movenc: Fix segfault when remuxing rtp hint stream
When remuxing an rtp hint stream (or any stream with the tag "rtp "),
the mov muxer treats this as one of the rtp hint tracks it creates
internally when ordered to do so; yet this track lacks the
AVFormatContext for the hinting rtp muxer, leading to segfaults in
mov_write_udta_sdp() if a "trak" atom is written for this stream; if not,
the stream's codecpar is freed by mov_free() as if the mov muxer owned
it (it does for the internally created "rtp " tracks), but without
resetting st->codecpar, leading to double-frees lateron. This commit
therefore ignores said tag which makes rtp hint streams unremuxable.

This fixes tickets #8181 and #8186.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 22c3cd1760)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-31 18:56:40 +01:00
Paul B Mahol
7df2ff54e8 avformat/tty: add probe function
(cherry picked from commit 3bce9e9b3e)
2021-10-31 18:45:21 +01:00
Michael Niedermayer
a19bed14d6 avcodec/flac_parser: Consider AV_INPUT_BUFFER_PADDING_SIZE
Fixes: out if array read
Fixes: 40109/clusterfuzz-testcase-minimized-ffmpeg_dem_FLAC_fuzzer-4805686811295744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Mattias Wadman <mattias.wadman@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-22 22:49:44 +02:00
Michael Niedermayer
d57898b74b avcodec/ttadsp: Fix integer overflows in tta_filter_process_c()
Fixes: signed integer overflow: 822841647 + 1647055738 cannot be represented in type 'int'
Fixes: 39935/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-4592657142251520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f24028c798)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-21 15:26:19 +02:00
Michael Niedermayer
e8363735fb avutil/mathematics: Document av_rescale_rnd() behavior on non int64 results
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e154353fdb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-21 15:25:58 +02:00
Michael Niedermayer
79ea2bba3f Changelog: update
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-16 12:50:08 +02:00
Lynne
ed18bdeca1 configure: update copyright year
(cherry picked from commit 63505fc60a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-11 23:08:49 +02:00
Michael Niedermayer
c4b50a8c81 update for 3.2.16
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:04:05 +02:00
Michael Niedermayer
af682e4d2e avformat/wavdec: Check smv_block_size
Fixes: Timeout
Fixes: 39554/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-4915221701984256

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 849138f476)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
6d7f466d72 avformat/rmdec: Check for multiple audio_stream_info
Fixes: memleak
Fixes: 39166/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5153276690038784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8fe3566b8f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
5a514d8e9b avcodec/apedec: Use 64bit to avoid overflow
Fixes: runtime error: signed integer overflow: 727298502 * 3 cannot be represented in type 'int'
Fixes: 39172/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-638602483033702

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f059b56195)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
8a904d1475 avcodec/apedec: Fix undefined integer overflow in long_filter_ehigh_3830()
Fixes: signed integer overflow: -2145648640 - 3357696 cannot be represented in type 'int'
Fixes: 38899/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5358815017566208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ad517ee6e4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
2c2eee9a95 oavformat/avidec: Check offset in odml
Fixes: signed integer overflow: 9223372036854775807 + 8 cannot be represented in type 'long'
Fixes: 38787/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-4859845799444480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 255a7b423e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
784f511ff8 avformat/mpegts: use actually read packet size in mpegts_resync special case
Fixes: infinite loop
Fixes: 37986/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5292311517462528 -

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 83b2e4c8f1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
eb5f9b321a swscale/alphablend: Fix slice handling
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 06d6726588)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
608bed85d0 avcodec/mxpegdec: Check for AVDISCARD_ALL
Fixes: Fixes NULL pointer dereference
Fixes: 36610/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-6052641783283712
Fixes: 37907/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-4725170850365440
Fixes: 37904/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-6367889262247936
Fixes: 38085/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-5175270823297024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 20afd3a63a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
aee47eb6e2 avcodec/flicvideo: Check remaining bytes in FLI*COPY
Fixes: Timeout
Fixes: 37795/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-4846536543043584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f835efbca)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
2d766961b0 avcodec/mpeg12dec: Do not put mpeg_f_code into an invalid state on error return
Fixes: invalid shift
Fixes: 37018/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG2VIDEO_fuzzer-5290280902328320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5a95abcce4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
4c6e3e4cf7 avcodec/apedec: Fix integer overflow in intermediate
Fixes: signed integer overflow: 559334865 * 4 cannot be represented in type 'int'
Fixes: 37929/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6751932295806976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 90da43557f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
e9f4bf74f4 avformat/mvdec: Do not set invalid sample rate
Fixes: signed integer overflow: -682581959642593728 * 16 cannot be represented in type 'long'
Fixes: 37883/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5311691517198336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 737e6bf216)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
b1172139b1 avformat/rmdec: Use 64bit for intermediate for DEINT_ID_INT4
Fixes: runtime error: signed integer overflow: 65312 * 65535 cannot be represented in type 'int'
Fixes: 32832/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-4817710040088576

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e2c2872393)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
58dcbde8d9 avformat/jacosubdec: Check for min in t overflow in get_shift()
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 34651/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-5157941012463616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 989febfbd0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
cc3641c669 avformat/mxfdec: check channel number in mxf_get_d10_aes3_packet()
Fixes: Out of array access
Fixes: 37030/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5387719147651072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3dd5a8a135)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
James Almer
94551f3197 avcodec/utils: don't return negative values in av_get_audio_frame_duration()
In some extrme cases, like with adpcm_ms samples with an extremely high channel
count, get_audio_frame_duration() may return a negative frame duration value.
Don't propagate it, and instead return 0, signaling that a duration could not
be determined.

Fixes ticket #9312

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit e01d306c64)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
891bf1f8ad avcodec/jpeg2000dec: Check that atom header is within bytsetream
Fixes: Infinite loop
Fixes: 36666/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5912760671141888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3c659f8618)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
e6565c33a1 avcodec/apedec: Fix 2 integer overflows in filter_3800()
Fixes: signed integer overflow: 1683879955 - -466265224 cannot be represented in type 'int'
Fixes: 37419/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6074294407921664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 33feb527ff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Martin Storsjö
20d93dd9e8 network: Define ENOTCONN as WSAENOTCONN if not defined
This fixes compilation with old mingw.org toolchains, which has got
much fewer errno.h entries.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 6569e9505c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
a526545554 avcodec/mjpegdec: Check for bits left in mjpeg_decode_scan_progressive_ac()
Fixes: Timeout
Fixes: 36262/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-4969052454912000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 909faca929)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
maryam ebrahimzadeh
8028e18988 avformat/adtsenc: return value check for init_get_bits in adts_decode_extradata
As the second argument for init_get_bits (buf) can be crafted, a return value check for this function call is necessary.
'buf' is  part of  'AVPacket pkt'.
replace init_get_bits with init_get_bits8.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9ffa49496d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
41d43bf610 avcodec/webp: Check available space in loop in decode_entropy_coded_image()
Fixes: Timeout
Fixes: 35401/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WEBP_fuzzer-5714401821851648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5e00eab611)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
3b8f82d437 avcodec/vc1dec: ff_print_debug_info() does not support WMV3 field_mode
Fixes: out of array read
Fixes: 36331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-5140494328922112.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c59b5e3d1e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
492318cb65 avcodec/frame_thread_encoder: Free AVCodecContext structure on error during init
Fixes: MemLeak
Fixes: 8281
Fixes: PoC_option158.jpg
Fixes: CVE-2020-22037

Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7bba0dd638)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
161750d194 avcodec/faxcompr: Check for end of input in cmode == 1 in decode_group3_2d_line()
Fixes: Infinite loop
Fixes: 35591/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4503764022198272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f803635c4f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
5b2d8401a5 avcodec/vc1dec: Disable error concealment for *IMAGE
The existing error concealment makes no sense for the image formats, they
use transformed source images which is different from keyframe + MC+difference
for which the error concealment is designed.
Of course feel free to re-enable this if you have a case where it works and
improves vissual results

Fixes: Timeout
Fixes: 36234/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-6300306743885824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 643b2d49bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
bd071f6ee0 avcodec/sbrdsp_fixed: Fix negation overflow in sbr_neg_odd_64_c()
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 35593/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5182217725804544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8f2856a1da)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
0f110f0227 avformat/wtvdec: Check for EOF before seeking back in parse_media_type()
Fixes: Infinite loop
Fixes: 36311/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-4889181296918528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 89505d38de)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
ca1c3e2adb avformat/wavdec: Use 64bit in new_pos computation
Fixes: signed integer overflow: 129 * 16711680 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-6742285317439488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9b57d2f0a9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
f3fc9e0fe4 avformat/sbgdec: Check for overflow in timestamp preparation
Fixes: signed integer overflow: 9223372036854775807 + 86400000000 cannot be represented in type 'long'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6731040263634944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9dbed90840)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
d1dc6b0858 avformat/dsicin: Check packet size for overflow
Fixes: signed integer overflow: 24672 + 2147483424 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_DSICIN_fuzzer-6731325979623424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9d1c47ec03)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
2793fdfb24 avformat/bfi: check nframes
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_BFI_fuzzer-6737028768202752

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b4e77dfca1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
09ffdfbd68 avformat/avidec: fix position overflow in avi_load_index()
Fixes: signed integer overflow: 9223372033098784808 + 4294967072 cannot be represented in type 'long'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6732488912273408

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 527821a2dd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
d678a0e492 avformat/asfdec_f: Check sizeX against padding
Fixes: signed integer overflow: 2147483607 + 64 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-6753897878257664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f034c2e36a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
15c03a7d34 avformat/aiffdec: Check for size overflow in header parsing
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6723467048255488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bae2e19777)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
957d98934d avcodec/aaccoder: Add minimal bias in search_for_ms()
Fixes: floating point division by 0
Fixes: Ticket8218

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 75a099fc73)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
935e455ce4 avfilter/vf_mestimate: Check b_count
Fixes: left shift of negative value -1
Fixes: Ticket8270

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 06af6e101b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
3d628cae56 avformat/mov: do not ignore errors in mov_metadata_hmmt()
Fixes: Timeout
Fixes: 35637/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6311060272447488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c52c99a18f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
97d06e6d60 avformat/mxfdec: Check size for shrinking
av_shrink_packet() takes int size, so size must fit in int
Fixes: out of array access
Fixes: 35607/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4875541323841536

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 65b862ab59)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
maryam ebr
eeda5a1bd4 avcodec/dnxhddec: check and propagate function return value
Similar to CVE-2013-0868, here return value check for 'init_vlc' is needed.
crafted DNxHD data can cause unspecified impact.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 7150f95756)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
f5706ceea8 swscale/slice: Fix wrong return on error
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7874d40f10)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
f596962a33 swscale/slice: Check slice for allocation failure
Fixes: null pointer dereference
Fixes: alloc_slice.mp4

Found-by: Rafael Dutra <rafael.dutra@cispa.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 997f9cfc12)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
4428bd5366 avformat/matroskadec: Fix handling of huge default durations
Fixes: negation of -9223372036854775808 cannot be represented in type 'int64_t' (aka 'long'); cast to an unsigned type to negate this value to itself
Fixes: 33997/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6752039691485184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 343d950a4a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
a44e327a89 avcodec/lpc: check for zero err in normalization in compute_lpc_coefs()
Fixes: floating point division by 0
Fixes: Ticket8213

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 70874e024a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
78ece38bc0 avformat/ftp: Check for av_strtok() failure
Fixes: CID1396258 Dereference null return value

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9d40782088)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
2d14096d63 tools/cws2fws: Check read() for failure
Fixes: CID1452579 Argument cannot be negative

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0b3cdd7cc2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
3fc0ffdf4f avcodec/cpia: Fix missing src_size update
Fixes: out of array read
Fixes: 35210/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CPIA_fuzzer-5669199688105984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cea05864e6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
ff1bb8ce6b avcodec/utils: Use 64bit for intermediate in AV_CODEC_ID_ADPCM_THP* duration calculation
Fixes: signed integer overflow: 486539264 * 14 cannot be represented in type 'int'
Fixes: 35281/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-6068262742917120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 00ae9b77ef)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
3b7ece0fcc avformat/rmdec: Check old_format len for overflow
Maybe such large values could be disallowed earlier and closer to where
they are set.

Fixes: signed integer overflow: 538976288 * 8224 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6704350354341888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 06d174e289)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
0233d6c829 avformat/realtextdec: Check the pts difference before using it for the duration computation
Fixes: signed integer overflow: 5404200000 - -9223372031709351616 cannot be represented in type 'long'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_REALTEXT_fuzzer-6737340551790592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fe12aa6890)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
115621acb2 avformat/qcp: Avoid negative nb_rates
Fixes: signed integer overflow: 2 * -1725947872 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_QCP_fuzzer-6726807632084992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b865cc703)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
59971fee9c avformat/nutdec: Check tmp_size
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6739990530883584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1ca00b5e44)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
a971e35df1 avformat/msf: Check that channels doesnt overflow during extradata construction
Fixes: signed integer overflow: 2048 * 1122336 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_MSF_fuzzer-6726959600107520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a1a277926b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
4748d46ab3 avformat/mpc8: Check for position overflow in mpc8_handle_chunk()
Fixes: signed integer overflow: 15 + 9223372036854775796 cannot be represented in type 'long'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6723520756318208
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6739833034768384

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8ef25d1182)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
d8b0f5a2c0 avformat/iff: Use 64bit in duration computation
Fixes: signed integer overflow: 588 * 16719904 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6748331936186368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 93d964689c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
035ff41b71 avformat/dxa: Check fps to be within the supported range more precissely
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: assertion failure
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-6744985740378112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6ea494befc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
41035de57e avcodec/iff: Only write palette to plane 1 if its PAL8
Fixes: null pointer passed as argument 1, which is declared to never be null
Fixes: 33791/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5107575256383488.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 216eb60b85)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
e992d0668d avformat/tta: Check for EOF in index reading loop
Fixes: OOM
Fixes: 33585/clusterfuzz-testcase-minimized-ffmpeg_dem_TTA_fuzzer-4564665830080512

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b72d657b73)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:21 +02:00
Michael Niedermayer
bfa1895472 Update missed irc links
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c067d20177)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
33dabdc8a7 avformat/rpl: The associative law doesnt hold for signed integers in C
Add () to avoid undefined behavior
Fixes: signed integer overflow: 9223372036854775790 + 57 cannot be represented in type 'long'
Fixes: 34983/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-5765822923538432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 480f11bdd7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
219839f311 avcodec/faxcompr: Check available bits in decode_uncompressed()
Fixes: Timeout
Fixes: 34950/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5686764151898112
Fixes: 34966/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4587409334468608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ff56c139e0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
1eaabed791 avcodec/faxcompr: Check if bits are available before reading in cmode == 9 || cmode == 10
Fixes: Timeout
Fixes: 34950/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5686764151898112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7d8421e3d5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
222fc50dbb avcodec/utils: do "calc from frame_bytes, channels, and block_align" in 64bit
Fixes: signed integer overflow: 104962766 * 32 cannot be represented in type 'int'
Fixes: 33614/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-6252129036664832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3447979d08)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
a393000d6d avcodec/ttadata: Add sentinel at the end of ff_tta_shift_1
Fixes: out of array access
Fixes: 34933/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5629322560929792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dbbcfbcc4e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
e8eeabea99 avfilter/vf_dctdnoiz: Check threads
Fixes: floating point division by 0
Fixes: Ticket 8269

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4a3917c02c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
366e80698e avfilter/vf_ciescope: Fix undefined behavior in rgb_to_xy() with black
Fixes: floating point division by 0
Fixes: undefined behavior in handling NaN
Fixes: Ticket 8268

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3d500e62f6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
300a9ab2eb avformat/rpl: Check for EOF and zero framesize
Fixes: Infinite loop
Fixes: 34751/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-5439330800762880
Fixes: 34774/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-5851571660390400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a0a4a527c3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
6bb993761e avcodec/vc2enc: Check for non negative slice bounds
Fixes: invalid shifts
Fixes: Ticket 8221

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f7862e8268)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
a9919e7f1f avformat/rpl: Use 64bit in bitrate computation and check it
Fixes: signed integer overflow: 777777776 * 4 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-6726188921913344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 29b244ffc1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
0a0fc56d14 avcodec/svq1enc: Do not print debug RD value before it has been computed
Avoids floating point division by 0

Fixes: Ticket8191

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c297f7e57a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
799c7b73d8 avcodec/aacpsy: Check bandwidth
Fixes: Ticket8011

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 36dead4bc2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
00a14cfeb2 avcodec/aacenc: Do not divide by lambda_count if it is 0
Avoids Floating point division by 0

Fixes: Ticket8011

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c520b98691)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
162f4df07b avcodec/aacenc: Use FLT_EPSILON for lambda minimum
(cherry picked from commit 4b89cf7aa4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
a7c3cfd8ea avfilter/vf_yadif: Fix handing of tiny images
Fixes: out of array access
Fixes: Ticket8240
Fixes: CVE-2020-22021

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7971f62120)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bb08ee0c6fb7bdebd37cbf00aefed206909e8f78)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
64602be17d avformat/cinedec: Fix index_entries size check
Fixes: out of array access
Fixes: 29868/clusterfuzz-testcase-minimized-ffmpeg_dem_CINE_fuzzer-5692001957445632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
ef75363a43 avformat/movenc: Check pal_size before use
Fixes: assertion failure
Fixes: out of array read
Fixes: Ticket8190
Fixes: CVE-2020-22015

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4c1afa2925)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
a6dc7ba0ec avcodec/lpc: Avoid floating point division by 0
Fixes: Ticket7996
Fixes: CVE-2020-20445

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 38d18fb578)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
f5d0848098 avcodec/aacpsy: Avoid floating point division by 0 of norm_fac
Fixes: Ticket7995
Fixes: CVE-2020-20446

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 223b5e8ac9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
d6737266a9 avcodec/aacenc: Avoid 0 lambda
Fixes: Ticket8003
Fixes: CVE-2020-20453

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a7a7f32c8a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
68d77a5580 avcodec/exr: x/ymax cannot be INT_MAX
The code uses x/ymax + 1 so the maximum is INT_MAX-1

Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 33158/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5545462457303040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 48342aa075)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
4588d46c37 avformat/avio: Check av_opt_copy() for failure
Fixes: CID1477416 Unchecked return value

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f8611ae1ef)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
9c85898056 avcodec/vc1: Check remaining bits in ff_vc1_parse_frame_header()
Fixes: Timeout
Fixes: 33156/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-6259655027326976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 38c4761588)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
75b816f2c4 avformat/mov: Limit nb_chapter_tracks to input size
Fixes: Timeout (15k loop iterations instead of 400m)
Fixes: 31368/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6601583174483968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 299a56c900)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
29052446dc avformat/mvdec: Check sample rate in parse_audio_var()
Fixes: signed integer overflow: -635424002382840000 * 16 cannot be represented in type 'long'
Fixes: 33612/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5704741108711424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ff60249a5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
6838715c82 avcodec/faxcompr: Check for end of bitstream in decode_group3_1d_line() and decode_group3_2d_line()
Fixes: infinite loop
Fixes: 33674/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4816457818046464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 08d2df4153)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
8fd09b2f34 avcodec/utils: treat PAL8 for jpegs similar to other colorspaces
Fixes: out of array access
Fixes: 33713/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5778775641030656
Fixes: 33717/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-4960397238075392
Fixes: 33718/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-5314270096130048.fuzz
Fixes: 33719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5352721864589312
Fixes: 33721/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-5938892055379968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f0ce023ddb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
241b505b0c avcodec/jpeglsdec: Set alpha plane in PAL8 so image is not 100% transparent
Fixes: tickets/3933/128.jls

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 011006874c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
bb46e9cc84 avformat/id3v2: Check end for overflow in id3v2_parse()
Fixes: signed integer overflow: 9223372036840103978 + 67637280 cannot be represented in type 'long'
Fixes: 33341/clusterfuzz-testcase-minimized-ffmpeg_dem_DSF_fuzzer-6408154041679872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit efdb564504)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
17836637db avformat/wtvdec: Improve size overflow checks in parse_chunks()
Fixes: signed integer overflow: 32 + 2147483647 cannot be represented in type 'int
Fixes: 32967/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5132856218222592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f8ec1da8ac)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
0ccbac1ee8 avcodec/faxcompr: Check remaining bits on error in decode_group3_1d_line()
Fixes: Timeout
Fixes: 32886/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4779761466474496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7b3881f0da)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
facc1ef12b avcodec/utils: Check ima wav duration for overflow
Fixes: signed integer overflow: 44331634 * 65 cannot be represented in type 'int'
Fixes: 32120/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-5760221223583744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f40e9b1355)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
1e3e8daece avformat/cafdec: Check channels
Fixes: signed integer overflow: -1184429040541376544 * 32 cannot be represented in type 'long'
Fixes: 31788/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6236746338664448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 641c1db22b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
3f69b4640f avcodec/dpx: Check bits_per_color earlier
Fixes: shift exponent 251 is too large for 32-bit type 'int'
Fixes: 32147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DPX_fuzzer-5519111675314176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c093eb3031)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
57685d44ee avcodec/pnm_parser: Check image size addition for overflow
Fixes: assertion failure
Fixes: out of array access
Fixes: 32664/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-6533642202513408.fuzz
Fixes: 32669/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-6001928875147264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 79ac8d5546)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
1ac6969517 avformat/rmdec: use larger intermediate type for audio_framesize * sub_packet_h check
Fixes: signed integer overflow: 65535 * 65535 cannot be represented in type 'int'
Fixes: 31406/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5024692843970560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cf2fd9204b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
eca0a942ea avcodec/h264_slice: Check input SPS in ff_h264_update_thread_context()
Fixes: crash
Fixes: check_pkt.mp4

Found-by: Rafael Dutra <rafael.dutra@cispa.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ceae92cb29)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
c5a26f4511 avcodec/mpegvideo: Update chroma_?_shift in ff_mpv_common_frame_size_change()
Fixes: out of array access
Fixes: 31201/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4627865612189696.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 87d87e6587)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
752fa02287 avformat/mov: Ignore multiple STSC / STCO
Fixes: STSC / STCO inconsistency and assertion failure
Fixes: crbug1184666.mp4

Found-by: Chromium ASAN fuzzer
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2611d20d35)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
63f7a6310b avformat/utils: Extend overflow check in dts wrap in compute_pkt_fields()
Fixes: signed integer overflow: -9223372032574480351 - 4294967296 cannot be represented in type 'long long'
Fixes: 30022/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5568610275819520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b37ff29e0e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
8e1d958610 avfilter/vf_scale: Fix adding 0 to NULL (which is UB) in scale_slice()
Found-by: Jeremy Leconte <jleconte@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1cf96ce269)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
fcd8bfa3b9 avutil/common: Add FF_PTR_ADD()
Suggested-by: Andreas Rheinhardt
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 522a5259e9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
bda74d0f20 avformat/wtvdec: Check size in SBE2_STREAM_DESC_EVENT / stream2_guid
Fixes: signed integer overflow: 539033600 - -1910497124 cannot be represented in type 'int'
Fixes: 30928/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5922630966312960

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1f74661543)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
88627638d5 avformat/cafdec: Do not build an index if all packets are the same
Fixes: Timeout
Fixes: 28214/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6495999421579264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ea12590c8e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
5079967d37 avcodec/sonic: Use unsigned temporary in predictor_calc_error()
Fixes: signed integer overflow: -2147471366 - 18638 cannot be represented in type 'int'
Fixes: 30157/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5171199746506752

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 075d793ba8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
a2b7f4a101 avformat/flvdec: Check array entry number
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 30209/clusterfuzz-testcase-minimized-ffmpeg_dem_FLV_fuzzer-5724831658147840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b5d8fe1c87)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
698d23aebf avcodec/h264_slice: Check sps in h264_slice_header_init()
Fixes: null pointer dereference
Fixes: h264_slice_header_init.mp4

Found-by: Rafael Dutra <rafael.dutra@cispa.de>
Tested-by: Rafael Dutra <rafael.dutra@cispa.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8047243899)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
bf8e7c2b17 avformat/movenc: Avoid loosing cluster array on failure
Fixes: crash
Fixes: check_pkt.mp4

Found-by: Rafael Dutra <rafael.dutra@cispa.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5c2ff44f91)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
92049dc205 avformat/avidec: Check for dv streams before using priv_data in parse ##dc/##wb
Fixes: null pointer dereference
Fixes: 31588/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6165716135968768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f733688d30)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
134e261b99 avformat/mov: Check sample size for overflow in mov_parse_stsd_audio()
Fixes: signed integer overflow: 2 * 1914708000 cannot be represented in type 'int'
Fixes: 31639/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6303428239294464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d35677736a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
9a261e5681 avcodec/ffwavesynth: Avoid signed integer overflow in phi_at()
Fixes: signed integer overflow: 2314885530818453536 - -9070214327174160352 cannot be represented in type 'long'
Fixes: 31000/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-6558389742206976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit be08b84f8b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
77cab29a28 avcodec/mpeg4videoenc: Check extradata malloc()
Fixes: Null pointer dereference
Fixes: any mpeg4 testcase which fails the malloc at that exact spot

Found-by: Rafael Dutra <rafael.dutra@cispa.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 33a1687bf6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
b2d4f33fd4 avformat/matroskadec: Check for EOF in resync loop
Fixes: Timeout (too long -> instantly)
Fixes: 29136/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4586141227548672

Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5282147d0c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
81e27dc15b avcodec/utils: Use more bits for intermediate for AV_CODEC_ID_ADPCM_MS
Fixes: signed integer overflow: 1172577312 * 2 cannot be represented in type 'int'
Fixes: 29924/clusterfuzz-testcase-minimized-ffmpeg_dem_BOA_fuzzer-4882912874594304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0f441b9063)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
c13d2e47de avcodec/jpegls: Check A[Q] for overflow in ff_jpegls_update_state_regular()
Fixes: Timeout
Fixes: 30912/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5556235476795392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8a3fea802a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
88974483a4 avutil/timecode: Avoid fps overflow
Fixes: Integer overflow and division by 0
Fixes: poc-202102-div.mov

Found-by: 1vanChen of NSFOCUS Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c94875471e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
2d0320b7af avformat/mvi: Check audio size for more overflows
Fixes: left shift of negative value -352256000
Fixes: 30837/clusterfuzz-testcase-minimized-ffmpeg_dem_MVI_fuzzer-5755626262888448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 403b35e16e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
d446934d39 avcodec/ffv1dec: Check if trailer is available
Fixes: out of array read
Fixes: 29750/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-4808377272238080.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 36ad2f41e3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
6f7af297c6 avcodec/4xm: Check pre_gb in decode_i_block()
Fixes: Timeout
Fixes: 31257/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5150866229297152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b87781649e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
fcab70315c avcodec/dcadsp: Fix integer overflow in dmix_add_c()
Fixes: signed integer overflow: 1515225320 + 759416059 cannot be represented in type 'int'
Fixes: 29256/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DCA_fuzzer-5719088561258496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b4ebf483bc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
693dbc30a5 avformat/flvdec: Check double before cast in parse_keyframes_index()
Fixes: -2.21166e+304 is outside the range of representable values of type 'long'
Fixes: 29169/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5725452796821504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 09e5e406c7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
3374ed3d42 avformat/paf: Check for EOF before allocation in read_header()
Fixes: OOM
Fixes: 26584/clusterfuzz-testcase-minimized-ffmpeg_dem_PAF_fuzzer-5172661183053824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bcb1e9d3b9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
cf8a7b7b4e avcodec/aacdec_template: Avoid undefined negation in imdct_and_windowing_eld()
Fixes: negation of -2147483648 cannot be represented in type 'INTFLOAT' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: 29057/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5642758933053440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 633924539a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
737803535f avformat/lxfdec: Fix multiple integer overflows related to track_size
Fixes: signed integer overflow: 538976288 * 8 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_LXF_fuzzer-6634030636335104

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7819412f44)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
5310bf2493 avformat/aiffdec: Check that SSND is at least 8 bytes
Fixes: Infinite loop
Fixes: 30874/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-5933710488764416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 460d3dc41f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
be7d80bc43 avformat/dcstr: Check sample rate
Fixes: signed integer overflow: -1300248894420254720 * 16 cannot be represented in type 'long'
Fixes: 30879/clusterfuzz-testcase-minimized-ffmpeg_dem_DCSTR_fuzzer-5094464215449600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fdcb966f4a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
c97f77e407 avcodec/alsdec: Check bitstream input in read_block()
Fixes: Timeout
Fixes: 28110/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5036338973507584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 53d739db4e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
ea95ff0a08 avformat/mov: Extend data_size check in mov_read_udta_string()
Fixes: signed integer overflow: -2147483634 - 16 cannot be represented in type 'int'
Fixes: 28322/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5711888402612224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 74c4c53953)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
70bb5c2a25 avformat/voc_packet: Add a basic check on max_size
Fixes: signed integer overflow: -2147483648 - 4 cannot be represented in type 'int'
Fixes: 28127/clusterfuzz-testcase-minimized-ffmpeg_dem_VOC_fuzzer-4880586455646208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 52f75181bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
52022eec69 avformat/microdvddec: use 64bit for durations
Fixes: signed integer overflow: 7 - -2147483647 cannot be represented in type 'int'
Fixes: 28036/clusterfuzz-testcase-minimized-ffmpeg_dem_MICRODVD_fuzzer-5171698751766528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f569ac4ce0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
6173ca00f7 avcodec/hapdec: Change compressed_offset to unsigned 32bit
Fixes: out of array access
Fixes: 29345/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5401813482340352
Fixes: 30745/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5762798221131776

Suggested-by: Anton
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 89fe1935b1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
86e3f06eec avformat/rmdec: Check codec_length without overflow
Fixes: signed integer overflow: 2147483647 + 64 cannot be represented in type 'int'
Fixes: 30333/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-5175286983426048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d558c9f237)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
7efc9ebf08 avformat/mov: Check element count in mov_metadata_hmmt()
Fixes: Timeout
Fixes: 30325/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6048395703746560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1d277b92fa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
c9243ed1fd avformat/nutdec: Check timebase count against main header length
Fixes: Timeout (long -> 3ms)
Fixes: 28514/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6078669009321984
Fixes: 30095/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-5074433016463360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c425198558)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
f9ab9bfe4e avformat/electronicarts: Clear partial_packet on error
Fixes: Infinite loop
Fixes: 30165/clusterfuzz-testcase-minimized-ffmpeg_dem_EA_fuzzer-6224642371092480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 59bb9dc2a6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
e5dac88184 avformat/r3d: Check samples before computing duration
Fixes: signed integer overflow: -4611686024827895807 + -4611686016279904256 cannot be represented in type 'long'
Fixes: 30161/clusterfuzz-testcase-minimized-ffmpeg_dem_R3D_fuzzer-5694406713802752

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7a2aa5dc2a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
b3a9f2dfbf avformat/wavdec: Consider AV_INPUT_BUFFER_PADDING_SIZE in set_spdif()
The buffer is read by using the bit reader
Fixes: out of array read
Fixes: 27539/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-5650565572591616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0a7c648e2d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
0146375f9a avcodec/pnm_parser: Check av_image_get_buffer_size() for failure
Fixes: out of array access
Fixes: 30135/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PBM_fuzzer-4997145650397184
Fixes: 30208/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-5605891665690624.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5314a4996c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
de6e245fce avformat/rmdec: Check remaining space in debug av_log() loop
Fixes: Timeout (long -> 2 ms)
Fixes: 26709/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5665833403285504
Fixes: 27522/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-6321071221112832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a8fe78decd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
67c197abaf avformat/flvdec: Treat high ts byte as unsigned
Fixes: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 27516/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5152854660349952

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f514113cfa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
7ac3fadfa7 avformat/samidec: Sanity check pts
Fixes: signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'long'
Fixes: 29743/clusterfuzz-testcase-minimized-ffmpeg_dem_SAMI_fuzzer-5499256859394048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2014b01352)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
752575d953 avformat/avidec: Use 64bit in get_duration()
Fixes: signed integer overflow: 2147483424 + 8224 cannot be represented in type 'int'
Fixes: 29619/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5191424373030912

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a0ceb0cdd4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
44919d079c avformat/mvdec: Check for EOF in read_index()
Fixes: Timeout
Fixes: 29550/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5094307193290752

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6c64351bb1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
ecf7cb4579 avcodec/jpeglsdec: Fix k=16 in ls_get_code_regular()
Fixes: Timeout
Fixes: left shift of 33046 by 16 places cannot be represented in type 'int'
Fixes: 29258/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-4889231489105920
Fixes: 29515/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-6161940391002112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 980900d991)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
d474fa3e3c avformat/id3v2: Check the return from avio_get_str()
Fixes: out of array access
Fixes: 29446/clusterfuzz-testcase-minimized-ffmpeg_dem_AAC_fuzzer-5096222622875648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 25f240fcb3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
d472de012a avcodec/hevc_sei: Check payload size in decode_nal_sei_message()
Fixes: out of array access
Fixes: 29392/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4821602850177024.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0791a515d3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
4fd805a2ae libavutil/eval: Remove CONFIG_TRAPV special handling
Fixes: division by zero
Fixes: 29555/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVO_fuzzer-5149951447400448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8574fcbfc7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
439d8ae684 avformat/wtvdec: Check len in parse_chunks() to avoid overflow
Fixes: signed integer overflow: 2147483647 + 7 cannot be represented in type 'int'
Fixes: 30084/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-6192261941559296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5552ceaf56)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
1be3f57841 avformat/asfdec_f: Add an additional check for the extradata size
Fixes: OOM
Fixes: 30066/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-6182309126602752

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2c8cd4490a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
099130c0cd avformat/3dostr: Check sample_rate
Fixes: signed integer overflow: -1268324762623155200 * 8 cannot be represented in type 'long'
Fixes: 30123/clusterfuzz-testcase-minimized-ffmpeg_dem_THREEDOSTR_fuzzer-6710765123928064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7e5034f97e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
d38f2e23e5 avformat/4xm: Make audio_frame_count 64bit
Fixes: signed integer overflow: 2099257366 * 2 cannot be represented in type 'int'
Fixes: 27486/clusterfuzz-testcase-minimized-ffmpeg_dem_FOURXM_fuzzer-5112179134824448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 842c268c64)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
2c72722ffc avformat/mov: Use av_mul_q() to avoid integer overflows
Fixes: signed integer overflow: 538976288 * 538976288 cannot be represented in type 'int'
Fixes: 27473/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5758978289827840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4f70e1ec0c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
e2bd33c8de avcodec/vp9dsp_template: Fix integer overflows in itxfm_wrapper
Fixes: signed integer overflow: 2147483641 + 32 cannot be represented in type 'int'
Fixes: 27452/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5078752576667648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4dfb7ff528)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
8b0386154a avformat/rmdec: Reorder operations to avoid overflow
Fixes: signed integer overflow: -2147483648 - 14 cannot be represented in type 'int'
Fixes: 27659/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-5697250168406016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b12e713b80)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
4fdb414590 avcodec/mxpegdec: fix SOF counting
Fixes: Timeout (>10sec -> 15ms)
Fixes: 27652/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-5125920868007936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 401495def6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
5ef9f6e6e3 avcodec/rscc: Check inflated_buf size whan it is used
Fixes: out of array access
Fixes: 27434/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RSCC_fuzzer-5196757675540480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit a5ed6da9bd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
00cc2e7df2 avformat/mvdec: Sanity check SAMPLE_WIDTH
Fixes: signed integer overflow: 999999999 * 8 cannot be represented in type 'int'
Fixes: 30048/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5864289917337600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ab82c10578)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
6180a967b7 avformat/rmdec: Fix codecdata_length overflow check
Fixes: signed integer overflow: 2147483647 + 64 cannot be represented in type 'int'
Fixes: 28509/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-6310969680723968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3c41d0bfd6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
68b034625c avcodec/simple_idct: Fix undefined integer overflow in idct4row()
Fixes: signed integer overflow: -1498310196 - 902891776 cannot be represented in type 'int'
Fixes: 28445/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5075163389493248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 57f7e5caa3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
7ec328d53c avformat/tta: Use 64bit intermediate for index
Fixes: signed integer overflow: 42032 * 51092 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_TTA_fuzzer-6679539648430080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fd61b42b4c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
a4fc719fc5 avformat/soxdec: Check channels to be positive
Fixes: signed integer overflow: 32 * -1795162112 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_SOX_fuzzer-6724151473340416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b0588b73da)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
05efd2ec5c avcodec/vp3: Check input amount in theora_decode_header()
Fixes: Timeout
Fixes: 29226/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-6195092572471296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 869fe41d10)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
e59cb0f33a avformat/wavdec: Check avio_get_str16le() for failure
Fixes: out of array access
Fixes: 29195/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5037853281222656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d7594ee751)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
2ed03339c3 avformat/flvdec: Check for EOF in amf_skip_tag()
Fixes: Timeout
Fixes: 29070/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5650106766458880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9725d07a17)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
e537ef1a0d avformat/aiffdec: Check size before subtraction in get_aiff_header()
Fixes: Infinite loop
Fixes: 27235/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-5761398380167168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8af299acde)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
a2c10d3b2a avformat/electronicarts: More chunk_size checks
Fixes: Timeout
Fixes: 26909/clusterfuzz-testcase-minimized-ffmpeg_dem_EA_fuzzer-6489496553783296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d03f0ec9a1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
a09824a0a7 avformat/tedcaptionsdec: Check for overflow in parse_int()
Fixes: signed integer overflow: 1111111111111111111 * 10 cannot be represented in type 'long'
Fixes: 26892/clusterfuzz-testcase-minimized-ffmpeg_dem_TEDCAPTIONS_fuzzer-5756045055754240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b0f8586ca9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
456fccdad6 avformat/mpc8: Check size before implicitly converting to int
Fixes: Timeout
Fixes: 28551/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6229183210586112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 78d6d8ddb5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
56004939a1 avformat/nutdec: Fix integer overflow in count computation
Note, the value is checked a few lines later already

Fixes: signed integer overflow: -440402016 - 1879048064 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6603876618469376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0014249fd9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
f8a147dfde avformat/mvi: Use 64bit for testing dimensions
Fixes: signed integer overflow: 65535 * 65535 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_MVI_fuzzer-6649291124899840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 48fb752767)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
af35cb648a avformat/utils: Check dts in update_initial_timestamps() more
Fixes: signed integer overflow: -9223372036853488158 - 90000000 cannot be represented in type 'long long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_MPSUB_fuzzer-6696625298866176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 29851cb840)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
279b58906d avformat/flvdec: Check for avio_read() failure in amf_get_string()
Suggested-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cb31667611)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
6791fd5c13 avformat/flvdec: Check for nesting depth in amf_skip_tag()
Fixes: out of array access
Fixes: 29440/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5985279812960256.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2ef522c918)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
96d4eaf592 avformat/flvdec: Check for nesting depth in amf_parse_object()
Fixes: out of array access
Fixes: 29202/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5112845840809984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 074e204b42)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
14046c7ba6 avformat/asfdec_o: Check for EOF in asf_read_marker()
Fixes: Timeout
Fixes: 26460/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-5710884393189376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9e3d09f435)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
463cbe5067 avformat/utils: Check dts - (1<<pts_wrap_bits) overflow
Fixes: signed integer overflow: -9223372036842389247 - 2147483648 cannot be represented in type 'long long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_FLV_fuzzer-4845007531671552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d82ee907d6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
1e44c44cd4 avformat/bfi: Check chunk_header
Fixes: signed integer overflow: -2147483648 - 3 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_BFI_fuzzer-6665764123836416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 638a151a87)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
55658df3d1 avformat/ads: Check size
Fixes: signed integer overflow: -2147483616 - 64 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_ADS_fuzzer-6617769344892928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c78b2b138c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
349a1d01c5 avformat/iff: Check block align also for ID_MAUD
Fixes: Timeout & OOM
Fixes: 28701/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5185094964871168
Fixes: 29116/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4874284795297792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b17ffe8f8f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
e37c5f6d6a avcodec/utils: Check for integer overflow in get_audio_frame_duration() for ADPCM_DTK
Fixes: signed integer overflow: 131203586 * 28 cannot be represented in type 'int'
Fixes: 26817/clusterfuzz-testcase-minimized-ffmpeg_dem_MSF_fuzzer-6296902548848640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2488ba85a0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
95671d383f avformat/mxfdec: Fix integer overflow in next position in mxf_read_local_tags()
Fixes: signed integer overflow: 9223372036854775723 + 8192 cannot be represented in type 'long'
Fixes: 29072/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4812604904177664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d3d9b1fc8e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
d558c0cae0 avformat/avidec: dv does not support palettes
Fixes: memleak
Fixes: 26937/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5763003338981376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b373b41d9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
b5a1384287 libavformat/utils: consider avio_size() failure in ffio_limit()
Fixes: Timeout (>20sec -> 3ms)
Fixes: 26918/clusterfuzz-testcase-minimized-ffmpeg_dem_THP_fuzzer-5750425191710720

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b1dac2716)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
65dd97ac32 avformat/asfdec_o: Check size vs. offset in detect_unknown_subobject()
Fixes: signed integer overflow: 2314885530818453566 + 7503032301549264928 cannot be represented in type 'long'
Fixes: 26639/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6024222100684800

Alternatively this could be ignored but then the end condition of the loop
would be hard to reach as avio_tell() is int64_t

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0bee216ad4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
ac301bcf8e avformat/utils: check for integer overflow in av_get_frame_filename2()
Fixes: signed integer overflow: 317316873 * 10 cannot be represented in type 'int'
Fixes: 24708/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5731180885049344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 03c479ce23)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
090893695e avutil/timecode: Avoid undefined behavior with large framenum
Fixes: signed integer overflow: 2147462079 + 2149596 cannot be represented in type 'int'
Fixes: 27565/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5091972813160448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b19057396)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
fa3dc72efc avformat/sbgdec: Reduce the amount of floating point in str_to_time()
Fixes: 1e+75 is outside the range of representable values of type 'long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6626834808700928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ac6c8993f7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
bdfb379795 avformat/mxfdec: Free all types for both Descriptors
Fixes: memleak
Fixes: 26352/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5201158714687488

Suggested-by: Tomas Härdin <tjoppen@acc.umu.se>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 88519be8db)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
8715db6e6d uavformat/rsd: check for EOF in extradata
Fixes: OOM
Fixes: 26503/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-6530816735444992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7186ec88b9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
c9138413c9 avcodec/wmaprodec: Check packet size
Fixes: left shift of negative value -25824
Fixes: 27754/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA2_fuzzer-5760255962906624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 69aeba8a19)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
981624face avformat/mpegts: Fix argument type for av_log
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 654b21ef17)
2021-10-09 22:02:20 +02:00
Michael Niedermayer
d53d36e93d avformat/cafdec: clip sample rate
Fixes: 1.21126e+111 is outside the range of representable values of type 'int'
Fixes: 27398/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5412960339755008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 684aec6a68)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
6cdbedbfb7 avcodec/ffv1dec: Fix off by 1 error with quant tables
Fixes: assertion failure
Fixes: 28447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-5369575948550144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5cae71d2b7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
10b493af68 avformat/mpegts: Increase pcr_incr width to 64bit
Fixes: division by zero
Fixes: 26459/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5666350112178176
Fixes: 28154/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5195728439476224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ef7b117b7b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
150c66f775 avformat/mov: Check if hoov is at the end
Fixes: Timeout, probably infinite loop
Fixes: 26559/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5391165484171264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0afbaabdca)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
e46b067199 avcodec/hevc_ps: check scaling_list_dc_coef
Fixes: signed integer overflow: 2147483640 + 8 cannot be represented in type 'int'
Fixes: 28449/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5686013259284480

Reviewed-by: James Almer <jamrial@gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f1700bd8bb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
a9fe6abe0a avformat/iff: Check data_size
Fixes: infinite loop
Fixes: 27834/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5694930919620608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 001bc594d8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
fe15426edd avformat/matroskadec: Sanity check codec_id/track type
Fixes: memleak
Fixes: 27766/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-5198300814508032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7b88dd8f0c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:20 +02:00
Michael Niedermayer
a4be820f99 avformat/rpl: Check the number of streams
Fixes: out of memory access
Fixes: 27787/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-4743666463408128.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0677bdb1f5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
896720925a avcodec/h264idct_template: Fix integer overflow in ff_h264_chroma422_dc_dequant_idct()
Fixes: signed integer overflow: -2105540608 - 2105540608 cannot be represented in type 'int'
Fixes: 26870/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5656647567147008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 51dfd6f1bd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
05ca3ac921 avformat/dsfdec: Check block_align more completely
Fixes: infinite loop
Fixes: 26865/clusterfuzz-testcase-minimized-ffmpeg_dem_DSF_fuzzer-5649473830912000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 65b8974d54)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
62ccd6b820 avformat/mpc8: Check remaining space in mpc8_parse_seektable()
Fixes: Fixes infinite loop
Fixes: 26704/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6327056939614208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4f66dd13d0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
5929303897 avformat/id3v2: Sanity check tlen before alloc and uncompress
Fixes: Timeout (>20sec -> 65ms)
Fixes: 26896/clusterfuzz-testcase-minimized-ffmpeg_dem_DAUD_fuzzer-5691024049176576
Fixes: 27627/clusterfuzz-testcase-minimized-ffmpeg_dem_AEA_fuzzer-4907019324358656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d7f87a4b9e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
20a2a36571 avformat/vqf: Check len for COMM chunks
Fixes: Infinite loop
Fixes: 26696/clusterfuzz-testcase-minimized-ffmpeg_dem_VQF_fuzzer-5648269168082944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a834af133b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
4314f97f65 avcodec/hevc_cabac: Limit value in coeff_abs_level_remaining_decode() tighter
The max depth is 16bps, the max allowed coefficient depth is depth+6
Fixes: signed integer overflow: 1074266112 + 1073725439 cannot be represented in type 'int'
Fixes: 26493/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5657763331702784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7cf852b03c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
4622b9359a avformat/cafdec: Check the return code from av_add_index_entry()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9dc3301745)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
b25aae7253 avformat/cafdec: Check for EOF in index read loop
Fixes: OOM
Fixes: 27398/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-541296033975500

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eb46939e3a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
631e300654 avformat/cafdec: Check that bytes_per_packet and frames_per_packet are non negative
These fields are not signed in the spec (1.0) so they cannot be negative
Changing bytes_per_packet to unsigned would not solve this as it is exported
as block_align which is signed

Fixes: Infinite loop
Fixes: 26492/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5632087614554112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5eed718087)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
c9eb3dc486 avformat/mpc8: correct integer overflow in mpc8_parse_seektable()
Fixes: signed integer overflow: -4683718486770919638 * 2 cannot be represented in type 'long'
Fixes: 26704/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6327056939614208
Fixes: 27550/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6259212652642304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0897402ac8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
fe309530ae avformat/mpc8: correct 32bit timestamp truncation
Fixes: left shift of 65536 by 15 places cannot be represented in type 'int'
Fixes: 26801/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-5164313092030464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ad3e495657)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
30102ee94e avcodec/exr: Check ymin vs. h
Fixes: out of array access
Fixes: 26532/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5613925708857344
Fixes: 27443/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5631239813595136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3e5959b345)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
25ed238480 avformat/avs: Use 64bit for the avio_tell() output
Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented in type 'long'
Fixes: 26549/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS_fuzzer-4844306424397824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1278f117d7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
0ce79b95d9 avformat/wavdec: More complete size check in find_guid()
Fixes: signed integer overflow: 9223372036854775807 + 8 cannot be represented in type 'long'
Fixes: 27341/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5442833206738944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a207df2acb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
608bb9814c avformat/iff: Check size before skip
Fixes: Infinite loop
Fixes: 27292/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5731168991051776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8b50e8bc29)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
83e5a77c1d avformat/rmdec: Check for EOF in index packet reading
Fixes: Timeout(>10sec -> 1ms)
Fixes: 27284/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6304211110985728

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ebf4bc629e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
33a82227ad avformat/icodec: Check for zero streams and stream creation failure
Fixes: NULL pointer dereference
Fixes: 26814/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-5758487797432320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b33233bd53)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
de7f2908f1 avformat/icodec: Factor failure code out in read_header()
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 27ee67c00f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
89e148cb81 avformat/bintext: Check width
Fixes: division by 0
Fixes: 26780/clusterfuzz-testcase-minimized-ffmpeg_dem_ADF_fuzzer-5117945027756032
Fixes: 26998/clusterfuzz-testcase-minimized-ffmpeg_dem_ADF_fuzzer-5119352359354368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f6dc285fb5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
64ed3aff37 avformat/sbgdec: Check that end is not before start
Fixes: signed integer overflow: -9223372036854775808 + -5279949906739200 cannot be represented in type 'long'
Fixes: 26908/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6329610851319808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9ef60a66f1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
ecd4013d80 avformat/lvfdec: Check stream_index before use
Fixes: assertion failure
Fixes: 26905/clusterfuzz-testcase-minimized-ffmpeg_dem_LVF_fuzzer-5724267599364096.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b1d99ab14f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
e298bc5980 avformat/au: cleanup on EOF return in au_read_annotation()
Fixes: memleak
Fixes: 26841/clusterfuzz-testcase-minimized-ffmpeg_dem_AU_fuzzer-5174166309044224
Regression since: e680d50eb4
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d16974c3dd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
7a395606a7 avformat/mpegts: Limit copied data to space
Fixes: out of array access
Fixes: 26816/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-6282861159907328.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 79cf7c7191)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
978bc27c61 avformat/bintext: Check width in idf_read_header()
Fixes: division by 0
Fixes: 26802/clusterfuzz-testcase-minimized-ffmpeg_dem_IDF_fuzzer-5180591554953216.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 442d53f409)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
2c45037a25 avformat/iff: check size against INT64_MAX
Bigger sizes are misinterpreted as negative numbers by the API
Fixes: infinite loop
Fixes: 26611/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4890614975692800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f291cd681b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
7769ab9393 avformat/paf: Check for EOF in read_table()
Fixes: OOM
Fixes: 26528/clusterfuzz-testcase-minimized-ffmpeg_dem_PAF_fuzzer-5081929248145408
Fixes: 26584/clusterfuzz-testcase-minimized-ffmpeg_dem_PAF_fuzzer-5172661183053824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 437b7302b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
c9c4b480c6 avformat/gxf: Check pkt_len
Fixes: Infinite loop
Fixes: 26576/clusterfuzz-testcase-minimized-ffmpeg_dem_GXF_fuzzer-4823080360476672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dad9a86ca7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
10cfdf25af avformat/aiffdec: Check packet size
Fixes: Fixes infinite loop
Fixes: 26575/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-5727522236661760

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ba71a72d3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
f1f6d6c861 avformat/concatdec: use av_strstart()
Fixes: out array read
Fixes: 26610/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-5631838049271808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2610acb49a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
021e2b9cf1 avformat/wavdec: Refuse to read chunks bigger than the filesize in w64_read_header()
Fixes: OOM
Fixes: 26414/clusterfuzz-testcase-minimized-ffmpeg_dem_FWSE_fuzzer-5070632544632832
Fixes: 26475/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5770207722995712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7b2244565a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
51cdea6e4f avformat/iff: More completely check body_size
Fixes: infinite loop
Fixes: 26485/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5126561373880320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3588e2e6b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
cf572adb92 avformat/xwma: Check for EOF in dpds_table read code
Fixes: Timeout (>30 -> 140ms)
Fixes: 26478/clusterfuzz-testcase-minimized-ffmpeg_dem_XWMA_fuzzer-5918147066200064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 44b18a76b8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
4ecce5f256 avcodec/utils: Check sample rate before use for AV_CODEC_ID_BINKAUDIO_DCT in get_audio_frame_duration()
Fixes: shift exponent 95 is too large for 32-bit type 'int'
Fixes: 26590/clusterfuzz-testcase-minimized-ffmpeg_dem_SMACKER_fuzzer-5120609937522688

Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ec7e0d4288)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
8206115257 avcodec/dirac_parser: do not offset AV_NOPTS_OFFSET
Fixes: signed integer overflow: -9223372036854775807 - 48000 cannot be represented in type 'long long'
Fixes: 26521/clusterfuzz-testcase-minimized-ffmpeg_dem_DIRAC_fuzzer-5635536506847232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 343c3149ab)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
39d8fb2f67 avformat/rmdec: Make expected_len 64bit
Fixes: signed integer overflow: 1347551268 * 14 cannot be represented in type 'int'
Fixes: 26458/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-5655364324032512

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 728330462c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
5a1cc01fdf avformat/lrcdec: Clip timestamps
Fixes: signed integer overflow: 7111111111111531010 - -7335632962598013506 cannot be represented in type 'long'
Fixes: 26463/clusterfuzz-testcase-minimized-ffmpeg_dem_LRC_fuzzer-6015558333759488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 80bc2ac3c0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
2c6b8fadfc avformat/electronicarts: Check for EOF in each iteration of the loop in ea_read_packet()
Fixes: timeout(>20sec -> 1ms)
Fixes: 26526/clusterfuzz-testcase-minimized-ffmpeg_dem_EA_fuzzer-5672328069120000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 857aba7c45)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
c4b7fbc981 avcodec/vp9dsp_template: Fix some overflows in iadst8_1d()
Fixes: signed integer overflow: 190587 * 11585 cannot be represented in type 'int'
Fixes: 26407/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5086348408782848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bca0735be5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
0abb64d8f3 avformat/jacosubdec: Use 64bit inside get_shift()
Fixes: signed integer overflow: 111111111 * 30 cannot be represented in type 'int'
Fixes: 26448/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-5638440374501376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 715ff75e5d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
b71b8cba2e avformat/genh: Check block_align
Fixes: infinite loop
Fixes: 26440/clusterfuzz-testcase-minimized-ffmpeg_dem_GENH_fuzzer-5632134020333568

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 37396e9ba8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
1639916eef avformat/mvi: Check count for overflow
Fixes: left shift of 21378748 by 10 places cannot be represented in type 'int'
Fixes: 26449/clusterfuzz-testcase-minimized-ffmpeg_dem_MVI_fuzzer-5680463374712832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a413ed9863)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
5c607d895d avcodec/magicyuv: Check slice size before reading flags and pred
Fixes: heap-buffer-overflow
Fixes: 26487/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_fuzzer-5742553675333632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0dc42147b6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
e16c81b742 avformat/asfdec_f: Check for negative ext_len
Fixes: Infinite loop
Fixes: 26376/clusterfuzz-testcase-minimized-ffmpeg_dem_PCM_U32LE_fuzzer-6050518830678016
Fixes: 26377/clusterfuzz-testcase-minimized-ffmpeg_dem_TY_fuzzer-4838195726123008
Fixes: 26384/clusterfuzz-testcase-minimized-ffmpeg_dem_G729_fuzzer-5173450337157120
Fixes: 26396/clusterfuzz-testcase-minimized-ffmpeg_dem_PCM_S24BE_fuzzer-5071092206796800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 209b9ff5c3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
86ec1f4707 avformat/bethsoftvid: Check image dimensions before use
Fixes: signed integer overflow: 55255 * 53207 cannot be represented in type 'int'
Fixes: 26387/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS2_fuzzer-5684222226071552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 50b29f081e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
6455233ff5 avformat/genh: Check block_align for how it will be used in SDX2_DPCM
Fixes: signed integer overflow: 19922944 * 1024 cannot be represented in type 'int'
Fixes: 26402/clusterfuzz-testcase-minimized-ffmpeg_dem_VMD_fuzzer-5745470053548032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c95b47e18f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
ad6ab41673 avformat/au: Check for EOF in au_read_annotation()
Fixes: Timeout (too looong -> 1 ms)
Fixes: 26366/clusterfuzz-testcase-minimized-ffmpeg_dem_SDX_fuzzer-5655584843759616
Fixes: 26391/clusterfuzz-testcase-minimized-ffmpeg_dem_ALP_fuzzer-5484026133217280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e680d50eb4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
1b4c3b54a6 avformat/segafilm: Do not assume AV_CODEC_ID_NONE is 0
Suggested-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d34e4904cd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
35c09f6c01 avformat/segafilm: Check that there is a stream
Fixes: assertion failure
Fixes: 26472/clusterfuzz-testcase-minimized-ffmpeg_dem_SEGAFILM_fuzzer-5759751591559168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c0d7fd269b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
86e36161ab avformat/wtvdec: Check dir_length
Fixes: Infinite loop
Fixes: 26445/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5125558331244544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1868cb7316)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
40edc35fcf avcodec/exr: Check limits to avoid overflow in delta computation
Fixes: signed integer overflow: 553590816 - -2145378049 cannot be represented in type 'int'
Fixes: 26315/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5938755121446912
Fixes: 26340/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5644316208529408

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6910e0f4e5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
64264c3772 avformat/asfdec_f: Check name_len for overflow
Fixes: signed integer overflow: -1172299744 * 2 cannot be represented in type 'int'
Fixes: 26258/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5672758488596480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0d088a47ca)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
cfce46eb2e avcodec/h264idct_template: Fix integer overflow in ff_h264_chroma422_dc_dequant_idct()
Fixes: signed integer overflow: 241173056 + 1953511200 cannot be represented in type 'int'
Fixes: 26086/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5068366420901888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d198362839)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
2f0b704093 avcodec/aacdec_fixed: Limit index in vector_pow43()
Fixes: out of array access
Fixes: 26087/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5724825462767616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4f83a53638)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
c2dd6a3cd9 avformat/rmdec: sanity check coded_framesize
Fixes: signed integer overflow: -14671840 * 8224 cannot be represented in type 'int'
Fixes: 24793/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5101884323659776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aee8477c6b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
4e5117017e avformat/flvdec: Check for EOF in amf_parse_object()
Fixes: Timeout (too long -> 1ms)
Fixes: 26108/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5653887668977664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 33624f4f2e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
217764d01e avcodec/smacker: Check remaining bits in SMK_BLK_FULL
Fixes: out of array access
Fixes: 26047/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKER_fuzzer-5083031667474432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 42ded4d1e6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
ef74efacd5 avcodec/cook: Check subpacket index against max
Fixes: off by 1 error
Fixes: index 5 out of bounds for type 'COOKSubpacket [5]'
Fixes: 25772/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5762459498184704.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5a2a7604da)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
fdc7c4d553 avcodec/hevcpred_template: Fix diagonal chroma availability in 4:2:2 edge case in intra_pred
Fixes: pixel decode issue.ts
Fixes: raw frame.hevc

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3fbf873792)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
04b4479da8 avformat/icodec: Change order of operations to avoid NULL dereference
Fixes: SEGV on unknown address 0x000000000000
Fixes: 26379/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-5709011753893888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3300f5c133)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
f4953bfde5 avcodec/exr: Fix overflow with many blocks
Fixes: signed integer overflow: 1073741827 * 8 cannot be represented in type 'int'
Fixes: 25621/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6304841641754624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7265b7d904)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
247115c046 avcodec/vp9dsp_template: Fix integer overflows in idct16_1d()
Fixes: signed integer overflow: -190760 * 11585 cannot be represented in type 'int'
Fixes: 25471/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5743354917421056

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 394e8bb385)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
76109b1ac3 avcodec/hevcdec: Check slice_cb_qp_offset / slice_cr_qp_offset
Fixes: signed integer overflow: 29 + 2147483640 cannot be represented in type 'int'
Fixes: 25413/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5697909331591168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 106f11f68a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
3f13007d5c avformat/subviewerdec: fail on AV_NOPTS_VALUE
Such values are not supported by ff_subtitles_queue*

Fixes: signed integer overflow: 10 - -9223372036854775808 cannot be represented in type 'long'
Fixes: 24193/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5714901855895552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b7f51428b1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
d7d8a8ccfb avcodec/exr: Check line size for overflow
Fixes: signed integer overflow: 570425356 * 6 cannot be represented in type 'int
Fixes: 25929/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5099197739827200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9b72cea446)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
bd5d981c9d avcodec/exr: Check xdelta, ydelta
Fixes: assertion failure
Fixes: 25617/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5648746061496320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6949df35d0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
acd9ec8436 avcodec/takdsp: Fix negative shift in decorrelate_sf()
Fixes: left shift of negative value -4
Fixes: 25723/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-6250580752990208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4f54f53003)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
7a5f705d2f avcodec/dxtory: Fix negative stride shift in dx2_decode_slice_420()
Fixes: left shift of negative value -640
Fixes: 26044/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXTORY_fuzzer-5631057602543616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3291d994b7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
dacd01c948 avformat/asfdec_f: Change order or operations slightly
Fixes: signed integer overflow: 20 * 5184056935931942919 cannot be represented in type 'long'
Fixes: 25466/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4798660247552000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 686f015190)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
83c2bd1a4a avformat/dxa: Use av_rescale() for duration computation
Fixes: signed integer overflow: 8224000000 * 1629552639 cannot be represented in type 'long'
Fixes: 24908/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4658478506049536

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c313089fbe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
640964687f avcodec/vc1_block: Fix integer overflow in ac value
Fixes: signed integer overflow: 25488 * 87381 cannot be represented in type 'int'
Fixes: 24765/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5108259565076480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3056e19e68)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
b365cbe989 avformat/iff: Check data_size not overflowing int64
Fixes: Infinite loop
Fixes: 25844/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5660803318153216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 24352ca792)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
490b2b8b42 avcodec/dxtory: Fix negative shift in dx2_decode_slice_410()
Fixes: left shift of negative value -768
Fixes: 25574/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXTORY_fuzzer-6012596027916288

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit abebd87764)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
7abc2f9fea avcodec/sonic: Check channels before deallocating
Fixes: heap-buffer-overflow
Fixes: 25744/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5172961169113088

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f249981976)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
d23e7ce02a avcodec/ansi: Check nb_args for overflow
Fixes: Integer overflow (no testcase)

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bc0e776c9a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
9b01de9145 avformat/wc3movie: Move wc3_read_close() up
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0c635f2ce6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
fe15e22e61 avcodec/diracdsp: Fix integer anomaly in dequant_subband_*
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: 23760/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-604209011412172

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ca3c6c981a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
bdfd833cd7 avutil/fixed_dsp: Fix integer overflows in butterflies_fixed_c()
Fixes: signed integer overflow: 0 - -2147483648 cannot be represented in type 'int'
Fixes: 23646/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5480991098667008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4a02ae49c2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
bc28f09bf8 avcodec/wmalosslessdec: Check remaining space before padding and channel residue
Fixes: Timeout (1101sec -> 0.4sec)
Fixes: 24491/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5725337036783616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c467adf3bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
4c927ebe8b avformat/cdg: Fix integer overflow in duration computation
Fixes: signed integer overflow: 8398407 * 300 cannot be represented in type 'int'
Fixes: 23914/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4702539290509312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aa8935b395)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
9dea79afde avcodec/mpc: Fix multiple numerical overflows in ff_mpc_dequantize_and_synth()
Fixes: -2.4187e+09 is outside the range of representable values of type 'int'
Fixes: signed integer overflow: -14512205 + -2147483648 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC7_fuzzer-5747263166480384
Fixes: 23528/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC7_fuzzer-5747263166480384

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2b9f39689a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
033936fc4a avformat/electronicarts: Check if there are any streams
Fixes: Assertion failure (invalid stream index)
Fixes: 25120/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6565251898933248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 39a98623ed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
a681e5f131 avcodec/ffwavesynth: Fix integer overflow in wavesynth_synth_sample / WS_SINE
Fixes: signed integer overflow: -1429092 * -32596 cannot be represented in type 'int'
Fixes: 24419/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5157849974702080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a0da95df77)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
53796ad5ab avcodec/vp9dsp_template: Fix integer overflow in iadst8_1d()
Fixes: signed integer overflow: 998938090 + 1169275991 cannot be represented in type 'int'
Fixes: 23411/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-4644692330545152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d182d8f10c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
a16460918d avformat/avidec: Fix io_fsize overflow
Fixes: signed integer overflow: 7958120835074169528 * 9 cannot be represented in type 'long long'
Fixes: 23382/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6230683226996736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cf0c700b0c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
bbc3425f60 avcodec/cfhd: Check transform type
Fixes: out of array access
Fixes: 24823/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-4855119863349248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 659658d08b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
e4b4cf4ba7 avcodec/tiff: Restrict tag order based on specification
"The entries in an IFD must be sorted in ascending order by Tag. Note that this is
 not the order in which the fields are described in this document."

This way various dimensions, sample and bit sizes cannot be changed at
arbitrary times which reduces the potential for bugs.
The tag reading code also on various places assumes that numerically previous
tags have already been parsed, so this needs to be enforced one way or another.

If this commit causes problems with real world files which are not easy to fix
then some other form of checks are needed to ensure the various dependencies
in the tag reading are not violated.

Fixes: out of array access
Fixes: 24825/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-6326925027704832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ad29f9e47c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
735255edb0 avformat/siff: Reject audio packets without audio stream
Fixes: Assertion failure
Fixes: 24612/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6600899842277376.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8931c55789)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
df401e11ed avformat/mpeg: Check avio_read() return value in get_pts()
Found-by: Thierry Foucu <tfoucu@gmail.com>
Fixes: Use-of-uninitialized-value
Reviewed-by: Thierry Foucu <tfoucu@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e8a88a16f7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
a590a733fa avcodec/tiff: Check bpp/bppcount for 0
Fixes: division by zero
Fixes: 24253/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-6250318007107584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit be090da25f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
ab4e05cfed avcodec/snowdec: Sanity check hcoeff
Fixes: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
Fixes: 24011/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5486376610168832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d51d569cf6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
28eecaca56 avformat/mov: Check comp_brand_size
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 24457/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5760093644390400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ffa6072fc7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
e5fa192bb7 avcodec/alac: Check decorr_shift to avoid invalid shift
Later the decorrelate_stereo call is guarded by channels == 2
and non-zero decorr_left_weight. Make sure decorr_shift is in
the expected shift range for that case.

Fixes: shift exponent 128 is too large for 32-bit type 'int'
Fixes: 23860/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5751138914402304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Alexander Strasser <eclipse7@gmx.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4333718b35)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
944d7e7225 avcodec/tdsc: Fix tile checks
Fixes: out of array access
Fixes: crash.asf

Found-by: anton listov <greyfarn7@yandex.ru>
Reviewed-by: anton listov <greyfarn7@yandex.ru>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 081e3001ed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Andreas Rheinhardt
eeb4dd7866 avformat/mm: Check for existence of audio stream
No audio stream is created unconditionally and if none has been created,
no packet with stream_index 1 may be returned. This fixes an assert in
ff_read_packet() in libavformat/utils reported in ticket #8782.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit ec59dc73f0)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2021-10-09 22:02:19 +02:00
Zhao Zhili
177fb05660 avformat/mov: Fix unaligned read of uint32_t and endian-dependance in mov_read_default
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 806a4d5187)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
9704e1ac08 avcodec/apedec: Fix undefined integer overflow with 24bit
Fixes: signed integer overflow: 8683744 * 256 cannot be represented in type 'int'
Fixes: 23527/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5679885932822528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9f7b252cdf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
0b8425dc76 avcodec/loco: Fix integer overflow with large values from loco_get_rice()
Fixes: signed integer overflow: 155 + 2147483647 cannot be represented in type 'int'
Fixes: 23421/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5652849097965568

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3ddc5e1f3c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
7f96fc8c13 avformat/smjpegdec: Check the existence of referred streams
Fixes: Assertion failure
Fixes: 23758/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5160954605338624.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 321ea59dac)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
5bb8dab66a avcodec/pnmdec: Fix misaligned reads
Found-by: "Steinar H. Gunderson" <steinar+ffmpeg@gunderson.no>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ea28ce9bc1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-09 22:02:19 +02:00
Michael Niedermayer
cb456b8fb0 avcodec/utils: Check close before calling it
Fixes: NULL pointer dereference
Fixes: 15733/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IDF_fuzzer-5658616977162240

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8df6884832)
2021-01-02 15:23:48 -03:00
Jan Ekström
cb772c3597 avformat/tls_schannel: immediately return decrypted data if available
Until now, we would have only attempted to utilize already decrypted
data if it was enough to fill the size of buffer requested, that could
very well be up to 32 kilobytes.

With keep-alive connections this would just lead to recv blocking
until rw_timeout had been reached, as the connection would not be
officially closed after each transfer. This would also lead to a
loop, as such timed out I/O request would just be attempted again.

By just returning the available decrypted data, keep-alive based
connectivity such as HLS playback is fixed with schannel.

(cherry picked from commit 6f8826e4aa)
2020-09-04 21:00:53 +03:00
Jan Ekström
1400236899 avformat/tls_schannel: always decrypt all received data
The dec_buf seems to be properly managed between read calls,
and we have no logic to decrypt before attempting socket I/O.
Thus - until now - such data would not be decrypted in case of
connections such as HTTP keep-alive, as the recv call would
always get executed first, block until rw_timeout, and then get
retried by retry_transfer_wrapper.

Thus - if data is received - decrypt all of it right away. This way
it is available for the following requests in case they can be
satisfied with it.

(cherry picked from commit 39977fff20)
2020-09-04 21:00:52 +03:00
Paweł Wegner
27fec5be47 avformat/tls_schannel: Fix use of uninitialized variable
Fixes: runtime error: passing uninitialized value to FreeContextBuffer
causes a crash

Signed-off-by: Paweł Wegner <pawel.wegner95@gmail.com>
(cherry picked from commit 85c00643b7)
2020-09-04 21:00:52 +03:00
Andreas Rheinhardt
65f24edb05 avcodec/ttaenc: Fix undefined shift
ttaenc contained (1 << unary) - 1 as an argument for a function
expecting an unsigned int. unary can be as big as 31 in this case.
The type of the shift and the whole expression is int, because 1 fits
into an integer, so that the behaviour is undefined if unary == 31
as the result of the shift can't be represented in an int §. Subtraction
by 1 (which makes the result of the whole expression representable in
an int) doesn't change that this is undefined (it usually leads to
signed integer overflow which is undefined, too).

The solution is simple: Make 1 unsigned to change the type of the
whole expression to unsigned int (as the function expects anyway).

Fixes ticket #8153.

§: This of course presupposes the common int range of -2^31..2^31-1

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3ab488a540)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:17:40 +02:00
Andreas Rheinhardt
a86137e6e8 fftools/ffmpeg: Free swresample dictionary during cleanup
Freeing this was forgotten in ad899522.

Fixes #8315 and #8316.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6f2a3958cf)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:17:40 +02:00
Andreas Rheinhardt
0b18f80241 avfilter/vf_xbr: Fix left shift of negative number
Affected every usage of vf_xbr, e.g. the FATE-tests filter-2xbr,
filter-3xbr, filter-4xbr.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4294dc3589)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:17:40 +02:00
Andreas Rheinhardt
4ee6a9b1bb avfilter/vf_hqx: Fix undefined left shifts of negative numbers
Affected every usage of this filter; in particular, it affected the
FATE-tests filter-2xbr, filter-3xbr and filter-4xbr.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fa21194326)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:17:40 +02:00
Andreas Rheinhardt
37d8033fd0 avcodec/jpeg2000dwt: Fix undefined shifts of negative numbers
Affected the vsynth*-jpeg2000 and the vsynth*-jpeg2000-97 FATE tests
(where * ranges over { 1, 2, 3, _lena }) as well as ticket #7983.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5cf593adcd)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:17:40 +02:00
Andreas Rheinhardt
c5a5b8055e avcodec/ituh263dec: Fix undefined left shift of negative number
Fixes ticket #8160.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 324487b596)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:17:40 +02:00
Andreas Rheinhardt
88e7ca3cd2 avcodec/dnxhdenc: Fix undefined left shifts of negative numbers
Affected 61 FATE-tests: 60 vsynth tests and lavf-mxf_opatom.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b7f156e8cb)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:17:40 +02:00
Andreas Rheinhardt
c690866ee0 swscale/utils: Fix invalid left shifts of negative numbers
Affected the FATE-tests vsynth_lena-dv-411, vsynth1-dv-411,
vsynth2-dv-411 and hevc-paramchange-yuv420p.yuv420p10.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e2646e23be)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:17:40 +02:00
Andreas Rheinhardt
b94fe011d6 swscale/x86/swscale: Fix undefined left shifts of negative numbers
This affected many FATE-tests: The number of failing tests went down
from 663 to 344. (Both numbers exclude tests that failed because of
unaligned accesses in code that is inside #if HAVE_FAST_UNALIGNED.)

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 736c7c20e7)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:17:40 +02:00
Andreas Rheinhardt
d354f4425d avformat/movenc: Fix undefined shift
Fixes the movenc FATE-test.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 646799b42f)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:16:48 +02:00
Andreas Rheinhardt
5b71c06acb avcodec/pcm: Fix undefined shifts
Fixes the acodec-pcm-u16[lb]e FATE-tests.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 69473bec6f)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:16:48 +02:00
Andreas Rheinhardt
d86572fc9e avcodec/wavpackenc: Fix undefined shifts
Fixes ticket #8161 and the acodec-wavpack FATE-test.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 84974c6fb5)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:16:48 +02:00
Andreas Rheinhardt
00e95fda13 avcodec/ac3enc: Fix invalid shift
Fixes the FATE-tests unknown_layout-ac3, ac3-fixed-encode, ac3-encode
and eac3-encode. It furthermore fixes the ac3-encoder bugs mentioned in
tickets #7994, #8144 and #8159.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2f289ec914)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:16:48 +02:00
Andreas Rheinhardt
cd786fe2f2 avcodec/tdsc: Fix undefined shifts
Fixes the tdsc FATE-test.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 86bef10e7a)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:16:48 +02:00
Andreas Rheinhardt
bf91a98aad fftools/ffmpeg_opt: Fix signed integer overflow
Fixes ticket #8154.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2b1fcba8dd)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:16:48 +02:00
Andreas Rheinhardt
6ae79b3b13 avformat/mov: Fix reel_name size check
Only read str_size bytes from offset 30 of extradata if the extradata is
indeed at least 30 + str_size bytes long.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit ff3fad6b0e)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:16:48 +02:00
Andreas Rheinhardt
bfa07a9633 avformat/mov: Fix memleak upon encountering repeating tags
mov_read_custom tries to read three strings belonging to three different
tags. When an already encountered tag is encountered again, a new buffer
for the string to be read is allocated and stored in the pointer
destined for this particular tag. But in this scenario, said pointer
already holds the address of the string read earlier, leading to a leak.

This commit therefore aborts the reading process upon encountering
an already encountered tag.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit dfef1d5e3c)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:16:47 +02:00
Andreas Rheinhardt
259407ac89 avformat/matroskaenc: Don't use NULL for %s format string
The argument pertaining to a printf %s conversion specifier must not
be NULL, even if the precision (i.e. the number of characters to write)
is zero. If it is NULL, it is undefined behaviour.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 6de6ce7bc8)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:16:47 +02:00
Andreas Rheinhardt
9c4eb3419e avformat/webvttdec: Fix memleak upon read header failure
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit c784fe8b86)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:16:47 +02:00
Andreas Rheinhardt
b5c427fd99 avformat/vplayerdec: Fix memleak upon read header failure
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 67434afa7f)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:16:47 +02:00
Andreas Rheinhardt
0e0618cd6e avformat/tedcaptionsdec: Fix memleak upon read header failure
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if allocating the AVStream for the subtitles fails.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 337783b118)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:16:47 +02:00
Andreas Rheinhardt
2c6b124cac avformat/subviewerdec: Fix memleak upon read header failure
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit a708f65273)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:16:47 +02:00
Andreas Rheinhardt
98c9dd554c avformat/subviewer1dec: Fix memleak upon read header failure
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 9751d75152)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:16:47 +02:00
Andreas Rheinhardt
b199ed5dea avformat/stldec: Fix memleak upon read header failure
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit e13874b9ea)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:16:47 +02:00
Andreas Rheinhardt
03fa21f98c avformat/srtdec: Fix memleak upon read header failure
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit c70409957c)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:16:47 +02:00
Andreas Rheinhardt
b291998d8f avformat/samidec: Fix memleak upon read header failure
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle
or when creating extradata.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit f161f8e4ad)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:15:57 +02:00
Andreas Rheinhardt
9003b8f5de avformat/pjsdec: Fix memleak upon read header failure
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 9df560e898)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:15:57 +02:00
Andreas Rheinhardt
1e0ab3a93b avformat/mpsubdec: Fix memleak upon read header failure
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon creating an AVStream.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit a5ed8aeea4)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:15:57 +02:00
Andreas Rheinhardt
d448673406 avformat/mpl2dec: Fix memleak upon read header failure
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 331799747e)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:15:57 +02:00
Andreas Rheinhardt
7871825ce7 avformat/microdvddec: Fix memleak upon read header failure
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle
or when allocating extradata.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit b12014a5b8)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:15:57 +02:00
Andreas Rheinhardt
49ea0726c2 avformat/lrcdec: Fix memleak upon read header failure
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit d38694cea9)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:15:57 +02:00
Andreas Rheinhardt
01e64c3ba9 avformat/jacosubdec: Fix memleak upon read header failure
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit c13a752733)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:15:57 +02:00
Andreas Rheinhardt
a24ada22e9 avformat/assdec: Fix memleak upon read header failure
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle
or if creating the extradata failed.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 5ab39c2d8c)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:15:57 +02:00
Andreas Rheinhardt
91e430ab58 avformat/aqtitledec: Fix memleak upon read header failure
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit a86a5d06d8)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:15:56 +02:00
Andreas Rheinhardt
3174c7b1bf avformat/omadec: Fix memleaks upon read_header failure
Fixes possible leaks of id3v2 metadata as well as an AVDES struct in
case the content is encrypted and an error happens lateron.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 3d3ba43bc6)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:14:48 +02:00
Andreas Rheinhardt
cfe31c7f48 avformat/matroskadec: Use right number of tracks
When demuxing a Matroska/WebM file, streams are added for tracks and for
attachments, so that the array containing the former can be NULL even
when the corresponding AVFormatContext has streams. So check for there
to be tracks in the MatroskaDemuxContext instead of just streams in the
AVFormatContext before dereferencing the pointer to the tracks.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 1ef30571a0)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:14:47 +02:00
Andreas Rheinhardt
ca58c80058 avformat/matroskadec: Fix handling gigantic durations
matroska_parse_block currently asserts that the duration is not equal to
AV_NOPTS_VALUE, but there is nothing that actually guarantees this. It
is easy to create (spec-compliant) files which run into this assert;
so replace it and instead cap the duration to INT64_MAX, as the duration
field of an AVPacket is an int64_t.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 3714d452b8)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:14:47 +02:00
Andreas Rheinhardt
35557942bf avformat/aviobuf: Don't check for overflow after it happened
If adding two ints overflows, it doesn't matter whether the result will
be stored in an unsigned or not; and checking afterwards does not make it
retroactively defined.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 28a078eded)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:14:47 +02:00
Andreas Rheinhardt
852e1978e4 avformat/matroskaenc: Fix memleak upon encountering bogus chapter
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit cb255b616c)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:14:47 +02:00
Andreas Rheinhardt
de6d8e6fba fftools/ffmpeg_opt: Check attachment filesize
The data of an attachment file is put into an AVCodecParameter's
extradata. The corresponding size field has type int, yet there was no
check for the size to fit into an int. As a consequence, it was possible
to create extradata with negative size (by using a big enough max_alloc).

Other errors were also possible: If SIZE_MAX < INT64_MAX (e.g. on 32bit
systems) then the file size might be truncated before the allocation;
and avio_read() takes an int, too, so one would not have read as much
as one desired.

Furthermore, the extradata is now padded as is required.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 889ad93c88)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:14:47 +02:00
Andreas Rheinhardt
939cb37247 avformat/webmdashenc: Check codec types
The WebM DASH Manifest muxer only supports VP8, VP9, Vorbis and Opus,
but there was no check for this. The codec type is used to get a pointer
to a string containing the codec name or NULL if it is not one of those
four codecs. Said pointer has then been used without further checks as
string for the %s conversion specifier in an avio_printf()) call which
is undefined behaviour.

This commit adds a check for the supported codec types.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit cbea58b2b3)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:14:47 +02:00
Andreas Rheinhardt
f19d4077ac avformat/webmdashenc: Fix memleak upon realloc failure
The classical ptr = av_realloc(ptr, size).

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 418e468699)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:14:47 +02:00
Andreas Rheinhardt
0cdb2e99e5 avformat/matroskadec: Don't discard the upper 32bits of TrackNumber
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit ba36a07734)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:14:47 +02:00
Andreas Rheinhardt
07552856f0 avformat/hnm: Check for extradata allocation failure
and also add padding to it; moreover, don't use memcpy to write one byte
to extradata.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9e0f3352d1)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:14:46 +02:00
Andreas Rheinhardt
c790095828 avformat/subtitles: Don't increment packet counter prematurely
Do it only if the packet has been successfully allocated in
av_new_packet() -- otherwise on error a completely uninitialized packet
would be unreferenced later.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6bd8bcc2ac)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:14:46 +02:00
Andreas Rheinhardt
5941c8fa05 avformat/bethsoftvid: Fix potential memleak upon reallocation failure
The classical ptr = av_realloc(ptr, size), just with av_fast_realloc().

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5acef12061)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:14:46 +02:00
Andreas Rheinhardt
d63495c692 avformat/smoothstreaming: Fix memleaks on errors
If an AVFormatContext could be allocated, but white-/blacklists couldn't
be copied, the AVFormatContext would leak as it was only accessible
through a local variable that goes out of scope when one goes to fail.

Furthermore, in case writing a header of a submuxer failed, the options
used for said call could leak.

Both of these memleaks have been fixed.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit abbb466368)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:14:46 +02:00
Andreas Rheinhardt
11185385a0 avformat/matroskaenc: Check BlockAdditional size before use
Don't read a 64bit number before having checked that the data is at
least 8 bytes long.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6e9cc96429)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:14:46 +02:00
Andreas Rheinhardt
c9a8def8f2 avformat/utils: Fix memleaks in avformat_open_input()
A demuxer might have allocated memory while reading the header. If
reading the header was successfull and an error happens before returning
(e.g. when queueing the attached pictures), the read_close function
would have never been called, so that all those allocations would leak.
This commit changes this.

Furthermore, there would be even more memleaks if the error level was
set to AV_EF_EXPLODE in case there is both metadata and id3v2 metadata.
This has been fixed, too.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit e2307f4ff1)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:14:43 +02:00
Andreas Rheinhardt
a936072932 avcodec/cavsdsp: Fix undefined left shifts of negative numbers
Affected the ffmpeg-filter_colorkey FATE-test (but only if the C version
of idct8_add is used and not e.g. the x86 SSE2 version).

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>

Fixes: left shift of negative value -107
Fixes: 20398/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5725389278412800

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0f0f2ab0c3)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:13:44 +02:00
Andreas Rheinhardt
0a71f90b36 avformat/matroskaenc: Check for reformatting errors
This is needed especially for AV1: If a reformatting error happens (e.g.
if the length field of an OBU contained in the current packet indicates
that said OBU extends beyond the current packet), the data pointer is
still NULL, yet the size is unchanged, so that writing the data leads
to a segmentation fault.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 58428bef4b)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 16:07:27 +02:00
Andreas Rheinhardt
2595150562 avcodec/ra144enc: Fix invalid left shift of negative number
by replacing it with a multiplication. Said multiplication can't
overflow an int32_t because lpc_coefs is limited to 16 bit precision.

Fixes the FACE-test acodec-ra144 as well as part of #8217.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e3fb9af6f1)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 15:49:19 +02:00
Andreas Rheinhardt
9d7bc32e1c avcodec/adxenc: Avoid undefined left shift of negative numbers
Replace "((a << shift) + b) >> shift" by "a + (b >> shift)". This avoids
a left shift which also happens to trigger undefined behaviour in case "a"
is negative. This affected the FATE-tests acodec-adpcm-adx and
acodec-adpcm-adx-trellis; it also fixes ticket #8008.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 59a9d65e0d)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 15:49:18 +02:00
Andreas Rheinhardt
90f17d1cc1 avcodec/adpcm: Fix undefined left shifts of negative numbers
Affected the adpcm-afc, adpcm-ea-1, adpcm-ea-2, adpcm-ea-maxis-xa,
adpcm-thp and ea-cdata FATE-tests. Also fixes ticket #8487.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3ad8af51b7)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 15:49:18 +02:00
Andreas Rheinhardt
4ef06c48d1 avcodec/proresenc_anatoliy: Fix invalid left shift of negative number
This fixes ticket #7997 as well as the vsynth*-prores_# FATE-tests
(where * ranges over { 1, 2, 3, _lena } and # over { , _int, _444,
_444_int }).

(Given that prev_dc is in the range -0xC000..0x3FFF, no overflow can
happen upon multiplication with 2.)

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 198081efb7)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 15:49:18 +02:00
Andreas Rheinhardt
78bf4ac778 avformat/wtvdec: Fix memleak when reading header fails
Fixes #8314.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 373c1c9b69)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 15:49:18 +02:00
Andreas Rheinhardt
baf9d51b8b avcodec/hevc_mp4toannexb_bsf: Check NAL size against available input
The hevc_mp4toannexb bsf does not explicitly check whether a NAL unit
is so big that it extends beyond the end of the input packet; it does so
only implicitly by using the checked version of the bytestream2 API.
But this has downsides compared to real checks: It can lead to huge
allocations (up to 2GiB) even when the input packet is just a few bytes.
And furthermore it leads to uninitialized data being output.
So add a check to error out early if it happens.

Also check directly whether there is enough data for the length field.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit ea1b71e82f)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 15:14:38 +02:00
Andreas Rheinhardt
d7703a815f avcodec/bitstream: Don't check for undefined behaviour after it happened
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 5e196dac22)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-03 15:14:38 +02:00
Michael Niedermayer
37a8ad9a31 Changelog: update 2020-07-02 18:50:40 +02:00
Michael Niedermayer
5c691bf758 avcodec/dstdec: Replace AC overread check by sample rate check
Real files do skip coding 0 bits at the end, thus this kind of check
does not work reliable.

Fixes: Ticket 8770
Fixes: dst-256fs44-6ch-refdstencoder.dff

The samplerate is specified in ISO/IEC 14496-3:2005(E) as one of 3 fixed
values, this also can be used to limit the duration and avoid the timeout

This reverts commit f6df99dba1.

(cherry picked from commit 1679f23beb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-02 18:49:22 +02:00
Zhao Zhili
bd51c9dfaf avformat/mov: fix memleaks
Fix two cases of memleaks:
1. The leak of dv_demux
2. The leak of dv_fctx upon dv_demux allocate failure

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit f3dc38a186)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-01 15:50:18 +02:00
Andreas Rheinhardt
e26c58d8e0 libavformat/mov: Fix memleaks when demuxing DV audio
The code for demuxing DV audio predates the introduction of refcounted
packets and when the latter was added, changes to the former were
forgotten. This meant that when avpriv_dv_produce_packet initialized the
packet containing the AVBufferRef, the AVBufferRef as well as the
underlying AVBuffer leaked; the actual packet data didn't leak: They
were directly freed, but not via their AVBuffer's free function.

https://samples.ffmpeg.org/ffmpeg-bugs/trac/ticket4671/dir1.tar.bz2
contains samples for this (enable_drefs needs to be enabled for them).

Moreover, errors in avpriv_dv_produce_packet were ignored; this has been
changed, too.

Furthermore, in the hypothetical scenario that the track has a palette,
this would leak, too, so reorder the code so that the palette code
appears after the DV audio code.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 61f5c6ab06)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-01 15:50:17 +02:00
Michael Niedermayer
43e6bdacdd Update for 3.2.15 2020-07-01 13:10:34 +02:00
Michael Niedermayer
13dfe3e6e9 avformat/utils: reorder duration computation to avoid overflow
Fixes: signed integer overflow: 8 * 9223372036854774783 cannot be represented in type 'long'
Fixes: 23381/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4818340509122560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 10cc82c35b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
c4ac9554f0 avcodec/pngdec: Check for fctl after idat
Fixes: out of array access
Fixes: 23554/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-4796622520451072.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 65b1ba680f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Ronald S. Bultje
b3a653c92e png: split header state and data state in two separate variables.
Fixes a reported (but false) race condition in tsan for fate-apng:

WARNING: ThreadSanitizer: data race (pid=6274)
  Read of size 4 at 0x7d680001ec78 by main thread (mutexes: write M1338):
    #0 update_thread_context src/libavcodec/pngdec.c:1456 (ffmpeg+0x000000dacf0c)
[..]
  Previous write of size 4 at 0x7d680001ec78 by thread T1 (mutexes: write M1335):
    #0 decode_idat_chunk src/libavcodec/pngdec.c:737 (ffmpeg+0x000000dae951)

(cherry picked from commit 478f1c3d5e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
8a2ef6d25d avformat/hls: Pass a copy of the URL for probing
The segments / url can be modified by the io read when reloading

This may be an alternative or additional fix for Ticket8673
as a further alternative the reload stuff could be disabled during
probing

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b5e39880fb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Steven Liu
f80106e256 avformat/hls: check segment duration value of EXTINF
fix ticket: 8673
set the default EXTINF duration to 1ms if duration is smaller than 1ms

Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit 9dfb19baeb)
2020-07-01 12:49:26 +02:00
Michael Niedermayer
bf3757f54b avutil/common: Fix integer overflow in av_ceil_log2_c()
Fixes: left shift of 1913647649 by 1 places cannot be represented in type 'int'
Fixes: 23572/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5082619795734528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e409262837)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
056f59ad2c avcodec/wmalosslessdec: fix overflow with pred in revert_cdlms
Fixes: signed integer overflow: 2048 + 2147483646 cannot be represented in type 'int'
Fixes: 23538/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5227567073460224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 21598d711d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
69eca43d61 avformat/mvdec: Fix integer overflow with billions of channels
Fixes: signed integer overflow: 1394614304 * 2 cannot be represented in type 'int'
Fixes: 23491/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5697377020411904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b6fbbe08c3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
620374a3af avformat/microdvddec: skip malformed lines without frame number.
Fixes: signed integer overflow: 1 - -9223372036854775808 cannot be represented in type 'long'
Fixes: 23490/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5133490093031424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a8fb7612a9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
f6e7fbd510 avformat/mxfdec: free duplicated utf16 strings
Fixes: memleak
Fixes: 23415/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5124814510751744

Suggested-by: Marton Balint <cus@passwd.hu>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0aa2768cb2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
460bcdcd84 avformat/4xm: Check that a video stream was created before returning packets for it
Fixes: assertion failure
Fixes: 23434/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5227750851084288.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c517c3f474)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
8fdd4fc3c0 avcodec/ffwavesynth: Avoid undefined operation on ts overflow
Alternatively these conditions could be treated as errors
Fixes: 23147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5639254549200896
Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'int64_t' (aka 'long')

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 584d334afd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
ef970a79b7 avcodec/mpeg4videodec: Fix 2 integer overflows in get_amv()
Fixes: signed integer overflow: -144876608 * 16 cannot be represented in type 'int'
Fixes: 22782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-6039584977977344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e361785ee0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
17847fd5c7 avcodec/lossless_audiodsp: Fix undefined overflows in scalarproduct_and_madd_int16_c()
Fixes: signed integer overflow: 2142077091 + 6881070 cannot be represented in type 'int'
Fixes: 22737/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5958388889681920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c0dfe134be)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
ef99bc3d0e avcodec/sonic: Fix several integer overflows
Fixes: signed integer overflow: 2129689466 + 2129689466 cannot be represented in type 'int'
Fixes: 20715/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5155263109922816

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 75d520e337)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
b2314621f0 avcodec/iff: Fix off by x error
Fixes: out of array access
Fixes: 23245/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5723121327013888.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 51225dee0a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
baac1fb3da avcodec/wmalosslessdec: Check block_align maximum
Fixes: Assertion failure
Fixes: 22737/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5958388889681920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 314d10f7a6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
62deac54b2 avcodec/loco: Fix signed integer overflow in loco_get_rice()
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 22975/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5658160970072064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aa88cdfd90)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
5cae4b4606 avformat/thp: Check fps
Fixes: division by zero
Fixes: 23162/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4856420817436672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0e15b01b4e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
422ef6d222 avformat/mpl2dec: Fix integer overflow with duration
Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented in type 'long'
Fixes: 23167/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6425051741290496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9a42a67c5c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
a5779e7250 avcodec/mpeg12dec: remove outdated comments
Found-by: Kieran
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 48de8f5816)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
334c031c93 avcodec/snowdec: Avoid integer overflow with huge qlog
Fixes: integer overflow
Fixes: 22285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5682428762128384

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 38fbf33c72)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
97c4d49538 avcodec/mpeg12dec: Fix got_output
This makes got_output consistent with the code in slice_end() which sets the output

in slice_end()
 if (s->pict_type == AV_PICTURE_TYPE_B || s->low_delay) {
     int ret = av_frame_ref(pict, s->current_picture_ptr->f);
     ...
 } else {

Fixes: assertion failure
Fixes: 22178/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5664234440753152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4f33a9803a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
53c685afde avformat/4xm: Cleanup on GET_LIST_HEADER() failure
Fixes: memleak
Fixes: 23142/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5932860820422656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a5313ce654)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
0ef01e368c avcodec/lzf: Consider the needed size in reallocation
Fixes: NULL pointer dereference
Fixes: 22381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-5659879921680384.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 292b9b93a5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
11fadd532e avformat/mlvdec: fail reading a packet with 0 streams
Fixes: NULL pointer dereference
Fixes: 22604/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5667739074297856.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5bd5c31087)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
d28891ca8f avformat/thp: Check compcount
Fixes: out of array access
Fixes: 22520/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5100297658826752

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1ba8484559)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
0179add61d avcodec/adpcm: XA: Check shift similar to filter
Fixes: negative shift
Fixes: 22499/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_XA_fuzzer-5765452130418688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6d96bae9c4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
bf9c86f62a avcodec/huffyuvdec: Test vertical coordinate more often
Fixes: out of array access
Fixes: 22892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-5135996772679680.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a1223ddc56)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
65f2862dcd avcodec/hq_hqa: Check info size
Fixes: assertion failure
Fixes: 21079/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-5737046523248640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cf28521fee)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
922dc61770 avcodec/wmalosslessdec: Fix integer overflow in mclms_predict()
Fixes: signed integer overflow: 2147483636 + 2048 cannot be represented in type 'int'
Fixes: 22016/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5109395618004992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c42ed06695)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
4db34eb330 avcodec/vp9dsp_template: Fix integer overflow(s) in iadst16_1d()
Fixes: signed integer overflow: 1080285923 - -1130879337 cannot be represented in type 'int'
Fixes: 22002/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-6260237310099456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 071e293723)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
8c4fcbd4f9 avcodec/h264dec: Disable forced small_padding on flag2 fast
Fixes: 20978/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5746381832847360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
4ce82f27c7 avformat/oggparsevorbis: Error out on double init of vp
Fixes: memleak
Fixes: 19949/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5743636058210304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2a3bbc0086)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
e79c52ad01 avcodec/pnmdec: Use unsigned for maxval rescaling
Fixes: signed integer overflow: 65535 * 55335 cannot be represented in type 'int'
Fixes: 21955/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-5669206981083136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 49459aca47)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
340ac128a2 avcodec/ivi: Clear got_p_frame before decoding a new frame using it
Fixes: assertion failure
Fixes: 21666/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-5706468994318336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1d633e6a0a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
83ce829db6 avcodec/dsddec: Check channels
Fixes: division by zero
Fixes: 21677/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DSD_MSBF_fuzzer-5712547983654912
Fixes: 21751/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DSD_LSBF_fuzzer-5197097180856320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2570a8777e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
71d7c4fbac avcodec/xvididct: Fix integer overflow in idct_row()
Fixes: signed integer overflow: -1238335488 + -1003634688 cannot be represented in type 'int'
Fixes: 21649/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5112005765890048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 620236e4d2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
015c164cd4 avcodec/wmalosslessdec: Fix integer overflows in revert_inter_ch_decorr()
Fixes: signed integer overflow: -717241856 + -1434459904 cannot be represented in type 'int'
Fixes: 21405/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5677143666458624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e9a4c4fe99)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
996ca74081 avformat/mpegenc: Fix integer overflow with AV_NOPTS_VALUE
Fixes: signed integer overflow: -9223372036854775808 - 45000 cannot be represented in type 'long'
Fixes: ticket8187

Found-by: Suhwan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9874815b1a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
35a451d490 avformat/swfenc: Fix integer overflow in frame rate handling
Fixes: signed integer overflow: 30000299 * 256 cannot be represented in type 'int'
Fixes: ticket8184

Found-by: Suhwan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 31f956acad)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
d7e9a72060 avformat/aadec: Check toc_size to contain the minimum to demuxer uses
Fixes: out of array access
Fixes: stack-buffer-overflow-READ-0x0831fff1

Found-by: GalyCannon <galycannon@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit daa2482871)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Dale Curtis
e26d6f68bb avformat/mov: Don't allow negative sample sizes.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2d8d554f15)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Vitaly Buka
fa10782c02 mpeg4videoenc: Don't crash with -fsanitize=bounds
Also the patch makes this code consistent with mpeg4videodec.c

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f163d30de2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
74eb8e83e6 avcodec/binkaudio: Fix 2Ghz sample_rate
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 19950/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINKAUDIO_DCT_fuzzer-5765514337189888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Paul
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f603d10b1e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
ecea2efff3 avcodec/adpcm: Fix integer overflow in ADPCM THP
The reference (thp.txt) uses floats so wrap around would seem incorrect.

Fixes: signed integer overflow: 1073741824 + 1073741824 cannot be represented in type 'int'
Fixes: 20658/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_THP_fuzzer-5646302555930624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b12b05374f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
a63a292ac8 avcodec/ralf: Check num_blocks before use
Fixes: out of array access
Fixes: 20659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5739471895265280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f0c0471075)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
d88e50ed61 avcodec/iff: Test video_size being non zero
Fixes: Out of array access
Fixes: 20659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5658548592967680
Fixes: 20659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5723561177382912

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a035fd88ae)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
44710253f4 avcodec/utvideodec: Fix integer overflow in decode_plane()
Fixes: signed integer overflow: 2147483594 + 142 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_fuzzer-5658568101724160

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 876cfa67f3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
b1046b3b14 avcodec/ttadsp: Fix several integer overflows in tta_filter_process_c()
Fixes: signed integer overflow: 1931744255 + 252497024 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5763348114440192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8627885172)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
b87281969a avcodec/ralf: Fix integer overflow in decode_block()
Fixes: signed integer overflow: 289082077 - -2003141111 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5196077752123392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0c4330847c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
3cf22dc460 avcodec/nuv: widen buf_size type
Fixes: signed integer overflow: 65312 * 65312 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-5740176118906880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1ac106bf56)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
4a41de80ed avcodec/iff: Fix several integer overflows
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int32_t' (aka 'int')
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5764066459254784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7a92147f87)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
6ce730d39e avcodec/g729postfilter: Clip gain before scaling with AGC_FAC1
The fixed point integer reference specifies the multiplication used
to have 16bit input and clips so we need to clip the input
The floating point implementation does not seem to do that.

Fixes: signed integer overflow: 6317568 * 410 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G729_fuzzer-5700189272932352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 82d4c7b95e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
4cbda397c3 avcodec/alac: Fix integer overflow with 24/20bps samples
Fixes: signed integer overflow: 1020048 * 4096 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5753877751660544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 22e51e95ac)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
efe50a9ce1 avcodec/dstdec: Check sample rate
Fixes: out of array access
Fixes: 20659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5735812071424000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5727b1f13f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
5be59bb8a1 avformat/thp: Require a video stream
The demuxer code assumes the existence of a video stream

Fixes: assertion failure
Fixes: 21512/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5699660783288320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 97c78caf3e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
3153dae379 avformat/mpeg: Decrease score by 1 for files with very little valid data
Fixes: 8233/PPY6574574605_cut.mp3

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 20f7b4dfc9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
d48569cb5b avcodec/pngdec: Check length in fdAT
Fixes: 21089/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-5135981419429888
Fixes: out of array read

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 79e5c2ee2b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
74f7e11a98 avcodec/g2meet: Check tile_width in epic_jb_decode_tile()
Fixes: out of array access
Fixes: 21469/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5199357982015488

Alternatively the arrays can be made bigger or the index can be clipped.
In case a real file with such huge tiles exist we ask the user to upload it.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5501bb28dd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
60d36825bc avcodec/vp9dsp_template: Fix integer overflows in idct32_1d()
Fixes: signed integer overflow: -193177 * 11585 cannot be represented in type 'int'
Fixes: 20557/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5704852816789504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e16e3e63f0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
e2a3317510 avcodec/alacdsp: Fix invalid shift in append_extra_bits()
Fixes: left shift of negative value -1
Fixes: 21390/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-6242539519868928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 49ae034b42)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
a4e9221bde libavcodec/wmalosslessdec: prevent sum of positive numbers from becoming negative
Fixes: left shift of negative value -8321365
Fixes: 20506/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-4798062906310656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 62e4003780)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
3ea3a94a1e avcodec/dstdec: Fix integer overflow in read_table()
Fixes: signed integer overflow: -16 * 134217879 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5639509530378240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2d465a401d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
76ad5d0351 avcodec/txd: Check for input size against the header size.
Fixes: Timeout (21sec -> 80ms)
Fixes: 20673/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TXD_fuzzer-5177453863763968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aeb4e43584)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
ae8e215c41 avcodec/svq1dec: Check that there is data left after the header
Fixes: Timeout (21sec -> 255ms)
Fixes: 20709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ1_fuzzer-5085075089915904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 55e344ee5a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
01436cc976 avcodec/intrax8: Check for end of bitstream in ff_intrax8_decode_picture()
Fixes: Timeout (105sec -> 1sec)
Fixes: 20479/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5769846937878528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0a9ccc2514)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
0734772b79 avformat/mpegts: Shuffle avio_seek
This avoids accessing an old, no longer valid buffer.
Fixes: out of array access
Fixes: crash_audio-2020

Found-by: le wu <shoulewoba@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Martin Storsjö
4b19bb49bc rtmpdh: Don't use the OpenSSL DH struct
Instead use our own struct, which we already use when using
gcrypt and gnutls.

In OpenSSL 1.1, the DH struct has been made opaque.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 568c906501001b5a3469c8cf720ce27d9693352f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
3402904943 avcodec/hevc_mp4toannexb_bsf: Check nalu_size
Fixes: Timeout (29sec -> 5ms)
Fixes: 20237/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_MP4TOANNEXB_fuzzer-5165615044362240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ae2537f53e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
c2fd7070d4 avcodec/iff: Check length before memcpy() in decode_deep_rle32()
Fixes: out of array read
Fixes: 20796/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5111364702175232.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b4a33387cb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
bedf686d5b avcodec/iff: Fix invalid pointer intermediates in decode_deep_rle32()
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bc41a29a5a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
5e9fa514a4 avcodec/rv40dsp: Fix integer overflows in rv40_weight_func_*()
Fixes: signed integer overflow: 40550400 * 128 cannot be represented in type 'int'
Fixes: 20331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV40_fuzzer-5676685725007872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 13171ad2e3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
ff3ea90d6b avcodec/ac3dec_fixed: Fix several invalid left shifts in scale_coefs()
Fixes: left shift of negative value -14336
Fixes: 20298/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AC3_FIXED_fuzzer-5675484201615360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8e30502abe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
541298cef7 avcodec/flac_parser: Do not lose header count in find_headers_search()
Fixes: Timeout
Fixes: out of array access
Fixes: 20274/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5649631988154368
Fixes: 19275/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5757535722405888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 55f9683cf6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
2d3dd65a4b avcodec/audiodsp: Fix integer overflow in scalarproduct_int16_c()
Fixes: signed integer overflow: 2145417478 + 76702564 cannot be represented in type 'int'
Fixes: 20313/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-5734487724130304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit abb5762e98)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
94af3d9ca6 avformat/oggdec: Check for EOF after page header
Fixes: Infinite loop
Fixes: Ticket8594

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f1589be9fd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
6e768588c3 swscale/yuv2rgb: Fix vertical dither offset with slices
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit be3c29e379)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
7164a168fb avcodec/dpcm: clip exponent into supported range in XAN DPCM
Fixes: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 21200/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XAN_DPCM_fuzzer-5754704894361600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 20ade59d96)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
51e0e2deaf avcodec/flacdsp_template: Fix invalid shifts in decorrelate
Fixes: left shift of negative value -2
Fixes: 20303/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5096829297623040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3935c891e9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
dad6714ce6 avcodec/xvididct: Fix integer overflow in MULT()
Fixes: signed integer overflow: 23170 * 95058 cannot be represented in type 'int'
Fixes: 20295/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5800212870463488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7ccb576191)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
9727acaad5 avcodec/ffwavesynth: Correct undefined overflow of PINK_UNIT
Fixes: signed integer overflow: 9223372036854775775 + 128 cannot be represented in type 'long'
Fixes: 20054/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5686385113825280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 187161d62f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
b02acd029f swscale/output: Fix integer overflow in yuv2rgb_write_full() with out of range input
Fixes: signed integer overflow: 1169365504 + 981452800 cannot be represented in type 'int'
Fixes: ticket8293

Found-by: Suhwan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e057e83a4f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
John Rummell
3d1eed6b3d libavformat/amr.c: Check return value from avio_read()
If the buffer doesn't contain enough bytes when reading a stream,
fail rather than continuing on with initialized data. Caught by
Chromium fuzzeras (crbug.com/1065731).

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5b967f56b6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
John Rummell
d0a74df81b libavformat/mov.c: Free aes_decrypt to avoid leaking memory
Found by Chromium fuzzers (crbug.com/1057205).

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ad91cf1f2f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
John Rummell
77620689e5 libavformat/oggdec.c: Check return value from avio_read()
If the buffer doesn't contain enough bytes when reading a stream,
fail rather than continuing on with unitialized data. Caught by
Chromium fuzzers (crbug.com/1054229).

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b7c67b1ae3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
b39e085d0c avformat/asfdec_f: Fix overflow check in get_tag()
Fixes: signed integer overflow: 2 * 1210064928 cannot be represented in type 'int'
Fixes: 20873/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5761116909338624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c8140fe732)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
a0af4f6926 avformat/nsvdec: Fix memleaks on errors while reading the header
Fixes: memleaks
Fixes: 21084/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5655975492321280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 96c0469455)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
ce53f179ac avcodec/ffwavesynth: Fix integer overflow in computation of ddphi
Fixes: signed integer overflow: 1302123111085380114 - -8319005078741256972 cannot be represented in type 'long'
Fixes: 20991/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5148554161291264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c85bf16318)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
80cf78e4d6 avcodec/adpcm: Fix invalid shift in AV_CODEC_ID_ADPCM_PSX
Fixes: left shift of negative value -1
Fixes: 20859/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_PSX_fuzzer-5720391507247104

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0a11ef68f0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
c8c2855510 avcodec/mpeg12dec: Fix invalid shift in mpeg2_fast_decode_block_intra()
Fixes: left shift of negative value -695
Fixes: 19232/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5702856963522560
Fixes: 19555/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5741218147598336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c40df2166c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
28163cb7ad avcodec/mpegaudioenc_template: fix invalid shift of sample
Fixes: Ticket8010

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a2c97a8342)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
a70f312df1 avcodec/motion_est_template: Fix invalid shifts in no_sub_motion_search()
Fixes: Ticket8167

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e13eee37ee)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
11bb3cc107 libavformat/avienc: Check bits per sample for PAL8
Fixes: assertion failure
Fixes: Ticket 8172

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3595878281)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
5e81e1fb11 avformat/mpegts: Improve the position determination for avpriv_mpegts_parse_packet()
Fixes: assertion failure
Fixes: Ticket 8005

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e5bb48ae59)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
1bed5bf9e2 avcodec/magicyuv: Check that there are enough lines for interlacing to be possible
Fixes: out of array access
Fixes: 20763/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_fuzzer-5759562508664832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f8a0e9f9f7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
6587933021 avformat/mvdec: Check stream numbers
Fixes: null pointer dereference
Fixes: 20768/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5638648978735104.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 618a9bea65)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
7588b99a3b avcodec/pcm: Fix invalid shift in AV_CODEC_ID_PCM_LXF
Fixes: left shift of 233 by 24 places cannot be represented in type 'int'
Fixes: 20736/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PCM_LXF_fuzzer-4829212685107200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 051d11f659)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
5654c46336 avcodec/qdm2: Check fft_coefs_index
Fixes: out of array access
Fixes: 20660/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5658290216501248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9fc73bf022)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
1038603ebd avformat/avidec: Avoid integer overflow in NI switch check
Fixes: signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'long'
Fixes: Ticket8149

Found-by: Suhwan
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 347920ca21)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
ee19ae3290 fftools/ffmpeg: Fix integer overflow in duration computation in seek_to_start()
Fixes: signed integer overflow: -9223372036854775808 - 9223372036854775807 cannot be represented in type 'long'
Fixes: Ticket8142

Found-by: Suhwan
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4f4ad33d96)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
24cd98ec4a avfilter/vf_aspect: Fix integer overflow in compute_dar()
Fixes: signed integer overflow: 1562273630 * 17 cannot be represented in type 'int'
Fixes: Ticket8323

Found-by: Suhwan
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0c0ca0f244)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
b503ec1ae1 avcodec/apedec: Fix invalid shift with 24 bps
Fixes: left shift of negative value -463
Fixes: 20542/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5688714435231744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8e27867229)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Dale Curtis
baa0304074 avformat/utils: Fix undefined behavior in ff_configure_buffers_for_index()
When e2_pts == INT64_MIN and e1_pts >= 0 the calculation of
e2_pts - e1_pts will overflow an int64_t.

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f15007afa9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
1a54ee4a51 avcodec/wmalosslessdec: Fix integer overflow with sliding in padding bits
Fixes: signed integer overflow: -53716100 * 256 cannot be represented in type 'int'
Fixes: 20143/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5716604000403456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b8a0be9352)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
44da920eb7 avcodec/wmalosslessdec: Fix loop in revert_acfilter()
Fixes: out of array read
Fixes: 20059/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5691776237305856

No testcase except the fuzzed one.

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5584c0bb94)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
e1aa37ce1a avcodec/lagarith: Sanity check scale
A value of 24 and above can collaps the range to 0 which would not work.

Fixes: Timeout (75sec -> 21sec)
Fixes: 18707/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LAGARITH_fuzzer-5708950892969984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fb3855342b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
ba17b9961a avcodec/apedec: Fix integer overflows in predictor_decode_mono_3950()
Fixes: signed integer overflow: -2147407150 + -1871606 cannot be represented in type 'int'
Fixes: 18702/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5679095417667584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eb64a5c6f9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
f46cd02b63 avcodec/ralf: Fix integer overflow in apply_lpc()
Fixes: signed integer overflow: 2147482897 + 2048 cannot be represented in type 'int'
Fixes: 19240/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5743240326414336
Fixes: 19869/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5150136636538880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fd313d8cf8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
4b0a1becaa avcodec/dca_lbr: Fix some error codes and error passing
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bfea054a75)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
b68e717a2e avcodec/wmavoice: Fix rounding and integer anomalies in calc_input_response()
Fixes: out of array access
Fixes: inf is outside the range of representable values of type 'int'
Fixes: signed integer overflow: -9223372036854775808 - 1 cannot be represented in type 'long'
Fixes: 19316/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5677369365102592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 38d3758444)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
833cb46dfa avcodec/pcm: Fix invalid shift in pcm_decode_frame for LXF
Fixes: left shift of 32 by 28 places cannot be represented in type 'int'
Fixes: 19472/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PCM_LXF_fuzzer-5704364320096256

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 985d3666f6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
5e483df01f avcodec/snappy: Sanity check bytestream2_get_levarint()
Fixes: left shift of 79 by 28 places cannot be represented in type 'int'
Fixes: 20202/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5719004081815552
Fixes: 20219/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5641738677125120
Fixes: 20389/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5680721517871104

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit be54da2117)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
876997d462 avcodec/mlpdsp: Fix a invalid shift in ff_mlp_rematrix_channel()
Fixes: left shift of negative value -2
Fixes: 20305/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-5677196618498048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Jai Luthra <me@jailuthra.in>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fcc9f13717)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
cb3495c0cb avcodec/avdct: Clear IDCTDSPContext context
Fixes use of uninitialized variable and segfault

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b82825eba8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
10e807c860 avcodec/x86/diracdsp: Fix high bits on Windows x86_64
Found-by: james
(cherry picked from commit 24af459d1e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
753d8e4854 avformat/mov: Check STCO location
Fixes: bypassing of checks and assertion failure
Fixes: asan_1003879.mp4

Found-by: Clusterfuzz + asan
Reported-by: Thomas Guilbert <tguilbert@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1cd4184020)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
bb4afc18b8 avcodec/wmalosslessdec: Fix multiple integer overflows
Fixes: left shift of 3329 by 20 places cannot be represented in type 'int'
Fixes: signed integer overflow: -199378355 + -1948950833 cannot be represented in type 'int'
Fixes: 19837/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5752565837070336
Fixes: 19839/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5767483265122304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 422202516c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
a7d8e08ddf avcodec/apedec: Fix undefined integer overflow in decode_array_0000()
Fixes: signed integer overflow: -2143289344 - 6246400 cannot be represented in type 'int'
Fixes: 19239/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5173755680915456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a3655bb02c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
ee671c0e80 avcodec/smacker: Check space before decoding type
Fixes: Timeout (232sec -> 280ms)
Fixes: 19682/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKER_fuzzer-5654129649385472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6f5c18da59)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
bc752e53eb avcodec/rawdec: Use linesize in b64a
Fixes: out of array access
Fixes: 19750/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RAWVIDEO_fuzzer-5074834119983104

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2b5b9d5dac)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
7d90fce505 avcodec/iff: Over-allocate ham_palbuf for HAM6 IFF-PBM
IFF-PBM-HAM6 can read out of array without this overallocation
Fixes: Out of array read
Fixes: 19752/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5675331403120640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8652f4e7a1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
98d6a1f520 avcodec/x86/diracdsp: Fix incorrect src addressing in dequant_subband_32()
Fixes: Segfault (not reproducable with asm, which made this hard to debug)
Fixes: decoding errors
Fixes: 19854/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5729372837511168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0694b60b7b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
11dbad9f4c avfilter/vf_find_rect: Remove assert
A score of 0 is possible
Fixes: Ticket8500

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dfc4714886)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
d3bc68d505 avfilter/vf_find_rect: Increase worst case score
score could be 1.0 which lead to uninitialized values

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6ff2474e02)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
8ce02ab4e5 swscale/input: Fix several invalid shifts related to rgb2yuv constants
Fixes: Invalid shifts
Fixes: #8140
Fixes: #8146

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d48e510124)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
44d12d1ec9 swscale/output: Fix several invalid shifts in yuv2rgb_full_1_c_template()
Fixes: Invalid shifts
Fixes: #8320

Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7b7f97532b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
9a64d50c9e swscale/swscale: Fix several invalid shifts related to vChrDrop
Fixes: Invalid shifts
Fixes: #8166
Fixes: filter-crop_scale_vflip FATE-test

Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a6ca22c118)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
643d709d3a avcodec/hevc_mp4toannexb_bsf: check that nalu size doesnt overflow
Fixes: Out of array access
Fixes: 19299/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_MP4TOANNEXB_fuzzer-5169193398042624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a8ceb2a72f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
347773eb7c avcodec/hevc_mp4toannexb_bsf: Avoid NULL memcpy()
Fixes: invalid memcpy use
Fixes: 19299/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_MP4TOANNEXB_fuzzer-5169193398042624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1e23b5a706)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
9c10e71991 avcodec/wmalosslessdec: move channel check up
Fixes: out of array access
Fixes: 2nd part of 18429/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-6210814364614656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 891bcc4acc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
622e695d80 avcodec/adpcm: Fix overflow in FFABS() IMA_EA_EACS
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 19235/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_EA_EACS_fuzzer-5680878952382464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 794352ae9d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
f99ecf94cc avcodec/alac: Fix integer overflow in LPC coefficient adaption
Fixes: signed integer overflow: 267693597 * 10 cannot be represented in type 'int'
Fixes: 19237/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5755407700328448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6a865cec5e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
13b155ceaf avcodec/g729postfilter: Optimize out overflowing multiplication from apply_tilt_comp()
Fixes: signed integer overflow: -1114392282 * 2 cannot be represented in type 'int'
Fixes: 19236/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G729_fuzzer-5741678938030080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c0bd5fa43d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
1ef8357fee avcodec/vc1dec: Check field_mode for sprites
Fixes: Out of array read
Fixes: 19263/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5389219325542400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 32fb919836)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
02a7dd06a7 avcodec/vc1dec: Limit bits by the actual bitstream size
Fixes: Timeout (350 ->19sec)
Fixes: 19249/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-6566896438870016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c56a52a82c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
1ca83dd19f avcodec/vmdaudio: Check block_align more
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 19788/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMDAUDIO_fuzzer-5743379690553344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 06f6857b54)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Gyan Doshi
db998f9c54 configure: bump year
(cherry picked from commit 7b58702cbd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
2beb811cff avcodec/pgssubdec: Free subtitle on error
Fixes: Assertion failure
Fixes: 19753/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGSSUB_fuzzer-5688461843759104

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b0a718923b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
263afaf541 avcodec/ffwavesynth: Fix undefined overflow in wavesynth_synth_sample()
Fixes: signed integer overflow: 2147464192 + 21176 cannot be represented in type 'int'
Fixes: 19042/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5719828090585088

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fa47f6412d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
b20f2bec1b avcodec/cook: Use 3 stage VLC decoding for channel_coupling
Fixes: shift exponent -1 is negative
Fixes: out of array read
Fixes: 19028/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5759766471376896
Fixes: 19037/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5734106625474560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 89fd76db71)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
d692445dd9 avcodec/wmalosslessdec: Fixes undefined overflow in dequantization in decode_subframe()
Fixes: signed integer overflow: 47875596 * 45 cannot be represented in type 'int'
Fixes: 19082/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5687766512041984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 53efab44a9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
a731e95bea avcodec/sonic: Check e in get_symbol()
Fixes: signed integer overflow: 1721520852 + 1721520852 cannot be represented in type 'int'
Fixes: 18346/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5709623893426176
Fixes: 18753/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5663299131932672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aea6755611)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
c4b1fe4c15 avcodec/twinvqdec: Correct overflow in block align check
Fixes: signed integer overflow: 538976288 * 8 cannot be represented in type 'int'
Fixes: 19126/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TWINVQ_fuzzer-5687464110325760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4dc93ae3d7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
c8a6ca0299 avcodec/vc1dec: Fix "return -1" cases
Reviewed-by: "mypopy@gmail.com" <mypopy@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 26f040bcb4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
54152c08f6 avcodec/vc1dec: Free sprite_output_frame on error
Fixes: memleaks
Fixes: 19471/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5688035714269184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3ee9240be3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
a97438c354 avcodec/wmadec: Keep track of exponent initialization per channel
Fixes: division by 0
Fixes: 19123/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5655493121146880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bf5c850b79)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
e8c992e538 avcodec/iff: Check that video_size is large enough for the read parameters
video is allocated before parameters like bpp are read.

Fixes: out of array access
Fixes: 19084/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5718556033679360
Fixes: 19465/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5759908398235648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f1b97f62f8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
5251e09f2a avcodec/adpcm: Clip predictor for APC
Fixes: signed integer overflow: -2147483648 - 13 cannot be represented in type 'int'
Fixes: 18893/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_APC_fuzzer-5630760442920960

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9fe07908c3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
096b57c93b avcodec/targa: Check colors vs. available space
Fixes: Timeout (37sec -> 52ms)
Fixes: 18892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TARGA_fuzzer-5739537854889984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 01593278ce)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
9a053a9804 avcodec/dstdec: Use get_ur_golomb_jpegls()
Fixes: shift exponent -4 is negative
Fixes: 17793/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5766088435957760
Fixes: 18989/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5175008116867072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a76690c02b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
ed96a2491b avcodec/wmavoice: Check remaining input in parse_packet_header()
Fixes: Infinite loop
Fixes: 18914/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5731902946541568

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 19c41969b2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
9626dd3257 avcodec/wmalosslessdec: Fix 2 overflows in mclms
Fixes: signed integer overflow: 2038337026 + 109343477 cannot be represented in type 'int'
Fixes: 18886/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5673660505653248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 92455c8c65)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
b37e5eb31f avcodec/wmaprodec: Fixes integer overflow with 32bit samples
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 18860/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAPRO_fuzzer-5755223125786624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a9cc69c0d5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
1de4bc525c avcodec/adpcm: Fix invalid shift in xa_decode()
Fixes: left shift of negative value -1
Fixes: 18859/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_XA_fuzzer-5748474213040128

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 50db30b47d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
3b22dc6fec avcodec/wmalosslessdec: Fix several integer issues
Fixes: shift exponent -1 is negative (and others)
Fixes: 18852/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5660855295541248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ec3fe67074)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
f5f6d3cf91 avcodec/wmalosslessdec: Check that padding bits is not more than sample bits
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 18817/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5713317180211200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9d42826580)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
2351e997af avcodec/iff: Skip overflowing runs in decode_delta_d()
Fixes: Timeout (107sec - 75ms>
Fixes: 18812/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-6295585225441280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 185f441ba2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
ce9939160e avcodec/pnm: Check that the header is not truncated
Fixes: Ticket8430

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c94cb8d9b2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
19d02d6ff8 avcodec/mp3_header_decompress_bsf: Check sample_rate_index
Fixes: out of array read
Fixes: 19309/clusterfuzz-testcase-minimized-ffmpeg_BSF_MP3_HEADER_DECOMPRESS_fuzzer-5651002950942720

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f064c7c449)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
ef63ea76a6 avformat/rmdec: Initialize and sanity check offset in ivr_read_header()
Fixes: signed integer overflow: -9223372036854775808 - 17 cannot be represented in type 'long'
Fixes: 18768/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5674385247830016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7e665e4a81)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
7281f83903 avcodec/apedec: Fix 2 integer overflows
Fixes: signed integer overflow: 2119056926 - -134217728 cannot be represented in type 'int'
Fixes: 18728/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5747539563511808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6e15ba2d1f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
7ff8465a87 avcodec/wmaprodec: Set packet_loss when we error out on a sanity check
Fixes: left shift of negative value -34
Fixes: 18719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAPRO_fuzzer-5642658173419520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a9cbd25d89)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
34b8b3b8bd avcodec/truemotion2: Fix 2 integer overflows in tm2_low_res_block()
Fixes: signed integer overflow: 1778647621 + 574372924 cannot be represented in type 'int'
Fixes: 18692/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-6248679635943424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 93d52a181e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
ce0137298f avcodec/g729dec: require buf_size to be non 0
The 0 case was added with the support for multiple packets. It
appears unintended and causes extra complexity and out of array
accesses (though within padding)

No testcase

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f64be9da4c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
14c3ac2e04 avcodec/alac: Fix integer overflow in lpc_prediction() with sign
Fixes: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
Fixes: 18643/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5672182449700864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7686ba1f14)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
c0727c6dd1 avcodec/wmaprodec: Fix buflen computation in save_bits()
Fixes: Assertion failure
Fixes: 18630/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAPRO_fuzzer-5201588654440448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 589cb44498)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
224459717b avcodec/vc1_block: Fix integer overflow in AC rescaling in vc1_decode_i_block_adv()
Fixes: signed integer overflow: 50176 * 262144 cannot be represented in type 'int'
Fixes: 18629/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5182370286403584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0e010e489b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
44f4ee27ab avcodec/vmdaudio: Check chunk counts to avoid integer overflow
Fixes: signed integer overflow: 4 * 538976288 cannot be represented in type 'int'
Fixes: 18622/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMDAUDIO_fuzzer-5092166174507008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 47d963335e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
e3bcbaa7c9 avformat/mxfdec: Clear metadata_sets_count in mxf_read_close()
This avoids problems if the function is called twice

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 13816a1d08)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
19d2e68ddc avcodec/nuv: Use ff_set_dimensions()
Fixes: OOM
Fixes: 18956/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-5766505644163072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1ca978d636)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
55b661d777 avcodec/ffwavesynth: Fix integer overflow with pink_ts_cur/next
Fixes: signed integer overflow: 6175076100092079360 - -5034989061050195840 cannot be represented in type 'long'
Fixes: 18614/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5704508847423488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d82ab96e76)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
9accc4a832 avcodec/ralf: Fix integer overflows with the filter coefficient in decode_channel()
Fixes: signed integer overflow: 1145975808 - -1146173210 cannot be represented in type 'int'
Fixes: 18616/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5121296757424128

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 721624c2f6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
bc8dcbedca avcodec/g729dec: Use 64bit and clip in scalar product
The G729 reference decoder clips after each individual operation and keeps track if overflow
occurred (in the fixed point implementation), this here is
simpler and faster but not 1:1 the same what the reference does.

Non fuzzed samples which trigger any such overflow are welcome, so
the need and impact of different clipping solutions can be evaluated.

Fixes: signed integer overflow: 1271483721 + 1073676289 cannot be represented in type 'int'
Fixes: 18617/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5137705679978496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bf9c4a1275)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
e3ac98dab2 avcodec/mxpegdec: Check for multiple SOF
Fixes: Timeout (14sec -> 9ms)
Fixes: 18598/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-5726095261564928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 75b64e5aa3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
c998f15357 avcodec/nuv: Move comptype check up
Fixes: Timeout (23sec -> 5ms)
Fixes: 18517/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-5753135536013312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1138cdecbe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
1d19208020 avcodec/wmavoice: Fix integer overflow in synth_frame()
Fixes: left shift of negative value -3
Fixes: 18518/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-6560514359951360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cf323f4d38)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
ed0fa59bd7 avcodec/rawdec: Check bits_per_coded_sample more pedantically for 16bit cases
Fixes: shift exponent -14 is negative
Fixes: 18335/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RAWVIDEO_fuzzer-5723267192586240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5634e20525)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
7a159bec19 avutil/lfg: Correct index increment type to avoid undefined behavior
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 18333/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COMFORTNOISE_fuzzer-5668481831272448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6014bcf1b7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
afbca5bd83 avcodec/cngdec: Remove AV_CODEC_CAP_DELAY
As is the decoder will never stop, it will cause an infinite loop. The RFC seems only
to speak of non empty packets so endlessly generating noise from the last empty flush
packets seems wrong.

Fixes: infinite loop
Fixes: 18333/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COMFORTNOISE_fuzzer-5668481831272448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 327a968817)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
3910ae5d4d avcodec/iff: Move index use after check in decodeplane8()
Fixes: index 9 out of bounds for type 'const uint64_t [8][256]'
Fixes: 18409/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5767030560522240
Fixes: 18720/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5651995784642560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a1f8b36cc4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
d9a8345d21 avcodec/atrac3: Check for huge block aligns
The largest documented frame size = block align is 1024 bytes
(https://wiki.multimedia.cx/index.php/ATRAC3)

Without a limit this can allocate arbitrary memory and trigger OOM
Fixes: OOM
Fixes: 18337/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3_fuzzer-5763861478637568
Fixes: 18556/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3AL_fuzzer-5646183334936576

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f09151fff9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
5454e8d95f avcodec/ralf: use multiply instead of shift to avoid undefined behavior in decode_block()
Fixes: left shift of negative value -249
Fixes: 18566/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5649394561187840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b7d02642b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
9a1b08f6d3 avcodec/wmadec: Require previous exponents for reuse
Fixes: division by zero
Fixes: 18474/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5764986962182144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c54b9fc42f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
ec0ab97fac avcodec/vc1_block: Fix undefined behavior in ac prediction rescaling
The intermediates are required to fit in 12bit (8.1.3.9 Coefficient Scaling)
See SMPTE 421M-2006 and Amendment 1-2007

Fixes: signed integer overflow: -20691 * 262144 cannot be represented in type 'int'
Fixes: 18479/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5128912371187712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7fc1baf0ca)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
0c67877df2 avcodec/apedec: Fixes integer overflow of res+*data in do_apply_filter()
Fixes: signed integer overflow: 7400 + 2147482786 cannot be represented in type 'int'
Fixes: 18405/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5708834760294400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dc3f327e74)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
bcfc8ccd04 avcodec/sonic: Fix integer overflow in predictor_calc_error()
Fixes: signed integer overflow: 5 * -1094995529 cannot be represented in type 'int'
Fixes: 18346/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5709623893426176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c8c17b8cef)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
b1af78f526 avformat/mp3dec: Check that the frame fits within the probe buffer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e9a335150a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Carl Eugen Hoyos
4b857fc113 lavc/tableprint_vlc: Remove avpriv_request_sample() from included files.
Fixes compilation with --enable-hardcoded-tables.
Fixes ticket #7962.

(cherry picked from commit c8232e5007)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
f6c2f3c762 avcodec/interplayacm: Fix overflow of last unused value
Fixes: signed integer overflow: -2147450880 - 65535 cannot be represented in type 'int'
Fixes: 18393/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5667520110919680

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 10eabb8e40)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
3db973db96 avcodec/adpcm: Fix undefined behavior with negative predictions in IMA OKI
Fixes: left shift of negative value -30
Fixes: 18392/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_OKI_fuzzer-5631771831435264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7786f6c30e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
31ded792d4 avcodec/cook: Move up and extend block_align check
Fixes: signed integer overflow: 2046820356 * 8 cannot be represented in type 'int'
Fixes: 18391/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5631674666188800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1c63edcdd2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
87b41afe27 avcodec/twinvq: Check block_align
Fixes: signed integer overflow: 538976288 * 8 cannot be represented in type 'int'
Fixes: 18348/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_METASOUND_fuzzer-6681325716635648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 97f778e9c5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
9fa00a6ade avcodec/cook: Enlarge gain table
Fixes: index 25 out of bounds for type 'float [23]'
Fixes: 18355/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5641398941908992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 50001cd440)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
e67955dcc6 avcodec/cook: Check samples_per_channel earlier
Fixes: division by zero
Fixes: 18362/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5653727679086592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 57750bb629)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
61cee1d67f avcodec/atrac3plus: Check split point in fill mode 3
Fixes: index 32 out of bounds for type 'int [32]'
Fixes: 18350/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3P_fuzzer-5643794862571520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit de5102fd92)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
b06f9b00ca avcodec/wmavoice: Check sample_rate
Fixes: left shift of 538976288 by 8 places cannot be represented in type 'int'
Fixes: 18376/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5741645391200256

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 55c97a7637)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
1c61c36389 avcodec/xsubdec: fix overflow in alpha handling
Fixes: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 18368/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XSUB_fuzzer-5702665442426880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9ea9973959)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
577f91346f avcodec/iff: Check available space before entering loop in decode_long_vertical_delta2() / decode_long_vertical_delta()
Fixes: Timeout (31sec -> 41ms)
Fixes: 18380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5645210121404416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 32b3c8ce7d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
d549c5d81f avcodec/apedec: Fix integer overflow in filter_3800()
Fixes: signed integer overflow: 2117181180 + 60483298 cannot be represented in type 'int'
Fixes: 18344/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5685327791915008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1c038c5c63)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
2acb1c9059 avcodec/ffv1dec: Use a different error message for the slice level CRC
This way they can be told apart easily

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit df498cf544)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
53f61bdcea avcodec/apedec: Fix undefined integer overflow in long_filter_ehigh_3830()
Fixes: signed integer overflow: -1094995529 * 2 cannot be represented in type 'int'
Fixes: 18281/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5692589180715008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1d1719a44d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
120ab2375c avcodec/dstdec: Check that AC probabilities are within range
ISO/IEC 14496-3:2005(E): "Each entry of P_one[ ][ ] is in the range of 1 to
128, corresponding to a probability of 1/256 to 128/256 of the next error bit (bit E, See Figure 10.5)..."

Fixes: Timeout (42sec ->1sec)
Fixes: 18181/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5736646250594304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0c3e1b395b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
47e60b2020 avcodec/dstdec: Check read_table() for failure
Fixes: Timeout (too long -> 42sec)
Fixes: 18181/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5736646250594304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 03ea8d8cd4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
e0983daf05 avcodec/snowenc: Fix 2 undefined shifts
Fixes: Ticket7990

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8802e329c8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
2720888c60 avformat/nutenc: Do not pass NULL to memcmp() in get_needed_flags()
This compared to the other suggestions is cleaner and easier to understand
keeping the condition in the if() simple.

This affects alot of fate tests.

See: [FFmpeg-devel] [PATCH 05/11] avformat/nutenc: Don't pass NULL to memcmp
See: [FFmpeg-devel] [PATCH]lavf/nutenc: Do not call memcmp() with NULL argument

Fixes: Ticket 7980

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e4fdeb3fce)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
7549beb2a2 avcodec/aacdec_template: Check samplerate
Fixes: signed integer overflow: 2 * 1881153568 cannot be represented in type 'int'
Fixes: 17996/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5687126468853760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7730bacb41)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
e7f409662c avcodec/truemotion2: Fix several integer overflows in tm2_low_res_block()
Fixes: signed integer overflow: 1077952576 + 1355863565 cannot be represented in type 'int'
Fixes: 16196/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5679842317565952

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2b655f55ea)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
f640a2d9a9 avcodec/utils: Check block_align
Fixes: out of array access
Fixes: 18432/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5675574936207360
Fixes: 18326/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5071752362721280
Fixes: 18384/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV1_fuzzer-5769439500304384

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f011572e66)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
313bdb49a6 avcodec/wmalosslessdec: Fix some integer anomalies
Fixes: left shift of negative value -341180
Fixes: 18401/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5686380134400000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d3dee676b8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
28ae690805 avcodec/adpcm: Fix invalid shifts in ADPCM DTK
Fixes: left shift of negative value -1
Fixes: 18397/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_DTK_fuzzer-5675653487132672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 34e701ff93)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
21436750a1 avcodec/apedec: Only clear the needed buffer space, instead of all
Fixes: Timeout (15sec -> 0.4sec)
Fixes: 18396/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5730080487112704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f17ea02001)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
3926e909fd avcodec/libvorbisdec: Fix insufficient input checks leading to out of array reads
Fixes: 16144/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVORBIS_fuzzer-5638618940440576
Fixes: out of array read

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 069be4aa5d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
a485e375e4 avcodec/vp5: Check render_x/y
Fixes: Timeout (15sec -> 91ms)
Fixes: 18353/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP5_fuzzer-5704150326706176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 698e042c77)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
ae1cc1089f avcodec/qdrw: Check input for header/skiped space before get_buffer()
Fixes: Timeout (21sec -> 0.8sec)
Fixes: 17990/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDRAW_fuzzer-5200374436200448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b63fbc19c0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
fee64199d3 avcodec/ralf: Skip initializing unused filter variables
Fixes: left shift of negative value -1
Fixes: 17890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5643307467669504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f4ecf6c39d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
68a9d6b6b3 avcodec/takdec: Fix overflow with large sample rates
Fixes: signed integer overflow: 2147483647 + 511 cannot be represented in type 'int'
Fixes: 17899/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5719753322135552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 42eb78059d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
1fe652551b avcodec/alsdec: Check that input space for header exists in read_diff_float_data()
Fixes: Timeout (21sec -> 8sec)
Fixes: 17832/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5737092172218368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 09581f7923)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
0799b34bbd avformat/pjsdec: Check duration for overflow
Fixes: signed integer overflow: -3 - 9223372036854775807 cannot be represented in type 'long'
Fixes: 17828/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5645915116797952

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1efaac6932)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
5cc96ce0e7 avcodec/ptx: Check that the input contains at least one line
Fixes: Timeout (19sec -> 44ms)
Fixes: 17816/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PTX_fuzzer-5704459950227456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a6ad328256)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
4e76df3ead avcodec/alac: Fix integer overflow in LPC
Fixes: signed integer overflow: 2147483628 + 128 cannot be represented in type 'int'
Fixes: 17783/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5146470595952640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 44b73a0568)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
31c2c9e811 avcodec/smacker: Fix integer overflows in pred[] in smka_decode_frame()
Fixes: signed integer overflow: -2147481503 + -32732 cannot be represented in type 'int'
Fixes: 17782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKAUD_fuzzer-5769672225456128

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a76897e19c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
da9b6f9e10 avcodec/aliaspixdec: Check input size against minimal picture size
Fixes: Timeout (15sec -> 72ms)
Fixes: 17774/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALIAS_PIX_fuzzer-5193929107963904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8c69310477)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
2a1b7258d8 avcodec/ffwavesynth: Fix integer overflows in pink noise addition
Fixes: signed integer overflow: -1795675744 + -1926578528 cannot be represented in type 'int'
Fixes: 17741/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5131336402075648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7916b6863c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
2408efea19 avcodec/vc1_block: Fixes integer overflow in vc1_decode_i_block_adv()
Fixes: signed integer overflow: 62220 * 262144 cannot be represented in type 'int'
Fixes: 17145/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5667394743173120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6fdeb20817)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
3ed8549b5d avcodec/wmalosslessdec: Check block_align
Fixes: NULL pointer dereference
Fixes: 18331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5652847445671936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c1c799271e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
1cff89a11f avcodec/g729postfilter: Fix left shift of negative value
Fixes: Ticket8176

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f0acc5064)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
1cb06b7a79 avcodec/binkaudio: Check sample rate
Fixes: signed integer overflow: 1092624416 * 2 cannot be represented in type 'int'
Fixes: 18045/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINKAUDIO_RDFT_fuzzer-5718519492116480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2fca09bce4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
a2d319fe34 avcodec/adpcm: Check initial predictor for ADPCM_IMA_EA_EACS
Fixes: signed integer overflow: -2147483360 - 631 cannot be represented in type 'int'
Fixes: 17701/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_EA_EACS_fuzzer-5711517319692288

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2f66e8436d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
462949e087 avcodec/apedec: Fix integer overflow in predictor_update_3930()
Fixes: signed integer overflow: -69555262 * 31 cannot be represented in type 'int'
Fixes: 17698/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5728970447781888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5c072c9ed7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
f884af4573 avcodec/g729postfilter: Fix undefined intermediate pointers
Fixes: index -49 out of bounds for type 'int16_t [192]'
Fixes: 17689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5756275014500352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0c61661a2c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
1334b5dae1 avcodec/g729postfilter: Fix undefined shifts
Fixes: left shift of negative value -12
Fixes: 17689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5756275014500352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6a4fdbf112)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
ac28d793c1 avcodec/lsp: Fix undefined shifts in lsp2poly()
Fixes: left shift of negative value -30635
Fixes: 17689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5756275014500352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2b93f52cd6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
7c985c6334 avcodec/adpcm: Fix left shifts in AV_CODEC_ID_ADPCM_EA
Fixes: left shift of negative value -1
Fixes: 17683/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_EA_R2_fuzzer-5111690013704192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8695fbec57)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
53bf9cb31c avformat/shortendec: Check k in probe
Fixes: Assertion failure
Fixes: 17640/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5708767475269632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ea770eb559)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
1af067b06f avfilter/vf_geq: Use av_clipd() instead of av_clipf()
With floats we cannot represent all 32bit integer dimensions

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c8813b1a98)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
e6431d2c2c avcodec/ituh263dec: Check input for minimal frame size
Fixes: Timeout (28sec -> 3sec)
Fixes: 17559/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H263_fuzzer-5681050776240128

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7f0498ed46)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
5bebc312fe avcodec/truemotion1: Check that the input has enough space for a minimal index_stream
Fixes: Timeout (18sec -> 0.4sec)
Fixes: 17585/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION1_fuzzer-5117015135617024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4a660fac98)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
a0453ff7c7 avformat/mpsubdec: Clear queue on error
Fixes: Memleaks
Fixes: 17219/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5720539124989952

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9a0d36e562)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
f18a2951aa avcodec/sunrast: Check that the input is large enough for the maximally compressed image
Fixes: Timeout (17sec -> 15ms)
Fixes: 17224/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SUNRAST_fuzzer-5663218491457536
Fixes: 17224/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SUNRAST_fuzzer-5735590015795200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bf0ba75c4a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
f7395b8343 avcodec/sunrast: Check for availability of maplength before allocating image
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 711ad71aea)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
1b7c5197ab avformat/subtitles: Check nb_subs in ff_subtitles_queue_finalize()
Fixes: null pointer dereference
Fixes: 17828/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5645915116797952
Fixes: Ticket8147

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 81b53913bb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
da5941248e avcodec/g2meet: Check for end of input in jpg_decode_block()
Fixes: Timeout (100sec -> 0.7sec)
Fixes: 8668/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5174143888130048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 61dd2e07be)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
4dda4cd775 avcodec/g2meet: Check if adjusted pixel was on the stack
This basically checks if a pixel that was coded with prediction
and residual could have been stored using a previous case.
This avoids basically a string of 0 symbols stored in less than
50 bytes to hit a O(n²) codepath.

Fixes: Timeout (too slow to wait -> immediately)
Fixes: 8668/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-4895946310680576

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9c84c162e9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
2f10c7553e avformat/electronicarts: If no packet has been read at the end do not treat it as if theres a packet
Fixes: Assertion failure
Fixes: 17770/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5700606668308480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c4de49edc4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
689af5e194 avcodec/utils: Check sample_rate before opening the decoder
Fixes: signed integer overflow: 2 * -1306460384 cannot be represented in type 'int'
Fixes: 17685/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_fuzzer-5747390337777664
Fixes: 17688/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5739287210885120
Fixes: 17699/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5678394531905536
Fixes: 17738/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5763415733174272
Fixes: 17746/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINKAUDIO_RDFT_fuzzer-5703008159006720

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 75fefb1fb7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
76b49dad73 avcodec/motionpixels: Mark 2 functions as always_inline
Fixes: Timeout (30sec -> 25sec)
Fixes: 17050/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOTIONPIXELS_fuzzer-5719149803732992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 017884bdc3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
70657ae897 avcodec/ralf: Fix integer overflow in decode_channel()
Fixes: signed integer overflow: -1094995519 * 64 cannot be represented in type 'int'
Fixes: 17030/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5640695838146560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fbb314b6f2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
0e0eba418f vcodec/vc1: compute rangex/y only for P/B frames
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int'
Fixes: 16976/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-4847262047404032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e75e7fe160)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
29bdf27f9d avcodec/vc1_pred: Fix invalid shifts in scaleforopp()
Fixes: left shift of negative value -2
Fixes: 16964/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5757853565976576

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ced9a1cd0a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
7c2a7c1a02 avcodec/vc1_block: Fix invalid shift with rangeredfrm
Fixes: left shift of negative value -7
Fixes: 16959/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-5200360825683968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c722a69253)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
ba0294877f avcodec/vc1: Check for excessive resolution
Fixes: overflow in aspect ratio calculation
Fixes: signed integer overflow: 393215 * 14594 cannot be represented in type 'int'
Fixes: 15728/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5661588893204480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 181e138da7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
9eef494603 avcodec/vc1: check REFDIST
"9.1.1.43 P Reference Distance (REFDIST)"
"The value of REFDIST shall be less than, or equal to, 16."

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7f7af9e294)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
3ef741291c avcodec/apedec: Fix several integer overflows in predictor_update_filter() and do_apply_filter()
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: signed integer overflow: -14527961 - 2147483425 cannot be represented in type 'int'
Fixes: 16380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5645957131141120
Fixes: 16968/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5716169901735936
Fixes: 17074/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5198710497083392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1e95a3e8a7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
0791e50495 avcodec/hevc_cabac: Tighten the limit on k in ff_hevc_cu_qp_delta_abs()
Values larger would fail subsequent tests.

Fixes: signed integer overflow: 5 + 2147483646 cannot be represented in type 'int'
Fixes: 16966/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5695709549953024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f63cd1963e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
c261eea59a avcodec/4xm: Check index in decode_i_block() also in the path where its not used.
Fixes: Infinite loop
Fixes: signed integer overflow: 2147483644 + 16 cannot be represented in type 'int'
Fixes: 16169/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5662570416963584
Fixes: 16782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5743163859271680
Fixes: 17641/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5711603562971136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 87ddf9f1ef)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
76f387bbad avcodec/atrac3: Check block_align
Fixes: Infinite loop
Fixes: 17620/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3_fuzzer-5086123012915200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2acbbe2623)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
da57f10917 avcodec/alsdec: Avoid dereferencing context pointer in inner interleave loop
This makes the decoder faster

Improves/Fixes: Timeout (22sec -> 20sec)
Testcase: 17619/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5078510820917248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 581a895c5c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
f28b6b740c avcodec/dstdec: Fix integer overflow in samples_per_frame computation
Fixes: Timeout (? -> 2ms)
Fixes: 17616/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5198057947267072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7dc0943d4a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
ed0ffdf09d avcodec/g729_parser: Check block_size
Fixes: Infinite loop
Fixes: 17611/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5765134928052224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 972a0a818f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
71e047e45c avcodec/utils: Optimize ff_color_frame() using memcpy()
4650975 -> 4493240 dezicycles

This optimizes lines 2 and later. Line 1 still uses av_memcpy_backptr()
This change originally fixed ossfuzz 10790 but this is now fixed by other
optimizations already

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 95e5396919)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
8527e9702c avcodec/aacdec: Check if we run out of input in read_stream_mux_config()
Fixes: Infinite loop
Fixes: 16920/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5653421289373696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3dce4d03d5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
0571e85e42 avcodec/utils: Use av_memcpy_backptr() in ff_color_frame()
Fixes: Timeout (191sec -> 53sec)
Fixes: 16908/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5711207859748864
Fixes: 10709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5630617975259136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 340ab13504)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
91e6e96640 avcodec/smacker: Fix integer overflow in signed int multiply in SMK_BLK_FILL
Fixes: signed integer overflow: 238 * 16843009 cannot be represented in type 'int'
Fixes: 16958/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKER_fuzzer-5193905355620352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 033d2c4884)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
69000f77bc avcodec/alac: Fix invalid shifts in 20/24 bps
Fixes: left shift of negative value -256
Fixes: 16892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-4880802642395136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b30c07cc2b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
dcb101dbd7 avcodec/alac: fix undefined behavior with INT_MIN in lpc_prediction()
Fixes: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
Fixes: 16786/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5632818851348480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0831cbfe09)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
e4050af186 avcodec/ffwavesynth: Fix integer overflow in timestamps
Fixes: signed integer overflow: 9223371075321077760 * 2 cannot be represented in type 'long'
Fixes: 16447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5698937431785472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c7ccbf40ed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
33a78c547a avcodec/adpcm: Check number of channels for MTAF
Fixes: out of array access
Fixes: 17608/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_MTAF_fuzzer-5074936267276288

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 74bbf9bc82)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
56a8faa9f9 avcodec/sunrast: Fix indention
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0728d64497)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
8828dded99 avcodec/sunrast: Fix return type for "unsupported (compression) type"
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0e8b7709a9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
35a5ce9061 avformat/mov: Check for EOF in mov_read_meta()
Fixes: Timeout (195sec -> 2ms)
Fixes: 16735/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5090676403863552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 093d1f4250)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
44b6cd884c avformat/cdxl: Fix integer overflow in intermediate
Fixes: signed integer overflow: 65535 * 65312 cannot be represented in type 'int'
Fixes: 16704/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6294115603447808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5c5575c8dc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
0394262515 avcodec/hevcdec: repeat character in skiped
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d2d8e797cc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
9940e9aa4e avcodec/htmlsubtitles: Avoid locale dependant isdigit()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b94cf549e2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
f775712d67 avcodec/alsdec: Check k from being outside what our implementation can handle
The specification does not seem to list what the maximum valid
value is

Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 16268/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5638164544225280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e125578994)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
eccef3a6f9 avcodec/aacps: Fix integer overflows in hybrid_synthesis()
Fixes: signed integer overflow: -822667928 + -1399761199 cannot be represented in type 'int'
Fixes: 15756/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5645182051024896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ec749ed222)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
86b84302f3 avcodec/vp56rac: delay signaling an error on truncated input
A threshold of 1 is sufficient for simple_dump_cut.webm, 10 is used
just to be sure the next truncated file doesnt cause the same issue

Obvious alternative fixes are to simply accept that the file is broken or to
write some advanced error concealment or to
simply accept that the decoder wont stop at the end of input.

Fixes: Ticket 8069 (artifacts not the differing md5 which was there before 1afd246960)
Fixes: simple_dump_cut.webm
Fixes: regression of 1afd246960

fate-vp5 changes because the last frame is truncated and now handled
differently.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b6b9ac5698)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 70fb3fa990d604211d5b24fc43cdfe31560de250)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
ebe45f5858 avcodec/vp5/6/8: use vpX_rac_is_end()
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ab56e62e8f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1dd89192c59df0d6655e9308a0782d8c7b259b18)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
fc9e307043 avcodec/vp56: Add vpX_rac_is_end() to check for the end of input
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0fb83b4c91)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
c51e5227ec avcodec/qdm2: Check frame size
Fixes: index 2304 out of bounds for type 'float [2304]'
Fixes: 16332/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5679142481166336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 12b909ba31)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
9f95fb5402 avcodec/vc1_pred: Fix refdist in scaleforopp()
Fixes: out of array access
Fixes: 16601/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5656105392275456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 413e0f2516)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
3030fe2ccd avcodec/vorbisdec: fix FASTDIV usage for vr_type == 2
This reverts a hunk from f1ca40ee00

Fixes: out of array read
Fixes: 16924/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5157893162139648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 722fd46965)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
9dce1e87e9 avcodec/iff: Check for overlap in cmap_read_palette()
Fixes: undefined memcpy() use
Fixes: 16302/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5678750575886336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dfa5d1a366)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
593f625081 avcodec/apedec: Fix 32bit int overflow in do_apply_filter()
Fixes: signed integer overflow: 2147480546 + 4096 cannot be represented in type 'int'
Fixes: 16280/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5123442566758400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9d3ddef519)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
7dc68569f1 avcodec/ralf: fix undefined shift in extend_code()
Fixes: left shift of negative value -3
Fixes: 16147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5658392722407424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4778407ab3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
1213f82a5c avcodec/ralf: fix undefined shift
Fixes: left shift of negative value -2
Fixes: 16145/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5146671058518016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ee886988e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
32bdad0a6c avcodec/bgmc: Check input space in ff_bgmc_decode_init()
Fixes: Infinite loop
Fixes: 16608/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5636229827133440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b54031a6e9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
8b132a9f99 avcodec/truemotion2: Fix multiple integer overflows in tm2_null_res_block()
Fixes: signed integer overflow: 1795032576 + 598344192 cannot be represented in type 'int'
Fixes: 16196/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5636723419119616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cc78783ce5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
50e0d2b1dc avcodec/vc1dec: Require res_sprite for wmv3images
non res_sprite leads to decoder delay which leads to assertion failure
Fixes: Assertion failure
Fixes: 16402/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5704510034411520
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int'
Fixes: 16425/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5692858838810624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9c6b400492)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
4dcc78c2ab avcodec/vc1_block: Check for double escapes
Fixes: out of array read
Fixes: 16331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5672735195267072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6962fd586e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
1db82d7367 avcodec/vorbisdec: Check get_vlc2() failure
Fixes: out of array read
Fixes: 16510/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5754510382727168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 07b948fe60)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
0e081d85b9 avcodec/tta: Fix integer overflow in prediction
Fixes: signed integer overflow: -395281576 + -1827578048 cannot be represented in type 'int'
Fixes: 16038/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5646109705240576

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7e9aecc9f3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
6aa71cdc31 avcodec/vb: Check input packet size to be large enough to contain flags
Fixes: Timeout (->9sec)
Fixes: 16292/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VB_fuzzer-5747063496638464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dea2591d4f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
81407e6b36 avcodec/cavsdec: Limit the number of access units per packet to 2
Fixes: Timeout (122sec -> 13ms)
Fixes: 15978/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5148925004087296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 37bc8e3249)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
8deca89efa avcodec/alac: Fix multiple integer overflows in lpc_prediction()
Fixes: signed integer overflow: 2088795537 + 2147254401 cannot be represented in type 'int'
Fixes: signed integer overflow: -1500363496 + -1295351808 cannot be represented in type 'int'
Fixes: signed integer overflow: -79560 * 32640 cannot be represented in type 'int'
Fixes: signed integer overflow: 2088910005 + 2088796058 cannot be represented in type 'int'
Fixes: signed integer overflow: -117258064 - 2088725225 cannot be represented in type 'int'
Fixes: signed integer overflow: 2088725225 - -117258064 cannot be represented in type 'int'
Fixes: 15739/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5630664122040320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ae3d6a337a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
b513cb8dfe avcodec/rl2: set dimensions
The dimensions are always 320x200 they are hardcoded in the demuxer.
Hardcode them instead in the decoder.

Fixes: Timeout (16sec -> 400ms)
Fixes: 15574/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RL2_fuzzer-5158614072819712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 965e766e48)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
ccd1cbb254 avcodec/aacdec: Add FF_CODEC_CAP_INIT_CLEANUP
Fixes: memleaks
Fixes: 16289/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5200695692623872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 48b86dd8a6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:49:26 +02:00
Michael Niedermayer
da4a0e0025 avformat/realtextdec: free queue on error
Fixes: memleak
Fixes: 16277/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5696629440512000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 493438fafc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
b6b0d71e4d avcodec/alsdec: Fix integer overflow in decode_var_block_data()
Fixes: signed integer overflow: 1927975249 - -514719744 cannot be represented in type 'int'
Fixes: 16413/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5651206856245248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 661a9b274b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
1d8b19e2bf avcodec/alsdec: Limit maximum channels to 512
There seems to be no limit in the specification and upto 64k could be stored
512 is choosen as limit as thats the maximum in a conformance sample

An alternative to this patch would be a max_channels variable

Fixes: OOM
Fixes: 16200/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5764788793114624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Thilo Borgmann <thilo.borgmann@mail.de>
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f51e4d026c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
225b144277 avcodec/anm: Check input size for a frame with just a stop code
Fixes: Timeout (11sec -> 6sec)
Fixes: 16344/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ANM_fuzzer-5673032000995328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1965161ef6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
adfd49ee98 avcodec/loco: Check left column value
Fixes: Timeout (42sec -> 379 ms)
Fixes: 16323/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5679178099195904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c812db814e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
43bdd56a8c avcodec/ffwavesynth: Fixes invalid shift with pink noise seeking
Fixes: left shift of negative value -961533698048
Fixes: 16242/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5738550670131200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cdea0206ef)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
205609f780 avcodec/ffwavesynth: Fix integer overflow for some corner case values
Fixes: left shift of negative value -14671840
Fixes: 16000/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5145977817661440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c4a88fb546)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
7aa7af699e avcodec/indeo2: Check remaining input more often
Fixes: Timeout (95sec -> 30ms)
Fixes: 14765/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO2_fuzzer-5692455527120896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpe
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 52939a2c57)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
ebe31077ce avcodec/diracdec: Check that slices are fewer than pixels
Fixes: Timeout (197sec ->144ms)
Fixes: 15034/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5733549405110272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fbbc8ba67f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
0d57e136af avcodec/vp56: Consider the alpha start as end of the prior header
Fixes: Timeout (23sec -> 71ms)
Fixes: 15661/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP6A_fuzzer-6257865947348992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit db78bc1297)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
8541dca46c avcodec/4xm: Check for end of input in decode_p_block()
Fixes: Timeout (81sec -> 0.2sec)
Fixes: 16169/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5662570416963584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8f92eb05e0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
e4bb18c368 avcodec/hnm4video: Optimize postprocess_current_frame()
Improves: Timeout (220sec -> 108sec)
Improves: 15570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HNM4_VIDEO_fuzzer-5085482213441536

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cd460f4da0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
63dd760bf9 avcodec/hevc_refs: Optimize 16bit generate_missing_ref()
Fixes: Timeout (86sec -> 8sec) [these numbers assume also "[FFmpeg-devel] [PATCH 2/5] [RFC] avcodec/hevcdec: Check for overread in hls_decode_entry()"]
Fixes: 15702/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5657764929470464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit da8936969f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
0f228c20e4 avcodec/dds: Use ff_set_dimensions()
Fixes: signed integer overflow: 2082471995 * 36 cannot be represented in type 'int'
Fixes: 16025/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DDS_fuzzer-5136663778426880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9cd1e939cf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
39f45d5aca avcodec/mpc8: Fix 32bit mask/enum
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 15817/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC8_fuzzer-5636626409062400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e8bb949ade)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
8c8e52fcc3 avcodec/alsdec: Fix integer overflows of raw_samples in decode_var_block_data()
This also makes the code consistent with the existing similar MUL64()
in decode_var_block_data()

Fixes: signed integer overflow: -7277630735906765035 + -3272193951413647896 cannot be represented in type 'long'
Fixes: 16015/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5666552818434048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fad3ec89b7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
f9337c3632 avcodec/alsdec: Fix integer overflow of raw_samples in decode_blocks()
Fixes: signed integer overflow: 2147483424 - -1772303236 cannot be represented in type 'int'
Fixes: 15708/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5067890362941440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce65232406)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
420849c2fa avcodec/alsdec: fix mantisse shift
Fixes: shift exponent -1 is negative
Fixes: 16039/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5656825657032704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 02346292a3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
9c901ffdee avcodec/aacdec_template: fix integer overflow in imdct_and_windowing()
Fixes: signed integer overflow: 2147483645 + 4 cannot be represented in type 'int'
Fixes: 15418/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5685269069561856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit da93e2b142)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Andreas Rheinhardt
c67412041b libavcodec/iff: Use unsigned to avoid undefined behaviour
The initialization of the uint32_t plane32_lut matrix uses left shifts
of the form 1 << plane; plane can be as big as 31 which means that this
is undefined behaviour as 1 will be simply an int. So make it unsigned
to avoid this.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f12e662a3d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
b2585db43a avcodec/alsdec: Check for block_length <= 0 in read_var_block_data()
Fixes: left shift of negative value -1
Fixes: 15719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5685731105701888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit be4fb282f9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
039c13f109 avcodec/vqavideo: Set video size
Fixes: out of array access
Fixes: 15919/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-5657368257363968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 02f909dc24)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
8dc0bcceba avcodec/sanm: Check extradata_size before allocations
Fixes: Leaks
Fixes: 15349/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5102530557640704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 172a43ce36)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
36292283b2 avcodec/mss1: check for overread and forward errors
Fixes: Timeout (106sec -> 14ms)
Fixes: 15576/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSS1_fuzzer-5688080461201408

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 43015afd7c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
33af0d0083 avcodec/dirac_parser: Fix overflow in dts
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 15568/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5634719611355136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 549fcba8fc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
1e42d9c60a avcodec/ralf: Fix undefined pointer in decode_channel()
Fixes: 16203/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5086088934195200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3c06ba1716)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
231f9d0302 avcodec/ralf: Fix integer overflow in apply_lpc()
Fixes: signed integer overflow: 1603085316 + 1238786562 cannot be represented in type 'int'
Fixes: 16203/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5086088934195200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ccca484324)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
f382c6498c avcodec/vorbisdec: Implement vr->classifications = 1
It appears no valid file uses this, so this is not testable with
a valid file.

Fixes: assertion failure
Fixes: 16187/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5638880618872832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5a5f12e3b3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
a9f7f378e8 avcodec/vorbisdec: Check parameters in vorbis_floor0_decode() before divide
Fixes: division by zero
Fixes: 16183/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5688966782648320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aecc9b96d6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
ae6bd1fd3e avformat/realtextdec: Check for duplicate extradata in realtext_read_header()
Fixes: memleak
Fixes: 16140/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5684008052064256

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 652ea23cb3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
db696af196 avcodec/apedec: Fix 2 signed overflows
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int'
Fixes: signed integer overflow: 2049431315 + 262759074 cannot be represented in type 'int'
Fixes: 16012/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5719016003338240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 392c028cd2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
a0cf2b8293 avcodec/mss3: Check for the rac stream being invalid in rac_normalize()
Fixes: out of array read
Fixes: 15982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSA1_fuzzer-5630676251967488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 99a172f3f4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
712e9b8caa avcodec/vc1_block: Check get_vlc2() return before use
Fixes: index -1 out of bounds for type 'const uint8_t [185][2]'
Fixes: 15720/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSS2_fuzzer-5666071933091840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2cb1f79735)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
9cbe9f8054 avcodec/apedec: Do not partially clear data array
Fixes: Assertion failure and memleak
Fixes: 15709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5182435093905408

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8e4b522c91)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
70ec9a6f7e avcodec/hnm4video: Forward errors of decode_interframe_v4()
Fixes: Timeout (108sec -> 160ms)
Fixes: 15570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HNM4_VIDEO_fuzzer-5085482213441536

Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9af8ce754b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
fbe4a21518 avcodec/vp3: Check that theora is theora
Theora is forced to be non zero if it is zero and a sample
is asked for, as suggested by reimar

Fixes: Timeout (2min -> 600ms)
Fixes: 15366/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-5737849938247680

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b4bf7226af)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
a2a8b9470a avcodec/vc1_pred: Fix invalid shift in scaleforsame()
Fixes: left shift of negative value -1
Fixes: 15531/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5759556258365440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6dfda35dd2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
4ef3aafa83 avcodec/vc1_block: Fix integer overflow in ff_vc1_pred_dc()
Fixes: signed integer overflow: 32796 * 65536 cannot be represented in type 'int'
Fixes: 15430/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5735424087031808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f31ed8f3b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
af988e8b8d avcodec/truemotion2: Fix several integer overflows in tm2_motion_block()
Fixes: 15524/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5173148372172800
Fixes: signed integer overflow: 13701388 - -2134868270 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9a353ea876)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
97b4a01596 avcodec/apedec: make left/right unsigned to avoid undefined behavior
Fixes: signed integer overflow: 755176387 + 1515360583 cannot be represented in type 'int'
Fixes: 15506/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5706859232624640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bf778af149)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
7f974f343e avcodec/apedec: Fix multiple integer overflows and undefined behaviorin filter_3800()
Fixes: left shift of negative value -4
Fixes: signed integer overflow: -15091694 * 167 cannot be represented in type 'int'
Fixes: signed integer overflow: 1898547155 + 453967445 cannot be represented in type 'int'
Fixes: 15258/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5759095564402688
Fixes: signed integer overflow: 962196438 * 31 cannot be represented in type 'int'
Fixes: 15364/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5718799845687296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 267eb2ab7f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
c11cc557c1 avformat/mpc: deallocate frames array on errors
Fixes: memleak on error path
Fixes: 15984/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5679918412726272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit da5039415c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
03ffaebe94 avcodec/eatqi: Check for minimum frame size
The minimum header is 8 bytes, the smallest bitstream that is passed to
the MB decode code is 4 bytes

Fixes: Timeout (35sec -> 18sec)
Fixes: 15800/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATQI_fuzzer-5684154517159936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5ffb8e8793)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
f4c653c387 avcodec/eatgv: Check remaining size after the keyframe header
The minimal size which unpack() will not fail on is 5 bytes
Fixes: Timeout (14sec -> 77ms) (testcase 15508)
Fixes: 15508/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATGV_fuzzer-5700053513011200
Fixes: 15996/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATGV_fuzzer-5751353223151616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 009ec8dc33)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
b58888b565 avcodec/assdec: undefined use of memcpy()
Fixes: null pointer passed as argument 2, which is declared to never be null
Fixes: 16008/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SSA_fuzzer-5650582821404672 (this is a separate issue found in this testcase)

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 47b6ca0b02)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
1b8026a23b avcodec/brenderpix: Check input size before allocating image
An incomplete image is not supported prior to this and will
not produce any output. This commit moves the failure before
time consuming operations.

Fixes: Timeout (81sec -> 76ms)
Fixes: 15723/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BRENDER_PIX_fuzzer-5147265653538816

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 38b6c48c43)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Matt Wolenetz
debbbb5ba6 lafv/wavdec: Fail bext parsing on incomplete reads
avio_read can successfully return even when less than the requested
amount of input was read. wavdec's bext parsing mistakenly assumed a
successful avio_read always read the full amount that was requested.
The result could be dictionary tags populated with partially
uninitialized values.

This change also fixes a broken assertion in wav_parse_bext_string that
was off-by-one, though no known current usage of that method hits that
broken case.

Chromium bug: 987270

Signed-off-by: Matt Wolenetz <wolenetz@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 052d41377a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
50fbf10414 avcodec/vorbisdec: Check vlc for floor0 dec vector offset
Fixes: out of array access
Fixes: 15649/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5729191309344768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 99f95f39c6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
208055fabf avcodec/vorbisdec: amplitude bits can be more than 25 bits
Fixes: assertion failure, invalid shift
Fixes: 15583/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5640157484548096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 308771a738)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
55a510ce32 avcodec/apedec: Fix various integer overflows
Fixes: signed integer overflow: -538976267 * 31 cannot be represented in type 'int'
Fixes: left shift of 65312 by 16 places cannot be represented in type 'int'
Fixes: 15255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5718831688843264
Fixes: 15547/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5691384901664768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 240bf0e596)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
a625520f85 avcodec/apedec: Fix multiple integer overflows in predictor_update_filter()
Fixes: signed integer overflow: -829262115 + -1410750414 cannot be represented in type 'int'
Fixes: 15251/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5651742252859392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0af08cb803)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
ab4b8e8aea avcodec/alsdec: fix undefined shift in multiply()
Fixes: left shift of negative value -6
Fixes: 15564/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5701655938465792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b880b3b236)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
b70e7e6eaf avcodec/alsdec: Fix 2 integer overflows
Fixes: signed integer overflow: 1270564968 + 904828220 cannot be represented in type 'int'
Fixes: 15402/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5755426823471104

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9cd0d94f59)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
eeff00c7da avcodec/flicvideo: Make line_packets int
Fixes: signed integer overflow: -32768 * 196032 cannot be represented in type 'int'
Fixes: 15300/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-5733319519502336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 54bd47f861)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
0c8edb3d65 avcodec/dvbsubdec: Use ff_set_dimensions()
Fixes: signed integer overflow: 65313 * 65313 cannot be represented in type 'int'
Fixes: 15740/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVBSUB_fuzzer-5641749164195840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5941b7f615)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
6227ab340a avcodec/ffwavesynth: Check if there is enough extradata before allocation
Fixes: OOM
Fixes: 15750/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5702090367696896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 65bac4a782)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
a7ddecc18f avcodec/ffwavesynth: More correct cast in wavesynth_seek()
Fixes: signed integer overflow: 553590816 - -9223372036315799520 cannot be represented in type 'long'
Fixes: 15743/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5705835377852416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f4605770af)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
80a204d616 avcodec/ffwavesynth: Check sample rate before use
Fixes: division by zero
Fixes: 15725/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5641231956180992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c95857a423)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
4c8560e743 avformat/utils: Check rfps_duration_sum for overflow
Fixes: signed integer overflow: 9151595917793558550 + 297519050751678697 cannot be represented in type 'long'
Fixes: 15496/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5722866475073536

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5c46fdf305)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
63e9227f36 avcodec/h264_refs: Also check reference in ff_h264_build_ref_list()
Fixes: out of array read
Fixes: 15409/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5758846959616000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7d3581e6bb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
941ca8fb71 avcodec/parser: Check next index validity in ff_combine_frame()
Fixes: out of array access
Fixes: 15522/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DNXHD_fuzzer-5747756078989312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 15008db0fa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
d68a494271 avcodec/ivi: Ask for samples with odd tiles
Fixes: Assertion failure
Fixes: 15422/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO5_fuzzer-5676625481433088

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a7e02cf3ad)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
a1b60ae5e5 avformat/xmv: Make bitrate 64bit
Fixes: signed integer overflow: 32 * 538976288 cannot be represented in type 'int'
Fixes: 15633/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5752273981931520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 39a6a79bcb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
91915f44f5 avcodec/pngdec: Check that previous_picture has same w/h/format
Fixes: out of array access
Fixes: 15540/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-5684905029140480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 18c808ffbe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
e638460d74 avcodec/huffyuv: remove gray8a (the format is listed but not supported by the implementation)
Fixes: null pointer dereference
Fixes: 15464/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-5681391150301184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6aaa01afe4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
71100d7102 avcodec/mpc8: Fixes invalid shift in mpc8_decode_frame()
Fixes: left shift of negative value -456
Fixes: 15561/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC8_fuzzer-5758130404720640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1dbb67d39b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
cea8e10a0f avcodec/golomb: Correct the doxy about get_ue_golomb() and errors
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1bb3b3f11c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
b735adcec5 avformat/utils: Check timebase before use in estimate_timings()
Fixes: division by 0
Fixes: 15480/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5746727434321920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f57e97dfd9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
1da95b4bd1 avcodec/hq_hqa: Use ff_set_dimensions()
Fixes: 15530/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-5637370344374272
Fixes: signed integer overflow: 65312 * 65312 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a6229fcd40)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
0d4df82e2a avcodec/rv10: Fix integer overflow in aspect ratio compare
Fixes: signed integer overflow: 2040 * 1187872 cannot be represented in type 'int'
Fixes: 15368/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV20_fuzzer-5681657136283648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 14fcf42958)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
9b01f16af8 avcodec/4xm: Fix signed integer overflows in idct()
Fixes: signed integer overflow: 20242 * 121095 cannot be represented in type 'int'
Fixes: 15310/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5737051745419264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2bbea155bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
3150e804d5 avcodec/qdm2: Check checksum_size for 0
Fixes: Infinite loop
Fixes: 15337/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5757428949319680

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7b2ebf89a4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
8a95eef287 avcodec/qdm2: error out of qdm2_fft_decode_tones() before entering endless loop
Fixes: signed integer overflow: 2147483646 + 2 cannot be represented in type 'int'
Fixes: infinite loop
Fixes: 15396/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5116605501014016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 694be24bd6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
454bb7e366 avcodec/qdm2: Do not read out of array in fix_coding_method_array()
Instead we ask for a sample, its unclear what to do in this case.

Fixes: index 30 out of bounds for type 'int8_t [30][64]'
Fixes: 15339/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5749441484554240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ae021c1239)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
d293006885 avcodec/svq3: Use ff_set_dimension()
Fixes: OOM
Fixes: 15410/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-5659464805384192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7b114d7687)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
5749fb774c avcodec/iff: Check ham vs bpp
This checks the ham value much stricter and avoids hitting cases which cannot be reached
with data from the libavformat demuxer.

Fixes: out of array access
Fixes: 15320/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5080476840099840
Fixes: 15423/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5630765833912320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f76d7352e0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
e6aaa2a989 avcodec/ffwavesynth: use uint32_t to compute difference, it is enough
Fixes: signed integer overflow: 6494225984479297536 - -6043795377581187040 cannot be represented in type 'long'
Fixes: 15285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5632780307791872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e9dd3c7126)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
f7e9ce34c5 avcodec/ffwavesynth: Simplify lcg_seek(), avoid negative case
Fixes: negation of -9223372036854775808 cannot be represented in type 'int64_t' (aka 'long'); cast to an unsigned type to negate this value to itself
Fixes: 15289/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5709034499342336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8c02209935)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
18beff1709 avcodec/ffwavesynth: Fix backward lcg_seek()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cf2bd3ce79)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
5e5577ff87 avcodec/vc1_block: Check for vlc error in vc1_decode_ac_coeff()
Fixes: index -1 out of bounds for type 'const uint8_t [185][2]'
Fixes: 15250/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5648992869810176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 79204a1fc8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
345a3b8edf avcodec/alac: Check lpc_quant
lpc_quant of 0 produces undefined behavior, thus disallow this.
If valid samples use this then such a sample would be quite
usefull to confirm the correct&lossles handling of this.

Fixes: libavcodec/alac.c:218:25: runtime error: shift exponent -1 is negative
Fixes: 15273/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5656388535058432
Fixes: 15276/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5761238417539072
Fixes: 15315/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5767260766994432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a6474b899c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
bf0af79cbc avcodec/alsdec: Add FF_CODEC_CAP_INIT_CLEANUP
Fixes: multiple memleaks
Fixes: 15293/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5642409288925184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b7b6ddd596)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
213304972e avcodec/alsdec: Fix integer overflow with buffer number
Fixes: signed integer overflow: 65313 * 65313 cannot be represented in type 'int'
Fixes: 15290/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5738074249625600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f64f6058e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
b1334c7740 avcodec/alsdec: Check opt_order / sb_length in ra_block handling
Fixes: out of array access
Fixes: 15277/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5184853437317120
Fixes: 15280/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5741062137577472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0794494c8f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
9dd910ad2a avcodec/alsdec: Fix integer overflow with shifting samples
Fixes: signed integer overflow: -346039050 * 8 cannot be represented in type 'int'
Fixes: 15283/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5692700268953600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a3bd4b260e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
b5c293030a avcodec/alsdec: Fix undefined behavior in decode_rice()
Fixes: left shift of 72 by 26 places cannot be represented in type 'int'
Fixes: 15279/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5700665621348352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 51f6870c37)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
dc94ace788 avcodec/alsdec: Fixes invalid shifts in read_var_block_data() and INTERLEAVE_OUTPUT()
Fixes: left shift of negative value -6
Fixes: 15275/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5742361767837696
Fixes: signed integer overflow: 41582592 * 256 cannot be represented in type 'int'
Fixes: 15296/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5739558227935232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e131568752)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
5cbd861f0f avcodec/apedec: Add k < 24 check to the only k++ case which lacks such a check
Fixes: 15255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5718831688843264
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3d4f4f4a15)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
07af2b695d avcodec/m101: Fix off be 2 error
Fixes: out of array read
Fixes: 15263/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_M101_fuzzer-5728999453491200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 89b96900fa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
6e1ea9c2c5 avcodec/qdm2: Move fft_order check up
This avoids undefined computations with unchecked values

Fixes: shift exponent -21 is negative
Fixes: 15262/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5651261753393152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8d8b8c4ac6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
758f16b475 avcodec/libvorbisdec: Check extradata size
Fixes: out of array read
Fixes: 15261/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVORBIS_fuzzer-5764908467093504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cf3c245566)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
e6641846b0 avformat/vqf: Check header_size
Fixes: 15271/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5735262606327808
Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7c30ff3888)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
6f4e118f63 avcodec/utils: Check bits_per_coded_sample
This avoids the need for each decoder separately having to handle this case

Fixes: shift exponent -100663046 is negative
Fixes: out of array access
Fixes: 15270/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5727829913763840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d33414d2ad)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
0f89ff5b11 avcodec/videodsp_template: Fix overflow of addition
Fixes: addition of unsigned offset to 0x7f56fc26a9b6 overflowed to 0x7f56fc26a8be*
Fixes: clusterfuzz-testcase-minimized-mediasource_MP4_AVC1_pipeline_integration_fuzzer-4917949056679936

Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 247a1de7f7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
70afff15e5 avcodec/alsdec: Fix invalid shift in multiply()
Fixes: shift exponent -24 is negative
Fixes: 15292/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5768533318828032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f30be1ec98)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
424a6cda84 avcodec/ffwavesynth: Check ts_end - ts_start for overflow
Fixes: signed integer overflow: 2314885530818453536 - -8926099139098304480 cannot be represented in type 'long'
Fixes: 15259/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5764366093254656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2db7a3bc4a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
2e01ce019f avcodec/vc1dsp: Avoid undefined shifts in vc1_v_s_overlap_c / vc1_h_s_overlap_c
Fixes: left shift of negative value -13
Fixes: 15260/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5702076048343040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 507ca66ee4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
97d7505017 avcodec/tta: Fix undefined shift
Fixes: left shift of negative value -4483
Fixes: 15256/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5738691617619968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ebccd2f778)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
dd79db8188 avcodec/bintext: Check font height
Fixes: division by zero
Fixes: 15257/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINTEXT_fuzzer-5757352881422336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bfb58bdd70)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
de1524267e avcodec/binkdsp: Fix integer overflows in idct
Fixes: signed integer overflow: 3784 * 682038 cannot be represented in type 'int'
Fixes: 15265/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5088311799971840
Fixes: 15268/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5666502344179712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7a072fbcc4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
39f5835d89 avcodec/motionpixels: Check for vlc error in mp_get_vlc()
Fixes: 15246/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOTIONPIXELS_fuzzer-5168534407086080
Fixes: runtime error: index -1 out of bounds for type 'HuffCode [16]'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 930cdef80a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
5449787c47 avcodec/loco: Limit lossy parameter so it is sane and does not overflow
Fixes: 15248/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5087440458481664
Fixes: signed integer overflow: 3 + 2147483647 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce3b0b9066)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
857ecd6f2e avformat/mov: Set fragment.found_tfhd only after TFHD has been parsed
Fixes: Assertion failure
Fixes: crbug971646.mp4

Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 696312c487)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
93f48a978b avcodec/aacpsdsp_template: Fix integer overflow in ps_hybrid_analysis_c()
Fixes: signed integer overflow: -1539565182 + -798086761 cannot be represented in type 'int'
Fixes: 14807/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-564925382682214

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f8f5668df5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
e9178f35fc avcodec/truemotion2: Fix integer overflow in last loop in tm2_update_block()
Fixes: signed integer overflow: -1727985666 - 538976288 cannot be represented in type 'int'
Fixes: 15031/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5100228035739648

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3aecd01704)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
c9ee2ce31b avcodec/iff: finetune the palette size check in the mask case
Fixes: out of array access
Fixes: 15381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5668057826983936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0f9789c8e3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
7d640c8d30 avcodec/iff: Fix mask_buf / mask_palbuf leak
Fixes: 15372/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5708881759567872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 92e8db532c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
e17ac25646 avformat/icodec: Free ico->images on error paths
Fixes: 15116/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5715173567889408
Fixes: memleak

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 54918b5116)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
5d9b5e719d avformat/wsddec: Fix undefined shift
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 15123/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5738039235575808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 112eb17a2b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
63f5e2fd3b avcodec/bink: Reorder operations in init to avoid memleak on error
Fixes: Direct leak of 536 byte(s) in 1 object(s)
Fixes: 15266/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5629530426834944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2603f25d32)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
09f8ed7077 avformat/wtvdec: Avoid (32bit signed) sectors
Fixes: left shift of negative value -14614752
Fixes: 15174/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5670543606415360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dd357d76e5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
804f68d91e avcodec/bitstream: Check for more conflicting codes in build_table()
Fixes: out of array read
Fixes: 14563/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5646451545210880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a7e3b271fc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
9e1fcf4975 avcodec/bitstream: Check for integer code truncation in build_table()
Fixes: out of array read
Fixes: 14563/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5646451545210880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e78b0f8374)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
d098178905 avformat/sbgdec: Fixes integer overflow in str_to_time() with hours
Fixes: signed integer overflow: 904444 * 3600 cannot be represented in type 'int'
Fixes: 15113/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5764083346833408

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2a0f23b9d6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
b07457f4c4 avformat/vpk: Check offset for validity
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aa003019ab)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
bf34934436 avformat/vpk: Fix integer overflow in samples_per_block computation
Fixes: signed integer overflow: 84026453 * 28 cannot be represented in type 'int'
Fixes: 15111/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5675630072430592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8c6c4129b4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
140ca0c025 avcodec/mjpegdec: Check for non ls PAL8
Fixes: Null-dereference READ in av_malloc
Fixes: 15002/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-5643474625363968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 442375fee7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
ab203f9157 avcodec/h264_parse: Use 64bit for expectedpoc and expected_delta_per_poc_cycle
Fixes: signed integer overflow: -2142516591 + -267814575 cannot be represented in type 'int'
Fixes: 14450/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5716105319940096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4896fa18ad)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
b625f2b6d4 avcodec/mss4: Check input size against skip bits
Fixes: Timeout (17sec -> 20ms)
Fixes: 14615/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MTS2_fuzzer-5093007763701760
Fixes: 14797/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MTS2_fuzzer-5651696119709696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0fef412dff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
c5aa4f6c12 avcodec/diracdec: Fix integer overflow in global_mv()
Fixes: signed integer overflow: 16384 * 196607 cannot be represented in type 'int'
Fixes: 14810/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5091232683917312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a99ffb5bb4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
71d9293663 avcodec/vmnc: Check available space against chunks before reget_buffer()
Fixes: Timeout (16sec -> 60ms)
Fixes: 14673/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMNC_fuzzer-5640217517621248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 279d9a84af)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
806d1e3253 avcodec/aacdec_template: skip apply_tns() if max_sfb is 0 (from previous header decode failure)
Fixes: NULL pointer dereference
Fixes: 14723/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5654612436058112
Fixes: 14724/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5712607111020544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cf3156e762)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
1a18b09031 avcodec/aacdec_fixed: Handle more extreem cases in noise_scale()
Its unclear if these cases have any relevance in real files

Fixes: shift exponent -2 is negative
Fixes: 14489/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5681941631729664

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3d14663f83)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
2d2c079688 avcodec/aacdec_template: Merge 3 #ifs related to noise handling
Fewer #if and fewer lines

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bc33c99d56)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
52410bc41a avcodec/aacdec_fixed: ssign seems always -1 in noise_scale(), simplify
(cherry picked from commit 3d5863d739)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
276e97f055 avformat/mp3enc: Avoid SEEK_END as it is unsupported
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bf3ee6a130)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
deaa56a055 avcodec/truemotion2: Fix several integer overflows in tm2_update_block()
Fixes: signed integer overflow: -1877966852 + -469491713 cannot be represented in type 'int'
Fixes: 14561/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5167608359288832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8eecf761a6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
9f8f52f35b avformat/webm_chunk: Specify expected argument length of get_chunk_filename()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1a74b04737)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
d62af7c542 avformat/webm_chunk: Check header filename length
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3b5b977c9f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:55 +02:00
Michael Niedermayer
58f6d9143c avcodec/cpia: Check input size also against linesizes and EOL
Fixes: Timeout (14sec -> 29ms)
Fixes: 14733/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CPIA_fuzzer-5707022445576192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Carl Eugen Hoyos <ceffmpeg@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3c0bfa7d1a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 12:11:54 +02:00
Andreas Rheinhardt
85c08cd6dc libavcodec/libvpxenc: Don't free user-provided AVPacket
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 26b4509690)
2020-05-23 20:49:42 +02:00
Andreas Rheinhardt
10b280a902 libavcodec/libmp3lame: Don't free user-provided AVPacket
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 7e6941e185)
2020-05-23 20:49:41 +02:00
Andreas Rheinhardt
c70ecbdef0 avcodec/libopusenc: Don't free user-provided AVPacket
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit b803993b6d)
2020-05-23 20:49:41 +02:00
Andreas Rheinhardt
2e0549f06d avformat/matroskadec: Fix default value of BlockAddID
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit dbc50f8a93)
2020-04-03 22:25:16 +02:00
James Almer
7df1cb3dce avcodec/bsf: check that AVBSFInternal was allocated before dereferencing it
This can happen when av_bsf_free() is called on av_bsf_alloc() failure.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit d889ae3396)
2019-09-23 10:08:57 -03:00
Carl Eugen Hoyos
9b236547f4 lavf/rawenc: Only accept the appropriate stream type for raw muxers.
This does not affect the rawvideo muxer.

Fixes ticket #7979.

(cherry picked from commit aef24efb0c)
2019-09-06 18:57:57 -03:00
Mark Harris
5fd65ebf28 avutil/mem: Fix invalid use of av_alloc_size
The alloc_size attribute is valid only on functions that return a
pointer.  GCC 9 (not yet released) warns about invalid usage:

./libavutil/mem.h:342:1: warning: 'alloc_size' attribute ignored on a function returning int' [-Wattributes]
  342 | av_alloc_size(2, 3) int av_reallocp_array(void *ptr, size_t nmemb, size_t size);
      | ^~~~~~~~~~~~~

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4361293fcf)
2019-07-23 01:18:28 -03:00
Michael Niedermayer
ba11e4028c Changelog: Update
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-05-14 00:39:42 +02:00
Kevin Backhouse via RT
273f2755ce avcodec/htmlsubtitles: Fixes denial of service due to use of sscanf in inner loop for handling braces
Fixes: [Semmle Security Reports #19439]
Fixes: dos_sscanf2.mkv

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 894995c41e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-05-14 00:17:31 +02:00
Kevin Backhouse via RT
23ccf3cabb avcodec/htmlsubtitles: Fixes denial of service due to use of sscanf in inner loop for tag scaning
Fixes: [Semmle Security Reports #19438]
Fixes: dos_sscanf1.mkv

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1f00c97bc3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-05-14 00:17:30 +02:00
Michael Niedermayer
abdbbe8958 avcodec/htmlsubtitles: Be a bit more picky on syntax
This reduces the number of strstr() calls per byte
This diasalows empty tags like '< >' as well as '<' in tags like '<ab<cd<<ef>'

Fixes timeout
Fixes: 1817/clusterfuzz-testcase-minimized-5104230530547712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c61715e2c5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-05-14 00:17:29 +02:00
Michael Niedermayer
3a6bcc059c Changelog: update
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-05-13 14:10:33 +02:00
Adam Richter
280f5c4fcf libswcale: Fix possible string overflow in test.
In libswcale/tests/swcale.c, the function fileTest() calls sscanf in
an argument of "%12s" on character srcStr[] and dstStr[], which are
only 12 bytes.  So, if the input string is 12 characters, a
terminating null byte can be written past the end of these arrays.

This bug was found by cppcheck.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b8ed493061)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-05-13 14:09:27 +02:00
Michael Niedermayer
a649b62b90 avcodec/hq_hqa: Check available space before reading slice offsets
Fixes: Timeout (43sec -> 18sec)
Fixes: 14556/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-5673543024508928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 407e7c34ca)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-05-12 16:35:30 +02:00
Andreas Rheinhardt
9fad760f56 lavf/webm_chunk: Respect buffer size
The last argument of av_strlcpy is supposed to contain the size of the
destination buffer, but it was filled with the size of the source
string, effectively negating its very purpose.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 73ef1f47f5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-05-11 19:04:05 +02:00
Michael Niedermayer
e38fc0af12 Update for 3.2.14
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-05-10 23:54:43 +02:00
Michael Niedermayer
2d64c35764 avcodec/jvdec: Use ff_get_buffer() when the content is not reused
Fixes: Timeout (11sec -> 5sec)
Fixes: 14473/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JV_fuzzer-5761630857592832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 09edcd3572)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-05-09 11:50:03 +02:00
Michael Niedermayer
430850d2f0 avcodec/truemotion2: Fix 2 integer overflows in tm2_update_block()
Fixes: signed integer overflow: -2147483648 + -1 cannot be represented in type 'int'
Fixes: 14107/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5694078680825856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f4a1b8d409)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-05-09 11:27:34 +02:00
Michael Niedermayer
485546eec1 avcodec/jpeg2000: Check stepsize before using it
Fixes: value 1.87633e+10 is outside the range of representable values of type 'int'
Fixes: Undefined behavior
Fixes: 14246/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5758393601490944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 06ef186fa1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-05-09 11:23:13 +02:00
Michael Niedermayer
3adb15617d avcodec/aacdec_fixed: Fix undefined shift in noise_scale()
Fixes: 13655/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5120559430500352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8ea211ab79)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-05-09 11:22:35 +02:00
Michael Niedermayer
3905acef67 avutil/avstring: Fix bug and undefined behavior in av_strncasecmp()
The function in case of n=0 would read more bytes than 0.
The end pointer could be beyond the allocated space, which
is undefined.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6f0e9a8634)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-05-09 11:21:57 +02:00
Michael Niedermayer
d203563494 avformat/mov: Skip stsd adjustment without chunks
Fixes: Assertion failure
Fixes: clusterfuzz-testcase-minimized-media_pipeline_integration_fuzzer-5683096400822272

Found-by: Clusterfuzz
Reported-by: Dan Sanders <sandersd@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 18a567c369)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-05-09 11:21:25 +02:00
Michael Niedermayer
b5b12e2189 avformat/aadec: Check for scanf() failure
Fixes: use of uninitialized variables
Fixes: blank.aa

Found-by: Chamal De Silva <chamal.desilva@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ed188f6dcd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-05-09 11:18:13 +02:00
Michael Niedermayer
0dd99b0238 avcodec/ccaption_dec: Add a blank like at the end to avoid rollup reading from outside
Fixes: index 20 out of bounds for type 'const char *[4][128]'
Fixes: 14367/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CCAPTION_fuzzer-5718819672162304

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f17e8e90bb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-04-22 01:06:35 +02:00
Michael Niedermayer
3b2994552a avcodec/ivi: Move buffer/block end check to caller of ivi_dc_transform()
Fixes: assertion failure
Fixes: 14078/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO5_fuzzer-5760571284127744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 110dce9633)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-04-22 00:59:10 +02:00
Michael Niedermayer
49881ea343 avcodec/diracdec: Use 64bit in intermediate of global motion vector field generation
It seems the specification does not limit the value to 32bit

Fixes: signed integer overflow: -109611143 * 24 cannot be represented in type 'int'
Fixes: 13477/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5648337460527104

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 837820f385)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-04-22 00:54:06 +02:00
Michael Niedermayer
5f7ab544b3 avcodec/truemotion2: Fix integer overflow in tm2_decode_blocks()
Fixes: signed integer overflow: 255 + 2147483634 cannot be represented in type 'int'
Fixes: 13472/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5712444142387200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ad0533e91)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-04-22 00:52:53 +02:00
Michael Niedermayer
544f5fce12 avcodec/rscc: Check that the to be uncompressed input is large enough
Fixes: Out of array access
Fixes: 13984/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RSCC_fuzzer-5734128093233152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3a0ec1511e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-04-01 10:32:10 +02:00
Michael Niedermayer
cbfd062d16 avcodec/hevcdec: Avoid only partly skiping duplicate first slices
Fixes: NULL pointer dereference and out of array access
Fixes: 13871/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5746167087890432
Fixes: 13845/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5650370728034304

This also fixes the return code for explode mode

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 54655623a8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-27 08:50:03 +01:00
Carl Eugen Hoyos
0eeea04a71 lavc/bmp: Avoid a heap buffer overwrite for 1bpp input.
Found by Mingi Cho, Seoyoung Kim, and Taekyoung Kwon
of the Information Security Lab, Yonsei University.

(cherry picked from commit 1e34014010)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-27 08:47:32 +01:00
Michael Niedermayer
e20e5b38a6 avcodec/truemotion2: Fix integer overflow in tm2_null_res_block()
Fixes: signed integer overflow: 1111638592 - -2122219136 cannot be represented in type 'int'
Fixes: 13441/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5732769815068672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1223696c72)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-25 15:32:08 +01:00
Michael Niedermayer
9e96567e14 avcodec/dfa: Check the chunk header is not truncated
Fixes: Timeout (11sec -> 3sec)
Fixes: 13218/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DFA_fuzzer-5661074316066816

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f20760fadb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
Michael Niedermayer
5d28b2dc37 avcodec/dvbsubdec: Check object position
Reference: ETSI EN 300 743 V1.2.1  7.2.2 Region composition segment

Fixes: Timeout
Fixes: 13325/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVBSUB_fuzzer-5143979392237568

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a8c5ae4511)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
Michael Niedermayer
bed614b0cc avcodec/cdgraphics: Use ff_set_dimensions()
Fixes: Timeout (17 sec -> 65 milli sec)
Fixes: 13264/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CDGRAPHICS_fuzzer-5711167941509120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9a9f0e239c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
Michael Niedermayer
5ff9505770 avcodec/qpeg: Limit copy in qpeg_decode_intra() to the available bytes
Fixes: Timeout (27 sec -> 39 milli sec)
Fixes: 13151/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QPEG_fuzzer-5717536023248896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b819472995)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
Michael Niedermayer
8c69d65cb4 avcodec/aic: Check remaining bits in aic_decode_coeffs()
Fixes: Timeout (78 seconds -> 2 seconds)
Fixes: 13186/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AIC_fuzzer-5639516533030912

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 951bb7632f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
Michael Niedermayer
4e5a17e790 avcodec/bethsoftvideo: Check block_type
Fixes: Timeout (17 seconds -> 1 second)
Fixes: 13184/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BETHSOFTVID_fuzzer-5711446296494080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b8ecadec05)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
Michael Niedermayer
6299f85cf2 avcodec/jpeg2000dwt: Fix integer overflow in dwt_decode97_int()
Fixes: runtime error: signed integer overflow: 2147483598 + 128 cannot be represented in type 'int'
Fixes: 12926/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5705100733972480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4801eea0d4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
Michael Niedermayer
8a598030e2 avcodec/error_resilience: Use a symmetric check for skipping MV estimation
This speeds up the testcase by a factor of 4

Fixes: Timeout
Fixes: 13100/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV2_fuzzer-5767533905313792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e4289cb253)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
Michael Niedermayer
e9dbc7b309 avcodec/mlpdec: Insuffient typo
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fc32e08941)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
Michael Niedermayer
715b526d82 avcodec/zmbv: obtain frame later
The frame is not needed that early so obtaining it later avoids
the costly operation in case other checks fail.

Fixes: Timeout (14sec -> 4sec)
Fixes: 13140/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZMBV_fuzzer-5738330308739072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 177b40890c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
Michael Niedermayer
fdf19ce6c6 avcodec/jvdec: Check available input space before decode8x8()
Fixes: Timeout (78 sec -> 15 millisec)
Fixes: 13147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JV_fuzzer-5727107827630080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 61523683c5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
Michael Niedermayer
5773985902 avcodec/h264_direct: Fix overflow in POC comparission
Fixes: runtime error: signed integer overflow: 2147421862 - -33624063 cannot be represented in type 'int'
Fixes: 12885/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5733516975800320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5ccf296e74)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
Michael Niedermayer
0213519add avformat/webmdashenc: Check id in adaption_sets
Fixes: out of array access

Found-by: Wenxiang Qian
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b687b549aa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
Wenxiang Qian
a0692be43b avformat/http: Fix Out-of-Bounds access in process_line()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 85f91ed760)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
Wenxiang Qian
dacc00a2e3 avformat/ftp: Fix Out-of-Bounds Access and Information Leak in ftp.c:393
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a142ffdcae)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
Michael Niedermayer
f84464c6de avformat/matroskadec: Do not leak queued packets on sync errors
Fixes: memleak
Fixes: clusterfuzz-testcase-minimized-audio_decoder_fuzzer-5649187601121280

Reported-by: Chris Cunningham <chcunningham@google.com>
Tested-by: Chris Cunningham <chcunningham@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d1afa7284c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
chcunningham
750ec96f66 avformat/mov: validate chunk_count vs stsc_data
Bad content may contain stsc boxes with a first_chunk index that
exceeds stco.entries (chunk_count). This ammends the existing check to
include cases where chunk_count == 0. It also patches up the case
when stsc refers to unknown chunks, but stts has no samples (so we
can simply ignore stsc).

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1c15449ca9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
chcunningham
90c194710a avformat/mov.c: require tfhd to begin parsing trun
Detecting missing tfhd avoids re-using tfhd track info from the previous
moof. For files with multiple tracks, this may make a mess of the
avindex and fragindex, which can later trigger av_assert0 in
mov_read_trun().

Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3ea87e5d9e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
Michael Niedermayer
98b5ec4bc0 avcodec/pgssubdec: Check for duplicate display segments
In such a duplication the previous gets overwritten and leaks

Fixes: memleak
Fixes: 12510/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGSSUB_fuzzer-5694439226343424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e35c3d887b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
Michael Niedermayer
d116540d06 avformat/rtsp: Check number of streams in sdp_parse_line()
Fixes: OOM

Found-by: Michael Hanselmann <public@hansmi.ch>
Reviewed-by: Michael Hanselmann <public@hansmi.ch>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 497c9b0cce)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
Michael Niedermayer
e5ea21a580 avformat/rtsp: Clear reply in every iteration in ff_rtsp_connect()
Fixes: Infinite loop

Found-by: Michael Hanselmann <public@hansmi.ch>
Reviewed-by: Michael Hanselmann <public@hansmi.ch>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0b50f27635)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
Michael Niedermayer
20337eb106 avcodec/fic: Check that there is input left in fic_decode_block()
Fixes: Timeout
Fixes: 12450/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FIC_fuzzer-5661984622641152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit db1c4acd02)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
Michael Niedermayer
8ea2558ab7 avutil/mem: Optimize fill32() by unrolling and using 64bit
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 12b1338be3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-03-24 10:39:03 +01:00
James Almer
a06cd0283e avcodec/hevcdec: decode at most one slice reporting being the first in the picture
Fixes deadlocks when decoding packets containing more than one of the aforementioned
slices when using frame threads.

Tested-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 70c8c8a818)
2019-03-20 21:43:10 -03:00
Paul B Mahol
4321092be3 avfilter/af_silenceremove: fix possible crash if supplied duration is negative
Signed-off-by: Paul B Mahol <onemda@gmail.com>

Fixes ticket #7697.
(cherry picked from commit 2d1594a8d6)
2019-01-25 00:58:04 +01:00
James Almer
a97ea53ad9 configure: bump year
Happy new year!

(cherry picked from commit 3209d7b393)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 01:23:01 +01:00
Michael Niedermayer
05ed562862 Update for 3.2.13
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 01:17:07 +01:00
Michael Niedermayer
3389d479ac avcodec/diracdec: Check component quant
Fixes: Timeout
Fixes: 10708/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5730140957442048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 28c96c2ce2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 01:17:07 +01:00
Michael Niedermayer
53319cbe97 avcodec/tests/rangecoder: initialize array to avoid valgrind warning
Found-by: jamrial
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c15972f0af)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 00:57:27 +01:00
Michael Niedermayer
f4a9455e03 avcodec/h264_slice: Fix integer overflow in implicit_weight_table()
Fixes: signed integer overflow: 2 * 2132811760 cannot be represented in type 'int'
Fixes: 11156/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-6237685933408256

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 77e56d74f9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 00:57:27 +01:00
Michael Niedermayer
9f92a1d020 avcodec/exr: set layer_match in all branches
Otherwise it is left to the value from the previous iteration

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 433d2ae435)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 00:57:27 +01:00
Michael Niedermayer
aae57535ca avcodec/4xm: Fix returned error codes
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 07607a1db8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 00:57:27 +01:00
Michael Niedermayer
a27b49579d avcodec/mjpegbdec: Fix some misplaced {} and spaces
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 11a8d2ccab)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 00:57:27 +01:00
David Bryant
0eaff670a7 avformat/wvdec: detect and error out on WavPack DSD files
Not currently supported.

(cherry picked from commit db109373d8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 00:57:27 +01:00
gxw
0f9cb4e726 avcodec/mips: Fix failed case: hevc-conformance-AMP_A_Samsung_* when enable msa
The AV_INPUT_BUFFER_PADDING_SIZE has been increased to 64, but the value is still 32
in function ff_hevc_sao_edge_filter_8_msa. So, use AV_INPUT_BUFFER_PADDING_SIZE directly.
Also, use MAX_PB_SIZE directly instead of 64. Fate tests passed.

Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f652c7a45c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 00:57:27 +01:00
Michael Niedermayer
6e5238d55f avcodec/fic: Fail on invalid slice size/off
Fixes: Timeout
Fixes: 11486/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FIC_fuzzer-5677133863583744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 30a7a81cdc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 00:57:27 +01:00
Michael Niedermayer
5a82f570a4 postproc/postprocess_template: remove FF_REG_sp from clobber list
Future gcc may no longer support this

Tested-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c1cbeb87db)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 00:57:27 +01:00
Michael Niedermayer
bcf1557736 postproc/postprocess_template: Avoid using %4 for the threshold compare
This avoids problems if %4 is the stack pointer
the constraints do not allow %4 to be the stack pointer but gcc 9 may
no longer support specifying such constraints

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4325527e1c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 00:57:27 +01:00
Michael Niedermayer
a48c69a04e avcodec/rpza: Check that there is enough data for all the blocks
Fixes: Timeout
Fixes: 11547/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RPZA_fuzzer-5678435842654208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e63517e00a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 00:57:27 +01:00
Michael Niedermayer
b96292c6d3 avcodec/rpza: Move frame allocation to a later point
This will allow performing some fast checks before the slow allocation

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8a708aa99c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 00:57:27 +01:00
Michael Niedermayer
bcc42f1923 avcodec/avcodec: Document the data type for AV_PKT_DATA_MPEGTS_STREAM_ID
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 68e011e410)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 00:57:27 +01:00
Michael Niedermayer
d9010b1d8f avformat/mpegts: Fix side data type for stream id
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ab1319d82f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 00:57:27 +01:00
Michael Niedermayer
72536017a7 avcodec/mjpegdec: Fix indention of ljpeg_decode_yuv_scan()
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ea30ac1e40)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 00:57:27 +01:00
chcunningham
490a5253ca lavf/id3v2: fail read_apic on EOF reading mimetype
avio_read may return EOF, leaving the mimetype array unitialized. fail
early when this occurs to avoid using the array in an unitialized state.

Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ee1e39a576)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 00:57:27 +01:00
Michael Niedermayer
9925adcd68 avformat/nutenc: Document trailer index assert better
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3a95b73abc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 00:57:27 +01:00
chcunningham
418f13261f lavf/mov: ensure only one tkhd per trak
Chromium fuzzing produced a whacky file with extra tkhds. This caused
an AVStream that was already in use to be corrupted by assigning it a
new id, which blows up later in mov_read_trun because the
MOVFragmentStreamInfo.index_entry now points OOB.

Reviewed-by: Baptiste Coudurier <baptiste.coudurier@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c9f7b6f7a9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 00:57:27 +01:00
Michael Niedermayer
3c2207b10f avcodec/msvideo1: Check for too small dimensions
Such low resolution would result in empty output as a minimum of 4x4 is needed
We could also check for multiple of 4 dimensions but that is not needed

Fixes: Timeout
Fixes: 11191/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSVIDEO1_fuzzer-5739529588178944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 953bd58861)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 00:57:27 +01:00
Michael Niedermayer
4ff4fd4179 avcodec/wmv2dec: Skip I frame if its smaller than 1/8 of the minimal size
Frames that small are not valid and of limited use for error concealment, while
being very computationally intensive to process.

Fixes: Timeout
Fixes: 11168/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV2_fuzzer-5733782032744448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d6f4341522)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 00:57:27 +01:00
Michael Niedermayer
aa5190d54a avcodec/msmpeg4dec: Skip frame if its smaller than 1/8 of the minimal size
Frames that small are not valid and of limited use for error concealment, while
being very computationally intensive to process.

Fixes: Timeout
Fixes: 11318/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSMPEG4V1_fuzzer-5710884555456512

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 09ec182864)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 00:57:27 +01:00
Michael Niedermayer
f3400e731a avcodec/truemotion2rt: Fix rounding in input size check
Fixes: Timeout
Fixes: 11332/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2RT_fuzzer-5678456612847616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7f22a4ebc9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-01-15 00:57:27 +01:00
Michael Niedermayer
dfa3a5ac63 avcodec/truemotion2: fix integer overflows in tm2_low_chroma()
Fixes: 11295/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-4888953459572736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2ae39d7956)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-24 22:15:15 +01:00
Michael Niedermayer
de1d2ea6b2 avcodec/pngdec: Check compression method
method 0 (inflate/deflate) is the only specified in the specification and the only supported

Fixes: Timeout
Fixes: 10976/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PNG_fuzzer-5729372588736512

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1f99674ddd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:35:03 +01:00
Michael Niedermayer
0612e6a0d7 avcodec/shorten: Fix integer overflow with offset
Fixes: signed integer overflow: -1625810908 - 582229060 cannot be represented in type 'int'
Fixes: 10977/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5732602018267136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2f888771cd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:35:03 +01:00
Michael Niedermayer
d10266a96f avcodec/cavsdec: Propagate error codes inside decode_mb_i()
Fixes: Timeout
Fixes: 10702/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5669940938407936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c1cee05656)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:35:03 +01:00
Michael Niedermayer
875a5d055b avcodec/mpegaudio_parser: Consume more than 0 bytes in case of the unsupported mp3adu case
Fixes: Timeout
Fixes: 10966/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP3ADU_fuzzer-5348695024336896
Fixes: 10969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP3ADUFLOAT_fuzzer-5691669402877952

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit df91af140c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:35:03 +01:00
Michael Niedermayer
c2af767c3e avutil/integer: Fix integer overflow in av_mul_i()
Found-by: fate
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3cc3cb663b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:35:03 +01:00
Michael Niedermayer
e6f8f6a7ee avcodec/msrle: Check that the input is large enough to contain a end of picture code
Fixes: Timeout
Fixes: 10625/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSRLE_fuzzer-5659651283091456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 203ccb8746)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:35:03 +01:00
Michael Niedermayer
353ef58a82 avcodec/jpeg2000dec: Fix off by 1 error in JPEG2000_PGOD_CPRL handling
Fixes: assertion failure
Fixes: 10785/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5672160496975872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 305e523105)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:35:03 +01:00
Michael Niedermayer
1effc4baa1 avcodec/mpeg4videodec: Fix typo in sprite delta check
Fixes: Integer overflow
Fixes: 10890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5636062181851136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b737317a88)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:35:03 +01:00
Michael Niedermayer
72268fbdc3 avcodec/h264_cavlc: Check mb_skip_run
Fixes: 10300/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-6292205497483264
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f72b9904fe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:35:03 +01:00
Michael Niedermayer
f266eca585 avcodec/ra144: Fix integer overflow in add_wav()
Fixes: signed integer overflow: -2144033225 + -5208934 cannot be represented in type 'int'
Fixes: 10633/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-5679133791617024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c6282141cb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:35:03 +01:00
Michael Niedermayer
77d35ab734 avformat/utils: Never store negative values in last_IP_duration
Fixes: integer overflow compute_pkt_fields()
Fixes: compute_pkt_usan

Reported-by: Thomas Guilbert <tguilbert@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 079d1a7175)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:35:03 +01:00
Michael Niedermayer
9181ecd2e6 avformat/utils: Fix integer overflow in discontinuity check
Fixes: signed integer overflow: 7738135736989908991 - -7954308516317364223 cannot be represented in type 'long'
Fixes: find_stream_info_usan

Reported-by: Thomas Guilbert <tguilbert@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4e19cfcfa3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:35:03 +01:00
Michael Niedermayer
72babd45c8 avcodec/unary: Improve get_unary() docs
Found-by: kierank
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ad89e203bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:35:03 +01:00
Michael Niedermayer
7bcc4d7ea7 avcodec/dvdsubdec: Sanity check len in decode_rle()
Fixes: Timeout
Fixes: 9778/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVDSUB_fuzzer-5186007132536832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e7b023e1db)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:35:03 +01:00
Michael Niedermayer
64bccfd11d avcodec/mpeg4videodec: Fix undefined shift in get_amv()
Fixes: runtime error: shift exponent -1 is negative
Fixes: 9938/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5653783529914368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c88afa44c4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:35:03 +01:00
Michael Niedermayer
2baee6dd1b avcodec/zmbv: Check that the decompressed data size is correct
This checks the value exactly for intra frames and checks it against a
minimum for inter frames as they can be variable.

Fixes: Timeout
Fixes: 10182/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZMBV_fuzzer-6245951174344704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e33b28cc79)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:35:03 +01:00
Michael Niedermayer
5fe92631fc avcodec/zmbv: Update decomp_len in raw frames
decomp_len is used in raw frames, so it should not be left at the value from
whatever was decoded previously (which may be any other frame)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3d201b83cd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:35:03 +01:00
Michael Niedermayer
3b20cd4f65 avcodec/shorten: Fix bitstream end check in read_header()
Fixes: Timeout
Fixes: 9961/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5687856176562176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 28b80c2d52)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:35:03 +01:00
Michael Niedermayer
9f0e0a4cf2 avcodec/dvdsubdec: Avoid branch in decode_run_8bit()
Speed improvment 35.5 sec -> 34.7sec

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 71bf033050)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:35:03 +01:00
Michael Niedermayer
59c463f4cc avcodec/h264_refs: Document last if() in ff_h264_execute_ref_pic_marking()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 697984b9db)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:35:03 +01:00
Michael Niedermayer
a90f6d3e90 avcodec/ra144: Fix undefined integer overflow in add_wav()
Fixes: signed integer overflow: -26884 * 91439 cannot be represented in type 'int'
Fixes: 9687/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-4995588121690112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 93a203662f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:35:03 +01:00
Dale Curtis
a72d42b80f avformat/mov: Error on too large stsd entry counts.
Entries are always at least 8 bytes per the parsing code, so if we
see an impossible entry count avoid massive allocations. This is
similar to an existing check in mov_read_stsc().

Since ff_mov_read_stsd_entries() does eof checks, an alternative
approach could be to clamp the entry count to atom.size / 8.

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 320b631a99)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:20:44 +01:00
Michael Niedermayer
368e7a0994 avcodec/hq_hqa: Check remaining input bits in hqa_decode_mb()
Fixes: Timeout
Fixes: 9634/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-6267852259590144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c9222b972d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:20:44 +01:00
Michael Niedermayer
2df51ffcb7 avcodec/vb: Check for end of bytestream before reading blocktype
Fixes: Timeout
Fixes: 9601/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VB_fuzzer-4550228702134272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1cbac9ce20)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:20:44 +01:00
Michael Niedermayer
c6b7060137 avcodec/snowdec: Fix integer overflow with motion vector residual
Fixes: signed integer overflow: -19818 + -2147483648 cannot be represented in type 'int'
Fixes: 9545/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-4928769537081344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit acba153a14)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:20:44 +01:00
Michael Niedermayer
5d7bab77de avformat/nsvdec: Do not parse multiple NSVf
The specification states "NSV files may contain a single file header. "
Fixes: out of array access
Fixes: nsv-asan-002f473f726a0dcbd3bd53e422c4fc40b3cf3421

Found-by: Paul Ch <paulcher@icloud.com>
Tested-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 78d4b6bd43)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:20:44 +01:00
Michael Niedermayer
949995b225 avformat/mlvdec: read_string() received unsigned size, make the argument unsigned
Fixes: infinite loop
Fixes: mlv-timeout-e3b8cab9835edecad6823baa057e029671329d04

Found-by: Paul Ch <paulcher@icloud.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1e71cb2c8e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:20:44 +01:00
Michael Niedermayer
b535e8936b avformat/rmdec: Fix EOF check in the stream loop in ivr_read_header()
Fixes: long running loop
Fixes: ivr-timeout-42468cb797f52f025fb329394702f5d4d64322d6

Found-by: Paul Ch <paulcher@icloud.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c2eec1762d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:20:44 +01:00
Michael Niedermayer
c71fe632b7 avcodec/shorten: Fix signed 32bit overflow in shift in shorten_decode_frame()
Fixes: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 9480/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-6647324284551168 -rss_limit_mb=2000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9b604e96a5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:20:44 +01:00
Michael Niedermayer
eba99acdf2 avcodec/shorten: Fix integer overflow in residual/LPC combination
Fixes: signed integer overflow: -540538872 + -2012739576 cannot be represented in type 'int'
Fixes: 9255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5758630052757504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit db7e9082e1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:20:44 +01:00
Michael Niedermayer
f20a35a13e avcodec/shorten: Check verbatim length
Fixes: Timeout
Fixes: 9252/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5780720709533696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7007dabec0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:20:44 +01:00
Michael Niedermayer
1a9810dde0 avcodec/mpegaudio_parser: Initialize poutbuf*
Possibly fixes: null pointer dereference
Possibly fixes: 9352/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP3ADUFLOAT_fuzzer-5146068961460224
Fixes: Heap-use-after-free
Fixes: 9453/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP3ADUFLOAT_fuzzer-5137954375729152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0f4c3b0b8e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:20:44 +01:00
Michael Niedermayer
cc9263c2e1 avcodec/aacpsdsp_template: Fix integer overflow in ps_stereo_interpolate_c()
Fixes: signed integer overflow: -1813244069 + -1407981383 cannot be represented in type 'int'
Fixes: 8823/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5643295618236416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 47db5763e2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:20:44 +01:00
Michael Niedermayer
1b28323822 avformat/flvenc: Check audio packet size
Fixes: Assertion failure
Fixes: assert_flvenc.c:941_1.swf

Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6b67d7f059)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:20:44 +01:00
Michael Niedermayer
09800cbc01 avcodec/qtrle: Check remaining bytestream in qtrle_decode_XYbpp()
Fixes: Timeout
Fixes: 9213/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QTRLE_fuzzer-5649753332252672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7dd836a3f9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:20:44 +01:00
Michael Niedermayer
7a7a6bf8e2 avcodec/diracdec: Check bytes count in else branch in decode_lowdelay() too
Fixes: signed integer overflow: 8 * 340018243 cannot be represented in type 'int'
Fixes: 9441/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5194665207791616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bed125b710)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:20:44 +01:00
Michael Niedermayer
ec7cf0c74f avcodec/diracdec: Check slice numbers for overflows in relation to picture dimensions
Fixes: signed integer overflow: 88 * 33685506 cannot be represented in type 'int'
Fixes: 9433/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5725943535501312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f457c0ad7f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:20:44 +01:00
Michael Niedermayer
6ebb8f5ab5 avcodec/diracdec: Change frame_number to 64bit as its a 32bit from the bitstream and we also have a -1 special case
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 9291/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-6324345860259840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 462d1be6de)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:20:43 +01:00
Michael Niedermayer
33ee198cdb avcodec/dirac_dwt_template: Fix several integer overflows in horizontal_compose_daub97i()
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 8926/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-6047609228623872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 69cac9e130)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:20:43 +01:00
Michael Niedermayer
8ed1874dab avcodec/diracdec: Prevent integer overflow in intermediate in global_mv()
Fixes: signed integer overflow: -393471 * 5460 cannot be represented in type 'int'
Fixes: 8890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-6299775379963904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5129040646)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:20:43 +01:00
Michael Niedermayer
430405eb0b swresample/swresample: Fix input channel count in resample_first computation
Found-by: Marcin Gorzel <gorzel@google.com>
Reviewed-by: Marcin Gorzel <gorzel@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bce4da85e8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:20:43 +01:00
Michael Niedermayer
b130cdb923 avutil/pixfmt: Document chroma plane size for odd resolutions
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit be0b77e6e8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-11-18 02:20:43 +01:00
Michael Niedermayer
67149cb2f6 avformat/asfdec_o: Check size_bmp more fully
Fixes: integer overflow and out of array access
Fixes: asfo-crash-46080c4341572a7137a162331af77f6ded45cbd7

Found-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2b46ebdbff)
Signed-off-by: James Almer <jamrial@gmail.com>
2018-08-08 01:37:20 -03:00
Alexandra Hájková
32e8eed1ae asfdec: Account for different Format Data sizes
Some muxers may use the BMP_HEADER Format Data size instead
of the ASF-specific one.

Signed-off-by: Diego Biurrun <diego@biurrun.de>
(cherry picked from commit 42f27d1b8e)
Signed-off-by: James Almer <jamrial@gmail.com>
2018-08-08 01:33:27 -03:00
James Almer
ecafc4af95 avcodec/bitstream_filters: check the input argument of av_bsf_get_by_name() for NULL
Fixes crashes like "ffmpeg -h bsf" caused by passing NULL to strcmp()

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 3258cc6507)
2018-07-28 22:46:00 -03:00
Michael Niedermayer
a911f234e2 Update for 3.2.12
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-18 23:04:10 +02:00
Michael Niedermayer
94fda4f9ec avcodec/dvdsub_parser: Allocate input padding
Fixes: out of array read
Fixes: 9350/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVDSUB_fuzzer-5746777750765568

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cd86b5cfe2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-18 16:57:03 +02:00
Michael Niedermayer
ffc9ef8f4c avcodec/dvdsub_parser: Init output buf/size
No testcase

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9e6c843776)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-18 16:57:03 +02:00
Michael Niedermayer
fe73afd730 avcodec/dirac_dwt_template: Fix signedness regression in interleave()
Found-by: <jdarnley>
Tested-by: James Darnley <james.darnley@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 181435a4de)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-18 16:57:03 +02:00
Michael Niedermayer
2c0e98a0b4 avformat/movenc: Write version 2 of audio atom if channels is not known
The version 1 needs the channel count and would divide by 0
Fixes: division by 0
Fixes: fpe_movenc.c_1108_1.ogg
Fixes: fpe_movenc.c_1108_2.ogg
Fixes: fpe_movenc.c_1108_3.wav

Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fa19fbcf71)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-18 16:57:03 +02:00
Rahul Chaudhry
a1d4de0559 swresample/arm: rename labels to fix xcode build error
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e84212b78e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-18 16:57:03 +02:00
James Almer
e870255e4e avformat/utils: fix mixed declarations and code
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 31de45d20b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-18 16:57:03 +02:00
Simon Thelen
c773ce32e1 avcodec/imgconvert: fix possible null pointer dereference
regression since 354b26a394

(cherry picked from commit 8c2c97403b)
2018-07-15 16:45:45 +03:00
Michael Niedermayer
97321ae360 Update for 3.2.11
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 21:07:45 +02:00
Michael Niedermayer
3571bec56e avformat/movenc: Check input sample count
Fixes: division by 0
Fixes: fpe_movenc.c_199_1.wav
Fixes: fpe_movenc.c_199_2.wav
Fixes: fpe_movenc.c_199_3.wav
Fixes: fpe_movenc.c_199_4.wav
Fixes: fpe_movenc.c_199_5.wav
Fixes: fpe_movenc.c_199_6.wav
Fixes: fpe_movenc.c_199_7.wav

Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3a2d21bc5f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
64993b613b avcodec/mjpegdec: Check for odd progressive RGB
Fixes: out of array access
Fixes: 9225/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-5684770334834688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ee1e3ca5eb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
92972f1916 avformat/movenc: Check that frame_types other than EAC3_FRAME_TYPE_INDEPENDENT have a supported substream id
Fixes: out of array access
Fixes: ffmpeg_bof_1.avi

Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ed22dc2221)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
f65d6ff9ab avformat/mms: Add missing chunksize check
Fixes: out of array read
Fixes: mms-crash-01b6c5d85f9d9f40f4e879896103e9f5b222816a

Found-by: Paul Ch <paulcher@icloud.com>
1st hunk by Paul Ch <paulcher@icloud.com>
Tested-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cced03dd66)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
e82a06d2be avformat/pva: Check for EOF before retrying in read_part_of_packet()
Fixes: Infinite loop
Fixes: pva-4b1835dbc2027bf3c567005dcc78e85199240d06

Found-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9807d3976b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
4a42353c7a avformat/rmdec: Do not pass mime type in rm_read_multi() to ff_rm_read_mdpr_codecdata()
Fixes: use after free()
Fixes: rmdec-crash-ffe85b4cab1597d1cfea6955705e53f1f5c8a362

Found-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a7e032a277)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
2b8c152327 avcodec/indeo4: Check for end of bitstream in decode_mb_info()
Fixes: Timeout
Fixes: 8776/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-5361788798369792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 267ba2aa96)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
c7dca18226 avcodec/shorten: Fix undefined addition in shorten_decode_frame()
Fixes: signed integer overflow: 1139785606 + 1454196085 cannot be represented in type 'int'
Fixes: 8937/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-6202943597445120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3b10bb8772)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
e1d4289596 avcodec/shorten: Fix undefined integer overflow
Fixes: signed integer overflow: 8454144 * 256 cannot be represented in type 'int'
Fixes: 8788/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5728205041303552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 70832333bb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
c68a8137ce avcodec/jpeg2000dec: Fixes invalid shifts in jpeg2000_decode_packets_po_iteration()
Fixes: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 9163/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5661750182543360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 652d7c6348)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
636081c982 avcodec/jpeg2000dec: Check that there are enough bytes for all tiles
Fixes: OOM
Fixes: 8781/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5810709081358336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0898a3d990)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
e6d3fd942f avformat/movenc: Do not pass AVCodecParameters in avpriv_request_sample
Fixes: out of array read
Fixes: ffmpeg_crash_8.avi

Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 95556e27e2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
09e4f84365 avcodec/escape124: Fix spelling errors in comment
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f59c4e4391)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
4bb368e6d9 avcodec/ra144: Fix integer overflow in ff_eval_refl()
Fixes: signed integer overflow: -4096 * -524288 cannot be represented in type 'int'
Fixes: 8650/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-5734816036159488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b31189881a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
28a0f69987 avcodec/cscd: Check output buffer size for lzo.
Fixes: Timeout
Fixes: 8665/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CSCD_fuzzer-5768442610188288

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit 78167b498f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
dac23ef23c avcodec/escape124: Check buf_size against num_superblocks
Fixes: Timeout
Fixes: 8722/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-4843268402577408

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6677c98626)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
2a30376e50 avcodec/h264_parser: Reduce needed history for parsing mb index
This fixes a bug/regression with very small packets
Fixes: output_file

Regression since: 0782fb6bcb

Reported-by: Thierry Foucu <tfoucu@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d25c945247)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
be9424966f avcodec/mjpegdec: Check for end of bitstream in ljpeg_decode_rgb_scan()
Fixes: Timeout
Fixes: 8648/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5108395525799936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 540e8c2d64)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
5cf8268b03 avcodec/aacdec_fixed: Fix undefined integer overflow in apply_independent_coupling_fixed()
Fixes: signed integer overflow: 1195517 * 2048 cannot be represented in type 'int'
Fixes: 8636/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-4695836326887424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8bd514d934)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
836a9d62d1 avcodec/dirac_dwt_template: Fix undefined behavior in interleave()
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 8697/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5197148130902016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 575d8ca026)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
75c0be5b93 avutil/common: Fix undefined behavior in av_clip_uintp2_c()
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 8521/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5639024952737792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aa41d322be)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
699e09f0de fftools/ffmpeg: Fallback to duration if sample rate is unavailable
Regression since: af1761f7
Fixes: Division by 0
Fixes: ffmpeg_crash_1

Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 16d8b13b3b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
39723d1ccb avformat/mov: Only set pkt->duration to non negative values
Reviewed-by: Sasi Inguva <isasi@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8176799f31)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
35cd7417f9 avcodec/h264_ps: Move MAX_LOG2_MAX_FRAME_NUM to header so it can be used in h264_sei
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b796c5ae92)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
7281cf7195 avcodec/h264_mc_template: Only prefetch motion if the list is used.
Fixes: index 59 out of bounds for type 'H264Ref [48]'
Fixes: 8232/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5703295145345024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8b55591757)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
d18d83f5a1 avcodec/xwddec: Use ff_set_dimensions()
Fixes: OOM
Fixes: 8178/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XWD_fuzzer-4844793342459904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c2852e4e00)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
e1eebcbe3b avcodec/wavpack: Fix overflow in adding tail
Fixes: signed integer overflow: 2146907204 + 26846088 cannot be represented in type 'int'
Fixes: 8105/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-6233036682166272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d13379fb79)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
eba50bdadc avcodec/shorten: Fix multiple integer overflows
Fixes: signed integer overflow: 3 * 1006632960 cannot be represented in type 'int'
Fixes: 8278/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5692857166856192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f2abd36b38)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
72aac791f1 avcodec/shorten: Fix undefined shift in fix_bitshift()
Fixes: left shift of negative value -9
Fixes: 8571/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5715966875926528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 606c714823)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
e2207d5c46 avcodec/shorten: Fix a negative left shift in shorten_decode_frame()
Fixes: left shift of negative value -9057
Fixes: 8527/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5666853924896768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a711efe922)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
9b1cbcdafb avcodec/shorten: Sanity check nmeans
Fixes: OOM
Fixes: 8195/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5179785826271232

The reference software appears to use longs for 32bits and it uses int for nmeans
hinting that the intended maximum size was not 32bit.

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d91a0b503d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
60021049be avcodec/shorten: Check non COMM chunk len before skip in decode_aiff_header()
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 8024/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5109204648984576

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 424a81df10)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
e520692e14 avcodec/mjpegdec: Fix integer overflow in ljpeg_decode_rgb_scan()
Fixes: signed integer overflow: 32768 + 2147450880 cannot be represented in type 'int'
Fixes: 7885/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-5298834394578944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 936f4a2c2e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
89c2b51579 avcodec/truemotion2: Fix overflow in tm2_apply_deltas()
Fixes: signed integer overflow: 1077952576 + 1077952576 cannot be represented in type 'int'
Fixes: 7712/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5056281753681920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 79c6047c36)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:47 +02:00
Michael Niedermayer
5acbb27cbd avcodec/opus_silk: Change silk_lsf2lpc() slightly toward silk/NLSF2A.c
Fixes: runtime error: signed integer overflow: -1440457022 - 785819492 cannot be represented in type 'int'
Fixes: 7700/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OPUS_fuzzer-6595838684954624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e7dda51150)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
008288c2c4 avcodec/amrwbdec: Fix division by 0 in find_hb_gain()
This restructures the code slightly toward D_UTIL_dec_synthesis()

Fixes: 7420/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMRWB_fuzzer-6577305112543232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dce80a4b47)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
6a11c4955c avformat/mov: replace a value error by clipping into valid range in mov_read_stsc()
Fixes: #7165

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fe84f70819)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
d1f924319e avformat/mov: Break out early if chunk_count is 0 in mov_build_index()
Without this some operations might overflow (undefined behavior)
even though the index adding loop would never execute

No testcase known

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 56e76bd057)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
6ad66ddce3 avcodec/fic: Avoid some magic numbers related to cursors
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c6a11714c4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
9797767ff7 avcodec/g2meet: ask for sample with overflowing RGB
Suggested-by: Tomas Härdin <tjoppen@acc.umu.se>

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ab834b8f36)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
ec1aca8500 avcodec/aacdec_fixed: use 64bit to avoid overflow in rounding in apply_dependent_coupling_fixed()
Fixes: signed integer overflow: -2141499320 + -14469590 cannot be represented in type 'int'
Fixes: 7351/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-6351214791884800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 90475db97e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
32aa3e55b1 oavcodec/aacpsdsp_template: Use unsigned for hs0X to prevent undefined behavior
Fixes: signed integer overflow: 1073741842 + 1784008138 cannot be represented in type 'int'
Fixes: 6792/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5677589835284480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 62cb6fadf3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
55e4a40e96 avcodec/g723_1dec: Clip bits2 in both directions
Fixes: shift exponent 33 is too large for 32-bit type 'int'
Fixes: 6743/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G723_1_fuzzer-5823772687859712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 53f241218d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
d6f8960812 avcodec/mpeg4videoenc: Use 64 bit for times in mpeg4_encode_gop_header()
Fixes truncation
Fixes Assertion n <= 31 && value < (1U << n) failed at libavcodec/put_bits.h:169
Fixes: ffmpeg_crash_2.avi

Found-by: Thuan Pham <thuanpv@comp.nus.edu.sg>, Marcel Böhme, Andrew Santosa and Alexandru RazvanCaciulescu with AFLSmart

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e1182fac1a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
99b4524bfb avcodec/mlpdec: Only change noise_type if the related fields are valid
Fixes: inconsistency
Fixes:runtime error: index 8 out of bounds for type 'int32_t [8]'
Fixes: 6686/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-5191383498358784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 63c4a4b0d6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
2a9f93d8b0 indeo4: Decode all or nothing of a band header.
This avoids inconsistent value combinations.
Alternatively it would be possible to add more checks and careful use of
temporary variables, but my try of this quickly seemed to become
a rather large change.
The disadvantage of this, is that the struct is copied back and forth.

Fixes: index 6 out of bounds for type 'const uint16_t [5][16]'
Fixes: 6557/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-4787296550256640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 10c8521265)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
c3ff11cc08 avformat/mov: Only fail for STCO/STSC contradictions if both exist
Fixes regression with playback of GF9720Repeal20the20Eighth20with20Helen20Linehan.m4a
See: crbug 822666

Found-by: "Mattias Wadman <mattias.wadman@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2c2d689c56)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
3a97317e8b avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD97iH0 / COMPOSE_DD137iL0
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int');
Fixes: 6500/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-4523620274536448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cb944fc7f1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
837c42535b avcodec/fic: Check available input space for cursor
Fixes: out of array read
Fixes: 6546/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FIC_fuzzer-6317064647081984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cb2f7ea96b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
8878f43cf5 avcodec/g2meet: Check RGB upper limit
Fixes: runtime error: left shift of 1876744317 by 16 places cannot be represented in type 'int'
Fixes: 6799/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5115274731716608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4dd2c8b9ea)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
45b45ce240 avcodec/jpeg2000dec: Fix undefined shift in the jpeg2000_decode_packets_po_iteration() CPRL case
Fixes: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 7955/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-6016721977606144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 652ba72ed3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
6d3b48f285 avcodec/jpeg2000dec: Skip init for component in CPRL if nothing is to be done
Fixes: assertion failure
Fixes: 7949/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-4819602782552064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a96c131eb5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
b06c67cbf3 avcodec/g2meet: Change order of operations to avoid undefined behavior
Fixes: signed integer overflow: 65280 * 196032 cannot be represented in type 'int'
Fixes: 7279/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5977332473921536

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0a47451458)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
c21933835b avcodec/flac_parser: Fix infinite loop
Fixes: crbug/827204

Reported-by: Frank Liberato <liberato@google.com>
Reviewed-by: Frank Liberato <liberato@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 15a2e35e9e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
6ea3a2a276 avcodec/wavpack: Fix integer overflow in DEC_MED() / INC_MED()
Fixes: runtime error: signed integer overflow: 2147483637 + 128 cannot be represented in type 'int'
Fixes: 6701/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5358324934508544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6e95d80e6f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
1411eddce6 avcodec/error_resilience: Fix integer overflow in filter181()
Fixes: runtime error: signed integer overflow: 197710 * 10923 cannot be represented in type 'int'
Fixes: 7010/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5667127596941312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1c97035e3b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
95156bdb59 avcodec/h263dec: Check slice_ret in mspeg4 slice loop
Fixes infinite loop
Fixes: 6858/clusterfuzz-testcase-ffmpeg_AV_CODEC_ID_MSMPEG4V3_fuzzer-4681563766784000
Fixes: 6890/clusterfuzz-testcase-ffmpeg_AV_CODEC_ID_WMV1_fuzzer-4756103142309888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit de841fbea7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
2901299610 avcodec/elsdec: Fix memleaks
Fixes: 6798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5135899701542912

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0bd0401336)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
83e870beb8 avcodec/vc1_block: simplify ac_val computation
also fixes: runtime error: index 1456 out of bounds for type 'int16_t [16]'

Found-by: durandal_1707
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d06b01fc2d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
1e4bd765ac avcodec/ffv1enc: Check that the crc + version combination is supported
The crc flag is only stored since version 3 thus before this crcs do not
work. We increase the version as needed same as we do with pix_fmts

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d9706f79c1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Stephan Holljes
fbb65e77b6 lavf/http.c: Free allocated client URLContext in case of error.
Signed-off-by: Stephan Holljes <klaxa1337@googlemail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7b6b8c9265)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
05f4488bd7 avcodec/dsicinvideo: Fail if there is only a small fraction of the data available that comprises a full frame
Fixes: Timeout
Fixes: 6306/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DSICINVIDEO_fuzzer-5079253549842432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5549488bbf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
8b89c007e8 avcodec/dsicinvideo: Propagate errors from cin_decode_rle()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 942217b153)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
e77fe2b7c4 avcodec/dfa: Check dimension against maximum
The headers from where the dimensions are read in actual files
are limited to 16bit per component.

Fixes: Timeout
Fixes: 6305/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DFA_fuzzer-4824270749302784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9d5a4fcfbb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
6b382d4d86 avcodec/cinepak: Skip empty frames
Speeds up decoding from 3 to 0.1 seconds for 6302/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CINEPAK_fuzzer-5626371985375232
Fixes: Timeout

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9033920bec)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
b01b57f7e0 avcodec/cinepak: move some checks prior to frame allocation
Speeds up decoding from 8 to 3 seconds for 6302/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CINEPAK_fuzzer-5626371985375232
Fixes: Timeout

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2324ef1ff3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Rahul Chaudhry
e7f1090a54 swresample/arm: remove unintentional relocation.
Branch to global symbol results in reference to PLT, and when compiling
for THUMB-2 - in a R_ARM_THM_JUMP19 relocation. Some linkers don't
support this relocation (ld.gold), while others can end up truncating
the relocation to fit (ld.bfd).

Convert this branch through PLT into a direct branch that the assembler
can resolve locally.

See https://github.com/android-ndk/ndk/issues/337 for background.

The current workaround is to disable neon during gstreamer build,
which is not optimal and can be reverted after this patch:
41556c4157

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b22db4f465)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
5a2a40fa78 doc/APIchanges: Fix typos in hashes
Thanks-to: Moritz Barsnick <barsnick@gmx.net> for finding the correct ones

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ec8a5262b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
bb6146ca6d avformat/utils: Check cur_dts in update_initial_timestamps() more
Fixes: runtime error: signed integer overflow: 18133149658382192 - -9223090561878065151 cannot be represented in type 'long long'
Fixes: crbug 831552

Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 37d46dc21d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
1fbd13ebe5 avcodec/utils: Enforce minimum width also for VP5/6
Fixes: out of array access
Fixes: poc_0411

Found-by: GwanYeong Kim <gy741.kim@gmail.com>
Tested-by: GwanYeong Kim <gy741.kim@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 544324827e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
c512be126b avcodec/truemotion2: Propagate out of bounds error from GET_TOK()
Fixes: Timeout
Fixes: 6389/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5695918121680896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f6304af234)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
8d40798dd0 avformat/utils: Fix integer overflow in end time calculation in update_stream_timings()
Fixes: crbug 829153

Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c48ceff786)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
8b0de157d2 avcodec/mjpegdec: Check input buffer size.
Fixes: Timeout
Fixes: 6381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-5665032743419904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8d381b57fd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
b545cc000d avformat/mov: Fix extradata memleak
Fixes: crbug 822705

Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0a8133119c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Matt Wolenetz
c2e611fef6 lavc/libopusdec: Allow avcodec_open2 to call .close
If there is a decoder initialization failure detected in avcodec_open2
after .init is called, allow graceful decoder .close to prevent leaking
libopus decoder allocations.

BUG=828526

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e43e97f0e0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
173fdd9b65 avcodec/movtextdec: Check style_start/end
Limits based on 3GPP TS 26.245 V14.0.0
Fixes: Timeout
Fixes: 6377/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOVTEXT_fuzzer-5175929115508736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Philip Langdale <philipl@overt.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 249aca8f98)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
626da21af8 avcodec/aacsbr_fixed: Fix integer overflow in sbr_hf_assemble()
Fixes: runtime error: signed integer overflow: 2052929346 + 204817098 cannot be represented in type 'int'

This was missed in b1bef755f6
Fixes: 5275/clusterfuzz-testcase-minimized-5367635958038528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c837918f50)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
c66c4da55a libavcodec/rv34: error out earlier on missing references
Fixes visual corruption on seeking

Fixes: downloadTest_clip_24M.rmvb

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6cd81d68c5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Hendrik Schreiber
da51b8be0b swresample/swresample: Fix for seg fault in swr_convert_internal() -> sum2_float during dithering.
Removed +len1 in call to s->mix_2_1_f() as I found no logical explanation for it. After removal, problem was gone.

Signed-off-by: Hendrik Schreiber <hs@tagtraum.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 647fd4b829)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
f14c3cfbc3 avcodec/aacdec_fixed: Fix integer overflow in apply_independent_coupling_fixed()
I was not able to reproduce this, this fix is based on just the fuzzer log.
Fixes: 4959/clusterfuzz-testcase-minimized-6035350934781952

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 197a4e8fee)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
050d779a1f avcodec/cscd: Error out when LZ* decompression fails
Fixes: Timeout
Fixes: 6304/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CSCD_fuzzer-5754772461191168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d52be5d4e9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
heimdallr
e0888e5758 avcodec/imgconvert: Fix loss mask bug in avcodec_find_best_pix_fmt_of_list()
example:

AVPixelFormat pixFmts[] = { AV_PIX_FMT_RGB24, AV_PIX_FMT_RGBA };
int loss = 0;
AVPixelFormat best = avcodec_find_best_pix_fmt_of_list(pixFmts, AV_PIX_FMT_BGRA, 1, &loss);

best is AV_PIX_FMT_RGB24. But AV_PIX_FMT_RGBA is better.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 354b26a394)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
7050970d06 avcodec/utvideodec: Set pro flag based on fourcc
This avoids mixing 8bit variants with pro and 10bit with non pro mode.
Fixes: out of array read
Fixes: poc_03_30.avi

Found-by: GwanYeong Kim <gy741.kim@gmail.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 47b7c68ae5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
3d329dc8c3 avcodec/wmalosslessdec: Fix null pointer dereference in decode_frame()
Fixes: 2018_03_23_poc.wav
Found-by: GwanYeong Kim <gy741.kim@gmail.com>

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ea15915b2d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
a3ffdf43e6 avcodec/tableprint_vlc: Fix build failure with --enable-hardcoded-tables
Found-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5c75438b89)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:46 +02:00
Michael Niedermayer
ea209bee9c avformat/mov: Move +1 in check to avoid hypothetical overflow in add_ctts_entry()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eb60b9d3aa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
e054e9fb20 avcodec/get_bits: Make sure the input bitstream with padding can be addressed
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e529fe7633)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
0288fa9319 avformat/mov: Check STSC and remove invalid entries
Fixes assertion failure
Fixes: crbug 822547, crbug 822666 and crbug 823009

Affects: aark15sd_9A62E2FA.mp4

Found-by: ClusterFuzz
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9e67447a4f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
f6a55b0490 avcodec/nuv: rtjpeg with dimensions less than 16 would result in no decoded pixels thus reject it
Fixes: Timeout
Fixes: 6297/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-4882404863901696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 939440ad1a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
da1b72ae35 avcodec/nuv: Check for minimum input size for uncomprssed and rtjpeg
Fixes: Timeout
Fixes: 6297/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-4882404863901696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8ee3265dbe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
7a5630b56a avcodec/wmalosslessdec: Reset num_saved_bits on error path
Fixes: NULL pointer dereference
Fixes: poc-201803.wav
Found-by: GwanYeong Kim <gy741.kim@gmail.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 64c9ce0abc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
791c0940f5 avformat/mov: Fix integer overflows related to sample_duration
Fixes: runtime error: signed integer overflow: -9166684017437101870 + -2495066639299164439 cannot be represented in type

Fixes: Chromium bug 791349

Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2f37082827)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
2583022266 avformat/oggparsedaala: Do not adjust AV_NOPTS_VALUE
Fixes: potential signed integer overflow

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f655ddfb47)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
723f154ae0 avformat/oggparseogm: Check lb against psize
No testcase, this was found during code review

Found-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3e7c847aaf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
bdb68741ba avformat/oggparseogm: Fix undefined shift in ogm_packet()
Fixes: shift exponent 48 is too large for 32-bit type 'int'
Fixes: Chromium bug 786793
Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 010b7b30b7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
35194c4e02 avformat/avidec: Fix integer overflow in cum_len check
Fixes: signed integer overflow: 3775922176 * 4278190080 cannot be represented in type 'long'
Fixes: Chromium bug 791237

Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 06e092e781)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
adfbb5112d avformat/oggparsetheora: Do not adjust AV_NOPTS_VALUE
Fixes: Chromium bug 795653
Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'long'
Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 02ecda4aba)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
d3e6b38a41 avformat/utils: Fix integer overflow of fps_first/last_dts
Fixes: runtime error: signed integer overflow: 7738135736989908991 - -7898362169240453118 cannot be represented in type 'long'
Fixes: Chromium bug 796778
Reported-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b1362e408)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
4c1d58f937 libavformat/oggparsevorbis: Fix memleak on multiple headers
Fixes: Chromium bug 800123
Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3934aa495d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
7fafcad8d5 avcodec/truemotion2rt: Check input buffer size
Fixes: Timeout
Fixes: 6250/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2RT_fuzzer-5479814011027456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8b5c29b6c2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
b827d3a352 avcodec/exr: fix invalid shift in unpack_14()
Fixes: 6154/clusterfuzz-testcase-minimized-5762231061970944
Fixes: runtime error: shift exponent 63 is too large for 32-bit type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 49062a9017)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
2dc487bcb0 avcodec/bintext: sanity check dimensions
Fixes: Timeout
Fixes: 6277/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XBIN_fuzzer-6047202288861184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 090c0abff9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
9c05935764 avcodec/utvideodec: Check subsample factors
Fixes: Out of array read
Fixes: heap_poc

Found-by: GwanYeong Kim <gy741.kim@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7414d0bda7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
36268aa896 avcodec/smc: Check input packet size
Fixes: Timeout
Fixes: 6261/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMC_fuzzer-5811309653262336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0293663483)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
72f06b3a2c avcodec/cavsdec: Check alpha/beta offset
Fixes: Integer overflow
Fixes: 6183/clusterfuzz-testcase-minimized-6269224436629504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ae2eb04648)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
51f64667fc avcodec/diracdec: Fix integer overflow in mv computation
Fixes: signed integer overflow: -2072 + -2147483646 cannot be represented in type 'int'
Fixes: 6097/clusterfuzz-testcase-minimized-5034145253163008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 47e65ad63b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
2c08bd58d8 avcodec/h264_parse: Clear invalid chroma weights in ff_h264_pred_weight_table()
Fixes: 6037/clusterfuzz-testcase-minimized-5030249784934400
Fixes: signed integer overflow: 256 * 16992036 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 85c85fffff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
145e40c0d0 avcodec/aacdec_templat: Fix integer overflow in apply_ltp()
Fixes: signed integer overflow: -1625276744 + -1041893960 cannot be represented in type 'int'
Fixes: 5948/clusterfuzz-testcase-minimized-5791479856365568

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 33fe17bdc8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
8360920972 avcodec/jpeg2000dwt: Fix integer overflows in sr_1d53()
Fixes: 5918/clusterfuzz-testcase-minimized-5120505435652096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 793347a545)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
736ef72bff avcodec/diracdec: Use int64 in global mv to prevent overflow
Fixes: runtime error: signed integer overflow: 361 * -6295541 cannot be represented in type 'int'
Fixes: 5911/clusterfuzz-testcase-minimized-6450382197751808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cbcbefdc3b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
1c905c02d0 avcodec/dxtory: Remove code that corrupts dimensions
Fixes: Timeout
Fixes: 5796/clusterfuzz-testcase-minimized-5206729085157376

Does someone have a valid sample that triggers this path ?

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3748746a4d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
db617c9520 avcodec/dirac_dwt_template: Fix Integer overflow in horizontal_compose_dd137i()
Fixes: 5894/clusterfuzz-testcase-minimized-5315325420634112
Fixes: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 647fa49495)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:45:45 +02:00
Michael Niedermayer
ca85929440 avcodec/vp8: Check for bitstream end before vp7_fade_frame()
Fixes: Timeout
Fixes: 5653/clusterfuzz-testcase-5497680018014208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit de675648ce)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:30:10 +02:00
Michael Niedermayer
a7bd00eab4 avcodec/exr: Check remaining bits in last get code loop
Fixes: runtime error: shift exponent -7 is negative
Fixes: 3902/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6081926122176512

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dd8351b118)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:30:10 +02:00
Michael Niedermayer
fc9dcfb9f2 avutil/common: Fix integer overflow in av_clip_uint8_c() and av_clip_uint16_c()
Fixes: 5567/clusterfuzz-testcase-minimized-5769966247739392
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ab6f571ef7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:30:10 +02:00
Michael Niedermayer
ed04cbf62b avcodec/h264_cabac: Tighten allowed coeff_abs range
Fixes: integer overflows
Reported-by: "Xiaohan Wang (王消寒)" <xhwang@chromium.org>

Based on limits in "8.5 Transform coefficient decoding process and picture
construction process prior to deblocking  filter process"

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f26a63c4ee)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:30:10 +02:00
Xiaohan Wang
f4ff8845e2 avcodec/h264_cavlc: Set valid qscale value in ff_h264_decode_mb_cavlc()
When ff_h264_decode_mb_cavlc() failed due to wrong sl->qscale values,
e.g. dquant out of range, set the qscale to be a valid value before
returning -1 and exiting the function. The qscale value can be used
later e.g. in loop filter.

BUG=806122

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 71f39de2a5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:30:10 +02:00
Michael Niedermayer
e38388fb09 avcodec/vp3: Error out on invalid num_coeffs in unpack_vlcs()
This fixes a hypothetical integer overflow

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f2318aee8c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:30:10 +02:00
Michael Niedermayer
6098d54fbd avcodec/mpeg4videodec: Ignore multiple VOL headers
Fixes: Ticket7005

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 63a4bdbf3b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:30:10 +02:00
Michael Niedermayer
218574f24b avcodec/vp3: Check eob_run
Fixes: out of array access
Fixes: 5919/clusterfuzz-testcase-minimized-5859311382167552
Fixes: special case for theora (untested due to lack of sample)

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 570023eab3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 19:30:10 +02:00
Nekopanda
5aa07015d7 avcodec/mpeg2dec: Fix field selection for skipped macroblocks
For B field pictures, the spec says,

> The prediction shall be made from the field of the same parity as the field being predicted.

I did it.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8b154cb3e9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
Michael Niedermayer
40b7dc104a avcodec/huffyuvdec: Check input buffer size
Fixes: Timeout
Fixes: 5487/clusterfuzz-testcase-4696837035393024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 08c220d26c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
Michael Niedermayer
22aa37c0fe avcodec/utvideodec: Fix bytes left check in decode_frame()
Fixes: out of array read
Fixes: poc-2017.avi

Found-by: GwanYeong Kim <gy741.kim@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 118e1b0b33)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
Michael Niedermayer
7cc7346dfd avcodec/wavpack: Fix integer overflow in FFABS
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 5396/clusterfuzz-testcase-minimized-6558555529281536

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8e50bd61e4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
Michael Niedermayer
7aed596664 avcodec/aacsbr_fixed: Fix overflows in rounding in sbr_hf_assemble()
Fixes: runtime error: signed integer overflow: 2052929346 + 204817098 cannot be represented in type 'int'
Fixes: 5275/clusterfuzz-testcase-minimized-5367635958038528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b1bef755f6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
Michael Niedermayer
08deabae38 avcodec/dirac_dwt: Fix several integer overflows
Fixes: runtime error: signed integer overflow: -2146071175 + -268479557 cannot be represented in type 'int'
Fixes: 5237/clusterfuzz-testcase-minimized-4569895275593728

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fe1e6c06d0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
Michael Niedermayer
e67ae6dc19 avcodec/indeo5: Do not leave frame_type set to an invalid value
Fixes: null pointer dereference
Fixes: 5264/clusterfuzz-testcase-minimized-4621956621008896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2ff9f17851)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
Michael Niedermayer
2bf49f9b1c avcodec/hevc_ps: Check log2_sao_offset_scale_*
Fixes: 4868/clusterfuzz-testcase-minimized-6236542906400768
Fixes: runtime error: shift exponent 126 is too large for 32-bit type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4a75a75c62)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
Aman Gupta
55776eae21 avcodec/hevc_ps: extract one SPS fields required for hvcC construction
Signed-off-by: Aman Gupta <aman@tmm1.net>
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
Michael Niedermayer
f7f814ade8 avcodec/mpeg4videodec: Avoid possibly aliasing violating casts
Found-by: kierank
Reviewed-by: Kieran Kunhya <kieran618@googlemail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d4967c04e0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
Michael Niedermayer
fbc5e36fdd avcodec/get_bits: Document the return code of get_vlc2()
Found-by: kierank
Reviewed-by: Kieran Kunhya <kieran618@googlemail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4a94ff4ccd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
Michael Niedermayer
ef80b1402b avcodec/mpeg4videodec: Check mb_num also against 0
The spec implies that 0 is invalid in addition to the existing checks

Found-by: <kierank>
Reviewed-by: Kieran Kunhya <kieran618@googlemail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 05f4703a16)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
Michael Niedermayer
c4ba170cad avfilter/vf_transpose: Fix used plane count.
Fixes out of array access
Fixes: poc.mp4

Found-by: GwanYeong Kim <gy741.kim@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c6939f65a1)
(cherry picked from commit 3f621455d6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
Michael Niedermayer
6abe8c7563 avcodec/hevc_cabac: Check prefix so as to avoid invalid shifts in coeff_abs_level_remaining_decode()
I suspect that this can be limited tighter, but i failed to find anything
in the spec that would confirm that.

Fixes: 4833/clusterfuzz-testcase-minimized-5302840101699584
Fixes: runtime error: left shift of 134217730 by 4 places cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a026a3efae)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
Michael Niedermayer
71524db178 avcodec/mjpegdec: Fix integer overflow in DC dequantization
Fixes: runtime error: signed integer overflow: -65535 * 65312 cannot be represented in type 'int'
Fixes: 4900/clusterfuzz-testcase-minimized-5769019744321536

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1bfc1aa004)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
Michael Niedermayer
7348bbf9c2 avcodec/dxtory: Fix bits left checks
Fixes: Timeout
Fixes: 4863/clusterfuzz-testcase-6347354178322432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6e1a167c55)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
Michael Niedermayer
a8b92327f8 avcodec/hevc_cabac: Move prefix check in coeff_abs_level_remaining_decode() down
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 94d4237a7a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
Michael Niedermayer
d39b17f237 avcodec/truemotion2: Fix integer overflow in TM2_RECALC_BLOCK()
Fixes: signed integer overflow: 1477974040 - -1877995504 cannot be represented in type 'int'
Fixes: 4861/clusterfuzz-testcase-minimized-4570316383715328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 56a53340ed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
Michael Niedermayer
eea05ba855 avcodec/snowdec: Fix integer overflow before htaps check
Fixes: runtime error: signed integer overflow: -1094995529 * 2 cannot be represented in type 'int'
Fixes: 4828/clusterfuzz-testcase-minimized-5100849937252352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2eecf3cf8e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
Michael Niedermayer
8ce2c38226 avcodec/ulti: Check number of blocks at init
Fixes: Timeout
Fixes: 4832/clusterfuzz-testcase-4699096590843904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 725353525e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
Michael Niedermayer
7d79d8f6ef avcodec/ac3dec_fixed: Fix integer overflow in scale_coefs()
Fixes: runtime error: signed integer overflow: 2147483520 + 128 cannot be represented in type 'int'
Fixes: 4800/clusterfuzz-testcase-minimized-6110372403609600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a1f38c7589)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
Nikolas Bowe
4eb8e1bce2 avformat/lrcdec: Fix memory leak in lrc_read_header()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ef5994e09d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
Nikolas Bowe
e7701e89ec avformat/matroskadec: Fix float-cast-overflow undefined behavior in matroska_parse_tracks()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e07649e618)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-07-08 13:07:06 +02:00
James Almer
27fc118d1c avdevice/iec61883: free the private context at the end
Fixes part of ticket #7146.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 5079e96bcc)
2018-04-18 23:01:33 -03:00
James Almer
53803ef71c avdevice/iec61883: return reference counted packets
Fixes part of ticket #7146, dealing with leaks of packet data since
commit 87c8812270.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit b8629654c6)
2018-04-18 23:01:29 -03:00
Marton Balint
1fd992af60 avdevice/iec61883: free packet on buffer allocation error
Fixes Coverity CID 1396416.

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit 4556dad2b7)
2018-04-18 23:01:25 -03:00
James Almer
0a340924ef avformat/hvcc: zero initialize the nal buffers past the last written byte
Prevents use of uninitialized values.

Fixes ticket #7038.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 9482ec1b20)
2018-02-24 00:37:41 -03:00
Tobias Rapp
1c3144751a swresample/rematrix: fix update of channel matrix if input or output layout is undefined
Prefer direct in/out channel count values over channel layout, when
available. Fixes a pan filter bug (ticket #6790).

Signed-off-by: Tobias Rapp <t.rapp@noa-archive.com>
(cherry picked from commit 6325bd3717)
2018-02-19 10:09:15 +01:00
Carl Eugen Hoyos
028a032a31 configure: bump year
Happy new year!

(cherry picked from commit bddf31ba75)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-13 04:02:06 +01:00
Michael Niedermayer
124a3ddc4b Changelog: update
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-13 02:07:40 +01:00
Michael Niedermayer
fc7e3955ae avcodec/utils: Avoid hardcoding duplicated types in sizeof()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 860d991fcd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-13 02:06:35 +01:00
Michael Niedermayer
acf1316167 avcodec/arm/sbrdsp_neon: Use a free register instead of putting 2 things in one
Fixes high pitched shriek
Fixes: 25420848_1478428308873746_4255813235963330560_n.mp4

Reported-by: Dale Curtis <dalecurtis@google.com>
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7dbbb75ee3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-13 02:06:35 +01:00
James Almer
24c49e0b42 changelog: update after previous commit
Signed-off-by: James Almer <jamrial@gmail.com>
2018-01-11 23:37:05 -03:00
James Almer
4fb5f391ae avformat/libssh: check the user provided a password before trying to use it
Fixes ticket #6413

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 8ddb6820bd)
2018-01-11 10:37:11 -03:00
Michael Niedermayer
4fb4a642c6 Update for 3.2.10
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-09 01:54:06 +01:00
Michael Niedermayer
adfefc9c9a avcodec/h264addpx_template: Fixes integer overflows
Fixes: signed integer overflow: 512 + 2147483491 cannot be represented in type 'int'
Fixes: 4780/clusterfuzz-testcase-minimized-4709066174627840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d6945aeee4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:15 +01:00
Michael Niedermayer
1ab3e34cb4 avcodec/dirac_dwt: Fix overflows in COMPOSE_HAARiH0/COMPOSE_HAARiL0
Fixes: 4830/clusterfuzz-testcase-minimized-5255392054476800
Fixes: signed integer overflow: 2147483646 - -7 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0e62a23734)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:15 +01:00
Michael Niedermayer
a9fb75893b avcodec/diracdec: Fix integer overflow with quant
Fixes: signed integer overflow: 2 + 2147483646 cannot be represented in type 'int'
Fixes: 4792/clusterfuzz-testcase-minimized-6322450775146496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eaa9317589)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:15 +01:00
Michael Niedermayer
c28752f03a avcodec/opus_parser: Check payload_len in parse_opus_ts_header()
Fixes: clusterfuzz-testcase-minimized-6134545979277312
Fixes: crbug 797469

Reported-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1bcd7fefcb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:15 +01:00
Michael Niedermayer
d89941aa89 avcodec/jpeg2000dsp: Fix integer overflows in ict_int()
Fixes: signed integer overflow: 46802 * -71230 cannot be represented in type 'int'
Fixes: 4756/clusterfuzz-testcase-minimized-4812495563784192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b3192c64b5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:15 +01:00
Michael Niedermayer
3f86cc0680 avcodec/h264_slice: Do not attempt to render into frames already output
Fixes: null pointer dereference
Fixes: 4698/clusterfuzz-testcase-minimized-5096956322906112

This testcase does not reproduce the issue before 03b82b3ab9

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 476665d4de)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:15 +01:00
Michael Niedermayer
c4ead1ab27 avcodec/dnxhddec: Check dc vlc
Fixes: signed integer overflow: 1024 + 2147483640 cannot be represented in type 'int'
Fixes: 4671/clusterfuzz-testcase-minimized-6027464343027712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b2be76c0a4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:15 +01:00
Luca Barbato
6d654eb036 x264: Support version 153
It has native simultaneus 8 and 10 bit support.

(cherry picked from commit c6558e8840)
(cherry picked from commit 96e8400553)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:15 +01:00
Michael Niedermayer
439f3564fa avcodec/exr: Check buf_size more completely
Fixes: Out of heap array read
Fixes: 4683/clusterfuzz-testcase-minimized-6152313673613312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 903be5e4f6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:15 +01:00
Michael Niedermayer
ab0e4b5b51 avcodec/flacdec: Fix overflow in multiplication in decode_subframe_fixed()
Fixes: signed integer overflow: 2 * 1629495328 cannot be represented in type 'int'
Fixes: 4716/clusterfuzz-testcase-minimized-5835915940331520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3d23f7a096)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
34a9bef0c9 avcodec/hevcdsp_template: Fix Invalid shifts in put_hevc_qpel_bi_w_h() and put_hevc_qpel_bi_w_w()
Fixes: left shift of negative value -1
Fixes: 4690/clusterfuzz-testcase-minimized-6117482428366848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d135f3c514)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
4be2a19822 avcodec/flacdec: avoid undefined shift
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 4688/clusterfuzz-testcase-minimized-6572210748653568

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 560daf8891)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
954c2b07b6 avcodec/hevcdsp_template.c: Fix undefined shift in FUNC(dequant)
Fixes: runtime error: left shift of negative value -180
Fixes: 4626/clusterfuzz-testcase-minimized-5647837887987712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0c9ab5ef9c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
2c60731777 avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD97iH0() and COMPOSE_DD137iL0()
Fixes: runtime error: signed integer overflow: 2147483646 + 33554433 cannot be represented in type 'int'
Fixes: 4563/clusterfuzz-testcase-minimized-5438979567517696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4d70fbeec8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
8bd6bf8214 avcodec/hevc_cabac: Fix integer overflow in ff_hevc_cu_qp_delta_abs()
Fixes: signed integer overflow: 2147483647 + 1073741824 cannot be represented in type 'int'
Fixes: 4555/clusterfuzz-testcase-minimized-4505532481142784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ee143558d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
9ad735588c tests/audiomatch: Add missing return code at the end of main()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 65da5c56e6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
34cad2f0e2 avcodec/hevc_sei: Fix integer overflows in decode_nal_sei_message()
Fixes: signed integer overflow: 2147483520 + 255 cannot be represented in type 'int'
Fixes: 4554/clusterfuzz-testcase-minimized-4843714515042304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 991ef6e5b9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
ce28047755 avcodec/hevcdsp_template: Fix undefined shift in put_hevc_qpel_bi_w_hv()
Fixes: runtime error: left shift of negative value -3
Fixes: 4524/clusterfuzz-testcase-minimized-6055590120914944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 439fbb9c8b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Kelly Ledford
235a55700b libavfilter/af_dcshift.c: Fixed repeated spelling error
'threshhold' should be 'threshold'

Signed-off-by: Kelly Ledford <kelly.ledford@intel.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bc219082bb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Jun Zhao
1a6f38b31b avfilter/formats: fix wrong function name in error message
Use perdefined micro __FUNCTION__ rather than hard coding function name
to fix wrong function name in error message.

Signed-off-by: Jun Zhao <jun.zhao@intel.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4280948702)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
969485aace avcodec/amrwbdec: Fix division by 0 in voice_factor()
The added value matches "Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS); LTE; Extended Adaptive Multi-Rate - Wideband (AMR-WB+) codec; Floating-point ANSI-C code (3GPP TS 26.304 version 14.0.0 Release 14)
Extended Adaptive Multi-Rate - Wideband (AMR-WB+) codec; Floating-point ANSI-C code"

Fixes: runtime error: division by zero
Fixes: 4415/clusterfuzz-testcase-minimized-4677752314658816

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1d0817d56b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
49efdb1e77 avcodec/diracdsp: Fix integer overflow in PUT_SIGNED_RECT_CLAMPED()
Fixes: runtime error: signed integer overflow: 2147483646 + 2048 cannot be represented in type 'int'
Fixes: 4479/clusterfuzz-testcase-minimized-6529894147162112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 610dd74502)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
17b3485a67 avcodec/dirac_dwt: Fix integer overflows in COMPOSE_DAUB97*
Fixes: 4478/clusterfuzz-testcase-minimized-4752113767809024
Fixes: runtime error: signed integer overflow: -2147483626 + -319489 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5e9a13a5a3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Dale Curtis
91c7cc9726 avcodec/vorbis: Fix another 1 << 31 > int32_t::max() with 1u.
Didn't notice this one when 9648cc6d was landed.

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 95bacb521a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Dale Curtis
32d1657192 Don't manipulate duration when it's AV_NOPTS_VALUE.
This leads to signed integer overflow.

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit c5fd57f483)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Dale Curtis
e1a854da2d avcodec/vorbis: 1 << 31 > int32_t::max(), so use 1u << 31 instead.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9648cc6d7f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Dale Curtis
fc3e4c9ab3 avformat/utils: Prevent undefined shift with wrap_bits > 64.
2LL << (wrap_bits=64 - 1) does not fit in int64_t; change the
code to use a uint64_t (2ULL) and add an av_assert2() to
ensure wrap_bits <= 64.

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 03fbc0daa7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
50dd0e43af avcodec/j2kenc: Fix out of array access in encode_cblk()
Fixes: 4427/clusterfuzz-testcase-minimized-5106919271301120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0674087004)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
e8a3b17dd4 avcodec/hevcdsp_template: Fix undefined shift in put_hevc_epel_bi_w_h()
Fixes: runtime error: left shift of negative value -127
Fixes: 4397/clusterfuzz-testcase-minimized-4779061080489984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0409d33311)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
5ee4c376d0 avcodec/mlpdsp: Fix signed integer overflow, 2nd try
The outputted bits should match what is used in the lossless check

Fixes: runtime error: signed integer overflow: -538697856 * 256 cannot be represented in type 'int'
Fixes: 4326/clusterfuzz-testcase-minimized-5689449645080576

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 97c00edaa0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
857c5fa976 avcodec/kgv1dec: Check that there is enough input for maximum RLE compression
Fixes: Timeout
Fixes: 4271/clusterfuzz-testcase-4676667768307712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3aad94bf2b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
42b9df5a98 avcodec/dirac_dwt: Fix integer overflow in COMPOSE_FIDELITYi*
Fixes: runtime error: signed integer overflow: -2143827186 - 7404944 cannot be represented in type 'int'
Fixes: 4354/clusterfuzz-testcase-minimized-4671122764201984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2b6964f764)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
b48a36e773 avcodec/mpeg4videodec: Check also for negative versions in the validity check
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0e7865ce41)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Dale Curtis
02d11e616a Close ogg stream upon error when using AV_EF_EXPLODE.
Without this there can be multiple memory leaks for unrecognized
ogg streams.

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bce8fc0754)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Dale Curtis
13763f7192 Fix undefined shift on assumed 8-bit input.
decode_user_data() attempts to create an integer |build|
value with 8 bits of spacing for 3 components. However
each component is an int32_t, so shifting each component
is undefined for values outside of the 8 bit range.

This patch simply clamps input to 8-bits per component
and prints out a warning that the values were clamped.

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7010dd98b5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Dale Curtis
380515e5b9 Use ff_thread_once for fixed, float table init.
These tables are static so they should only be initialized once
instead of on every call to ff_mpadsp_init().

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5eaaffaf64)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Jacob Trimble
a03d488ae2 avformat/mov: Propagate errors in mov_switch_root.
Signed-off-by: Jacob Trimble <modmaker@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2d9cf3bf16)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
c09c0ce374 avcodec/hevcdsp_template: Fix invalid shift in put_hevc_epel_bi_w_v()
Fixes: runtime error: left shift of negative value -255
Fixes: 4037/clusterfuzz-testcase-minimized-5290998163832832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7d88586e47)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
81bf24a827 avcodec/mlpdsp: Fix undefined shift ff_mlp_pack_output()
Fixes: runtime error: left shift of negative value -7862264
Fixes: 4074/clusterfuzz-testcase-minimized-4516104123711488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4f7f70738e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
d6ff6dc56b avcodec/zmbv: Check that the buffer is large enough for mvec
Fixes: Timeout
Fixes: 4143/clusterfuzz-testcase-4736864637419520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2ab9568a2c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
37a14a3d83 avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD137iL0()
Fixes: 4035/clusterfuzz-testcase-minimized-6479308925173760
Fixes: runtime error: signed integer overflow: 9 * 402653183 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 73964680d7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
5fdc679561 avcodec/wmv2dec: Check end of bitstream in parse_mb_skip() and ff_wmv2_decode_mb()
Fixes: Timeout
Fixes: 3200/clusterfuzz-testcase-5750022136135680

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 65e0a7c473)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
b24b316e30 avcodec/snowdec: Check for remaining bitstream in decode_blocks()
Fixes: Timeout
Fixes: 3142/clusterfuzz-testcase-5007853163118592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4527ec2216)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
3e3e42dbc4 avcodec/snowdec: Check intra block dc differences.
Fixes: Timeout
Fixes: 3142/clusterfuzz-testcase-5007853163118592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c3b9bbcc6e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Fredrik Hubinette
7d14046740 avformat/mov: Check size of STSC allocation
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a6fdd75fe6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
e69edb7aef avcodec/vc2enc: Clear coef_buf on allocation
Fixes: Use of uninitialized memory
Fixes: assertion failure

Reviewed-by: <atomnuker>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6d00905f81)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
cbc839681b avcodec/h264dec: Fix potential array overread
add padding before scantable arrays

See: 522d850e68

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 380b48fb9f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
b51f515c5c avcodec/x86/mpegvideodsp: Fix signedness bug in need_emu
Fixes: out of array read
Fixes: 3516/attachment-311488.dat

Found-by: Insu Yun, Georgia Tech.
Tested-by: wuninsu@gmail.com
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 58cf31cee7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
4654cc8cee avcodec/aacpsdsp_template: Fix integer overflows in ps_decorrelate_c()
Fixes: runtime error: signed integer overflow: 1939661764 - -454942263 cannot be represented in type 'int'
Fixes: 3191/clusterfuzz-testcase-minimized-5688798451073024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2afe05402f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
1fc3ebbcd9 avcodec/aacdec_fixed: Fix undefined shift
Fixes: runtime error: left shift of negative value -801112064
Fixes: 3492/clusterfuzz-testcase-minimized-5784775283441664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fca198fb5b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
314d78992c avcodec/mdct_*: Fix integer overflow in addition in RESCALE()
Fixes: runtime error: signed integer overflow: 1219998458 - -1469874012 cannot be represented in type 'int'
Fixes: 3443/clusterfuzz-testcase-minimized-5369987105554432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 770c934fa1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
5f58877bd9 avcodec/snowdec: Fix integer overflow in header parsing
Fixes: 3984/clusterfuzz-testcase-minimized-5265759929368576
Fixes: runtime error: signed integer overflow: -1085585801 + -1094995529 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c897a92858)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
d857f1035b avcodec/cngdec: Fix integer clipping
Fixes: runtime error: value -36211.7 is outside the range of representable values of type 'short'
Fixes: 2992/clusterfuzz-testcase-6649611793989632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 51090133b3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
4730046891 avcodec/sbrdsp_fixed: Fix integer overflow in shift in sbr_hf_g_filt_c()
Fixes: runtime error: shift exponent 66 is too large for 64-bit type 'long long'
Fixes: 3642/clusterfuzz-testcase-minimized-5443853801750528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 981e99ab99)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
4e87ab803a avcodec/aacsbr_fixed: Fix division by zero in sbr_gain_calc()
Fixes: 3642/clusterfuzz-testcase-minimized-5443853801750528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7d1dec4668)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
4d9f669a9f avutil/softfloat: Add FLOAT_MIN
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e34fe61bf4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
7a8b61357c avcodec/h264idct_template: Fix integer overflows in ff_h264_idct8_add()
Fixes: runtime error: signed integer overflow: -503316480 + -2013265038 cannot be represented in type 'int'
Fixes: 3805/clusterfuzz-testcase-minimized-6578427831255040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e131b8cedb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
d7c29005a4 avcodec/xan: Check for bitstream end in xan_huffman_decode()
Fixes: Timeout
Fixes: 3707/clusterfuzz-testcase-6465922706440192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4b51437dcc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
8b8502a66f avcodec/exr: fix undefined shift in pxr24_uncompress()
Fixes: runtime error: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 3787/clusterfuzz-testcase-minimized-5728764920070144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 66f0c958bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Luca Barbato
d6ecc61db8 avformat: Free the internal codec context at the end
Avoid a use after free in avformat_find_stream_info.

(cherry picked from commit 9e4a5eb51b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
0bd6717c0f avcodec/xan: Improve overlapping check
Fixes: memcpy-param-overlap
Fixes: 3612/clusterfuzz-testcase-minimized-6393461273001984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e8fafef1db)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
8bd2ba44a1 avcodec/aacdec_fixed: Fix integer overflow in apply_dependent_coupling_fixed()
Fixes: runtime error: signed integer overflow: 623487 * 536870912 cannot be represented in type 'int'
Fixes: 3594/clusterfuzz-testcase-minimized-4650622935629824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 41d96af2a7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
fcfa854abd avcodec/aacdec_fixed: Fix integer overflow in predict()
Fixes: runtime error: signed integer overflow: -2110708110 + -82837504 cannot be represented in type 'int'
Fixes: 3547/clusterfuzz-testcase-minimized-6009386439802880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0976752420)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
7373064247 avcodec/jpeglsdec: Check for end of bitstream in ls_decode_line()
Fixes: 1773/clusterfuzz-testcase-minimized-4832523987189760

Fixes: Timeout

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f80224ed19)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
374a2d2250 avcodec/jpeglsdec: Check ilv for being a supported value
Fixes: 1773/clusterfuzz-testcase-minimized-4832523987189760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fe533628b9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Rostislav Pehlivanov
519a54cc19 vc2enc_dwt: pad the temporary buffer by the slice size
Since non-Haar wavelets need to look into pixels outside the frame, we
need to pad the buffer. The old factor of two seemed to be a workaround
that fact and only padded to the left and bottom. This correctly pads
by the slice size and as such reduces memory usage and potential
exploits.
Reported by Liu Bingchang.

Ideally, there should be no temporary buffer but the encoder is designed
to deinterleave the coefficients into the classical wavelet structure
with the lower frequency values in the top left corner.

Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com>
(cherry picked from commit 3228ac730c)
2017-11-09 02:10:46 +00:00
Michael Niedermayer
4b1e87dc32 Update for 3.2.9
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-10-26 21:48:07 +02:00
Fredrik Hubinette
b76dcd0786 avformat/id3v2: fix leak in chapter parsing
Reviewed-on: https://chromium-review.googlesource.com/439405
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: James Almer <jamrial@gmail.com>
2017-10-26 21:47:41 +02:00
Michael Niedermayer
70d0cc8221 avcodec/snowdec: Check mv_scale
Fixes: runtime error: signed integer overflow: 2 * -1094995530 cannot be represented in type 'int'
Fixes: 3512/clusterfuzz-testcase-minimized-4812747210489856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 393d6fc739)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-10-15 00:45:24 +02:00
Michael Niedermayer
1959c0f9f9 avcodec/pafvideo: Check for bitstream end in decode_0()
Fixes: Timeout
Fixes: 3529/clusterfuzz-testcase-5057068371279872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9c85329cd0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-10-15 00:45:10 +02:00
Michael Niedermayer
f052d1df3e avcodec/ffv1dec: Fix out of array read in slice counting
Fixes: test-201710.mp4

Found-by: 连一汉 <lianyihan@360.cn> and Zhibin Hu
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c20f4fcb74)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-10-13 13:02:23 +02:00
Michael Niedermayer
11f5a13196 avcodec/dirac_dwt: Fix integer overflow in COMPOSE_53iL0()
Fixes: runtime error: signed integer overflow: 2147483646 + 2 cannot be represented in type 'int'
Fixes: 3485/clusterfuzz-testcase-minimized-4940429332054016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bdee75a4e7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-10-13 13:01:58 +02:00
Michael Niedermayer
b2c9771dd4 avcodec/mpeg_er: Clear mcsel in mpeg_er_decode_mb()
Fixes out of array read
Should fix: 3516/clusterfuzz-testcase-minimized-4608518562775040 (not reprodoceable)

Found-by: Insu Yun, Georgia Tech.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 127a362630)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-10-13 12:59:47 +02:00
Michael Niedermayer
16b07d59de avcodec/mpeg4videodec: Use 64 bit intermediates for sprite delta
Fixes: runtime error: signed integer overflow: -104713 * 65536 cannot be represented in type 'int'
Fixes: 3453/clusterfuzz-testcase-minimized-5555554657239040
Fixes: 3528/clusterfuzz-testcase-minimized-6283628420005888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e38f280fec)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-10-13 12:58:58 +02:00
Michael Niedermayer
0eb0b21c7f avcodec/x86/lossless_videoencdsp: Fix handling of small widths
Fixes out of array access
Fixes: crash-huf.avi

Regression since: 6b41b44149

This could also be fixed by adding checks in the C code that calls the dsp

Found-by: Zhibin Hu and 连一汉 <lianyihan@360.cn>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit df62b70de8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-10-05 01:33:26 +02:00
Michael Niedermayer
2db9b31996 avcodec/truemotion2: Fix integer overflows in tm2_high_chroma()
Fixes: runtime error: signed integer overflow: -1408475220 + -1408475220 cannot be represented in type 'int'
Fixes: 3336/clusterfuzz-testcase-minimized-5656839179993088

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 44874b4f5e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-10-05 01:30:02 +02:00
Michael Niedermayer
d9630deca4 avcodec/aacdec_template: Clear tns present flag on error
Fixes: 3444/clusterfuzz-testcase-minimized-6270352105668608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dcf9bae4a9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-10-05 01:29:44 +02:00
Michael Niedermayer
79bec49315 avcodec/proresdec2: SKIP_BITS() does not work with len=32
Fixes: invalid shift
Fixes: 3482/clusterfuzz-testcase-minimized-5446915875405824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c37138e01a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-10-05 01:28:21 +02:00
Michael Niedermayer
2293e5a78a avcodec/hevcdsp_template: Fix undefined shift
Fixes: runtime error: left shift of negative value -255
Fixes: 3373/clusterfuzz-testcase-minimized-5604083912146944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fbdab6eca7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-10-05 01:27:59 +02:00
Michael Niedermayer
74b28c54d9 avcodec/jpeg2000: Check that codsty->log2_prec_widths/heights has been initialized
Fixes: OOM
Fixes: 2225/clusterfuzz-testcase-minimized-5505632079708160

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 64e034da95)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-10-05 01:26:57 +02:00
Michael Niedermayer
04be199f8e avcodec/takdec: Fix integer overflow in decode_lpc()
Fixes: runtime error: signed integer overflow: 16748560 + 2143729712 cannot be represented in type 'int'
Fixes: 3202/clusterfuzz-testcase-minimized-4988291642294272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5d31f03a02)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-25 11:10:29 +02:00
Michael Niedermayer
9e8a636551 avcodec/proresdec2: Check bits in DECODE_CODEWORD(), fixes invalid shift
Fixes: runtime error: shift exponent 42 is too large for 32-bit type 'unsigned int'
Fixes: 3410/clusterfuzz-testcase-minimized-5313377960198144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4f5eaf0b59)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-25 11:10:14 +02:00
Michael Niedermayer
397674a3fb avcodec/takdec: Fix integer overflows in decode_subframe()
Fixes: runtime error: signed integer overflow: -1562477869 + -691460395 cannot be represented in type 'int'
Fixes: 3196/clusterfuzz-testcase-minimized-4528307146063872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3dabb9c69d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-25 11:09:05 +02:00
Michael Niedermayer
720a44f3a3 avcodec/dirac_dwt: Fix integer overflow in COMPOSE_FIDELITYi*()
Fixes: runtime error: signed integer overflow: 161 * 13872281 cannot be represented in type 'int'

Fixes: 3295/clusterfuzz-testcase-minimized-4738998142500864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 67da2685e0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-24 02:43:52 +02:00
Michael Niedermayer
5cf5a1034c avcodec/ffv1dec: Fix integer overflow in read_quant_table()
Fixes: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 3361/clusterfuzz-testcase-minimized-5065842955911168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d00fc952b6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-24 02:41:18 +02:00
Michael Niedermayer
6b66cd8c40 avcodec/svq3: Fix overflow in svq3_add_idct_c()
Fixes: runtime error: signed integer overflow: 2147392585 + 524288 cannot be represented in type 'int'
Fixes: 3348/clusterfuzz-testcase-minimized-4809500517203968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2c933c5168)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-24 02:40:59 +02:00
Michael Niedermayer
ab2d991382 avcodec/pngdec: Clean up on av_frame_ref() failure
Fixes: memleak
Fixes: 3203/clusterfuzz-testcase-minimized-4514553595428864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5480e82d77)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-20 03:09:14 +02:00
Michael Niedermayer
98f8f5b12f Update for 3.2.8
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:23:15 +02:00
Michael Niedermayer
0a5251d28e avcodec/hevc_ps: Fix c?_qp_offset_list size
Fixes: runtime error: index 5 out of bounds for type 'int8_t const[5]'
Fixes:3175/clusterfuzz-testcase-minimized-4736774054084608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit abf3f9fa23)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
2cfabd8ce7 avcodec/shorten: Move buffer allocation and offset init to end of read_header()
They are time consuming operations, performing them after the other checks
improves the speed with damaged input dramatically.

Fixes: Timeout
Fixes: 2928/clusterfuzz-testcase-4992812120539136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 380659604f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
87ef295ddf avcodec/jpeg2000dsp: Fix multiple integer overflows in ict_int()
Fixes: runtime error: signed integer overflow: 22553 * -188962 cannot be represented in type 'int'
Fixes: 3042/clusterfuzz-testcase-minimized-5174210131394560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2d025e7428)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
03bf78eba6 avcodec/hevcdsp_template: Fix undefined shift in put_hevc_pel_bi_w_pixels
Fixes: runtime error: left shift of negative value -95
Fixes: 3077/clusterfuzz-testcase-minimized-4684917524922368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c225da68cf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
f3c3cd5afb avcodec/diracdec: Fix overflow in DC computation
Fixes: runtime error: signed integer overflow: 11896 + 2147483646 cannot be represented in type 'int'
Fixes: 3053/clusterfuzz-testcase-minimized-6355082062856192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b5995856a4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
256ebf8bb4 avcodec/dirac_vlc: limit res_bits in APPEND_RESIDUE()
Fixes: runtime error: left shift of 1073741838 by 1 places cannot be represented in type 'int32_t' (aka 'int')
Fixes: 3279/clusterfuzz-testcase-minimized-4564805744590848

Suggested-by: <atomnuker>
Reviewed-by: <atomnuker>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d98d29a775)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Mark Wachsler
36c0958fbd libavcodec/h264_parse: don't use uninitialized value when chroma_format_idc==0
When parsing a monochrome file, chroma_log2_weight_denom was used without
being initialized, which could lead to a bogus error message being printed, e.g.
  [h264 @ 0x61a000026480] chroma_log2_weight_denom 24576 is out of range
It also could led to warnings using AddressSanitizer.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fde5c7dc79)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
4e4177dde2 avformat/asfdec: Fix DoS in asf_build_simple_index()
Fixes: Missing EOF check in loop
No testcase

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit afc9c683ed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
c9527df274 avformat/mov: Fix DoS in read_tfra()
Fixes: Missing EOF check in loop
No testcase

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9cb4eb7728)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
372bb59438 avcodec/dirac_vlc: Fix invalid shift in ff_dirac_golomb_read_32bit()
Fixes: runtime error: shift exponent 64 is too large for 64-bit type 'residual' (aka 'unsigned long')
Fixes: 2838/clusterfuzz-testcase-minimized-6260066086813696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c595139f1f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
d5b42af8e7 avcodec/dirac_dwt: Fix multiple overflows in 9/7 lifting
Fixes: runtime error: signed integer overflow: 1073901567 + 1073901567 cannot be represented in type 'int'
Fixes: 3124/clusterfuzz-testcase-minimized-454643435752652

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f71cd44147)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
2173539519 avcodec/diracdec: Fix integer overflow in INTRA_DC_PRED()
Fixes: runtime error: signed integer overflow: 1168175789 + 1168178473 cannot be represented in type 'int'
Fixes: 3081/clusterfuzz-testcase-minimized-4807564879462400
Fixes: 2844/clusterfuzz-testcase-minimized-5561715838156800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2a0823ae96)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
孙浩(晓黑)
816f7337bf avformat/mxfdec: Fix Sign error in mxf_read_primer_pack()
Fixes: 20170829B.mxf

Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com>
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9d00fb9d70)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
孙浩(晓黑)
9cbac36026 avformat/mxfdec: Fix DoS issues in mxf_read_index_entry_array()
Fixes: 20170829A.mxf

Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com>
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 900f39692c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
孙浩(晓黑)
a051de092e avformat/nsvdec: Fix DoS due to lack of eof check in nsvs_file_offset loop.
Fixes: 20170829.nsv

Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com>
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c24bcb5536)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
e29c9ef2d5 avcodec/snowdec: Fix integer overflow in decode_subband_slice_buffered()
Fixes: runtime error: signed integer overflow: 267 * 8388608 cannot be represented in type 'int'
Fixes: 2743/clusterfuzz-testcase-minimized-5820652076400640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 732f976456)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
50d726273e avcodec/hevc_ps: Fix undefined shift in pcm code
Fixes: runtime error: shift exponent -1 is negative
Fixes: 3091/clusterfuzz-testcase-minimized-6229767969832960

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2a83866c9f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
a4cc1101cc avcodec/sbrdsp_fixed: Fix undefined overflows in autocorrelate()
Fixes: runtime error: signed integer overflow: 8903997421129740175 + 354481484684609529 cannot be represented in type 'long'
Fixes: 2045/clusterfuzz-testcase-minimized-6751255865065472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eefb68c9c3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
d4fc6b211f avformat/mvdec: Fix DoS due to lack of eof check
Fixes: loop.mv

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4f05e2e2dc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
孙浩 and 张洪亮(望初)
5bc9f70441 avformat/rl2: Fix DoS due to lack of eof check
Fixes: loop.rl2

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 96f24d1bee)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
孙浩 and 张洪亮(望初)
2bbef8ee27 avformat/rmdec: Fix DoS due to lack of eof check
Fixes: loop.ivr

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 124eb202e7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
孙浩 and 张洪亮(望初)
98e177c728 avformat/cinedec: Fix DoS due to lack of eof check
Fixes: loop.cine

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7e80b63ecd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
孙浩 and 张洪亮(望初)
f94517934b avformat/asfdec: Fix DoS due to lack of eof check
Fixes: loop.asf

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7f9ec5593e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
2920c7cec0 avformat/hls: Fix DoS due to infinite loop
Fixes: loop.m3u

The default max iteration count of 1000 is arbitrary and ideas for a better solution are welcome

Found-by: Xiaohei and Wangchu from Alibaba Security Team

Previous version reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7ec414892d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
baca98fc09 ffprobe: Fix NULL pointer handling in color parameter printing
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 351e28f9a7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
726133b6d2 ffprobe: Fix null pointer dereference with color primaries
Found-by: AD-lab of venustech
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 837cb4325b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b2c39fcc3c0749490dc93bca80f56724878b55fe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
3738a41830 avcodec/hevc_ps: Check delta_pocs in ff_hevc_decode_short_term_rps()
Fixes: integer overflow
Fixes: 2893/clusterfuzz-testcase-minimized-5809330567774208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2b44dcbc44)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
53a6cdf89d avformat/rtpdec_h264: Fix heap-buffer-overflow
Fixes: rtp_sdp/poc.sdp

Found-by: Bingchang <l.bing.chang.bc@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c42a1388a6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Vitaly Buka
50cb32480b avformat/aviobuf: Fix signed integer overflow in avio_seek()
Signed integer overflow is undefined behavior.
Detected with clang and -fsanitize=signed-integer-overflow

Signed-off-by: Vitaly Buka <vitalybuka@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eca2a49716)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Vitaly Buka
74410f2aba avformat/mov: Fix signed integer overflows with total_size
Signed integer overflow is undefined behavior.
Detected with clang and -fsanitize=signed-integer-overflow

Signed-off-by: Vitaly Buka <vitalybuka@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4a404cb5b9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Vitaly Buka
febea34f91 avcodec/utils: Fix signed integer overflow in rc_initial_buffer_occupancy initialization
Signed integer overflow is undefined behavior.
Detected with clang and -fsanitize=signed-integer-overflow

Signed-off-by: Vitaly Buka <vitalybuka@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8c2bb10ddf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
6da5e63ba7 avcodec/aacdec_template: Fix running cleanup in decode_ics_info()
Fixes: out of array read
Fixes: 2873/clusterfuzz-testcase-minimized-5924145713905664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Previous version reviewed-by: Alex Converse <alex.converse@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6f03ffb47d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
d15b1da8bc avcodec/me_cmp: Fix crashes on ARM due to misalignment
Adds a diff_pixels_unaligned()

Fixes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872503

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bc488ec28a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
dc86479e5f avcodec/dirac_dwt_template: Fix integer overflow in vertical_compose53iL0()
Fixes: runtime error: signed integer overflow: 2147483646 + 2 cannot be represented in type 'int'
Fixes: 3013/clusterfuzz-testcase-minimized-4644084197097472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a165b53daa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
98cd9cd4c2 avcodec/fic: Fixes signed integer overflow
Fixes: runtime error: signed integer overflow: 1037142357 + 1227025305 cannot be represented in type 'int'
Fixes: 3024/clusterfuzz-testcase-minimized-5885660323905536

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0c9d5b015c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
bd09e3b19c avcodec/snowdec: Fix off by 1 error
Fixes: runtime error: index 4 out of bounds for type 'int8_t [4]'
Fixes: 3023/clusterfuzz-testcase-minimized-6421736130084864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d132683ddd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
5bc3b18e3d avcodec/diracdec: Fixes integer overflow
Fixes: runtime error: signed integer overflow: 340018243 * 27 cannot be represented in type 'int'
Fixes: 2861/clusterfuzz-testcase-minimized-5361070510178304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 92da23093c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
952393b69e avcodec/diracdec: Check perspective_exp and zrs_exp.
Fixes: undefined shift
Fixes: runtime error: shift exponent 264 is too large for 32-bit type 'int'
Fixes: 2860/clusterfuzz-testcase-minimized-4672811689836544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1e6cab8745)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
04db307c77 avcodec/ffv1dec_template: Fix undefined shift
Fixes: runtime error: left shift of negative value -127
Fixes: 2834/clusterfuzz-testcase-minimized-5988039123795968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 62702eebde)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
342d5c20ce avcodec/mpeg4videodec: Clear mcsel before decoding an image
Fixes: runtime error: signed integer overflow: 2146467840 + 1032192 cannot be represented in type 'int'
Fixes: 2826/clusterfuzz-testcase-minimized-5901511613743104

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7735ed2974)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
52c4069119 avcodec/dirac_dwt: Fixes integer overflows in COMPOSE_DAUB97*
Fix multiple: runtime error: signed integer overflow: 6497 * 3409630 cannot be represented in type 'int'
Fixes: 2819/clusterfuzz-testcase-minimized-4743700301217792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a5380f9c1c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
e595087048 avcodec/aacdec_fixed: fix invalid shift in predict()
Fixes: runtime error: shift exponent -2 is negative
Fixes: 2818/clusterfuzz-testcase-minimized-5062943676825600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1e443051b2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
b66aa37834 avcodec/h264_slice: Fix overflow in slice offset
Fixes: runtime error: signed integer overflow: 1610612736 * 2 cannot be represented in type 'int'
Fixes: 2817/clusterfuzz-testcase-minimized-5289691240726528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1f53bde6d8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Steven Siloti
16ee405707 avformat/utils: fix memory leak in avformat_free_context
The pointer to the packet queue is stored in the internal structure
so the queue needs to be flushed before internal is freed.

Signed-off-by: Steven Siloti <ssiloti@bittorrent.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 949debd1d1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
19938f1a11 avcodec/diracdsp: fix integer overflow
Fixes: runtime error: signed integer overflow: 11 * 225726413 cannot be represented in type 'int'
Fixes: 2764/clusterfuzz-testcase-minimized-5382561922547712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b2d9d72269)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Michael Niedermayer
892ceb512f avcodec/diracdec: Check weight_log2denom
Fixes: runtime error: shift exponent -1 is negative
Fixes: 2742/clusterfuzz-testcase-minimized-5724322402402304
Fixes: 2744/clusterfuzz-testcase-minimized-4672435653705728
Fixes: 2749/clusterfuzz-testcase-minimized-5298741273690112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 880f5c5913)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-09-17 12:21:32 +02:00
Muhammad Faiz
5987b16f86 avfilter/vf_ssim: fix temp size calculation
Also use av_mallocz_array.
Fix Ticket6519.

Reviewed-by: Tobias Rapp <t.rapp@noa-archive.com>
Signed-off-by: Muhammad Faiz <mfcc64@gmail.com>
(cherry picked from commit f2d23ec03f)
2017-08-06 16:25:33 +07:00
Michael Niedermayer
66395ac32b Update for 3.2.7
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-30 12:22:51 +02:00
Michael Niedermayer
e889397924 avcodec/dirac_dwt: Fix multiple integer overflows in COMPOSE_DD97iH0()
Fixes: runtime error: signed integer overflow: 9 * 335544320 cannot be represented in type 'int'
Fixes: 2739/clusterfuzz-testcase-minimized-6737297955356672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bf8ab72ae9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-29 19:13:20 +02:00
Michael Niedermayer
7827b06d77 avcodec/diracdec: Fix integer overflow in divide3()
Fixes: runtime error: signed integer overflow: -1073746548 * 21845 cannot be represented in type 'int'
Fixes: 2729/clusterfuzz-testcase-minimized-5902915464069120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c0220c768c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-29 14:23:24 +02:00
Michael Niedermayer
bae812711a avcodec/takdec: Fix integer overflow in decode_subframe()
Fixes: runtime error: signed integer overflow: -536870912 - 1972191120 cannot be represented in type 'int'
Fixes: 2711/clusterfuzz-testcase-minimized-4975142398590976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2c630d159f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-29 14:18:34 +02:00
Michael Niedermayer
b375cc8bb7 avformat/rtmppkt: Convert ff_amf_get_field_value() to bytestream2
Fixes: out of array accesses

Found-by: JunDong Xie of Ant-financial Light-Year Security Lab
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ffcc82219c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-29 14:17:57 +02:00
Michael Niedermayer
f2a6f41dd7 avformat/rtmppkt: Convert ff_amf_tag_size() to bytestream2
Fixes: out of array accesses
Fixes: crash-9238fa9e8d4fde3beda1f279626f53812cb001cb-SEGV

Found-by: JunDong Xie of Ant-financial Light-Year Security Lab
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 08c073434e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-29 04:49:46 +02:00
Michael Niedermayer
8c7b477b97 avcodec/diracdec: Fix integer overflow in signed multiplication in UNPACK_ARITH()
Fixes: runtime error: signed integer overflow: 1073741823 * 4 cannot be represented in type 'int'
Fixes: 2729/clusterfuzz-testcase-minimized-5902915464069120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8e275a74b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-28 03:41:08 +02:00
Michael Niedermayer
6a10b962e3 avcodec/dnxhddec: Move mb height check out of non hr branch
Fixes: out of array access
Fixes: poc.dnxhd

Found-by: Bingchang, Liu@VARAS of IIE
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 296debd213)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-27 03:11:19 +02:00
Michael Niedermayer
efb649467c avcodec/hevc_ps: fix integer overflow in log2_parallel_merge_level_minus2
Fixes: runtime error: signed integer overflow: -2147483647 - 2 cannot be represented in type 'int'
Fixes: 2702/clusterfuzz-testcase-minimized-4511932591636480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 74c1c22d7f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-26 17:24:26 +02:00
Michael Niedermayer
6cc7777d4b avformat/oggparsecelt: Do not re-allocate os->private
Fixes: double free
Fixes: clusterfuzz-testcase-minimized-5080550145785856

Found-by: ClusterFuzz
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7140761481)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-26 00:14:57 +02:00
Michael Niedermayer
00b0d595eb avcodec/ylc: Fix shift overflow
Fixes: runtime error: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 2698/clusterfuzz-testcase-minimized-4713541443518464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 03a9e6ff30)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-26 00:14:21 +02:00
Michael Niedermayer
b905d2948a avcodec/aacps: Fix multiple integer overflow in map_val_34_to_20()
Fixes: avcodec/aacps.c:511:40: runtime error: signed integer overflow: 1509077651 + 758068176 cannot be represented in type 'int'
Fixes: 2678/clusterfuzz-testcase-minimized-4702787684270080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0764fe1d09)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-26 00:14:02 +02:00
Michael Niedermayer
7f638d56bd avcodec/aacdec_fixed: fix: left shift of negative value -1
Fixes: 2699/clusterfuzz-testcase-minimized-5631303862976512

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2dfb8c4178)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-26 00:11:55 +02:00
Michael Niedermayer
c368f07565 avcodec/dirac_vlc: Fix undefined shift
Fixes: runtime error: shift exponent 64 is too large for 64-bit type 'residual' (aka 'unsigned long')
Fixes: 2674/clusterfuzz-testcase-minimized-4999700518273024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 69e7daf6ce)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-24 03:03:15 +02:00
Brice Waegeneire
79f6269fd0 doc/filters: typo in frei0r
Signed-off-by: Brice Waegeneire <brice.wge@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6a6eec485d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-23 15:01:03 +02:00
Vodyannikov Aleksandr
539dc1746a avcodec/cfhd: Fix decoding regression due to height check
Fixes: Ticket6546

Regression since: 54aaadf648

Reviewed-by: Muhammad Faiz <mfcc64@gmail.com>
Reviewed-by: Kieran Kunhya <kierank@obe.tv>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 47c9365724)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-23 15:00:52 +02:00
Michael Niedermayer
97e35bc40b avcodec/aacdec_template (fixed point): Check gain in decode_cce() to avoid undefined shifts later
Fixes: runtime error: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 2581/clusterfuzz-testcase-minimized-4681474395602944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2886142e0c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-19 04:03:09 +02:00
Michael Niedermayer
13c0467c49 avcodec/ffv1dec_template: Fix signed integer overflow
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 2634/clusterfuzz-testcase-minimized-4540890636877824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4de4308d2a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-19 03:54:53 +02:00
Michael Niedermayer
3abe6554c1 avcodec/aacdec_template: Fix undefined integer overflow in apply_tns()
Fixes: runtime error: signed integer overflow: -2147483648 - 1202286525 cannot be represented in type 'int'
Fixes: 2071/clusterfuzz-testcase-minimized-6036414271586304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ef8f03133)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-19 03:54:38 +02:00
Michael Niedermayer
aa01a35dd5 avcodec/magicyuv: Check that vlc len is not too large
Fixes: runtime error: shift exponent -95 is negative
Fixes: 2568/clusterfuzz-testcase-minimized-4926115716005888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 341f01290c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-19 03:53:22 +02:00
Michael Niedermayer
fa427bdb59 avcodec/mjpegdec: Clip DC also on the negative side.
Fixes: runtime error: signed integer overflow: -16711425 + -2130772346 cannot be represented in type 'int'
Fixes: 2533/clusterfuzz-testcase-minimized-5372857678823424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c28f648b19)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-19 03:47:59 +02:00
Michael Niedermayer
1268784d9f avcodec/aacps (fixed point): Fix multiple signed integer overflows
Fixes: runtime error: signed integer overflow: 1421978265 - -1810326882 cannot be represented in type 'int'
Fixes: 2527/clusterfuzz-testcase-minimized-5260915396050944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 80b9e40b6f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-19 03:47:44 +02:00
Michael Niedermayer
6405c66a51 avcodec/ylc: Fix vlc of 31 bits
Fixes: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 2515/clusterfuzz-testcase-minimized-6197200012967936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fe9242204d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-19 03:40:21 +02:00
Michael Niedermayer
a76db7176a avcodec/sbrdsp_fixed: Fix integer overflow in sbr_hf_apply_noise()
Fixes: runtime error: signed integer overflow: -2049425300 + -117591631 cannot be represented in type 'int'
Fixes: part of 2096/clusterfuzz-testcase-minimized-4901566068817920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2061de8a3f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-19 03:39:52 +02:00
Michael Niedermayer
a954b531f6 avcodec/wavpack: Fix invalid shift
Fixes: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 2377/clusterfuzz-testcase-minimized-6108505935183872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c07af72098)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-19 02:50:33 +02:00
Michael Niedermayer
aaecd2ef68 avcodec/h264_slice: Fix signed integer overflow
Fixes: runtime error: signed integer overflow: 26 + 2147483644 cannot be represented in type 'int'
Fixes: 2456/clusterfuzz-testcase-minimized-4822695051001856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7592d97f10)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-19 02:50:18 +02:00
Michael Niedermayer
2b85709bee avcodec/hevc_ps: Fix integer overflow with beta/tc offsets
Fixes: runtime error: signed integer overflow: 2113929216 * 2 cannot be represented in type 'int'
Fixes: 2422/clusterfuzz-testcase-minimized-5242114713583616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit de54a37c1d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-19 02:50:00 +02:00
Michael Niedermayer
d986096963 avcodec/cfhd: Fix invalid left shift of negative value
Fixes: runtime error: left shift of negative value -1
Fixes: 2395/clusterfuzz-testcase-minimized-6540529313513472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c709f009da)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-19 02:49:03 +02:00
Michael Niedermayer
20ce366fee avcodec/vb: Check vertical GMC component before multiply
Fixes: runtime error: signed integer overflow: 8224 * 663584 cannot be represented in type 'int'
Fixes: 2393/clusterfuzz-testcase-minimized-6128334993883136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bc6ab72bc7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-19 02:48:39 +02:00
Michael Niedermayer
bbf911b660 avcodec/jpeg2000dwt: Fix integer overflow in dwt_decode97_int()
Fixes: runtime error: signed integer overflow: -163654656 * 256 cannot be represented in type 'int'
Fixes: 2367/clusterfuzz-testcase-minimized-4648678897745920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ea5366670e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-19 02:45:51 +02:00
Michael Niedermayer
5bb861d45b avcodec/apedec: Fix integer overflow
Fixes: out of array access
Fixes: PoC.ape and others

Found-by: Bingchang, Liu@VARAS of IIE
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ba4beaf614)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-07-16 17:02:30 +02:00
Michael Niedermayer
fc24783c6d avcodec/wavpack: Fix integer overflow in wv_unpack_stereo()
Fixes: runtime error: signed integer overflow: 2080374785 + 2080374784 cannot be represented in type 'int'
Fixes: 2351/clusterfuzz-testcase-minimized-5359403240783872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 73ea2a028e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-25 02:52:40 +02:00
Michael Niedermayer
a2bde1363c avcodec/mpeg4videodec: Fix GMC with videos of dimension 1
Fixes: runtime error: shift exponent -1 is negative
Fixes: 2338/clusterfuzz-testcase-minimized-5153426541379584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4976a3411f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-25 02:48:00 +02:00
Michael Niedermayer
a7c0243e2f avcodec/wavpack: Fix integer overflow
Fixes: runtime error: signed integer overflow: 227511904 + 1964113935 cannot be represented in type 'int'
Fixes: 2331/clusterfuzz-testcase-minimized-6182185830711296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 24e95f9d4d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-23 03:05:54 +02:00
Michael Niedermayer
00a6211b45 avcodec/takdec: Fix integer overflow
Fixes: runtime error: signed integer overflow: 512 + 2147483146 cannot be represented in type 'int'
Fixes: 2314/clusterfuzz-testcase-minimized-4519333877252096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0c2ef4f6b4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-23 03:05:43 +02:00
Michael Niedermayer
220ee7e583 avcodec/tiff: Update pointer only when the result is used
Fixes: runtime error: signed integer overflow: 538976288 * 32 cannot be represented in type 'int'
Fixes: 2310/clusterfuzz-testcase-minimized-4534784887881728

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 27f80ab016)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-23 03:05:33 +02:00
Michael Niedermayer
9bca2f698b avcodec/cfhd: Check bpc before setting bpc in context
Fixes: runtime error: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 2306/clusterfuzz-testcase-minimized-5002997392211968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6f1d2355a7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-22 03:09:17 +02:00
Michael Niedermayer
6d951be24d avcodec/cfhd: Fix undefined shift
Fixes: runtime error: left shift of negative value -1
Fixes: 2303/clusterfuzz-testcase-minimized-5529675273076736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5a950f4e32)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-22 03:08:57 +02:00
Michael Niedermayer
80dc5b497e avcodec/hevc_filter: Fix invalid shift
Fixes: runtime error: left shift of negative value -1

Fixes: 2299/clusterfuzz-testcase-minimized-4843509351710720

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d7b3d5c3f2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-22 03:08:44 +02:00
Michael Niedermayer
dd4fd80fe6 avcodec/mpeg4videodec: Fix overflow in virtual_ref computation
Fixes: runtime error: signed integer overflow: 262144 * -16120 cannot be represented in type 'int'
Fixes: 2292/clusterfuzz-testcase-minimized-6156080415506432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5443c4bdf4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-22 03:08:34 +02:00
Michael Niedermayer
b97e0e98b4 avcodec/lpc: signed integer overflow in compute_lpc_coefs() (aacdec_fixed)
Fixes: runtime error: signed integer overflow: -1575818955 + -915383657 cannot be represented in type 'int'
Fixes: 2224/clusterfuzz-testcase-minimized-6208559949807616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e95fcfe8fb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-22 03:08:22 +02:00
Michael Niedermayer
9125bbb3e5 avcodec/wavpack: Fix undefined integer negation
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 2291/clusterfuzz-testcase-minimized-5538453481586688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f89747086)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-22 03:07:19 +02:00
Michael Niedermayer
27ad04e128 avcodec/aacdec_fixed: Check s for being too small
Fixes: runtime error: shift exponent -8 is negative
Fixes: 2286/clusterfuzz-testcase-minimized-5711764169687040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cf7edbd6c5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-22 03:07:07 +02:00
Michael Niedermayer
66735ddd72 avcodec/htmlsubtitles: Replace very slow redundant sscanf() calls by cleaner and faster code
This reduces the worst case from O(n²) to O(n) time

Fixes Timeout
Fixes: 2127/clusterfuzz-testcase-minimized-6595787859427328

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4132218b87)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-22 03:06:42 +02:00
Anton Mitrofanov
f7addaece8 avcodec/h264: Fix mix of lossless and lossy MBs decoding
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit cf231b68da)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-20 03:09:08 +02:00
Anton Mitrofanov
b36c97a0ae avcodec/h264_mb: Fix 8x8dct in lossless for new versions of x264
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 06dda70f1e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-20 03:03:12 +02:00
Anton Mitrofanov
312f96053a avcodec/h264_cabac: Fix CABAC+8x8dct in 4:4:4
Use the correct ctxIdxInc calculation for coded_block_flag.
Keep old behavior for old versions of x264 for backward compatibility.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 840b41b2a6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-20 01:53:29 +02:00
Michael Niedermayer
e5d9f0c3cd avcodec/takdec: Fixes: integer overflow in AV_SAMPLE_FMT_U8P output
Fixes: runtime error: signed integer overflow: 2147483543 + 128 cannot be represented in type 'int'
Fixes: 2234/clusterfuzz-testcase-minimized-6266896041115648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 27c2006805)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-18 15:17:13 +02:00
Michael Niedermayer
431ccd3f55 Changelog: update
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-18 00:49:16 +02:00
Michael Niedermayer
74cf081ef0 avcodec/jpeg2000dsp: Reorder operations in ict_int() to avoid 2 integer overflows
Fixes: runtime error: signed integer overflow: 58065 * 51981 cannot be represented in type 'int'
Fixes: 2271/clusterfuzz-testcase-minimized-5778297776504832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c746f92a8e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-17 23:34:47 +02:00
Michael Niedermayer
b7362f3c6b avcodec/hevcpred_template: Fix left shift of negative value
Fixes: runtime error: left shift of negative value -1
Fixes: 2250/clusterfuzz-testcase-minimized-5693382112313344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c94326c1fc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-17 23:34:18 +02:00
Michael Niedermayer
1a54f239ad Update for 3.2.6
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-17 02:30:36 +02:00
Michael Niedermayer
a2055f8e3f avcodec/hevcdec: Fix signed integer overflow in decode_lt_rps()
Fixes: runtime error: signed integer overflow: 2147483647 + 6 cannot be represented in type 'int'
Fixes: 2263/clusterfuzz-testcase-minimized-4800359627227136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1edbf5e20c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-17 02:25:54 +02:00
Michael Niedermayer
c00ef60abd avcodec/jpeg2000dec: Check nonzerobits more completely
Fixes: runtime error: shift exponent 36 is too large for 32-bit type 'int'
Fixes: 2239/clusterfuzz-testcase-minimized-5639766592716800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dfb61ea263)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-17 02:25:27 +02:00
Michael Niedermayer
12cf6ace44 avcodec/shorten: Sanity check maxnlpc
Fixes OOM
Fixes: 2131/clusterfuzz-testcase-minimized-4718045157130240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e77ddd31a8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-17 02:23:53 +02:00
Michael Niedermayer
39d9308b99 avcodec/truemotion2: Move skip computation after checks
Fixes: runtime error: signed integer overflow: 630067357 * 4 cannot be represented in type 'int'
Fixes: 2233/clusterfuzz-testcase-minimized-5943031318446080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3c716682a8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-17 02:23:07 +02:00
Michael Niedermayer
d09ec6c27f avcodec/jpeg2000: Fixes integer overflow in ff_jpeg2000_ceildivpow2()
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 2231/clusterfuzz-testcase-minimized-4565181982048256

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e3fadc57c5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:43:37 +02:00
Michael Niedermayer
31c1c0b46a avcodec/dnxhd_parser: Do not return invalid value from dnxhd_find_frame_end() on error
Fixes: Null pointer dereference

Fixes: CVE-2017-9608
Found-by: Yihan Lian
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 611b356274)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:15:51 +02:00
Michael Niedermayer
6d77a3ff3c avcodec/hevcdec: Check nb_sps
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bc40674462)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:30 +02:00
Michael Niedermayer
81527019b1 avcodec/hevc_refs: Check nb_refs in add_candidate_ref()
Fixes: runtime error: index 16 out of bounds for type 'int [16]'
Fixes: 2209/clusterfuzz-testcase-minimized-5012343912136704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1cb4ef526d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:30 +02:00
Michael Niedermayer
3c6aa2e0d1 avcodec/mpeg4videodec: Check sprite delta upshift against overflowing.
Fixes: runtime error: signed integer overflow: -268386304 * 16 cannot be represented in type 'int'
Fixes: 2204/clusterfuzz-testcase-minimized-5616756909408256

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 12245ab1f6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:30 +02:00
Michael Niedermayer
46acaabd2a avcodec/mpeg4videodec: Fix integer overflow in num_sprite_warping_points=2 case
Fixes: runtime error: signed integer overflow: 131072 + 2147352576 cannot be represented in type 'int'
Fixes: 2192/clusterfuzz-testcase-minimized-5370387988742144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0a87be404a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:30 +02:00
Michael Niedermayer
c1e2c1e84e avcodec/aacsbr_fixed: Check shift in sbr_hf_assemble()
Fixes: runtime error: shift exponent -10 is negative

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d1992448d3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:30 +02:00
Michael Niedermayer
15a408f182 avcodec/sbrdsp_fixed: Return an error from sbr_hf_apply_noise() if operations are impossible
Fixes: 1775/clusterfuzz-testcase-minimized-5330288148217856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d549f026d8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:30 +02:00
Michael Niedermayer
22a6713ce9 avcodec/libvpxdec: Check that display dimensions fit in the storage dimensions
Fixes assertion failure
Fixes: 2112/clusterfuzz-testcase-minimized-4526878557732864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f8593c2f49)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:30 +02:00
Michael Niedermayer
61bf10368c avcodec/jpeg2000dwt: Fix runtime error: left shift of negative value -123
Fixes: 2208/clusterfuzz-testcase-minimized-5976593765761024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d24043e1a2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:30 +02:00
Michael Niedermayer
266ecedc75 avcodec/wavpack: Fix runtime error: signed integer overflow: 1886191616 + 277872640 cannot be represented in type 'int'
Fixes: 2181/clusterfuzz-testcase-minimized-6314784322486272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c996374d4d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:30 +02:00
Michael Niedermayer
753d04b618 avcodec/snowdec: Fix runtime error: left shift of negative value -1
Fixes: 2197/clusterfuzz-testcase-minimized-6010716676947968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2e44126363)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:30 +02:00
Michael Niedermayer
1df8547366 avcodec/aacdec_fixed: Fix runtime error: left shift of negative value -1297616
Fixes: 2195/clusterfuzz-testcase-minimized-4736721533009920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6d499ecef9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:30 +02:00
Michael Niedermayer
722cbfc5e1 avcodec/tiff: Fix leak of geotags[].val
Fixes: 2176/clusterfuzz-testcase-minimized-5908197216878592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 22a25ab389)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:30 +02:00
Michael Niedermayer
9a8419541f avcodec/ra144: Fix runtime error: signed integer overflow: -2200 * 1033073 cannot be represented in type 'int'
Fixes: 2175/clusterfuzz-testcase-minimized-5809657849315328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 71da0a5c97)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:30 +02:00
Michael Niedermayer
ef157cec81 avcodec/flicvideo: Fix runtime error: signed integer overflow: 4864 * 459296 cannot be represented in type 'int'
Fixes: 2174/clusterfuzz-testcase-minimized-5739234533048320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 90e8317b3b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:30 +02:00
Michael Niedermayer
1f1b73cb16 avcodec/cfhd: Check band parameters before storing them
Fixes out of array read
Fixes: 2169/clusterfuzz-testcase-minimized-5688641642823680

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 54aaadf648)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:30 +02:00
Michael Niedermayer
e5714e4ccb avcodec/h264_parse: Check picture structure when initializig weight table
Fixes: runtime error: index 49 out of bounds for type 'int [48][2][2]'
Fixes: 2159/clusterfuzz-testcase-minimized-5267945972301824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3a1ad368a78b153b63ccc07af864b3611e2a4ac3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
e93ffb4888 avcodec/indeo4: Check remaining data in Pic hdr extension parsing code
Fixes: Timeout
Fixes: 2115/clusterfuzz-testcase-minimized-6594111748440064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a3b5b60bdf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
f7ea74422f avcodec/ac3dec_fixed: Fix multiple runtime error: signed integer overflow: -39271008 * 59 cannot be represented in type 'int'
Fixes: 2113/clusterfuzz-testcase-minimized-6510704959946752

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4e3ab1a5c1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
d528414568 avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: 53098 * 40448 cannot be represented in type 'int'
Fixes: 2106/clusterfuzz-testcase-minimized-6136503639998464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 18bca25adb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
fe5b764e6a avcodec/pafvideo: Fix assertion failure
Fixes: 2100/clusterfuzz-testcase-minimized-4522961547558912

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c4360559ee)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
f865aa6bee avcodec/takdec: Fix multiple runtime error: signed integer overflow: 637072 * 4096 cannot be represented in type 'int'
Fixes: 2079/clusterfuzz-testcase-minimized-5345861779324928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e4efd41b83)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
873397e27e avcodec/mjpegdec: Check that reference frame matches the current frame
Fixes: out of array read
Fixes: 2097/clusterfuzz-testcase-minimized-5036861833609216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4705edbbb9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
260a286e53 avcodec/tiff: Avoid loosing allocated geotag values
Fixes memleak
Fixes: 2076/clusterfuzz-testcase-minimized-6542640243802112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d7cbeab4c1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
fb0d1cafab avcodec/cavs: Fix runtime error: signed integer overflow: -12648062 * 256 cannot be represented in type 'int'
Fixes: 2067/clusterfuzz-testcase-minimized-5578430902960128

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1e6ee86d92)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
25dac3128b avformat/hls: Check local file extensions
This reduces the attack surface of local file-system
information leaking.

It prevents the existing exploit leading to an information leak. As
well as similar hypothetical attacks.

Leaks of information from files and symlinks ending in common multimedia extensions
are still possible. But files with sensitive information like private keys and passwords
generally do not use common multimedia filename extensions.
It does not stop leaks via remote addresses in the LAN.

The existing exploit depends on a specific decoder as well.
It does appear though that the exploit should be possible with any decoder.
The problem is that as long as sensitive information gets into the decoder,
the output of the decoder becomes sensitive as well.
The only obvious solution is to prevent access to sensitive information. Or to
disable hls or possibly some of its feature. More complex solutions like
checking the path to limit access to only subdirectories of the hls path may
work as an alternative. But such solutions are fragile and tricky to implement
portably and would not stop every possible attack nor would they work with all
valid hls files.

Developers have expressed their dislike / objected to disabling hls by default as well
as disabling hls with local files. There also where objections against restricting
remote url file extensions. This here is a less robust but also lower
inconvenience solution.
It can be applied stand alone or together with other solutions.
limiting the check to local files was suggested by nevcairiel

This recommits the security fix without the author name joke which was
originally requested by Nicolas.

Found-by: Emil Lerner and Pavel Cheremushkin
Reported-by: Thierry Foucu <tfoucu@google.com>

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 189ff42196)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
5c82f67012 avcodec/qdrw: Fix null pointer dereference
The RGB555 PACKBITSRGN case tries to read a palette, if such
palette is actually stored then it accesses a null pointer.
All 16bit samples i could find use DIRECTBITSRGN.

Fixes: 2065/clusterfuzz-testcase-minimized-6298930457346048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 46b865ea9f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
25b7dc959a avutil/softfloat: Fix sign error in and improve documentation of av_int2sf()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6019d721d4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
5c2c0979e2 avcodec/hevc_ps: Fix runtime error: index 32 out of bounds for type 'uint8_t [32]'
Fixes: 2010/clusterfuzz-testcase-minimized-6209288450080768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 29808fff33)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
439757d38a avcodec/dxv: Check remaining bytes in dxv_decompress_raw()
Fixes: Timeout
Fixes: 2006/clusterfuzz-testcase-minimized-5766515037044736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eb50492270)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
90c38d6ab8 avcodec/pafvideo: Check packet size and frame code before ff_reget_buffer()
Fixes 1745/clusterfuzz-testcase-minimized-6160693365571584
Fixes: Timeout

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit faa5a2181d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
7edf958740 avcodec/ac3dec_fixed: Fix runtime error: left shift of 419 by 23 places cannot be represented in type 'int'
Fixes: 1352/clusterfuzz-testcase-minimized-5757565017260032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 136ce8baa4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
858adb27a0 avformat/options: log filename on open
The loglevel is choosen so that the main filename and any images of
multi image sequences are shown only at debug level to avoid
clutter.

This makes exploits in playlists more visible. As they would show
accesses to private/sensitive files

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 53e0d5d724)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
6a44539bc8 avcodec/aacps: Fix runtime error: left shift of 1073741824 by 1 places cannot be represented in type 'INTFLOAT' (aka 'int')
Fixes: 2005/clusterfuzz-testcase-minimized-5744226438479872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9faf098163)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
b7afa9f8aa avcodec/wavpack: Fix runtime error: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 1967/clusterfuzz-testcase-minimized-5757031199801344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8b3e580b7f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
a8643da03a avcodec/cfhd: Fix runtime error: signed integer overflow: 65280 * 65288 cannot be represented in type 'int'
Fixes: 1925/clusterfuzz-testcase-minimized-5564569688735744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cd6f319a74)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
fe2a92cfd4 avcodec/wavpack: Fix runtime error: signed integer overflow: 2013265955 - -134217694 cannot be represented in type 'int'
Fixes: 1922/clusterfuzz-testcase-minimized-5561194112876544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a47273c803)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
1d6983c899 avcodec/cinepak: Check input packet size before frame reallocation
Reduces time spend decoding 1917/clusterfuzz-testcase-minimized-5023221273329664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e47057e932)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
64ecc9eda9 avcodec/hevc_ps: Fix runtime error: signed integer overflow: 2147483628 + 256 cannot be represented in type 'int'
Fixes: 1909/clusterfuzz-testcase-minimized-6732072662073344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6726328f79)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
cb14b289bc avcodec/ra144: Fixes runtime error: signed integer overflow: 7160 * 327138 cannot be represented in type 'int'
Fixes: 1908/clusterfuzz-testcase-minimized-5392712477966336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 08cb69e870)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
ccc598dbcb avcodec/pnm: Use ff_set_dimensions()
Fixes: OOM
Fixes: 1906/clusterfuzz-testcase-minimized-4599315114754048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a1c0d1d906)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
79a5cac077 avcodec/cavsdec: Fix runtime error: signed integer overflow: 59 + 2147483600 cannot be represented in type 'int'
Fixes: 1903/clusterfuzz-testcase-minimized-5359318167715840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 58f8cd4ac5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
5415c88e37 avformat/avidec: Limit formats in gab2 to srt and ass/ssa
This prevents part of one exploit leading to an information leak

Found-by: Emil Lerner and Pavel Cheremushkin
Reported-by: Thierry Foucu <tfoucu@google.com>

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a5d849b149)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:29 +02:00
Michael Niedermayer
625fb08959 avcodec/acelp_pitch_delay: Fix runtime error: value 4.83233e+39 is outside the range of representable values of type 'float'
Fixes: 1902/clusterfuzz-testcase-minimized-4762451407011840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 87bddba43b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
d5f5d21322 avcodec/wavpack: Check float_shift
Fixes: runtime error: shift exponent 40 is too large for 32-bit type 'unsigned int'
Fixes: 1898/clusterfuzz-testcase-minimized-5970744880136192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4020b009d1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
b424fde5de avcodec/wavpack: Fix runtime error: signed integer overflow: 24 * -2147483648 cannot be represented in type 'int'
Fixes: 1894/clusterfuzz-testcase-minimized-4716739789062144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d90c5bf105)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
df7f051f4d avcodec/ansi: Fix frame memleak
Fixes: 1892/clusterfuzz-testcase-minimized-4519341733183488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e091b9b3c7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
9f8da7e2aa avcodec/dds: Fix runtime error: left shift of 145 by 24 places cannot be represented in type 'int'
Fixes: 1891/clusterfuzz-testcase-minimized-6274417925554176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c49fa2a514)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
1d4199e023 avcodec/jpeg2000dec: Use ff_set_dimensions()
Fixes: OOM
Fixes: 1890/clusterfuzz-testcase-minimized-6329019509243904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f3da6fbff8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
ba925988ef avcodec/truemotion2: Fix passing null pointer to memset()
Fixes part of: 1888/clusterfuzz-testcase-minimized-5237704826552320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c901627918)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
362a98eea9 avcodec/truemotion2: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes part of: 1888/clusterfuzz-testcase-minimized-5237704826552320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c9e884f3d9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
5b6d056da8 avcodec/ra144: Fix runtime error: signed integer overflow: -2449 * 1398101 cannot be represented in type 'int'
Fixes: 1885/clusterfuzz-testcase-minimized-5336328549957632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7c845450d2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
efe4dbb6e6 avcodec/ra144: Fix runtime error: signed integer overflow: 11184810 * 404 cannot be represented in type 'int'
Fixes: 1884/clusterfuzz-testcase-minimized-4637425835966464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4c472c5252)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
1b048028a7 avcodec/aac_defines: Add missing () to AAC_HALF_SUM() macro
Fixes: runtime error: shift exponent 1073741848 is too large for 32-bit type 'INTFLOAT' (aka 'int')
Fixes: 1880/clusterfuzz-testcase-minimized-4900645322620928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 872bac8159)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
66c9e5e3eb avcodec/webp: Fixes null pointer dereference
Fixes: 1470/clusterfuzz-testcase-minimized-5404421666111488
Fixes: 1472/clusterfuzz-testcase-minimized-5677426430443520
Fixes: 1875/clusterfuzz-testcase-minimized-5536474562822144

Approved-by: BBB

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 67020711b7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
a871e42e30 avcodec/aacdec_fixed: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 1878/clusterfuzz-testcase-minimized-6441918630199296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6b9cb5d26a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
b08f7e592f avcodec/ylc: Check count in build_vlc()
Fixes: runtime error: signed integer overflow: 211633430 + 2147483647 cannot be represented in type 'int'
Fixes: 1874/clusterfuzz-testcase-minimized-5037763613163520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 67b30decf7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
2b220944e9 avcodec/snow: Fix runtime error: signed integer overflow: 1086573993 + 1086573994 cannot be represented in type 'int'
Fixes: 1871/clusterfuzz-testcase-minimized-5719950331215872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b9c032ebc0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
ee202d98ce avcodec/jpeg2000: Fix runtime error: signed integer overflow: 4185 + 2147483394 cannot be represented in type 'int'
Fixes: 1870/clusterfuzz-testcase-minimized-4686788029317120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 781f88bb26)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
f720b43615 avcodec/jpeg2000dec: Check tile offsets more completely
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9c1812491f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
f5839a7826 avcodec/sheervideo: Check input buffer size before allocating and decoding
Fixes: Timeout
Fixes: 1858/clusterfuzz-testcase-minimized-6450473802399744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d8030c14bd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
b1da01c051 avcodec/aacdec_fixed: Fix multiple runtime error: shift exponent 127 is too large for 32-bit type 'int'
Fixes: 1851/clusterfuzz-testcase-minimized-5692607495667712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6c3a63fc3d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
7108189a54 avcodec/wnv1: More strict buffer size check
This requires at least 25% of a picture to allocate and decode it

Fixes: Timeout
Fixes: 1845/clusterfuzz-testcase-minimized-5075974343360512

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7f50c25124)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
e18bd51596 avcodec/libfdk-aacdec: Correct buffer_size parameter
the timeDataSize argument to aacDecoder_DecodeFrame() seems undocumented and until
2016 04 (203e3f28fbebec7011342017fafc2a0bda0ce530) unused.
after that commit libfdk-aacdec interprets it as size in sample units and memsets that on error.
FFmpeg as well as others (like GStreamer) did interpret it as size in bytes

Fixes: 1442/clusterfuzz-testcase-minimized-4540199973421056 (This requires recent libfdk to reproduce)

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ca6776a993)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
e7776cedf5 avcodec/sbrdsp_template: Fix: runtime error: signed integer overflow: 849815297 + 1315389781 cannot be represented in type 'int'
Fixes: 1770/clusterfuzz-testcase-minimized-5285511235108864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7c36ee216f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
6eb1a6f48b avcodec/ivi_dsp: Fix runtime error: left shift of negative value -2
Fixes: 1839/clusterfuzz-testcase-minimized-6238490993885184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 357f2316a0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Kevin Mark
706bbb22b1 doc/filters: Clarify scale2ref example
Signed-off-by: Kevin Mark <kmark937@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 114e871621)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
1e74ee34f9 avcodec/mlpdec: Do not leave invalid values in matrix_out_ch[] on error
Fixes: runtime error: index 12 out of bounds for type 'uint8_t [8]'
Fixes: 1832/clusterfuzz-testcase-minimized-6574546079449088

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ac8dfcbd89)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
288eb8b17e avcodec/ra144dec: Fix runtime error: left shift of negative value -17
Fixes: 1830/clusterfuzz-testcase-minimized-5828293733384192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 53c0c637d3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:28 +02:00
Michael Niedermayer
9b27474cdf avformat/mux: Fix copy an paste typo
Found-by: Roger Scott <rscott@grammatech.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1a36354698)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
af71771a6c avutil/internal: Do not enable CHECKED with DEBUG
This avoids potential undefined behavior in debug mode while still allowing
developers which want to check for potential additional overflows to do so
by manually enabling this.

Reviewed-by: wm4
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a44b3abb4c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
7072201271 avcodec/aacdec_fixed: Fix runtime error: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
Fixes: 1825/clusterfuzz-testcase-minimized-6002833050566656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8e87d146d7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
c419022789 avcodec/smc: Check remaining input
Fixes: Timeout
Fixes: 1818/clusterfuzz-testcase-minimized-5039166473633792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 356194fcb1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
8cbe7461b3 avcodec/diracdec: Fix off by 1 error in quant check
Fixes: out of array read
Fixes: 1781/clusterfuzz-testcase-minimized-4617176877105152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b946bd8ef2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
fdba18c068 avcodec/jpeg2000dec: Fix copy and paste error
Found-by: jamrial
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5782e0ba8c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
6b1a01f3ec avcodec/jpeg2000dec: Check tile offsets
Fixes: runtime error: signed integer overflow: 4096 - -2147483648 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 89325417e7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Max Justicz
66aa3c61fe avcodec/sanm: Fix uninitialized reference frames
Fixes: poc.snm

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ca616b0f72)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
8d7ccdf873 avcodec/jpeglsdec: Check get_bits_left() before decoding a picture
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4bc3008d04)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
3b0f0dab4a avcodec/ivi_dsp: Fix multiple runtime error: left shift of negative value -71
Fixes: 1734/clusterfuzz-testcase-minimized-5385630815092736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8fb00b3e85)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
a7f35b7f35 avcodec/mjpegdec: Fix runtime error: signed integer overflow: -32767 * 130560 cannot be represented in type 'int'
Fixes: 1724/clusterfuzz-testcase-minimized-4842395432648704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 40fa6a2fa2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
43db1288dd avcodec/aacdec_fixed: Fix runtime error: shift exponent 34 is too large for 32-bit type 'int'
Fixes: 1721/clusterfuzz-testcase-minimized-4719352135811072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b5228e44c7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
510f968849 avcodec/mpeg4videodec: Check for multiple VOL headers
Fixes multiple: runtime error: signed integer overflow: 2147115008 + 413696 cannot be represented in type 'int'
Fixes: 1723/clusterfuzz-testcase-minimized-5309409372667904
Fixes: 1727/clusterfuzz-testcase-minimized-5900685306494976
Fixes: 1737/clusterfuzz-testcase-minimized-5922321338466304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit efeb47fd5d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
eed9fc2f61 avcodec/vmnc: Check location before use
Fixes: runtime error: signed integer overflow: 65535 * 64256 cannot be represented in type 'int'
Fixes: 1717/clusterfuzz-testcase-minimized-5491696676634624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ec2b76aab4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
228b1e3f40 avcodec/takdec: Fix runtime error: signed integer overflow: 8192 * 524308 cannot be represented in type 'int'
Fixes: 1630/clusterfuzz-testcase-minimized-6326111917047808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 955db41192)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
bc95cd1480 avcodec/aac_defines: Fix: runtime error: left shift of negative value -2
Fixes: 1716/clusterfuzz-testcase-minimized-4691012196761600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c3547dcbc3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
20363bef60 avcodec/takdec: Fix runtime error: left shift of negative value -63
Fixes: 1713/clusterfuzz-testcase-minimized-5791887476654080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d66193252b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
e1e7b75cbf avcodec/mlpdsp: Fix runtime error: signed integer overflow: -24419392 * 128 cannot be represented in type 'int'
Fixes: 1711/clusterfuzz-testcase-minimized-5248503515185152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1d04fc94e1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
90ff230fd1 avcodec/sbrdsp_fixed: fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: part of 1709/clusterfuzz-testcase-minimized-4513580554649600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 384508b2ff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
f5212833b2 avcodec/aacsbr_fixed: Fix multiple runtime error: shift exponent 170 is too large for 32-bit type 'int'
Fixes part of 1709/clusterfuzz-testcase-minimized-4513580554649600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6310fc714d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
1d52ed4da8 avcodec/mlpdec: Do not leave a invalid num_primitive_matrices in the context
Fixes: runtime error: index 8 out of bounds for type 'uint8_t [8]'
Fixes: 1699/clusterfuzz-testcase-minimized-6327177438035968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 64ea4d102a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
0ff8f9b8e0 avcodec/aacsbr_fixed: Fix multiple runtime error: shift exponent 150 is too large for 32-bit type 'int'
Fixes: 1681/clusterfuzz-testcase-minimized-5970545365483520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3fb104f447)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
bc133fe409 avcodec/mimic: Use ff_set_dimensions() to set the dimensions
Fixes: OOM
Fixes: 1671/clusterfuzz-testcase-minimized-4759078033162240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e434840fd4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
4f40dac0af avcodec/fic: Fix multiple runtime error: signed integer overflow: 5793 * 419752 cannot be represented in type 'int'
Fixes: 1669/clusterfuzz-testcase-minimized-5287529198649344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a173f484b5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
6ee9d6e32f avcodec/mlpdec: Fix: runtime error: left shift of negative value -8
Fixes: 1658/clusterfuzz-testcase-minimized-4889937130291200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 25c81e4b73)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
70247373a1 avcodec/dfa: Fix: runtime error: signed integer overflow: -14202 * 196877 cannot be represented in type 'int'
Fixes: 1657/clusterfuzz-testcase-minimized-4710000079405056

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 58ac7fb9c3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
dd01941b9a avcodec/aacdec: Fix runtime error: signed integer overflow: 2147483520 + 255 cannot be represented in type 'int'
Fixes: 1656/clusterfuzz-testcase-minimized-5900404925661184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 94d05ff159)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
f66f1c5232 avcodec/aacdec_template: Fix fixed point scale in decode_cce()
Fixes: runtime error: shift exponent 1073741824 is too large for 32-bit type 'int'
Fixes: 1654/clusterfuzz-testcase-minimized-5151903795118080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 53a502206a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:27 +02:00
Michael Niedermayer
3814f965aa avcodec/flicvideo: Check frame_size before decrementing
Fixes: runtime error: signed integer overflow: -2147483627 - 22 cannot be represented in type 'int'
Fixes: 1637/clusterfuzz-testcase-minimized-5376582493405184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 355e27e24d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:26 +02:00
Michael Niedermayer
e74ec43293 avcodec/mlpdec: Fix runtime error: left shift of negative value -1
Fixes: 1636/clusterfuzz-testcase-minimized-5310494757879808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 552adf1dd3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:26 +02:00
Michael Niedermayer
b4bb262b48 avcodec/takdec: Fix runtime error: left shift of negative value -42
Fixes: 1635/clusterfuzz-testcase-minimized-4992749856096256

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 99c4c76cfb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:26 +02:00
Michael Niedermayer
a9bb748cee avcodec/hq_hqa: Fix: runtime error: signed integer overflow: -255 * 10180917 cannot be represented in type 'int'
Fixes: 1626/clusterfuzz-testcase-minimized-6416580571299840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3d9cb583c8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-06-16 01:05:26 +02:00
Timo Rothenpieler
1f76235dd4 avcodec/nvenc: remove unnecessary alignment
Fixes #6260
2017-05-23 11:59:21 +02:00
Aaron Levinson
7793fc5b33 avutil/hwcontext_dxva2: Don't improperly free IDirect3DSurface9 objects
Add dxva2_pool_release_dummy() and use it in call to
av_buffer_create() in dxva2_pool_alloc().

Prior to this change, av_buffer_create() was called with NULL for the
third argument, which indicates that av_buffer_default_free() should
be used to free the buffer's data.  Eventually, it gets to
buffer_pool_free() and calls buf->free() on a surface object (which is
av_buffer_default_free()).

This can result in a crash when the debug version of the C-runtime is
used on Windows.  While it doesn't appear to result in a crash when
the release version of the C-runtime is used on Windows, it likely
results in memory corruption, since av_free() is being called on
memory that was allocated using
IDirectXVideoAccelerationService::CreateSurface().

Signed-off-by: Aaron Levinson <alevinsn@aracnet.com>
Reviewed-by: wm4 <nfxjfg@googlemail.com>
Reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Reviewed-by: Mark Thompson <sw@jkqxz.net>
(cherry picked from commit 0c1c514643)
2017-05-16 22:03:21 +01:00
James Almer
e958bfac8b avcodec/hevc_sei: fix amount of bits skipped when reading picture timing SEI message
The code was skipping the entire reported SEI message size regardless of
the amount of bits read.
While in theory safe for NALU where the picture timing SEI message is alone
or at the end as we're using the checked bitstream reader, it isn't in any
other situation, where every SEI message in the NALU after the picture
timing one would potentially fail to parse.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit f738140807)

Conflicts:
	libavcodec/hevc_sei.c
2017-05-16 14:09:01 -03:00
James Almer
d4241affd8 avcodec/aac_adtstoasc: fix ASC passthrough on small frames
ASC frames smaller than AAC_ADTS_HEADER_SIZE were being discarded.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 0f05f2c7e6)
2017-05-16 11:58:23 -03:00
Gregory J. Wolfe
5d737a3d0c avformat/tests/fifo_muxer: includes libavformat/network.h to define ETIMEDOUT for fate build.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9c041a3cd5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-16 04:00:30 +02:00
Michael Niedermayer
f61c888743 Update for FFmpeg 3.2.5
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-16 03:34:43 +02:00
Michael Niedermayer
1274e92015 avcodec/truemotion1: Fix multiple runtime error: signed integer overflow: 1246906962 * 2 cannot be represented in type 'int'
Fixes: 1616/clusterfuzz-testcase-minimized-5119196578971648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5ea6bc2a166edac37042f2bbc28eb603a0fbeccb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-16 03:30:40 +02:00
Michael Niedermayer
8e6d9d48a0 avcodec/svq3: Fix runtime error: left shift of negative value -6
Fixes: 1604/clusterfuzz-testcase-minimized-5312060206350336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a6eb006ad4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-16 02:24:34 +02:00
Michael Niedermayer
c521f9a5cd avcodec/tiff: reset sampling[] if its invalid
Fixes divission by 0
Fixes: clusterfuzz-testcase-minimized-5592896440893440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f08122fbe0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-16 02:24:01 +02:00
Michael Niedermayer
826515083a avcodec/aacps: Fix undefined behavior
Fixes: 1337/clusterfuzz-testcase-minimized-5212314171080704

Fixes the existence of a potentially invalid pointer intermediate

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 527f89e059)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 17:52:43 +02:00
Michael Niedermayer
0f5cb5c111 avcodec/opus_silk: Fix integer overflow and out of array read
Fixes: 1362/clusterfuzz-testcase-minimized-6097275002552320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4654baff12)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 17:52:03 +02:00
Michael Niedermayer
6131115d27 avcodec/flacdec: Return error code instead of 0 for failures
Fixes: infinite loop
Fixes: 1418/clusterfuzz-testcase-minimized-5934472438480896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3f5a68533d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 17:50:21 +02:00
Michael Niedermayer
3078fc9de7 avcodec/snowdec: Check width
Fixes: out of array read
Fixes: 1419/clusterfuzz-testcase-minimized-6108700873850880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 78aa93807b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 17:49:03 +02:00
Michael Niedermayer
5d7b87af7e avcodec/webp: Update canvas size in vp8_lossy_decode_frame() as in vp8_lossless_decode_frame()
Fixes: 1407/clusterfuzz-testcase-minimized-6044604124102656
Fixes: 1420/clusterfuzz-testcase-minimized-6059927359455232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 72810d20b7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 17:48:29 +02:00
Michael Niedermayer
2384c67d06 avcodec/webp: Factor update_canvas_size() out
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c4f63b78b7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 17:34:17 +02:00
Michael Niedermayer
d835d6cd08 avcodec/cllc: Check prefix
Fixes: runtime error: left shift of 1610706944 by 1 places cannot be represented in type 'int'
Fixes: 1421/clusterfuzz-testcase-minimized-6239947507892224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 62c5949bec)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 17:32:51 +02:00
Michael Niedermayer
3c428a5ff7 avcodec/rscc: Check pixel_size for overflow
Fixes: 1509/clusterfuzz-testcase-minimized-5129419876204544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 934572c5c3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 17:28:25 +02:00
Michael Niedermayer
9b76264241 avcodec/dds: Fix runtime error: left shift of 210 by 24 places cannot be represented in type 'int'
Fixes: 1510/clusterfuzz-testcase-minimized-5826231746428928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit afb4632cc3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 17:27:52 +02:00
Michael Niedermayer
36847fd7f1 avcodec/mpeg4videodec: Clear sprite wraping on unsupported cases in VOP decode
Fixes: Integer overflow
Fixes: 1572/clusterfuzz-testcase-minimized-4578773729017856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 467677769a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 17:24:57 +02:00
Michael Niedermayer
322077091c avcodec/ac3dec: Fix: runtime error: index -1 out of bounds for type 'INTFLOAT [2]'
It seems dual mono with a LFE channel is not forbidden

Fixes: 1570/clusterfuzz-testcase-minimized-6455337349545984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c55e637072)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 15:31:43 +02:00
Michael Niedermayer
d736890eed avcodec/hqxdsp: Fix runtime error: signed integer overflow: -196264 * 11585 cannot be represented in type 'int'
Fixes: 1568/clusterfuzz-testcase-minimized-5944868608147456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b923213276)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 15:31:26 +02:00
Michael Niedermayer
08a4305128 avcodec/g723_1dec: Fix LCG type
Fixes: 1567/clusterfuzz-testcase-minimized-5693653555085312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f2c539d350)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 15:31:17 +02:00
Michael Niedermayer
45a0a449bd libswscale/tests/swscale: Fix uninitialized variables
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7796f29065)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
82bcbad1fd avcodec/ffv1dec: Fix runtime error: signed integer overflow: 1550964438 + 1550964438 cannot be represented in type 'int'
Fixes: 1559/clusterfuzz-testcase-minimized-5048096079740928
Fixes: 1560/clusterfuzz-testcase-minimized-6011037813833728

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8630b2cd36)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
79bfa4a663 avcodec/webp: Fix signedness in prefix_code check
Fixes: out of array read
Fixes: 1557/clusterfuzz-testcase-minimized-6535013757616128

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8c5cd1c9d3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
ea57abac8d avcodec/svq3: Fix runtime error: signed integer overflow: 169 * 12717677 cannot be represented in type 'int'
Fixes: 1556/clusterfuzz-testcase-minimized-5027865978470400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 86b1b0d33d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
2366285207 avcodec/mlpdec: Check that there is enough data for headers
Fixes: out of array access
Fixes: 1541/clusterfuzz-testcase-minimized-6403410590957568

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e3e51f8c14)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
85d5f5502c avcodec/ac3dec: Keep track of band structure
It is needed in some corner cases that seem not to be forbidden
Fixes: out of array index
Fixes: 1538/clusterfuzz-testcase-minimized-4696904925446144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9351a156de)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
7ed2d4dcb7 avcodec/webp: Add missing input padding
Fixes: 1536/clusterfuzz-testcase-minimized-5973925404082176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a3508cc3fe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
95ccad6758 avcodec/aacdec_fixed: Fix runtime error: left shift of negative value -1
Fixes: 1535/clusterfuzz-testcase-minimized-5826695535788032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 26227d9186)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
4d47113c66 avcodec/aacsbr_template: Do not change bs_num_env before its checked
Fixes: 1489/clusterfuzz-testcase-minimized-5075102901207040
Fixes: out of array access

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 87b08ee6d2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
39a24c1fa8 avcodec/mlp: Fix multiple runtime error: left shift of negative value -1
Fixes: 1512/clusterfuzz-testcase-minimized-4713846423945216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 74dc728a2c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
5983ae55ec avcodec/vp8dsp: vp7_luma_dc_wht_c: Fix multiple runtime error: signed integer overflow: -1366381240 + -1262413604 cannot be represented in type 'int'
Fixes: 1440/clusterfuzz-testcase-minimized-5785716111966208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ccce2248bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
9c6577035e avcodec/avcodec: Limit the number of side data elements per packet
Fixes: 1293/clusterfuzz-testcase-minimized-6054752074858496

See: [FFmpeg-devel] [PATCH] avcodec/avcodec: Limit the number of side data elements per packet

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d5711cb891)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
7d37865af0 avcodec/texturedsp: Fix runtime error: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 1505/clusterfuzz-testcase-minimized-4561688818876416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f225003d17)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
bec98cd8bd avcodec/g723_1dec: Fix runtime error: left shift of negative value -1
Fixes: 1504/clusterfuzz-testcase-minimized-6249212138225664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c4c0245686)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
2964778d7e avcodec/wmv2dsp: Fix runtime error: signed integer overflow: 181 * -17047030 cannot be represented in type 'int'
Fixes: 1503/clusterfuzz-testcase-minimized-5369271855087616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit df640dbbc9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
a1a7dd4da0 avcodec/diracdec: Fix Assertion frame->buf[0] failed at libavcodec/decode.c:610
Fixes: 1487/clusterfuzz-testcase-minimized-6288036495097856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6899e6e560)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
54eaad7c6e avcodec/msmpeg4dec: Check for cbpy VLC errors
Fixes: runtime error: left shift of negative value -1
Fixes: 1480/clusterfuzz-testcase-minimized-5188321007370240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 15e892aad1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
af52a28f4d avcodec/cllc: Check num_bits
Fixes: runtime error: shift exponent -2 is negative
Fixes: 1479/clusterfuzz-testcase-minimized-6638493360979968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2bfd0a9758)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
0a75880b64 avcodec/cllc: Factor VLC_BITS/DEPTH out, do not use repeated literal numbers
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e717fa1f0a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
b83e839f1e avcodec/dvbsubdec: Check entry_id
Fixes: randomly writing over the array end
Fixes: 1473/clusterfuzz-testcase-minimized-5768907824562176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8a69f2602f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
b36be353b8 avcodec/aacdec_fixed: Fix multiple shift exponent 33 is too large for 32-bit type 'int'
Fixes: 1471/clusterfuzz-testcase-minimized-6376460543590400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3a0ff78168)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
8bdef54c19 avcodec/mpeg12dec: Fixes runtime error: division by zero
Fixes: 1464/clusterfuzz-testcase-minimized-4925445571084288

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c0ece1f4ad)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
869e8b1d0f avcodec/webp: Always set pix_fmt
Fixes: out of array access
Fixes: 1434/clusterfuzz-testcase-minimized-6314998085189632
Fixes: 1435/clusterfuzz-testcase-minimized-6483783723253760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6b5d3fb26f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
fa3bbd77c1 avfilter/vf_uspp: Fix currently unused input frame dimensions
Found-by: Nicolas
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 942036e97c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
89a2384828 avcodec/truemotion1: Fix multiple runtime error: left shift of negative value -1
Fixes: 1446/clusterfuzz-testcase-minimized-5577409124368384

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit db5fae3229)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
d757c9428c avcodec/eatqi: Fix runtime error: signed integer overflow: 4466147 * 1075 cannot be represented in type 'int'
Fixes: 1443/clusterfuzz-testcase-minimized-4826998612426752

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a8de60ba27)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
d6c2b08e73 avcodec/dss_sp: Fix runtime error: signed integer overflow: 2147481189 + 4096 cannot be represented in type 'int'
Fixes: 1441/clusterfuzz-testcase-minimized-6223152357048320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6ea4287893)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
李赞
a4fb44723d avformat/wavdec: Check chunk_size
Fixes integer overflow and out of array access

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3d23219637)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
25a592e5d4 avcodec/cavs: Check updated MV
Fixes: runtime error: signed integer overflow: 251 + 2147483647 cannot be represented in type 'int'
Fixes: 1438/clusterfuzz-testcase-minimized-4917542646710272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5871adc90f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
3c8e14482e avcodec/y41pdec: Fix width in input buffer size check
Fixes: out of array read
Fixes: 1437/clusterfuzz-testcase-minimized-4569970002362368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3d8d372947)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
dcc5cdbdbb avcodec/svq3: Fix multiple runtime error: signed integer overflow: -237341 * 24552 cannot be represented in type 'int'
Fixes: 1429/clusterfuzz-testcase-minimized-5959951610544128

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ae6fd1790f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
f01e5156df avcodec/texturedsp: Fix runtime error: left shift of 218 by 24 places cannot be represented in type 'int'
Fixes: 1428/clusterfuzz-testcase-minimized-5263281793007616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2bd8eb05d2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
d47a3f3f9d avcodec/lagarith: Check scale_factor
Fixes: 1425/clusterfuzz-testcase-minimized-6295712339853312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ed3c9b5b0d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
7810d341d3 avcodec/lagarith: Fix runtime error: left shift of negative value -1
Fixes: 1424/clusterfuzz-testcase-minimized-6088327159611392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ddb2dd7edb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
477020fdf1 avcodec/takdec: Fix multiple runtime error: left shift of negative value -1
Fixes: 1423/clusterfuzz-testcase-minimized-5063889899225088

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c5d2fa2fdf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
ebbf9e1eb8 avcodec/indeo2: Check for invalid VLCs
Fixes: timeout
Fixes: 1416/clusterfuzz-testcase-minimized-5536862435278848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 159fb8ff7e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
1219924dbe avcodec/g723_1dec: Fix several integer related cases of undefined behaviour
Fixes: 1412/clusterfuzz-testcase-minimized-6561308772139008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d3088e0fd8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
350f7f0bdf avcodec/htmlsubtitles: Check for string truncation and return error
Fixes out of array access
Fixes: 1354/clusterfuzz-testcase-minimized-5520132195483648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f4ae3cce64)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
f47b687067 avcodec/bmvvideo: Fix runtime error: left shift of 137 by 24 places cannot be represented in type 'int'
Fixes: 1411/clusterfuzz-testcase-minimized-5776085184675840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 29692023b2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
14da95af46 avcodec/dss_sp: Fix multiple runtime error: signed integer overflow: -15699 * -164039 cannot be represented in type 'int'
Fixed: 1409/clusterfuzz-testcase-minimized-5237365020819456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ea59ef0c03)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
afa243bdf0 avcodec/dvbsubdec: check region dimensions
Fixes: 1408/clusterfuzz-testcase-minimized-6529985844084736
Fixes: integer overflow

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0075d9eced)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
05efc2bab7 avcodec/vp8dsp: Fixes: runtime error: signed integer overflow: 1330143360 - -1023040530 cannot be represented in type 'int'
Fixes: 1406/clusterfuzz-testcase-minimized-5064865125236736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8824b7370a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
f06fae660b avcodec/hqxdsp: Fix multiple runtime error: signed integer overflow: 248220 * 21407 cannot be represented in type 'int' in idct_col()
Fixes: 1405/clusterfuzz-testcase-minimized-5011491835084800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5d5118f81b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
862b16aabf avcodec/cavsdec: Check sym_factor
Fixes: runtime error: signed integer overflow: 25984 * 130560 cannot be represented in type 'int'

Fixes: 1404/clusterfuzz-testcase-minimized-5000441286885376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 279420b5a6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
7f3a671ece avcodec/cdxl: Check format for BGR24
Fixes: out of array access
Fixes: 1427/clusterfuzz-testcase-minimized-5020737339392000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1e42736b95)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
4aea3cd974 avcodec/ffv1dec: Fix copying planes of paletted formats
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3a4d387195)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
ed06434bff avcodec/wmv2dsp: Fix runtime error: signed integer overflow: 181 * -12156865 cannot be represented in type 'int'
Fixes: 1401/clusterfuzz-testcase-minimized-6526248148795392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8b1f66cf5c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
85c8c0c826 avcodec/xwddec: Check bpp more completely
Fixes out of array access
Fixes: 1399/clusterfuzz-testcase-minimized-4866094172995584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 441026fcb1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
332a9cbbf7 avcodec/aacdec_template: Do not decode 2nd PCE if it will lead to failure
Fixes: out of array read
Fixes: 1072/clusterfuzz-testcase-6456688074817536
Fixes: 1398/clusterfuzz-testcase-minimized-4576913622302720

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a5e0dbf530)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
36dd76ef14 avcodec/s302m: Fix left shift of 8 by 28 places cannot be represented in type 'int'
Fixes: 1395/clusterfuzz-testcase-minimized-5330939741732864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a38e9797cb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:16 +02:00
Michael Niedermayer
e9a8242b96 avcodec/eamad: Fix runtime error: signed integer overflow: 49674 * 49858 cannot be represented in type 'int'
Fixes: 1394/clusterfuzz-testcase-minimized-6493376885030912

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ac1c87194)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
408b4fb430 avcodec/g726: Fix runtime error: left shift of negative value -2
Fixes: 1393/clusterfuzz-testcase-minimized-5948366791901184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c04aa14882)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
fe09596f49 avcodec/ra144: Fix runtime error: left shift of negative value -798
Fixes: 1388/clusterfuzz-testcase-minimized-6680800936329216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 78bf446852)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
8d17000794 avcodec/mss34dsp: Fix multiple signed integer overflow
Fixes: 1387/clusterfuzz-testcase-minimized-4802757766676480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 464c4b86ee)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
5c81cf8225 avcodec/targa_y216dec: Fix width type
Fixes out of array access
Fixes: 1376/clusterfuzz-testcase-minimized-6361794975105024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3e56db8926)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
a7ca51b273 avcodec/texturedsp: Fix multiple runtime error: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 1386/clusterfuzz-testcase-minimized-5323086394032128

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e92fb2bea1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
1514e432f9 avcodec/ivi_dsp: Fix multiple left shift of negative value -2
Fixes: 1385/clusterfuzz-testcase-minimized-5552882663292928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9e88cc94e5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
a3e3d72d12 avcodec/svq3: Fix multiple runtime error: signed integer overflow: 44161 * 61694 cannot be represented in type 'int'
Fixes: 1382/clusterfuzz-testcase-minimized-6013445293998080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 669419939c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
89e26447fa avcodec/msmpeg4dec: Correct table depth
Fixes undefined shift
Fixes: 1381/clusterfuzz-testcase-minimized-5513944540119040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1121d92707)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
207f2874c0 avcodec/dds: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 1380/clusterfuzz-testcase-minimized-650122545122508

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8a8335de03)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
7a69c1b2ab avcodec/cdxl: Check format parameter
Fixes out of array access
Fixes: 1378/clusterfuzz-testcase-minimized-5715088008806400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e1b60aad77)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
1bb1d2d4a1 avutil/softfloat: Fix overflow in av_div_sf()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 277e397eb5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
f20c485e4e avcodec/hq_hqa: Fix runtime error: left shift of negative value -207
Fixes: 1375/clusterfuzz-testcase-minimized-6070134701555712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1283c42447)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
db83541205 avcodec/mss3: Change types in rac_get_model_sym() to match the types they are initialized from
Fixes integer overflow
Fixes: 1372/clusterfuzz-testcase-minimized-5712192982745088

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2ef0f39271)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
8bf18194ab avcodec/shorten: Check k in get_uint()
Fixes: undefined shift
Fixes: 1371/clusterfuzz-testcase-minimized-5770822591447040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7b6a51f59c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
57e603fd9f avcodec/webp: Fix null pointer dereference
Fixes: 1369/clusterfuzz-testcase-minimized-5048908029886464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9bf4523e40)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
65f3fffbcf avcodec/dfa: Fix signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 1368/clusterfuzz-testcase-minimized-4507293276176384

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 12936a4585)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
37d51c242f avcodec/g723_1: Fix multiple runtime error: left shift of negative value
Fixes: 1367/clusterfuzz-testcase-minimized-571496882346393

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4ace2d2219)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
054a16d375 avcodec/mimic: Fix runtime error: left shift of negative value -1
Fixes: 1365/clusterfuzz-testcase-minimized-5624158450876416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fc2c420b82)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
aa39ca14d6 avcodec/fic: Fix multiple left shift of negative value -15
Fixes: 1356/clusterfuzz-testcase-minimized-6008489086287872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b20c71409b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
4ee1e00f08 avcodec/mlpdec: Fix runtime error: left shift of negative value -22
Fixes: 1355/clusterfuzz-testcase-minimized-6662205472768000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c535436cbe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
2d3da218ce avcodec/snowdec: Check qbias
Fixes: signed integer overflow: -1094995529 * 131 cannot be represented in type 'int'
Fixes: 1353/clusterfuzz-testcase-minimized-5208180449607680

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 523205ce1e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
cff78c4cc4 avutil/softfloat: Fix multiple runtime error: left shift of negative value -8
Fixes: 1352/clusterfuzz-testcase-minimized-5757565017260032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 35f3df0d76)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
2a6cad221b avcodec/aacsbr_template: Do not leave bs_num_env invalid
Fixes out of array read
Fixes: 1349/clusterfuzz-testcase-minimized-5370707196248064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a8ad83b793)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
1f91d66a62 avcodec/mdec: Fix signed integer overflow: 28835400 * 83 cannot be represented in type 'int'
Fixes: 1346/clusterfuzz-testcase-minimized-5776732600664064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a234b5ade3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
536af42121 avcodec/dfa: Fix off by 1 error
Fixes out of array access
Fixes: 1345/clusterfuzz-testcase-minimized-6062963045695488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f52fbf4f3e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
9c7184ae63 avcodec/nellymoser: Fix multiple left shift of negative value -8591
Fixes: 1342/clusterfuzz-testcase-minimized-5490842129137664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0953736b7e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
0f6f163922 avcodec/cdxl: Fix signed integer overflow: 14243456 * 164 cannot be represented in type 'int'
Fixes: 1341/clusterfuzz-testcase-minimized-5441502618583040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1002932a3b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
db8f28fd3f avcodec/g722: Fix multiple runtime error: left shift of negative value -1
Fixes: 1340/clusterfuzz-testcase-minimized-4669892148068352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f55df62998)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
77aa9eddbc avcodec/dss_sp: Fix multiple left shift of negative value -466
Fixes: 1339/clusterfuzz-testcase-minimized-4614671485108224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 38152d9368)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
5fb14cc889 avcodec/wnv1: Fix runtime error: left shift of negative value -1
Fixes: 1338/clusterfuzz-testcase-minimized-6485546354343936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9fac508ca4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
a78cfe84f9 avcodec/tiertexseqv: set the fixed dimenasions, do not depend on the demuxer doing so
Fixes: out of array access
Fixes: 1348/clusterfuzz-testcase-minimized-6195673642827776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce551a3925)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
b0d6bff2f2 avcodec/mjpegdec: Fix runtime error: signed integer overflow: -24543 * 2031616 cannot be represented in type 'int'
Fixes: 943/clusterfuzz-testcase-5114865297391616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a78ae465fd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
231e242ed2 avcodec/cavsdec: Fix undefined behavior from integer overflow
Fixes: 1335/clusterfuzz-testcase-minimized-5566961566089216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a0e5f7f363)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
58b05f8720 avcodec/dvdsubdec: Fix runtime error: left shift of 242 by 24 places cannot be represented in type 'int'
Fixes: 1080/clusterfuzz-testcase-5353236754071552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce7098b8f2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
5aa97eb1a6 libavcodec/mpeg4videodec: Convert sprite_offset to 64bit
This avoids intermediates from overflowing (the final values are checked)
Fixes: runtime error: signed integer overflow: -167712 + -2147352576 cannot be represented in type 'int'

Fixes: 1298/clusterfuzz-testcase-minimized-5955580877340672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c1c3a14073)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
6bdc6bef2a avcodec/pngdec: Use ff_set_dimensions()
Fixes OOM
Fixes: 1314/clusterfuzz-testcase-minimized-4621997222920192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a0296fc056)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
03dee014f4 avcodec/msvideo1: Check buffer size before re-getting the frame
Fixes timeout
Fixes: 1306/clusterfuzz-testcase-minimized-6152296217968640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cabfed6895)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
56f8ab1802 avcodec/h264_cavlc: Fix undefined behavior on qscale overflow
Fixes: 1214/clusterfuzz-testcase-minimized-6130606599569408

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fc8cff96ed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
4674c4594f avcodec/dcadsp: Fix runtime error: signed integer overflow
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9244b839b7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
f66140a1bd avcodec/svq3: Reject dx/dy beyond 16bit
The code does use 16bit sized arrays later so larger deltas would not work

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 48b3117844)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
fa595a94a1 avcodec/svq3: Increase offsets to prevent integer overflows
Fixes: 1280/clusterfuzz-testcase-minimized-6102353767825408

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 382b4fc9b5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
8fee7589d5 avcodec/indeo2: Check remaining bits in ir2_decode_plane()
Fixes: 1290/clusterfuzz-testcase-minimized-5815578902134784
Fixes: timeout

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b29feec982)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
bd2e3b0e90 avcodec/vp3: Check remaining bits in unpack_dct_coeffs()
Decreases the time spend decoding junk.

May fix: 1283/clusterfuzz-testcase-minimized-6221126759874560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2f00300b77)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
9f2b473fa7 doc/developer: Add terse documentation of assumed C implementation defined behavior
Suggested-by: "Ronald S. Bultje" <rsbultje@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b706ddbae3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
50cd472ce6 avcodec/mdec: Fix runtime error: left shift of negative value -127
Fixes undefined behavior
Fixes: 1275/clusterfuzz-testcase-minimized-6718162017976320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6ca82975b7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
8fb0b9ae35 avcodec/x86/vc1dsp_init: Fix build failure with --disable-optimizations and clang
compilers doing DCE at -O0 do not necessarily understand "complex" boolean expressions
Build succeeds with this change, this was the only failure

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fa8fd0808f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Martin Vignali
0ed8bab02f libavcodec/exr : fix float to uint16 conversion for negative float value
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e46d637452)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Derek Buitenhuis
e66548345c avformat/webmdashenc: Validate the 'streams' adaptation sets parameter
It should not be a value larger than the number of streams we have,
or it will cause invalid reads and/or SIGSEGV.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ec07efa700)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Derek Buitenhuis
1485562f6e avformat/webmdashenc: Require the 'adaptation_sets' option to be set
This seems to be non-optional, and if the muxer is run without it,
strlen() is run on NULL, causing a segfault.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cbd3a68f3e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
bb61a31223 avformat/oggparseogm: Check ff_alloc_extradata() for failure
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9eff4b0d2b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
773c55b820 avformat/oggparseogm: Check available data before reading global header
Fixes use of uninitialized data

Found-by: Thomas Guilbert <tguilbert@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 170d864d2c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
502313dd50 avformat/mov: Check creation_time for overflow
Fixes integer overflow
Fixes: 701640

Found-by: Found-by: Thomas Guilbert <tguilbert@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 39ee3ddff8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
0a6598536c avcodec/dvdsubdec: Fixes 2 runtime error: left shift of 170 by 24 places cannot be represented in type 'int'
Fixes: 619/clusterfuzz-testcase-5803914534322176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 61ee2ca775)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
7655f73c45 avcodec/h264: Check weight values to be within the specs limits.
Fixes: integer overflows
Fixes: 911/clusterfuzz-testcase-5415105606975488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 08117a4015)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Thierry Foucu
2d0c589941 libavformat/mov: Fix memory leak, need to free the chapter tracks array
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ac24a8202a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
30f20c0b93 avformat/oggparsedaala: Do not leave an invalid value in gpshift
Fixes: undefined behavior
Fixes: 702974

Found-by: Thomas Guilbert <tguilbert@google.com>
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 23ae3cc822)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
5e8786fc22 avformat/oggparsedaala: Check duration for AV_NOPTS_VALUE
This avoids an integer overflow
the solution matches oggparsevorbis.c and 45581ed15d

Fixes: 700242

Found-by: Thomas Guilbert <tguilbert@google.com>
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 679a315424)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
a17d258e94 avformat/libopenmpt: Check for avio_size() failure
Fixes CID1396850

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bd8201566d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
8ce5038e99 avfilter/af_sofalizer: Fix bad shift
Fixes CID1396835

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4064f3f0df)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
wm4
4ed0177e4a avcodec: fix uninitialized variable read
This cna happen if the user tries to call the new decode API for
subtitles.

Fixes CID 1402071.

(cherry picked from commit b4b8ca24f6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
a99a7bb071 avfilter/avfiltergraph: Add assert to write down in machine readable form what is assumed about sample rates in swap_samplerates_on_filter()
Fixes CID1397292

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f2b360fc0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
4dcceb650d avcodec/tiff: Perform multiply in tiff_unpack_lzma() as 64bit
This should make no difference as the value should not be able to be that large
but its more correct this way

Fixes CID1348138

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f48b6b8b91)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Steven Liu
7129dfdba8 avformat/test/fifo_muxer: add check for FailingMuxerPacketData alloc
CID: 1396257

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit d1f3e475f9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Timothy Gu
efc708afae omx: Fix OOM check
Also use av_mallocz_array().

Fixes CID1396839.

(cherry picked from commit 16a75304fe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Philip Langdale
d4f4fa22d7 avcodec/vdpau_hevc: Fix potential out-of-bounds write
The maximum number of references is 16, so the index value cannot
exceed 15.

Fixes Coverity CID 1348139, 1348140, 1348141

(cherry picked from commit 4e6d1c1f4e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
8ee3f73464 avcodec/h264_ps: Fix runtime error: signed integer overflow: 2147483647 + 26 cannot be represented in type 'int'
Fixes: 902/clusterfuzz-testcase-4561155144024064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4f727fbc73)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
fc863900b7 avcodec/tiff: Check geotag count for being non zero
Fixes memleak
Fixes: 874/clusterfuzz-testcase-5252796175613952

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3182e19c1c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
6f0a892ba0 avcodec/vp56: Check avctx->error_concealment before enabling EC
Fixes timeout with 847/clusterfuzz-testcase-5291877358108672
Fixes timeout with 850/clusterfuzz-testcase-5721296509861888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 98da63b3f5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
a7ccd87090 avcodec/tiff: Check stripsize strippos for overflow
Fixes: 861/clusterfuzz-testcase-5688284384591872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5d996b5649)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
6652799267 avcodec/mpegaudiodec_template: Make l3_unscale() work with e=0
Fixes undefined behavior
Fixes: 830/clusterfuzz-testcase-6253175327686656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8ebed703f1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
6ee76fab4c avcodec/tiff: Check for multiple geo key directories
Fixes memleak
Fixes: 826/clusterfuzz-testcase-5316921379520512

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 108b02e547)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
81ea01fb1c avcodec/wavpack: Fix runtime error: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 822/clusterfuzz-testcase-4873433189974016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7cebc5a9cc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
b0c5fff859 avcodec/rv34: Fix runtime error: signed integer overflow: 36880 * 66288 cannot be represented in type 'int'
Fixes: 768/clusterfuzz-testcase-4807444305805312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a66c6e28b5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
8eadc50021 avcodec/amrwbdec: Fix runtime error: left shift of negative value -1
Fixes: 763/clusterfuzz-testcase-6007567320875008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 44e2105189)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
f03bab0240 avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: -135088512 * 16 cannot be represented in type 'int'
Fixes: 736/clusterfuzz-testcase-5580263943831552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e2a4f1a9eb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
7c349ae7e9 avcodec/h264_mvpred: Fix runtime error: left shift of negative value -1
Fixes: 734/clusterfuzz-testcase-4821293192970240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 222c9f031d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
60385207aa avcodec/mjpegdec: Fix runtime error: left shift of negative value -127
Fixes: 733/clusterfuzz-testcase-4682158096515072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 800d02abe0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
d63cec6ce3 avcodec/wavpack: Fix runtime error: left shift of negative value -5
Fixes: 729/clusterfuzz-testcase-5154831595470848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3016e919d4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
9b783dc492 avcodec/wavpack: Fix runtime error: left shift of negative value -2
Fixes: 723/clusterfuzz-testcase-6471394663596032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ba15005132)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
43919b6e2e avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: 134527392 * 16 cannot be represented in type 'int'
This checks the sprite delta intermediates for overflow
Fixes: 716/clusterfuzz-testcase-4890287480504320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fab13bbbcd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
b31b1499cf avcodec/mpeg12dec: Fix runtime error: left shift of negative value -13
Fixes: 709/clusterfuzz-testcase-4789836449841152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d757ddbaab)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
87ae545648 avcodec/h264_mvpred: Fix multiple runtime error: left shift of negative value
Fixes: 710/clusterfuzz-testcase-5091051431788544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ab998f4c7f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
0cabddc13b avcodec/adxdec: Fix runtime error: left shift of negative value -1
Fixes: 705/clusterfuzz-testcase-5129572590813184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d23727e042)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
4071e7eaab avcodec/mpeg4videodec: Improve the overflow checks in mpeg4_decode_sprite_trajectory()
Also clear the state on errors

Fixes integer overflows in 701/clusterfuzz-testcase-6594719951880192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eb41956636)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
fe4b666707 avcodec/mjpegdec: Fix runtime error: left shift of negative value -511
Fixes: 693/clusterfuzz-testcase-6109776066904064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4b72d5cd6f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
a07319a0cc avcodec/h264_direct: Fix runtime error: left shift of negative value -14
Fixes: 682/clusterfuzz-testcase-4799120021651456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4bd3f1ce3e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
4c91e1eb5c avcodec/pictordec: Check plane value before doing value/mask computations
Fixes integer overflow
Fixes: 675/clusterfuzz-testcase-6722971232108544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 63e400a880)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
aa34d29b2e avcodec/mpeg4videodec: Fix runtime error: left shift of negative value -2650
Fixes: 674/clusterfuzz-testcase-6713275880308736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 25e93aacc2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
5d21cfb170 avcodec/eac3dec: Fix runtime error: left shift of negative value -3
Fixes: 672/clusterfuzz-testcase-5595018867769344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 87eb374970)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
842c0b9f59 avcodec/mpeg12dec: Fix runtime error: left shift of negative value -2
671/clusterfuzz-testcase-4990381827555328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aff8cf18cb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
be3852ab9b avcodec/mpeg4videodec: Check the other 3 sprite points for intermediate overflows
This is not necessarily specific to fuzzed files

Fixes: Multiple integer overflows
Fixes: 656/clusterfuzz-testcase-6463814516080640
Fixes: 658/clusterfuzz-testcase-6691260146384896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 76ba09d182)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
025af5ccd1 avcodec/mpeg4videodec: Check sprite_offset in addition to shifts
Fixes: 651/clusterfuzz-testcase-5710668915277824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6871df02d9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
706dd2331a avcodec/mpeg4video: Fix runtime error: left shift of negative value
Fixes: 644/clusterfuzz-testcase-4726434209726464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6179dc8aa7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
0ccc767a15 avcodec/ituh263dec: Fix runtime error: left shift of negative value -22
Fixes: 639/clusterfuzz-testcase-5143866241974272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 631f748491)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
e2b46de961 avcodec/rv40: Fix runtime error: left shift of negative value
Fixes: 630/clusterfuzz-testcase-6608718928019456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 956472a323)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
297b077b49 avcodec/h264_cabac: runtime error: signed integer overflow: 2147483647 + 14 cannot be represented in type 'int'
Fixes: 614/clusterfuzz-testcase-4931860079575040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 258763ad0e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
09dfcb857e avcodec/mpeg4videodec: Fix runtime error: shift exponent -2 is negative
Fixes: 612/clusterfuzz-testcase-4707817137111040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aa2b75263e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
6be28e7545 avcodec/mjpegdec: Fix runtime error: left shift of negative value -507
Fixes: 611/clusterfuzz-testcase-5613455820193792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c91bdd4524)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
762bf27fcc avcodec/eac3dec: Fix runtime error: left shift of negative value
Fixes: 610/clusterfuzz-testcase-4831030085156864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 067485b673)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
8161ebbcc3 avcodec/htmlsubtitles: Fix reading one byte beyond the array
Fixes: fuzz-2-ffmpeg_SUBTITLE_AV_CODEC_ID_SUBRIP_fuzzer

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 04bd1b38ee)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
3e6b3d20b2 avcodec/vp6: clear dimensions on failed resolution change in vp6_parse_header()
Fixes: 807/clusterfuzz-testcase-6470061042696192
Fixes null pointer dereference

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 967feea5eb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
e1ebd54a26 avcodec/vp56: Reset have_undamaged_frame on resolution changes
Fixes: timeout in 758/clusterfuzz-testcase-4720832028868608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6e913f2129)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Thomas Guilbert
c73128381f avcodec/vp8: Fix hang with slice threads
Fixes: 447860.webm

Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9bbc73ae9f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
cc08c44904 avcodec/vp8: Check for the bitstream end per MB in decode_mb_row_no_filter()
Fixes: timeout in 730/clusterfuzz-testcase-5265113739165696 (part 2 of 2)

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: BBB
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1afd246960)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
9e0e1e3d54 avcodec/vp568: Check that there is enough data for ff_vp56_init_range_decoder()
Fixes: timeout in 730/clusterfuzz-testcase-5265113739165696 (part 1 of 2)

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: BBB
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 55d7371fe0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
4770ef8742 avcodec/vp8: remove redundant check
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5098a6f627)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
c098e99d06 avcodec/vp56: Require a correctly decoded frame before using vp56_conceal_mb()
Fixes timeout with 700/clusterfuzz-testcase-5660909504561152
Fixes timeout with 702/clusterfuzz-testcase-4553541576294400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2ce4f28431)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
de43cdb2f5 avcodec/vp3: Do not return random positive values but the buf size
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d8094a303b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
b8b8e4f9eb avcodec/vp8: Check for bitsteam end in decode_mb_row_no_filter()
Fixes timeout with 686/clusterfuzz-testcase-5853946876788736

this shortcuts (i.e. speeds up) the error and
return-to-user when decoding a truncated frame

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Previous version reviewed by: "Ronald S. Bultje" <rsbultje@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

(cherry picked from commit 7b5ff7d573)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
4b1f14dcf5 avcodec/vp56: Factorize vp56_render_mb() out
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4c0139463c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
d7d2a121a3 avcodec/vp3dsp: Fix multiple signed integer overflow: 46341 * 47523 cannot be represented in type 'int'
Fixes: 664/clusterfuzz-testcase-4917047475568640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2b8b7921c5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
bf780cbd99 Add CHECK/SUINT code
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4614bf2caf)
(cherry picked from commit e8d4eacc07)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
3dd0166bde avcodec/mpeg12dec: Fix runtime error: left shift of negative value -1
Fixes: 764/clusterfuzz-testcase-6273034652483584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a720b854b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
11477cdba5 avcodec/vp56: Clear dimensions in case of failure in the middle of a resolution change
Similar code is used elsewhere in vp56 to force a more complete reinit in the future.
Fixes null pointer dereference
Fixes: 707/clusterfuzz-testcase-4717453097566208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4bed066377)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
47c30a60e6 avcodec/vp56: Implement very basic error concealment
This should fix the fate failure due to a truncated last frame.
Alternatively the frame could be dropped.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d34bf886e9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
eaa6ac7ffd avcodec/amrwbdec: Fix 2 runtime errors: left shift of negative value -1
Fixes: 669/clusterfuzz-testcase-4847965409640448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6bd79ba59f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
891f354796 avcodec/pngdec: Fix runtime error: left shift of 152 by 24 places cannot be represented in type 'int'
Fixes: 666/clusterfuzz-testcase-6581447227867136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 310d2af319)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
1e301c21d7 avcodec/vp56: Fix sign typo
Fixes: 664/clusterfuzz-testcase-4917047475568640

The change to fate is due to a truncated last frames which is now detected as damaged.

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 513a349439)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
24a9a51e57 avcodec/mpegaudiodec_template: Correct return code on id3 tag discarding
Fixes: 665/clusterfuzz-testcase-4863789881098240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5d81616be3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
1108c628ba avcodec/rv34: Simplify and factor get_slice_offset() code
This also fixes several integer overflows by checking each value before
use.
Fixes: 662/clusterfuzz-testcase-4898131432964096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8696f25444)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
116120045b avcodec/pictordec: Do not read more than nb_planes
Fixes undefined behavior
Fixes: 622/clusterfuzz-testcase-5745722022428672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 01d196a67d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
ccce40356a avcodec/srtdec: Fix signed integer overflow: 1811992524 * 384 cannot be represented in type 'int'
Fixes: 617/clusterfuzz-testcase-6413875723370496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c11d3634b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
508b8c3569 avcodec/pngdec: Check bit depth for validity
Fixes: runtime error: shift exponent 132 is too large for 32-bit type 'int'
Fixes: 609/clusterfuzz-testcase-4825202619842560

See 11.2.2 IHDR Image header

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4279613a26)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
edb15cce00 avcodec/mpeg12dec: Fix runtime error: left shift of negative value
Fixes: 608/clusterfuzz-testcase-603978286392934

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 706757d26d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
5ee27f48d7 avcodec/wavpacl: Fix runtime error: left shift of negative value -1
Fixes: 607/clusterfuzz-testcase-5108792465293312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 12eebb845a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
758258f567 avformat/http: Check for truncated buffers in http_connect()
Reported-by: SleepProgger <security@gnutp.com>
Reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8fa18e042a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Aaron Levinson
9cf601f87d avformat/utils: free AVStream.codec properly in free_stream()
Fixes memory leaks.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit b9d2005ea5)
2017-05-11 21:18:07 -03:00
James Almer
65add3a818 avcodec/options: do a more thorough clean up in avcodec_copy_context()
Free coded_frame and coded_side_data to prevent potential leaks.

Reviewed-by: Aaron Levinson <alevinsn@aracnet.com>
Tested-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit cac8de2da5)
2017-05-11 21:16:54 -03:00
James Almer
8d9f927078 avcodec/options: factorize avcodec_copy_context() cleanup code
Reviewed-by: Aaron Levinson <alevinsn@aracnet.com>
Tested-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 54a4c9b4e9)
2017-05-11 21:16:28 -03:00
James Almer
49279d4cc2 avformat/concatdec: fix the h264 annexb extradata check
The start code can be either in the first three or four bytes.

(cherry picked from commit b4330a0e02)
2017-05-11 21:12:12 -03:00
Mark Thompson
016064625f hwcontext_vdpau: Fix missing subscripts
Also remove the redundant casts which were hiding the error here.

Fixes Ubuntu bug 1688735, reported by andysem.

(cherry picked from commit 7081620aca)
2017-05-09 14:45:54 +02:00
Carl Eugen Hoyos
582c3d514a lavf/flacdec: Return maximum score if the streaminfo header is valid.
Fixes ticket #6208.

(cherry picked from commit 3733039610)
2017-03-30 01:41:22 +02:00
Paul B Mahol
a60e665162 avcodec/dnxhd_parser: take into account compressed frame size and skip it
Fixes #6214 and vsynth1-dnxhd-720p-hr-lb.

Signed-off-by: Paul B Mahol <onemda@gmail.com>
(cherry picked from commit e1940d2458)
2017-03-24 19:57:36 +01:00
James Almer
33978a49c0 avformat/apng: fix setting frame delay when max_fps is set to no limit
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 874eb012f7)
2017-03-21 20:22:12 -03:00
James Almer
2bf28b9db6 swresample/resample: free existing ResampleContext on reinit
Fixes memleak.

Reviewed-by: wm4 <nfxjfg@googlemail.com>
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit db7a05dab0)
2017-03-21 12:12:09 -03:00
James Almer
2d322bf3e9 swresample/resample: move resample_free() higher in the file
Also make it more readable while at it.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 2a8a8a2e98)
2017-03-21 12:11:57 -03:00
James Almer
36fff6c754 avformat/matroskaenc: don't write DisplayUnit with value Unknown on WebM files
Value 4 (Unknown) is for the time being part of the Matroska spec but not
supported by WebM

Addresses ticket #6176

(cherry picked from commit 1ad60e4e70)
2017-02-21 21:18:07 -03:00
Rostislav Pehlivanov
5546294f63 lavfi/buffersrc: fix directly setting channel layout
When setting the channel layout directly using AVBufferSrcParameters
the channel layout was correctly set however the init function still
expected the old string format to set the number of channels (when it
hadn't already been specified).

Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com>
(cherry picked from commit 42959044ac)
Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com>
2017-02-21 16:40:53 +00:00
Carl Eugen Hoyos
e93e215b36 lavf/mpeg: Initialize a stack variable used by memcmp().
Silence a valgrind warning.

Fixes ticket #6160.
(cherry picked from commit a5c1c7a8b3)
2017-02-21 02:16:13 +01:00
Carl Eugen Hoyos
5c524e651f lavc/avpacket: Initialize a variable in error path.
Fixes ticket #6153.

Tested-by: Tyson Smith
(cherry picked from commit 1d54be2153)
2017-02-17 10:44:56 +01:00
Matt Wolenetz
d4b731e271 lavf/mov.c: Avoid heap allocation wraps in mov_read_{senc,saiz}()
Core of patch is from paul@paulmehta.com
Reference https://crbug.com/643952 (senc,saiz portions)

Signed-off-by: Matt Wolenetz <wolenetz@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 36aba43bd5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-02-10 12:15:17 +01:00
Matt Wolenetz
927e59b74a lavf/mov.c: Avoid OOB in mov_read_udta_string()
Core of patch is from paul@paulmehta.com
Reference https://crbug.com/643952 (udta_string portion)

Signed-off-by: Matt Wolenetz <wolenetz@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9bbdf5d921)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-02-10 12:14:39 +01:00
Michael Niedermayer
cbe65ccfa0 Update for 3.2.4
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-02-08 20:30:18 +01:00
Michael Niedermayer
63637e457c avcodec/h264_slice: Clear ref_counts on redundant slices
Fixes reading freed memory
Fixes: 568/clusterfuzz-testcase-6107186067406848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c03029a835)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-02-08 19:22:05 +01:00
Matt Wolenetz
ed2572b9c8 lavf/mov.c: Avoid heap allocation wrap in mov_read_uuid
Core of patch is from paul@paulmehta.com
Reference https://crbug.com/643951

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Check value reduced as the code does not support values beyond INT_MAX
Also the check is moved to a more common place and before integer truncation

(cherry picked from commit 2d453188c2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-02-08 04:08:48 +01:00
Matt Wolenetz
cf8e004a51 lavf/mov.c: Avoid heap allocation wrap in mov_read_hdlr
Core of patch is from paul@paulmehta.com
Reference https://crbug.com/643950

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Check value reduced as the code does not support larger lengths

(cherry picked from commit fd30e4d57f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-02-08 04:08:25 +01:00
Michael Niedermayer
a1a14982ec avcodec/pictordec: Fix logic error
Fixes: 559/clusterfuzz-testcase-6424225917173760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8c2ea3030a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-02-07 21:33:20 +01:00
Michael Niedermayer
29ef35abff ffserver_config: Setup codecpar in add_codec()
fixes segfault in the status page code

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 472fee91bc)
2017-02-07 13:21:14 +01:00
Michael Niedermayer
1fd78b9b34 Changelog: fix typos
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-02-07 13:21:03 +01:00
Michael Niedermayer
68ed682710 Update for 3.2.3
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-02-06 12:26:47 +01:00
Michael Niedermayer
44ce16b7f9 avcodec/movtextdec: Fix decode_styl() cleanup
Fixes: null pointer dereference
Fixes: 555/clusterfuzz-testcase-5986646595993600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e248522d1b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-02-06 12:11:37 +01:00
Chris Cunningham
d88493c02b lavf/matroskadec: fix is_keyframe for early Blocks
Blocks are marked as key frames whenever the "reference" field is
zero. This breaks for non-keyframe Blocks with a reference timestamp
of zero.

The likelihood of reference timestamp being zero is increased by a
longstanding bug in muxing that encodes reference timestamp as the
absolute time of the referenced frame (rather than relative to the
current Block timestamp, as described in MKV spec).

Now using INT64_MIN to denote "no reference".

Reported to chromium at http://crbug.com/497889 (contains sample)

(cherry picked from commit ac25840ee3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-02-06 11:00:24 +01:00
James Almer
87a47c67a6 configure: bump year
Happy new year!

(cherry picked from commit d800d48fc6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-02-06 10:17:13 +01:00
Michael Niedermayer
7e1d9d25fe avcodec/pngdec: Check trns more completely
Fixes out of array access
Fixes: 546/clusterfuzz-testcase-4809433909559296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e477f09d0b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-02-06 10:17:13 +01:00
Michael Niedermayer
d399f25bd1 avcodec/interplayvideo: Move parameter change check up
Fixes out of array read
Fixes: 544/clusterfuzz-testcase-5936536407244800.f8bd9b24_8ba77916_70c2c7be_3df6a2ea_96cd9f14

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b1e2192007)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-02-06 10:17:13 +01:00
Michael Niedermayer
7323a8ab29 avcodec/dca_lbr: Fix off by 1 error in freq check
Fixes out of array read
Fixes: 510/clusterfuzz-testcase-5737865715646464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 61f70416f8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-02-06 10:17:13 +01:00
Michael Niedermayer
aa20863f44 avcodec/mjpegdec: Check for for the bitstream end in mjpeg_decode_scan_progressive_ac()
Fixes timeout
Fixes: 496/clusterfuzz-testcase-5805083497332736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3782656631)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-02-06 10:17:13 +01:00
Andreas Cadhalpun
83269fd13b pgssubdec: reset rle_data_len/rle_remaining_len on allocation error
The code relies on their validity and otherwise can try to access a NULL
object->rle pointer, causing segmentation faults.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 842e98b4d8)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2017-02-01 02:28:09 +01:00
Andreas Cadhalpun
884cd3caa5 swscale: save ebx register when it is not available
Configure checks if the ebx register can be used for asm and it has to
be saved if and only if this is not the case.
Without this the build fails when configuring with --toolchain=hardened
--disable-pic on i386 using gcc 4.8:
error: PIC register clobbered by '%ebx' in 'asm'

In that case gcc 4.8 reserves the ebx register for the GOT needed for
PIE, so it can't be used in asm directly.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 319438e2f2)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2017-01-26 02:22:09 +01:00
Frank Liberato
cc66247603 avformat/flacdec: Check avio_read result when reading flac block header.
Return AVERROR_INVALIDDATA if all four bytes aren't present.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 95bde49982)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-01-26 00:34:13 +01:00
Michael Niedermayer
dc2d3856f3 avcodec/utils: correct align value for interplay
Fixes out of array access
Fixes: 452/fuzz-1-ffmpeg_VIDEO_AV_CODEC_ID_INTERPLAY_VIDEO_fuzzer

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2080bc3371)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-01-26 00:34:13 +01:00
Michael Niedermayer
dd36b3a06a avcodec/vp56: Check for the bitstream end, pass error codes on
Fixes timeout
Fixes: 446/fuzz-3-ffmpeg_VIDEO_AV_CODEC_ID_VP6_fuzzer

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9e6a242755)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-01-26 00:34:13 +01:00
Michael Niedermayer
14f555683a avcodec/mjpegdec: Check remaining bitstream in ljpeg_decode_yuv_scan()
Fixes timeout
Fixes: 445/fuzz-3-ffmpeg_VIDEO_AV_CODEC_ID_MJPEG_fuzzer
Fixes: 456/fuzz-2-ffmpeg_VIDEO_AV_CODEC_ID_JPEGLS_fuzzer

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 755933cb5c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-01-26 00:34:13 +01:00
Michael Niedermayer
bd6c1d5149 avcodec/pngdec: Fix off by 1 size in decode_zbuf()
Fixes out of array access
Fixes: 444/fuzz-2-ffmpeg_VIDEO_AV_CODEC_ID_PNG_fuzzer

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e371f031b9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-01-26 00:34:12 +01:00
Andreas Cadhalpun
41fc098a86 libopenmpt: add missing avio_read return value check
This fixes heap-buffer-overflows in libopenmpt caused by interpreting
the negative size value as unsigned size_t.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Reviewed-by: Jörn Heusipp <osmanx@problemloesungsmaschine.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 367cac7827)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-01-26 00:34:12 +01:00
Michael Niedermayer
3442c20c4d avcodec/bsf: Fix av_bsf_list_free()
Negate null check
Fixes CID1396248

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 762bf6f4af)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-01-26 00:34:12 +01:00
Michael Niedermayer
7d222736c2 avcodec/omx: Do not pass negative value into av_malloc()
Fixes CID1396849

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bd83c295fc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-01-26 00:34:12 +01:00
Tobias Rapp
d5154c055b avformat/avidec: skip odml master index chunks in avi_sync
Fixes pts gaps when reading AVI files > 256GiB generated by FFmpeg.

Signed-off-by: Tobias Rapp <t.rapp@noa-archive.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6d579d7c1b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-01-26 00:34:12 +01:00
Michael Niedermayer
cd81993070 avcodec/mjpegdec: Check for rgb before flipping
Fixes assertion failure due to unsupported case

Fixes: 356/fuzz-1-ffmpeg_VIDEO_AV_CODEC_ID_MJPEG_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 25d9643f11)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-01-26 00:34:12 +01:00
Matt Wolenetz
2481f1320a lavf/utils.c Protect against accessing entries[nb_entries]
In ff_index_search_timestamp(), if b == num_entries,
m == num_entries - 1, and entries[m].flags & AVINDEX_DISCARD_FRAME is
true, then the search for the next non-discarded packet could access
entries[nb_entries], exceeding its bounds. This change adds a protection
against that scenario. Reference: https://crbug.com/666770

Reviewed-by: Sasi Inguva <isasi@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fe7547d69e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-01-26 00:34:12 +01:00
Michael Niedermayer
ceeeccc862 avutil/random_seed: Reduce the time needed on systems with very low precission clock()
This should fix issues on BSD
CLOCKS_PER_SEC is 128 on BSD while SUSv2 requires it to be a million

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c4152fc42e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-01-26 00:34:12 +01:00
Michael Niedermayer
07df85b958 swscale/swscale: Fix dereference of stride array before null check
Fixes: CID1396263
Fixes: CID1396271

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 03ce71e4a1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-01-26 00:34:12 +01:00
Michael Niedermayer
7643e8584f avutil/random_seed: Improve get_generic_seed() with higher precission clock()
Tested-by: Thomas Turner <thomastdt@googlemail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit da73d95bad)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-01-26 00:34:12 +01:00
Chris Cunningham
533431d5af avformat/mp3dec: fix msan warning when verifying mpa header
MPEG Audio frame header must be 4 bytes. If we fail to read
4 bytes bail early to avoid Use-of-uninitialized-value msan error.
Reference https://crbug.com/666874.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ab87df9a47)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-01-26 00:34:12 +01:00
Michael Niedermayer
9519b2560e avformat/utils: Print verbose error message if stream count exceeds max_streams
Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f0bdd53871)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-01-26 00:34:12 +01:00
Michael Niedermayer
3e3e095fc9 avformat/options_table: Set the default maximum number of streams to 1000
Fixes CVE-2016-9561, Note the security relevance of this is disputed as
running out of memory can happen with valid files

Suggested-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 30581c51e7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-01-26 00:34:12 +01:00
Georgi D. Sotirov
41f8a8843d lavf/chromaprint: Update for version 1.4
Fixes ticket #5997.
(cherry picked from commit 581f93f37e)

Fixes Debian bug 841501.
2017-01-15 11:53:41 +01:00
Michael Niedermayer
64bb329afa avutil: Add av_image_check_size2()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f542b152aa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-12-11 00:21:53 +01:00
Michael Niedermayer
3ecbac5664 avformat: Add max_streams option
This allows user apps to stop OOM due to excessive number of streams

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1296f84495)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-12-11 00:21:53 +01:00
Michael Niedermayer
0e6febff5a avcodec/ffv1enc: Allocate smaller packet if the worst case size cannot be allocated
We are checking during encoding if there is enough space as version 4 needs that
check.

Fixes Ticket6005

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 38a7834bbb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-12-11 00:21:53 +01:00
Michael Niedermayer
3f779aef79 avcodec/mpeg4videodec: Fix undefined shifts in mpeg4_decode_sprite_trajectory()
Fixes: part of 670190.ogg

Found-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8258e36385)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-12-11 00:21:53 +01:00
Michael Niedermayer
35ef033a19 avformat/oggdec: Skip streams in duration correction that did not had their duration set.
Fixes: part of 670190.ogg
Fixes integer overflow

Found-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ee2a6f5df8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-12-11 00:21:53 +01:00
Michael Niedermayer
aec21cd840 avcodec/ffv1enc: Fix size of first slice
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cff1c0edaa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-12-11 00:21:53 +01:00
Marton Balint
47e47cfb07 ffplay: fix sws_scale possible out of bounds array access
As I used simple RGBA formats for subtitles and for the video texture if
avfilter is disabled I kind of assumed that sws_scale won't access data
pointers and strides above index 0, but apparently that is not the case.

Fixes Coverity CID 1396737, 1396738, 1396739, 1396740.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Marton Balint <cus@passwd.hu>
2016-12-10 23:24:05 +01:00
Srinath K R
314c425b16 avfilter/vf_hwupload_cuda: Add min/max limits for the 'device' option
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org>
2016-12-08 11:26:34 +01:00
Michael Niedermayer
148c4fb8d2 Update for 3.2.2
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-12-06 00:09:40 +01:00
Michael Niedermayer
c12ee64e80 ffserver: Check chunk size
Fixes out of array access

Fixes: poc_ffserver.py
Found-by: Paul Cher <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a5d25faa3f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-12-06 00:07:50 +01:00
Michael Niedermayer
46cd1699f9 Avoid using the term "file" and prefer "url" in some docs and comments
This should make it less ambigous that these are URLs

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a5f27a9c3a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-12-06 00:07:50 +01:00
Michael Niedermayer
32b95471a8 avformat/rtmppkt: Check for packet size mismatches
Fixes out of array access

Found-by: Paul Cher <paulcher@icloud.com>
Reviewed-by: Paul Cher <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7d57ca4d9a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-12-06 00:07:50 +01:00
Timothy Gu
f66bfe71bb zmqsend: Initialize ret to 0
Fixes CID1396857.

(cherry picked from commit d903b4e3ad)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-12-06 00:07:50 +01:00
Michael Niedermayer
af1e19b9e4 avcodec/flacdec: Fix undefined shift in decode_subframe()
Fixes undefined behavior
Fixes: 639961-media

Found-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1f5630af51)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-12-06 00:07:50 +01:00
Michael Niedermayer
334901aea0 avcodec/get_bits: Fix get_sbits_long(0)
Fixes undefined behavior
Fixes: 640889-media

Found-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c72fa43234)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-12-06 00:07:50 +01:00
Michael Niedermayer
bbe9a4b542 avformat/ffmdec: Check media type for chunks
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e706e2e775)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-12-06 00:07:50 +01:00
Michael Niedermayer
a772aaf5dc avcodec/flacdec: Fix signed integer overflow in decode_subframe_fixed()
Fixes undefined behavior
Fixes: 640912-media

Found-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 83a75bf6c3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-12-06 00:07:50 +01:00
Michael Niedermayer
c39e8d05f5 avcodec/flacdsp_template: Fix undefined shift in flac_decorrelate_indep_c
Fixes: left shift of negative value
Fixes: 668346-media

Found-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit acc163c6ab)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-12-06 00:07:50 +01:00
Michael Niedermayer
a0715c1e89 avformat/oggparsespeex: Check frames_per_packet and packet_size
The speex specification does not seem to restrict these values, thus
the limits where choosen so as to avoid multiplicative overflow

Fixes undefined behavior
Fixes: 635422.ogg

Found-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit afcf15b0db)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-12-06 00:07:50 +01:00
Michael Niedermayer
a0ed412f38 avformat/utils: Check start/end before computing duration in update_stream_timings()
Fixes undefined behavior
Fixes: 637428.ogg

Found-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 90da187f1d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-12-06 00:07:50 +01:00
Michael Niedermayer
2fb7eb05dc avcodec/flac_parser: Update nb_headers_buffered
Fixes infinite loop
Fixes: fuzz.flac

Found-by: Frank Liberato <liberato@google.com>
Reviewed-by: Frank Liberato <liberato@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2475858889)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-12-06 00:07:50 +01:00
Michael Niedermayer
8e4f737d2f avformat/idroqdec: Check chunk_size for being too large
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 744a0b5206)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-12-06 00:07:50 +01:00
Michael Niedermayer
2d51cb1d0a avcodec/me_cmp: Fix median_sad size
Fixes out of array read
Fixes: COV1396255

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d9883ded34)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-12-06 00:07:50 +01:00
Michael Niedermayer
c165bad0c0 avformat/utils: Fix type mismatch
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a06e84b56e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-12-06 00:07:50 +01:00
James Almer
16aa8c8146 configure: check for strtoull on msvc
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit b52d3574d4)
2016-12-05 19:20:59 -03:00
Ronald S. Bultje
e5be73e178 http: move chunk handling from http_read_stream() to http_buf_read().
(cherry picked from commit 845bb40178)
2016-12-05 16:20:12 -05:00
Ronald S. Bultje
0e0a413725 http: make length/offset-related variables unsigned.
Fixes #5992, reported and found by Paul Cher <paulcher@icloud.com>.

(cherry picked from commit 2a05c8f813)
2016-12-05 16:20:12 -05:00
James Almer
c269c43a83 avcodec/aac_adtstoasc_bsf: validate and forward extradata if the stream is already ASC
Fixes ticket #5973

Reviewed-by: Hendrik Leppkes <h.leppkes@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 6e1902bab4)
2016-11-25 18:51:00 -03:00
Andreas Cadhalpun
6f3e3cb8ba Update Changelog
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-25 22:23:39 +01:00
Andreas Cadhalpun
d147114b9d mss2: only use error correction for matching block counts
This fixes a heap-buffer-overflow in ff_er_frame_end when decoding mss2
with coded_width/coded_height larger than width/height.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 2566ad98b0)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-25 22:22:19 +01:00
Andreas Cadhalpun
ad82036626 softfloat: decrease MIN_EXP to cover full float range
floats are not necessarily normalized, so a normalized softfloat needs
MIN_EXP lowered by 23 to cover that range.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 2d6f46d801)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-25 22:22:15 +01:00
Andreas Cadhalpun
a6a2d9d1e5 libopusdec: default to stereo for invalid number of channels
This fixes an out-of-bounds read if avc->channels is 0.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 8c8f543b81)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-25 22:22:11 +01:00
Andreas Cadhalpun
6ad2773142 flvdec: require need_context_update when changing codec id
Otherwise the codec context and codecpar might disagree on the codec id,
triggering asserts in av_parser_parse2.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 98b3a7979f)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-25 22:22:07 +01:00
Andreas Cadhalpun
1dc59aaf61 pgssubdec: only set w/h/linesize when allocating data
Rects with positive w/h/linesize but no data are invalid.

Reviewed-by: Petri Hintukainen <phintuka@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 995512328e)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-25 22:21:52 +01:00
Andreas Cadhalpun
9aaddbf0ef sbgdec: prevent NULL pointer access
Reviewed-by: Josh de Kock <josh@itanimul.li>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit dbefbb61b7)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-25 22:21:48 +01:00
Andreas Cadhalpun
e00fec907f rmdec: validate block alignment
This fixes division by zero crashes.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit de4ded0636)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-25 22:21:44 +01:00
Andreas Cadhalpun
d8364f4e1d smacker: limit recursion depth of smacker_decode_bigtree
This fixes segmentation faults due to stack-overflow caused by too deep
recursion.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 946ecd19ea)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-25 22:21:39 +01:00
Andreas Cadhalpun
7d0cc12a56 mxfdec: fix NULL pointer dereference in mxf_read_packet_old
Metadata streams have priv_data set to NULL.

Reviewed-by: Josh de Kock <josh@itanimul.li>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit fdb8c455b6)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-25 22:21:33 +01:00
Andreas Cadhalpun
de031809f3 ffmdec: validate codec parameters
A negative extradata size for example gets passed to memcpy in
avcodec_parameters_from_context causing a segmentation fault.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 1c7da19a4b)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-25 22:21:14 +01:00
Michael Niedermayer
6550d0580b Update for 3.2.1
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-25 21:27:40 +01:00
Michael Niedermayer
dff4f58107 avformat/mpeg: Adjust vid probe threshold to correct mis-detection
Fixes: _ij.mp3

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4e5049a230)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-23 20:29:31 +01:00
Michael Niedermayer
e9f3cc7fc7 avcodec/ass_split: Change order of operations in ass_split_section()
This matches the other branch
Fixes out of array read
Fixes: 4d142ca76d39fe685effcf5017098723/asan_heap-oob_31ae824_8611_348fdb64f9009b63c8a8eae9a0e497c5.mkv

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ae514b1254)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-23 20:29:31 +01:00
James Almer
ee56777379 avcodec/rawdec: check for side data before checking its size
Fixes valgrind warnings about usage of uninitialized values.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 51e329918d)
2016-11-19 23:50:37 -03:00
James Almer
3bd7ad58a7 avcodec/avpacket: fix leak on realloc in av_packet_add_side_data()
If realloc fails, the pointer is overwritten and the previously allocated
buffer is leaked, which goes against the expected behavior of keeping the
packet unchanged in case of error.

Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>

(cherry picked from commit 574929d8b6)
2016-11-19 20:24:54 -03:00
James Almer
f97bee9ad5 avformat/apngenc: use the stream parameters extradata if available
Fixes remuxing apng streams coming from the apng demuxer, which sends extradata
during init.

Signed-off-by: James Almer <jamrial@gmail.com>
2016-11-18 12:33:31 -03:00
James Almer
cf655d1643 Revert "apngdec: use side data to pass extradata to the decoder"
This reverts commit e0c6b32046.

Said commit changed the behavior of the demuxer and decoder in a non
backwards compatible way.
Demuxers should make extradata available at init if possible, and send
new extradata as side data within a packet if needed.

A better fix for the remuxing crash will follow.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 16c429166d)
2016-11-18 12:33:21 -03:00
Stefano Sabatini
31c9c7ad82 ffprobe: fix crash in case -of is specified with an empty string
Fix trac issue #5957.

(cherry picked from commit 427a47abcd)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:51:21 +01:00
Martin Vignali
08f26d99b5 libavcodec/exr : fix channel size calculation for uint32 channel
uint32 need 4 bytes not 1.
Fix decoding when there is half/float and uint32 channel.

This fixes crashes due to pointer corruption caused by invalid writes.

The problem was introduced in commit
03152e74df.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 52da3f6f70)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:37:05 +01:00
Andreas Cadhalpun
c7d38efbc2 exr: fix out-of-bounds read
channel_index can be -1.

This problem was introduced in commit
2dd7b46132.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit ffdc5d09e4)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:19:01 +01:00
Andreas Cadhalpun
cbc9d46066 libschroedingerdec: fix leaking of framewithpts
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 3c0328d58d)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:18:56 +01:00
Andreas Cadhalpun
2b863d4e9b libschroedingerdec: don't produce empty frames
They are not valid and can cause problems/crashes for API users.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit a86ebbf7f6)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:18:53 +01:00
Andreas Cadhalpun
598016b85f dds: limit 4 bpp handling to AV_PIX_FMT_PAL8
This fixes NULL pointer dereferencing for formats, where frame->data[1]
is not allocated.

The problem was introduced in commit
257fbc3af4.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 90ebf3c428)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:18:48 +01:00
Andreas Cadhalpun
a2c7840a6b mlz: limit next_code to data buffer size
This fixes a heap-buffer-overflow detected by AddressSanitizer.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 1abcd972c4)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:18:42 +01:00
Andreas Cadhalpun
c8f5154fc1 softfloat: handle -INT_MAX correctly
This is similar to commit 9ac61e73d0.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 0edd569466)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:18:35 +01:00
Andreas Cadhalpun
b526958ca4 filmstripdec: correctly check image dimensions
This prevents a division by zero in read_packet.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 25012c5644)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:18:29 +01:00
Andreas Cadhalpun
039a3e6db8 pnmdec: make sure v is capped by maxval
Otherwise put_bits can be called with a value that doesn't fit in the
sample_len, causing an assertion failure.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit cdb5479c9d)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:17:58 +01:00
Andreas Cadhalpun
d8affeea82 smvjpegdec: make sure cur_frame is not negative
This fixes a heap-buffer-overflow detected by AddressSanitizer.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 360bc0d90a)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:17:20 +01:00
Andreas Cadhalpun
1615d83dcf icodec: correctly check avio_read return value
It can read less than the requested amount, in which case buf contains
uninitialized data, causing problems like segmentation faults later on.

Also make sure that image->size is positive, so that it can't match a
negative error code.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 89eb398c7f)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:16:48 +01:00
Andreas Cadhalpun
41359d381a icodec: fix leaking pkt on error
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 467eece1be)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:16:43 +01:00
Andreas Cadhalpun
581cce0cca dvbsubdec: fix division by zero in compute_default_clut
This problem was introduced in commit
4b90dcb849.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit c82b8ef0e4)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:15:52 +01:00
Andreas Cadhalpun
1ed4b52732 proresdec_lgpl: explicitly check coff[3] against slice_data_size
The implicit checks via v_data_size and a_data_size don't work in the case
'(hdr_size > 7) && !ctx->alpha_info'.

This fixes segmentation faults due to invalid reads.

This problem was introduced in commit
547c2f002a.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 1e33035ee7)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:15:47 +01:00
Andreas Cadhalpun
72a2d6ff56 escape124: reject codebook size 0
It causes a cb_depth of 32, leading to assertion failures in get_bits.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 226d35c845)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:15:42 +01:00
Andreas Cadhalpun
9dee25fbc7 mpegts: prevent division by zero
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 1bbb18fe82)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:15:07 +01:00
Andreas Cadhalpun
fa24e3780b matroskadec: fix NULL pointer dereference in webm_dash_manifest_read_header
The code assumes that s->streams[0] is valid.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit ff100c9dd9)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:14:52 +01:00
Andreas Cadhalpun
1e4979f780 mpegaudio_parser: don't return AVERROR_PATCHWELCOME
The API does not allow returning AVERROR codes.

It triggers an assert in av_parser_parse2.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 5249706e9d)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:14:01 +01:00
Andreas Cadhalpun
c11fd9de76 mxfdec: fix NULL pointer dereference
Metadata streams have priv_data set to NULL.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 0efb610611)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:13:29 +01:00
Andreas Cadhalpun
c72ac9ffd0 lzf: update pointer p after realloc
This fixes heap-use-after-free detected by AddressSanitizer.

Reviewed-by: Luca Barbato <lu_zero@gentoo.org>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit bb6a7b6f75)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:13:19 +01:00
Andreas Cadhalpun
31cebfe789 diracdec: check return code of get_buffer_with_edge
If it fails, buffers aren't allocated, causing NULL pointer dereferencing.

Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit db79dedb1a)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:13:14 +01:00
Andreas Cadhalpun
b9a24cee3b diracdec: clear slice_params_num_buf on allocation failure
Otherwise it can be non-zero next time decode_lowdelay is called, causing
slice_params_buf not to be allocated, leading to a NULL pointer dereference.

The problem was introduced in commit
dcad4677d6.

Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 24d20496d2)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:13:05 +01:00
Andreas Cadhalpun
08b1fd6afb diracdec: use correct buffer for slice_params_buf realloc
This fixes a double-free detected by AddressSanitizer.

The problem was introduced in commit
dcad4677d6.

Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 8a4ea96448)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:12:58 +01:00
Andreas Cadhalpun
35cb0c47bc ppc: pixblockdsp: do unaligned block accesses correctly again
This was broken by the following Libav commit:
4c387c7 ppc: dsputil: do unaligned block accesses correctly

The following tests fail due to this:
fate-checkasm
fate-vsynth1-dnxhd-2k-hr-hq fate-vsynth1-dnxhd-edge1-hr
fate-vsynth1-dnxhd-edge2-hr fate-vsynth1-dnxhd-edge3-hr
fate-vsynth1-dnxhd-hr-sq-mov fate-vsynth1-dnxhd-hr-hq-mov
fate-vsynth2-dnxhd-2k-hr-hq fate-vsynth2-dnxhd-edge1-hr
fate-vsynth2-dnxhd-edge2-hr fate-vsynth2-dnxhd-edge3-hr
fate-vsynth2-dnxhd-hr-sq-mov fate-vsynth2-dnxhd-hr-hq-mov
fate-vsynth3-dnxhd-2k-hr-hq fate-vsynth3-dnxhd-edge1-hr
fate-vsynth3-dnxhd-edge2-hr fate-vsynth3-dnxhd-edge3-hr
fate-vsynth3-dnxhd-hr-sq-mov fate-vsynth3-dnxhd-hr-hq-mov

Fixes trac ticket #5508.

Reviewed-by: Carl Eugen Hoyos <ceffmpeg@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 3932ccc472)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:12:50 +01:00
Andreas Cadhalpun
dc2942bbc8 avformat: close parser if codec changed
The parser depends on the codec and thus must not be used with a different one.
If it is, the 'avctx->codec_id == s->parser->codec_ids[0] ...' assert in
av_parser_parse2 gets triggered.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit f84ae3f04a)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:12:43 +01:00
Andreas Cadhalpun
35db873534 fate: add streamcopy test for apng
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 719c15aa9a)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:12:33 +01:00
Andreas Cadhalpun
3e33685892 apngdec: use side data to pass extradata to the decoder
Fixes remuxing apng streams coming from the apng demuxer.
This is a regression since 940b8908b9.

Found-by: James Almer <jamrial@gmail.com>
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit e0c6b32046)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:12:29 +01:00
Andreas Cadhalpun
d95568f9a2 mov: immediately return from mov_fix_index without old index entries
If there are no index entries, e_old = st->index_entries is only one
byte large, since it was created by av_realloc called with size 0.

Thus accessing e_old[0].timestamp causes a heap buffer overflow.

Reviewed-by: Sasi Inguva <isasi@google.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 9d83b209d8)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:12:23 +01:00
Andreas Cadhalpun
6e5ccabbe8 interplayacm: increase bitstream buffer size by AV_INPUT_BUFFER_PADDING_SIZE
This fixes out-of-bounds reads by the bitstream reader.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 60178e78f2)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:12:09 +01:00
Andreas Cadhalpun
266cf258cc interplayacm: validate number of channels
The number of channels is used as divisor in decode_frame, so it must
not be zero to avoid SIGFPE crashes.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 5540d6c134)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:11:57 +01:00
Andreas Cadhalpun
c90d521f16 interplayacm: check for too large b
This fixes out-of-bounds reads.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 14e4e26559)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:11:49 +01:00
Andreas Cadhalpun
346fa70bb8 doc: fix spelling errors
Reviewed-by: Lou Logan <lou@lrcd.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 1e660fe88d)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:11:34 +01:00
Andreas Cadhalpun
e92f585bd9 configure: make sure LTO does not optimize out the test functions
Fixes trac ticket #5909

Bud-Id: https://bugs.gentoo.org/show_bug.cgi?id=598054
Acked-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 890eb3d7c4)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:11:29 +01:00
Andreas Cadhalpun
e622d7723b fate: add apng encoding/muxing test
Also test the fallback to png creation for a single frame.

Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 97792e85c3)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:11:22 +01:00
Andreas Cadhalpun
1af7ddecda apng: use side data to pass extradata to muxer
This fixes creating apng files, which is broken since commit
5ef1959080.

Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 940b8908b9)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-11-17 23:11:12 +01:00
Michael Niedermayer
b9a0172260 avcodec/mpeg4videodec: Workaround interlaced mpeg4 edge MC bug
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2c9106257f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-17 12:47:40 +01:00
Michael Niedermayer
3f6aae377a avcodec/mpegvideo: Fix edge emu buffer overlap with interlaced mpeg4
Fixes Ticket5936
Regression since c5fc8ae126

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 85407c7e63)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-17 12:47:40 +01:00
Michael Niedermayer
0f8de7a3db avcodec/rv40: Test remaining space in loop of get_dimension()
Fixes infinite loop
Fixes: 178/fuzz-3-ffmpeg_VIDEO_AV_CODEC_ID_RV40_fuzzer

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1546d487cf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-17 12:47:40 +01:00
Michael Niedermayer
7e8eb30f40 avcodec/ituh263dec: Avoid spending a long time in slice sync
Fixes: 177/fuzz-3-ffmpeg_VIDEO_AV_CODEC_ID_FLV1_fuzzer

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2baf36caed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-17 12:47:40 +01:00
Michael Niedermayer
8deaed3b12 avcodec/movtextdec: Add error message for tsmb_size check
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0eb3198005)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-17 12:47:40 +01:00
Michael Niedermayer
a0c6b4cfd1 avcodec/movtextdec: Fix tsmb_size check==0 check
Fixes: 173/fuzz-3-ffmpeg_SUBTITLE_AV_CODEC_ID_MOV_TEXT_fuzzer

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a609905723)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-17 12:47:40 +01:00
Michael Niedermayer
20d0f32012 avcodec/movtextdec: Fix potential integer overflow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6ea2715768)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-17 12:47:40 +01:00
Michael Niedermayer
07c5e65e6d ffmpeg: Fix bsf corrupting merged side data
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 11f24e71ff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-17 12:47:40 +01:00
Michael Niedermayer
7521d5b8da avcodec/sunrast: Fix input buffer pointer check
Fixes: out of array read
Fixes: poc.dat

Found-by: Bingchang, Liu @VARAS of IIE
Tested-by: bc L <l.bing.chang.bc@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 37138338ff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-17 12:47:40 +01:00
Michael Niedermayer
487accbf19 avcodec/tscc: Check side data size before use
Fixes out of array read

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 979bca5134)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-17 12:47:40 +01:00
Michael Niedermayer
fa1ee96026 avcodec/rscc: Fix constant
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e167610794)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-17 12:47:40 +01:00
Michael Niedermayer
e8b9337281 avcodec/rawdec: Check side data size before use
Fixes out of array read

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f0bc0215a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-17 12:47:40 +01:00
Michael Niedermayer
aa896c182d avcodec/rscc: Check side data size before use
Fixes out of array read

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0f64b6cd22)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-17 12:47:40 +01:00
Michael Niedermayer
956407b5df avcodec/msvideo1: Check side data size before use
Fixes out of array read

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 161ccdaa06)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-17 12:47:40 +01:00
Michael Niedermayer
7821c96dd0 avcodec/qpeg: Check side data size before use
Fixes out of array read

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 16793504df)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-17 12:47:40 +01:00
Michael Niedermayer
0c0aa5ebba avcodec/qtrle: Check side data size before use
Fixes out of array read

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7d196f2a5a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-17 12:47:40 +01:00
Michael Niedermayer
3c1eb57d1e avcodec/msrle: Check side data size before use
Fixes out of array read

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a6330119a0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-17 12:47:40 +01:00
Michael Niedermayer
dc692ae1b7 avcodec/kmvc: Check side data size before use
Fixes out of array read

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2d99101d09)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-17 12:47:40 +01:00
Michael Niedermayer
be756396b5 avcodec/idcinvideo: Check side data size before use
Fixes out of array read

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a2b8dde659)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-17 12:47:40 +01:00
Michael Niedermayer
d8db018e31 avcodec/cinepak: Check side data size before use
Fixes out of array read

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 121be31060)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-17 12:47:40 +01:00
Michael Niedermayer
c9c619e667 avcodec/8bps: Check side data size before use
Fixes out of array read

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 042faa847f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-17 12:47:40 +01:00
Michael Niedermayer
48ee545d11 avformat/flvdec: Fix regression loosing streams
Fixes: unknown_video.flv

Found-by: Thierry Foucu <tfoucu@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 077939626e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-17 12:47:40 +01:00
Anssi Hannula
7568b0f553 avformat/hls: Add missing error check for avcodec_parameters_copy()
Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
(cherry picked from commit e2193b53ea)
2016-11-07 19:06:08 +02:00
Anssi Hannula
fc20e30058 avformat/hls: Fix probing mpegts audio streams that use probing
Commit 04964ac311 ("avformat/hls: Fix missing streams in some
cases with MPEG TS") caused a regression where subdemuxer streams that
use probing (e.g. dts/eac3/mp2 in mpegts) no longer get probed properly.

This is because the codec parameters from the subdemuxer stream, once
probed, are not passed on to the main stream.

Fix that by updating the codec parameters if the codec id changes.

Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
(cherry picked from commit 3d2f636497)
2016-11-07 19:06:08 +02:00
Anssi Hannula
32ceeb579e avformat/hls: Factor copying stream info to a separate function
Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
(cherry picked from commit 9a51cd35b8)
2016-11-07 19:06:08 +02:00
Stephen Hutchinson
ebf8ec5b0f avisynth: fix Planar RGB output
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bf14393635)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-10-27 17:24:04 +02:00
James Almer
548242d1a1 avcodec: remove missing incompatible_libav_abi references
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit bf709098c9)
2016-10-26 17:37:10 -03:00
James Almer
e554c667bd configure: remove missing incompatible_libav_abi references
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 7400f64211)
2016-10-26 17:37:06 -03:00
James Almer
e6f35a9cd8 avformat/matroskaenc: fix cue relative position values when CRC32 is enabled
The dynamic buffer does not contain the CRC32 element so calls to avio_tell()
don't take it into account. This resulted in CueRelativePosition values being
six bytes short.
This is a regression since 6724525a15

Instead of adding yet another custom check for CRC32 to fix a size or an offset,
remove the existing ones and reserve the six bytes in the dynamic buffer.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit eabbc64728)
2016-10-26 16:30:05 -03:00
Michael Niedermayer
660229d647 Revert "Bump minor versions after 3.2 branchpoint to seperate release"
this should only have been on master

This reverts commit 1609935b6c.
2016-10-26 21:22:12 +02:00
Michael Niedermayer
32860d2fb8 RELEASE_NOTES: based on 3.1
Name suggested by Lou and Kyle

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-10-26 21:14:02 +02:00
Michael Niedermayer
7fd15f2939 Update for 3.2
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-10-26 21:13:51 +02:00
1875 changed files with 39523 additions and 94667 deletions

1
.gitattributes vendored
View File

@@ -1,2 +1 @@
*.pnm -diff -text
tests/ref/fate/sub-scc eol=crlf

1763
Changelog

File diff suppressed because it is too large Load Diff

View File

@@ -17,6 +17,7 @@ Specifically, the GPL parts of FFmpeg are:
- `libavcodec/x86/flac_dsp_gpl.asm`
- `libavcodec/x86/idct_mmx.c`
- `libavfilter/x86/vf_removegrain.asm`
- the X11 grabber in `libavdevice/x11grab.c`
- the following building and testing tools
- `compat/solaris/make_sunver.pl`
- `doc/t2h.pm`
@@ -25,6 +26,7 @@ Specifically, the GPL parts of FFmpeg are:
- `tests/checkasm/*`
- `tests/tiny_ssim.c`
- the following filters in libavfilter:
- `f_ebur128.c`
- `vf_blackframe.c`
- `vf_boxblur.c`
- `vf_colormatrix.c`

View File

@@ -47,7 +47,6 @@ project server Árpád Gereöffy, Michael Niedermayer,
presets Robert Swain
metadata subsystem Aurelien Jacobs
release management Michael Niedermayer
API tests Ludmila Glinskih
Communication
@@ -60,7 +59,6 @@ mailing lists Baptiste Coudurier, Lou Logan
Google+ Paul B Mahol, Michael Niedermayer, Alexander Strasser
Twitter Lou Logan, Reynaldo H. Verdejo Pinochet
Launchpad Timothy Gu
ffmpeg-security Andreas Cadhalpun, Carl Eugen Hoyos, Clément Bœsch, Michael Niedermayer, Reimar Doeffinger, Rodger Combs, wm4
libavutil
@@ -116,8 +114,6 @@ Generic Parts:
lzw.* Michael Niedermayer
floating point AAN DCT:
faandct.c, faandct.h Michael Niedermayer
Non-power-of-two MDCT:
mdct15.c, mdct15.h Rostislav Pehlivanov
Golomb coding:
golomb.c, golomb.h Michael Niedermayer
motion estimation:
@@ -179,7 +175,7 @@ Codecs:
h263* Michael Niedermayer
h264* Loren Merritt, Michael Niedermayer
hap* Tom Butterworth
huffyuv* Michael Niedermayer
huffyuv* Michael Niedermayer, Christophe Gisquet
idcinvideo.c Mike Melanson
interplayvideo.c Mike Melanson
jni*, ffjni* Matthieu Bouron
@@ -212,14 +208,13 @@ Codecs:
msvideo1.c Mike Melanson
nuv.c Reimar Doeffinger
nvenc* Timo Rothenpieler
opus* Rostislav Pehlivanov
paf.* Paul B Mahol
pcx.c Ivo van Poorten
pgssubdec.c Reimar Doeffinger
ptx.c Ivo van Poorten
qcelp* Reynaldo H. Verdejo Pinochet
qdm2.c, qdm2data.h Roberto Togni
qsv* Mark Thompson
qsv* Ivan Uskov
qtrle.c Mike Melanson
ra144.c, ra144.h, ra288.c, ra288.h Roberto Togni
resample2.c Michael Niedermayer
@@ -227,6 +222,7 @@ Codecs:
rpza.c Roberto Togni
rtjpeg.c, rtjpeg.h Reimar Doeffinger
rv10.c Michael Niedermayer
rv4* Christophe Gisquet
s3tc* Ivo van Poorten
smc.c Mike Melanson
smvjpegdec.c Ash Hughes
@@ -240,6 +236,7 @@ Codecs:
tta.c Alex Beregszaszi, Jaikrishnan Menon
ttaenc.c Paul B Mahol
txd.c Ivo van Poorten
vc1* Christophe Gisquet
vc2* Rostislav Pehlivanov
vcr1.c Michael Niedermayer
vda_h264_dec.c Xidorn Quan
@@ -264,8 +261,7 @@ Codecs:
Hardware acceleration:
crystalhd.c Philip Langdale
dxva2* Hendrik Leppkes, Laurent Aimar, Steve Lhomme
d3d11va* Steve Lhomme
dxva2* Hendrik Leppkes, Laurent Aimar
mediacodec* Matthieu Bouron
vaapi* Gwenole Beauchesne
vaapi_encode* Mark Thompson
@@ -388,7 +384,6 @@ Muxers/Demuxers:
avisynth.c Stephen Hutchinson
avr.c Paul B Mahol
bink.c Peter Ross
boadec.c Michael Niedermayer
brstm.c Paul B Mahol
caf* Peter Ross
cdxl.c Paul B Mahol
@@ -401,8 +396,7 @@ Muxers/Demuxers:
epafdec.c Paul B Mahol
ffm* Baptiste Coudurier
flic.c Mike Melanson
flvdec.c Michael Niedermayer
flvenc.c Michael Niedermayer, Steven Liu
flvdec.c, flvenc.c Michael Niedermayer
gxf.c Reimar Doeffinger
gxfenc.c Baptiste Coudurier
hls.c Anssi Hannula
@@ -529,32 +523,6 @@ Sparc Roman Shaposhnik
OS/2 KO Myung-Hun
Developers with git write access who are currently not maintaining any specific part
====================================================================================
Alex Converse
Andreas Cadhalpun
Anuradha Suraparaju
Ben Littler
Benjamin Larsson
Bobby Bingham
Daniel Verkamp
Derek Buitenhuis
Ganesh Ajjanagadde
Henrik Gramner
Ivan Uskov
James Darnley
Joakim Plate
Kieran Kunhya
Kirill Gavrilov
Martin Storsjö
Panagiotis Issaris
Pedro Arthur
Sebastien Zwickert
Vittorio Giovara
wm4
(this list is incomplete)
Releases
========

View File

@@ -79,13 +79,8 @@ tools/cws2fws$(EXESUF): ELIBS = $(ZLIB)
tools/uncoded_frame$(EXESUF): $(FF_DEP_LIBS)
tools/uncoded_frame$(EXESUF): ELIBS = $(FF_EXTRALIBS)
CONFIGURABLE_COMPONENTS = \
$(wildcard $(FFLIBS:%=$(SRC_PATH)/lib%/all*.c)) \
$(SRC_PATH)/libavcodec/bitstream_filters.c \
$(SRC_PATH)/libavformat/protocols.c \
config.h: .config
.config: $(CONFIGURABLE_COMPONENTS)
.config: $(wildcard $(FFLIBS:%=$(SRC_PATH)/lib%/all*.c))
@-tput bold 2>/dev/null
@-printf '\nWARNING: $(?F) newer than config.h, rerun configure\n\n'
@-tput sgr0 2>/dev/null
@@ -93,7 +88,7 @@ config.h: .config
SUBDIR_VARS := CLEANFILES EXAMPLES FFLIBS HOSTPROGS TESTPROGS TOOLS \
HEADERS ARCH_HEADERS BUILT_HEADERS SKIPHEADERS \
ARMV5TE-OBJS ARMV6-OBJS ARMV8-OBJS VFP-OBJS NEON-OBJS \
ALTIVEC-OBJS VSX-OBJS MMX-OBJS YASM-OBJS \
ALTIVEC-OBJS MMX-OBJS YASM-OBJS \
MIPSFPU-OBJS MIPSDSPR2-OBJS MIPSDSP-OBJS MSA-OBJS \
MMI-OBJS OBJS SLIBOBJS HOSTOBJS TESTOBJS
@@ -184,9 +179,6 @@ clean::
$(RM) $(ALLAVPROGS) $(ALLAVPROGS_G)
$(RM) $(CLEANSUFFIXES)
$(RM) $(CLEANSUFFIXES:%=tools/%)
$(RM) $(CLEANSUFFIXES:%=compat/msvcrt/%)
$(RM) $(CLEANSUFFIXES:%=compat/atomics/pthread/%)
$(RM) $(CLEANSUFFIXES:%=compat/%)
$(RM) -r coverage-html
$(RM) -rf coverage.info coverage.info.in lcov

View File

@@ -1 +1 @@
3.3.git
3.2.18

15
RELEASE_NOTES Normal file
View File

@@ -0,0 +1,15 @@
┌────────────────────────────────────────┐
│ RELEASE NOTES for FFmpeg 3.2 "Hypatia" │
└────────────────────────────────────────┘
The FFmpeg Project proudly presents FFmpeg 3.2 "Hypatia", about 4
months after the release of FFmpeg 3.1.
A complete Changelog is available at the root of the project, and the
complete Git history on http://source.ffmpeg.org.
We hope you will like this release as much as we enjoyed working on it, and
as usual, if you have any questions about it, or any FFmpeg related topic,
feel free to join us on the #ffmpeg IRC channel (on irc.libera.chat) or ask
on the mailing-lists.

View File

@@ -75,12 +75,6 @@ static FILE *report_file;
static int report_file_level = AV_LOG_DEBUG;
int hide_banner = 0;
enum show_muxdemuxers {
SHOW_DEFAULT,
SHOW_DEMUXERS,
SHOW_MUXERS,
};
void init_opts(void)
{
av_dict_set(&sws_dict, "flags", "bicubic", 0);
@@ -231,6 +225,7 @@ static const OptionDef *find_option(const OptionDef *po, const char *name)
* by default. HAVE_COMMANDLINETOARGVW is true on cygwin, while
* it doesn't provide the actual command line via GetCommandLineW(). */
#if HAVE_COMMANDLINETOARGVW && defined(_WIN32)
#include <windows.h>
#include <shellapi.h>
/* Will be leaked on exit */
static char** win32_argv_utf8 = NULL;
@@ -1256,7 +1251,7 @@ static int is_device(const AVClass *avclass)
return AV_IS_INPUT_DEVICE(avclass->category) || AV_IS_OUTPUT_DEVICE(avclass->category);
}
static int show_formats_devices(void *optctx, const char *opt, const char *arg, int device_only, int muxdemuxers)
static int show_formats_devices(void *optctx, const char *opt, const char *arg, int device_only)
{
AVInputFormat *ifmt = NULL;
AVOutputFormat *ofmt = NULL;
@@ -1274,33 +1269,29 @@ static int show_formats_devices(void *optctx, const char *opt, const char *arg,
const char *name = NULL;
const char *long_name = NULL;
if (muxdemuxers !=SHOW_DEMUXERS) {
while ((ofmt = av_oformat_next(ofmt))) {
is_dev = is_device(ofmt->priv_class);
if (!is_dev && device_only)
continue;
if ((!name || strcmp(ofmt->name, name) < 0) &&
strcmp(ofmt->name, last_name) > 0) {
name = ofmt->name;
long_name = ofmt->long_name;
encode = 1;
}
while ((ofmt = av_oformat_next(ofmt))) {
is_dev = is_device(ofmt->priv_class);
if (!is_dev && device_only)
continue;
if ((!name || strcmp(ofmt->name, name) < 0) &&
strcmp(ofmt->name, last_name) > 0) {
name = ofmt->name;
long_name = ofmt->long_name;
encode = 1;
}
}
if (muxdemuxers != SHOW_MUXERS) {
while ((ifmt = av_iformat_next(ifmt))) {
is_dev = is_device(ifmt->priv_class);
if (!is_dev && device_only)
continue;
if ((!name || strcmp(ifmt->name, name) < 0) &&
strcmp(ifmt->name, last_name) > 0) {
name = ifmt->name;
long_name = ifmt->long_name;
encode = 0;
}
if (name && strcmp(ifmt->name, name) == 0)
decode = 1;
while ((ifmt = av_iformat_next(ifmt))) {
is_dev = is_device(ifmt->priv_class);
if (!is_dev && device_only)
continue;
if ((!name || strcmp(ifmt->name, name) < 0) &&
strcmp(ifmt->name, last_name) > 0) {
name = ifmt->name;
long_name = ifmt->long_name;
encode = 0;
}
if (name && strcmp(ifmt->name, name) == 0)
decode = 1;
}
if (!name)
break;
@@ -1317,22 +1308,12 @@ static int show_formats_devices(void *optctx, const char *opt, const char *arg,
int show_formats(void *optctx, const char *opt, const char *arg)
{
return show_formats_devices(optctx, opt, arg, 0, SHOW_DEFAULT);
}
int show_muxers(void *optctx, const char *opt, const char *arg)
{
return show_formats_devices(optctx, opt, arg, 0, SHOW_MUXERS);
}
int show_demuxers(void *optctx, const char *opt, const char *arg)
{
return show_formats_devices(optctx, opt, arg, 0, SHOW_DEMUXERS);
return show_formats_devices(optctx, opt, arg, 0);
}
int show_devices(void *optctx, const char *opt, const char *arg)
{
return show_formats_devices(optctx, opt, arg, 1, SHOW_DEFAULT);
return show_formats_devices(optctx, opt, arg, 1);
}
#define PRINT_CODEC_SUPPORTED(codec, field, type, list_name, term, get_name) \
@@ -2097,10 +2078,18 @@ void *grow_array(void *array, int elem_size, int *size, int new_size)
double get_rotation(AVStream *st)
{
AVDictionaryEntry *rotate_tag = av_dict_get(st->metadata, "rotate", NULL, 0);
uint8_t* displaymatrix = av_stream_get_side_data(st,
AV_PKT_DATA_DISPLAYMATRIX, NULL);
double theta = 0;
if (displaymatrix)
if (rotate_tag && *rotate_tag->value && strcmp(rotate_tag->value, "0")) {
char *tail;
theta = av_strtod(rotate_tag->value, &tail);
if (*tail)
theta = 0;
}
if (displaymatrix && !theta)
theta = -av_display_rotation_get((int32_t*) displaymatrix);
theta -= 360*floor(theta/360 + 0.9/360);

View File

@@ -441,20 +441,6 @@ int show_license(void *optctx, const char *opt, const char *arg);
*/
int show_formats(void *optctx, const char *opt, const char *arg);
/**
* Print a listing containing all the muxers supported by the
* program (including devices).
* This option processing function does not utilize the arguments.
*/
int show_muxers(void *optctx, const char *opt, const char *arg);
/**
* Print a listing containing all the demuxer supported by the
* program (including devices).
* This option processing function does not utilize the arguments.
*/
int show_demuxers(void *optctx, const char *opt, const char *arg);
/**
* Print a listing containing all the devices supported by the
* program.

View File

@@ -6,8 +6,6 @@
{ "version" , OPT_EXIT, {.func_arg = show_version}, "show version" },
{ "buildconf" , OPT_EXIT, {.func_arg = show_buildconf}, "show build configuration" },
{ "formats" , OPT_EXIT, {.func_arg = show_formats }, "show available formats" },
{ "muxers" , OPT_EXIT, {.func_arg = show_muxers }, "show available muxers" },
{ "demuxers" , OPT_EXIT, {.func_arg = show_demuxers }, "show available demuxers" },
{ "devices" , OPT_EXIT, {.func_arg = show_devices }, "show available devices" },
{ "codecs" , OPT_EXIT, {.func_arg = show_codecs }, "show available codecs" },
{ "decoders" , OPT_EXIT, {.func_arg = show_decoders }, "show available decoders" },

View File

@@ -213,27 +213,22 @@ static int compare_ocl_device_desc(const void *a, const void *b)
int opt_opencl_bench(void *optctx, const char *opt, const char *arg)
{
int i, j, nb_devices = 0, count = 0, ret = 0;
int i, j, nb_devices = 0, count = 0;
int64_t score = 0;
AVOpenCLDeviceList *device_list;
AVOpenCLDeviceNode *device_node = NULL;
OpenCLDeviceBenchmark *devices = NULL;
cl_platform_id platform;
ret = av_opencl_get_device_list(&device_list);
if (ret < 0) {
return ret;
}
av_opencl_get_device_list(&device_list);
for (i = 0; i < device_list->platform_num; i++)
nb_devices += device_list->platform_node[i]->device_num;
if (!nb_devices) {
av_log(NULL, AV_LOG_ERROR, "No OpenCL device detected!\n");
av_opencl_free_device_list(&device_list);
return AVERROR(EINVAL);
}
if (!(devices = av_malloc_array(nb_devices, sizeof(OpenCLDeviceBenchmark)))) {
av_log(NULL, AV_LOG_ERROR, "Could not allocate buffer\n");
av_opencl_free_device_list(&device_list);
return AVERROR(ENOMEM);
}

View File

@@ -74,15 +74,6 @@ COMPILE_HOSTC = $(call COMPILE,HOSTCC)
%_host.o: %.c
$(COMPILE_HOSTC)
%$(DEFAULT_YASMD).asm: %.asm
$(DEPYASM) $(YASMFLAGS) -I $(<D)/ -M -o $@ $< > $(@:.asm=.d)
$(YASM) $(YASMFLAGS) -I $(<D)/ -e $< | sed '/^%/d;/^$$/d;' > $@
%.o: %.asm
$(DEPYASM) $(YASMFLAGS) -I $(<D)/ -M -o $@ $< > $(@:.o=.d)
$(YASM) $(YASMFLAGS) -I $(<D)/ -o $@ $(patsubst $(SRC_PATH)/%,$(SRC_LINK)/%,$<)
-$(if $(ASMSTRIPFLAGS), $(STRIP) $(ASMSTRIPFLAGS) $@)
%.o: %.rc
$(WINDRES) $(IFLAGS) --preprocessor "$(DEPWINDRES) -E -xc-header -DRC_INVOKED $(CC_DEPFLAGS)" -o $@ $<

View File

@@ -1,176 +0,0 @@
/*
* This file is part of FFmpeg.
*
* FFmpeg is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* FFmpeg is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with FFmpeg; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
/*
* based on vlc_atomic.h from VLC
* Copyright (C) 2010 Rémi Denis-Courmont
*/
#ifndef COMPAT_ATOMICS_DUMMY_STDATOMIC_H
#define COMPAT_ATOMICS_DUMMY_STDATOMIC_H
#include <stdint.h>
#define ATOMIC_FLAG_INIT 0
#define ATOMIC_VAR_INIT(value) (value)
#define atomic_init(obj, value) \
do { \
*(obj) = (value); \
} while(0)
#define kill_dependency(y) ((void)0)
#define atomic_thread_fence(order) \
((void)0)
#define atomic_signal_fence(order) \
((void)0)
#define atomic_is_lock_free(obj) 0
typedef intptr_t atomic_flag;
typedef intptr_t atomic_bool;
typedef intptr_t atomic_char;
typedef intptr_t atomic_schar;
typedef intptr_t atomic_uchar;
typedef intptr_t atomic_short;
typedef intptr_t atomic_ushort;
typedef intptr_t atomic_int;
typedef intptr_t atomic_uint;
typedef intptr_t atomic_long;
typedef intptr_t atomic_ulong;
typedef intptr_t atomic_llong;
typedef intptr_t atomic_ullong;
typedef intptr_t atomic_wchar_t;
typedef intptr_t atomic_int_least8_t;
typedef intptr_t atomic_uint_least8_t;
typedef intptr_t atomic_int_least16_t;
typedef intptr_t atomic_uint_least16_t;
typedef intptr_t atomic_int_least32_t;
typedef intptr_t atomic_uint_least32_t;
typedef intptr_t atomic_int_least64_t;
typedef intptr_t atomic_uint_least64_t;
typedef intptr_t atomic_int_fast8_t;
typedef intptr_t atomic_uint_fast8_t;
typedef intptr_t atomic_int_fast16_t;
typedef intptr_t atomic_uint_fast16_t;
typedef intptr_t atomic_int_fast32_t;
typedef intptr_t atomic_uint_fast32_t;
typedef intptr_t atomic_int_fast64_t;
typedef intptr_t atomic_uint_fast64_t;
typedef intptr_t atomic_intptr_t;
typedef intptr_t atomic_uintptr_t;
typedef intptr_t atomic_size_t;
typedef intptr_t atomic_ptrdiff_t;
typedef intptr_t atomic_intmax_t;
typedef intptr_t atomic_uintmax_t;
#define atomic_store(object, desired) \
do { \
*(object) = (desired); \
} while (0)
#define atomic_store_explicit(object, desired, order) \
atomic_store(object, desired)
#define atomic_load(object) \
(*(object))
#define atomic_load_explicit(object, order) \
atomic_load(object)
static inline intptr_t atomic_exchange(intptr_t *object, intptr_t desired)
{
intptr_t ret = *object;
*object = desired;
return ret;
}
#define atomic_exchange_explicit(object, desired, order) \
atomic_exchange(object, desired)
static inline int atomic_compare_exchange_strong(intptr_t *object, intptr_t *expected,
intptr_t desired)
{
int ret;
if (*object == *expected) {
*object = desired;
ret = 1;
} else {
*expected = *object;
ret = 0;
}
return ret;
}
#define atomic_compare_exchange_strong_explicit(object, expected, desired, success, failure) \
atomic_compare_exchange_strong(object, expected, desired)
#define atomic_compare_exchange_weak(object, expected, desired) \
atomic_compare_exchange_strong(object, expected, desired)
#define atomic_compare_exchange_weak_explicit(object, expected, desired, success, failure) \
atomic_compare_exchange_weak(object, expected, desired)
#define FETCH_MODIFY(opname, op) \
static inline intptr_t atomic_fetch_ ## opname(intptr_t *object, intptr_t operand) \
{ \
intptr_t ret; \
ret = *object; \
*object = *object op operand; \
return ret; \
}
FETCH_MODIFY(add, +)
FETCH_MODIFY(sub, -)
FETCH_MODIFY(or, |)
FETCH_MODIFY(xor, ^)
FETCH_MODIFY(and, &)
#undef FETCH_MODIFY
#define atomic_fetch_add_explicit(object, operand, order) \
atomic_fetch_add(object, operand)
#define atomic_fetch_sub_explicit(object, operand, order) \
atomic_fetch_sub(object, operand)
#define atomic_fetch_or_explicit(object, operand, order) \
atomic_fetch_or(object, operand)
#define atomic_fetch_xor_explicit(object, operand, order) \
atomic_fetch_xor(object, operand)
#define atomic_fetch_and_explicit(object, operand, order) \
atomic_fetch_and(object, operand)
#define atomic_flag_test_and_set(object) \
atomic_exchange(object, 1)
#define atomic_flag_test_and_set_explicit(object, order) \
atomic_flag_test_and_set(object)
#define atomic_flag_clear(object) \
atomic_store(object, 0)
#define atomic_flag_clear_explicit(object, order) \
atomic_flag_clear(object)
#endif /* COMPAT_ATOMICS_DUMMY_STDATOMIC_H */

View File

@@ -1,173 +0,0 @@
/*
* This file is part of FFmpeg.
*
* FFmpeg is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* FFmpeg is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with FFmpeg; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
/*
* based on vlc_atomic.h from VLC
* Copyright (C) 2010 Rémi Denis-Courmont
*/
#ifndef COMPAT_ATOMICS_GCC_STDATOMIC_H
#define COMPAT_ATOMICS_GCC_STDATOMIC_H
#include <stddef.h>
#include <stdint.h>
#define ATOMIC_FLAG_INIT 0
#define ATOMIC_VAR_INIT(value) (value)
#define atomic_init(obj, value) \
do { \
*(obj) = (value); \
} while(0)
#define kill_dependency(y) ((void)0)
#define atomic_thread_fence(order) \
__sync_synchronize()
#define atomic_signal_fence(order) \
((void)0)
#define atomic_is_lock_free(obj) 0
typedef _Bool atomic_flag;
typedef _Bool atomic_bool;
typedef char atomic_char;
typedef signed char atomic_schar;
typedef unsigned char atomic_uchar;
typedef short atomic_short;
typedef unsigned short atomic_ushort;
typedef int atomic_int;
typedef unsigned int atomic_uint;
typedef long atomic_long;
typedef unsigned long atomic_ulong;
typedef long long atomic_llong;
typedef unsigned long long atomic_ullong;
typedef wchar_t atomic_wchar_t;
typedef int_least8_t atomic_int_least8_t;
typedef uint_least8_t atomic_uint_least8_t;
typedef int_least16_t atomic_int_least16_t;
typedef uint_least16_t atomic_uint_least16_t;
typedef int_least32_t atomic_int_least32_t;
typedef uint_least32_t atomic_uint_least32_t;
typedef int_least64_t atomic_int_least64_t;
typedef uint_least64_t atomic_uint_least64_t;
typedef int_fast8_t atomic_int_fast8_t;
typedef uint_fast8_t atomic_uint_fast8_t;
typedef int_fast16_t atomic_int_fast16_t;
typedef uint_fast16_t atomic_uint_fast16_t;
typedef int_fast32_t atomic_int_fast32_t;
typedef uint_fast32_t atomic_uint_fast32_t;
typedef int_fast64_t atomic_int_fast64_t;
typedef uint_fast64_t atomic_uint_fast64_t;
typedef intptr_t atomic_intptr_t;
typedef uintptr_t atomic_uintptr_t;
typedef size_t atomic_size_t;
typedef ptrdiff_t atomic_ptrdiff_t;
typedef intmax_t atomic_intmax_t;
typedef uintmax_t atomic_uintmax_t;
#define atomic_store(object, desired) \
do { \
*(object) = (desired); \
__sync_synchronize(); \
} while (0)
#define atomic_store_explicit(object, desired, order) \
atomic_store(object, desired)
#define atomic_load(object) \
(__sync_synchronize(), *(object))
#define atomic_load_explicit(object, order) \
atomic_load(object)
#define atomic_exchange(object, desired) \
({ \
__typeof__(object) _obj = (object); \
__typeof__(*object) _old; \
do \
_old = atomic_load(_obj); \
while (!__sync_bool_compare_and_swap(_obj, _old, (desired))); \
_old; \
})
#define atomic_exchange_explicit(object, desired, order) \
atomic_exchange(object, desired)
#define atomic_compare_exchange_strong(object, expected, desired) \
({ \
__typeof__(object) _exp = (expected); \
__typeof__(*object) _old = *_exp; \
*_exp = __sync_val_compare_and_swap((object), _old, (desired)); \
*_exp == _old; \
})
#define atomic_compare_exchange_strong_explicit(object, expected, desired, success, failure) \
atomic_compare_exchange_strong(object, expected, desired)
#define atomic_compare_exchange_weak(object, expected, desired) \
atomic_compare_exchange_strong(object, expected, desired)
#define atomic_compare_exchange_weak_explicit(object, expected, desired, success, failure) \
atomic_compare_exchange_weak(object, expected, desired)
#define atomic_fetch_add(object, operand) \
__sync_fetch_and_add(object, operand)
#define atomic_fetch_add_explicit(object, operand, order) \
atomic_fetch_add(object, operand)
#define atomic_fetch_sub(object, operand) \
__sync_fetch_and_sub(object, operand)
#define atomic_fetch_sub_explicit(object, operand, order) \
atomic_fetch_sub(object, operand)
#define atomic_fetch_or(object, operand) \
__sync_fetch_and_or(object, operand)
#define atomic_fetch_or_explicit(object, operand, order) \
atomic_fetch_or(object, operand)
#define atomic_fetch_xor(object, operand) \
__sync_fetch_and_xor(object, operand)
#define atomic_fetch_xor_explicit(object, operand, order) \
atomic_fetch_xor(object, operand)
#define atomic_fetch_and(object, operand) \
__sync_fetch_and_and(object, operand)
#define atomic_fetch_and_explicit(object, operand, order) \
atomic_fetch_and(object, operand)
#define atomic_flag_test_and_set(object) \
atomic_exchange(object, 1)
#define atomic_flag_test_and_set_explicit(object, order) \
atomic_flag_test_and_set(object)
#define atomic_flag_clear(object) \
atomic_store(object, 0)
#define atomic_flag_clear_explicit(object, order) \
atomic_flag_clear(object)
#endif /* COMPAT_ATOMICS_GCC_STDATOMIC_H */

View File

@@ -1,39 +0,0 @@
/*
* This file is part of FFmpeg.
*
* FFmpeg is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* FFmpeg is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with FFmpeg; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
/*
* based on vlc_atomic.h from VLC
* Copyright (C) 2010 Rémi Denis-Courmont
*/
#include <pthread.h>
#include <stdint.h>
#include "stdatomic.h"
static pthread_mutex_t atomic_lock = PTHREAD_MUTEX_INITIALIZER;
void avpriv_atomic_lock(void)
{
pthread_mutex_lock(&atomic_lock);
}
void avpriv_atomic_unlock(void)
{
pthread_mutex_unlock(&atomic_lock);
}

View File

@@ -1,197 +0,0 @@
/*
* This file is part of FFmpeg.
*
* FFmpeg is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* FFmpeg is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with FFmpeg; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
/*
* based on vlc_atomic.h from VLC
* Copyright (C) 2010 Rémi Denis-Courmont
*/
#ifndef COMPAT_ATOMICS_PTHREAD_STDATOMIC_H
#define COMPAT_ATOMICS_PTHREAD_STDATOMIC_H
#include <stdint.h>
#define ATOMIC_FLAG_INIT 0
#define ATOMIC_VAR_INIT(value) (value)
#define atomic_init(obj, value) \
do { \
*(obj) = (value); \
} while(0)
#define kill_dependency(y) ((void)0)
#define atomic_signal_fence(order) \
((void)0)
#define atomic_is_lock_free(obj) 0
typedef intptr_t atomic_flag;
typedef intptr_t atomic_bool;
typedef intptr_t atomic_char;
typedef intptr_t atomic_schar;
typedef intptr_t atomic_uchar;
typedef intptr_t atomic_short;
typedef intptr_t atomic_ushort;
typedef intptr_t atomic_int;
typedef intptr_t atomic_uint;
typedef intptr_t atomic_long;
typedef intptr_t atomic_ulong;
typedef intptr_t atomic_llong;
typedef intptr_t atomic_ullong;
typedef intptr_t atomic_wchar_t;
typedef intptr_t atomic_int_least8_t;
typedef intptr_t atomic_uint_least8_t;
typedef intptr_t atomic_int_least16_t;
typedef intptr_t atomic_uint_least16_t;
typedef intptr_t atomic_int_least32_t;
typedef intptr_t atomic_uint_least32_t;
typedef intptr_t atomic_int_least64_t;
typedef intptr_t atomic_uint_least64_t;
typedef intptr_t atomic_int_fast8_t;
typedef intptr_t atomic_uint_fast8_t;
typedef intptr_t atomic_int_fast16_t;
typedef intptr_t atomic_uint_fast16_t;
typedef intptr_t atomic_int_fast32_t;
typedef intptr_t atomic_uint_fast32_t;
typedef intptr_t atomic_int_fast64_t;
typedef intptr_t atomic_uint_fast64_t;
typedef intptr_t atomic_intptr_t;
typedef intptr_t atomic_uintptr_t;
typedef intptr_t atomic_size_t;
typedef intptr_t atomic_ptrdiff_t;
typedef intptr_t atomic_intmax_t;
typedef intptr_t atomic_uintmax_t;
void avpriv_atomic_lock(void);
void avpriv_atomic_unlock(void);
static inline void atomic_thread_fence(int order)
{
avpriv_atomic_lock();
avpriv_atomic_unlock();
}
static inline void atomic_store(intptr_t *object, intptr_t desired)
{
avpriv_atomic_lock();
*object = desired;
avpriv_atomic_unlock();
}
#define atomic_store_explicit(object, desired, order) \
atomic_store(object, desired)
static inline intptr_t atomic_load(intptr_t *object)
{
intptr_t ret;
avpriv_atomic_lock();
ret = *object;
avpriv_atomic_unlock();
return ret;
}
#define atomic_load_explicit(object, order) \
atomic_load(object)
static inline intptr_t atomic_exchange(intptr_t *object, intptr_t desired)
{
intptr_t ret;
avpriv_atomic_lock();
ret = *object;
*object = desired;
avpriv_atomic_unlock();
return ret;
}
#define atomic_exchange_explicit(object, desired, order) \
atomic_exchange(object, desired)
static inline int atomic_compare_exchange_strong(intptr_t *object, intptr_t *expected,
intptr_t desired)
{
int ret;
avpriv_atomic_lock();
if (*object == *expected) {
ret = 1;
*object = desired;
} else {
ret = 0;
*expected = *object;
}
avpriv_atomic_unlock();
return ret;
}
#define atomic_compare_exchange_strong_explicit(object, expected, desired, success, failure) \
atomic_compare_exchange_strong(object, expected, desired)
#define atomic_compare_exchange_weak(object, expected, desired) \
atomic_compare_exchange_strong(object, expected, desired)
#define atomic_compare_exchange_weak_explicit(object, expected, desired, success, failure) \
atomic_compare_exchange_weak(object, expected, desired)
#define FETCH_MODIFY(opname, op) \
static inline intptr_t atomic_fetch_ ## opname(intptr_t *object, intptr_t operand) \
{ \
intptr_t ret; \
avpriv_atomic_lock(); \
ret = *object; \
*object = *object op operand; \
avpriv_atomic_unlock(); \
return ret; \
}
FETCH_MODIFY(add, +)
FETCH_MODIFY(sub, -)
FETCH_MODIFY(or, |)
FETCH_MODIFY(xor, ^)
FETCH_MODIFY(and, &)
#undef FETCH_MODIFY
#define atomic_fetch_add_explicit(object, operand, order) \
atomic_fetch_add(object, operand)
#define atomic_fetch_sub_explicit(object, operand, order) \
atomic_fetch_sub(object, operand)
#define atomic_fetch_or_explicit(object, operand, order) \
atomic_fetch_or(object, operand)
#define atomic_fetch_xor_explicit(object, operand, order) \
atomic_fetch_xor(object, operand)
#define atomic_fetch_and_explicit(object, operand, order) \
atomic_fetch_and(object, operand)
#define atomic_flag_test_and_set(object) \
atomic_exchange(object, 1)
#define atomic_flag_test_and_set_explicit(object, order) \
atomic_flag_test_and_set(object)
#define atomic_flag_clear(object) \
atomic_store(object, 0)
#define atomic_flag_clear_explicit(object, order) \
atomic_flag_clear(object)
#endif /* COMPAT_ATOMICS_PTHREAD_STDATOMIC_H */

View File

@@ -1,186 +0,0 @@
/*
* This file is part of FFmpeg.
*
* FFmpeg is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* FFmpeg is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with FFmpeg; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
#ifndef COMPAT_ATOMICS_SUNCC_STDATOMIC_H
#define COMPAT_ATOMICS_SUNCC_STDATOMIC_H
#include <atomic.h>
#include <mbarrier.h>
#include <stddef.h>
#include <stdint.h>
#define ATOMIC_FLAG_INIT 0
#define ATOMIC_VAR_INIT(value) (value)
#define atomic_init(obj, value) \
do { \
*(obj) = (value); \
} while(0)
#define kill_dependency(y) ((void)0)
#define atomic_thread_fence(order) \
__machine_rw_barrier();
#define atomic_signal_fence(order) \
((void)0)
#define atomic_is_lock_free(obj) 0
typedef intptr_t atomic_flag;
typedef intptr_t atomic_bool;
typedef intptr_t atomic_char;
typedef intptr_t atomic_schar;
typedef intptr_t atomic_uchar;
typedef intptr_t atomic_short;
typedef intptr_t atomic_ushort;
typedef intptr_t atomic_int;
typedef intptr_t atomic_uint;
typedef intptr_t atomic_long;
typedef intptr_t atomic_ulong;
typedef intptr_t atomic_llong;
typedef intptr_t atomic_ullong;
typedef intptr_t atomic_wchar_t;
typedef intptr_t atomic_int_least8_t;
typedef intptr_t atomic_uint_least8_t;
typedef intptr_t atomic_int_least16_t;
typedef intptr_t atomic_uint_least16_t;
typedef intptr_t atomic_int_least32_t;
typedef intptr_t atomic_uint_least32_t;
typedef intptr_t atomic_int_least64_t;
typedef intptr_t atomic_uint_least64_t;
typedef intptr_t atomic_int_fast8_t;
typedef intptr_t atomic_uint_fast8_t;
typedef intptr_t atomic_int_fast16_t;
typedef intptr_t atomic_uint_fast16_t;
typedef intptr_t atomic_int_fast32_t;
typedef intptr_t atomic_uint_fast32_t;
typedef intptr_t atomic_int_fast64_t;
typedef intptr_t atomic_uint_fast64_t;
typedef intptr_t atomic_intptr_t;
typedef intptr_t atomic_uintptr_t;
typedef intptr_t atomic_size_t;
typedef intptr_t atomic_ptrdiff_t;
typedef intptr_t atomic_intmax_t;
typedef intptr_t atomic_uintmax_t;
static inline void atomic_store(intptr_t *object, intptr_t desired)
{
*object = desired;
__machine_rw_barrier();
}
#define atomic_store_explicit(object, desired, order) \
atomic_store(object, desired)
static inline intptr_t atomic_load(intptr_t *object)
{
__machine_rw_barrier();
return *object;
}
#define atomic_load_explicit(object, order) \
atomic_load(object)
#define atomic_exchange(object, desired) \
atomic_swap_ptr(object, desired)
#define atomic_exchange_explicit(object, desired, order) \
atomic_exchange(object, desired)
static inline int atomic_compare_exchange_strong(intptr_t *object, intptr_t *expected,
intptr_t desired)
{
intptr_t old = *expected;
*expected = atomic_cas_ptr(object, old, desired);
return *expected == old;
}
#define atomic_compare_exchange_strong_explicit(object, expected, desired, success, failure) \
atomic_compare_exchange_strong(object, expected, desired)
#define atomic_compare_exchange_weak(object, expected, desired) \
atomic_compare_exchange_strong(object, expected, desired)
#define atomic_compare_exchange_weak_explicit(object, expected, desired, success, failure) \
atomic_compare_exchange_weak(object, expected, desired)
static inline intptr_t atomic_fetch_add(intptr_t *object, intptr_t operand)
{
return atomic_add_ptr_nv(object, operand) - operand;
}
#define atomic_fetch_sub(object, operand) \
atomic_fetch_add(object, -(operand))
static inline intptr_t atomic_fetch_or(intptr_t *object, intptr_t operand)
{
intptr_t old;
do {
old = atomic_load(object);
} while (!atomic_compare_exchange_strong(object, old, old | operand));
return old;
}
static inline intptr_t atomic_fetch_xor(intptr_t *object, intptr_t operand)
{
intptr_t old;
do {
old = atomic_load(object);
} while (!atomic_compare_exchange_strong(object, old, old ^ operand));
return old;
}
static inline intptr_t atomic_fetch_and(intptr_t *object, intptr_t operand)
{
intptr_t old;
do {
old = atomic_load(object);
} while (!atomic_compare_exchange_strong(object, old, old & operand));
return old;
}
#define atomic_fetch_add_explicit(object, operand, order) \
atomic_fetch_add(object, operand)
#define atomic_fetch_sub_explicit(object, operand, order) \
atomic_fetch_sub(object, operand)
#define atomic_fetch_or_explicit(object, operand, order) \
atomic_fetch_or(object, operand)
#define atomic_fetch_xor_explicit(object, operand, order) \
atomic_fetch_xor(object, operand)
#define atomic_fetch_and_explicit(object, operand, order) \
atomic_fetch_and(object, operand)
#define atomic_flag_test_and_set(object) \
atomic_exchange(object, 1)
#define atomic_flag_test_and_set_explicit(object, order) \
atomic_flag_test_and_set(object)
#define atomic_flag_clear(object) \
atomic_store(object, 0)
#define atomic_flag_clear_explicit(object, order) \
atomic_flag_clear(object)
#endif /* COMPAT_ATOMICS_SUNCC_STDATOMIC_H */

View File

@@ -1,179 +0,0 @@
/*
* This file is part of FFmpeg.
*
* FFmpeg is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* FFmpeg is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with FFmpeg; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
#ifndef COMPAT_ATOMICS_WIN32_STDATOMIC_H
#define COMPAT_ATOMICS_WIN32_STDATOMIC_H
#include <stddef.h>
#include <stdint.h>
#include <windows.h>
#define ATOMIC_FLAG_INIT 0
#define ATOMIC_VAR_INIT(value) (value)
#define atomic_init(obj, value) \
do { \
*(obj) = (value); \
} while(0)
#define kill_dependency(y) ((void)0)
#define atomic_thread_fence(order) \
MemoryBarrier();
#define atomic_signal_fence(order) \
((void)0)
#define atomic_is_lock_free(obj) 0
typedef intptr_t atomic_flag;
typedef intptr_t atomic_bool;
typedef intptr_t atomic_char;
typedef intptr_t atomic_schar;
typedef intptr_t atomic_uchar;
typedef intptr_t atomic_short;
typedef intptr_t atomic_ushort;
typedef intptr_t atomic_int;
typedef intptr_t atomic_uint;
typedef intptr_t atomic_long;
typedef intptr_t atomic_ulong;
typedef intptr_t atomic_llong;
typedef intptr_t atomic_ullong;
typedef intptr_t atomic_wchar_t;
typedef intptr_t atomic_int_least8_t;
typedef intptr_t atomic_uint_least8_t;
typedef intptr_t atomic_int_least16_t;
typedef intptr_t atomic_uint_least16_t;
typedef intptr_t atomic_int_least32_t;
typedef intptr_t atomic_uint_least32_t;
typedef intptr_t atomic_int_least64_t;
typedef intptr_t atomic_uint_least64_t;
typedef intptr_t atomic_int_fast8_t;
typedef intptr_t atomic_uint_fast8_t;
typedef intptr_t atomic_int_fast16_t;
typedef intptr_t atomic_uint_fast16_t;
typedef intptr_t atomic_int_fast32_t;
typedef intptr_t atomic_uint_fast32_t;
typedef intptr_t atomic_int_fast64_t;
typedef intptr_t atomic_uint_fast64_t;
typedef intptr_t atomic_intptr_t;
typedef intptr_t atomic_uintptr_t;
typedef intptr_t atomic_size_t;
typedef intptr_t atomic_ptrdiff_t;
typedef intptr_t atomic_intmax_t;
typedef intptr_t atomic_uintmax_t;
#define atomic_store(object, desired) \
do { \
*(object) = (desired); \
MemoryBarrier(); \
} while (0)
#define atomic_store_explicit(object, desired, order) \
atomic_store(object, desired)
#define atomic_load(object) \
(MemoryBarrier(), *(object))
#define atomic_load_explicit(object, order) \
atomic_load(object)
#define atomic_exchange(object, desired) \
InterlockedExchangePointer(object, desired);
#define atomic_exchange_explicit(object, desired, order) \
atomic_exchange(object, desired)
static inline int atomic_compare_exchange_strong(intptr_t *object, intptr_t *expected,
intptr_t desired)
{
intptr_t old = *expected;
*expected = InterlockedCompareExchangePointer(object, desired, old);
return *expected == old;
}
#define atomic_compare_exchange_strong_explicit(object, expected, desired, success, failure) \
atomic_compare_exchange_strong(object, expected, desired)
#define atomic_compare_exchange_weak(object, expected, desired) \
atomic_compare_exchange_strong(object, expected, desired)
#define atomic_compare_exchange_weak_explicit(object, expected, desired, success, failure) \
atomic_compare_exchange_weak(object, expected, desired)
#ifdef _WIN64
#define atomic_fetch_add(object, operand) \
InterlockedExchangeAdd64(object, operand)
#define atomic_fetch_sub(object, operand) \
InterlockedExchangeAdd64(object, -(operand))
#define atomic_fetch_or(object, operand) \
InterlockedOr64(object, operand)
#define atomic_fetch_xor(object, operand) \
InterlockedXor64(object, operand)
#define atomic_fetch_and(object, operand) \
InterlockedAnd64(object, operand)
#else
#define atomic_fetch_add(object, operand) \
InterlockedExchangeAdd(object, operand)
#define atomic_fetch_sub(object, operand) \
InterlockedExchangeAdd(object, -(operand))
#define atomic_fetch_or(object, operand) \
InterlockedOr(object, operand)
#define atomic_fetch_xor(object, operand) \
InterlockedXor(object, operand)
#define atomic_fetch_and(object, operand) \
InterlockedAnd(object, operand)
#endif /* _WIN64 */
#define atomic_fetch_add_explicit(object, operand, order) \
atomic_fetch_add(object, operand)
#define atomic_fetch_sub_explicit(object, operand, order) \
atomic_fetch_sub(object, operand)
#define atomic_fetch_or_explicit(object, operand, order) \
atomic_fetch_or(object, operand)
#define atomic_fetch_xor_explicit(object, operand, order) \
atomic_fetch_xor(object, operand)
#define atomic_fetch_and_explicit(object, operand, order) \
atomic_fetch_and(object, operand)
#define atomic_flag_test_and_set(object) \
atomic_exchange(object, 1)
#define atomic_flag_test_and_set_explicit(object, order) \
atomic_flag_test_and_set(object)
#define atomic_flag_clear(object) \
atomic_store(object, 0)
#define atomic_flag_clear_explicit(object, order) \
atomic_flag_clear(object)
#endif /* COMPAT_ATOMICS_WIN32_STDATOMIC_H */

View File

@@ -35,6 +35,10 @@
#if !defined(__CUDA_VIDEO_H__)
#define __CUDA_VIDEO_H__
#ifndef __cuda_cuda_h__
#include <cuda.h>
#endif // __cuda_cuda_h__
#if defined(__x86_64) || defined(AMD64) || defined(_M_AMD64)
#if (CUDA_VERSION >= 3020) && (!defined(CUDA_FORCE_API_VERSION) || (CUDA_FORCE_API_VERSION >= 3020))
#define __CUVID_DEVPTR64
@@ -45,12 +49,6 @@
extern "C" {
#endif /* __cplusplus */
#if defined(__CYGWIN__)
typedef unsigned int tcu_ulong;
#else
typedef unsigned long tcu_ulong;
#endif
typedef void *CUvideodecoder;
typedef struct _CUcontextlock_st *CUvideoctxlock;
@@ -89,8 +87,7 @@ typedef enum cudaVideoCodec_enum {
* Video Surface Formats Enums
*/
typedef enum cudaVideoSurfaceFormat_enum {
cudaVideoSurfaceFormat_NV12=0, /**< NV12 */
cudaVideoSurfaceFormat_P016=1 /**< P016 */
cudaVideoSurfaceFormat_NV12=0 /**< NV12 (currently the only supported output format) */
} cudaVideoSurfaceFormat;
/*!
@@ -131,14 +128,14 @@ typedef enum cudaVideoCreateFlags_enum {
*/
typedef struct _CUVIDDECODECREATEINFO
{
tcu_ulong ulWidth; /**< Coded Sequence Width */
tcu_ulong ulHeight; /**< Coded Sequence Height */
tcu_ulong ulNumDecodeSurfaces; /**< Maximum number of internal decode surfaces */
unsigned long ulWidth; /**< Coded Sequence Width */
unsigned long ulHeight; /**< Coded Sequence Height */
unsigned long ulNumDecodeSurfaces; /**< Maximum number of internal decode surfaces */
cudaVideoCodec CodecType; /**< cudaVideoCodec_XXX */
cudaVideoChromaFormat ChromaFormat; /**< cudaVideoChromaFormat_XXX (only 4:2:0 is currently supported) */
tcu_ulong ulCreationFlags; /**< Decoder creation flags (cudaVideoCreateFlags_XXX) */
tcu_ulong bitDepthMinus8;
tcu_ulong Reserved1[4]; /**< Reserved for future use - set to zero */
unsigned long ulCreationFlags; /**< Decoder creation flags (cudaVideoCreateFlags_XXX) */
unsigned long bitDepthMinus8;
unsigned long Reserved1[4]; /**< Reserved for future use - set to zero */
/**
* area of the frame that should be displayed
*/
@@ -151,9 +148,9 @@ typedef struct _CUVIDDECODECREATEINFO
cudaVideoSurfaceFormat OutputFormat; /**< cudaVideoSurfaceFormat_XXX */
cudaVideoDeinterlaceMode DeinterlaceMode; /**< cudaVideoDeinterlaceMode_XXX */
tcu_ulong ulTargetWidth; /**< Post-processed Output Width (Should be aligned to 2) */
tcu_ulong ulTargetHeight; /**< Post-processed Output Height (Should be aligbed to 2) */
tcu_ulong ulNumOutputSurfaces; /**< Maximum number of output surfaces simultaneously mapped */
unsigned long ulTargetWidth; /**< Post-processed Output Width (Should be aligned to 2) */
unsigned long ulTargetHeight; /**< Post-processed Output Height (Should be aligbed to 2) */
unsigned long ulNumOutputSurfaces; /**< Maximum number of output surfaces simultaneously mapped */
CUvideoctxlock vidLock; /**< If non-NULL, context lock used for synchronizing ownership of the cuda context */
/**
* target rectangle in the output frame (for aspect ratio conversion)
@@ -165,7 +162,7 @@ typedef struct _CUVIDDECODECREATEINFO
short right;
short bottom;
} target_rect;
tcu_ulong Reserved2[5]; /**< Reserved for future use - set to zero */
unsigned long Reserved2[5]; /**< Reserved for future use - set to zero */
} CUVIDDECODECREATEINFO;
/*!
@@ -297,7 +294,7 @@ typedef struct _CUVIDH264PICPARAMS
{
CUVIDH264MVCEXT mvcext;
CUVIDH264SVCEXT svcext;
} svcmvc;
};
} CUVIDH264PICPARAMS;
@@ -555,7 +552,7 @@ typedef struct _CUVIDVP8PICPARAMS
unsigned char Reserved2Bits : 2;
};
unsigned char wFrameTagFlags;
} tagflags;
};
unsigned char Reserved1[4];
unsigned int Reserved2[3];
} CUVIDVP8PICPARAMS;
@@ -718,19 +715,19 @@ typedef struct _CUVIDPROCPARAMS
* \fn CUresult CUDAAPI cuvidCreateDecoder(CUvideodecoder *phDecoder, CUVIDDECODECREATEINFO *pdci)
* Create the decoder object
*/
typedef CUresult CUDAAPI tcuvidCreateDecoder(CUvideodecoder *phDecoder, CUVIDDECODECREATEINFO *pdci);
CUresult CUDAAPI cuvidCreateDecoder(CUvideodecoder *phDecoder, CUVIDDECODECREATEINFO *pdci);
/**
* \fn CUresult CUDAAPI cuvidDestroyDecoder(CUvideodecoder hDecoder)
* Destroy the decoder object
*/
typedef CUresult CUDAAPI tcuvidDestroyDecoder(CUvideodecoder hDecoder);
CUresult CUDAAPI cuvidDestroyDecoder(CUvideodecoder hDecoder);
/**
* \fn CUresult CUDAAPI cuvidDecodePicture(CUvideodecoder hDecoder, CUVIDPICPARAMS *pPicParams)
* Decode a single picture (field or frame)
*/
typedef CUresult CUDAAPI tcuvidDecodePicture(CUvideodecoder hDecoder, CUVIDPICPARAMS *pPicParams);
CUresult CUDAAPI cuvidDecodePicture(CUvideodecoder hDecoder, CUVIDPICPARAMS *pPicParams);
#if !defined(__CUVID_DEVPTR64) || defined(__CUVID_INTERNAL)
@@ -738,15 +735,15 @@ typedef CUresult CUDAAPI tcuvidDecodePicture(CUvideodecoder hDecoder, CUVIDPICPA
* \fn CUresult CUDAAPI cuvidMapVideoFrame(CUvideodecoder hDecoder, int nPicIdx, unsigned int *pDevPtr, unsigned int *pPitch, CUVIDPROCPARAMS *pVPP);
* Post-process and map a video frame for use in cuda
*/
typedef CUresult CUDAAPI tcuvidMapVideoFrame(CUvideodecoder hDecoder, int nPicIdx,
unsigned int *pDevPtr, unsigned int *pPitch,
CUVIDPROCPARAMS *pVPP);
CUresult CUDAAPI cuvidMapVideoFrame(CUvideodecoder hDecoder, int nPicIdx,
unsigned int *pDevPtr, unsigned int *pPitch,
CUVIDPROCPARAMS *pVPP);
/**
* \fn CUresult CUDAAPI cuvidUnmapVideoFrame(CUvideodecoder hDecoder, unsigned int DevPtr)
* Unmap a previously mapped video frame
*/
typedef CUresult CUDAAPI tcuvidUnmapVideoFrame(CUvideodecoder hDecoder, unsigned int DevPtr);
CUresult CUDAAPI cuvidUnmapVideoFrame(CUvideodecoder hDecoder, unsigned int DevPtr);
#endif
#if defined(WIN64) || defined(_WIN64) || defined(__x86_64) || defined(AMD64) || defined(_M_AMD64)
@@ -754,22 +751,23 @@ typedef CUresult CUDAAPI tcuvidUnmapVideoFrame(CUvideodecoder hDecoder, unsigned
* \fn CUresult CUDAAPI cuvidMapVideoFrame64(CUvideodecoder hDecoder, int nPicIdx, unsigned long long *pDevPtr, unsigned int *pPitch, CUVIDPROCPARAMS *pVPP);
* map a video frame
*/
typedef CUresult CUDAAPI tcuvidMapVideoFrame64(CUvideodecoder hDecoder, int nPicIdx, unsigned long long *pDevPtr,
unsigned int *pPitch, CUVIDPROCPARAMS *pVPP);
CUresult CUDAAPI cuvidMapVideoFrame64(CUvideodecoder hDecoder, int nPicIdx, unsigned long long *pDevPtr,
unsigned int *pPitch, CUVIDPROCPARAMS *pVPP);
/**
* \fn CUresult CUDAAPI cuvidUnmapVideoFrame64(CUvideodecoder hDecoder, unsigned long long DevPtr);
* Unmap a previously mapped video frame
*/
typedef CUresult CUDAAPI tcuvidUnmapVideoFrame64(CUvideodecoder hDecoder, unsigned long long DevPtr);
CUresult CUDAAPI cuvidUnmapVideoFrame64(CUvideodecoder hDecoder, unsigned long long DevPtr);
#if defined(__CUVID_DEVPTR64) && !defined(__CUVID_INTERNAL)
#define tcuvidMapVideoFrame tcuvidMapVideoFrame64
#define tcuvidUnmapVideoFrame tcuvidUnmapVideoFrame64
#define cuvidMapVideoFrame cuvidMapVideoFrame64
#define cuvidUnmapVideoFrame cuvidUnmapVideoFrame64
#endif
#endif
/**
*
* Context-locking: to facilitate multi-threaded implementations, the following 4 functions
@@ -789,27 +787,41 @@ typedef CUresult CUDAAPI tcuvidUnmapVideoFrame64(CUvideodecoder hDecoder, unsign
/**
* \fn CUresult CUDAAPI cuvidCtxLockCreate(CUvideoctxlock *pLock, CUcontext ctx)
*/
typedef CUresult CUDAAPI tcuvidCtxLockCreate(CUvideoctxlock *pLock, CUcontext ctx);
CUresult CUDAAPI cuvidCtxLockCreate(CUvideoctxlock *pLock, CUcontext ctx);
/**
* \fn CUresult CUDAAPI cuvidCtxLockDestroy(CUvideoctxlock lck)
*/
typedef CUresult CUDAAPI tcuvidCtxLockDestroy(CUvideoctxlock lck);
CUresult CUDAAPI cuvidCtxLockDestroy(CUvideoctxlock lck);
/**
* \fn CUresult CUDAAPI cuvidCtxLock(CUvideoctxlock lck, unsigned int reserved_flags)
*/
typedef CUresult CUDAAPI tcuvidCtxLock(CUvideoctxlock lck, unsigned int reserved_flags);
CUresult CUDAAPI cuvidCtxLock(CUvideoctxlock lck, unsigned int reserved_flags);
/**
* \fn CUresult CUDAAPI cuvidCtxUnlock(CUvideoctxlock lck, unsigned int reserved_flags)
*/
typedef CUresult CUDAAPI tcuvidCtxUnlock(CUvideoctxlock lck, unsigned int reserved_flags);
CUresult CUDAAPI cuvidCtxUnlock(CUvideoctxlock lck, unsigned int reserved_flags);
/** @} */ /* End VIDEO_DECODER */
////////////////////////////////////////////////////////////////////////////////////////////////
#if defined(__cplusplus)
// Auto-lock helper for C++ applications
class CCtxAutoLock
{
private:
CUvideoctxlock m_ctx;
public:
CCtxAutoLock(CUvideoctxlock ctx);
~CCtxAutoLock();
};
}
#endif /* __cplusplus */
#endif // __CUDA_VIDEO_H__

View File

@@ -1,97 +0,0 @@
/*
* This copyright notice applies to this header file only:
*
* Copyright (c) 2016
*
* Permission is hereby granted, free of charge, to any person
* obtaining a copy of this software and associated documentation
* files (the "Software"), to deal in the Software without
* restriction, including without limitation the rights to use,
* copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the software, and to permit persons to whom the
* software is furnished to do so, subject to the following
* conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
* OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
* HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
* OTHER DEALINGS IN THE SOFTWARE.
*/
#if !defined(AV_COMPAT_DYNLINK_CUDA_H) && !defined(CUDA_VERSION)
#define AV_COMPAT_DYNLINK_CUDA_H
#include <stddef.h>
#define CUDA_VERSION 7050
#if defined(_WIN32) || defined(__CYGWIN__)
#define CUDAAPI __stdcall
#else
#define CUDAAPI
#endif
#define CU_CTX_SCHED_BLOCKING_SYNC 4
typedef int CUdevice;
typedef void* CUarray;
typedef void* CUcontext;
#if defined(__x86_64) || defined(AMD64) || defined(_M_AMD64)
typedef unsigned long long CUdeviceptr;
#else
typedef unsigned int CUdeviceptr;
#endif
typedef enum cudaError_enum {
CUDA_SUCCESS = 0
} CUresult;
typedef enum CUmemorytype_enum {
CU_MEMORYTYPE_HOST = 1,
CU_MEMORYTYPE_DEVICE = 2
} CUmemorytype;
typedef struct CUDA_MEMCPY2D_st {
size_t srcXInBytes;
size_t srcY;
CUmemorytype srcMemoryType;
const void *srcHost;
CUdeviceptr srcDevice;
CUarray srcArray;
size_t srcPitch;
size_t dstXInBytes;
size_t dstY;
CUmemorytype dstMemoryType;
void *dstHost;
CUdeviceptr dstDevice;
CUarray dstArray;
size_t dstPitch;
size_t WidthInBytes;
size_t Height;
} CUDA_MEMCPY2D;
typedef CUresult CUDAAPI tcuInit(unsigned int Flags);
typedef CUresult CUDAAPI tcuDeviceGetCount(int *count);
typedef CUresult CUDAAPI tcuDeviceGet(CUdevice *device, int ordinal);
typedef CUresult CUDAAPI tcuDeviceGetName(char *name, int len, CUdevice dev);
typedef CUresult CUDAAPI tcuDeviceComputeCapability(int *major, int *minor, CUdevice dev);
typedef CUresult CUDAAPI tcuCtxCreate_v2(CUcontext *pctx, unsigned int flags, CUdevice dev);
typedef CUresult CUDAAPI tcuCtxPushCurrent_v2(CUcontext *pctx);
typedef CUresult CUDAAPI tcuCtxPopCurrent_v2(CUcontext *pctx);
typedef CUresult CUDAAPI tcuCtxDestroy_v2(CUcontext ctx);
typedef CUresult CUDAAPI tcuMemAlloc_v2(CUdeviceptr *dptr, size_t bytesize);
typedef CUresult CUDAAPI tcuMemFree_v2(CUdeviceptr dptr);
typedef CUresult CUDAAPI tcuMemcpy2D_v2(const CUDA_MEMCPY2D *pcopy);
typedef CUresult CUDAAPI tcuGetErrorName(CUresult error, const char** pstr);
typedef CUresult CUDAAPI tcuGetErrorString(CUresult error, const char** pstr);
#endif

View File

@@ -1,254 +0,0 @@
/*
* This copyright notice applies to this header file only:
*
* Copyright (c) 2016
*
* Permission is hereby granted, free of charge, to any person
* obtaining a copy of this software and associated documentation
* files (the "Software"), to deal in the Software without
* restriction, including without limitation the rights to use,
* copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the software, and to permit persons to whom the
* software is furnished to do so, subject to the following
* conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
* OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
* HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
* OTHER DEALINGS IN THE SOFTWARE.
*/
#ifndef AV_COMPAT_CUDA_DYNLINK_LOADER_H
#define AV_COMPAT_CUDA_DYNLINK_LOADER_H
#include "compat/cuda/dynlink_cuda.h"
#include "compat/cuda/dynlink_nvcuvid.h"
#include "compat/nvenc/nvEncodeAPI.h"
#include "compat/w32dlfcn.h"
#include "libavutil/log.h"
#include "libavutil/error.h"
#if defined(_WIN32)
# define LIB_HANDLE HMODULE
#else
# define LIB_HANDLE void*
#endif
#if defined(_WIN32) || defined(__CYGWIN__)
# define CUDA_LIBNAME "nvcuda.dll"
# define NVCUVID_LIBNAME "nvcuvid.dll"
# if ARCH_X86_64
# define NVENC_LIBNAME "nvEncodeAPI64.dll"
# else
# define NVENC_LIBNAME "nvEncodeAPI.dll"
# endif
#else
# define CUDA_LIBNAME "libcuda.so.1"
# define NVCUVID_LIBNAME "libnvcuvid.so.1"
# define NVENC_LIBNAME "libnvidia-encode.so.1"
#endif
#define LOAD_LIBRARY(l, path) \
do { \
if (!((l) = dlopen(path, RTLD_LAZY))) { \
av_log(NULL, AV_LOG_ERROR, "Cannot load %s\n", path); \
ret = AVERROR_UNKNOWN; \
goto error; \
} \
av_log(NULL, AV_LOG_TRACE, "Loaded lib: %s\n", path); \
} while (0)
#define LOAD_SYMBOL(fun, symbol) \
do { \
if (!((f->fun) = dlsym(f->lib, symbol))) { \
av_log(NULL, AV_LOG_ERROR, "Cannot load %s\n", symbol); \
ret = AVERROR_UNKNOWN; \
goto error; \
} \
av_log(NULL, AV_LOG_TRACE, "Loaded sym: %s\n", symbol); \
} while (0)
#define GENERIC_LOAD_FUNC_PREAMBLE(T, n, N) \
T *f; \
int ret; \
\
n##_free_functions(functions); \
\
f = *functions = av_mallocz(sizeof(*f)); \
if (!f) \
return AVERROR(ENOMEM); \
\
LOAD_LIBRARY(f->lib, N);
#define GENERIC_LOAD_FUNC_FINALE(n) \
return 0; \
error: \
n##_free_functions(functions); \
return ret;
#define GENERIC_FREE_FUNC() \
if (!functions) \
return; \
if (*functions && (*functions)->lib) \
dlclose((*functions)->lib); \
av_freep(functions);
#ifdef AV_COMPAT_DYNLINK_CUDA_H
typedef struct CudaFunctions {
tcuInit *cuInit;
tcuDeviceGetCount *cuDeviceGetCount;
tcuDeviceGet *cuDeviceGet;
tcuDeviceGetName *cuDeviceGetName;
tcuDeviceComputeCapability *cuDeviceComputeCapability;
tcuCtxCreate_v2 *cuCtxCreate;
tcuCtxPushCurrent_v2 *cuCtxPushCurrent;
tcuCtxPopCurrent_v2 *cuCtxPopCurrent;
tcuCtxDestroy_v2 *cuCtxDestroy;
tcuMemAlloc_v2 *cuMemAlloc;
tcuMemFree_v2 *cuMemFree;
tcuMemcpy2D_v2 *cuMemcpy2D;
tcuGetErrorName *cuGetErrorName;
tcuGetErrorString *cuGetErrorString;
LIB_HANDLE lib;
} CudaFunctions;
#else
typedef struct CudaFunctions CudaFunctions;
#endif
typedef struct CuvidFunctions {
tcuvidCreateDecoder *cuvidCreateDecoder;
tcuvidDestroyDecoder *cuvidDestroyDecoder;
tcuvidDecodePicture *cuvidDecodePicture;
tcuvidMapVideoFrame *cuvidMapVideoFrame;
tcuvidUnmapVideoFrame *cuvidUnmapVideoFrame;
tcuvidCtxLockCreate *cuvidCtxLockCreate;
tcuvidCtxLockDestroy *cuvidCtxLockDestroy;
tcuvidCtxLock *cuvidCtxLock;
tcuvidCtxUnlock *cuvidCtxUnlock;
tcuvidCreateVideoSource *cuvidCreateVideoSource;
tcuvidCreateVideoSourceW *cuvidCreateVideoSourceW;
tcuvidDestroyVideoSource *cuvidDestroyVideoSource;
tcuvidSetVideoSourceState *cuvidSetVideoSourceState;
tcuvidGetVideoSourceState *cuvidGetVideoSourceState;
tcuvidGetSourceVideoFormat *cuvidGetSourceVideoFormat;
tcuvidGetSourceAudioFormat *cuvidGetSourceAudioFormat;
tcuvidCreateVideoParser *cuvidCreateVideoParser;
tcuvidParseVideoData *cuvidParseVideoData;
tcuvidDestroyVideoParser *cuvidDestroyVideoParser;
LIB_HANDLE lib;
} CuvidFunctions;
typedef struct NvencFunctions {
NVENCSTATUS (NVENCAPI *NvEncodeAPICreateInstance)(NV_ENCODE_API_FUNCTION_LIST *functionList);
NVENCSTATUS (NVENCAPI *NvEncodeAPIGetMaxSupportedVersion)(uint32_t* version);
LIB_HANDLE lib;
} NvencFunctions;
#ifdef AV_COMPAT_DYNLINK_CUDA_H
static inline void cuda_free_functions(CudaFunctions **functions)
{
GENERIC_FREE_FUNC();
}
#endif
static inline void cuvid_free_functions(CuvidFunctions **functions)
{
GENERIC_FREE_FUNC();
}
static inline void nvenc_free_functions(NvencFunctions **functions)
{
GENERIC_FREE_FUNC();
}
#ifdef AV_COMPAT_DYNLINK_CUDA_H
static inline int cuda_load_functions(CudaFunctions **functions)
{
GENERIC_LOAD_FUNC_PREAMBLE(CudaFunctions, cuda, CUDA_LIBNAME);
LOAD_SYMBOL(cuInit, "cuInit");
LOAD_SYMBOL(cuDeviceGetCount, "cuDeviceGetCount");
LOAD_SYMBOL(cuDeviceGet, "cuDeviceGet");
LOAD_SYMBOL(cuDeviceGetName, "cuDeviceGetName");
LOAD_SYMBOL(cuDeviceComputeCapability, "cuDeviceComputeCapability");
LOAD_SYMBOL(cuCtxCreate, "cuCtxCreate_v2");
LOAD_SYMBOL(cuCtxPushCurrent, "cuCtxPushCurrent_v2");
LOAD_SYMBOL(cuCtxPopCurrent, "cuCtxPopCurrent_v2");
LOAD_SYMBOL(cuCtxDestroy, "cuCtxDestroy_v2");
LOAD_SYMBOL(cuMemAlloc, "cuMemAlloc_v2");
LOAD_SYMBOL(cuMemFree, "cuMemFree_v2");
LOAD_SYMBOL(cuMemcpy2D, "cuMemcpy2D_v2");
LOAD_SYMBOL(cuGetErrorName, "cuGetErrorName");
LOAD_SYMBOL(cuGetErrorString, "cuGetErrorString");
GENERIC_LOAD_FUNC_FINALE(cuda);
}
#endif
static inline int cuvid_load_functions(CuvidFunctions **functions)
{
GENERIC_LOAD_FUNC_PREAMBLE(CuvidFunctions, cuvid, NVCUVID_LIBNAME);
LOAD_SYMBOL(cuvidCreateDecoder, "cuvidCreateDecoder");
LOAD_SYMBOL(cuvidDestroyDecoder, "cuvidDestroyDecoder");
LOAD_SYMBOL(cuvidDecodePicture, "cuvidDecodePicture");
#ifdef __CUVID_DEVPTR64
LOAD_SYMBOL(cuvidMapVideoFrame, "cuvidMapVideoFrame64");
LOAD_SYMBOL(cuvidUnmapVideoFrame, "cuvidUnmapVideoFrame64");
#else
LOAD_SYMBOL(cuvidMapVideoFrame, "cuvidMapVideoFrame");
LOAD_SYMBOL(cuvidUnmapVideoFrame, "cuvidUnmapVideoFrame");
#endif
LOAD_SYMBOL(cuvidCtxLockCreate, "cuvidCtxLockCreate");
LOAD_SYMBOL(cuvidCtxLockDestroy, "cuvidCtxLockDestroy");
LOAD_SYMBOL(cuvidCtxLock, "cuvidCtxLock");
LOAD_SYMBOL(cuvidCtxUnlock, "cuvidCtxUnlock");
LOAD_SYMBOL(cuvidCreateVideoSource, "cuvidCreateVideoSource");
LOAD_SYMBOL(cuvidCreateVideoSourceW, "cuvidCreateVideoSourceW");
LOAD_SYMBOL(cuvidDestroyVideoSource, "cuvidDestroyVideoSource");
LOAD_SYMBOL(cuvidSetVideoSourceState, "cuvidSetVideoSourceState");
LOAD_SYMBOL(cuvidGetVideoSourceState, "cuvidGetVideoSourceState");
LOAD_SYMBOL(cuvidGetSourceVideoFormat, "cuvidGetSourceVideoFormat");
LOAD_SYMBOL(cuvidGetSourceAudioFormat, "cuvidGetSourceAudioFormat");
LOAD_SYMBOL(cuvidCreateVideoParser, "cuvidCreateVideoParser");
LOAD_SYMBOL(cuvidParseVideoData, "cuvidParseVideoData");
LOAD_SYMBOL(cuvidDestroyVideoParser, "cuvidDestroyVideoParser");
GENERIC_LOAD_FUNC_FINALE(cuvid);
}
static inline int nvenc_load_functions(NvencFunctions **functions)
{
GENERIC_LOAD_FUNC_PREAMBLE(NvencFunctions, nvenc, NVENC_LIBNAME);
LOAD_SYMBOL(NvEncodeAPICreateInstance, "NvEncodeAPICreateInstance");
LOAD_SYMBOL(NvEncodeAPIGetMaxSupportedVersion, "NvEncodeAPIGetMaxSupportedVersion");
GENERIC_LOAD_FUNC_FINALE(nvenc);
}
#undef GENERIC_LOAD_FUNC_PREAMBLE
#undef LOAD_LIBRARY
#undef LOAD_SYMBOL
#undef GENERIC_LOAD_FUNC_FINALE
#undef GENERIC_FREE_FUNC
#undef CUDA_LIBNAME
#undef NVCUVID_LIBNAME
#undef NVENC_LIBNAME
#undef LIB_HANDLE
#endif

View File

@@ -35,12 +35,17 @@
#if !defined(__NVCUVID_H__)
#define __NVCUVID_H__
#include "compat/cuda/dynlink_cuviddec.h"
#include "compat/cuda/cuviddec.h"
#if defined(__cplusplus)
extern "C" {
#endif /* __cplusplus */
/*********************************
** Initialization
*********************************/
CUresult CUDAAPI cuvidInit(unsigned int Flags);
////////////////////////////////////////////////////////////////////////////////////////////////
//
// High-level helper APIs for video sources
@@ -173,8 +178,8 @@ typedef enum {
*/
typedef struct _CUVIDSOURCEDATAPACKET
{
tcu_ulong flags; /**< Combination of CUVID_PKT_XXX flags */
tcu_ulong payload_size; /**< number of bytes in the payload (may be zero if EOS flag is set) */
unsigned long flags; /**< Combination of CUVID_PKT_XXX flags */
unsigned long payload_size; /**< number of bytes in the payload (may be zero if EOS flag is set) */
const unsigned char *payload; /**< Pointer to packet payload data (may be NULL if EOS flag is set) */
CUvideotimestamp timestamp; /**< Presentation timestamp (10MHz clock), only valid if CUVID_PKT_TIMESTAMP flag is set */
} CUVIDSOURCEDATAPACKET;
@@ -209,43 +214,43 @@ typedef enum {
* \fn CUresult CUDAAPI cuvidCreateVideoSource(CUvideosource *pObj, const char *pszFileName, CUVIDSOURCEPARAMS *pParams)
* Create Video Source
*/
typedef CUresult CUDAAPI tcuvidCreateVideoSource(CUvideosource *pObj, const char *pszFileName, CUVIDSOURCEPARAMS *pParams);
CUresult CUDAAPI cuvidCreateVideoSource(CUvideosource *pObj, const char *pszFileName, CUVIDSOURCEPARAMS *pParams);
/**
* \fn CUresult CUDAAPI cuvidCreateVideoSourceW(CUvideosource *pObj, const wchar_t *pwszFileName, CUVIDSOURCEPARAMS *pParams)
* Create Video Source
*/
typedef CUresult CUDAAPI tcuvidCreateVideoSourceW(CUvideosource *pObj, const wchar_t *pwszFileName, CUVIDSOURCEPARAMS *pParams);
CUresult CUDAAPI cuvidCreateVideoSourceW(CUvideosource *pObj, const wchar_t *pwszFileName, CUVIDSOURCEPARAMS *pParams);
/**
* \fn CUresult CUDAAPI cuvidDestroyVideoSource(CUvideosource obj)
* Destroy Video Source
*/
typedef CUresult CUDAAPI tcuvidDestroyVideoSource(CUvideosource obj);
CUresult CUDAAPI cuvidDestroyVideoSource(CUvideosource obj);
/**
* \fn CUresult CUDAAPI cuvidSetVideoSourceState(CUvideosource obj, cudaVideoState state)
* Set Video Source state
*/
typedef CUresult CUDAAPI tcuvidSetVideoSourceState(CUvideosource obj, cudaVideoState state);
CUresult CUDAAPI cuvidSetVideoSourceState(CUvideosource obj, cudaVideoState state);
/**
* \fn cudaVideoState CUDAAPI cuvidGetVideoSourceState(CUvideosource obj)
* Get Video Source state
*/
typedef cudaVideoState CUDAAPI tcuvidGetVideoSourceState(CUvideosource obj);
cudaVideoState CUDAAPI cuvidGetVideoSourceState(CUvideosource obj);
/**
* \fn CUresult CUDAAPI cuvidGetSourceVideoFormat(CUvideosource obj, CUVIDEOFORMAT *pvidfmt, unsigned int flags)
* Get Video Source Format
*/
typedef CUresult CUDAAPI tcuvidGetSourceVideoFormat(CUvideosource obj, CUVIDEOFORMAT *pvidfmt, unsigned int flags);
CUresult CUDAAPI cuvidGetSourceVideoFormat(CUvideosource obj, CUVIDEOFORMAT *pvidfmt, unsigned int flags);
/**
* \fn CUresult CUDAAPI cuvidGetSourceAudioFormat(CUvideosource obj, CUAUDIOFORMAT *paudfmt, unsigned int flags)
* Set Video Source state
*/
typedef CUresult CUDAAPI tcuvidGetSourceAudioFormat(CUvideosource obj, CUAUDIOFORMAT *paudfmt, unsigned int flags);
CUresult CUDAAPI cuvidGetSourceAudioFormat(CUvideosource obj, CUAUDIOFORMAT *paudfmt, unsigned int flags);
#endif
@@ -292,17 +297,17 @@ typedef struct _CUVIDPARSERPARAMS
/**
* \fn CUresult CUDAAPI cuvidCreateVideoParser(CUvideoparser *pObj, CUVIDPARSERPARAMS *pParams)
*/
typedef CUresult CUDAAPI tcuvidCreateVideoParser(CUvideoparser *pObj, CUVIDPARSERPARAMS *pParams);
CUresult CUDAAPI cuvidCreateVideoParser(CUvideoparser *pObj, CUVIDPARSERPARAMS *pParams);
/**
* \fn CUresult CUDAAPI cuvidParseVideoData(CUvideoparser obj, CUVIDSOURCEDATAPACKET *pPacket)
*/
typedef CUresult CUDAAPI tcuvidParseVideoData(CUvideoparser obj, CUVIDSOURCEDATAPACKET *pPacket);
CUresult CUDAAPI cuvidParseVideoData(CUvideoparser obj, CUVIDSOURCEDATAPACKET *pPacket);
/**
* \fn CUresult CUDAAPI cuvidDestroyVideoParser(CUvideoparser obj)
*/
typedef CUresult CUDAAPI tcuvidDestroyVideoParser(CUvideoparser obj);
CUresult CUDAAPI cuvidDestroyVideoParser(CUvideoparser obj);
/** @} */ /* END VIDEO_PARSER */
////////////////////////////////////////////////////////////////////////////////////////////////

View File

@@ -1,83 +0,0 @@
/*
* This file is part of FFmpeg.
*
* FFmpeg is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* FFmpeg is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with FFmpeg; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
#ifndef COMPAT_W32DLFCN_H
#define COMPAT_W32DLFCN_H
#ifdef _WIN32
#include <windows.h>
#if _WIN32_WINNT < 0x0602
#include "libavutil/wchar_filename.h"
#endif
/**
* Safe function used to open dynamic libs. This attempts to improve program security
* by removing the current directory from the dll search path. Only dll's found in the
* executable or system directory are allowed to be loaded.
* @param name The dynamic lib name.
* @return A handle to the opened lib.
*/
static inline HMODULE win32_dlopen(const char *name)
{
#if _WIN32_WINNT < 0x0602
// Need to check if KB2533623 is available
if (!GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "SetDefaultDllDirectories")) {
HMODULE module = NULL;
wchar_t *path = NULL, *name_w = NULL;
DWORD pathlen;
if (utf8towchar(name, &name_w))
goto exit;
path = (wchar_t *)av_mallocz_array(MAX_PATH, sizeof(wchar_t));
// Try local directory first
pathlen = GetModuleFileNameW(NULL, path, MAX_PATH);
pathlen = wcsrchr(path, '\\') - path;
if (pathlen == 0 || pathlen + wcslen(name_w) + 2 > MAX_PATH)
goto exit;
path[pathlen] = '\\';
wcscpy(path + pathlen + 1, name_w);
module = LoadLibraryExW(path, NULL, LOAD_WITH_ALTERED_SEARCH_PATH);
if (module == NULL) {
// Next try System32 directory
pathlen = GetSystemDirectoryW(path, MAX_PATH);
if (pathlen == 0 || pathlen + wcslen(name_w) + 2 > MAX_PATH)
goto exit;
path[pathlen] = '\\';
wcscpy(path + pathlen + 1, name_w);
module = LoadLibraryExW(path, NULL, LOAD_WITH_ALTERED_SEARCH_PATH);
}
exit:
av_free(path);
av_free(name_w);
return module;
}
#endif
#ifndef LOAD_LIBRARY_SEARCH_APPLICATION_DIR
# define LOAD_LIBRARY_SEARCH_APPLICATION_DIR 0x00000200
#endif
#ifndef LOAD_LIBRARY_SEARCH_SYSTEM32
# define LOAD_LIBRARY_SEARCH_SYSTEM32 0x00000800
#endif
return LoadLibraryExA(name, NULL, LOAD_LIBRARY_SEARCH_APPLICATION_DIR | LOAD_LIBRARY_SEARCH_SYSTEM32);
}
#define dlopen(name, flags) win32_dlopen(name)
#define dlclose FreeLibrary
#define dlsym GetProcAddress
#else
#include <dlfcn.h>
#endif
#endif /* COMPAT_W32DLFCN_H */

670
configure vendored

File diff suppressed because it is too large Load Diff

View File

@@ -15,117 +15,6 @@ libavutil: 2015-08-28
API changes, most recent first:
2017-03-31 - xxxxxxx - lavu 55.57.100 - spherical.h
Add av_spherical_projection_name().
Add av_spherical_from_name().
2017-03-30 - xxxxxxx - lavu 55.53.100 / 55.27.0 - hwcontext.h
Add av_hwframe_map() and associated AV_HWFRAME_MAP_* flags.
Add av_hwframe_ctx_create_derived().
2017-03-29 - bfdcdd6d82 - lavu 55.52.100 - avutil.h
add av_fourcc_make_string() function and av_fourcc2str() macro to replace
av_get_codec_tag_string() from lavc.
2017-03-27 - ddef3d902f - lavf 57.68.100 - avformat.h
Deprecate that demuxers export the stream rotation angle in AVStream.metadata
(via an entry named "rotate"). Use av_stream_get_side_data() with
AV_PKT_DATA_DISPLAYMATRIX instead, and read the rotation angle with
av_display_rotation_get(). The same is done for muxing. Instead of adding a
"rotate" entry to AVStream.metadata, AV_PKT_DATA_DISPLAYMATRIX side data has
to be added to the AVStream.
2017-03-23 - 7e4ba776a2 - lavc 57.85.101 - avcodec.h
vdpau hardware accelerated decoding now supports the new hwaccel API, which
can create the decoder context and allocate hardware frame automatically.
See AVCodecContext.hw_device_ctx and AVCodecContext.hw_frames_ctx.
2017-03-23 - 156bd8278f - lavc 57.85.100 - avcodec.h
Add AVCodecContext.hwaccel_flags field. This will control some hwaccels at
a later point.
2017-03-21 - xxxxxxx - lavf 57.67.100 / 57.08.0 - avio.h
Add AVIO_SEEKABLE_TIME flag.
2017-03-21 - d682ae70b4 - lavf 57.66.105, lavc 57.83.101 - avformat.h, avcodec.h
Deprecate AVFMT_FLAG_KEEP_SIDE_DATA. It will be ignored after the next major
bump, and libavformat will behave as if it were always set.
Deprecate av_packet_merge_side_data() and av_packet_split_side_data().
2016-03-20 - xxxxxxx - lavu 55.50.100 / 55.21.0 - imgutils.h
Add av_image_copy_uc_from(), a version of av_image_copy() for copying
from GPU mapped memory.
2017-03-20 - 9c2436e - lavu 55.49.100 - pixdesc.h
Add AV_PIX_FMT_FLAG_BAYER pixel format flag.
2017-03-18 - 3796fb2692 - lavfi 6.77.100 - avfilter.h
Deprecate AVFilterGraph.resample_lavr_opts
It's never been used by avfilter nor passed to anything.
2017-02-10 - xxxxxxx - lavu 55.48.100 / 55.33.0 - spherical.h
Add AV_SPHERICAL_EQUIRECTANGULAR_TILE, av_spherical_tile_bounds(),
and projection-specific properties (bound_left, bound_top, bound_right,
bound_bottom, padding) to AVSphericalMapping.
2017-03-02 - ade7c1a232 - lavc 57.81.104 - videotoolbox.h
AVVideotoolboxContext.cv_pix_fmt_type can now be set to 0 to output the
native decoder format. (The default value is not changed.)
2017-03-02 - 554bc4eea8 - lavu 55.47.101, lavc 57.81.102, lavf 57.66.103
Remove requirement to use AVOption or accessors to access certain fields
in AVFrame, AVCodecContext, and AVFormatContext that were previously
documented as "no direct access" allowed.
2017-02-13 - c1a5fca06f - lavc 57.80.100 - avcodec.h
Add AVCodecContext.hw_device_ctx.
2017-02-11 - e3af49b14b - lavu 55.47.100 - frame.h
Add AVFrame.opaque_ref.
2017-01-31 - xxxxxxx - lavu 55.46.100 / 55.20.0 - cpu.h
Add AV_CPU_FLAG_SSSE3SLOW.
2017-01-24 - c4618f842a - lavu 55.45.100 - channel_layout.h
Add av_get_extended_channel_layout()
2017-01-22 - 76c5a69e26 - lavu 55.44.100 - lfg.h
Add av_lfg_init_from_data().
2017-01-17 - 2a4a8653b6 - lavc 57.74.100 - vaapi.h
Deprecate struct vaapi_context and the vaapi.h installed header.
Callers should set AVCodecContext.hw_frames_ctx instead.
2017-01-12 - dbe9dbed31 - lavfi 6.69.100- buffersink.h
Add av_buffersink_get_*() functions.
2017-01-06 - 9488032e10 - lavf 57.62.100- avio.h
Add avio_get_dyn_buf()
2016-12-10 - xxxxxxx - lavu xx.xx.100- imgutils.h
Add av_image_check_size2()
2016-xx-xx - xxxxxxx - lavc 57.67.100 / 57.29.0 - avcodec.h
Add AV_PKT_DATA_SPHERICAL packet side data to export AVSphericalMapping
information from containers.
2016-xx-xx - xxxxxxx - lavu 55.42.100 / 55.30.0 - spherical.h
Add AV_FRAME_DATA_SPHERICAL value, av_spherical_alloc() API and
AVSphericalMapping type to export and describe spherical video properties.
2016-11-18 - 2ab50647ff - lavf 57.58.100 - avformat.h
Add av_stream_add_side_data().
2016-11-13 - 775a8477b7 - lavu 55.39.100 - hwcontext_vaapi.h
Add AV_VAAPI_DRIVER_QUIRK_ATTRIB_MEMTYPE.
2016-11-13 - a8d51bb424 - lavu 55.38.100 - hwcontext_vaapi.h
Add driver quirks field to VAAPI-specific hwdevice and enum with
members AV_VAAPI_DRIVER_QUIRK_* to represent its values.
2016-11-10 - 638b216d4f - lavu 55.36.100 - pixfmt.h
Add AV_PIX_FMT_GRAY12(LE/BE).
-------- 8< --------- FFmpeg 3.2 was cut here -------- 8< ---------
2016-10-24 - 73ead47 - lavf 57.55.100 - avformat.h
@@ -626,7 +515,7 @@ API changes, most recent first:
Add av_opt_get_dict_val/set_dict_val with AV_OPT_TYPE_DICT to support
dictionary types being set as options.
2014-08-13 - afbd4b8 - lavf 56.01.0 - avformat.h
2014-08-13 - afbd4b7e09 - lavf 56.01.0 - avformat.h
Add AVFormatContext.event_flags and AVStream.event_flags for signaling to
the user when events happen in the file/stream.
@@ -643,7 +532,7 @@ API changes, most recent first:
2014-08-08 - 5c3c671 - lavf 55.53.100 - avio.h
Add avio_feof() and deprecate url_feof().
2014-08-07 - bb78903 - lsws 2.1.3 - swscale.h
2014-08-07 - bb789016d4 - lsws 2.1.3 - swscale.h
sws_getContext is not going to be removed in the future.
2014-08-07 - a561662 / ad1ee5f - lavc 55.73.101 / 55.57.3 - avcodec.h

View File

@@ -38,7 +38,7 @@ PROJECT_NAME = FFmpeg
# could be handy for archiving the generated documentation or if some version
# control system is used.
PROJECT_NUMBER =
PROJECT_NUMBER = 3.2.18
# Using the PROJECT_BRIEF tag one can provide an optional one line description
# for a project that appears at the top of each page and should give viewer a

View File

@@ -38,11 +38,8 @@ DOCS = $(DOCS-yes)
DOC_EXAMPLES-$(CONFIG_AVIO_DIR_CMD_EXAMPLE) += avio_dir_cmd
DOC_EXAMPLES-$(CONFIG_AVIO_READING_EXAMPLE) += avio_reading
DOC_EXAMPLES-$(CONFIG_DECODE_AUDIO_EXAMPLE) += decode_audio
DOC_EXAMPLES-$(CONFIG_DECODE_VIDEO_EXAMPLE) += decode_video
DOC_EXAMPLES-$(CONFIG_DECODING_ENCODING_EXAMPLE) += decoding_encoding
DOC_EXAMPLES-$(CONFIG_DEMUXING_DECODING_EXAMPLE) += demuxing_decoding
DOC_EXAMPLES-$(CONFIG_ENCODE_AUDIO_EXAMPLE) += encode_audio
DOC_EXAMPLES-$(CONFIG_ENCODE_VIDEO_EXAMPLE) += encode_video
DOC_EXAMPLES-$(CONFIG_EXTRACT_MVS_EXAMPLE) += extract_mvs
DOC_EXAMPLES-$(CONFIG_FILTER_AUDIO_EXAMPLE) += filter_audio
DOC_EXAMPLES-$(CONFIG_FILTERING_AUDIO_EXAMPLE) += filtering_audio

View File

@@ -26,26 +26,19 @@ with their parameters, if any.
@section aac_adtstoasc
Convert MPEG-2/4 AAC ADTS to an MPEG-4 Audio Specific Configuration
bitstream.
Convert MPEG-2/4 AAC ADTS to MPEG-4 Audio Specific Configuration
bitstream filter.
This filter creates an MPEG-4 AudioSpecificConfig from an MPEG-2/4
ADTS header and removes the ADTS header.
This filter is required for example when copying an AAC stream from a
raw ADTS AAC or an MPEG-TS container to MP4A-LATM, to an FLV file, or
to MOV/MP4 files and related formats such as 3GP or M4A. Please note
that it is auto-inserted for MP4A-LATM and MOV/MP4 and related formats.
This is required for example when copying an AAC stream from a raw
ADTS AAC container to a FLV or a MOV/MP4 file.
@section chomp
Remove zero padding at the end of a packet.
@section dca_core
Extract the core from a DCA/DTS stream, dropping extensions such as
DTS-HD.
@section dump_extra
Add extradata to the beginning of the filtered packets.
@@ -74,23 +67,9 @@ the header stored in extradata to the key packets:
ffmpeg -i INPUT -map 0 -flags:v +global_header -c:v libx264 -bsf:v dump_extra out.ts
@end example
@section extract_extradata
@section dca_core
Extract the in-band extradata.
Certain codecs allow the long-term headers (e.g. MPEG-2 sequence headers,
or H.264/HEVC (VPS/)SPS/PPS) to be transmitted either "in-band" (i.e. as a part
of the bitstream containing the coded frames) or "out of band" (e.g. on the
container level). This latter form is called "extradata" in FFmpeg terminology.
This bitstream filter detects the in-band headers and makes them available as
extradata.
@table @option
@item remove
When this option is enabled, the long-term headers are removed from the
bitstream after extraction.
@end table
Extract DCA core from DTS-HD streams.
@section h264_mp4toannexb
@@ -99,7 +78,7 @@ prefixed mode (as defined in the Annex B of the ITU-T H.264
specification).
This is required by some streaming formats, typically the MPEG-2
transport stream format (muxer @code{mpegts}).
transport stream format ("mpegts").
For example to remux an MP4 file containing an H.264 stream to mpegts
format with @command{ffmpeg}, you can use the command:
@@ -108,29 +87,6 @@ format with @command{ffmpeg}, you can use the command:
ffmpeg -i INPUT.mp4 -codec copy -bsf:v h264_mp4toannexb OUTPUT.ts
@end example
Please note that this filter is auto-inserted for MPEG-TS (muxer
@code{mpegts}) and raw H.264 (muxer @code{h264}) output formats.
@section hevc_mp4toannexb
Convert an HEVC/H.265 bitstream from length prefixed mode to start code
prefixed mode (as defined in the Annex B of the ITU-T H.265
specification).
This is required by some streaming formats, typically the MPEG-2
transport stream format (muxer @code{mpegts}).
For example to remux an MP4 file containing an HEVC stream to mpegts
format with @command{ffmpeg}, you can use the command:
@example
ffmpeg -i INPUT.mp4 -codec copy -bsf:v hevc_mp4toannexb OUTPUT.ts
@end example
Please note that this filter is auto-inserted for MPEG-TS (muxer
@code{mpegts}) and raw HEVC/H.265 (muxer @code{h265} or
@code{hevc}) output formats.
@section imxdump
Modifies the bitstream to fit in MOV and to be usable by the Final Cut
@@ -181,22 +137,11 @@ exiftran -i -9 frame*.jpg
ffmpeg -i frame_%d.jpg -c:v copy rotated.avi
@end example
@section mjpegadump
@section mjpega_dump_header
Add an MJPEG A header to the bitstream, to enable decoding by
Quicktime.
@section movsub
@anchor{mov2textsub}
@section mov2textsub
Extract a representable text file from MOV subtitles, stripping the
metadata header from each subtitle packet.
See also the @ref{text2movsub} filter.
@section mp3decomp
Decompress non-standard compressed MP3 audio headers.
@section mp3_header_decompress
@section mpeg4_unpack_bframes
@@ -236,38 +181,4 @@ applies the modification to every byte.
@section remove_extra
Remove extradata from packets.
It accepts the following parameter:
@table @option
@item freq
Set which frame types to remove extradata from.
@table @samp
@item k
Remove extradata from non-keyframes only.
@item keyframe
Remove extradata from keyframes only.
@item e, all
Remove extradata from all frames.
@end table
@end table
@anchor{text2movsub}
@section text2movsub
Convert text subtitles to MOV subtitles (as used by the @code{mov_text}
codec) with metadata headers.
See also the @ref{mov2textsub} filter.
@section vp9_superframe
Merge VP9 invisible (alt-ref) frames back into VP9 superframes. This
fixes merging of split/segmented VP9 streams where the alt-ref frame
was split from its visible counterpart.
@c man end BITSTREAM FILTERS

View File

@@ -138,8 +138,7 @@ Set audio sampling rate (in Hz).
Set number of audio channels.
@item cutoff @var{integer} (@emph{encoding,audio})
Set cutoff bandwidth. (Supported only by selected encoders, see
their respective documentation sections.)
Set cutoff bandwidth.
@item frame_size @var{integer} (@emph{encoding,audio})
Set audio frame size.
@@ -1068,15 +1067,12 @@ SMPTE 240 M
Film
@item bt2020
BT.2020
@item smpte428
@item smpte428_1
SMPTE ST 428-1
@item smpte431
SMPTE 431-2
@item smpte432
SMPTE 432-1
@item jedec-p22
JEDEC P22
@end table
@item color_trc @var{integer} (@emph{decoding/encoding,video})
@@ -1095,29 +1091,21 @@ SMPTE 240 M
@item linear
Linear
@item log
@item log100
Log
@item log_sqrt
@item log316
Log square root
@item iec61966_2_4
@item iec61966-2-4
IEC 61966-2-4
@item bt1361
@item bt1361e
BT.1361
@item iec61966_2_1
@item iec61966-2-1
IEC 61966-2-1
@item bt2020_10
@item bt2020_10bit
BT.2020 - 10 bit
@item bt2020_12
@item bt2020_12bit
BT.2020 - 12 bit
@item smpte2084
SMPTE ST 2084
@item smpte428
@item smpte428_1
SMPTE ST 428-1
@item arib-std-b67
@@ -1141,10 +1129,8 @@ SMPTE 170 M
SMPTE 240 M
@item ycocg
YCOCG
@item bt2020nc
@item bt2020_ncl
BT.2020 NCL
@item bt2020c
@item bt2020_cl
BT.2020 CL
@item smpte2085
@@ -1154,32 +1140,8 @@ SMPTE 2085
@item color_range @var{integer} (@emph{decoding/encoding,video})
If used as input parameter, it serves as a hint to the decoder, which
color_range the input has.
Possible values:
@table @samp
@item tv
@item mpeg
MPEG (219*2^(n-8))
@item pc
@item jpeg
JPEG (2^n-1)
@end table
@item chroma_sample_location @var{integer} (@emph{decoding/encoding,video})
Possible values:
@table @samp
@item left
@item center
@item topleft
@item top
@item bottomleft
@item bottom
@end table
@item log_level_offset @var{integer}
Set the log level offset.
@@ -1275,10 +1237,6 @@ ffprobe -dump_separator "
" -i ~/videos/matrixbench_mpeg2.mpg
@end example
@item max_pixels @var{integer} (@emph{decoding/encoding,video})
Maximum number of pixels per image. This value can be used to avoid out of
memory failures due to large images.
@end table
@c man end CODEC OPTIONS

View File

@@ -13,9 +13,8 @@ You can disable all the demuxers using the configure option
the option @code{--enable-demuxer=@var{DEMUXER}}, or disable it
with the option @code{--disable-demuxer=@var{DEMUXER}}.
The option @code{-demuxers} of the ff* tools will display the list of
enabled demuxers. Use @code{-formats} to view a combined list of
enabled demuxers and muxers.
The option @code{-formats} of the ff* tools will display the list of
enabled demuxers.
The description of some of the currently available demuxers follows.
@@ -244,17 +243,11 @@ file subdir/file-2.wav
@end example
@end itemize
@section flv, live_flv
@section flv
Adobe Flash Video Format demuxer.
This demuxer is used to demux FLV files and RTMP network streams. In case of live network streams, if you force format, you may use live_flv option instead of flv to survive timestamp discontinuities.
@example
ffmpeg -f flv -i myfile.flv ...
ffmpeg -f live_flv -i rtmp://<any.server>/anything/key ....
@end example
This demuxer is used to demux FLV files and RTMP network streams.
@table @option
@item -flv_metadata @var{bool}
@@ -300,6 +293,24 @@ used to end the output video at the length of the shortest input file,
which in this case is @file{input.mp4} as the GIF in this example loops
infinitely.
@section hls
HLS demuxer
It accepts the following options:
@table @option
@item live_start_index
segment index to start live streams at (negative values are from the end).
@item allowed_extensions
',' separated list of file extensions that hls is allowed to access.
@item max_reload
Maximum number of times a insufficient list is attempted to be reloaded.
Default value is 1000.
@end table
@section image2
Image file demuxer.

View File

@@ -131,6 +131,11 @@ designated struct initializers (@samp{struct s x = @{ .i = 17 @};});
@item
compound literals (@samp{x = (struct s) @{ 17, 23 @};}).
@item
Implementation defined behavior for signed integers is assumed to match the
expected behavior for two's complement. Non representable values in integer
casts are binary truncated. Shift right of signed values uses sign extension.
@end itemize
These features are supported by all compilers we care about, so we will not

View File

@@ -488,10 +488,6 @@ is an optional AC-3 feature that increases quality by selectively encoding
the left/right channels as mid/side. This option is enabled by default, and it
is highly recommended that it be left as enabled except for testing purposes.
@item cutoff @var{frequency}
Set lowpass cutoff frequency. If unspecified, the encoder selects a default
determined by various other encoding parameters.
@end table
@subsection Floating-Point-Only AC-3 Encoding Options
@@ -549,8 +545,7 @@ The following options are supported by FFmpeg's flac encoder.
@table @option
@item compression_level
Sets the compression level, which chooses defaults for many other options
if they are not set explicitly. Valid values are from 0 to 12, 5 is the
default.
if they are not set explicitly.
@item frame_size
Sets the size of the frames in samples per channel.
@@ -617,27 +612,6 @@ and slightly improves compression.
@end table
@anchor{opusenc}
@section opus
Opus encoder.
This is a native FFmpeg encoder for the Opus format. Currently its in development and
only implements the CELT part of the codec. Its quality is usually worse and at best
is equal to the libopus encoder.
@subsection Options
@table @option
@item b
Set bit rate in bits/s. If unspecified it uses the number of channels and the layout
to make a good guess.
@item opus_delay
Sets the maximum delay in milliseconds. Lower delays than 20ms will very quickly
decrease quality.
@end table
@anchor{libfdk-aac-enc}
@section libfdk_aac
@@ -843,10 +817,6 @@ Set algorithm quality. Valid arguments are integers in the 0-9 range,
with 0 meaning highest quality but slowest, and 9 meaning fastest
while producing the worst quality.
@item cutoff (@emph{--lowpass})
Set lowpass cutoff frequency. If unspecified, the encoder dynamically
adjusts the cutoff.
@item reservoir
Enable use of bit reservoir when set to 1. Default value is 1. LAME
has this enabled by default, but can be overridden by use
@@ -900,90 +870,6 @@ default value is 0 (disabled).
@end table
@section libopus
libopus Opus Interactive Audio Codec encoder wrapper.
Requires the presence of the libopus headers and library during
configuration. You need to explicitly configure the build with
@code{--enable-libopus}.
@subsection Option Mapping
Most libopus options are modelled after the @command{opusenc} utility from
opus-tools. The following is an option mapping chart describing options
supported by the libopus wrapper, and their @command{opusenc}-equivalent
in parentheses.
@table @option
@item b (@emph{bitrate})
Set the bit rate in bits/s. FFmpeg's @option{b} option is
expressed in bits/s, while @command{opusenc}'s @option{bitrate} in
kilobits/s.
@item vbr (@emph{vbr}, @emph{hard-cbr}, and @emph{cvbr})
Set VBR mode. The FFmpeg @option{vbr} option has the following
valid arguments, with the @command{opusenc} equivalent options
in parentheses:
@table @samp
@item off (@emph{hard-cbr})
Use constant bit rate encoding.
@item on (@emph{vbr})
Use variable bit rate encoding (the default).
@item constrained (@emph{cvbr})
Use constrained variable bit rate encoding.
@end table
@item compression_level (@emph{comp})
Set encoding algorithm complexity. Valid options are integers in
the 0-10 range. 0 gives the fastest encodes but lower quality, while 10
gives the highest quality but slowest encoding. The default is 10.
@item frame_duration (@emph{framesize})
Set maximum frame size, or duration of a frame in milliseconds. The
argument must be exactly the following: 2.5, 5, 10, 20, 40, 60. Smaller
frame sizes achieve lower latency but less quality at a given bitrate.
Sizes greater than 20ms are only interesting at fairly low bitrates.
The default is 20ms.
@item packet_loss (@emph{expect-loss})
Set expected packet loss percentage. The default is 0.
@item application (N.A.)
Set intended application type. Valid options are listed below:
@table @samp
@item voip
Favor improved speech intelligibility.
@item audio
Favor faithfulness to the input (the default).
@item lowdelay
Restrict to only the lowest delay modes.
@end table
@item cutoff (N.A.)
Set cutoff bandwidth in Hz. The argument must be exactly one of the
following: 4000, 6000, 8000, 12000, or 20000, corresponding to
narrowband, mediumband, wideband, super wideband, and fullband
respectively. The default is 0 (cutoff disabled).
@item mapping_family (@emph{mapping_family})
Set channel mapping family to be used by the encoder. The default value of -1
uses mapping family 0 for mono and stereo inputs, and mapping family 1
otherwise. The default also disables the surround masking and LFE bandwidth
optimzations in libopus, and requires that the input contains 8 channels or
fewer.
Other values include 0 for mono and stereo, 1 for surround sound with masking
and LFE bandwidth optimizations, and 255 for independent streams with an
unspecified channel layout.
@end table
@anchor{libshine}
@section libshine
@@ -1123,6 +1009,90 @@ default value is 0 (disabled).
@end table
@section libopus
libopus Opus Interactive Audio Codec encoder wrapper.
Requires the presence of the libopus headers and library during
configuration. You need to explicitly configure the build with
@code{--enable-libopus}.
@subsection Option Mapping
Most libopus options are modelled after the @command{opusenc} utility from
opus-tools. The following is an option mapping chart describing options
supported by the libopus wrapper, and their @command{opusenc}-equivalent
in parentheses.
@table @option
@item b (@emph{bitrate})
Set the bit rate in bits/s. FFmpeg's @option{b} option is
expressed in bits/s, while @command{opusenc}'s @option{bitrate} in
kilobits/s.
@item vbr (@emph{vbr}, @emph{hard-cbr}, and @emph{cvbr})
Set VBR mode. The FFmpeg @option{vbr} option has the following
valid arguments, with the @command{opusenc} equivalent options
in parentheses:
@table @samp
@item off (@emph{hard-cbr})
Use constant bit rate encoding.
@item on (@emph{vbr})
Use variable bit rate encoding (the default).
@item constrained (@emph{cvbr})
Use constrained variable bit rate encoding.
@end table
@item compression_level (@emph{comp})
Set encoding algorithm complexity. Valid options are integers in
the 0-10 range. 0 gives the fastest encodes but lower quality, while 10
gives the highest quality but slowest encoding. The default is 10.
@item frame_duration (@emph{framesize})
Set maximum frame size, or duration of a frame in milliseconds. The
argument must be exactly the following: 2.5, 5, 10, 20, 40, 60. Smaller
frame sizes achieve lower latency but less quality at a given bitrate.
Sizes greater than 20ms are only interesting at fairly low bitrates.
The default is 20ms.
@item packet_loss (@emph{expect-loss})
Set expected packet loss percentage. The default is 0.
@item application (N.A.)
Set intended application type. Valid options are listed below:
@table @samp
@item voip
Favor improved speech intelligibility.
@item audio
Favor faithfulness to the input (the default).
@item lowdelay
Restrict to only the lowest delay modes.
@end table
@item cutoff (N.A.)
Set cutoff bandwidth in Hz. The argument must be exactly one of the
following: 4000, 6000, 8000, 12000, or 20000, corresponding to
narrowband, mediumband, wideband, super wideband, and fullband
respectively. The default is 0 (cutoff disabled).
@item mapping_family (@emph{mapping_family})
Set channel mapping family to be used by the encoder. The default value of -1
uses mapping family 0 for mono and stereo inputs, and mapping family 1
otherwise. The default also disables the surround masking and LFE bandwidth
optimzations in libopus, and requires that the input contains 8 channels or
fewer.
Other values include 0 for mono and stereo, 1 for surround sound with masking
and LFE bandwidth optimizations, and 255 for independent streams with an
unspecified channel layout.
@end table
@section libvorbis
libvorbis encoder wrapper.
@@ -1222,27 +1192,6 @@ Same as @samp{3}, but with extra processing enabled.
@end table
@end table
@anchor{mjpegenc}
@section mjpeg
Motion JPEG encoder.
@subsection Options
@table @option
@item huffman
Set the huffman encoding strategy. Possible values:
@table @samp
@item default
Use the default huffman tables. This is the default strategy.
@item optimal
Compute and use optimal huffman tables.
@end table
@end table
@anchor{wavpackenc}
@section wavpack
@@ -1312,81 +1261,6 @@ disabled
A description of some of the currently available video encoders
follows.
@section Hap
Vidvox Hap video encoder.
@subsection Options
@table @option
@item format @var{integer}
Specifies the Hap format to encode.
@table @option
@item hap
@item hap_alpha
@item hap_q
@end table
Default value is @option{hap}.
@item chunks @var{integer}
Specifies the number of chunks to split frames into, between 1 and 64. This
permits multithreaded decoding of large frames, potentially at the cost of
data-rate. The encoder may modify this value to divide frames evenly.
Default value is @var{1}.
@item compressor @var{integer}
Specifies the second-stage compressor to use. If set to @option{none},
@option{chunks} will be limited to 1, as chunked uncompressed frames offer no
benefit.
@table @option
@item none
@item snappy
@end table
Default value is @option{snappy}.
@end table
@section jpeg2000
The native jpeg 2000 encoder is lossy by default, the @code{-q:v}
option can be used to set the encoding quality. Lossless encoding
can be selected with @code{-pred 1}.
@subsection Options
@table @option
@item format
Can be set to either @code{j2k} or @code{jp2} (the default) that
makes it possible to store non-rgb pix_fmts.
@end table
@section libkvazaar
Kvazaar H.265/HEVC encoder.
Requires the presence of the libkvazaar headers and library during
configuration. You need to explicitly configure the build with
@option{--enable-libkvazaar}.
@subsection Options
@table @option
@item b
Set target video bitrate in bit/s and enable rate control.
@item kvazaar-params
Set kvazaar parameters as a list of @var{name}=@var{value} pairs separated
by commas (,). See kvazaar documentation for a list of options.
@end table
@section libopenh264
Cisco libopenh264 H.264/MPEG-4 AVC encoder wrapper.
@@ -1453,6 +1327,30 @@ Set maximum NAL size in bytes.
Allow skipping frames to hit the target bitrate if set to 1.
@end table
@section jpeg2000
The native jpeg 2000 encoder is lossy by default, the @code{-q:v}
option can be used to set the encoding quality. Lossless encoding
can be selected with @code{-pred 1}.
@subsection Options
@table @option
@item format
Can be set to either @code{j2k} or @code{jp2} (the default) that
makes it possible to store non-rgb pix_fmts.
@end table
@section snow
@subsection Options
@table @option
@item iterative_dia_size
dia size for the iterative motion estimation
@end table
@section libtheora
libtheora Theora encoder wrapper.
@@ -1686,6 +1584,7 @@ colorspaces:
For more information about libvpx see:
@url{http://www.webmproject.org/}
@section libwebp
libwebp WebP Image encoder wrapper
@@ -1852,10 +1751,6 @@ Exhaustive search.
Hadamard exhaustive search (slowest).
@end table
@item forced-idr
Normally, when forcing a I-frame type, the encoder can select any type
of I-frame. This option forces it to choose an IDR-frame.
@item subq (@emph{subme})
Sub-pixel motion estimation method.
@@ -2146,10 +2041,6 @@ Set the x265 preset.
@item tune
Set the x265 tune parameter.
@item forced-idr
Normally, when forcing a I-frame type, the encoder can select any type
of I-frame. This option forces it to choose an IDR-frame.
@item x265-params
Set x265 options using a list of @var{key}=@var{value} couples separated
by ":". See @command{x265 --help} for a list of options.
@@ -2428,6 +2319,27 @@ Setting a higher @option{bits_per_mb} limit will improve the speed.
For the fastest encoding speed set the @option{qscale} parameter (4 is the
recommended value) and do not set a size constraint.
@section libkvazaar
Kvazaar H.265/HEVC encoder.
Requires the presence of the libkvazaar headers and library during
configuration. You need to explicitly configure the build with
@option{--enable-libkvazaar}.
@subsection Options
@table @option
@item b
Set target video bitrate in bit/s and enable rate control.
@item kvazaar-params
Set kvazaar parameters as a list of @var{name}=@var{value} pairs separated
by commas (,). See kvazaar documentation for a list of options.
@end table
@section QSV encoders
The family of Intel QuickSync Video encoders (MPEG-2, H.264 and HEVC)
@@ -2516,15 +2428,6 @@ encoder use CAVLC instead of CABAC.
@end itemize
@section snow
@subsection Options
@table @option
@item iterative_dia_size
dia size for the iterative motion estimation
@end table
@section vc2
SMPTE VC-2 (previously BBC Dirac Pro). This codec was primarily aimed at

View File

@@ -1,10 +1,7 @@
/avio_dir_cmd
/avio_reading
/decode_audio
/decode_video
/decoding_encoding
/demuxing_decoding
/encode_audio
/encode_video
/extract_mvs
/filter_audio
/filtering_audio

View File

@@ -13,11 +13,8 @@ LDLIBS := $(shell pkg-config --libs $(FFMPEG_LIBS)) $(LDLIBS)
EXAMPLES= avio_dir_cmd \
avio_reading \
decode_audio \
decode_video \
decoding_encoding \
demuxing_decoding \
encode_audio \
encode_video \
extract_mvs \
filtering_video \
filtering_audio \
@@ -34,7 +31,7 @@ OBJS=$(addsuffix .o,$(EXAMPLES))
# the following examples make explicit use of the math library
avcodec: LDLIBS += -lm
encode_audio: LDLIBS += -lm
decoding_encoding: LDLIBS += -lm
muxing: LDLIBS += -lm
resampling_audio: LDLIBS += -lm

View File

@@ -1,152 +0,0 @@
/*
* Copyright (c) 2001 Fabrice Bellard
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
* THE SOFTWARE.
*/
/**
* @file
* audio decoding with libavcodec API example
*
* @example decode_audio.c
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <libavutil/frame.h>
#include <libavutil/mem.h>
#include <libavcodec/avcodec.h>
#define AUDIO_INBUF_SIZE 20480
#define AUDIO_REFILL_THRESH 4096
int main(int argc, char **argv)
{
const char *outfilename, *filename;
const AVCodec *codec;
AVCodecContext *c= NULL;
int len;
FILE *f, *outfile;
uint8_t inbuf[AUDIO_INBUF_SIZE + AV_INPUT_BUFFER_PADDING_SIZE];
AVPacket avpkt;
AVFrame *decoded_frame = NULL;
if (argc <= 2) {
fprintf(stderr, "Usage: %s <input file> <output file>\n", argv[0]);
exit(0);
}
filename = argv[1];
outfilename = argv[2];
/* register all the codecs */
avcodec_register_all();
av_init_packet(&avpkt);
/* find the MPEG audio decoder */
codec = avcodec_find_decoder(AV_CODEC_ID_MP2);
if (!codec) {
fprintf(stderr, "Codec not found\n");
exit(1);
}
c = avcodec_alloc_context3(codec);
if (!c) {
fprintf(stderr, "Could not allocate audio codec context\n");
exit(1);
}
/* open it */
if (avcodec_open2(c, codec, NULL) < 0) {
fprintf(stderr, "Could not open codec\n");
exit(1);
}
f = fopen(filename, "rb");
if (!f) {
fprintf(stderr, "Could not open %s\n", filename);
exit(1);
}
outfile = fopen(outfilename, "wb");
if (!outfile) {
av_free(c);
exit(1);
}
/* decode until eof */
avpkt.data = inbuf;
avpkt.size = fread(inbuf, 1, AUDIO_INBUF_SIZE, f);
while (avpkt.size > 0) {
int i, ch;
int got_frame = 0;
if (!decoded_frame) {
if (!(decoded_frame = av_frame_alloc())) {
fprintf(stderr, "Could not allocate audio frame\n");
exit(1);
}
}
len = avcodec_decode_audio4(c, decoded_frame, &got_frame, &avpkt);
if (len < 0) {
fprintf(stderr, "Error while decoding\n");
exit(1);
}
if (got_frame) {
/* if a frame has been decoded, output it */
int data_size = av_get_bytes_per_sample(c->sample_fmt);
if (data_size < 0) {
/* This should not occur, checking just for paranoia */
fprintf(stderr, "Failed to calculate data size\n");
exit(1);
}
for (i=0; i<decoded_frame->nb_samples; i++)
for (ch=0; ch<c->channels; ch++)
fwrite(decoded_frame->data[ch] + data_size*i, 1, data_size, outfile);
}
avpkt.size -= len;
avpkt.data += len;
avpkt.dts =
avpkt.pts = AV_NOPTS_VALUE;
if (avpkt.size < AUDIO_REFILL_THRESH) {
/* Refill the input buffer, to avoid trying to decode
* incomplete frames. Instead of this, one could also use
* a parser, or use a proper container format through
* libavformat. */
memmove(inbuf, avpkt.data, avpkt.size);
avpkt.data = inbuf;
len = fread(avpkt.data + avpkt.size, 1,
AUDIO_INBUF_SIZE - avpkt.size, f);
if (len > 0)
avpkt.size += len;
}
}
fclose(outfile);
fclose(f);
avcodec_free_context(&c);
av_frame_free(&decoded_frame);
return 0;
}

View File

@@ -1,182 +0,0 @@
/*
* Copyright (c) 2001 Fabrice Bellard
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
* THE SOFTWARE.
*/
/**
* @file
* video decoding with libavcodec API example
*
* @example decode_video.c
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <libavcodec/avcodec.h>
#define INBUF_SIZE 4096
static void pgm_save(unsigned char *buf, int wrap, int xsize, int ysize,
char *filename)
{
FILE *f;
int i;
f = fopen(filename,"w");
fprintf(f, "P5\n%d %d\n%d\n", xsize, ysize, 255);
for (i = 0; i < ysize; i++)
fwrite(buf + i * wrap, 1, xsize, f);
fclose(f);
}
static int decode_write_frame(const char *outfilename, AVCodecContext *avctx,
AVFrame *frame, int *frame_count, AVPacket *pkt, int last)
{
int len, got_frame;
char buf[1024];
len = avcodec_decode_video2(avctx, frame, &got_frame, pkt);
if (len < 0) {
fprintf(stderr, "Error while decoding frame %d\n", *frame_count);
return len;
}
if (got_frame) {
printf("Saving %sframe %3d\n", last ? "last " : "", *frame_count);
fflush(stdout);
/* the picture is allocated by the decoder, no need to free it */
snprintf(buf, sizeof(buf), outfilename, *frame_count);
pgm_save(frame->data[0], frame->linesize[0],
frame->width, frame->height, buf);
(*frame_count)++;
}
if (pkt->data) {
pkt->size -= len;
pkt->data += len;
}
return 0;
}
int main(int argc, char **argv)
{
const char *filename, *outfilename;
const AVCodec *codec;
AVCodecContext *c= NULL;
int frame_count;
FILE *f;
AVFrame *frame;
uint8_t inbuf[INBUF_SIZE + AV_INPUT_BUFFER_PADDING_SIZE];
AVPacket avpkt;
if (argc <= 2) {
fprintf(stderr, "Usage: %s <input file> <output file>\n", argv[0]);
exit(0);
}
filename = argv[1];
outfilename = argv[2];
avcodec_register_all();
av_init_packet(&avpkt);
/* set end of buffer to 0 (this ensures that no overreading happens for damaged MPEG streams) */
memset(inbuf + INBUF_SIZE, 0, AV_INPUT_BUFFER_PADDING_SIZE);
/* find the MPEG-1 video decoder */
codec = avcodec_find_decoder(AV_CODEC_ID_MPEG1VIDEO);
if (!codec) {
fprintf(stderr, "Codec not found\n");
exit(1);
}
c = avcodec_alloc_context3(codec);
if (!c) {
fprintf(stderr, "Could not allocate video codec context\n");
exit(1);
}
if (codec->capabilities & AV_CODEC_CAP_TRUNCATED)
c->flags |= AV_CODEC_FLAG_TRUNCATED; // we do not send complete frames
/* For some codecs, such as msmpeg4 and mpeg4, width and height
MUST be initialized there because this information is not
available in the bitstream. */
/* open it */
if (avcodec_open2(c, codec, NULL) < 0) {
fprintf(stderr, "Could not open codec\n");
exit(1);
}
f = fopen(filename, "rb");
if (!f) {
fprintf(stderr, "Could not open %s\n", filename);
exit(1);
}
frame = av_frame_alloc();
if (!frame) {
fprintf(stderr, "Could not allocate video frame\n");
exit(1);
}
frame_count = 0;
for (;;) {
avpkt.size = fread(inbuf, 1, INBUF_SIZE, f);
if (avpkt.size == 0)
break;
/* NOTE1: some codecs are stream based (mpegvideo, mpegaudio)
and this is the only method to use them because you cannot
know the compressed data size before analysing it.
BUT some other codecs (msmpeg4, mpeg4) are inherently frame
based, so you must call them with all the data for one
frame exactly. You must also initialize 'width' and
'height' before initializing them. */
/* NOTE2: some codecs allow the raw parameters (frame size,
sample rate) to be changed at any frame. We handle this, so
you should also take care of it */
/* here, we use a stream based decoder (mpeg1video), so we
feed decoder and see if it could decode a frame */
avpkt.data = inbuf;
while (avpkt.size > 0)
if (decode_write_frame(outfilename, c, frame, &frame_count, &avpkt, 0) < 0)
exit(1);
}
/* Some codecs, such as MPEG, transmit the I- and P-frame with a
latency of one frame. You must do the following to have a
chance to get the last frame of the video. */
avpkt.data = NULL;
avpkt.size = 0;
decode_write_frame(outfilename, c, frame, &frame_count, &avpkt, 1);
fclose(f);
avcodec_free_context(&c);
av_frame_free(&frame);
return 0;
}

View File

@@ -0,0 +1,665 @@
/*
* Copyright (c) 2001 Fabrice Bellard
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
* THE SOFTWARE.
*/
/**
* @file
* libavcodec API use example.
*
* @example decoding_encoding.c
* Note that libavcodec only handles codecs (MPEG, MPEG-4, etc...),
* not file formats (AVI, VOB, MP4, MOV, MKV, MXF, FLV, MPEG-TS, MPEG-PS, etc...).
* See library 'libavformat' for the format handling
*/
#include <math.h>
#include <libavutil/opt.h>
#include <libavcodec/avcodec.h>
#include <libavutil/channel_layout.h>
#include <libavutil/common.h>
#include <libavutil/imgutils.h>
#include <libavutil/mathematics.h>
#include <libavutil/samplefmt.h>
#define INBUF_SIZE 4096
#define AUDIO_INBUF_SIZE 20480
#define AUDIO_REFILL_THRESH 4096
/* check that a given sample format is supported by the encoder */
static int check_sample_fmt(AVCodec *codec, enum AVSampleFormat sample_fmt)
{
const enum AVSampleFormat *p = codec->sample_fmts;
while (*p != AV_SAMPLE_FMT_NONE) {
if (*p == sample_fmt)
return 1;
p++;
}
return 0;
}
/* just pick the highest supported samplerate */
static int select_sample_rate(AVCodec *codec)
{
const int *p;
int best_samplerate = 0;
if (!codec->supported_samplerates)
return 44100;
p = codec->supported_samplerates;
while (*p) {
best_samplerate = FFMAX(*p, best_samplerate);
p++;
}
return best_samplerate;
}
/* select layout with the highest channel count */
static int select_channel_layout(AVCodec *codec)
{
const uint64_t *p;
uint64_t best_ch_layout = 0;
int best_nb_channels = 0;
if (!codec->channel_layouts)
return AV_CH_LAYOUT_STEREO;
p = codec->channel_layouts;
while (*p) {
int nb_channels = av_get_channel_layout_nb_channels(*p);
if (nb_channels > best_nb_channels) {
best_ch_layout = *p;
best_nb_channels = nb_channels;
}
p++;
}
return best_ch_layout;
}
/*
* Audio encoding example
*/
static void audio_encode_example(const char *filename)
{
AVCodec *codec;
AVCodecContext *c= NULL;
AVFrame *frame;
AVPacket pkt;
int i, j, k, ret, got_output;
int buffer_size;
FILE *f;
uint16_t *samples;
float t, tincr;
printf("Encode audio file %s\n", filename);
/* find the MP2 encoder */
codec = avcodec_find_encoder(AV_CODEC_ID_MP2);
if (!codec) {
fprintf(stderr, "Codec not found\n");
exit(1);
}
c = avcodec_alloc_context3(codec);
if (!c) {
fprintf(stderr, "Could not allocate audio codec context\n");
exit(1);
}
/* put sample parameters */
c->bit_rate = 64000;
/* check that the encoder supports s16 pcm input */
c->sample_fmt = AV_SAMPLE_FMT_S16;
if (!check_sample_fmt(codec, c->sample_fmt)) {
fprintf(stderr, "Encoder does not support sample format %s",
av_get_sample_fmt_name(c->sample_fmt));
exit(1);
}
/* select other audio parameters supported by the encoder */
c->sample_rate = select_sample_rate(codec);
c->channel_layout = select_channel_layout(codec);
c->channels = av_get_channel_layout_nb_channels(c->channel_layout);
/* open it */
if (avcodec_open2(c, codec, NULL) < 0) {
fprintf(stderr, "Could not open codec\n");
exit(1);
}
f = fopen(filename, "wb");
if (!f) {
fprintf(stderr, "Could not open %s\n", filename);
exit(1);
}
/* frame containing input raw audio */
frame = av_frame_alloc();
if (!frame) {
fprintf(stderr, "Could not allocate audio frame\n");
exit(1);
}
frame->nb_samples = c->frame_size;
frame->format = c->sample_fmt;
frame->channel_layout = c->channel_layout;
/* the codec gives us the frame size, in samples,
* we calculate the size of the samples buffer in bytes */
buffer_size = av_samples_get_buffer_size(NULL, c->channels, c->frame_size,
c->sample_fmt, 0);
if (buffer_size < 0) {
fprintf(stderr, "Could not get sample buffer size\n");
exit(1);
}
samples = av_malloc(buffer_size);
if (!samples) {
fprintf(stderr, "Could not allocate %d bytes for samples buffer\n",
buffer_size);
exit(1);
}
/* setup the data pointers in the AVFrame */
ret = avcodec_fill_audio_frame(frame, c->channels, c->sample_fmt,
(const uint8_t*)samples, buffer_size, 0);
if (ret < 0) {
fprintf(stderr, "Could not setup audio frame\n");
exit(1);
}
/* encode a single tone sound */
t = 0;
tincr = 2 * M_PI * 440.0 / c->sample_rate;
for (i = 0; i < 200; i++) {
av_init_packet(&pkt);
pkt.data = NULL; // packet data will be allocated by the encoder
pkt.size = 0;
for (j = 0; j < c->frame_size; j++) {
samples[2*j] = (int)(sin(t) * 10000);
for (k = 1; k < c->channels; k++)
samples[2*j + k] = samples[2*j];
t += tincr;
}
/* encode the samples */
ret = avcodec_encode_audio2(c, &pkt, frame, &got_output);
if (ret < 0) {
fprintf(stderr, "Error encoding audio frame\n");
exit(1);
}
if (got_output) {
fwrite(pkt.data, 1, pkt.size, f);
av_packet_unref(&pkt);
}
}
/* get the delayed frames */
for (got_output = 1; got_output; i++) {
ret = avcodec_encode_audio2(c, &pkt, NULL, &got_output);
if (ret < 0) {
fprintf(stderr, "Error encoding frame\n");
exit(1);
}
if (got_output) {
fwrite(pkt.data, 1, pkt.size, f);
av_packet_unref(&pkt);
}
}
fclose(f);
av_freep(&samples);
av_frame_free(&frame);
avcodec_close(c);
av_free(c);
}
/*
* Audio decoding.
*/
static void audio_decode_example(const char *outfilename, const char *filename)
{
AVCodec *codec;
AVCodecContext *c= NULL;
int len;
FILE *f, *outfile;
uint8_t inbuf[AUDIO_INBUF_SIZE + AV_INPUT_BUFFER_PADDING_SIZE];
AVPacket avpkt;
AVFrame *decoded_frame = NULL;
av_init_packet(&avpkt);
printf("Decode audio file %s to %s\n", filename, outfilename);
/* find the MPEG audio decoder */
codec = avcodec_find_decoder(AV_CODEC_ID_MP2);
if (!codec) {
fprintf(stderr, "Codec not found\n");
exit(1);
}
c = avcodec_alloc_context3(codec);
if (!c) {
fprintf(stderr, "Could not allocate audio codec context\n");
exit(1);
}
/* open it */
if (avcodec_open2(c, codec, NULL) < 0) {
fprintf(stderr, "Could not open codec\n");
exit(1);
}
f = fopen(filename, "rb");
if (!f) {
fprintf(stderr, "Could not open %s\n", filename);
exit(1);
}
outfile = fopen(outfilename, "wb");
if (!outfile) {
av_free(c);
exit(1);
}
/* decode until eof */
avpkt.data = inbuf;
avpkt.size = fread(inbuf, 1, AUDIO_INBUF_SIZE, f);
while (avpkt.size > 0) {
int i, ch;
int got_frame = 0;
if (!decoded_frame) {
if (!(decoded_frame = av_frame_alloc())) {
fprintf(stderr, "Could not allocate audio frame\n");
exit(1);
}
}
len = avcodec_decode_audio4(c, decoded_frame, &got_frame, &avpkt);
if (len < 0) {
fprintf(stderr, "Error while decoding\n");
exit(1);
}
if (got_frame) {
/* if a frame has been decoded, output it */
int data_size = av_get_bytes_per_sample(c->sample_fmt);
if (data_size < 0) {
/* This should not occur, checking just for paranoia */
fprintf(stderr, "Failed to calculate data size\n");
exit(1);
}
for (i=0; i<decoded_frame->nb_samples; i++)
for (ch=0; ch<c->channels; ch++)
fwrite(decoded_frame->data[ch] + data_size*i, 1, data_size, outfile);
}
avpkt.size -= len;
avpkt.data += len;
avpkt.dts =
avpkt.pts = AV_NOPTS_VALUE;
if (avpkt.size < AUDIO_REFILL_THRESH) {
/* Refill the input buffer, to avoid trying to decode
* incomplete frames. Instead of this, one could also use
* a parser, or use a proper container format through
* libavformat. */
memmove(inbuf, avpkt.data, avpkt.size);
avpkt.data = inbuf;
len = fread(avpkt.data + avpkt.size, 1,
AUDIO_INBUF_SIZE - avpkt.size, f);
if (len > 0)
avpkt.size += len;
}
}
fclose(outfile);
fclose(f);
avcodec_close(c);
av_free(c);
av_frame_free(&decoded_frame);
}
/*
* Video encoding example
*/
static void video_encode_example(const char *filename, int codec_id)
{
AVCodec *codec;
AVCodecContext *c= NULL;
int i, ret, x, y, got_output;
FILE *f;
AVFrame *frame;
AVPacket pkt;
uint8_t endcode[] = { 0, 0, 1, 0xb7 };
printf("Encode video file %s\n", filename);
/* find the video encoder */
codec = avcodec_find_encoder(codec_id);
if (!codec) {
fprintf(stderr, "Codec not found\n");
exit(1);
}
c = avcodec_alloc_context3(codec);
if (!c) {
fprintf(stderr, "Could not allocate video codec context\n");
exit(1);
}
/* put sample parameters */
c->bit_rate = 400000;
/* resolution must be a multiple of two */
c->width = 352;
c->height = 288;
/* frames per second */
c->time_base = (AVRational){1,25};
/* emit one intra frame every ten frames
* check frame pict_type before passing frame
* to encoder, if frame->pict_type is AV_PICTURE_TYPE_I
* then gop_size is ignored and the output of encoder
* will always be I frame irrespective to gop_size
*/
c->gop_size = 10;
c->max_b_frames = 1;
c->pix_fmt = AV_PIX_FMT_YUV420P;
if (codec_id == AV_CODEC_ID_H264)
av_opt_set(c->priv_data, "preset", "slow", 0);
/* open it */
if (avcodec_open2(c, codec, NULL) < 0) {
fprintf(stderr, "Could not open codec\n");
exit(1);
}
f = fopen(filename, "wb");
if (!f) {
fprintf(stderr, "Could not open %s\n", filename);
exit(1);
}
frame = av_frame_alloc();
if (!frame) {
fprintf(stderr, "Could not allocate video frame\n");
exit(1);
}
frame->format = c->pix_fmt;
frame->width = c->width;
frame->height = c->height;
/* the image can be allocated by any means and av_image_alloc() is
* just the most convenient way if av_malloc() is to be used */
ret = av_image_alloc(frame->data, frame->linesize, c->width, c->height,
c->pix_fmt, 32);
if (ret < 0) {
fprintf(stderr, "Could not allocate raw picture buffer\n");
exit(1);
}
/* encode 1 second of video */
for (i = 0; i < 25; i++) {
av_init_packet(&pkt);
pkt.data = NULL; // packet data will be allocated by the encoder
pkt.size = 0;
fflush(stdout);
/* prepare a dummy image */
/* Y */
for (y = 0; y < c->height; y++) {
for (x = 0; x < c->width; x++) {
frame->data[0][y * frame->linesize[0] + x] = x + y + i * 3;
}
}
/* Cb and Cr */
for (y = 0; y < c->height/2; y++) {
for (x = 0; x < c->width/2; x++) {
frame->data[1][y * frame->linesize[1] + x] = 128 + y + i * 2;
frame->data[2][y * frame->linesize[2] + x] = 64 + x + i * 5;
}
}
frame->pts = i;
/* encode the image */
ret = avcodec_encode_video2(c, &pkt, frame, &got_output);
if (ret < 0) {
fprintf(stderr, "Error encoding frame\n");
exit(1);
}
if (got_output) {
printf("Write frame %3d (size=%5d)\n", i, pkt.size);
fwrite(pkt.data, 1, pkt.size, f);
av_packet_unref(&pkt);
}
}
/* get the delayed frames */
for (got_output = 1; got_output; i++) {
fflush(stdout);
ret = avcodec_encode_video2(c, &pkt, NULL, &got_output);
if (ret < 0) {
fprintf(stderr, "Error encoding frame\n");
exit(1);
}
if (got_output) {
printf("Write frame %3d (size=%5d)\n", i, pkt.size);
fwrite(pkt.data, 1, pkt.size, f);
av_packet_unref(&pkt);
}
}
/* add sequence end code to have a real MPEG file */
fwrite(endcode, 1, sizeof(endcode), f);
fclose(f);
avcodec_close(c);
av_free(c);
av_freep(&frame->data[0]);
av_frame_free(&frame);
printf("\n");
}
/*
* Video decoding example
*/
static void pgm_save(unsigned char *buf, int wrap, int xsize, int ysize,
char *filename)
{
FILE *f;
int i;
f = fopen(filename,"w");
fprintf(f, "P5\n%d %d\n%d\n", xsize, ysize, 255);
for (i = 0; i < ysize; i++)
fwrite(buf + i * wrap, 1, xsize, f);
fclose(f);
}
static int decode_write_frame(const char *outfilename, AVCodecContext *avctx,
AVFrame *frame, int *frame_count, AVPacket *pkt, int last)
{
int len, got_frame;
char buf[1024];
len = avcodec_decode_video2(avctx, frame, &got_frame, pkt);
if (len < 0) {
fprintf(stderr, "Error while decoding frame %d\n", *frame_count);
return len;
}
if (got_frame) {
printf("Saving %sframe %3d\n", last ? "last " : "", *frame_count);
fflush(stdout);
/* the picture is allocated by the decoder, no need to free it */
snprintf(buf, sizeof(buf), outfilename, *frame_count);
pgm_save(frame->data[0], frame->linesize[0],
frame->width, frame->height, buf);
(*frame_count)++;
}
if (pkt->data) {
pkt->size -= len;
pkt->data += len;
}
return 0;
}
static void video_decode_example(const char *outfilename, const char *filename)
{
AVCodec *codec;
AVCodecContext *c= NULL;
int frame_count;
FILE *f;
AVFrame *frame;
uint8_t inbuf[INBUF_SIZE + AV_INPUT_BUFFER_PADDING_SIZE];
AVPacket avpkt;
av_init_packet(&avpkt);
/* set end of buffer to 0 (this ensures that no overreading happens for damaged MPEG streams) */
memset(inbuf + INBUF_SIZE, 0, AV_INPUT_BUFFER_PADDING_SIZE);
printf("Decode video file %s to %s\n", filename, outfilename);
/* find the MPEG-1 video decoder */
codec = avcodec_find_decoder(AV_CODEC_ID_MPEG1VIDEO);
if (!codec) {
fprintf(stderr, "Codec not found\n");
exit(1);
}
c = avcodec_alloc_context3(codec);
if (!c) {
fprintf(stderr, "Could not allocate video codec context\n");
exit(1);
}
if (codec->capabilities & AV_CODEC_CAP_TRUNCATED)
c->flags |= AV_CODEC_FLAG_TRUNCATED; // we do not send complete frames
/* For some codecs, such as msmpeg4 and mpeg4, width and height
MUST be initialized there because this information is not
available in the bitstream. */
/* open it */
if (avcodec_open2(c, codec, NULL) < 0) {
fprintf(stderr, "Could not open codec\n");
exit(1);
}
f = fopen(filename, "rb");
if (!f) {
fprintf(stderr, "Could not open %s\n", filename);
exit(1);
}
frame = av_frame_alloc();
if (!frame) {
fprintf(stderr, "Could not allocate video frame\n");
exit(1);
}
frame_count = 0;
for (;;) {
avpkt.size = fread(inbuf, 1, INBUF_SIZE, f);
if (avpkt.size == 0)
break;
/* NOTE1: some codecs are stream based (mpegvideo, mpegaudio)
and this is the only method to use them because you cannot
know the compressed data size before analysing it.
BUT some other codecs (msmpeg4, mpeg4) are inherently frame
based, so you must call them with all the data for one
frame exactly. You must also initialize 'width' and
'height' before initializing them. */
/* NOTE2: some codecs allow the raw parameters (frame size,
sample rate) to be changed at any frame. We handle this, so
you should also take care of it */
/* here, we use a stream based decoder (mpeg1video), so we
feed decoder and see if it could decode a frame */
avpkt.data = inbuf;
while (avpkt.size > 0)
if (decode_write_frame(outfilename, c, frame, &frame_count, &avpkt, 0) < 0)
exit(1);
}
/* Some codecs, such as MPEG, transmit the I- and P-frame with a
latency of one frame. You must do the following to have a
chance to get the last frame of the video. */
avpkt.data = NULL;
avpkt.size = 0;
decode_write_frame(outfilename, c, frame, &frame_count, &avpkt, 1);
fclose(f);
avcodec_close(c);
av_free(c);
av_frame_free(&frame);
printf("\n");
}
int main(int argc, char **argv)
{
const char *output_type;
/* register all the codecs */
avcodec_register_all();
if (argc < 2) {
printf("usage: %s output_type\n"
"API example program to decode/encode a media stream with libavcodec.\n"
"This program generates a synthetic stream and encodes it to a file\n"
"named test.h264, test.mp2 or test.mpg depending on output_type.\n"
"The encoded stream is then decoded and written to a raw data output.\n"
"output_type must be chosen between 'h264', 'mp2', 'mpg'.\n",
argv[0]);
return 1;
}
output_type = argv[1];
if (!strcmp(output_type, "h264")) {
video_encode_example("test.h264", AV_CODEC_ID_H264);
} else if (!strcmp(output_type, "mp2")) {
audio_encode_example("test.mp2");
audio_decode_example("test.pcm", "test.mp2");
} else if (!strcmp(output_type, "mpg")) {
video_encode_example("test.mpg", AV_CODEC_ID_MPEG1VIDEO);
video_decode_example("test%02d.pgm", "test.mpg");
} else {
fprintf(stderr, "Invalid output type '%s', choose between 'h264', 'mp2', or 'mpg'\n",
output_type);
return 1;
}
return 0;
}

View File

@@ -1,228 +0,0 @@
/*
* Copyright (c) 2001 Fabrice Bellard
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
* THE SOFTWARE.
*/
/**
* @file
* audio encoding with libavcodec API example.
*
* @example encode_audio.c
*/
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <libavcodec/avcodec.h>
#include <libavutil/channel_layout.h>
#include <libavutil/common.h>
#include <libavutil/frame.h>
#include <libavutil/samplefmt.h>
/* check that a given sample format is supported by the encoder */
static int check_sample_fmt(const AVCodec *codec, enum AVSampleFormat sample_fmt)
{
const enum AVSampleFormat *p = codec->sample_fmts;
while (*p != AV_SAMPLE_FMT_NONE) {
if (*p == sample_fmt)
return 1;
p++;
}
return 0;
}
/* just pick the highest supported samplerate */
static int select_sample_rate(const AVCodec *codec)
{
const int *p;
int best_samplerate = 0;
if (!codec->supported_samplerates)
return 44100;
p = codec->supported_samplerates;
while (*p) {
if (!best_samplerate || abs(44100 - *p) < abs(44100 - best_samplerate))
best_samplerate = *p;
p++;
}
return best_samplerate;
}
/* select layout with the highest channel count */
static int select_channel_layout(const AVCodec *codec)
{
const uint64_t *p;
uint64_t best_ch_layout = 0;
int best_nb_channels = 0;
if (!codec->channel_layouts)
return AV_CH_LAYOUT_STEREO;
p = codec->channel_layouts;
while (*p) {
int nb_channels = av_get_channel_layout_nb_channels(*p);
if (nb_channels > best_nb_channels) {
best_ch_layout = *p;
best_nb_channels = nb_channels;
}
p++;
}
return best_ch_layout;
}
int main(int argc, char **argv)
{
const char *filename;
const AVCodec *codec;
AVCodecContext *c= NULL;
AVFrame *frame;
AVPacket pkt;
int i, j, k, ret, got_output;
FILE *f;
uint16_t *samples;
float t, tincr;
if (argc <= 1) {
fprintf(stderr, "Usage: %s <output file>\n", argv[0]);
return 0;
}
filename = argv[1];
/* register all the codecs */
avcodec_register_all();
/* find the MP2 encoder */
codec = avcodec_find_encoder(AV_CODEC_ID_MP2);
if (!codec) {
fprintf(stderr, "Codec not found\n");
exit(1);
}
c = avcodec_alloc_context3(codec);
if (!c) {
fprintf(stderr, "Could not allocate audio codec context\n");
exit(1);
}
/* put sample parameters */
c->bit_rate = 64000;
/* check that the encoder supports s16 pcm input */
c->sample_fmt = AV_SAMPLE_FMT_S16;
if (!check_sample_fmt(codec, c->sample_fmt)) {
fprintf(stderr, "Encoder does not support sample format %s",
av_get_sample_fmt_name(c->sample_fmt));
exit(1);
}
/* select other audio parameters supported by the encoder */
c->sample_rate = select_sample_rate(codec);
c->channel_layout = select_channel_layout(codec);
c->channels = av_get_channel_layout_nb_channels(c->channel_layout);
/* open it */
if (avcodec_open2(c, codec, NULL) < 0) {
fprintf(stderr, "Could not open codec\n");
exit(1);
}
f = fopen(filename, "wb");
if (!f) {
fprintf(stderr, "Could not open %s\n", filename);
exit(1);
}
/* frame containing input raw audio */
frame = av_frame_alloc();
if (!frame) {
fprintf(stderr, "Could not allocate audio frame\n");
exit(1);
}
frame->nb_samples = c->frame_size;
frame->format = c->sample_fmt;
frame->channel_layout = c->channel_layout;
/* allocate the data buffers */
ret = av_frame_get_buffer(frame, 0);
if (ret < 0) {
fprintf(stderr, "Could not allocate audio data buffers\n");
exit(1);
}
/* encode a single tone sound */
t = 0;
tincr = 2 * M_PI * 440.0 / c->sample_rate;
for (i = 0; i < 200; i++) {
av_init_packet(&pkt);
pkt.data = NULL; // packet data will be allocated by the encoder
pkt.size = 0;
/* make sure the frame is writable -- makes a copy if the encoder
* kept a reference internally */
ret = av_frame_make_writable(frame);
if (ret < 0)
exit(1);
samples = (uint16_t*)frame->data[0];
for (j = 0; j < c->frame_size; j++) {
samples[2*j] = (int)(sin(t) * 10000);
for (k = 1; k < c->channels; k++)
samples[2*j + k] = samples[2*j];
t += tincr;
}
/* encode the samples */
ret = avcodec_encode_audio2(c, &pkt, frame, &got_output);
if (ret < 0) {
fprintf(stderr, "Error encoding audio frame\n");
exit(1);
}
if (got_output) {
fwrite(pkt.data, 1, pkt.size, f);
av_packet_unref(&pkt);
}
}
/* get the delayed frames */
for (got_output = 1; got_output; i++) {
ret = avcodec_encode_audio2(c, &pkt, NULL, &got_output);
if (ret < 0) {
fprintf(stderr, "Error encoding frame\n");
exit(1);
}
if (got_output) {
fwrite(pkt.data, 1, pkt.size, f);
av_packet_unref(&pkt);
}
}
fclose(f);
av_frame_free(&frame);
avcodec_free_context(&c);
return 0;
}

View File

@@ -1,191 +0,0 @@
/*
* Copyright (c) 2001 Fabrice Bellard
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
* THE SOFTWARE.
*/
/**
* @file
* video encoding with libavcodec API example
*
* @example encode_video.c
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <libavcodec/avcodec.h>
#include <libavutil/opt.h>
#include <libavutil/imgutils.h>
int main(int argc, char **argv)
{
const char *filename, *codec_name;
const AVCodec *codec;
AVCodecContext *c= NULL;
int i, ret, x, y, got_output;
FILE *f;
AVFrame *frame;
AVPacket pkt;
uint8_t endcode[] = { 0, 0, 1, 0xb7 };
if (argc <= 2) {
fprintf(stderr, "Usage: %s <output file> <codec name>\n", argv[0]);
exit(0);
}
filename = argv[1];
codec_name = argv[2];
avcodec_register_all();
/* find the mpeg1video encoder */
codec = avcodec_find_encoder_by_name(codec_name);
if (!codec) {
fprintf(stderr, "Codec not found\n");
exit(1);
}
c = avcodec_alloc_context3(codec);
if (!c) {
fprintf(stderr, "Could not allocate video codec context\n");
exit(1);
}
/* put sample parameters */
c->bit_rate = 400000;
/* resolution must be a multiple of two */
c->width = 352;
c->height = 288;
/* frames per second */
c->time_base = (AVRational){1, 25};
c->framerate = (AVRational){25, 1};
/* emit one intra frame every ten frames
* check frame pict_type before passing frame
* to encoder, if frame->pict_type is AV_PICTURE_TYPE_I
* then gop_size is ignored and the output of encoder
* will always be I frame irrespective to gop_size
*/
c->gop_size = 10;
c->max_b_frames = 1;
c->pix_fmt = AV_PIX_FMT_YUV420P;
if (codec->id == AV_CODEC_ID_H264)
av_opt_set(c->priv_data, "preset", "slow", 0);
/* open it */
if (avcodec_open2(c, codec, NULL) < 0) {
fprintf(stderr, "Could not open codec\n");
exit(1);
}
f = fopen(filename, "wb");
if (!f) {
fprintf(stderr, "Could not open %s\n", filename);
exit(1);
}
frame = av_frame_alloc();
if (!frame) {
fprintf(stderr, "Could not allocate video frame\n");
exit(1);
}
frame->format = c->pix_fmt;
frame->width = c->width;
frame->height = c->height;
ret = av_frame_get_buffer(frame, 32);
if (ret < 0) {
fprintf(stderr, "Could not allocate the video frame data\n");
exit(1);
}
/* encode 1 second of video */
for (i = 0; i < 25; i++) {
av_init_packet(&pkt);
pkt.data = NULL; // packet data will be allocated by the encoder
pkt.size = 0;
fflush(stdout);
/* make sure the frame data is writable */
ret = av_frame_make_writable(frame);
if (ret < 0)
exit(1);
/* prepare a dummy image */
/* Y */
for (y = 0; y < c->height; y++) {
for (x = 0; x < c->width; x++) {
frame->data[0][y * frame->linesize[0] + x] = x + y + i * 3;
}
}
/* Cb and Cr */
for (y = 0; y < c->height/2; y++) {
for (x = 0; x < c->width/2; x++) {
frame->data[1][y * frame->linesize[1] + x] = 128 + y + i * 2;
frame->data[2][y * frame->linesize[2] + x] = 64 + x + i * 5;
}
}
frame->pts = i;
/* encode the image */
ret = avcodec_encode_video2(c, &pkt, frame, &got_output);
if (ret < 0) {
fprintf(stderr, "Error encoding frame\n");
exit(1);
}
if (got_output) {
printf("Write frame %3d (size=%5d)\n", i, pkt.size);
fwrite(pkt.data, 1, pkt.size, f);
av_packet_unref(&pkt);
}
}
/* get the delayed frames */
for (got_output = 1; got_output; i++) {
fflush(stdout);
ret = avcodec_encode_video2(c, &pkt, NULL, &got_output);
if (ret < 0) {
fprintf(stderr, "Error encoding frame\n");
exit(1);
}
if (got_output) {
printf("Write frame %3d (size=%5d)\n", i, pkt.size);
fwrite(pkt.data, 1, pkt.size, f);
av_packet_unref(&pkt);
}
}
/* add sequence end code to have a real MPEG file */
fwrite(endcode, 1, sizeof(endcode), f);
fclose(f);
avcodec_free_context(&c);
av_frame_free(&frame);
return 0;
}

View File

@@ -69,7 +69,8 @@ static int decode_packet(int *got_frame, int cached)
return decoded;
}
static int open_codec_context(AVFormatContext *fmt_ctx, enum AVMediaType type)
static int open_codec_context(int *stream_idx,
AVFormatContext *fmt_ctx, enum AVMediaType type)
{
int ret;
AVStream *st;
@@ -77,27 +78,24 @@ static int open_codec_context(AVFormatContext *fmt_ctx, enum AVMediaType type)
AVCodec *dec = NULL;
AVDictionary *opts = NULL;
ret = av_find_best_stream(fmt_ctx, type, -1, -1, &dec, 0);
ret = av_find_best_stream(fmt_ctx, type, -1, -1, NULL, 0);
if (ret < 0) {
fprintf(stderr, "Could not find %s stream in input file '%s'\n",
av_get_media_type_string(type), src_filename);
return ret;
} else {
int stream_idx = ret;
st = fmt_ctx->streams[stream_idx];
*stream_idx = ret;
st = fmt_ctx->streams[*stream_idx];
dec_ctx = avcodec_alloc_context3(dec);
if (!dec_ctx) {
fprintf(stderr, "Failed to allocate codec\n");
/* find decoder for the stream */
dec_ctx = st->codec;
dec = avcodec_find_decoder(dec_ctx->codec_id);
if (!dec) {
fprintf(stderr, "Failed to find %s codec\n",
av_get_media_type_string(type));
return AVERROR(EINVAL);
}
ret = avcodec_parameters_to_context(dec_ctx, st->codecpar);
if (ret < 0) {
fprintf(stderr, "Failed to copy codec parameters to codec context\n");
return ret;
}
/* Init the video decoder */
av_dict_set(&opts, "flags2", "+export_mvs", 0);
if ((ret = avcodec_open2(dec_ctx, dec, &opts)) < 0) {
@@ -105,10 +103,6 @@ static int open_codec_context(AVFormatContext *fmt_ctx, enum AVMediaType type)
av_get_media_type_string(type));
return ret;
}
video_stream_idx = stream_idx;
video_stream = fmt_ctx->streams[video_stream_idx];
video_dec_ctx = dec_ctx;
}
return 0;
@@ -136,7 +130,10 @@ int main(int argc, char **argv)
exit(1);
}
open_codec_context(fmt_ctx, AVMEDIA_TYPE_VIDEO);
if (open_codec_context(&video_stream_idx, fmt_ctx, AVMEDIA_TYPE_VIDEO) >= 0) {
video_stream = fmt_ctx->streams[video_stream_idx];
video_dec_ctx = video_stream->codec;
}
av_dump_format(fmt_ctx, 0, src_filename, 0);
@@ -181,7 +178,7 @@ int main(int argc, char **argv)
} while (got_frame);
end:
avcodec_free_context(&video_dec_ctx);
avcodec_close(video_dec_ctx);
avformat_close_input(&fmt_ctx);
av_frame_free(&frame);
return ret < 0;

View File

@@ -69,12 +69,7 @@ static int open_input_file(const char *filename)
return ret;
}
audio_stream_index = ret;
/* create decoding context */
dec_ctx = avcodec_alloc_context3(dec);
if (!dec_ctx)
return AVERROR(ENOMEM);
avcodec_parameters_to_context(dec_ctx, fmt_ctx->streams[audio_stream_index]->codecpar);
dec_ctx = fmt_ctx->streams[audio_stream_index]->codec;
av_opt_set_int(dec_ctx, "refcounted_frames", 1, 0);
/* init the audio decoder */
@@ -216,9 +211,10 @@ static void print_frame(const AVFrame *frame)
int main(int argc, char **argv)
{
int ret;
AVPacket packet;
AVPacket packet0, packet;
AVFrame *frame = av_frame_alloc();
AVFrame *filt_frame = av_frame_alloc();
int got_frame;
if (!frame || !filt_frame) {
perror("Could not allocate frame");
@@ -238,52 +234,54 @@ int main(int argc, char **argv)
goto end;
/* read all packets */
packet0.data = NULL;
packet.data = NULL;
while (1) {
if ((ret = av_read_frame(fmt_ctx, &packet)) < 0)
break;
if (!packet0.data) {
if ((ret = av_read_frame(fmt_ctx, &packet)) < 0)
break;
packet0 = packet;
}
if (packet.stream_index == audio_stream_index) {
ret = avcodec_send_packet(dec_ctx, &packet);
got_frame = 0;
ret = avcodec_decode_audio4(dec_ctx, frame, &got_frame, &packet);
if (ret < 0) {
av_log(NULL, AV_LOG_ERROR, "Error while sending a packet to the decoder\n");
break;
av_log(NULL, AV_LOG_ERROR, "Error decoding audio\n");
continue;
}
packet.size -= ret;
packet.data += ret;
while (ret >= 0) {
ret = avcodec_receive_frame(dec_ctx, frame);
if (ret == AVERROR(EAGAIN) || ret == AVERROR_EOF) {
if (got_frame) {
/* push the audio data from decoded frame into the filtergraph */
if (av_buffersrc_add_frame_flags(buffersrc_ctx, frame, 0) < 0) {
av_log(NULL, AV_LOG_ERROR, "Error while feeding the audio filtergraph\n");
break;
} else if (ret < 0) {
av_log(NULL, AV_LOG_ERROR, "Error while receiving a frame from the decoder\n");
goto end;
}
if (ret >= 0) {
/* push the audio data from decoded frame into the filtergraph */
if (av_buffersrc_add_frame_flags(buffersrc_ctx, frame, AV_BUFFERSRC_FLAG_KEEP_REF) < 0) {
av_log(NULL, AV_LOG_ERROR, "Error while feeding the audio filtergraph\n");
/* pull filtered audio from the filtergraph */
while (1) {
ret = av_buffersink_get_frame(buffersink_ctx, filt_frame);
if (ret == AVERROR(EAGAIN) || ret == AVERROR_EOF)
break;
}
/* pull filtered audio from the filtergraph */
while (1) {
ret = av_buffersink_get_frame(buffersink_ctx, filt_frame);
if (ret == AVERROR(EAGAIN) || ret == AVERROR_EOF)
break;
if (ret < 0)
goto end;
print_frame(filt_frame);
av_frame_unref(filt_frame);
}
av_frame_unref(frame);
if (ret < 0)
goto end;
print_frame(filt_frame);
av_frame_unref(filt_frame);
}
}
if (packet.size <= 0)
av_packet_unref(&packet0);
} else {
/* discard non-wanted packets */
av_packet_unref(&packet0);
}
av_packet_unref(&packet);
}
end:
avfilter_graph_free(&filter_graph);
avcodec_free_context(&dec_ctx);
avcodec_close(dec_ctx);
avformat_close_input(&fmt_ctx);
av_frame_free(&frame);
av_frame_free(&filt_frame);

View File

@@ -72,12 +72,7 @@ static int open_input_file(const char *filename)
return ret;
}
video_stream_index = ret;
/* create decoding context */
dec_ctx = avcodec_alloc_context3(dec);
if (!dec_ctx)
return AVERROR(ENOMEM);
avcodec_parameters_to_context(dec_ctx, fmt_ctx->streams[video_stream_index]->codecpar);
dec_ctx = fmt_ctx->streams[video_stream_index]->codec;
av_opt_set_int(dec_ctx, "refcounted_frames", 1, 0);
/* init the video decoder */
@@ -213,6 +208,7 @@ int main(int argc, char **argv)
AVPacket packet;
AVFrame *frame = av_frame_alloc();
AVFrame *filt_frame = av_frame_alloc();
int got_frame;
if (!frame || !filt_frame) {
perror("Could not allocate frame");
@@ -237,49 +233,40 @@ int main(int argc, char **argv)
break;
if (packet.stream_index == video_stream_index) {
ret = avcodec_send_packet(dec_ctx, &packet);
got_frame = 0;
ret = avcodec_decode_video2(dec_ctx, frame, &got_frame, &packet);
if (ret < 0) {
av_log(NULL, AV_LOG_ERROR, "Error while sending a packet to the decoder\n");
av_log(NULL, AV_LOG_ERROR, "Error decoding video\n");
break;
}
while (ret >= 0) {
ret = avcodec_receive_frame(dec_ctx, frame);
if (ret == AVERROR(EAGAIN) || ret == AVERROR_EOF) {
if (got_frame) {
frame->pts = av_frame_get_best_effort_timestamp(frame);
/* push the decoded frame into the filtergraph */
if (av_buffersrc_add_frame_flags(buffersrc_ctx, frame, AV_BUFFERSRC_FLAG_KEEP_REF) < 0) {
av_log(NULL, AV_LOG_ERROR, "Error while feeding the filtergraph\n");
break;
} else if (ret < 0) {
av_log(NULL, AV_LOG_ERROR, "Error while receiving a frame from the decoder\n");
goto end;
}
if (ret >= 0) {
frame->pts = av_frame_get_best_effort_timestamp(frame);
/* push the decoded frame into the filtergraph */
if (av_buffersrc_add_frame_flags(buffersrc_ctx, frame, AV_BUFFERSRC_FLAG_KEEP_REF) < 0) {
av_log(NULL, AV_LOG_ERROR, "Error while feeding the filtergraph\n");
/* pull filtered frames from the filtergraph */
while (1) {
ret = av_buffersink_get_frame(buffersink_ctx, filt_frame);
if (ret == AVERROR(EAGAIN) || ret == AVERROR_EOF)
break;
}
/* pull filtered frames from the filtergraph */
while (1) {
ret = av_buffersink_get_frame(buffersink_ctx, filt_frame);
if (ret == AVERROR(EAGAIN) || ret == AVERROR_EOF)
break;
if (ret < 0)
goto end;
display_frame(filt_frame, buffersink_ctx->inputs[0]->time_base);
av_frame_unref(filt_frame);
}
av_frame_unref(frame);
if (ret < 0)
goto end;
display_frame(filt_frame, buffersink_ctx->inputs[0]->time_base);
av_frame_unref(filt_frame);
}
av_frame_unref(frame);
}
}
av_packet_unref(&packet);
}
end:
avfilter_graph_free(&filter_graph);
avcodec_free_context(&dec_ctx);
avcodec_close(dec_ctx);
avformat_close_input(&fmt_ctx);
av_frame_free(&frame);
av_frame_free(&filt_frame);

View File

@@ -45,7 +45,6 @@ static void process_client(AVIOContext *client, const char *in_uri)
// may return empty string.
if (resource && strlen(resource))
break;
av_freep(&resource);
}
if (ret < 0)
goto end;
@@ -94,7 +93,6 @@ end:
avio_close(client);
fprintf(stderr, "Closing input\n");
avio_close(input);
av_freep(&resource);
}
int main(int argc, char **argv)

View File

@@ -335,15 +335,15 @@ static int write_audio_frame(AVFormatContext *oc, OutputStream *ost)
if (ret < 0)
exit(1);
/* convert to destination format */
ret = swr_convert(ost->swr_ctx,
ost->frame->data, dst_nb_samples,
(const uint8_t **)frame->data, frame->nb_samples);
if (ret < 0) {
fprintf(stderr, "Error while converting\n");
exit(1);
}
frame = ost->frame;
/* convert to destination format */
ret = swr_convert(ost->swr_ctx,
ost->frame->data, dst_nb_samples,
(const uint8_t **)frame->data, frame->nb_samples);
if (ret < 0) {
fprintf(stderr, "Error while converting\n");
exit(1);
}
frame = ost->frame;
frame->pts = av_rescale_q(ost->samples_count, (AVRational){1, c->sample_rate}, c->time_base);
ost->samples_count += dst_nb_samples;
@@ -440,7 +440,15 @@ static void open_video(AVFormatContext *oc, AVCodec *codec, OutputStream *ost, A
static void fill_yuv_image(AVFrame *pict, int frame_index,
int width, int height)
{
int x, y, i;
int x, y, i, ret;
/* when we pass a frame to the encoder, it may keep a reference to it
* internally;
* make sure we do not overwrite it here
*/
ret = av_frame_make_writable(pict);
if (ret < 0)
exit(1);
i = frame_index;
@@ -467,11 +475,6 @@ static AVFrame *get_video_frame(OutputStream *ost)
STREAM_DURATION, (AVRational){ 1, 1 }) >= 0)
return NULL;
/* when we pass a frame to the encoder, it may keep a reference to it
* internally; make sure we do not overwrite it here */
if (av_frame_make_writable(ost->frame) < 0)
exit(1);
if (c->pix_fmt != AV_PIX_FMT_YUV420P) {
/* as we only generate a YUV420P picture, we must convert it
* to the codec pixel format if needed */

View File

@@ -50,9 +50,6 @@ int main(int argc, char **argv)
AVPacket pkt;
const char *in_filename, *out_filename;
int ret, i;
int stream_index = 0;
int *stream_mapping = NULL;
int stream_mapping_size = 0;
if (argc < 3) {
printf("usage: %s input output\n"
@@ -86,42 +83,25 @@ int main(int argc, char **argv)
goto end;
}
stream_mapping_size = ifmt_ctx->nb_streams;
stream_mapping = av_mallocz_array(stream_mapping_size, sizeof(*stream_mapping));
if (!stream_mapping) {
ret = AVERROR(ENOMEM);
goto end;
}
ofmt = ofmt_ctx->oformat;
for (i = 0; i < ifmt_ctx->nb_streams; i++) {
AVStream *out_stream;
AVStream *in_stream = ifmt_ctx->streams[i];
AVCodecParameters *in_codecpar = in_stream->codecpar;
if (in_codecpar->codec_type != AVMEDIA_TYPE_AUDIO &&
in_codecpar->codec_type != AVMEDIA_TYPE_VIDEO &&
in_codecpar->codec_type != AVMEDIA_TYPE_SUBTITLE) {
stream_mapping[i] = -1;
continue;
}
stream_mapping[i] = stream_index++;
out_stream = avformat_new_stream(ofmt_ctx, NULL);
AVStream *out_stream = avformat_new_stream(ofmt_ctx, in_stream->codec->codec);
if (!out_stream) {
fprintf(stderr, "Failed allocating output stream\n");
ret = AVERROR_UNKNOWN;
goto end;
}
ret = avcodec_parameters_copy(out_stream->codecpar, in_codecpar);
ret = avcodec_copy_context(out_stream->codec, in_stream->codec);
if (ret < 0) {
fprintf(stderr, "Failed to copy codec parameters\n");
fprintf(stderr, "Failed to copy context from input to output stream codec context\n");
goto end;
}
out_stream->codecpar->codec_tag = 0;
out_stream->codec->codec_tag = 0;
if (ofmt_ctx->oformat->flags & AVFMT_GLOBALHEADER)
out_stream->codec->flags |= AV_CODEC_FLAG_GLOBAL_HEADER;
}
av_dump_format(ofmt_ctx, 0, out_filename, 1);
@@ -147,14 +127,8 @@ int main(int argc, char **argv)
break;
in_stream = ifmt_ctx->streams[pkt.stream_index];
if (pkt.stream_index >= stream_mapping_size ||
stream_mapping[pkt.stream_index] < 0) {
av_packet_unref(&pkt);
continue;
}
pkt.stream_index = stream_mapping[pkt.stream_index];
out_stream = ofmt_ctx->streams[pkt.stream_index];
log_packet(ifmt_ctx, &pkt, "in");
/* copy packet */
@@ -182,8 +156,6 @@ end:
avio_closep(&ofmt_ctx->pb);
avformat_free_context(ofmt_ctx);
av_freep(&stream_mapping);
if (ret < 0 && ret != AVERROR_EOF) {
fprintf(stderr, "Error occurred: %s\n", av_err2str(ret));
return 1;

View File

@@ -45,6 +45,18 @@
/** The number of output channels */
#define OUTPUT_CHANNELS 2
/**
* Convert an error code into a text message.
* @param error Error code to be converted
* @return Corresponding error text (not thread-safe)
*/
static const char *get_error_text(const int error)
{
static char error_buffer[255];
av_strerror(error, error_buffer, sizeof(error_buffer));
return error_buffer;
}
/** Open an input file and the required decoder. */
static int open_input_file(const char *filename,
AVFormatContext **input_format_context,
@@ -58,7 +70,7 @@ static int open_input_file(const char *filename,
if ((error = avformat_open_input(input_format_context, filename, NULL,
NULL)) < 0) {
fprintf(stderr, "Could not open input file '%s' (error '%s')\n",
filename, av_err2str(error));
filename, get_error_text(error));
*input_format_context = NULL;
return error;
}
@@ -66,7 +78,7 @@ static int open_input_file(const char *filename,
/** Get information on the input file (number of streams etc.). */
if ((error = avformat_find_stream_info(*input_format_context, NULL)) < 0) {
fprintf(stderr, "Could not open find stream info (error '%s')\n",
av_err2str(error));
get_error_text(error));
avformat_close_input(input_format_context);
return error;
}
@@ -105,7 +117,7 @@ static int open_input_file(const char *filename,
/** Open the decoder for the audio stream to use it later. */
if ((error = avcodec_open2(avctx, input_codec, NULL)) < 0) {
fprintf(stderr, "Could not open input codec (error '%s')\n",
av_err2str(error));
get_error_text(error));
avcodec_free_context(&avctx);
avformat_close_input(input_format_context);
return error;
@@ -137,7 +149,7 @@ static int open_output_file(const char *filename,
if ((error = avio_open(&output_io_context, filename,
AVIO_FLAG_WRITE)) < 0) {
fprintf(stderr, "Could not open output file '%s' (error '%s')\n",
filename, av_err2str(error));
filename, get_error_text(error));
return error;
}
@@ -207,7 +219,7 @@ static int open_output_file(const char *filename,
/** Open the encoder for the audio stream to use it later. */
if ((error = avcodec_open2(avctx, output_codec, NULL)) < 0) {
fprintf(stderr, "Could not open output codec (error '%s')\n",
av_err2str(error));
get_error_text(error));
goto cleanup;
}
@@ -313,7 +325,7 @@ static int write_output_file_header(AVFormatContext *output_format_context)
int error;
if ((error = avformat_write_header(output_format_context, NULL)) < 0) {
fprintf(stderr, "Could not write output file header (error '%s')\n",
av_err2str(error));
get_error_text(error));
return error;
}
return 0;
@@ -337,7 +349,7 @@ static int decode_audio_frame(AVFrame *frame,
*finished = 1;
else {
fprintf(stderr, "Could not read frame (error '%s')\n",
av_err2str(error));
get_error_text(error));
return error;
}
}
@@ -351,7 +363,7 @@ static int decode_audio_frame(AVFrame *frame,
if ((error = avcodec_decode_audio4(input_codec_context, frame,
data_present, &input_packet)) < 0) {
fprintf(stderr, "Could not decode frame (error '%s')\n",
av_err2str(error));
get_error_text(error));
av_packet_unref(&input_packet);
return error;
}
@@ -398,7 +410,7 @@ static int init_converted_samples(uint8_t ***converted_input_samples,
output_codec_context->sample_fmt, 0)) < 0) {
fprintf(stderr,
"Could not allocate converted input samples (error '%s')\n",
av_err2str(error));
get_error_text(error));
av_freep(&(*converted_input_samples)[0]);
free(*converted_input_samples);
return error;
@@ -422,7 +434,7 @@ static int convert_samples(const uint8_t **input_data,
converted_data, frame_size,
input_data , frame_size)) < 0) {
fprintf(stderr, "Could not convert input samples (error '%s')\n",
av_err2str(error));
get_error_text(error));
return error;
}
@@ -554,8 +566,8 @@ static int init_output_frame(AVFrame **frame,
* sure that the audio frame can hold as many samples as specified.
*/
if ((error = av_frame_get_buffer(*frame, 0)) < 0) {
fprintf(stderr, "Could not allocate output frame samples (error '%s')\n",
av_err2str(error));
fprintf(stderr, "Could allocate output frame samples (error '%s')\n",
get_error_text(error));
av_frame_free(frame);
return error;
}
@@ -590,7 +602,7 @@ static int encode_audio_frame(AVFrame *frame,
if ((error = avcodec_encode_audio2(output_codec_context, &output_packet,
frame, data_present)) < 0) {
fprintf(stderr, "Could not encode frame (error '%s')\n",
av_err2str(error));
get_error_text(error));
av_packet_unref(&output_packet);
return error;
}
@@ -599,7 +611,7 @@ static int encode_audio_frame(AVFrame *frame,
if (*data_present) {
if ((error = av_write_frame(output_format_context, &output_packet)) < 0) {
fprintf(stderr, "Could not write frame (error '%s')\n",
av_err2str(error));
get_error_text(error));
av_packet_unref(&output_packet);
return error;
}
@@ -659,7 +671,7 @@ static int write_output_file_trailer(AVFormatContext *output_format_context)
int error;
if ((error = av_write_trailer(output_format_context)) < 0) {
fprintf(stderr, "Could not write output file trailer (error '%s')\n",
av_err2str(error));
get_error_text(error));
return error;
}
return 0;

View File

@@ -45,12 +45,6 @@ typedef struct FilteringContext {
} FilteringContext;
static FilteringContext *filter_ctx;
typedef struct StreamContext {
AVCodecContext *dec_ctx;
AVCodecContext *enc_ctx;
} StreamContext;
static StreamContext *stream_ctx;
static int open_input_file(const char *filename)
{
int ret;
@@ -67,42 +61,22 @@ static int open_input_file(const char *filename)
return ret;
}
stream_ctx = av_mallocz_array(ifmt_ctx->nb_streams, sizeof(*stream_ctx));
if (!stream_ctx)
return AVERROR(ENOMEM);
for (i = 0; i < ifmt_ctx->nb_streams; i++) {
AVStream *stream = ifmt_ctx->streams[i];
AVCodec *dec = avcodec_find_decoder(stream->codecpar->codec_id);
AVStream *stream;
AVCodecContext *codec_ctx;
if (!dec) {
av_log(NULL, AV_LOG_ERROR, "Failed to find decoder for stream #%u\n", i);
return AVERROR_DECODER_NOT_FOUND;
}
codec_ctx = avcodec_alloc_context3(dec);
if (!codec_ctx) {
av_log(NULL, AV_LOG_ERROR, "Failed to allocate the decoder context for stream #%u\n", i);
return AVERROR(ENOMEM);
}
ret = avcodec_parameters_to_context(codec_ctx, stream->codecpar);
if (ret < 0) {
av_log(NULL, AV_LOG_ERROR, "Failed to copy decoder parameters to input decoder context "
"for stream #%u\n", i);
return ret;
}
stream = ifmt_ctx->streams[i];
codec_ctx = stream->codec;
/* Reencode video & audio and remux subtitles etc. */
if (codec_ctx->codec_type == AVMEDIA_TYPE_VIDEO
|| codec_ctx->codec_type == AVMEDIA_TYPE_AUDIO) {
if (codec_ctx->codec_type == AVMEDIA_TYPE_VIDEO)
codec_ctx->framerate = av_guess_frame_rate(ifmt_ctx, stream, NULL);
/* Open decoder */
ret = avcodec_open2(codec_ctx, dec, NULL);
ret = avcodec_open2(codec_ctx,
avcodec_find_decoder(codec_ctx->codec_id), NULL);
if (ret < 0) {
av_log(NULL, AV_LOG_ERROR, "Failed to open decoder for stream #%u\n", i);
return ret;
}
}
stream_ctx[i].dec_ctx = codec_ctx;
}
av_dump_format(ifmt_ctx, 0, filename, 0);
@@ -134,7 +108,8 @@ static int open_output_file(const char *filename)
}
in_stream = ifmt_ctx->streams[i];
dec_ctx = stream_ctx[i].dec_ctx;
dec_ctx = in_stream->codec;
enc_ctx = out_stream->codec;
if (dec_ctx->codec_type == AVMEDIA_TYPE_VIDEO
|| dec_ctx->codec_type == AVMEDIA_TYPE_AUDIO) {
@@ -144,11 +119,6 @@ static int open_output_file(const char *filename)
av_log(NULL, AV_LOG_FATAL, "Necessary encoder not found\n");
return AVERROR_INVALIDDATA;
}
enc_ctx = avcodec_alloc_context3(encoder);
if (!enc_ctx) {
av_log(NULL, AV_LOG_FATAL, "Failed to allocate the encoder context\n");
return AVERROR(ENOMEM);
}
/* In this example, we transcode to same properties (picture size,
* sample rate etc.). These properties can be changed for output
@@ -163,7 +133,7 @@ static int open_output_file(const char *filename)
else
enc_ctx->pix_fmt = dec_ctx->pix_fmt;
/* video time_base can be set to whatever is handy and supported by encoder */
enc_ctx->time_base = av_inv_q(dec_ctx->framerate);
enc_ctx->time_base = dec_ctx->time_base;
} else {
enc_ctx->sample_rate = dec_ctx->sample_rate;
enc_ctx->channel_layout = dec_ctx->channel_layout;
@@ -179,29 +149,22 @@ static int open_output_file(const char *filename)
av_log(NULL, AV_LOG_ERROR, "Cannot open video encoder for stream #%u\n", i);
return ret;
}
ret = avcodec_parameters_from_context(out_stream->codecpar, enc_ctx);
if (ret < 0) {
av_log(NULL, AV_LOG_ERROR, "Failed to copy encoder parameters to output stream #%u\n", i);
return ret;
}
if (ofmt_ctx->oformat->flags & AVFMT_GLOBALHEADER)
enc_ctx->flags |= AV_CODEC_FLAG_GLOBAL_HEADER;
out_stream->time_base = enc_ctx->time_base;
stream_ctx[i].enc_ctx = enc_ctx;
} else if (dec_ctx->codec_type == AVMEDIA_TYPE_UNKNOWN) {
av_log(NULL, AV_LOG_FATAL, "Elementary stream #%d is of unknown type, cannot proceed\n", i);
return AVERROR_INVALIDDATA;
} else {
/* if this stream must be remuxed */
ret = avcodec_parameters_copy(out_stream->codecpar, in_stream->codecpar);
ret = avcodec_copy_context(ofmt_ctx->streams[i]->codec,
ifmt_ctx->streams[i]->codec);
if (ret < 0) {
av_log(NULL, AV_LOG_ERROR, "Copying parameters for stream #%u failed\n", i);
av_log(NULL, AV_LOG_ERROR, "Copying stream context failed\n");
return ret;
}
out_stream->time_base = in_stream->time_base;
}
if (ofmt_ctx->oformat->flags & AVFMT_GLOBALHEADER)
enc_ctx->flags |= AV_CODEC_FLAG_GLOBAL_HEADER;
}
av_dump_format(ofmt_ctx, 0, filename, 1);
@@ -385,17 +348,17 @@ static int init_filters(void)
filter_ctx[i].buffersrc_ctx = NULL;
filter_ctx[i].buffersink_ctx = NULL;
filter_ctx[i].filter_graph = NULL;
if (!(ifmt_ctx->streams[i]->codecpar->codec_type == AVMEDIA_TYPE_AUDIO
|| ifmt_ctx->streams[i]->codecpar->codec_type == AVMEDIA_TYPE_VIDEO))
if (!(ifmt_ctx->streams[i]->codec->codec_type == AVMEDIA_TYPE_AUDIO
|| ifmt_ctx->streams[i]->codec->codec_type == AVMEDIA_TYPE_VIDEO))
continue;
if (ifmt_ctx->streams[i]->codecpar->codec_type == AVMEDIA_TYPE_VIDEO)
if (ifmt_ctx->streams[i]->codec->codec_type == AVMEDIA_TYPE_VIDEO)
filter_spec = "null"; /* passthrough (dummy) filter for video */
else
filter_spec = "anull"; /* passthrough (dummy) filter for audio */
ret = init_filter(&filter_ctx[i], stream_ctx[i].dec_ctx,
stream_ctx[i].enc_ctx, filter_spec);
ret = init_filter(&filter_ctx[i], ifmt_ctx->streams[i]->codec,
ofmt_ctx->streams[i]->codec, filter_spec);
if (ret)
return ret;
}
@@ -407,7 +370,7 @@ static int encode_write_frame(AVFrame *filt_frame, unsigned int stream_index, in
int got_frame_local;
AVPacket enc_pkt;
int (*enc_func)(AVCodecContext *, AVPacket *, const AVFrame *, int *) =
(ifmt_ctx->streams[stream_index]->codecpar->codec_type ==
(ifmt_ctx->streams[stream_index]->codec->codec_type ==
AVMEDIA_TYPE_VIDEO) ? avcodec_encode_video2 : avcodec_encode_audio2;
if (!got_frame)
@@ -418,7 +381,7 @@ static int encode_write_frame(AVFrame *filt_frame, unsigned int stream_index, in
enc_pkt.data = NULL;
enc_pkt.size = 0;
av_init_packet(&enc_pkt);
ret = enc_func(stream_ctx[stream_index].enc_ctx, &enc_pkt,
ret = enc_func(ofmt_ctx->streams[stream_index]->codec, &enc_pkt,
filt_frame, got_frame);
av_frame_free(&filt_frame);
if (ret < 0)
@@ -429,7 +392,7 @@ static int encode_write_frame(AVFrame *filt_frame, unsigned int stream_index, in
/* prepare packet for muxing */
enc_pkt.stream_index = stream_index;
av_packet_rescale_ts(&enc_pkt,
stream_ctx[stream_index].enc_ctx->time_base,
ofmt_ctx->streams[stream_index]->codec->time_base,
ofmt_ctx->streams[stream_index]->time_base);
av_log(NULL, AV_LOG_DEBUG, "Muxing frame\n");
@@ -487,7 +450,7 @@ static int flush_encoder(unsigned int stream_index)
int ret;
int got_frame;
if (!(stream_ctx[stream_index].enc_ctx->codec->capabilities &
if (!(ofmt_ctx->streams[stream_index]->codec->codec->capabilities &
AV_CODEC_CAP_DELAY))
return 0;
@@ -533,7 +496,7 @@ int main(int argc, char **argv)
if ((ret = av_read_frame(ifmt_ctx, &packet)) < 0)
break;
stream_index = packet.stream_index;
type = ifmt_ctx->streams[packet.stream_index]->codecpar->codec_type;
type = ifmt_ctx->streams[packet.stream_index]->codec->codec_type;
av_log(NULL, AV_LOG_DEBUG, "Demuxer gave frame of stream_index %u\n",
stream_index);
@@ -546,10 +509,10 @@ int main(int argc, char **argv)
}
av_packet_rescale_ts(&packet,
ifmt_ctx->streams[stream_index]->time_base,
stream_ctx[stream_index].dec_ctx->time_base);
ifmt_ctx->streams[stream_index]->codec->time_base);
dec_func = (type == AVMEDIA_TYPE_VIDEO) ? avcodec_decode_video2 :
avcodec_decode_audio4;
ret = dec_func(stream_ctx[stream_index].dec_ctx, frame,
ret = dec_func(ifmt_ctx->streams[stream_index]->codec, frame,
&got_frame, &packet);
if (ret < 0) {
av_frame_free(&frame);
@@ -603,14 +566,13 @@ end:
av_packet_unref(&packet);
av_frame_free(&frame);
for (i = 0; i < ifmt_ctx->nb_streams; i++) {
avcodec_free_context(&stream_ctx[i].dec_ctx);
if (ofmt_ctx && ofmt_ctx->nb_streams > i && ofmt_ctx->streams[i] && stream_ctx[i].enc_ctx)
avcodec_free_context(&stream_ctx[i].enc_ctx);
avcodec_close(ifmt_ctx->streams[i]->codec);
if (ofmt_ctx && ofmt_ctx->nb_streams > i && ofmt_ctx->streams[i] && ofmt_ctx->streams[i]->codec)
avcodec_close(ofmt_ctx->streams[i]->codec);
if (filter_ctx && filter_ctx[i].filter_graph)
avfilter_graph_free(&filter_ctx[i].filter_graph);
}
av_free(filter_ctx);
av_free(stream_ctx);
avformat_close_input(&ifmt_ctx);
if (ofmt_ctx && !(ofmt_ctx->oformat->flags & AVFMT_NOFILE))
avio_closep(&ofmt_ctx->pb);

View File

@@ -197,11 +197,6 @@ through @command{ssh}.
@item GEN
Set to @samp{1} to generate the missing or mismatched references.
@item HWACCEL
Specify which hardware acceleration to use while running regression tests,
by default @samp{none} is used.
@end table
@section Examples

View File

@@ -357,40 +357,6 @@ To set the language of the first audio stream:
ffmpeg -i INPUT -metadata:s:a:0 language=eng OUTPUT
@end example
@item -disposition[:stream_specifier] @var{value} (@emph{output,per-stream})
Sets the disposition for a stream.
This option overrides the disposition copied from the input stream. It is also
possible to delete the disposition by setting it to 0.
The following dispositions are recognized:
@table @option
@item default
@item dub
@item original
@item comment
@item lyrics
@item karaoke
@item forced
@item hearing_impaired
@item visual_impaired
@item clean_effects
@item captions
@item descriptions
@item metadata
@end table
For example, to make the second audio stream the default stream:
@example
ffmpeg -i in.mkv -disposition:a:1 default out.mkv
@end example
To make the second subtitle stream the default stream and remove the default
disposition from the first subtitle stream:
@example
ffmpeg -i INPUT -disposition:s:0 0 -disposition:s:1 default OUTPUT
@end example
@item -program [title=@var{title}:][program_num=@var{program_num}:]st=@var{stream}[:st=@var{stream}...] (@emph{output})
Creates a program with the specified @var{title}, @var{program_num} and adds the specified
@@ -414,8 +380,7 @@ ffmpeg -i myfile.avi -target vcd -bf 2 /tmp/vcd.mpg
@end example
@item -dframes @var{number} (@emph{output})
Set the number of data frames to output. This is an obsolete alias for
@code{-frames:d}, which you should use instead.
Set the number of data frames to output. This is an alias for @code{-frames:d}.
@item -frames[:@var{stream_specifier}] @var{framecount} (@emph{output,per-stream})
Stop writing to the stream after @var{framecount} frames.
@@ -450,11 +415,6 @@ This option is similar to @option{-filter}, the only difference is that its
argument is the name of the file from which a filtergraph description is to be
read.
@item -filter_threads @var{nb_threads} (@emph{global})
Defines how many threads are used to process a filter pipeline. Each pipeline
will produce a thread pool with this many threads available for parallel processing.
The default is the number of available CPUs.
@item -pre[:@var{stream_specifier}] @var{preset_name} (@emph{output,per-stream})
Specify the preset for matching stream(s).
@@ -530,8 +490,7 @@ Disable automatically rotating video based on file metadata.
@table @option
@item -vframes @var{number} (@emph{output})
Set the number of video frames to output. This is an obsolete alias for
@code{-frames:v}, which you should use instead.
Set the number of video frames to output. This is an alias for @code{-frames:v}.
@item -r[:@var{stream_specifier}] @var{fps} (@emph{input/output,per-stream})
Set frame rate (Hz value, fraction or abbreviation).
@@ -638,16 +597,6 @@ Calculate PSNR of compressed frames.
Dump video coding statistics to @file{vstats_HHMMSS.log}.
@item -vstats_file @var{file}
Dump video coding statistics to @var{file}.
@item -vstats_version @var{file}
Specifies which version of the vstats format to use. Default is 2.
version = 1 :
@code{frame= %5d q= %2.1f PSNR= %6.2f f_size= %6d s_size= %8.0fkB time= %0.3f br= %7.1fkbits/s avg_br= %7.1fkbits/s}
version > 1:
@code{out= %2d st= %2d frame= %5d q= %2.1f PSNR= %6.2f f_size= %6d s_size= %8.0fkB time= %0.3f br= %7.1fkbits/s avg_br= %7.1fkbits/s}
@item -top[:@var{stream_specifier}] @var{n} (@emph{output,per-stream})
top=1/bottom=0/auto=-1 field first
@item -dc @var{precision}
@@ -794,8 +743,7 @@ List all hardware acceleration methods supported in this build of ffmpeg.
@table @option
@item -aframes @var{number} (@emph{output})
Set the number of audio frames to output. This is an obsolete alias for
@code{-frames:a}, which you should use instead.
Set the number of audio frames to output. This is an alias for @code{-frames:a}.
@item -ar[:@var{stream_specifier}] @var{freq} (@emph{input/output,per-stream})
Set the audio sampling frequency. For output streams it is set by
default to the frequency of the corresponding input stream. For input
@@ -874,7 +822,7 @@ Set the size of the canvas used to render subtitles.
@section Advanced options
@table @option
@item -map [-]@var{input_file_id}[:@var{stream_specifier}][?][,@var{sync_file_id}[:@var{stream_specifier}]] | @var{[linklabel]} (@emph{output})
@item -map [-]@var{input_file_id}[:@var{stream_specifier}][,@var{sync_file_id}[:@var{stream_specifier}]] | @var{[linklabel]} (@emph{output})
Designate one or more input streams as a source for the output file. Each input
stream is identified by the input file index @var{input_file_id} and
@@ -890,11 +838,6 @@ the source for output stream 1, etc.
A @code{-} character before the stream identifier creates a "negative" mapping.
It disables matching streams from already created mappings.
A trailing @code{?} after the stream index will allow the map to be
optional: if the map matches no streams the map will be ignored instead
of failing. Note the map will still fail if an invalid input file index
is used; such as if the map refers to a non-existant input.
An alternative @var{[linklabel]} form will map outputs from complex filter
graphs (see the @option{-filter_complex} option) to the output file.
@var{linklabel} must correspond to a defined output link label in the graph.
@@ -932,13 +875,6 @@ To map all the streams except the second audio, use negative mappings
ffmpeg -i INPUT -map 0 -map -0:a:1 OUTPUT
@end example
To map the video and audio streams from the first input, and using the
trailing @code{?}, ignore the audio mapping if no audio streams exist in
the first input:
@example
ffmpeg -i INPUT -map 0:v -map 0:a? OUTPUT
@end example
To pick the English audio stream:
@example
ffmpeg -i INPUT -map 0:m:language:eng OUTPUT
@@ -1265,11 +1201,6 @@ To generate 5 seconds of pure red video using lavfi @code{color} source:
ffmpeg -filter_complex 'color=c=red' -t 5 out.mkv
@end example
@item -filter_complex_threads @var{nb_threads} (@emph{global})
Defines how many threads are used to process a filter_complex graph.
Similar to filter_threads but used for @code{-filter_complex} graphs only.
The default is the number of available CPUs.
@item -lavfi @var{filtergraph} (@emph{global})
Define a complex filtergraph, i.e. one with arbitrary number of inputs and/or
outputs. Equivalent to @option{-filter_complex}.
@@ -1562,7 +1493,7 @@ to enable LAME support by passing @code{--enable-libmp3lame} to configure.
The mapping is particularly useful for DVD transcoding
to get the desired audio language.
NOTE: To see the supported input formats, use @code{ffmpeg -demuxers}.
NOTE: To see the supported input formats, use @code{ffmpeg -formats}.
@item
You can extract images from a video, or create a video from many images:
@@ -1577,8 +1508,8 @@ output them in files named @file{foo-001.jpeg}, @file{foo-002.jpeg},
etc. Images will be rescaled to fit the new WxH values.
If you want to extract just a limited number of frames, you can use the
above command in combination with the @code{-frames:v} or @code{-t} option,
or in combination with -ss to start extracting from a certain point in time.
above command in combination with the -vframes or -t option, or in
combination with -ss to start extracting from a certain point in time.
For creating a video from many images:
@example

View File

@@ -62,12 +62,6 @@ see @ref{time duration syntax,,the Time duration section in the ffmpeg-utils(1)
Seek by bytes.
@item -nodisp
Disable graphical display.
@item -noborder
Borderless window.
@item -volume
Set the startup volume. 0 means silence, 100 means no volume reduction or
amplification. Negative values are treated as 0, values above 100 are treated
as 100.
@item -f @var{fmt}
Force format.
@item -window_title @var{title}

View File

@@ -208,13 +208,6 @@ multimedia stream.
The information for each single frame is printed within a dedicated
section with name "FRAME" or "SUBTITLE".
@item -show_log @var{loglevel}
Show logging information from the decoder about each frame according to
the value set in @var{loglevel}, (see @code{-loglevel}). This option requires @code{-show_frames}.
The information for each log message is printed within a dedicated
section with name "LOG".
@item -show_streams
Show information about each media stream contained in the input
multimedia stream.

View File

@@ -83,7 +83,6 @@
<xsd:complexType name="frameType">
<xsd:sequence>
<xsd:element name="tag" type="ffprobe:tagType" minOccurs="0" maxOccurs="unbounded"/>
<xsd:element name="logs" type="ffprobe:logsType" minOccurs="0" maxOccurs="1"/>
<xsd:element name="side_data_list" type="ffprobe:frameSideDataListType" minOccurs="0" maxOccurs="1" />
</xsd:sequence>
@@ -122,20 +121,6 @@
<xsd:attribute name="repeat_pict" type="xsd:int" />
</xsd:complexType>
<xsd:complexType name="logsType">
<xsd:sequence>
<xsd:element name="log" type="ffprobe:logType" minOccurs="1" maxOccurs="unbounded"/>
</xsd:sequence>
</xsd:complexType>
<xsd:complexType name="logType">
<xsd:attribute name="context" type="xsd:string"/>
<xsd:attribute name="level" type="xsd:int" />
<xsd:attribute name="category" type="xsd:int" />
<xsd:attribute name="parent_context" type="xsd:string"/>
<xsd:attribute name="parent_category" type="xsd:int" />
<xsd:attribute name="message" type="xsd:string"/>
</xsd:complexType>
<xsd:complexType name="frameSideDataListType">
<xsd:sequence>
<xsd:element name="side_data" type="ffprobe:frameSideDataType" minOccurs="1" maxOccurs="unbounded"/>

View File

@@ -110,12 +110,6 @@ Show version.
@item -formats
Show available formats (including devices).
@item -demuxers
Show available demuxers.
@item -muxers
Show available muxers.
@item -devices
Show available devices.

View File

@@ -306,8 +306,6 @@ smartblur = enable='between(t,10,3*60)',
curves = enable='gte(t,3)' : preset=cross_process
@end example
See @code{ffmpeg -filters} to view which filters have timeline support.
@c man end FILTERGRAPH DESCRIPTION
@chapter Audio Filters
@@ -1413,9 +1411,7 @@ The filter accepts the syntax
[@var{sample_rate}:]@var{resampler_options}, where @var{sample_rate}
expresses a sample rate and @var{resampler_options} is a list of
@var{key}=@var{value} pairs, separated by ":". See the
@ref{Resampler Options,,the "Resampler Options" section in the
ffmpeg-resampler(1) manual,ffmpeg-resampler}
for the complete list of supported options.
ffmpeg-resampler manual for the complete list of supported options.
@subsection Examples
@@ -1642,6 +1638,39 @@ Number of occasions (not the number of samples) that the signal attained either
Overall bit depth of audio. Number of bits used for each sample.
@end table
@section asyncts
Synchronize audio data with timestamps by squeezing/stretching it and/or
dropping samples/adding silence when needed.
This filter is not built by default, please use @ref{aresample} to do squeezing/stretching.
It accepts the following parameters:
@table @option
@item compensate
Enable stretching/squeezing the data to make it match the timestamps. Disabled
by default. When disabled, time gaps are covered with silence.
@item min_delta
The minimum difference between timestamps and audio data (in seconds) to trigger
adding/dropping samples. The default value is 0.1. If you get an imperfect
sync with this filter, try setting this parameter to 0.
@item max_comp
The maximum compensation in samples per second. Only relevant with compensate=1.
The default value is 500.
@item first_pts
Assume that the first PTS should be this value. The time base is 1 / sample
rate. This allows for padding/trimming at the start of the stream. By default,
no assumption is made about the first frame's expected PTS, so no padding or
trimming is done. For example, this could be set to 0 to pad the beginning with
silence if an audio stream starts after the video stream or to trim any samples
with a negative PTS due to encoder delay.
@end table
@section atempo
Adjust audio tempo.
@@ -1876,6 +1905,9 @@ Remap input channels to new locations.
It accepts the following parameters:
@table @option
@item channel_layout
The channel layout of the output stream.
@item map
Map channels from input to output. The argument is a '|'-separated list of
mappings, each in the @code{@var{in_channel}-@var{out_channel}} or
@@ -1884,9 +1916,6 @@ channel (e.g. FL for front left) or its index in the input channel layout.
@var{out_channel} is the name of the output channel or its index in the output
channel layout. If @var{out_channel} is not given then it is implicitly an
index, starting with zero and increasing by one for each mapping.
@item channel_layout
The channel layout of the output stream.
@end table
If no mapping is present, the filter will implicitly map input channels to
@@ -2556,10 +2585,6 @@ Set file for dumping, suitable for gnuplot.
@item dumpscale
Set scale for dumpfile. Acceptable values are same with scale option.
Default is linlog.
@item fft2
Enable 2-channel convolution using complex FFT. This improves speed significantly.
Default is disabled.
@end table
@subsection Examples
@@ -2892,6 +2917,9 @@ EBU R128 loudness normalization. Includes both dynamic and linear normalization
Support for both single pass (livestreams, files) and double pass (files) modes.
This algorithm can target IL, LRA, and maximum true peak.
To enable compilation of this filter you need to configure FFmpeg with
@code{--enable-libebur128}.
The filter accepts the following options:
@table @option
@@ -2997,7 +3025,7 @@ output channel layout or number of channels
@item outdef
output channel specification, of the form:
"@var{out_name}=[@var{gain}*]@var{in_name}[(+-)[@var{gain}*]@var{in_name}...]"
"@var{out_name}=[@var{gain}*]@var{in_name}[+[@var{gain}*]@var{in_name}...]"
@item out_name
output channel to define, either a channel name (FL, FR, etc.) or a channel
@@ -3482,10 +3510,10 @@ sofalizer=sofa=/path/to/ClubFritz12.sofa:type=freq:radius=2:rotation=5
@end example
@item
Similar as above but with custom speaker positions for front left, front right, back left and back right
Similar as above but with custom speaker positions for front left, front right, rear left and rear right
and also with custom gain:
@example
"sofalizer=sofa=/path/to/ClubFritz6.sofa:type=freq:radius=2:speakers=FL 45|FR 315|BL 135|BR 225:gain=28"
"sofalizer=sofa=/path/to/ClubFritz6.sofa:type=freq:radius=2:speakers=FL 45|FR 315|RL 135|RR 225:gain=28"
@end example
@end itemize
@@ -4510,10 +4538,6 @@ the position in the file if known or -1 and the timestamp in seconds.
In order to display the output lines, you need to set the loglevel at
least to the AV_LOG_INFO value.
This filter exports frame metadata @code{lavfi.blackframe.pblack}.
The value represents the percentage of pixels in the picture that
are below the threshold value.
It accepts the following parameters:
@table @option
@@ -5227,24 +5251,15 @@ The accepted values are:
@item bt709
BT.709
@item fcc
FCC
@item bt601
BT.601
@item bt470
BT.470
@item bt470bg
BT.470BG
@item smpte170m
SMPTE-170M
@item smpte240m
SMPTE-240M
@item fcc
FCC
@item bt2020
BT.2020
@end table
@@ -5258,7 +5273,6 @@ colormatrix=bt601:smpte240m
@section colorspace
Convert colorspace, transfer characteristics or color primaries.
Input video needs to have an even size.
The filter accepts the following options:
@@ -5316,9 +5330,6 @@ SMPTE-170M or BT.601-6 525
@item smpte240m
SMPTE-240M
@item ycgco
YCgCo
@item bt2020ncl
BT.2020 with non-constant luminance
@@ -5333,12 +5344,6 @@ The accepted values are:
@item bt709
BT.709
@item bt470m
BT.470M
@item bt470bg
BT.470BG
@item gamma22
Constant gamma of 2.2
@@ -5351,18 +5356,6 @@ SMPTE-170M, BT.601-6 625 or BT.601-6 525
@item smpte240m
SMPTE-240M
@item srgb
SRGB
@item iec61966-2-1
iec61966-2-1
@item iec61966-2-4
iec61966-2-4
@item xvycc
xvycc
@item bt2020-10
BT.2020 for 10-bits content
@@ -5392,15 +5385,6 @@ SMPTE-170M or BT.601-6 525
@item smpte240m
SMPTE-240M
@item film
film
@item smpte431
SMPTE-431
@item smpte432
SMPTE-432
@item bt2020
BT.2020
@@ -5412,15 +5396,9 @@ Specify output color range.
The accepted values are:
@table @samp
@item tv
TV (restricted) range
@item mpeg
MPEG (restricted) range
@item pc
PC (full) range
@item jpeg
JPEG (full) range
@@ -6183,16 +6161,11 @@ absolute value will be picked. For example direction 0, -PI or -2*PI radians
will pick only pixels on same row and -PI/2 will pick only pixels on same
column.
@item blur, b
@item blur
If enabled, current pixel is compared with average value of all four
surrounding pixels. The default is enabled. If disabled current pixel is
compared with all four surrounding pixels. The pixel is considered banded
if only all four differences with surrounding pixels are less than threshold.
@item coupling, c
If enabled, current pixel is changed if and only if all pixel components are banded,
e.g. banding detection threshold is triggered for all color components.
The default is disabled.
@end table
@anchor{decimate}
@@ -6730,10 +6703,6 @@ option, check the "Color" section in the ffmpeg-utils manual.
The default value of @var{boxcolor} is "white".
@item line_spacing
Set the line spacing in pixels of the border to be drawn around the box using @var{box}.
The default value of @var{line_spacing} is 0.
@item borderw
Set the width of the border to be drawn around the text using @var{bordercolor}.
The default value of @var{borderw} is 0.
@@ -6750,12 +6719,6 @@ Select how the @var{text} is expanded. Can be either @code{none},
@code{normal} (default). See the @ref{drawtext_expansion, Text expansion} section
below for details.
@item basetime
Set a start time for the count. Value is in microseconds. Only applied
in the deprecated strftime expansion mode. To emulate in normal expansion
mode use the @code{pts} function, supplying the start time (in seconds)
as the second argument.
@item fix_bounds
If true, check and fix text coords to avoid clipping.
@@ -6777,6 +6740,9 @@ The font family to be used for drawing text. By default Sans.
The font file to be used for drawing text. The path must be included.
This parameter is mandatory if the fontconfig support is disabled.
@item draw
This option does not exist, please see the timeline system
@item alpha
Draw the text applying alpha blending. The value can
be a number between 0.0 and 1.0.
@@ -6850,10 +6816,6 @@ option must be specified.
@item timecode_rate, rate, r
Set the timecode frame rate (timecode only).
@item tc24hmax
If set to 1, the output of the timecode option will wrap around at 24 hours.
Default is 0 (disabled).
@item text
The text string to be drawn. The text must be a sequence of UTF-8
encoded characters.
@@ -7131,14 +7093,6 @@ FOD=5 # fade out duration
ffplay -f lavfi "color,drawtext=text=TEST:fontsize=50:fontfile=FreeSerif.ttf:fontcolor_expr=ff0000%@{eif\\\\: clip(255*(1*between(t\\, $DS + $FID\\, $DE - $FOD) + ((t - $DS)/$FID)*between(t\\, $DS\\, $DS + $FID) + (-(t - $DE)/$FOD)*between(t\\, $DE - $FOD\\, $DE) )\\, 0\\, 255) \\\\: x\\\\: 2 @}"
@end example
@item
Horizontally align multiple separate texts. Note that @option{max_glyph_a}
and the @option{fontsize} value are included in the @option{y} offset.
@example
drawtext=fontfile=FreeSans.ttf:text=DOG:fontsize=24:x=10:y=20+24-max_glyph_a,
drawtext=fontfile=FreeSans.ttf:text=cow:fontsize=24:x=80:y=20+24-max_glyph_a
@end example
@end itemize
For more information about libfreetype, check:
@@ -8263,7 +8217,7 @@ It accepts the following parameters:
@item filter_name
The name of the frei0r effect to load. If the environment variable
@env{FREI0R_PATH} is defined, the frei0r effect is searched for in each of the
directories specified by the colon-separated list in @env{FREIOR_PATH}.
directories specified by the colon-separated list in @env{FREI0R_PATH}.
Otherwise, the standard frei0r paths are searched, in this order:
@file{HOME/.frei0r-1/lib/}, @file{/usr/local/lib/frei0r-1/},
@file{/usr/lib/frei0r-1/}.
@@ -9630,25 +9584,6 @@ Macroblock size. Default @code{16}.
Search parameter. Default @code{7}.
@end table
@section midequalizer
Apply Midway Image Equalization effect using two video streams.
Midway Image Equalization adjusts a pair of images to have the same
histogram, while maintaining their dynamics as much as possible. It's
useful for e.g. matching exposures from a pair of stereo cameras.
This filter has two inputs and one output, which must be of same pixel format, but
may be of different sizes. The output of filter is first input adjusted with
midway histogram of both inputs.
This filter accepts the following option:
@table @option
@item planes
Set which planes to process. Default is @code{15}, which is all available planes.
@end table
@section minterpolate
Convert the video to specified frame rate using motion interpolation.
@@ -9719,7 +9654,7 @@ Macroblock size. Default @code{16}.
@item search_param
Motion estimation search parameter. Default @code{32}.
@item vsbmc
@item vsmbc
Enable variable-size block motion compensation. Motion estimation is applied with smaller block sizes at object boundaries in order to make the them less blur. Default is @code{0} (disabled).
@end table
@end table
@@ -10207,10 +10142,7 @@ force YUV422 output
force YUV444 output
@item rgb
force packed RGB output
@item gbrp
force planar RGB output
force RGB output
@end table
Default value is @samp{yuv420}.
@@ -10435,24 +10367,6 @@ Specify the color of the padded area. For the syntax of this option,
check the "Color" section in the ffmpeg-utils manual.
The default value of @var{color} is "black".
@item eval
Specify when to evaluate @var{width}, @var{height}, @var{x} and @var{y} expression.
It accepts the following values:
@table @samp
@item init
Only evaluate expressions once during the filter initialization or when
a command is processed.
@item frame
Evaluate expressions for each incoming frame.
@end table
Default value is @samp{init}.
@end table
The value for the @var{width}, @var{height}, @var{x}, and @var{y}
@@ -11027,12 +10941,6 @@ Set medium thresholding (good results, default).
@end table
@end table
@section premultiply
Apply alpha premultiply effect to input video stream using first plane
of second stream as alpha.
Both streams must have same dimensions and same pixel format.
@section prewitt
Apply prewitt operator to input video stream.
@@ -11262,76 +11170,6 @@ less than @code{0}, the filter will try to use a good random seed on a
best effort basis.
@end table
@section readeia608
Read closed captioning (EIA-608) information from the top lines of a video frame.
This filter adds frame metadata for @code{lavfi.readeia608.X.cc} and
@code{lavfi.readeia608.X.line}, where @code{X} is the number of the identified line
with EIA-608 data (starting from 0). A description of each metadata value follows:
@table @option
@item lavfi.readeia608.X.cc
The two bytes stored as EIA-608 data (printed in hexadecimal).
@item lavfi.readeia608.X.line
The number of the line on which the EIA-608 data was identified and read.
@end table
This filter accepts the following options:
@table @option
@item scan_min
Set the line to start scanning for EIA-608 data. Default is @code{0}.
@item scan_max
Set the line to end scanning for EIA-608 data. Default is @code{29}.
@item mac
Set minimal acceptable amplitude change for sync codes detection.
Default is @code{0.2}. Allowed range is @code{[0.001 - 1]}.
@item spw
Set the ratio of width reserved for sync code detection.
Default is @code{0.27}. Allowed range is @code{[0.01 - 0.7]}.
@item mhd
Set the max peaks height difference for sync code detection.
Default is @code{0.1}. Allowed range is @code{[0.0 - 0.5]}.
@item mpd
Set max peaks period difference for sync code detection.
Default is @code{0.1}. Allowed range is @code{[0.0 - 0.5]}.
@item msd
Set the first two max start code bits differences.
Default is @code{0.02}. Allowed range is @code{[0.0 - 0.5]}.
@item bhd
Set the minimum ratio of bits height compared to 3rd start code bit.
Default is @code{0.75}. Allowed range is @code{[0.01 - 1]}.
@item th_w
Set the white color threshold. Default is @code{0.35}. Allowed range is @code{[0.1 - 1]}.
@item th_b
Set the black color threshold. Default is @code{0.15}. Allowed range is @code{[0.0 - 0.5]}.
@item chp
Enable checking the parity bit. In the event of a parity error, the filter will output
@code{0x00} for that character. Default is false.
@end table
@subsection Examples
@itemize
@item
Output a csv with presentation time and the first two lines of identified EIA-608 captioning data.
@example
ffprobe -f lavfi -i movie=captioned_video.mov,readeia608 -show_entries frame=pkt_pts_time:frame_tags=lavfi.readeia608.0.cc,lavfi.readeia608.1.cc -of csv
@end example
@end itemize
@section readvitc
Read vertical interval timecode (VITC) information from the top lines of a
@@ -12077,7 +11915,7 @@ uses the reference video instead of the main input as basis.
@itemize
@item
Scale a subtitle stream to match the main video in size before overlaying
Scale a subtitle stream (b) to match the main video (a) in size before overlaying
@example
'scale2ref[b][a];[a][b]overlay'
@end example
@@ -12368,7 +12206,7 @@ Set the size of the box used to represent one palette color entry. Default is
@section shuffleframes
Reorder and/or duplicate and/or drop video frames.
Reorder and/or duplicate video frames.
It accepts the following parameters:
@@ -12377,7 +12215,6 @@ It accepts the following parameters:
Set the destination indexes of input frames.
This is space or '|' separated list of indexes that maps input frames to output
frames. Number of indexes also sets maximal value that each index may have.
'-1' index have special meaning and that is to drop frame.
@end table
The first frame has the index 0. The default is to keep the input unchanged.
@@ -12627,95 +12464,6 @@ saturation maximum: %@{metadata:lavfi.signalstats.SATMAX@}
@end example
@end itemize
@anchor{signature}
@section signature
Calculates the MPEG-7 Video Signature. The filter can handle more than one
input. In this case the matching between the inputs can be calculated additionally.
The filter always passes through the first input. The signature of each stream can
be written into a file.
It accepts the following options:
@table @option
@item detectmode
Enable or disable the matching process.
Available values are:
@table @samp
@item off
Disable the calculation of a matching (default).
@item full
Calculate the matching for the whole video and output whether the whole video
matches or only parts.
@item fast
Calculate only until a matching is found or the video ends. Should be faster in
some cases.
@end table
@item nb_inputs
Set the number of inputs. The option value must be a non negative integer.
Default value is 1.
@item filename
Set the path to which the output is written. If there is more than one input,
the path must be a prototype, i.e. must contain %d or %0nd (where n is a positive
integer), that will be replaced with the input number. If no filename is
specified, no output will be written. This is the default.
@item format
Choose the output format.
Available values are:
@table @samp
@item binary
Use the specified binary representation (default).
@item xml
Use the specified xml representation.
@end table
@item th_d
Set threshold to detect one word as similar. The option value must be an integer
greater than zero. The default value is 9000.
@item th_dc
Set threshold to detect all words as similar. The option value must be an integer
greater than zero. The default value is 60000.
@item th_xh
Set threshold to detect frames as similar. The option value must be an integer
greater than zero. The default value is 116.
@item th_di
Set the minimum length of a sequence in frames to recognize it as matching
sequence. The option value must be a non negative integer value.
The default value is 0.
@item th_it
Set the minimum relation, that matching frames to all frames must have.
The option value must be a double value between 0 and 1. The default value is 0.5.
@end table
@subsection Examples
@itemize
@item
To calculate the signature of an input video and store it in signature.bin:
@example
ffmpeg -i input.mkv -vf signature=filename=signature.bin -map 0:v -f null -
@end example
@item
To detect whether two videos match and store the signatures in XML format in
signature0.xml and signature1.xml:
@example
ffmpeg -i input1.mkv -i input2.mkv -filter_complex "[0:v][1:v] signature=nb_inputs=2:detectmode=full:format=xml:filename=signature%d.xml" -map :v -f null -
@end example
@end itemize
@anchor{smartblur}
@section smartblur
@@ -12745,20 +12493,20 @@ in [-30,0] will filter edges. Default value is 0.
@item chroma_radius, cr
Set the chroma radius. The option value must be a float number in
the range [0.1,5.0] that specifies the variance of the gaussian filter
used to blur the image (slower if larger). Default value is @option{luma_radius}.
used to blur the image (slower if larger). Default value is 1.0.
@item chroma_strength, cs
Set the chroma strength. The option value must be a float number
in the range [-1.0,1.0] that configures the blurring. A value included
in [0.0,1.0] will blur the image whereas a value included in
[-1.0,0.0] will sharpen the image. Default value is @option{luma_strength}.
[-1.0,0.0] will sharpen the image. Default value is 1.0.
@item chroma_threshold, ct
Set the chroma threshold used as a coefficient to determine
whether a pixel should be blurred or not. The option value must be an
integer in the range [-30,30]. A value of 0 will filter all the image,
a value included in [0,30] will filter flat areas and a value included
in [-30,0] will filter edges. Default value is @option{luma_threshold}.
in [-30,0] will filter edges. Default value is 0.
@end table
If a chroma option is not explicitly set, the corresponding luma value
@@ -13290,63 +13038,6 @@ PAL output (25i):
16p: 33333334
@end example
@section threshold
Apply threshold effect to video stream.
This filter needs four video streams to perform thresholding.
First stream is stream we are filtering.
Second stream is holding threshold values, third stream is holding min values,
and last, fourth stream is holding max values.
The filter accepts the following option:
@table @option
@item planes
Set which planes will be processed, unprocessed planes will be copied.
By default value 0xf, all planes will be processed.
@end table
For example if first stream pixel's component value is less then threshold value
of pixel component from 2nd threshold stream, third stream value will picked,
otherwise fourth stream pixel component value will be picked.
Using color source filter one can perform various types of thresholding:
@subsection Examples
@itemize
@item
Binary threshold, using gray color as threshold:
@example
ffmpeg -i 320x240.avi -f lavfi -i color=gray -f lavfi -i color=black -f lavfi -i color=white -lavfi threshold output.avi
@end example
@item
Inverted binary threshold, using gray color as threshold:
@example
ffmpeg -i 320x240.avi -f lavfi -i color=gray -f lavfi -i color=white -f lavfi -i color=black -lavfi threshold output.avi
@end example
@item
Truncate binary threshold, using gray color as threshold:
@example
ffmpeg -i 320x240.avi -f lavfi -i color=gray -i 320x240.avi -f lavfi -i color=gray -lavfi threshold output.avi
@end example
@item
Threshold to zero, using gray color as threshold:
@example
ffmpeg -i 320x240.avi -f lavfi -i color=gray -f lavfi -i color=white -i 320x240.avi -lavfi threshold output.avi
@end example
@item
Inverted threshold to zero, using gray color as threshold:
@example
ffmpeg -i 320x240.avi -f lavfi -i color=gray -i 320x240.avi -f lavfi -i color=white -lavfi threshold output.avi
@end example
@end itemize
@section thumbnail
Select the most representative frame in a given sequence of consecutive frames.
@@ -14928,9 +14619,6 @@ Possible values are:
@item linear
@item 2020_10
@item 2020_12
@item smpte2084
@item iec61966-2-1
@item arib-std-b67
@end table
Default is same as input.
@@ -15035,9 +14723,6 @@ Possible values are:
@item bottomleft
@item bottom
@end table
@item npl
Set the nominal peak luminance.
@end table
The values of the @option{w} and @option{h} options are expressions
@@ -15782,28 +15467,6 @@ tools.
Below is a description of the currently available multimedia filters.
@section abitscope
Convert input audio to a video output, displaying the audio bit scope.
The filter accepts the following options:
@table @option
@item rate, r
Set frame rate, expressed as number of frames per second. Default
value is "25".
@item size, s
Specify the video size for the output. For the syntax of this option, check the
@ref{video size syntax,,"Video size" section in the ffmpeg-utils manual,ffmpeg-utils}.
Default value is @code{1024x256}.
@item colors
Specify list of colors separated by space or by '|' which will be used to
draw channels. Unrecognized or missing colors will be replaced
by white color.
@end table
@section ahistogram
Convert input audio to a video output, displaying the volume histogram.
@@ -15907,9 +15570,6 @@ Allowed range is @code{[0, 255]}.
@item mpc
Set color which will be used for drawing median phase. If color is
@code{none} which is default, no median phase value will be drawn.
@item video
Enable video output. Default is enabled.
@end table
The filter also exports the frame metadata @code{lavfi.aphasemeter.phase} which
@@ -16476,13 +16136,13 @@ Float representation of @code{value} from metadata key.
@item VALUE2
Float representation of @code{value} as supplied by user in @code{value} option.
@end table
@item file
If specified in @code{print} mode, output is written to the named file. Instead of
plain filename any writable url can be specified. Filename ``-'' is a shorthand
for standard output. If @code{file} option is not set, output is written to the log
with AV_LOG_INFO loglevel.
@end table
@end table
@@ -17175,16 +16835,12 @@ Acceptable range is @code{[1, 7]}.
Specify the bargraph gamma. Default value is @code{1}. Acceptable range is
@code{[1, 7]}.
@item bar_t
Specify the bargraph transparency level. Lower value makes the bargraph sharper.
Default value is @code{1}. Acceptable range is @code{[0, 1]}.
@item timeclamp, tc
Specify the transform timeclamp. At low frequency, there is trade-off between
accuracy in time domain and frequency domain. If timeclamp is lower,
event in time domain is represented more accurately (such as fast bass drum),
otherwise event in frequency domain is represented more accurately
(such as bass guitar). Acceptable range is @code{[0.002, 1]}. Default value is @code{0.17}.
(such as bass guitar). Acceptable range is @code{[0.1, 1]}. Default value is @code{0.17}.
@item basefreq
Specify the transform base frequency. Default value is @code{20.01523126408007475},
@@ -17962,23 +17618,7 @@ Set if channels should be drawn separately or overlap. Default value is 0.
Set colors separated by '|' which are going to be used for drawing of each channel.
@item scale
Set amplitude scale.
Available values are:
@table @samp
@item lin
Linear.
@item log
Logarithmic.
@item sqrt
Square root.
@item cbrt
Cubic root.
@end table
Set amplitude scale. Can be linear @code{lin} or logarithmic @code{log}.
Default is linear.
@end table
@@ -18245,7 +17885,7 @@ audio instead of video.
@item loop
Specifies how many times to read the stream in sequence.
If the value is 0, the stream will be looped infinitely.
If the value is less than 1, the stream will be read again and again.
Default value is "1".
Note that when the movie is looped the source timestamps are not

View File

@@ -186,19 +186,6 @@ For Windows, supported AviSynth variants are
For Linux and OS X, the supported AviSynth variant is
@url{https://github.com/avxsynth/avxsynth, AvxSynth}.
@float NOTE
There is currently a regression in AviSynth+'s @code{capi.h} header as of
October 2016, which interferes with the ability for builds of Libav to use
MSVC-built binaries of AviSynth. Until this is resolved, you can make sure
a known good version is installed by checking out a version from before
the regression occurred:
@code{git clone -b MT git://github.com/AviSynth/AviSynthPlus.git @*
cd AviSynthPlus @*
git checkout -b oldheader b4f292b4dbfad149697fb65c6a037bb3810813f9 @*
make install PREFIX=/install/prefix}
@end float
@float NOTE
AviSynth and AvxSynth are loaded dynamically. Distributors can build FFmpeg
with @code{--enable-avisynth}, and the binaries will work regardless of the
@@ -355,7 +342,6 @@ library:
@item iLBC @tab X @tab X
@item Interplay MVE @tab @tab X
@tab Format used in various Interplay computer games.
@item Iterated Systems ClearVideo @tab @tab X
@item IV8 @tab @tab X
@tab A format generated by IndigoVision 8000 video server.
@item IVF (On2) @tab X @tab X
@@ -401,7 +387,6 @@ library:
@tab Audio format used on the PS3.
@item Mirillis FIC video @tab @tab X
@tab No cursor rendering.
@item MIDI Sample Dump Standard @tab @tab X
@item MIME multipart JPEG @tab X @tab
@item MSN TCP webcam @tab @tab X
@tab Used by MSN Messenger webcam streams.
@@ -465,8 +450,6 @@ library:
@item raw PCM signed 24 bit little-endian @tab X @tab X
@item raw PCM signed 32 bit big-endian @tab X @tab X
@item raw PCM signed 32 bit little-endian @tab X @tab X
@item raw PCM signed 64 bit big-endian @tab X @tab X
@item raw PCM signed 64 bit little-endian @tab X @tab X
@item raw PCM unsigned 8 bit @tab X @tab X
@item raw PCM unsigned 16 bit big-endian @tab X @tab X
@item raw PCM unsigned 16 bit little-endian @tab X @tab X
@@ -474,8 +457,6 @@ library:
@item raw PCM unsigned 24 bit little-endian @tab X @tab X
@item raw PCM unsigned 32 bit big-endian @tab X @tab X
@item raw PCM unsigned 32 bit little-endian @tab X @tab X
@item raw PCM 16.8 floating point little-endian @tab @tab X
@item raw PCM 24.0 floating point little-endian @tab @tab X
@item raw PCM floating-point 32 bit big-endian @tab X @tab X
@item raw PCM floating-point 32 bit little-endian @tab X @tab X
@item raw PCM floating-point 64 bit big-endian @tab X @tab X
@@ -497,7 +478,6 @@ library:
@tab Output is performed by publishing stream to RTMP server
@item RTP @tab X @tab X
@item RTSP @tab X @tab X
@item Sample Dump eXchange @tab @tab X
@item SAP @tab X @tab X
@item SBG @tab @tab X
@item SDP @tab @tab X
@@ -604,8 +584,6 @@ following image formats are supported:
@item PNG @tab X @tab X
@item PPM @tab X @tab X
@tab Portable PixelMap image
@item PSD @tab @tab X
@tab Photoshop
@item PTX @tab @tab X
@tab V.Flash PTX format
@item SGI @tab X @tab X
@@ -622,8 +600,6 @@ following image formats are supported:
@tab X BitMap image format
@item XFace @tab X @tab X
@tab X-Face image format
@item XPM @tab @tab X
@tab X PixMap image format
@item XWD @tab X @tab X
@tab X Window Dump image format
@end multitable
@@ -649,7 +625,6 @@ following image formats are supported:
@item ANSI/ASCII art @tab @tab X
@item Apple Intermediate Codec @tab @tab X
@item Apple MJPEG-B @tab @tab X
@item Apple Pixlet @tab @tab X
@item Apple ProRes @tab X @tab X
@item Apple QuickDraw @tab @tab X
@tab fourcc: qdrw
@@ -732,7 +707,6 @@ following image formats are supported:
@item Flash Screen Video v2 @tab X @tab X
@item Flash Video (FLV) @tab X @tab X
@tab Sorenson H.263 used in Flash
@item FM Screen Capture Codec @tab @tab X
@item Forward Uncompressed @tab @tab X
@item Fraps @tab @tab X
@item Go2Meeting @tab @tab X
@@ -805,7 +779,6 @@ following image formats are supported:
@item MPEG-4 part 2 Microsoft variant version 1 @tab @tab X
@item MPEG-4 part 2 Microsoft variant version 2 @tab X @tab X
@item MPEG-4 part 2 Microsoft variant version 3 @tab X @tab X
@item Newtek SpeedHQ @tab @tab X
@item Nintendo Gamecube THP video @tab @tab X
@item NuppelVideo/RTjpeg @tab @tab X
@tab Video encoding used in NuppelVideo files.
@@ -846,7 +819,6 @@ following image formats are supported:
@tab Texture dictionaries used by the Renderware Engine.
@item RL2 video @tab @tab X
@tab used in some games by Entertainment Software Partners
@item ScreenPressor @tab @tab X
@item Screenpresso @tab @tab X
@item Sierra VMD video @tab @tab X
@tab Used in Sierra VMD files.
@@ -1069,7 +1041,6 @@ following image formats are supported:
@item PCM unsigned 32-bit little-endian @tab X @tab X
@item PCM Zork @tab @tab X
@item QCELP / PureVoice @tab @tab X
@item QDesign Music Codec 1 @tab @tab X
@item QDesign Music Codec 2 @tab @tab X
@tab There are still some distortions.
@item RealAudio 1.0 (14.4K) @tab X @tab X
@@ -1166,7 +1137,6 @@ performance on systems without hardware floating point support).
@item MMSH @tab X
@item MMST @tab X
@item pipe @tab X
@item Pro-MPEG FEC @tab X
@item RTMP @tab X
@item RTMPE @tab X
@item RTMPS @tab X

View File

@@ -233,12 +233,6 @@ Defaults to @option{false}.
If set to @option{true}, print a list of supported formats and exit.
Defaults to @option{false}.
@item format_code <FourCC>
This sets the input video format to the format given by the FourCC. To see
the supported values of your device(s) use @option{list_formats}.
Note that there is a FourCC @option{'pal '} that can also be used
as @option{pal} (3 letters).
@item bm_v210
If set to @samp{1}, video is captured in 10 bit v210 instead
of uyvy422. Not all Blackmagic devices support this option.
@@ -302,21 +296,21 @@ ffmpeg -f decklink -list_formats 1 -i 'Intensity Pro'
@end example
@item
Capture video clip at 1080i50:
Capture video clip at 1080i50 (format 11):
@example
ffmpeg -format_code Hi50 -f decklink -i 'Intensity Pro' -acodec copy -vcodec copy output.avi
ffmpeg -f decklink -i 'Intensity Pro@@11' -acodec copy -vcodec copy output.avi
@end example
@item
Capture video clip at 1080i50 10 bit:
@example
ffmpeg -bm_v210 1 -format_code Hi50 -f decklink -i 'UltraStudio Mini Recorder' -acodec copy -vcodec copy output.avi
ffmpeg -bm_v210 1 -f decklink -i 'UltraStudio Mini Recorder@@11' -acodec copy -vcodec copy output.avi
@end example
@item
Capture video clip at 1080i50 with 16 audio channels:
@example
ffmpeg -channels 16 -format_code Hi50 -f decklink -i 'UltraStudio Mini Recorder' -acodec copy -vcodec copy output.avi
ffmpeg -channels 16 -f decklink -i 'UltraStudio Mini Recorder@@11' -acodec copy -vcodec copy output.avi
@end example
@end itemize
@@ -1311,6 +1305,9 @@ To enable this input device during configuration you need libxcb
installed on your system. It will be automatically detected during
configuration.
Alternatively, the configure option @option{--enable-x11grab} exists
for legacy Xlib users.
This device allows one to capture a region of an X11 display.
The filename passed as input has the syntax:
@@ -1398,6 +1395,11 @@ ffmpeg -f x11grab -follow_mouse centered -show_region 1 -framerate 25 -video_siz
@item video_size
Set the video frame size. Default value is @code{vga}.
@item use_shm
Use the MIT-SHM extension for shared memory. Default value is @code{1}.
It may be necessary to disable it for remote displays (legacy x11grab
only).
@item grab_x
@item grab_y
Set the grabbing region coordinates. They are expressed as offset from

View File

@@ -1,27 +0,0 @@
Common abbreviations/shorthands we use that don't need a comment
================================================================
dsp: digital signal processing
dst/adst: (asymmetric) discrete sine transform
ec: entropy coding or error concealment
er: error resilience
fdct/idct: forward/inverse discrete cosine transform
fft: fast Fourier transform
gop: group of pictures
hw/sw: hardware/software
lp: lowpass
lpf: loop filter
lut: lookup table
mb: macroblock
mc: motion compensation
me: motion estimation
mv: motion vector
nal: network abstraction layer
pel/qpel/epel/hpel/fpel: pixel / quarter-pixel / eighth-pixel / half-pixel / full-pixel
pp: post process
qp: quantization parameter
rc: rate control
sei: supplemental enhancement information
sl: slice
vlc: variable length coding
vq: vector quantization

View File

@@ -88,16 +88,7 @@ Stuff that didn't reach the codebase:
-------------------------------------
- HEVC DSP and x86 MC SIMD improvements from Libav (see https://ffmpeg.org/pipermail/ffmpeg-devel/2015-December/184777.html)
- 1f821750f hevcdsp: split the qpel functions by width instead of by the subpixel fraction
- 818bfe7f0 hevcdsp: split the epel functions by width
- 688417399 hevcdsp: split the pred functions by width
- a853388d2 hevc: change the stride of the MC buffer to be in bytes instead of elements
- 0cef06df0 checkasm: add HEVC MC tests
- e7078e842 hevcdsp: add x86 SIMD for MC
- VAAPI VP8 decode hwaccel (currently under review: http://ffmpeg.org/pipermail/ffmpeg-devel/2017-February/thread.html#207348)
- Removal of the custom atomic API (5cc0057f49, see http://ffmpeg.org/pipermail/ffmpeg-devel/2017-March/209003.html)
- Use the new bitstream filter for extracting extradata (8e2ea69135 and 096a8effa3, see https://ffmpeg.org/pipermail/ffmpeg-devel/2017-March/209068.html)
- Read aac_adtstoasc extradata updates from packet side data on Matroska once mov and the bsf in question are fixed (See 13a211e632 and 5ef1959080)
- QSV HWContext integration (04b17ff and 130e1f1), QSV scaling filter (62c58c5)
Collateral damage that needs work locally:
------------------------------------------
@@ -105,11 +96,3 @@ Collateral damage that needs work locally:
- Merge proresdec2.c and proresdec_lgpl.c
- Merge proresenc_anatoliy.c and proresenc_kostya.c
- Remove ADVANCED_PARSER in libavcodec/hevc_parser.c
- Fix MIPS AC3 downmix
- hlsenc encryption support may need some adjustment (see edc43c571d)
Extra changes needed to be aligned with Libav:
----------------------------------------------
- Switching our examples to the new encode/decode API (see 67d28f4a0f)
- HEVC IDCT bit depth 12-bit support (Libav added 8 and 10 but doesn't have 12)

View File

@@ -13,9 +13,8 @@ You can disable all the muxers with the configure option
with the options @code{--enable-muxer=@var{MUXER}} /
@code{--disable-muxer=@var{MUXER}}.
The option @code{-muxers} of the ff* tools will display the list of
enabled muxers. Use @code{-formats} to view a combined list of
enabled demuxers and muxers.
The option @code{-formats} of the ff* tools will display the list of
enabled muxers.
A description of some of the currently available muxers follows.
@@ -58,39 +57,6 @@ fragmentation or muxer overhead depending on your source. Default value is
@end table
@anchor{avi}
@section avi
Audio Video Interleaved muxer.
@subsection Options
It accepts the following options:
@table @option
@item reserve_index_space
Reserve the specified amount of bytes for the OpenDML master index of each
stream within the file header. By default additional master indexes are
embedded within the data packets if there is no space left in the first master
index and are linked together as a chain of indexes. This index structure can
cause problems for some use cases, e.g. third-party software strictly relying
on the OpenDML index specification or when file seeking is slow. Reserving
enough index space in the file header avoids these problems.
The required index space depends on the output file size and should be about 16
bytes per gigabyte. When this option is omitted or set to zero the necessary
index space is guessed.
@item write_channel_mask
Write the channel layout mask into the audio stream header.
This option is enabled by default. Disabling the channel mask can be useful in
specific scenarios, e.g. when merging multiple audio streams into one for
compatibility with software that only supports a single audio stream in AVI
(see @ref{amerge,,the "amerge" section in the ffmpeg-filters manual,ffmpeg-filters}).
@end table
@anchor{chromaprint}
@section chromaprint
@@ -181,16 +147,6 @@ Place AAC sequence header based on audio stream data.
@item no_sequence_end
Disable sequence end tag.
@item no_metadata
Disable metadata tag.
@item no_duration_filesize
Disable duration and filesize in metadata when they are equal to zero
at the end of stream. (Be used to non-seekable living stream).
@item add_keyframe_index
Used to facilitate seeking; particularly for HTTP pseudo streaming.
@end table
@end table
@@ -442,41 +398,17 @@ parameters. Values containing @code{:} special characters must be
escaped.
@item hls_wrap @var{wrap}
This is a deprecated option, you can use @code{hls_list_size}
and @code{hls_flags delete_segments} instead it
Set the number after which the segment filename number (the number
specified in each segment file) wraps. If set to 0 the number will be
never wrapped. Default value is 0.
This option is useful to avoid to fill the disk with many segment
files, and limits the maximum number of segment files written to disk
to @var{wrap}.
@item hls_start_number_source
Start the playlist sequence number (@code{#EXT-X-MEDIA-SEQUENCE}) according to the specified source.
Unless @code{hls_flags single_file} is set, it also specifies source of starting sequence numbers of
segment and subtitle filenames. In any case, if @code{hls_flags append_list}
is set and read playlist sequence number is greater than the specified start sequence number,
then that value will be used as start value.
It accepts the following values:
@table @option
@item generic (default)
Set the starting sequence numbers according to @var{start_number} option value.
@item epoch
The start number will be the seconds since epoch (1970-01-01 00:00:00)
@item datetime
The start number will be based on the current date/time as YYYYmmddHHMMSS. e.g. 20161231235759.
@end table
@item start_number @var{number}
Start the playlist sequence number (@code{#EXT-X-MEDIA-SEQUENCE}) from the specified @var{number}
when @var{hls_start_number_source} value is @var{generic}. (This is the default case.)
Unless @code{hls_flags single_file} is set, it also specifies starting sequence numbers of segment and subtitle filenames.
Default value is 0.
Start the playlist sequence number from @var{number}. Default value is
0.
@item hls_allow_cache @var{allowcache}
Explicitly set whether the client MAY (1) or MUST NOT (0) cache media segments.
@@ -499,46 +431,24 @@ ffmpeg -i in.nut -hls_segment_filename 'file%03d.ts' out.m3u8
This example will produce the playlist, @file{out.m3u8}, and segment files:
@file{file000.ts}, @file{file001.ts}, @file{file002.ts}, etc.
@var{filename} may contain full path or relative path specification,
but only the file name part without any path info will be contained in the m3u8 segment list.
Should a relative path be specified, the path of the created segment
files will be relative to the current working directory.
When use_localtime_mkdir is set, the whole expanded value of @var{filename} will be written into the m3u8 segment list.
@item use_localtime
Use strftime() on @var{filename} to expand the segment filename with localtime.
The segment number is also available in this mode, but to use it, you need to specify second_level_segment_index
hls_flag and %%d will be the specifier.
Use strftime on @var{filename} to expand the segment filename with localtime.
The segment number (%d) is not available in this mode.
@example
ffmpeg -i in.nut -use_localtime 1 -hls_segment_filename 'file-%Y%m%d-%s.ts' out.m3u8
@end example
This example will produce the playlist, @file{out.m3u8}, and segment files:
@file{file-20160215-1455569023.ts}, @file{file-20160215-1455569024.ts}, etc.
Note: On some systems/environments, the @code{%s} specifier is not available. See
@code{strftime()} documentation.
@example
ffmpeg -i in.nut -use_localtime 1 -hls_flags second_level_segment_index -hls_segment_filename 'file-%Y%m%d-%%04d.ts' out.m3u8
@end example
This example will produce the playlist, @file{out.m3u8}, and segment files:
@file{file-20160215-0001.ts}, @file{file-20160215-0002.ts}, etc.
@item use_localtime_mkdir
Used together with -use_localtime, it will create all subdirectories which
Used together with -use_localtime, it will create up to one subdirectory which
is expanded in @var{filename}.
@example
ffmpeg -i in.nut -use_localtime 1 -use_localtime_mkdir 1 -hls_segment_filename '%Y%m%d/file-%Y%m%d-%s.ts' out.m3u8
@end example
This example will create a directory 201560215 (if it does not exist), and then
produce the playlist, @file{out.m3u8}, and segment files:
@file{20160215/file-20160215-1455569023.ts}, @file{20160215/file-20160215-1455569024.ts}, etc.
@example
ffmpeg -i in.nut -use_localtime 1 -use_localtime_mkdir 1 -hls_segment_filename '%Y/%m/%d/file-%Y%m%d-%s.ts' out.m3u8
@end example
This example will create a directory hierarchy 2016/02/15 (if any of them do not exist), and then
produce the playlist, @file{out.m3u8}, and segment files:
@file{2016/02/15/file-20160215-1455569023.ts}, @file{2016/02/15/file-20160215-1455569024.ts}, etc.
@file{201560215/file-20160215-1455569023.ts}, @file{201560215/file-20160215-1455569024.ts}, etc.
@item hls_key_info_file @var{key_info_file}
@@ -597,12 +507,7 @@ ffmpeg -f lavfi -re -i testsrc -c:v h264 -hls_flags delete_segments \
-hls_key_info_file file.keyinfo out.m3u8
@end example
@item hls_flags @var{flags}
Possible values:
@table @samp
@item single_file
@item hls_flags single_file
If this flag is set, the muxer will store all segments in a single MPEG-TS
file, and will use byte ranges in the playlist. HLS playlists generated with
this way will have the version number 4.
@@ -613,65 +518,34 @@ ffmpeg -i in.nut -hls_flags single_file out.m3u8
Will produce the playlist, @file{out.m3u8}, and a single segment file,
@file{out.ts}.
@item delete_segments
@item hls_flags delete_segments
Segment files removed from the playlist are deleted after a period of time
equal to the duration of the segment plus the duration of the playlist.
@item append_list
@item hls_flags append_list
Append new segments into the end of old segment list,
and remove the @code{#EXT-X-ENDLIST} from the old segment list.
@item round_durations
@item hls_flags round_durations
Round the duration info in the playlist file segment info to integer
values, instead of using floating point.
@item discont_start
@item hls_flags discont_starts
Add the @code{#EXT-X-DISCONTINUITY} tag to the playlist, before the
first segment's information.
@item omit_endlist
@item hls_flags omit_endlist
Do not append the @code{EXT-X-ENDLIST} tag at the end of the playlist.
@item split_by_time
@item hls_flags split_by_time
Allow segments to start on frames other than keyframes. This improves
behavior on some players when the time between keyframes is inconsistent,
but may make things worse on others, and can cause some oddities during
seeking. This flag should be used with the @code{hls_time} option.
@item program_date_time
@item hls_flags program_date_time
Generate @code{EXT-X-PROGRAM-DATE-TIME} tags.
@item second_level_segment_index
Makes it possible to use segment indexes as %%d in hls_segment_filename expression
besides date/time values when use_localtime is on.
To get fixed width numbers with trailing zeroes, %%0xd format is available where x is the required width.
@item second_level_segment_size
Makes it possible to use segment sizes (counted in bytes) as %%s in hls_segment_filename
expression besides date/time values when use_localtime is on.
To get fixed width numbers with trailing zeroes, %%0xs format is available where x is the required width.
@item second_level_segment_duration
Makes it possible to use segment duration (calculated in microseconds) as %%t in hls_segment_filename
expression besides date/time values when use_localtime is on.
To get fixed width numbers with trailing zeroes, %%0xt format is available where x is the required width.
@example
ffmpeg -i sample.mpeg \
-f hls -hls_time 3 -hls_list_size 5 \
-hls_flags second_level_segment_index+second_level_segment_size+second_level_segment_duration \
-use_localtime 1 -use_localtime_mkdir 1 -hls_segment_filename "segment_%Y%m%d%H%M%S_%%04d_%%08s_%%013t.ts" stream.m3u8
@end example
This will produce segments like this:
@file{segment_20170102194334_0003_00122200_0000003000000.ts}, @file{segment_20170102194334_0004_00120072_0000003000000.ts} etc.
@item temp_file
Write segment data to filename.tmp and rename to filename only once the segment is complete. A webserver
serving up segments can be configured to reject requests to *.tmp to prevent access to in-progress segments
before they have been added to the m3u8 playlist.
@end table
@item hls_playlist_type event
Emit @code{#EXT-X-PLAYLIST-TYPE:EVENT} in the m3u8 header. Forces
@option{hls_list_size} to 0; the playlist can only be appended to.
@@ -761,7 +635,7 @@ The following example shows how to use @command{ffmpeg} for creating a
sequence of files @file{img-001.jpeg}, @file{img-002.jpeg}, ...,
taking one image every second from the input video:
@example
ffmpeg -i in.avi -vsync cfr -r 1 -f image2 'img-%03d.jpeg'
ffmpeg -i in.avi -vsync 1 -r 1 -f image2 'img-%03d.jpeg'
@end example
Note that with @command{ffmpeg}, if the format is not specified with the
@@ -769,12 +643,12 @@ Note that with @command{ffmpeg}, if the format is not specified with the
format, the image2 muxer is automatically selected, so the previous
command can be written as:
@example
ffmpeg -i in.avi -vsync cfr -r 1 'img-%03d.jpeg'
ffmpeg -i in.avi -vsync 1 -r 1 'img-%03d.jpeg'
@end example
Note also that the pattern must not necessarily contain "%d" or
"%0@var{N}d", for example to create a single image file
@file{img.jpeg} from the start of the input video you can employ the command:
@file{img.jpeg} from the input video you can employ the command:
@example
ffmpeg -i in.avi -f image2 -frames:v 1 img.jpeg
@end example
@@ -1091,35 +965,69 @@ This muxer implements ISO 13818-1 and part of ETSI EN 300 468.
The recognized metadata settings in mpegts muxer are @code{service_provider}
and @code{service_name}. If they are not set the default for
@code{service_provider} is @samp{FFmpeg} and the default for
@code{service_name} is @samp{Service01}.
@code{service_provider} is "FFmpeg" and the default for
@code{service_name} is "Service01".
@subsection Options
The muxer options are:
@table @option
@item mpegts_transport_stream_id @var{integer}
Set the @samp{transport_stream_id}. This identifies a transponder in DVB.
Default is @code{0x0001}.
@item mpegts_original_network_id @var{number}
Set the original_network_id (default 0x0001). This is unique identifier
of a network in DVB. Its main use is in the unique identification of a
service through the path Original_Network_ID, Transport_Stream_ID.
@item mpegts_transport_stream_id @var{number}
Set the transport_stream_id (default 0x0001). This identifies a
transponder in DVB.
@item mpegts_service_id @var{number}
Set the service_id (default 0x0001) also known as program in DVB.
@item mpegts_service_type @var{number}
Set the program service_type (default @var{digital_tv}), see below
a list of pre defined values.
@item mpegts_pmt_start_pid @var{number}
Set the first PID for PMT (default 0x1000, max 0x1f00).
@item mpegts_start_pid @var{number}
Set the first PID for data packets (default 0x0100, max 0x0f00).
@item mpegts_m2ts_mode @var{number}
Enable m2ts mode if set to 1. Default value is -1 which disables m2ts mode.
@item muxrate @var{number}
Set a constant muxrate (default VBR).
@item pcr_period @var{numer}
Override the default PCR retransmission time (default 20ms), ignored
if variable muxrate is selected.
@item pat_period @var{number}
Maximal time in seconds between PAT/PMT tables.
@item sdt_period @var{number}
Maximal time in seconds between SDT tables.
@item pes_payload_size @var{number}
Set minimum PES packet payload in bytes.
@item mpegts_flags @var{flags}
Set flags (see below).
@item mpegts_copyts @var{number}
Preserve original timestamps, if value is set to 1. Default value is -1, which
results in shifting timestamps so that they start from 0.
@item tables_version @var{number}
Set PAT, PMT and SDT version (default 0, valid values are from 0 to 31, inclusively).
This option allows updating stream structure so that standard consumer may
detect the change. To do so, reopen output AVFormatContext (in case of API
usage) or restart ffmpeg instance, cyclically changing tables_version value:
@example
ffmpeg -i source1.ts -codec copy -f mpegts -tables_version 0 udp://1.1.1.1:1111
ffmpeg -i source2.ts -codec copy -f mpegts -tables_version 1 udp://1.1.1.1:1111
...
ffmpeg -i source3.ts -codec copy -f mpegts -tables_version 31 udp://1.1.1.1:1111
ffmpeg -i source1.ts -codec copy -f mpegts -tables_version 0 udp://1.1.1.1:1111
ffmpeg -i source2.ts -codec copy -f mpegts -tables_version 1 udp://1.1.1.1:1111
...
@end example
@end table
@item mpegts_original_network_id @var{integer}
Set the @samp{original_network_id}. This is unique identifier of a
network in DVB. Its main use is in the unique identification of a service
through the path @samp{Original_Network_ID, Transport_Stream_ID}. Default
is @code{0x0001}.
Option @option{mpegts_service_type} accepts the following values:
@item mpegts_service_id @var{integer}
Set the @samp{service_id}, also known as program in DVB. Default is
@code{0x0001}.
@item mpegts_service_type @var{integer}
Set the program @samp{service_type}. Default is @code{digital_tv}.
Accepts the following options:
@table @samp
@table @option
@item hex_value
Any hexdecimal value between @code{0x01} to @code{0xff} as defined in
ETSI 300 468.
Any hexdecimal value between 0x01 to 0xff as defined in ETSI 300 468.
@item digital_tv
Digital TV service.
@item digital_radio
@@ -1136,26 +1044,9 @@ Advanced Codec Digital SDTV service.
Advanced Codec Digital HDTV service.
@end table
@item mpegts_pmt_start_pid @var{integer}
Set the first PID for PMT. Default is @code{0x1000}. Max is @code{0x1f00}.
Option @option{mpegts_flags} may take a set of such flags:
@item mpegts_start_pid @var{integer}
Set the first PID for data packets. Default is @code{0x0100}. Max is
@code{0x0f00}.
@item mpegts_m2ts_mode @var{boolean}
Enable m2ts mode if set to @code{1}. Default value is @code{-1} which
disables m2ts mode.
@item muxrate @var{integer}
Set a constant muxrate. Default is VBR.
@item pes_payload_size @var{integer}
Set minimum PES packet payload in bytes. Default is @code{2930}.
@item mpegts_flags @var{flags}
Set mpegts flags. Accepts the following options:
@table @samp
@table @option
@item resend_headers
Reemit PAT/PMT before writing the next packet.
@item latm
@@ -1164,47 +1055,6 @@ Use LATM packetization for AAC.
Reemit PAT and PMT at each video frame.
@item system_b
Conform to System B (DVB) instead of System A (ATSC).
@item initial_discontinuity
Mark the initial packet of each stream as discontinuity.
@end table
@item resend_headers @var{integer}
Reemit PAT/PMT before writing the next packet. This option is deprecated:
use @option{mpegts_flags} instead.
@item mpegts_copyts @var{boolean}
Preserve original timestamps, if value is set to @code{1}. Default value
is @code{-1}, which results in shifting timestamps so that they start from 0.
@item omit_video_pes_length @var{boolean}
Omit the PES packet length for video packets. Default is @code{1} (true).
@item pcr_period @var{integer}
Override the default PCR retransmission time in milliseconds. Ignored if
variable muxrate is selected. Default is @code{20}.
@item pat_period @var{double}
Maximum time in seconds between PAT/PMT tables.
@item sdt_period @var{double}
Maximum time in seconds between SDT tables.
@item tables_version @var{integer}
Set PAT, PMT and SDT version (default @code{0}, valid values are from 0 to 31, inclusively).
This option allows updating stream structure so that standard consumer may
detect the change. To do so, reopen output @code{AVFormatContext} (in case of API
usage) or restart @command{ffmpeg} instance, cyclically changing
@option{tables_version} value:
@example
ffmpeg -i source1.ts -codec copy -f mpegts -tables_version 0 udp://1.1.1.1:1111
ffmpeg -i source2.ts -codec copy -f mpegts -tables_version 1 udp://1.1.1.1:1111
...
ffmpeg -i source3.ts -codec copy -f mpegts -tables_version 31 udp://1.1.1.1:1111
ffmpeg -i source1.ts -codec copy -f mpegts -tables_version 0 udp://1.1.1.1:1111
ffmpeg -i source2.ts -codec copy -f mpegts -tables_version 1 udp://1.1.1.1:1111
...
@end example
@end table
@subsection Example
@@ -1218,7 +1068,7 @@ ffmpeg -i file.mpg -c copy \
-mpegts_start_pid 0x150 \
-metadata service_provider="Some provider" \
-metadata service_name="Some Channel" \
out.ts
-y out.ts
@end example
@section mxf, mxf_d10
@@ -1467,6 +1317,9 @@ within the specified duration after the segmenting clock time. This way you
can make the segmenter more resilient to backward local time jumps, such as
leap seconds or transition to standard time from daylight savings time.
Assuming that the delay between the packets of your source is less than 0.5
second you can detect a leap second by specifying 0.5 as the duration.
Default is the maximum possible duration which means starting a new segment
regardless of the elapsed time since the last clock time.
@@ -1620,7 +1473,6 @@ Specify whether to remove all fragments when finished. Default 0 (do not remove)
@end table
@anchor{fifo}
@section fifo
The fifo pseudo-muxer allows the separation of encoding and muxing by using
@@ -1728,18 +1580,6 @@ with the tee muxer; encoding can be a very expensive process. It is not
useful when using the libavformat API directly because it is then possible
to feed the same packets to several muxers directly.
@table @option
@item use_fifo @var{bool}
If set to 1, slave outputs will be processed in separate thread using @ref{fifo}
muxer. This allows to compensate for different speed/latency/reliability of
outputs and setup transparent recovery. By default this feature is turned off.
@item fifo_options
Options to pass to fifo pseudo-muxer instances. See @ref{fifo}.
@end table
The slave outputs are specified in the file name given to the muxer,
separated by '|'. If any of the slave name contains the '|' separator,
leading or trailing spaces or any special character, it must be
@@ -1761,13 +1601,6 @@ output name suffix.
Specify a list of bitstream filters to apply to the specified
output.
@item use_fifo @var{bool}
This allows to override tee muxer use_fifo option for individual slave muxer.
@item fifo_options
This allows to override tee muxer fifo_options for individual slave muxer.
See @ref{fifo}.
It is possible to specify to which streams a given bitstream filter
applies, by appending a stream specifier to the option separated by
@code{/}. @var{spec} must be a stream specifier (see @ref{Format
@@ -1816,7 +1649,7 @@ keyframes packets, as requested by the MPEG-TS format. The select
option is applied to @file{out.aac} in order to make it contain only
audio packets.
@example
ffmpeg -i ... -map 0 -flags +global_header -c:v libx264 -c:a aac
ffmpeg -i ... -map 0 -flags +global_header -c:v libx264 -c:a aac -strict experimental
-f tee "[bsfs/v=dump_extra]out.ts|[movflags=+faststart]out.mp4|[select=a]out.aac"
@end example
@@ -1825,7 +1658,7 @@ As below, but select only stream @code{a:1} for the audio output. Note
that a second level escaping must be performed, as ":" is a special
character used to separate options.
@example
ffmpeg -i ... -map 0 -flags +global_header -c:v libx264 -c:a aac
ffmpeg -i ... -map 0 -flags +global_header -c:v libx264 -c:a aac -strict experimental
-f tee "[bsfs/v=dump_extra]out.ts|[movflags=+faststart]out.mp4|[select=\'a:1\']out.aac"
@end example
@end itemize

View File

@@ -142,7 +142,7 @@ Alignment:
Some instructions on some architectures have strict alignment restrictions,
for example most SSE/SSE2 instructions on x86.
The minimum guaranteed alignment is written in the .h files, for example:
void (*put_pixels_clamped)(const int16_t *block/*align 16*/, uint8_t *pixels/*align 8*/, ptrdiff_t stride);
void (*put_pixels_clamped)(const int16_t *block/*align 16*/, UINT8 *pixels/*align 8*/, int line_size);
General Tips:

View File

@@ -131,8 +131,8 @@ and @code{--extra-ldflags}.
On Windows, you need to run the IDL files through @command{widl}.
DeckLink is very picky about the formats it supports. Pixel format is always
uyvy422, framerate, field order and video size must be determined for your
device with @command{-list_formats 1}. Audio sample rate is always 48 kHz.
uyvy422, framerate and video size must be determined for your device with
@command{-list_formats 1}. Audio sample rate is always 48 kHz.
@subsection Options

View File

@@ -23,7 +23,6 @@
*/
#include <stddef.h>
#include <stdio.h>
#include <string.h>
#include <float.h>
@@ -31,16 +30,11 @@
// for the target. without this build breaks on mingw
#define AVFORMAT_OS_SUPPORT_H
#include "libavutil/attributes.h"
#include "libavutil/opt.h"
/* Forcibly turn off deprecation warnings, which just add noise here. */
#undef attribute_deprecated
#define attribute_deprecated
#include "libavcodec/options_table.h"
#include "libavformat/avformat.h"
#include "libavformat/options_table.h"
#include "libavcodec/avcodec.h"
#include "libavcodec/options_table.h"
#include "libavutil/opt.h"
static void print_usage(void)
{

View File

@@ -5,11 +5,6 @@ The libavformat library provides some generic global options, which
can be set on all the protocols. In addition each protocol may support
so-called private options, which are specific for that component.
Options may be set by specifying -@var{option} @var{value} in the
FFmpeg tools, or by setting the value explicitly in the
@code{AVFormatContext} options or using the @file{libavutil/opt.h} API
for programmatic use.
The list of supported options follows:
@table @option
@@ -520,41 +515,6 @@ time, which is valuable if data transmission is slow.
Note that some formats (typically MOV), require the output protocol to
be seekable, so they will fail with the pipe output protocol.
@section prompeg
Pro-MPEG Code of Practice #3 Release 2 FEC protocol.
The Pro-MPEG CoP#3 FEC is a 2D parity-check forward error correction mechanism
for MPEG-2 Transport Streams sent over RTP.
This protocol must be used in conjunction with the @code{rtp_mpegts} muxer and
the @code{rtp} protocol.
The required syntax is:
@example
-f rtp_mpegts -fec prompeg=@var{option}=@var{val}... rtp://@var{hostname}:@var{port}
@end example
The destination UDP ports are @code{port + 2} for the column FEC stream
and @code{port + 4} for the row FEC stream.
This protocol accepts the following options:
@table @option
@item l=@var{n}
The number of columns (4-20, LxD <= 100)
@item d=@var{n}
The number of rows (4-20, LxD <= 100)
@end table
Example usage:
@example
-f rtp_mpegts -fec prompeg=l=8:d=4 rtp://@var{hostname}:@var{port}
@end example
@section rtmp
Real-Time Messaging Protocol.

View File

@@ -132,13 +132,12 @@ For swr only, set resampling phase shift, default value is 10, and must be in
the interval [0,30].
@item linear_interp
Use linear interpolation when enabled (the default). Disable it if you want
to preserve speed instead of quality when exact_rational fails.
Use linear interpolation if set to 1, default value is 0.
@item exact_rational
For swr only, when enabled, try to use exact phase_count based on input and
output sample rate. However, if it is larger than @code{1 << phase_shift},
the phase_count will be @code{1 << phase_shift} as fallback. Default is enabled.
the phase_count will be @code{1 << phase_shift} as fallback. Default is disabled.
@item cutoff
Set cutoff frequency (swr: 6dB point; soxr: 0dB point) ratio; must be a float

View File

@@ -13,8 +13,7 @@ FFmpeg tools. For programmatic use, they can be set explicitly in the
@anchor{sws_flags}
@item sws_flags
Set the scaler flags. This is also used to set the scaling
algorithm. Only a single algorithm should be selected. Default
value is @samp{bicubic}.
algorithm. Only a single algorithm should be selected.
It accepts the following values:
@table @samp

View File

@@ -719,24 +719,19 @@ the name of a standard channel layout (e.g. @samp{mono},
the name of a single channel (e.g. @samp{FL}, @samp{FR}, @samp{FC}, @samp{LFE}, etc.)
@item
a number of channels, in decimal, followed by 'c', yielding the default channel
layout for that number of channels (see the function
@code{av_get_default_channel_layout}). Note that not all channel counts have a
default layout.
@item
a number of channels, in decimal, followed by 'C', yielding an unknown channel
layout with the specified number of channels. Note that not all channel layout
specification strings support unknown channel layouts.
a number of channels, in decimal, optionally followed by 'c', yielding
the default channel layout for that number of channels (see the
function @code{av_get_default_channel_layout})
@item
a channel layout mask, in hexadecimal starting with "0x" (see the
@code{AV_CH_*} macros in @file{libavutil/channel_layout.h}.
@end itemize
Before libavutil version 53 the trailing character "c" to specify a number of
channels was optional, but now it is required, while a channel layout mask can
also be specified as a decimal number (if and only if not followed by "c" or "C").
Starting from libavutil version 53 the trailing character "c" to
specify a number of channels will be required, while a channel layout
mask could also be specified as a decimal number (if and only if not
followed by "c").
See also the function @code{av_get_channel_layout} defined in
@file{libavutil/channel_layout.h}.
@@ -776,9 +771,6 @@ Compute arcsine of @var{x}.
@item atan(x)
Compute arctangent of @var{x}.
@item atan2(x, y)
Compute principal value of the arc tangent of @var{y}/@var{x}.
@item between(x, min, max)
Return 1 if @var{x} is greater than or equal to @var{min} and lesser than or
equal to @var{max}, 0 otherwise.

View File

@@ -420,4 +420,4 @@ done:
When all of this is done, you can submit your patch to the ffmpeg-devel
mailing-list for review. If you need any help, feel free to come on our IRC
channel, #ffmpeg-devel on irc.freenode.net.
channel, #ffmpeg-devel on irc.libera.chat.

1424
ffmpeg.c

File diff suppressed because it is too large Load Diff

View File

@@ -224,8 +224,6 @@ typedef struct OptionsContext {
int nb_disposition;
SpecifierOpt *program;
int nb_program;
SpecifierOpt *time_bases;
int nb_time_bases;
} OptionsContext;
typedef struct InputFilter {
@@ -233,23 +231,6 @@ typedef struct InputFilter {
struct InputStream *ist;
struct FilterGraph *graph;
uint8_t *name;
enum AVMediaType type; // AVMEDIA_TYPE_SUBTITLE for sub2video
AVFifoBuffer *frame_queue;
// parameters configured for this input
int format;
int width, height;
AVRational sample_aspect_ratio;
int sample_rate;
int channels;
uint64_t channel_layout;
AVBufferRef *hw_frames_ctx;
int eof;
} InputFilter;
typedef struct OutputFilter {
@@ -261,18 +242,6 @@ typedef struct OutputFilter {
/* temporary storage until stream maps are processed */
AVFilterInOut *out_tmp;
enum AVMediaType type;
/* desired output stream properties */
int width, height;
AVRational frame_rate;
int format;
int sample_rate;
uint64_t channel_layout;
// those are only set if no format is specified and the encoder gives us multiple options
int *formats;
uint64_t *channel_layouts;
int *sample_rates;
} OutputFilter;
typedef struct FilterGraph {
@@ -316,11 +285,6 @@ typedef struct InputStream {
int64_t min_pts; /* pts with the smallest value in a current stream */
int64_t max_pts; /* pts with the higher value in a current stream */
// when forcing constant input framerate through -r,
// this contains the pts that will be given to the next decoded frame
int64_t cfr_next_pts;
int64_t nb_samples; /* number of samples in the last decoded audio frame before looping */
double ts_scale;
@@ -331,6 +295,14 @@ typedef struct InputStream {
int guess_layout_max;
int autorotate;
int resample_height;
int resample_width;
int resample_pix_fmt;
int resample_sample_fmt;
int resample_sample_rate;
int resample_channels;
uint64_t resample_channel_layout;
int fix_sub_duration;
struct { /* previous decoded subtitle and related variables */
@@ -342,7 +314,6 @@ typedef struct InputStream {
struct sub2video {
int64_t last_pts;
int64_t end_pts;
AVFifoBuffer *sub_queue; ///< queue of AVSubtitle* before filter init
AVFrame *frame;
int w, h;
} sub2video;
@@ -382,8 +353,6 @@ typedef struct InputStream {
int64_t *dts_buffer;
int nb_dts_buffer;
int got_output;
} InputStream;
typedef struct InputFile {
@@ -451,8 +420,6 @@ typedef struct OutputStream {
int64_t first_pts;
/* dts of the last packet sent to the muxer */
int64_t last_mux_dts;
// the timebase of the packets sent to the muxer
AVRational mux_timebase;
int nb_bitstream_filters;
uint8_t *bsf_extradata_updated;
@@ -475,7 +442,6 @@ typedef struct OutputStream {
int force_fps;
int top_field_first;
int rotate_overridden;
double rotate_override_value;
AVRational frame_aspect_ratio;
@@ -513,8 +479,6 @@ typedef struct OutputStream {
// parameters are set in the AVStream.
int initialized;
int inputs_done;
const char *attachment_filename;
int copy_initial_nonkeyframes;
int copy_prior_start;
@@ -605,19 +569,12 @@ extern AVIOContext *progress_avio;
extern float max_error_rate;
extern char *videotoolbox_pixfmt;
extern int filter_nbthreads;
extern int filter_complex_nbthreads;
extern int vstats_version;
extern const AVIOInterruptCB int_cb;
extern const OptionDef options[];
extern const HWAccel hwaccels[];
extern int hwaccel_lax_profile_check;
extern AVBufferRef *hw_device_ctx;
#if CONFIG_QSV
extern char *qsv_device;
#endif
void term_init(void);
@@ -643,10 +600,6 @@ int filtergraph_is_simple(FilterGraph *fg);
int init_simple_filtergraph(InputStream *ist, OutputStream *ost);
int init_complex_filtergraph(FilterGraph *fg);
void sub2video_update(InputStream *ist, AVSubtitle *sub);
int ifilter_parameters_from_frame(InputFilter *ifilter, const AVFrame *frame);
int ffmpeg_parse_options(int argc, char **argv);
int vdpau_init(AVCodecContext *s);
@@ -654,8 +607,10 @@ int dxva2_init(AVCodecContext *s);
int vda_init(AVCodecContext *s);
int videotoolbox_init(AVCodecContext *s);
int qsv_init(AVCodecContext *s);
int qsv_transcode_init(OutputStream *ost);
int vaapi_decode_init(AVCodecContext *avctx);
int vaapi_device_init(const char *device);
int cuvid_init(AVCodecContext *s);
int cuvid_transcode_init(OutputStream *ost);
#endif /* FFMPEG_H */

View File

@@ -17,57 +17,139 @@
*/
#include "libavutil/hwcontext.h"
#include "libavutil/pixdesc.h"
#include "ffmpeg.h"
typedef struct CUVIDContext {
AVBufferRef *hw_frames_ctx;
} CUVIDContext;
static void cuvid_uninit(AVCodecContext *avctx)
{
InputStream *ist = avctx->opaque;
InputStream *ist = avctx->opaque;
CUVIDContext *ctx = ist->hwaccel_ctx;
if (ctx) {
av_buffer_unref(&ctx->hw_frames_ctx);
av_freep(&ctx);
}
av_buffer_unref(&ist->hw_frames_ctx);
ist->hwaccel_ctx = 0;
ist->hwaccel_uninit = 0;
}
int cuvid_init(AVCodecContext *avctx)
{
InputStream *ist = avctx->opaque;
AVHWFramesContext *frames_ctx;
int ret;
InputStream *ist = avctx->opaque;
CUVIDContext *ctx = ist->hwaccel_ctx;
av_log(avctx, AV_LOG_VERBOSE, "Initializing cuvid hwaccel\n");
av_log(NULL, AV_LOG_TRACE, "Initializing cuvid hwaccel\n");
if (!hw_device_ctx) {
ret = av_hwdevice_ctx_create(&hw_device_ctx, AV_HWDEVICE_TYPE_CUDA,
ist->hwaccel_device, NULL, 0);
if (ret < 0) {
av_log(avctx, AV_LOG_ERROR, "Error creating a CUDA device\n");
return ret;
}
if (!ctx) {
av_log(NULL, AV_LOG_ERROR, "CUVID transcoding is not initialized. "
"-hwaccel cuvid should only be used for one-to-one CUVID transcoding "
"with no (software) filters.\n");
return AVERROR(EINVAL);
}
return 0;
}
int cuvid_transcode_init(OutputStream *ost)
{
InputStream *ist;
const enum AVPixelFormat *pix_fmt;
AVHWFramesContext *hwframe_ctx;
AVBufferRef *device_ref = NULL;
CUVIDContext *ctx = NULL;
int ret = 0;
av_log(NULL, AV_LOG_TRACE, "Initializing cuvid transcoding\n");
if (ost->source_index < 0)
return 0;
ist = input_streams[ost->source_index];
/* check if the encoder supports CUVID */
if (!ost->enc->pix_fmts)
goto cancel;
for (pix_fmt = ost->enc->pix_fmts; *pix_fmt != AV_PIX_FMT_NONE; pix_fmt++)
if (*pix_fmt == AV_PIX_FMT_CUDA)
break;
if (*pix_fmt == AV_PIX_FMT_NONE)
goto cancel;
/* check if the decoder supports CUVID */
if (ist->hwaccel_id != HWACCEL_CUVID || !ist->dec || !ist->dec->pix_fmts)
goto cancel;
for (pix_fmt = ist->dec->pix_fmts; *pix_fmt != AV_PIX_FMT_NONE; pix_fmt++)
if (*pix_fmt == AV_PIX_FMT_CUDA)
break;
if (*pix_fmt == AV_PIX_FMT_NONE)
goto cancel;
av_log(NULL, AV_LOG_VERBOSE, "Setting up CUVID transcoding\n");
if (ist->hwaccel_ctx) {
ctx = ist->hwaccel_ctx;
} else {
ctx = av_mallocz(sizeof(*ctx));
if (!ctx) {
ret = AVERROR(ENOMEM);
goto error;
}
}
if (!ctx->hw_frames_ctx) {
ret = av_hwdevice_ctx_create(&device_ref, AV_HWDEVICE_TYPE_CUDA,
ist->hwaccel_device, NULL, 0);
if (ret < 0)
goto error;
ctx->hw_frames_ctx = av_hwframe_ctx_alloc(device_ref);
if (!ctx->hw_frames_ctx) {
av_log(NULL, AV_LOG_ERROR, "av_hwframe_ctx_alloc failed\n");
ret = AVERROR(ENOMEM);
goto error;
}
av_buffer_unref(&device_ref);
ist->hw_frames_ctx = av_buffer_ref(ctx->hw_frames_ctx);
if (!ist->hw_frames_ctx) {
av_log(NULL, AV_LOG_ERROR, "av_buffer_ref failed\n");
ret = AVERROR(ENOMEM);
goto error;
}
ist->hwaccel_ctx = ctx;
ist->resample_pix_fmt = AV_PIX_FMT_CUDA;
ist->hwaccel_uninit = cuvid_uninit;
/* This is a bit hacky, av_hwframe_ctx_init is called by the cuvid decoder
* once it has probed the necessary format information. But as filters/nvenc
* need to know the format/sw_format, set them here so they are happy.
* This is fine as long as CUVID doesn't add another supported pix_fmt.
*/
hwframe_ctx = (AVHWFramesContext*)ctx->hw_frames_ctx->data;
hwframe_ctx->format = AV_PIX_FMT_CUDA;
hwframe_ctx->sw_format = AV_PIX_FMT_NV12;
}
return 0;
error:
av_freep(&ctx);
av_buffer_unref(&device_ref);
return ret;
cancel:
if (ist->hwaccel_id == HWACCEL_CUVID) {
av_log(NULL, AV_LOG_ERROR, "CUVID hwaccel requested, but impossible to achieve.\n");
return AVERROR(EINVAL);
}
av_buffer_unref(&ist->hw_frames_ctx);
ist->hw_frames_ctx = av_hwframe_ctx_alloc(hw_device_ctx);
if (!ist->hw_frames_ctx) {
av_log(avctx, AV_LOG_ERROR, "Error creating a CUDA frames context\n");
return AVERROR(ENOMEM);
}
frames_ctx = (AVHWFramesContext*)ist->hw_frames_ctx->data;
frames_ctx->format = AV_PIX_FMT_CUDA;
frames_ctx->sw_format = avctx->sw_pix_fmt;
frames_ctx->width = avctx->width;
frames_ctx->height = avctx->height;
av_log(avctx, AV_LOG_DEBUG, "Initializing CUDA frames context: sw_format = %s, width = %d, height = %d\n",
av_get_pix_fmt_name(frames_ctx->sw_format), frames_ctx->width, frames_ctx->height);
ret = av_hwframe_ctx_init(ist->hw_frames_ctx);
if (ret < 0) {
av_log(avctx, AV_LOG_ERROR, "Error initializing a CUDA frame pool\n");
return ret;
}
ist->hwaccel_uninit = cuvid_uninit;
return 0;
}

View File

@@ -111,16 +111,16 @@ void choose_sample_fmt(AVStream *st, AVCodec *codec)
}
}
static char *choose_pix_fmts(OutputFilter *ofilter)
static char *choose_pix_fmts(OutputStream *ost)
{
OutputStream *ost = ofilter->ost;
AVDictionaryEntry *strict_dict = av_dict_get(ost->encoder_opts, "strict", NULL, 0);
if (strict_dict)
// used by choose_pixel_fmt() and below
av_opt_set(ost->enc_ctx, "strict", strict_dict->value, 0);
if (ost->keep_pix_fmt) {
avfilter_graph_set_auto_convert(ofilter->graph->graph,
if (ost->filter)
avfilter_graph_set_auto_convert(ost->filter->graph->graph,
AVFILTER_AUTO_CONVERT_NONE);
if (ost->enc_ctx->pix_fmt == AV_PIX_FMT_NONE)
return NULL;
@@ -155,13 +155,13 @@ static char *choose_pix_fmts(OutputFilter *ofilter)
/* Define a function for building a string containing a list of
* allowed formats. */
#define DEF_CHOOSE_FORMAT(suffix, type, var, supported_list, none, get_name) \
static char *choose_ ## suffix (OutputFilter *ofilter) \
#define DEF_CHOOSE_FORMAT(type, var, supported_list, none, get_name) \
static char *choose_ ## var ## s(OutputStream *ost) \
{ \
if (ofilter->var != none) { \
get_name(ofilter->var); \
if (ost->enc_ctx->var != none) { \
get_name(ost->enc_ctx->var); \
return av_strdup(name); \
} else if (ofilter->supported_list) { \
} else if (ost->enc && ost->enc->supported_list) { \
const type *p; \
AVIOContext *s = NULL; \
uint8_t *ret; \
@@ -170,7 +170,7 @@ static char *choose_ ## suffix (OutputFilter *ofilter) \
if (avio_open_dyn_buf(&s) < 0) \
exit_program(1); \
\
for (p = ofilter->supported_list; *p != none; p++) { \
for (p = ost->enc->supported_list; *p != none; p++) { \
get_name(*p); \
avio_printf(s, "%s|", name); \
} \
@@ -181,16 +181,16 @@ static char *choose_ ## suffix (OutputFilter *ofilter) \
return NULL; \
}
//DEF_CHOOSE_FORMAT(pix_fmts, enum AVPixelFormat, format, formats, AV_PIX_FMT_NONE,
// GET_PIX_FMT_NAME)
// DEF_CHOOSE_FORMAT(enum AVPixelFormat, pix_fmt, pix_fmts, AV_PIX_FMT_NONE,
// GET_PIX_FMT_NAME)
DEF_CHOOSE_FORMAT(sample_fmts, enum AVSampleFormat, format, formats,
DEF_CHOOSE_FORMAT(enum AVSampleFormat, sample_fmt, sample_fmts,
AV_SAMPLE_FMT_NONE, GET_SAMPLE_FMT_NAME)
DEF_CHOOSE_FORMAT(sample_rates, int, sample_rate, sample_rates, 0,
DEF_CHOOSE_FORMAT(int, sample_rate, supported_samplerates, 0,
GET_SAMPLE_RATE_NAME)
DEF_CHOOSE_FORMAT(channel_layouts, uint64_t, channel_layout, channel_layouts, 0,
DEF_CHOOSE_FORMAT(uint64_t, channel_layout, channel_layouts, 0,
GET_CH_LAYOUT_NAME)
int init_simple_filtergraph(InputStream *ist, OutputStream *ost)
@@ -206,7 +206,6 @@ int init_simple_filtergraph(InputStream *ist, OutputStream *ost)
exit_program(1);
fg->outputs[0]->ost = ost;
fg->outputs[0]->graph = fg;
fg->outputs[0]->format = -1;
ost->filter = fg->outputs[0];
@@ -215,11 +214,6 @@ int init_simple_filtergraph(InputStream *ist, OutputStream *ost)
exit_program(1);
fg->inputs[0]->ist = ist;
fg->inputs[0]->graph = fg;
fg->inputs[0]->format = -1;
fg->inputs[0]->frame_queue = av_fifo_alloc(8 * sizeof(AVFrame*));
if (!fg->inputs[0]->frame_queue)
exit_program(1);
GROW_ARRAY(ist->filters, ist->nb_filters);
ist->filters[ist->nb_filters - 1] = fg->inputs[0];
@@ -230,25 +224,6 @@ int init_simple_filtergraph(InputStream *ist, OutputStream *ost)
return 0;
}
static char *describe_filter_link(FilterGraph *fg, AVFilterInOut *inout, int in)
{
AVFilterContext *ctx = inout->filter_ctx;
AVFilterPad *pads = in ? ctx->input_pads : ctx->output_pads;
int nb_pads = in ? ctx->nb_inputs : ctx->nb_outputs;
AVIOContext *pb;
uint8_t *res = NULL;
if (avio_open_dyn_buf(&pb) < 0)
exit_program(1);
avio_printf(pb, "%s", ctx->filter->name);
if (nb_pads > 1)
avio_printf(pb, ":%s", avfilter_pad_get_name(pads, inout->pad_idx));
avio_w8(pb, 0);
avio_close_dyn_buf(pb, &res);
return res;
}
static void init_input_filter(FilterGraph *fg, AVFilterInOut *in)
{
InputStream *ist = NULL;
@@ -317,13 +292,6 @@ static void init_input_filter(FilterGraph *fg, AVFilterInOut *in)
exit_program(1);
fg->inputs[fg->nb_inputs - 1]->ist = ist;
fg->inputs[fg->nb_inputs - 1]->graph = fg;
fg->inputs[fg->nb_inputs - 1]->format = -1;
fg->inputs[fg->nb_inputs - 1]->type = ist->st->codecpar->codec_type;
fg->inputs[fg->nb_inputs - 1]->name = describe_filter_link(fg, in, 1);
fg->inputs[fg->nb_inputs - 1]->frame_queue = av_fifo_alloc(8 * sizeof(AVFrame*));
if (!fg->inputs[fg->nb_inputs - 1]->frame_queue)
exit_program(1);
GROW_ARRAY(ist->filters, ist->nb_filters);
ist->filters[ist->nb_filters - 1] = fg->inputs[fg->nb_inputs - 1];
@@ -358,7 +326,6 @@ int init_complex_filtergraph(FilterGraph *fg)
fg->outputs[fg->nb_outputs - 1]->out_tmp = cur;
fg->outputs[fg->nb_outputs - 1]->type = avfilter_pad_get_type(cur->filter_ctx->output_pads,
cur->pad_idx);
fg->outputs[fg->nb_outputs - 1]->name = describe_filter_link(fg, cur, 0);
cur = cur->next;
fg->outputs[fg->nb_outputs - 1]->out_tmp->next = NULL;
}
@@ -447,12 +414,13 @@ static int configure_output_video_filter(FilterGraph *fg, OutputFilter *ofilter,
char *pix_fmts;
OutputStream *ost = ofilter->ost;
OutputFile *of = output_files[ost->file_index];
AVCodecContext *codec = ost->enc_ctx;
AVFilterContext *last_filter = out->filter_ctx;
int pad_idx = out->pad_idx;
int ret;
char name[255];
snprintf(name, sizeof(name), "out_%d_%d", ost->file_index, ost->index);
snprintf(name, sizeof(name), "output stream %d:%d", ost->file_index, ost->index);
ret = avfilter_graph_create_filter(&ofilter->filter,
avfilter_get_by_name("buffersink"),
name, NULL, NULL, fg->graph);
@@ -460,20 +428,21 @@ static int configure_output_video_filter(FilterGraph *fg, OutputFilter *ofilter,
if (ret < 0)
return ret;
if (ofilter->width || ofilter->height) {
if (!hw_device_ctx && (codec->width || codec->height)) {
char args[255];
AVFilterContext *filter;
AVDictionaryEntry *e = NULL;
snprintf(args, sizeof(args), "%d:%d",
ofilter->width, ofilter->height);
codec->width,
codec->height);
while ((e = av_dict_get(ost->sws_dict, "", e,
AV_DICT_IGNORE_SUFFIX))) {
av_strlcatf(args, sizeof(args), ":%s=%s", e->key, e->value);
}
snprintf(name, sizeof(name), "scaler_out_%d_%d",
snprintf(name, sizeof(name), "scaler for output stream %d:%d",
ost->file_index, ost->index);
if ((ret = avfilter_graph_create_filter(&filter, avfilter_get_by_name("scale"),
name, args, NULL, fg->graph)) < 0)
@@ -485,9 +454,9 @@ static int configure_output_video_filter(FilterGraph *fg, OutputFilter *ofilter,
pad_idx = 0;
}
if ((pix_fmts = choose_pix_fmts(ofilter))) {
if ((pix_fmts = choose_pix_fmts(ost))) {
AVFilterContext *filter;
snprintf(name, sizeof(name), "format_out_%d_%d",
snprintf(name, sizeof(name), "pixel format for output stream %d:%d",
ost->file_index, ost->index);
ret = avfilter_graph_create_filter(&filter,
avfilter_get_by_name("format"),
@@ -508,7 +477,7 @@ static int configure_output_video_filter(FilterGraph *fg, OutputFilter *ofilter,
snprintf(args, sizeof(args), "fps=%d/%d", ost->frame_rate.num,
ost->frame_rate.den);
snprintf(name, sizeof(name), "fps_out_%d_%d",
snprintf(name, sizeof(name), "fps for output stream %d:%d",
ost->file_index, ost->index);
ret = avfilter_graph_create_filter(&fps, avfilter_get_by_name("fps"),
name, args, NULL, fg->graph);
@@ -522,7 +491,7 @@ static int configure_output_video_filter(FilterGraph *fg, OutputFilter *ofilter,
pad_idx = 0;
}
snprintf(name, sizeof(name), "trim_out_%d_%d",
snprintf(name, sizeof(name), "trim for output stream %d:%d",
ost->file_index, ost->index);
ret = insert_trim(of->start_time, of->recording_time,
&last_filter, &pad_idx, name);
@@ -547,7 +516,7 @@ static int configure_output_audio_filter(FilterGraph *fg, OutputFilter *ofilter,
char name[255];
int ret;
snprintf(name, sizeof(name), "out_%d_%d", ost->file_index, ost->index);
snprintf(name, sizeof(name), "output stream %d:%d", ost->file_index, ost->index);
ret = avfilter_graph_create_filter(&ofilter->filter,
avfilter_get_by_name("abuffersink"),
name, NULL, NULL, fg->graph);
@@ -592,9 +561,9 @@ static int configure_output_audio_filter(FilterGraph *fg, OutputFilter *ofilter,
if (codec->channels && !codec->channel_layout)
codec->channel_layout = av_get_default_channel_layout(codec->channels);
sample_fmts = choose_sample_fmts(ofilter);
sample_rates = choose_sample_rates(ofilter);
channel_layouts = choose_channel_layouts(ofilter);
sample_fmts = choose_sample_fmts(ost);
sample_rates = choose_sample_rates(ost);
channel_layouts = choose_channel_layouts(ost);
if (sample_fmts || sample_rates || channel_layouts) {
AVFilterContext *format;
char args[256];
@@ -614,7 +583,7 @@ static int configure_output_audio_filter(FilterGraph *fg, OutputFilter *ofilter,
av_freep(&sample_rates);
av_freep(&channel_layouts);
snprintf(name, sizeof(name), "format_out_%d_%d",
snprintf(name, sizeof(name), "audio format for output stream %d:%d",
ost->file_index, ost->index);
ret = avfilter_graph_create_filter(&format,
avfilter_get_by_name("aformat"),
@@ -664,8 +633,28 @@ static int configure_output_audio_filter(FilterGraph *fg, OutputFilter *ofilter,
return 0;
}
#define DESCRIBE_FILTER_LINK(f, inout, in) \
{ \
AVFilterContext *ctx = inout->filter_ctx; \
AVFilterPad *pads = in ? ctx->input_pads : ctx->output_pads; \
int nb_pads = in ? ctx->nb_inputs : ctx->nb_outputs; \
AVIOContext *pb; \
\
if (avio_open_dyn_buf(&pb) < 0) \
exit_program(1); \
\
avio_printf(pb, "%s", ctx->filter->name); \
if (nb_pads > 1) \
avio_printf(pb, ":%s", avfilter_pad_get_name(pads, inout->pad_idx));\
avio_w8(pb, 0); \
avio_close_dyn_buf(pb, &f->name); \
}
int configure_output_filter(FilterGraph *fg, OutputFilter *ofilter, AVFilterInOut *out)
{
av_freep(&ofilter->name);
DESCRIBE_FILTER_LINK(ofilter, out, 0);
if (!ofilter->ost) {
av_log(NULL, AV_LOG_FATAL, "Filter %s has an unconnected output\n", ofilter->name);
exit_program(1);
@@ -678,7 +667,7 @@ int configure_output_filter(FilterGraph *fg, OutputFilter *ofilter, AVFilterInOu
}
}
static int sub2video_prepare(InputStream *ist, InputFilter *ifilter)
static int sub2video_prepare(InputStream *ist)
{
AVFormatContext *avf = input_files[ist->file_index]->ctx;
int i, w, h;
@@ -686,8 +675,8 @@ static int sub2video_prepare(InputStream *ist, InputFilter *ifilter)
/* Compute the size of the canvas for the subtitles stream.
If the subtitles codecpar has set a size, use it. Otherwise use the
maximum dimensions of the video streams in the same file. */
w = ifilter->width;
h = ifilter->height;
w = ist->dec_ctx->width;
h = ist->dec_ctx->height;
if (!(w && h)) {
for (i = 0; i < avf->nb_streams; i++) {
if (avf->streams[i]->codecpar->codec_type == AVMEDIA_TYPE_VIDEO) {
@@ -701,15 +690,12 @@ static int sub2video_prepare(InputStream *ist, InputFilter *ifilter)
}
av_log(avf, AV_LOG_INFO, "sub2video: using %dx%d canvas\n", w, h);
}
ist->sub2video.w = ifilter->width = w;
ist->sub2video.h = ifilter->height = h;
ifilter->width = ist->dec_ctx->width ? ist->dec_ctx->width : ist->sub2video.w;
ifilter->height = ist->dec_ctx->height ? ist->dec_ctx->height : ist->sub2video.h;
ist->sub2video.w = ist->resample_width = w;
ist->sub2video.h = ist->resample_height = h;
/* rectangles are AV_PIX_FMT_PAL8, but we have no guarantee that the
palettes for all rectangles are identical or compatible */
ifilter->format = AV_PIX_FMT_RGB32;
ist->resample_pix_fmt = ist->dec_ctx->pix_fmt = AV_PIX_FMT_RGB32;
ist->sub2video.frame = av_frame_alloc();
if (!ist->sub2video.frame)
@@ -750,19 +736,22 @@ static int configure_input_video_filter(FilterGraph *fg, InputFilter *ifilter,
fr = av_guess_frame_rate(input_files[ist->file_index]->ctx, ist->st, NULL);
if (ist->dec_ctx->codec_type == AVMEDIA_TYPE_SUBTITLE) {
ret = sub2video_prepare(ist, ifilter);
ret = sub2video_prepare(ist);
if (ret < 0)
goto fail;
}
sar = ifilter->sample_aspect_ratio;
sar = ist->st->sample_aspect_ratio.num ?
ist->st->sample_aspect_ratio :
ist->dec_ctx->sample_aspect_ratio;
if(!sar.den)
sar = (AVRational){0,1};
av_bprint_init(&args, 0, 1);
av_bprintf(&args,
"video_size=%dx%d:pix_fmt=%d:time_base=%d/%d:"
"pixel_aspect=%d/%d:sws_param=flags=%d",
ifilter->width, ifilter->height, ifilter->format,
"pixel_aspect=%d/%d:sws_param=flags=%d", ist->resample_width,
ist->resample_height,
ist->hwaccel_retrieve_data ? ist->hwaccel_retrieved_pix_fmt : ist->resample_pix_fmt,
tb.num, tb.den, sar.num, sar.den,
SWS_BILINEAR + ((ist->dec_ctx->flags&AV_CODEC_FLAG_BITEXACT) ? SWS_BITEXACT:0));
if (fr.num && fr.den)
@@ -774,7 +763,7 @@ static int configure_input_video_filter(FilterGraph *fg, InputFilter *ifilter,
if ((ret = avfilter_graph_create_filter(&ifilter->filter, buffer_filt, name,
args.str, NULL, fg->graph)) < 0)
goto fail;
par->hw_frames_ctx = ifilter->hw_frames_ctx;
par->hw_frames_ctx = ist->hw_frames_ctx;
ret = av_buffersrc_parameters_set(ifilter->filter, par);
if (ret < 0)
goto fail;
@@ -802,10 +791,27 @@ static int configure_input_video_filter(FilterGraph *fg, InputFilter *ifilter,
return ret;
}
if (ist->framerate.num) {
AVFilterContext *setpts;
snprintf(name, sizeof(name), "force CFR for input from stream %d:%d",
ist->file_index, ist->st->index);
if ((ret = avfilter_graph_create_filter(&setpts,
avfilter_get_by_name("setpts"),
name, "N", NULL,
fg->graph)) < 0)
return ret;
if ((ret = avfilter_link(last_filter, 0, setpts, 0)) < 0)
return ret;
last_filter = setpts;
}
if (do_deinterlace) {
AVFilterContext *yadif;
snprintf(name, sizeof(name), "deinterlace_in_%d_%d",
snprintf(name, sizeof(name), "deinterlace input from stream %d:%d",
ist->file_index, ist->st->index);
if ((ret = avfilter_graph_create_filter(&yadif,
avfilter_get_by_name("yadif"),
@@ -819,7 +825,7 @@ static int configure_input_video_filter(FilterGraph *fg, InputFilter *ifilter,
last_filter = yadif;
}
snprintf(name, sizeof(name), "trim_in_%d_%d",
snprintf(name, sizeof(name), "trim for input stream %d:%d",
ist->file_index, ist->st->index);
if (copy_ts) {
tsoffset = f->start_time == AV_NOPTS_VALUE ? 0 : f->start_time;
@@ -860,15 +866,15 @@ static int configure_input_audio_filter(FilterGraph *fg, InputFilter *ifilter,
av_bprint_init(&args, 0, AV_BPRINT_SIZE_AUTOMATIC);
av_bprintf(&args, "time_base=%d/%d:sample_rate=%d:sample_fmt=%s",
1, ifilter->sample_rate,
ifilter->sample_rate,
av_get_sample_fmt_name(ifilter->format));
if (ifilter->channel_layout)
1, ist->dec_ctx->sample_rate,
ist->dec_ctx->sample_rate,
av_get_sample_fmt_name(ist->dec_ctx->sample_fmt));
if (ist->dec_ctx->channel_layout)
av_bprintf(&args, ":channel_layout=0x%"PRIx64,
ifilter->channel_layout);
ist->dec_ctx->channel_layout);
else
av_bprintf(&args, ":channels=%d", ifilter->channels);
snprintf(name, sizeof(name), "graph_%d_in_%d_%d", fg->index,
av_bprintf(&args, ":channels=%d", ist->dec_ctx->channels);
snprintf(name, sizeof(name), "graph %d input from stream %d:%d", fg->index,
ist->file_index, ist->st->index);
if ((ret = avfilter_graph_create_filter(&ifilter->filter, abuffer_filt,
@@ -883,7 +889,7 @@ static int configure_input_audio_filter(FilterGraph *fg, InputFilter *ifilter,
av_log(NULL, AV_LOG_INFO, opt_name " is forwarded to lavfi " \
"similarly to -af " filter_name "=%s.\n", arg); \
\
snprintf(name, sizeof(name), "graph_%d_%s_in_%d_%d", \
snprintf(name, sizeof(name), "graph %d %s for input stream %d:%d", \
fg->index, filter_name, ist->file_index, ist->st->index); \
ret = avfilter_graph_create_filter(&filt_ctx, \
avfilter_get_by_name(filter_name), \
@@ -954,6 +960,9 @@ static int configure_input_audio_filter(FilterGraph *fg, InputFilter *ifilter,
static int configure_input_filter(FilterGraph *fg, InputFilter *ifilter,
AVFilterInOut *in)
{
av_freep(&ifilter->name);
DESCRIBE_FILTER_LINK(ifilter, in, 1);
if (!ifilter->ist->dec) {
av_log(NULL, AV_LOG_ERROR,
"No decoder for stream #%d:%d, filtering impossible\n",
@@ -967,16 +976,6 @@ static int configure_input_filter(FilterGraph *fg, InputFilter *ifilter,
}
}
static void cleanup_filtergraph(FilterGraph *fg)
{
int i;
for (i = 0; i < fg->nb_outputs; i++)
fg->outputs[i]->filter = (AVFilterContext *)NULL;
for (i = 0; i < fg->nb_inputs; i++)
fg->inputs[i]->filter = (AVFilterContext *)NULL;
avfilter_graph_free(&fg->graph);
}
int configure_filtergraph(FilterGraph *fg)
{
AVFilterInOut *inputs, *outputs, *cur;
@@ -984,7 +983,7 @@ int configure_filtergraph(FilterGraph *fg)
const char *graph_desc = simple ? fg->outputs[0]->ost->avfilter :
fg->graph_desc;
cleanup_filtergraph(fg);
avfilter_graph_free(&fg->graph);
if (!(fg->graph = avfilter_graph_alloc()))
return AVERROR(ENOMEM);
@@ -993,8 +992,6 @@ int configure_filtergraph(FilterGraph *fg)
char args[512];
AVDictionaryEntry *e = NULL;
fg->graph->nb_threads = filter_nbthreads;
args[0] = 0;
while ((e = av_dict_get(ost->sws_dict, "", e,
AV_DICT_IGNORE_SUFFIX))) {
@@ -1020,16 +1017,15 @@ int configure_filtergraph(FilterGraph *fg)
}
if (strlen(args))
args[strlen(args) - 1] = '\0';
fg->graph->resample_lavr_opts = av_strdup(args);
e = av_dict_get(ost->encoder_opts, "threads", NULL, 0);
if (e)
av_opt_set(fg->graph, "threads", e->value, 0);
} else {
fg->graph->nb_threads = filter_complex_nbthreads;
}
if ((ret = avfilter_graph_parse2(fg->graph, graph_desc, &inputs, &outputs)) < 0)
goto fail;
return ret;
if (hw_device_ctx) {
for (i = 0; i < fg->graph->nb_filters; i++) {
@@ -1059,15 +1055,14 @@ int configure_filtergraph(FilterGraph *fg)
" However, it had %s input(s) and %s output(s)."
" Please adjust, or use a complex filtergraph (-filter_complex) instead.\n",
graph_desc, num_inputs, num_outputs);
ret = AVERROR(EINVAL);
goto fail;
return AVERROR(EINVAL);
}
for (cur = inputs, i = 0; cur; cur = cur->next, i++)
if ((ret = configure_input_filter(fg, fg->inputs[i], cur)) < 0) {
avfilter_inout_free(&inputs);
avfilter_inout_free(&outputs);
goto fail;
return ret;
}
avfilter_inout_free(&inputs);
@@ -1076,22 +1071,7 @@ int configure_filtergraph(FilterGraph *fg)
avfilter_inout_free(&outputs);
if ((ret = avfilter_graph_config(fg->graph, NULL)) < 0)
goto fail;
/* limit the lists of allowed formats to the ones selected, to
* make sure they stay the same if the filtergraph is reconfigured later */
for (i = 0; i < fg->nb_outputs; i++) {
OutputFilter *ofilter = fg->outputs[i];
AVFilterContext *sink = ofilter->filter;
ofilter->format = av_buffersink_get_format(sink);
ofilter->width = av_buffersink_get_w(sink);
ofilter->height = av_buffersink_get_h(sink);
ofilter->sample_rate = av_buffersink_get_sample_rate(sink);
ofilter->channel_layout = av_buffersink_get_channel_layout(sink);
}
return ret;
fg->reconfiguration = 1;
@@ -1102,8 +1082,7 @@ int configure_filtergraph(FilterGraph *fg)
complex filter graphs are initialized earlier */
av_log(NULL, AV_LOG_ERROR, "Encoder (codec %s) not found for output stream #%d:%d\n",
avcodec_get_name(ost->st->codecpar->codec_id), ost->file_index, ost->index);
ret = AVERROR(EINVAL);
goto fail;
return AVERROR(EINVAL);
}
if (ost->enc->type == AVMEDIA_TYPE_AUDIO &&
!(ost->enc->capabilities & AV_CODEC_CAP_VARIABLE_FRAME_SIZE))
@@ -1111,66 +1090,6 @@ int configure_filtergraph(FilterGraph *fg)
ost->enc_ctx->frame_size);
}
for (i = 0; i < fg->nb_inputs; i++) {
while (av_fifo_size(fg->inputs[i]->frame_queue)) {
AVFrame *tmp;
av_fifo_generic_read(fg->inputs[i]->frame_queue, &tmp, sizeof(tmp), NULL);
ret = av_buffersrc_add_frame(fg->inputs[i]->filter, tmp);
av_frame_free(&tmp);
if (ret < 0)
goto fail;
}
}
/* send the EOFs for the finished inputs */
for (i = 0; i < fg->nb_inputs; i++) {
if (fg->inputs[i]->eof) {
ret = av_buffersrc_add_frame(fg->inputs[i]->filter, NULL);
if (ret < 0)
goto fail;
}
}
/* process queued up subtitle packets */
for (i = 0; i < fg->nb_inputs; i++) {
InputStream *ist = fg->inputs[i]->ist;
if (ist->sub2video.sub_queue && ist->sub2video.frame) {
while (av_fifo_size(ist->sub2video.sub_queue)) {
AVSubtitle tmp;
av_fifo_generic_read(ist->sub2video.sub_queue, &tmp, sizeof(tmp), NULL);
sub2video_update(ist, &tmp);
avsubtitle_free(&tmp);
}
}
}
return 0;
fail:
cleanup_filtergraph(fg);
return ret;
}
int ifilter_parameters_from_frame(InputFilter *ifilter, const AVFrame *frame)
{
av_buffer_unref(&ifilter->hw_frames_ctx);
ifilter->format = frame->format;
ifilter->width = frame->width;
ifilter->height = frame->height;
ifilter->sample_aspect_ratio = frame->sample_aspect_ratio;
ifilter->sample_rate = frame->sample_rate;
ifilter->channels = av_frame_get_channels(frame);
ifilter->channel_layout = frame->channel_layout;
if (frame->hw_frames_ctx) {
ifilter->hw_frames_ctx = av_buffer_ref(frame->hw_frames_ctx);
if (!ifilter->hw_frames_ctx)
return AVERROR(ENOMEM);
}
return 0;
}

View File

@@ -1,3 +1,4 @@
/*
* ffmpeg option parsing
*
@@ -119,9 +120,6 @@ int qp_hist = 0;
int stdin_interaction = 1;
int frame_bits_per_raw_sample = 0;
float max_error_rate = 2.0/3;
int filter_nbthreads = 0;
int filter_complex_nbthreads = 0;
int vstats_version = 2;
static int intra_only = 0;
@@ -185,7 +183,7 @@ static int show_hwaccels(void *optctx, const char *opt, const char *arg)
int i;
printf("Hardware acceleration methods:\n");
for (i = 0; hwaccels[i].name; i++) {
for (i = 0; i < FF_ARRAY_ELEMS(hwaccels) - 1; i++) {
printf("%s\n", hwaccels[i].name);
}
printf("\n");
@@ -736,6 +734,10 @@ static void add_input_streams(OptionsContext *o, AVFormatContext *ic)
// avformat_find_stream_info() doesn't set this for us anymore.
ist->dec_ctx->framerate = st->avg_frame_rate;
ist->resample_height = ist->dec_ctx->height;
ist->resample_width = ist->dec_ctx->width;
ist->resample_pix_fmt = ist->dec_ctx->pix_fmt;
MATCH_PER_STREAM_OPT(frame_rates, str, framerate, ic, st);
if (framerate && av_parse_video_rate(&ist->framerate,
framerate) < 0) {
@@ -800,6 +802,12 @@ static void add_input_streams(OptionsContext *o, AVFormatContext *ic)
ist->guess_layout_max = INT_MAX;
MATCH_PER_STREAM_OPT(guess_layout_max, i, ist->guess_layout_max, ic, st);
guess_input_channel_layout(ist);
ist->resample_sample_fmt = ist->dec_ctx->sample_fmt;
ist->resample_sample_rate = ist->dec_ctx->sample_rate;
ist->resample_channels = ist->dec_ctx->channels;
ist->resample_channel_layout = ist->dec_ctx->channel_layout;
break;
case AVMEDIA_TYPE_DATA:
case AVMEDIA_TYPE_SUBTITLE: {
@@ -927,7 +935,6 @@ static int open_input_file(OptionsContext *o, const char *filename)
print_error(filename, AVERROR(ENOMEM));
exit_program(1);
}
ic->flags |= AVFMT_FLAG_KEEP_SIDE_DATA;
if (o->nb_audio_sample_rate) {
av_dict_set_int(&o->g->format_opts, "sample_rate", o->audio_sample_rate[o->nb_audio_sample_rate - 1].u.i, 0);
}
@@ -1223,7 +1230,7 @@ static OutputStream *new_output_stream(OptionsContext *o, AVFormatContext *oc, e
OutputStream *ost;
AVStream *st = avformat_new_stream(oc, NULL);
int idx = oc->nb_streams - 1, ret = 0;
const char *bsfs = NULL, *time_base = NULL;
const char *bsfs = NULL;
char *next, *codec_tag = NULL;
double qscale = -1;
int i;
@@ -1300,17 +1307,6 @@ static OutputStream *new_output_stream(OptionsContext *o, AVFormatContext *oc, e
ost->encoder_opts = filter_codec_opts(o->g->codec_opts, AV_CODEC_ID_NONE, oc, st, NULL);
}
MATCH_PER_STREAM_OPT(time_bases, str, time_base, oc, st);
if (time_base) {
AVRational q;
if (av_parse_ratio(&q, time_base, INT_MAX, 0, NULL) < 0 ||
q.num <= 0 || q.den <= 0) {
av_log(NULL, AV_LOG_FATAL, "Invalid time base: %s\n", time_base);
exit_program(1);
}
st->time_base = q;
}
ost->max_frames = INT64_MAX;
MATCH_PER_STREAM_OPT(max_frames, i64, ost->max_frames, oc, st);
for (i = 0; i<o->nb_max_frames; i++) {
@@ -1913,7 +1909,6 @@ static int read_ffserver_streams(OptionsContext *o, AVFormatContext *s, const ch
int i, err;
AVFormatContext *ic = avformat_alloc_context();
ic->flags |= AVFMT_FLAG_KEEP_SIDE_DATA;
ic->interrupt_callback = int_cb;
err = avformat_open_input(&ic, filename, NULL, NULL);
if (err < 0)
@@ -1977,7 +1972,6 @@ static void init_output_filter(OutputFilter *ofilter, OptionsContext *o,
ost->filter = ofilter;
ofilter->ost = ost;
ofilter->format = -1;
if (ost->stream_copy) {
av_log(NULL, AV_LOG_ERROR, "Streamcopy requested for output stream %d:%d, "
@@ -2013,6 +2007,17 @@ static int init_complex_filters(void)
return 0;
}
static int configure_complex_filters(void)
{
int i, ret = 0;
for (i = 0; i < nb_filtergraphs; i++)
if (!filtergraph_is_simple(filtergraphs[i]) &&
(ret = configure_filtergraph(filtergraphs[i])) < 0)
return ret;
return 0;
}
static int open_output_file(OptionsContext *o, const char *filename)
{
AVFormatContext *oc;
@@ -2023,7 +2028,7 @@ static int open_output_file(OptionsContext *o, const char *filename)
InputStream *ist;
AVDictionary *unused_opts = NULL;
AVDictionaryEntry *e = NULL;
int format_flags = 0;
if (o->stop_time != INT64_MAX && o->recording_time != INT64_MAX) {
o->stop_time = INT64_MAX;
@@ -2069,12 +2074,6 @@ static int open_output_file(OptionsContext *o, const char *filename)
file_oformat= oc->oformat;
oc->interrupt_callback = int_cb;
e = av_dict_get(o->g->format_opts, "fflags", NULL, 0);
if (e) {
const AVOption *o = av_opt_find(oc, "fflags", NULL, 0, 0);
av_opt_eval_flags(oc, o, e->value, &format_flags);
}
/* create streams for all unlabeled output pads */
for (i = 0; i < nb_filtergraphs; i++) {
FilterGraph *fg = filtergraphs[i];
@@ -2095,7 +2094,6 @@ static int open_output_file(OptionsContext *o, const char *filename)
/* ffserver seeking with date=... needs a date reference */
if (!strcmp(file_oformat->name, "ffm") &&
!(format_flags & AVFMT_FLAG_BITEXACT) &&
av_strstart(filename, "http:", NULL)) {
int err = parse_option(o, "metadata", "creation_time=now", options);
if (err < 0) {
@@ -2303,12 +2301,14 @@ loop_end:
o->attachments[i]);
exit_program(1);
}
if (!(attachment = av_malloc(len))) {
av_log(NULL, AV_LOG_FATAL, "Attachment %s too large to fit into memory.\n",
if (len > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE ||
!(attachment = av_malloc(len + AV_INPUT_BUFFER_PADDING_SIZE))) {
av_log(NULL, AV_LOG_FATAL, "Attachment %s too large.\n",
o->attachments[i]);
exit_program(1);
}
avio_read(pb, attachment, len);
memset(attachment + len, 0, AV_INPUT_BUFFER_PADDING_SIZE);
ost = new_attachment_stream(o, oc, -1);
ost->stream_copy = 0;
@@ -2402,67 +2402,6 @@ loop_end:
}
}
}
/* set the filter output constraints */
if (ost->filter) {
OutputFilter *f = ost->filter;
int count;
switch (ost->enc_ctx->codec_type) {
case AVMEDIA_TYPE_VIDEO:
f->frame_rate = ost->frame_rate;
f->width = ost->enc_ctx->width;
f->height = ost->enc_ctx->height;
if (ost->enc_ctx->pix_fmt != AV_PIX_FMT_NONE) {
f->format = ost->enc_ctx->pix_fmt;
} else if (ost->enc->pix_fmts) {
count = 0;
while (ost->enc->pix_fmts[count] != AV_PIX_FMT_NONE)
count++;
f->formats = av_mallocz_array(count + 1, sizeof(*f->formats));
if (!f->formats)
exit_program(1);
memcpy(f->formats, ost->enc->pix_fmts, (count + 1) * sizeof(*f->formats));
}
break;
case AVMEDIA_TYPE_AUDIO:
if (ost->enc_ctx->sample_fmt != AV_SAMPLE_FMT_NONE) {
f->format = ost->enc_ctx->sample_fmt;
} else if (ost->enc->sample_fmts) {
count = 0;
while (ost->enc->sample_fmts[count] != AV_SAMPLE_FMT_NONE)
count++;
f->formats = av_mallocz_array(count + 1, sizeof(*f->formats));
if (!f->formats)
exit_program(1);
memcpy(f->formats, ost->enc->sample_fmts, (count + 1) * sizeof(*f->formats));
}
if (ost->enc_ctx->sample_rate) {
f->sample_rate = ost->enc_ctx->sample_rate;
} else if (ost->enc->supported_samplerates) {
count = 0;
while (ost->enc->supported_samplerates[count])
count++;
f->sample_rates = av_mallocz_array(count + 1, sizeof(*f->sample_rates));
if (!f->sample_rates)
exit_program(1);
memcpy(f->sample_rates, ost->enc->supported_samplerates,
(count + 1) * sizeof(*f->sample_rates));
}
if (ost->enc_ctx->channels) {
f->channel_layout = av_get_default_channel_layout(ost->enc_ctx->channels);
} else if (ost->enc->channel_layouts) {
count = 0;
while (ost->enc->channel_layouts[count])
count++;
f->channel_layouts = av_mallocz_array(count + 1, sizeof(*f->channel_layouts));
if (!f->channel_layouts)
exit_program(1);
memcpy(f->channel_layouts, ost->enc->channel_layouts,
(count + 1) * sizeof(*f->channel_layouts));
}
break;
}
}
}
/* check filename in case of an image number is expected */
@@ -2549,6 +2488,8 @@ loop_end:
av_dict_copy(&output_streams[i]->st->metadata, ist->st->metadata, AV_DICT_DONT_OVERWRITE);
if (!output_streams[i]->stream_copy) {
av_dict_set(&output_streams[i]->st->metadata, "encoder", NULL, 0);
if (ist->autorotate)
av_dict_set(&output_streams[i]->st->metadata, "rotate", NULL, 0);
}
}
@@ -2638,15 +2579,9 @@ loop_end:
for (j = 0; j < oc->nb_streams; j++) {
ost = output_streams[nb_output_streams - oc->nb_streams + j];
if ((ret = check_stream_specifier(oc, oc->streams[j], stream_spec)) > 0) {
av_dict_set(&oc->streams[j]->metadata, o->metadata[i].u.str, *val ? val : NULL, 0);
if (!strcmp(o->metadata[i].u.str, "rotate")) {
char *tail;
double theta = av_strtod(val, &tail);
if (!*tail) {
ost->rotate_overridden = 1;
ost->rotate_override_value = theta;
}
} else {
av_dict_set(&oc->streams[j]->metadata, o->metadata[i].u.str, *val ? val : NULL, 0);
ost->rotate_overridden = 1;
}
} else if (ret < 0)
exit_program(1);
@@ -2700,13 +2635,14 @@ static int opt_target(void *optctx, const char *opt, const char *arg)
} else {
/* Try to determine PAL/NTSC by peeking in the input files */
if (nb_input_files) {
int i, j, fr;
int i, j;
for (j = 0; j < nb_input_files; j++) {
for (i = 0; i < input_files[j]->nb_streams; i++) {
AVStream *st = input_files[j]->ctx->streams[i];
int64_t fr;
if (st->codecpar->codec_type != AVMEDIA_TYPE_VIDEO)
continue;
fr = st->time_base.den * 1000 / st->time_base.num;
fr = st->time_base.den * 1000LL / st->time_base.num;
if (fr == 25000) {
norm = PAL;
break;
@@ -3196,6 +3132,7 @@ static int open_files(OptionGroupList *l, const char *inout,
if (ret < 0) {
av_log(NULL, AV_LOG_ERROR, "Error parsing options for %s file "
"%s.\n", inout, g->arg);
uninit_options(&o);
return ret;
}
@@ -3260,6 +3197,13 @@ int ffmpeg_parse_options(int argc, char **argv)
goto fail;
}
/* configure the complex filtergraphs */
ret = configure_complex_filters();
if (ret < 0) {
av_log(NULL, AV_LOG_FATAL, "Error configuring complex filters.\n");
goto fail;
}
fail:
uninit_parse_context(&octx);
if (ret < 0) {
@@ -3426,16 +3370,12 @@ const OptionDef options[] = {
"set profile", "profile" },
{ "filter", HAS_ARG | OPT_STRING | OPT_SPEC | OPT_OUTPUT, { .off = OFFSET(filters) },
"set stream filtergraph", "filter_graph" },
{ "filter_threads", HAS_ARG | OPT_INT, { &filter_nbthreads },
"number of non-complex filter threads" },
{ "filter_script", HAS_ARG | OPT_STRING | OPT_SPEC | OPT_OUTPUT, { .off = OFFSET(filter_scripts) },
"read stream filtergraph description from a file", "filename" },
{ "reinit_filter", HAS_ARG | OPT_INT | OPT_SPEC | OPT_INPUT, { .off = OFFSET(reinit_filters) },
"reinit filtergraph on input parameter changes", "" },
{ "filter_complex", HAS_ARG | OPT_EXPERT, { .func_arg = opt_filter_complex },
"create a complex filtergraph", "graph_description" },
{ "filter_complex_threads", HAS_ARG | OPT_INT, { &filter_complex_nbthreads },
"number of threads for -filter_complex" },
{ "lavfi", HAS_ARG | OPT_EXPERT, { .func_arg = opt_filter_complex },
"create a complex filtergraph", "graph_description" },
{ "filter_complex_script", HAS_ARG | OPT_EXPERT, { .func_arg = opt_filter_complex_script },
@@ -3510,8 +3450,6 @@ const OptionDef options[] = {
"dump video coding statistics to file" },
{ "vstats_file", OPT_VIDEO | HAS_ARG | OPT_EXPERT , { .func_arg = opt_vstats_file },
"dump video coding statistics to file", "file" },
{ "vstats_version", OPT_VIDEO | OPT_INT | HAS_ARG | OPT_EXPERT , { &vstats_version },
"Version of the vstats format to use."},
{ "vf", OPT_VIDEO | HAS_ARG | OPT_PERFILE | OPT_OUTPUT, { .func_arg = opt_video_filters },
"set video filters", "filter_graph" },
{ "intra_matrix", OPT_VIDEO | HAS_ARG | OPT_EXPERT | OPT_STRING | OPT_SPEC |
@@ -3625,9 +3563,6 @@ const OptionDef options[] = {
{ "sdp_file", HAS_ARG | OPT_EXPERT | OPT_OUTPUT, { .func_arg = opt_sdp_file },
"specify a file in which to print sdp information", "file" },
{ "time_base", HAS_ARG | OPT_STRING | OPT_EXPERT | OPT_SPEC | OPT_OUTPUT, { .off = OFFSET(time_bases) },
"set the desired time base hint for output stream (1:24, 1:48000 or 0.04166, 2.0833e-5)", "ratio" },
{ "bsf", HAS_ARG | OPT_STRING | OPT_SPEC | OPT_EXPERT | OPT_OUTPUT, { .off = OFFSET(bitstream_filters) },
"A comma-separated list of bitstream filters", "bitstream_filters" },
{ "absf", HAS_ARG | OPT_AUDIO | OPT_EXPERT| OPT_PERFILE | OPT_OUTPUT, { .func_arg = opt_old2new },
@@ -3658,10 +3593,5 @@ const OptionDef options[] = {
"set VAAPI hardware device (DRM path or X11 display name)", "device" },
#endif
#if CONFIG_QSV
{ "qsv_device", HAS_ARG | OPT_STRING | OPT_EXPERT, { &qsv_device },
"set QSV hardware device (DirectX adapter index, DRM path or X11 display name)", "device"},
#endif
{ NULL, },
};

View File

@@ -20,90 +20,248 @@
#include <stdlib.h>
#include "libavutil/dict.h"
#include "libavutil/hwcontext.h"
#include "libavutil/hwcontext_qsv.h"
#include "libavutil/mem.h"
#include "libavutil/opt.h"
#include "libavcodec/qsv.h"
#include "ffmpeg.h"
char *qsv_device = NULL;
typedef struct QSVContext {
OutputStream *ost;
mfxSession session;
mfxExtOpaqueSurfaceAlloc opaque_alloc;
AVBufferRef *opaque_surfaces_buf;
uint8_t *surface_used;
mfxFrameSurface1 **surface_ptrs;
int nb_surfaces;
mfxExtBuffer *ext_buffers[1];
} QSVContext;
static void buffer_release(void *opaque, uint8_t *data)
{
*(uint8_t*)opaque = 0;
}
static int qsv_get_buffer(AVCodecContext *s, AVFrame *frame, int flags)
{
InputStream *ist = s->opaque;
QSVContext *qsv = ist->hwaccel_ctx;
int i;
return av_hwframe_get_buffer(ist->hw_frames_ctx, frame, 0);
for (i = 0; i < qsv->nb_surfaces; i++) {
if (qsv->surface_used[i])
continue;
frame->buf[0] = av_buffer_create((uint8_t*)qsv->surface_ptrs[i], sizeof(*qsv->surface_ptrs[i]),
buffer_release, &qsv->surface_used[i], 0);
if (!frame->buf[0])
return AVERROR(ENOMEM);
frame->data[3] = (uint8_t*)qsv->surface_ptrs[i];
qsv->surface_used[i] = 1;
return 0;
}
return AVERROR(ENOMEM);
}
static int init_opaque_surf(QSVContext *qsv)
{
AVQSVContext *hwctx_enc = qsv->ost->enc_ctx->hwaccel_context;
mfxFrameSurface1 *surfaces;
int i;
qsv->nb_surfaces = hwctx_enc->nb_opaque_surfaces;
qsv->opaque_surfaces_buf = av_buffer_ref(hwctx_enc->opaque_surfaces);
qsv->surface_ptrs = av_mallocz_array(qsv->nb_surfaces, sizeof(*qsv->surface_ptrs));
qsv->surface_used = av_mallocz_array(qsv->nb_surfaces, sizeof(*qsv->surface_used));
if (!qsv->opaque_surfaces_buf || !qsv->surface_ptrs || !qsv->surface_used)
return AVERROR(ENOMEM);
surfaces = (mfxFrameSurface1*)qsv->opaque_surfaces_buf->data;
for (i = 0; i < qsv->nb_surfaces; i++)
qsv->surface_ptrs[i] = surfaces + i;
qsv->opaque_alloc.Out.Surfaces = qsv->surface_ptrs;
qsv->opaque_alloc.Out.NumSurface = qsv->nb_surfaces;
qsv->opaque_alloc.Out.Type = hwctx_enc->opaque_alloc_type;
qsv->opaque_alloc.Header.BufferId = MFX_EXTBUFF_OPAQUE_SURFACE_ALLOCATION;
qsv->opaque_alloc.Header.BufferSz = sizeof(qsv->opaque_alloc);
qsv->ext_buffers[0] = (mfxExtBuffer*)&qsv->opaque_alloc;
return 0;
}
static void qsv_uninit(AVCodecContext *s)
{
InputStream *ist = s->opaque;
av_buffer_unref(&ist->hw_frames_ctx);
}
QSVContext *qsv = ist->hwaccel_ctx;
static int qsv_device_init(InputStream *ist)
{
int err;
AVDictionary *dict = NULL;
av_freep(&qsv->ost->enc_ctx->hwaccel_context);
av_freep(&s->hwaccel_context);
if (qsv_device) {
err = av_dict_set(&dict, "child_device", qsv_device, 0);
if (err < 0)
return err;
}
av_buffer_unref(&qsv->opaque_surfaces_buf);
av_freep(&qsv->surface_used);
av_freep(&qsv->surface_ptrs);
err = av_hwdevice_ctx_create(&hw_device_ctx, AV_HWDEVICE_TYPE_QSV,
ist->hwaccel_device, dict, 0);
if (err < 0) {
av_log(NULL, AV_LOG_ERROR, "Error creating a QSV device\n");
goto err_out;
}
err_out:
if (dict)
av_dict_free(&dict);
return err;
av_freep(&qsv);
}
int qsv_init(AVCodecContext *s)
{
InputStream *ist = s->opaque;
AVHWFramesContext *frames_ctx;
AVQSVFramesContext *frames_hwctx;
QSVContext *qsv = ist->hwaccel_ctx;
AVQSVContext *hwctx_dec;
int ret;
if (!hw_device_ctx) {
ret = qsv_device_init(ist);
if (ret < 0)
return ret;
if (!qsv) {
av_log(NULL, AV_LOG_ERROR, "QSV transcoding is not initialized. "
"-hwaccel qsv should only be used for one-to-one QSV transcoding "
"with no filters.\n");
return AVERROR_BUG;
}
av_buffer_unref(&ist->hw_frames_ctx);
ist->hw_frames_ctx = av_hwframe_ctx_alloc(hw_device_ctx);
if (!ist->hw_frames_ctx)
ret = init_opaque_surf(qsv);
if (ret < 0)
return ret;
hwctx_dec = av_qsv_alloc_context();
if (!hwctx_dec)
return AVERROR(ENOMEM);
frames_ctx = (AVHWFramesContext*)ist->hw_frames_ctx->data;
frames_hwctx = frames_ctx->hwctx;
hwctx_dec->session = qsv->session;
hwctx_dec->iopattern = MFX_IOPATTERN_OUT_OPAQUE_MEMORY;
hwctx_dec->ext_buffers = qsv->ext_buffers;
hwctx_dec->nb_ext_buffers = FF_ARRAY_ELEMS(qsv->ext_buffers);
frames_ctx->width = FFALIGN(s->coded_width, 32);
frames_ctx->height = FFALIGN(s->coded_height, 32);
frames_ctx->format = AV_PIX_FMT_QSV;
frames_ctx->sw_format = s->sw_pix_fmt;
frames_ctx->initial_pool_size = 64;
frames_hwctx->frame_type = MFX_MEMTYPE_VIDEO_MEMORY_DECODER_TARGET;
ret = av_hwframe_ctx_init(ist->hw_frames_ctx);
if (ret < 0) {
av_log(NULL, AV_LOG_ERROR, "Error initializing a QSV frame pool\n");
return ret;
}
av_freep(&s->hwaccel_context);
s->hwaccel_context = hwctx_dec;
ist->hwaccel_get_buffer = qsv_get_buffer;
ist->hwaccel_uninit = qsv_uninit;
return 0;
}
static mfxIMPL choose_implementation(const InputStream *ist)
{
static const struct {
const char *name;
mfxIMPL impl;
} impl_map[] = {
{ "auto", MFX_IMPL_AUTO },
{ "sw", MFX_IMPL_SOFTWARE },
{ "hw", MFX_IMPL_HARDWARE },
{ "auto_any", MFX_IMPL_AUTO_ANY },
{ "hw_any", MFX_IMPL_HARDWARE_ANY },
{ "hw2", MFX_IMPL_HARDWARE2 },
{ "hw3", MFX_IMPL_HARDWARE3 },
{ "hw4", MFX_IMPL_HARDWARE4 },
};
mfxIMPL impl = MFX_IMPL_AUTO_ANY;
int i;
if (ist->hwaccel_device) {
for (i = 0; i < FF_ARRAY_ELEMS(impl_map); i++)
if (!strcmp(ist->hwaccel_device, impl_map[i].name)) {
impl = impl_map[i].impl;
break;
}
if (i == FF_ARRAY_ELEMS(impl_map))
impl = strtol(ist->hwaccel_device, NULL, 0);
}
return impl;
}
int qsv_transcode_init(OutputStream *ost)
{
InputStream *ist;
const enum AVPixelFormat *pix_fmt;
AVDictionaryEntry *e;
const AVOption *opt;
int flags = 0;
int err, i;
QSVContext *qsv = NULL;
AVQSVContext *hwctx = NULL;
mfxIMPL impl;
mfxVersion ver = { { 3, 1 } };
/* check if the encoder supports QSV */
if (!ost->enc->pix_fmts)
return 0;
for (pix_fmt = ost->enc->pix_fmts; *pix_fmt != AV_PIX_FMT_NONE; pix_fmt++)
if (*pix_fmt == AV_PIX_FMT_QSV)
break;
if (*pix_fmt == AV_PIX_FMT_NONE)
return 0;
if (strcmp(ost->avfilter, "null") || ost->source_index < 0)
return 0;
/* check if the decoder supports QSV and the output only goes to this stream */
ist = input_streams[ost->source_index];
if (ist->hwaccel_id != HWACCEL_QSV || !ist->dec || !ist->dec->pix_fmts)
return 0;
for (pix_fmt = ist->dec->pix_fmts; *pix_fmt != AV_PIX_FMT_NONE; pix_fmt++)
if (*pix_fmt == AV_PIX_FMT_QSV)
break;
if (*pix_fmt == AV_PIX_FMT_NONE)
return 0;
for (i = 0; i < nb_output_streams; i++)
if (output_streams[i] != ost &&
output_streams[i]->source_index == ost->source_index)
return 0;
av_log(NULL, AV_LOG_VERBOSE, "Setting up QSV transcoding\n");
qsv = av_mallocz(sizeof(*qsv));
hwctx = av_qsv_alloc_context();
if (!qsv || !hwctx)
goto fail;
impl = choose_implementation(ist);
err = MFXInit(impl, &ver, &qsv->session);
if (err != MFX_ERR_NONE) {
av_log(NULL, AV_LOG_ERROR, "Error initializing an MFX session: %d\n", err);
goto fail;
}
e = av_dict_get(ost->encoder_opts, "flags", NULL, 0);
opt = av_opt_find(ost->enc_ctx, "flags", NULL, 0, 0);
if (e && opt)
av_opt_eval_flags(ost->enc_ctx, opt, e->value, &flags);
qsv->ost = ost;
hwctx->session = qsv->session;
hwctx->iopattern = MFX_IOPATTERN_IN_OPAQUE_MEMORY;
hwctx->opaque_alloc = 1;
hwctx->nb_opaque_surfaces = 16;
ost->hwaccel_ctx = qsv;
ost->enc_ctx->hwaccel_context = hwctx;
ost->enc_ctx->pix_fmt = AV_PIX_FMT_QSV;
ist->hwaccel_ctx = qsv;
ist->dec_ctx->pix_fmt = AV_PIX_FMT_QSV;
ist->resample_pix_fmt = AV_PIX_FMT_QSV;
return 0;
fail:
av_freep(&hwctx);
av_freep(&qsv);
return AVERROR_UNKNOWN;
}

View File

@@ -18,10 +18,28 @@
#include "config.h"
#include <fcntl.h>
#include <unistd.h>
#include <va/va.h>
#if HAVE_VAAPI_X11
# include <va/va_x11.h>
#endif
#if HAVE_VAAPI_DRM
# include <va/va_drm.h>
#endif
#include "libavutil/avassert.h"
#include "libavutil/avconfig.h"
#include "libavutil/buffer.h"
#include "libavutil/frame.h"
#include "libavutil/hwcontext.h"
#include "libavutil/log.h"
#include "libavutil/hwcontext_vaapi.h"
#include "libavutil/imgutils.h"
#include "libavutil/opt.h"
#include "libavutil/pixfmt.h"
#include "libavcodec/vaapi.h"
#include "ffmpeg.h"
@@ -42,11 +60,23 @@ typedef struct VAAPIDecoderContext {
AVBufferRef *frames_ref;
AVHWFramesContext *frames;
VAProfile va_profile;
VAEntrypoint va_entrypoint;
VAConfigID va_config;
VAContextID va_context;
enum AVPixelFormat decode_format;
int decode_width;
int decode_height;
int decode_surfaces;
// The output need not have the same format, width and height as the
// decoded frames - the copy for non-direct-mapped access is actually
// a whole vpp instance which can do arbitrary scaling and format
// conversion.
enum AVPixelFormat output_format;
struct vaapi_context decoder_vaapi_context;
} VAAPIDecoderContext;
@@ -114,12 +144,257 @@ fail:
return err;
}
static const struct {
enum AVCodecID codec_id;
int codec_profile;
VAProfile va_profile;
} vaapi_profile_map[] = {
#define MAP(c, p, v) { AV_CODEC_ID_ ## c, FF_PROFILE_ ## p, VAProfile ## v }
MAP(MPEG2VIDEO, MPEG2_SIMPLE, MPEG2Simple ),
MAP(MPEG2VIDEO, MPEG2_MAIN, MPEG2Main ),
MAP(H263, UNKNOWN, H263Baseline),
MAP(MPEG4, MPEG4_SIMPLE, MPEG4Simple ),
MAP(MPEG4, MPEG4_ADVANCED_SIMPLE,
MPEG4AdvancedSimple),
MAP(MPEG4, MPEG4_MAIN, MPEG4Main ),
MAP(H264, H264_CONSTRAINED_BASELINE,
H264ConstrainedBaseline),
MAP(H264, H264_BASELINE, H264Baseline),
MAP(H264, H264_MAIN, H264Main ),
MAP(H264, H264_HIGH, H264High ),
#if VA_CHECK_VERSION(0, 37, 0)
MAP(HEVC, HEVC_MAIN, HEVCMain ),
#endif
MAP(WMV3, VC1_SIMPLE, VC1Simple ),
MAP(WMV3, VC1_MAIN, VC1Main ),
MAP(WMV3, VC1_COMPLEX, VC1Advanced ),
MAP(WMV3, VC1_ADVANCED, VC1Advanced ),
MAP(VC1, VC1_SIMPLE, VC1Simple ),
MAP(VC1, VC1_MAIN, VC1Main ),
MAP(VC1, VC1_COMPLEX, VC1Advanced ),
MAP(VC1, VC1_ADVANCED, VC1Advanced ),
#if VA_CHECK_VERSION(0, 35, 0)
MAP(VP8, UNKNOWN, VP8Version0_3 ),
#endif
#if VA_CHECK_VERSION(0, 37, 1)
MAP(VP9, VP9_0, VP9Profile0 ),
#endif
#undef MAP
};
static int vaapi_build_decoder_config(VAAPIDecoderContext *ctx,
AVCodecContext *avctx,
int fallback_allowed)
{
AVVAAPIDeviceContext *hwctx = ctx->device->hwctx;
AVVAAPIHWConfig *hwconfig = NULL;
AVHWFramesConstraints *constraints = NULL;
VAStatus vas;
int err, i, j;
int loglevel = fallback_allowed ? AV_LOG_VERBOSE : AV_LOG_ERROR;
const AVCodecDescriptor *codec_desc;
const AVPixFmtDescriptor *pix_desc;
enum AVPixelFormat pix_fmt;
VAProfile profile, *profile_list = NULL;
int profile_count, exact_match, alt_profile;
codec_desc = avcodec_descriptor_get(avctx->codec_id);
if (!codec_desc) {
err = AVERROR(EINVAL);
goto fail;
}
profile_count = vaMaxNumProfiles(hwctx->display);
profile_list = av_malloc(profile_count * sizeof(VAProfile));
if (!profile_list) {
err = AVERROR(ENOMEM);
goto fail;
}
vas = vaQueryConfigProfiles(hwctx->display,
profile_list, &profile_count);
if (vas != VA_STATUS_SUCCESS) {
av_log(ctx, loglevel, "Failed to query profiles: %d (%s).\n",
vas, vaErrorStr(vas));
err = AVERROR(EIO);
goto fail;
}
profile = VAProfileNone;
exact_match = 0;
for (i = 0; i < FF_ARRAY_ELEMS(vaapi_profile_map); i++) {
int profile_match = 0;
if (avctx->codec_id != vaapi_profile_map[i].codec_id)
continue;
if (avctx->profile == vaapi_profile_map[i].codec_profile)
profile_match = 1;
profile = vaapi_profile_map[i].va_profile;
for (j = 0; j < profile_count; j++) {
if (profile == profile_list[j]) {
exact_match = profile_match;
break;
}
}
if (j < profile_count) {
if (exact_match)
break;
alt_profile = vaapi_profile_map[i].codec_profile;
}
}
av_freep(&profile_list);
if (profile == VAProfileNone) {
av_log(ctx, loglevel, "No VAAPI support for codec %s.\n",
codec_desc->name);
err = AVERROR(ENOSYS);
goto fail;
}
if (!exact_match) {
if (fallback_allowed || !hwaccel_lax_profile_check) {
av_log(ctx, loglevel, "No VAAPI support for codec %s "
"profile %d.\n", codec_desc->name, avctx->profile);
if (!fallback_allowed) {
av_log(ctx, AV_LOG_WARNING, "If you want attempt decoding "
"anyway with a possibly-incompatible profile, add "
"the option -hwaccel_lax_profile_check.\n");
}
err = AVERROR(EINVAL);
goto fail;
} else {
av_log(ctx, AV_LOG_WARNING, "No VAAPI support for codec %s "
"profile %d: trying instead with profile %d.\n",
codec_desc->name, avctx->profile, alt_profile);
av_log(ctx, AV_LOG_WARNING, "This may fail or give "
"incorrect results, depending on your hardware.\n");
}
}
ctx->va_profile = profile;
ctx->va_entrypoint = VAEntrypointVLD;
vas = vaCreateConfig(hwctx->display, ctx->va_profile,
ctx->va_entrypoint, 0, 0, &ctx->va_config);
if (vas != VA_STATUS_SUCCESS) {
av_log(ctx, AV_LOG_ERROR, "Failed to create decode pipeline "
"configuration: %d (%s).\n", vas, vaErrorStr(vas));
err = AVERROR(EIO);
goto fail;
}
hwconfig = av_hwdevice_hwconfig_alloc(ctx->device_ref);
if (!hwconfig) {
err = AVERROR(ENOMEM);
goto fail;
}
hwconfig->config_id = ctx->va_config;
constraints = av_hwdevice_get_hwframe_constraints(ctx->device_ref,
hwconfig);
if (!constraints)
goto fail;
// Decide on the decoder target format.
// If the user specified something with -hwaccel_output_format then
// try to use that to minimise conversions later.
ctx->decode_format = AV_PIX_FMT_NONE;
if (ctx->output_format != AV_PIX_FMT_NONE &&
ctx->output_format != AV_PIX_FMT_VAAPI) {
for (i = 0; constraints->valid_sw_formats[i] != AV_PIX_FMT_NONE; i++) {
if (constraints->valid_sw_formats[i] == ctx->output_format) {
ctx->decode_format = ctx->output_format;
av_log(ctx, AV_LOG_DEBUG, "Using decode format %s (output "
"format).\n", av_get_pix_fmt_name(ctx->decode_format));
break;
}
}
}
// Otherwise, we would like to try to choose something which matches the
// decoder output, but there isn't enough information available here to
// do so. Assume for now that we are always dealing with YUV 4:2:0, so
// pick a format which does that.
if (ctx->decode_format == AV_PIX_FMT_NONE) {
for (i = 0; constraints->valid_sw_formats[i] != AV_PIX_FMT_NONE; i++) {
pix_fmt = constraints->valid_sw_formats[i];
pix_desc = av_pix_fmt_desc_get(pix_fmt);
if (pix_desc->nb_components == 3 &&
pix_desc->log2_chroma_w == 1 &&
pix_desc->log2_chroma_h == 1) {
ctx->decode_format = pix_fmt;
av_log(ctx, AV_LOG_DEBUG, "Using decode format %s (format "
"matched).\n", av_get_pix_fmt_name(ctx->decode_format));
break;
}
}
}
// Otherwise pick the first in the list and hope for the best.
if (ctx->decode_format == AV_PIX_FMT_NONE) {
ctx->decode_format = constraints->valid_sw_formats[0];
av_log(ctx, AV_LOG_DEBUG, "Using decode format %s (first in list).\n",
av_get_pix_fmt_name(ctx->decode_format));
if (i > 1) {
// There was a choice, and we picked randomly. Warn the user
// that they might want to choose intelligently instead.
av_log(ctx, AV_LOG_WARNING, "Using randomly chosen decode "
"format %s.\n", av_get_pix_fmt_name(ctx->decode_format));
}
}
// Ensure the picture size is supported by the hardware.
ctx->decode_width = avctx->coded_width;
ctx->decode_height = avctx->coded_height;
if (ctx->decode_width < constraints->min_width ||
ctx->decode_height < constraints->min_height ||
ctx->decode_width > constraints->max_width ||
ctx->decode_height >constraints->max_height) {
av_log(ctx, AV_LOG_ERROR, "VAAPI hardware does not support image "
"size %dx%d (constraints: width %d-%d height %d-%d).\n",
ctx->decode_width, ctx->decode_height,
constraints->min_width, constraints->max_width,
constraints->min_height, constraints->max_height);
err = AVERROR(EINVAL);
goto fail;
}
av_hwframe_constraints_free(&constraints);
av_freep(&hwconfig);
// Decide how many reference frames we need. This might be doable more
// nicely based on the codec and input stream?
ctx->decode_surfaces = DEFAULT_SURFACES;
// For frame-threaded decoding, one additional surfaces is needed for
// each thread.
if (avctx->active_thread_type & FF_THREAD_FRAME)
ctx->decode_surfaces += avctx->thread_count;
return 0;
fail:
av_hwframe_constraints_free(&constraints);
av_freep(&hwconfig);
vaDestroyConfig(hwctx->display, ctx->va_config);
av_freep(&profile_list);
return err;
}
static void vaapi_decode_uninit(AVCodecContext *avctx)
{
InputStream *ist = avctx->opaque;
VAAPIDecoderContext *ctx = ist->hwaccel_ctx;
if (ctx) {
AVVAAPIDeviceContext *hwctx = ctx->device->hwctx;
if (ctx->va_context != VA_INVALID_ID) {
vaDestroyContext(hwctx->display, ctx->va_context);
ctx->va_context = VA_INVALID_ID;
}
if (ctx->va_config != VA_INVALID_ID) {
vaDestroyConfig(hwctx->display, ctx->va_config);
ctx->va_config = VA_INVALID_ID;
}
av_buffer_unref(&ctx->frames_ref);
av_buffer_unref(&ctx->device_ref);
av_free(ctx);
@@ -127,16 +402,19 @@ static void vaapi_decode_uninit(AVCodecContext *avctx)
av_buffer_unref(&ist->hw_frames_ctx);
ist->hwaccel_ctx = NULL;
ist->hwaccel_uninit = NULL;
ist->hwaccel_get_buffer = NULL;
ist->hwaccel_retrieve_data = NULL;
ist->hwaccel_ctx = 0;
ist->hwaccel_uninit = 0;
ist->hwaccel_get_buffer = 0;
ist->hwaccel_retrieve_data = 0;
}
int vaapi_decode_init(AVCodecContext *avctx)
{
InputStream *ist = avctx->opaque;
AVVAAPIDeviceContext *hwctx;
AVVAAPIFramesContext *avfc;
VAAPIDecoderContext *ctx;
VAStatus vas;
int err;
int loglevel = (ist->hwaccel_id != HWACCEL_VAAPI ? AV_LOG_VERBOSE
: AV_LOG_ERROR);
@@ -157,12 +435,24 @@ int vaapi_decode_init(AVCodecContext *avctx)
if (!ctx)
return AVERROR(ENOMEM);
ctx->class = &vaapi_class;
ist->hwaccel_ctx = ctx;
ctx->device_ref = av_buffer_ref(hw_device_ctx);
ctx->device = (AVHWDeviceContext*)ctx->device_ref->data;
ctx->va_config = VA_INVALID_ID;
ctx->va_context = VA_INVALID_ID;
hwctx = ctx->device->hwctx;
ctx->output_format = ist->hwaccel_output_format;
err = vaapi_build_decoder_config(ctx, avctx,
ist->hwaccel_id != HWACCEL_VAAPI);
if (err < 0) {
av_log(ctx, loglevel, "No supported configuration for this codec.");
goto fail;
}
avctx->pix_fmt = ctx->output_format;
ctx->frames_ref = av_hwframe_ctx_alloc(ctx->device_ref);
@@ -174,21 +464,11 @@ int vaapi_decode_init(AVCodecContext *avctx)
ctx->frames = (AVHWFramesContext*)ctx->frames_ref->data;
ctx->frames->format = AV_PIX_FMT_VAAPI;
ctx->frames->width = avctx->coded_width;
ctx->frames->height = avctx->coded_height;
// It would be nice if we could query the available formats here,
// but unfortunately we don't have a VAConfigID to do it with.
// For now, just assume an NV12 format (or P010 if 10-bit).
ctx->frames->sw_format = (avctx->sw_pix_fmt == AV_PIX_FMT_YUV420P10 ?
AV_PIX_FMT_P010 : AV_PIX_FMT_NV12);
// For frame-threaded decoding, at least one additional surface
// is needed for each thread.
ctx->frames->initial_pool_size = DEFAULT_SURFACES;
if (avctx->active_thread_type & FF_THREAD_FRAME)
ctx->frames->initial_pool_size += avctx->thread_count;
ctx->frames->format = AV_PIX_FMT_VAAPI;
ctx->frames->sw_format = ctx->decode_format;
ctx->frames->width = ctx->decode_width;
ctx->frames->height = ctx->decode_height;
ctx->frames->initial_pool_size = ctx->decode_surfaces;
err = av_hwframe_ctx_init(ctx->frames_ref);
if (err < 0) {
@@ -197,15 +477,42 @@ int vaapi_decode_init(AVCodecContext *avctx)
goto fail;
}
avfc = ctx->frames->hwctx;
vas = vaCreateContext(hwctx->display, ctx->va_config,
ctx->decode_width, ctx->decode_height,
VA_PROGRESSIVE,
avfc->surface_ids, avfc->nb_surfaces,
&ctx->va_context);
if (vas != VA_STATUS_SUCCESS) {
av_log(ctx, AV_LOG_ERROR, "Failed to create decode pipeline "
"context: %d (%s).\n", vas, vaErrorStr(vas));
err = AVERROR(EINVAL);
goto fail;
}
av_log(ctx, AV_LOG_DEBUG, "VAAPI decoder (re)init complete.\n");
// We would like to set this on the AVCodecContext for use by whoever gets
// the frames from the decoder, but unfortunately the AVCodecContext we
// have here need not be the "real" one (H.264 makes many copies for
// threading purposes). To avoid the problem, we instead store it in the
// InputStream and propagate it from there.
ist->hw_frames_ctx = av_buffer_ref(ctx->frames_ref);
if (!ist->hw_frames_ctx) {
err = AVERROR(ENOMEM);
goto fail;
}
ist->hwaccel_uninit = &vaapi_decode_uninit;
ist->hwaccel_get_buffer = &vaapi_get_buffer;
ist->hwaccel_retrieve_data = &vaapi_retrieve_data;
ist->hwaccel_ctx = ctx;
ist->hwaccel_uninit = vaapi_decode_uninit;
ist->hwaccel_get_buffer = vaapi_get_buffer;
ist->hwaccel_retrieve_data = vaapi_retrieve_data;
ctx->decoder_vaapi_context.display = hwctx->display;
ctx->decoder_vaapi_context.config_id = ctx->va_config;
ctx->decoder_vaapi_context.context_id = ctx->va_context;
avctx->hwaccel_context = &ctx->decoder_vaapi_context;
return 0;
@@ -220,8 +527,6 @@ av_cold int vaapi_device_init(const char *device)
{
int err;
av_buffer_unref(&hw_device_ctx);
err = av_hwdevice_ctx_create(&hw_device_ctx, AV_HWDEVICE_TYPE_VAAPI,
device, NULL, 0);
if (err < 0) {

View File

@@ -48,6 +48,7 @@ static int videotoolbox_retrieve_data(AVCodecContext *s, AVFrame *frame)
uint8_t *data[4] = { 0 };
int linesize[4] = { 0 };
int planes, ret, i;
char codec_str[32];
av_frame_unref(vt->tmp_frame);
@@ -59,9 +60,9 @@ static int videotoolbox_retrieve_data(AVCodecContext *s, AVFrame *frame)
case kCVPixelFormatType_420YpCbCr8BiPlanarVideoRange: vt->tmp_frame->format = AV_PIX_FMT_NV12; break;
#endif
default:
av_get_codec_tag_string(codec_str, sizeof(codec_str), s->codec_tag);
av_log(NULL, AV_LOG_ERROR,
"%s: Unsupported pixel format: %s\n",
av_fourcc2str(s->codec_tag), videotoolbox_pixfmt);
"%s: Unsupported pixel format: %s\n", codec_str, videotoolbox_pixfmt);
return AVERROR(ENOSYS);
}

294
ffplay.c
View File

@@ -73,8 +73,8 @@ const int program_birth_year = 2003;
/* Calculate actual buffer size keeping in mind not cause too frequent audio callbacks */
#define SDL_AUDIO_MAX_CALLBACKS_PER_SEC 30
/* Step size for volume control in dB */
#define SDL_VOLUME_STEP (0.75)
/* Step size for volume control */
#define SDL_VOLUME_STEP (SDL_MIX_MAXVOLUME / 50)
/* no AV sync correction is done if below the minimum AV sync threshold */
#define AV_SYNC_THRESHOLD_MIN 0.04
@@ -158,12 +158,13 @@ typedef struct Frame {
double pts; /* presentation timestamp for the frame */
double duration; /* estimated duration of the frame */
int64_t pos; /* byte position of the frame in the input file */
SDL_Texture *bmp;
int allocated;
int width;
int height;
int format;
AVRational sar;
int uploaded;
int flip_v;
} Frame;
typedef struct FrameQueue {
@@ -272,7 +273,6 @@ typedef struct VideoState {
double last_vis_time;
SDL_Texture *vis_texture;
SDL_Texture *sub_texture;
SDL_Texture *vid_texture;
int subtitle_stream;
AVStream *subtitle_st;
@@ -321,8 +321,6 @@ static int subtitle_disable;
static const char* wanted_stream_spec[AVMEDIA_TYPE_NB] = {0};
static int seek_by_bytes = -1;
static int display_disable;
static int borderless;
static int startup_volume = 100;
static int show_status = 1;
static int av_sync_type = AV_SYNC_AUDIO_MASTER;
static int64_t start_time = AV_NOPTS_VALUE;
@@ -357,6 +355,7 @@ static int64_t audio_callback_time;
static AVPacket flush_pkt;
#define FF_ALLOC_EVENT (SDL_USEREVENT)
#define FF_QUIT_EVENT (SDL_USEREVENT + 2)
static SDL_Window *window;
@@ -391,6 +390,8 @@ int64_t get_valid_channel_layout(int64_t channel_layout, int channels)
return 0;
}
static void free_picture(Frame *vp);
static int packet_queue_put_private(PacketQueue *q, AVPacket *pkt)
{
MyAVPacketList *pkt1;
@@ -674,6 +675,7 @@ static void frame_queue_destory(FrameQueue *f)
Frame *vp = &f->queue[i];
frame_queue_unref_item(vp);
av_frame_free(&vp->frame);
free_picture(vp);
}
SDL_DestroyMutex(f->mutex);
SDL_DestroyCond(f->cond);
@@ -794,6 +796,14 @@ static inline void fill_rectangle(int x, int y, int w, int h)
SDL_RenderFillRect(renderer, &rect);
}
static void free_picture(Frame *vp)
{
if (vp->bmp) {
SDL_DestroyTexture(vp->bmp);
vp->bmp = NULL;
}
}
static int realloc_texture(SDL_Texture **texture, Uint32 new_format, int new_width, int new_height, SDL_BlendMode blendmode, int init_texture)
{
Uint32 format;
@@ -851,20 +861,12 @@ static int upload_texture(SDL_Texture *tex, AVFrame *frame, struct SwsContext **
int ret = 0;
switch (frame->format) {
case AV_PIX_FMT_YUV420P:
if (frame->linesize[0] < 0 || frame->linesize[1] < 0 || frame->linesize[2] < 0) {
av_log(NULL, AV_LOG_ERROR, "Negative linesize is not supported for YUV.\n");
return -1;
}
ret = SDL_UpdateYUVTexture(tex, NULL, frame->data[0], frame->linesize[0],
frame->data[1], frame->linesize[1],
frame->data[2], frame->linesize[2]);
break;
case AV_PIX_FMT_BGRA:
if (frame->linesize[0] < 0) {
ret = SDL_UpdateTexture(tex, NULL, frame->data[0] + frame->linesize[0] * (frame->height - 1), -frame->linesize[0]);
} else {
ret = SDL_UpdateTexture(tex, NULL, frame->data[0], frame->linesize[0]);
}
ret = SDL_UpdateTexture(tex, NULL, frame->data[0], frame->linesize[0]);
break;
default:
/* This should only happen if we are not using avfilter... */
@@ -895,80 +897,78 @@ static void video_image_display(VideoState *is)
SDL_Rect rect;
vp = frame_queue_peek_last(&is->pictq);
if (is->subtitle_st) {
if (frame_queue_nb_remaining(&is->subpq) > 0) {
sp = frame_queue_peek(&is->subpq);
if (vp->bmp) {
if (is->subtitle_st) {
if (frame_queue_nb_remaining(&is->subpq) > 0) {
sp = frame_queue_peek(&is->subpq);
if (vp->pts >= sp->pts + ((float) sp->sub.start_display_time / 1000)) {
if (!sp->uploaded) {
uint8_t* pixels[4];
int pitch[4];
int i;
if (!sp->width || !sp->height) {
sp->width = vp->width;
sp->height = vp->height;
}
if (realloc_texture(&is->sub_texture, SDL_PIXELFORMAT_ARGB8888, sp->width, sp->height, SDL_BLENDMODE_BLEND, 1) < 0)
return;
for (i = 0; i < sp->sub.num_rects; i++) {
AVSubtitleRect *sub_rect = sp->sub.rects[i];
sub_rect->x = av_clip(sub_rect->x, 0, sp->width );
sub_rect->y = av_clip(sub_rect->y, 0, sp->height);
sub_rect->w = av_clip(sub_rect->w, 0, sp->width - sub_rect->x);
sub_rect->h = av_clip(sub_rect->h, 0, sp->height - sub_rect->y);
is->sub_convert_ctx = sws_getCachedContext(is->sub_convert_ctx,
sub_rect->w, sub_rect->h, AV_PIX_FMT_PAL8,
sub_rect->w, sub_rect->h, AV_PIX_FMT_BGRA,
0, NULL, NULL, NULL);
if (!is->sub_convert_ctx) {
av_log(NULL, AV_LOG_FATAL, "Cannot initialize the conversion context\n");
if (vp->pts >= sp->pts + ((float) sp->sub.start_display_time / 1000)) {
if (!sp->uploaded) {
uint8_t* pixels[4];
int pitch[4];
int i;
if (!sp->width || !sp->height) {
sp->width = vp->width;
sp->height = vp->height;
}
if (realloc_texture(&is->sub_texture, SDL_PIXELFORMAT_ARGB8888, sp->width, sp->height, SDL_BLENDMODE_BLEND, 1) < 0)
return;
for (i = 0; i < sp->sub.num_rects; i++) {
AVSubtitleRect *sub_rect = sp->sub.rects[i];
sub_rect->x = av_clip(sub_rect->x, 0, sp->width );
sub_rect->y = av_clip(sub_rect->y, 0, sp->height);
sub_rect->w = av_clip(sub_rect->w, 0, sp->width - sub_rect->x);
sub_rect->h = av_clip(sub_rect->h, 0, sp->height - sub_rect->y);
is->sub_convert_ctx = sws_getCachedContext(is->sub_convert_ctx,
sub_rect->w, sub_rect->h, AV_PIX_FMT_PAL8,
sub_rect->w, sub_rect->h, AV_PIX_FMT_BGRA,
0, NULL, NULL, NULL);
if (!is->sub_convert_ctx) {
av_log(NULL, AV_LOG_FATAL, "Cannot initialize the conversion context\n");
return;
}
if (!SDL_LockTexture(is->sub_texture, (SDL_Rect *)sub_rect, (void **)pixels, pitch)) {
sws_scale(is->sub_convert_ctx, (const uint8_t * const *)sub_rect->data, sub_rect->linesize,
0, sub_rect->h, pixels, pitch);
SDL_UnlockTexture(is->sub_texture);
}
}
if (!SDL_LockTexture(is->sub_texture, (SDL_Rect *)sub_rect, (void **)pixels, pitch)) {
sws_scale(is->sub_convert_ctx, (const uint8_t * const *)sub_rect->data, sub_rect->linesize,
0, sub_rect->h, pixels, pitch);
SDL_UnlockTexture(is->sub_texture);
}
sp->uploaded = 1;
}
sp->uploaded = 1;
}
} else
sp = NULL;
} else
sp = NULL;
}
}
}
calculate_display_rect(&rect, is->xleft, is->ytop, is->width, is->height, vp->width, vp->height, vp->sar);
calculate_display_rect(&rect, is->xleft, is->ytop, is->width, is->height, vp->width, vp->height, vp->sar);
if (!vp->uploaded) {
int sdl_pix_fmt = vp->frame->format == AV_PIX_FMT_YUV420P ? SDL_PIXELFORMAT_YV12 : SDL_PIXELFORMAT_ARGB8888;
if (realloc_texture(&is->vid_texture, sdl_pix_fmt, vp->frame->width, vp->frame->height, SDL_BLENDMODE_NONE, 0) < 0)
return;
if (upload_texture(is->vid_texture, vp->frame, &is->img_convert_ctx) < 0)
return;
vp->uploaded = 1;
vp->flip_v = vp->frame->linesize[0] < 0;
}
if (!vp->uploaded) {
if (upload_texture(vp->bmp, vp->frame, &is->img_convert_ctx) < 0)
return;
vp->uploaded = 1;
}
SDL_RenderCopyEx(renderer, is->vid_texture, NULL, &rect, 0, NULL, vp->flip_v ? SDL_FLIP_VERTICAL : 0);
if (sp) {
SDL_RenderCopy(renderer, vp->bmp, NULL, &rect);
if (sp) {
#if USE_ONEPASS_SUBTITLE_RENDER
SDL_RenderCopy(renderer, is->sub_texture, NULL, &rect);
SDL_RenderCopy(renderer, is->sub_texture, NULL, &rect);
#else
int i;
double xratio = (double)rect.w / (double)sp->width;
double yratio = (double)rect.h / (double)sp->height;
for (i = 0; i < sp->sub.num_rects; i++) {
SDL_Rect *sub_rect = (SDL_Rect*)sp->sub.rects[i];
SDL_Rect target = {.x = rect.x + sub_rect->x * xratio,
.y = rect.y + sub_rect->y * yratio,
.w = sub_rect->w * xratio,
.h = sub_rect->h * yratio};
SDL_RenderCopy(renderer, is->sub_texture, sub_rect, &target);
}
int i;
double xratio = (double)rect.w / (double)sp->width;
double yratio = (double)rect.h / (double)sp->height;
for (i = 0; i < sp->sub.num_rects; i++) {
SDL_Rect *sub_rect = (SDL_Rect*)sp->sub.rects[i];
SDL_Rect target = {.x = rect.x + sub_rect->x * xratio,
.y = rect.y + sub_rect->y * yratio,
.w = sub_rect->w * xratio,
.h = sub_rect->h * yratio};
SDL_RenderCopy(renderer, is->sub_texture, sub_rect, &target);
}
#endif
}
}
}
@@ -1206,8 +1206,6 @@ static void stream_close(VideoState *is)
av_free(is->filename);
if (is->vis_texture)
SDL_DestroyTexture(is->vis_texture);
if (is->vid_texture)
SDL_DestroyTexture(is->vid_texture);
if (is->sub_texture)
SDL_DestroyTexture(is->sub_texture);
av_free(is);
@@ -1248,10 +1246,13 @@ static void set_default_window_size(int width, int height, AVRational sar)
default_height = rect.h;
}
static int video_open(VideoState *is)
static int video_open(VideoState *is, Frame *vp)
{
int w,h;
if (vp && vp->width)
set_default_window_size(vp->width, vp->height, vp->sar);
if (screen_width) {
w = screen_width;
h = screen_height;
@@ -1261,24 +1262,16 @@ static int video_open(VideoState *is)
}
if (!window) {
int flags = SDL_WINDOW_SHOWN;
int flags = SDL_WINDOW_SHOWN | SDL_WINDOW_RESIZABLE;
if (!window_title)
window_title = input_filename;
if (is_full_screen)
flags |= SDL_WINDOW_FULLSCREEN_DESKTOP;
if (borderless)
flags |= SDL_WINDOW_BORDERLESS;
else
flags |= SDL_WINDOW_RESIZABLE;
window = SDL_CreateWindow(window_title, SDL_WINDOWPOS_UNDEFINED, SDL_WINDOWPOS_UNDEFINED, w, h, flags);
SDL_SetHint(SDL_HINT_RENDER_SCALE_QUALITY, "linear");
if (window) {
SDL_RendererInfo info;
renderer = SDL_CreateRenderer(window, -1, SDL_RENDERER_ACCELERATED | SDL_RENDERER_PRESENTVSYNC);
if (!renderer) {
av_log(NULL, AV_LOG_WARNING, "Failed to initialize a hardware accelerated renderer: %s\n", SDL_GetError());
renderer = SDL_CreateRenderer(window, -1, 0);
}
if (renderer) {
if (!SDL_GetRendererInfo(renderer, &info))
av_log(NULL, AV_LOG_VERBOSE, "Initialized %s renderer.\n", info.name);
@@ -1303,7 +1296,7 @@ static int video_open(VideoState *is)
static void video_display(VideoState *is)
{
if (!window)
video_open(is);
video_open(is, NULL);
SDL_SetRenderDrawColor(renderer, 0, 0, 0, 255);
SDL_RenderClear(renderer);
@@ -1450,11 +1443,9 @@ static void toggle_mute(VideoState *is)
is->muted = !is->muted;
}
static void update_volume(VideoState *is, int sign, double step)
static void update_volume(VideoState *is, int sign, int step)
{
double volume_level = is->audio_volume ? (20 * log(is->audio_volume / (double)SDL_MIX_MAXVOLUME) / log(10)) : -1000.0;
int new_volume = lrint(SDL_MIX_MAXVOLUME * pow(10.0, (volume_level + sign * step) / 20.0));
is->audio_volume = av_clip(is->audio_volume == new_volume ? (is->audio_volume + sign) : new_volume, 0, SDL_MIX_MAXVOLUME);
is->audio_volume = av_clip(is->audio_volume + sign * step, 0, SDL_MIX_MAXVOLUME);
}
static void step_to_next_frame(VideoState *is)
@@ -1672,6 +1663,38 @@ display:
}
}
/* allocate a picture (needs to do that in main thread to avoid
potential locking problems */
static void alloc_picture(VideoState *is)
{
Frame *vp;
int sdl_format;
vp = &is->pictq.queue[is->pictq.windex];
video_open(is, vp);
if (vp->format == AV_PIX_FMT_YUV420P)
sdl_format = SDL_PIXELFORMAT_YV12;
else
sdl_format = SDL_PIXELFORMAT_ARGB8888;
if (realloc_texture(&vp->bmp, sdl_format, vp->width, vp->height, SDL_BLENDMODE_NONE, 0) < 0) {
/* SDL allocates a buffer smaller than requested if the video
* overlay hardware is unable to support the requested size. */
av_log(NULL, AV_LOG_FATAL,
"Error: the video system does not support an image\n"
"size of %dx%d pixels. Try using -lowres or -vf \"scale=w:h\"\n"
"to reduce the image size.\n", vp->width, vp->height );
do_exit(is);
}
SDL_LockMutex(is->pictq.mutex);
vp->allocated = 1;
SDL_CondSignal(is->pictq.cond);
SDL_UnlockMutex(is->pictq.mutex);
}
static int queue_picture(VideoState *is, AVFrame *src_frame, double pts, double duration, int64_t pos, int serial)
{
Frame *vp;
@@ -1687,19 +1710,51 @@ static int queue_picture(VideoState *is, AVFrame *src_frame, double pts, double
vp->sar = src_frame->sample_aspect_ratio;
vp->uploaded = 0;
vp->width = src_frame->width;
vp->height = src_frame->height;
vp->format = src_frame->format;
/* alloc or resize hardware picture buffer */
if (!vp->bmp || !vp->allocated ||
vp->width != src_frame->width ||
vp->height != src_frame->height ||
vp->format != src_frame->format) {
SDL_Event event;
vp->pts = pts;
vp->duration = duration;
vp->pos = pos;
vp->serial = serial;
vp->allocated = 0;
vp->width = src_frame->width;
vp->height = src_frame->height;
vp->format = src_frame->format;
set_default_window_size(vp->width, vp->height, vp->sar);
/* the allocation must be done in the main thread to avoid
locking problems. */
event.type = FF_ALLOC_EVENT;
event.user.data1 = is;
SDL_PushEvent(&event);
av_frame_move_ref(vp->frame, src_frame);
frame_queue_push(&is->pictq);
/* wait until the picture is allocated */
SDL_LockMutex(is->pictq.mutex);
while (!vp->allocated && !is->videoq.abort_request) {
SDL_CondWait(is->pictq.cond, is->pictq.mutex);
}
/* if the queue is aborted, we have to pop the pending ALLOC event or wait for the allocation to complete */
if (is->videoq.abort_request && SDL_PeepEvents(&event, 1, SDL_GETEVENT, FF_ALLOC_EVENT, FF_ALLOC_EVENT) != 1) {
while (!vp->allocated && !is->abort_request) {
SDL_CondWait(is->pictq.cond, is->pictq.mutex);
}
}
SDL_UnlockMutex(is->pictq.mutex);
if (is->videoq.abort_request)
return -1;
}
/* if the frame is not skipped, then display it */
if (vp->bmp) {
vp->pts = pts;
vp->duration = duration;
vp->pos = pos;
vp->serial = serial;
av_frame_move_ref(vp->frame, src_frame);
frame_queue_push(&is->pictq);
}
return 0;
}
@@ -2006,7 +2061,7 @@ static int audio_thread(void *arg)
goto the_end;
while ((ret = av_buffersink_get_frame_flags(is->out_audio_filter, frame, 0)) >= 0) {
tb = av_buffersink_get_time_base(is->out_audio_filter);
tb = is->out_audio_filter->inputs[0]->time_base;
#endif
if (!(af = frame_queue_peek_writable(&is->sampq)))
goto the_end;
@@ -2114,7 +2169,7 @@ static int video_thread(void *arg)
last_format = frame->format;
last_serial = is->viddec.pkt_serial;
last_vfilter_idx = is->vfilter_idx;
frame_rate = av_buffersink_get_frame_rate(filt_out);
frame_rate = filt_out->inputs[0]->frame_rate;
}
ret = av_buffersrc_add_frame(filt_in, frame);
@@ -2135,7 +2190,7 @@ static int video_thread(void *arg)
is->frame_last_filter_delay = av_gettime_relative() / 1000000.0 - is->frame_last_returned_time;
if (fabs(is->frame_last_filter_delay) > AV_NOSYNC_THRESHOLD / 10.0)
is->frame_last_filter_delay = 0;
tb = av_buffersink_get_time_base(filt_out);
tb = filt_out->inputs[0]->time_base;
#endif
duration = (frame_rate.num && frame_rate.den ? av_q2d((AVRational){frame_rate.den, frame_rate.num}) : 0);
pts = (frame->pts == AV_NOPTS_VALUE) ? NAN : frame->pts * av_q2d(tb);
@@ -2572,7 +2627,7 @@ static int stream_component_open(VideoState *is, int stream_index)
case AVMEDIA_TYPE_AUDIO:
#if CONFIG_AVFILTER
{
AVFilterContext *sink;
AVFilterLink *link;
is->audio_filter_src.freq = avctx->sample_rate;
is->audio_filter_src.channels = avctx->channels;
@@ -2580,10 +2635,10 @@ static int stream_component_open(VideoState *is, int stream_index)
is->audio_filter_src.fmt = avctx->sample_fmt;
if ((ret = configure_audio_filters(is, afilters, 0)) < 0)
goto fail;
sink = is->out_audio_filter;
sample_rate = av_buffersink_get_sample_rate(sink);
nb_channels = av_buffersink_get_channels(sink);
channel_layout = av_buffersink_get_channel_layout(sink);
link = is->out_audio_filter->inputs[0];
sample_rate = link->sample_rate;
nb_channels = avfilter_link_get_channels(link);
channel_layout = link->channel_layout;
}
#else
sample_rate = avctx->sample_rate;
@@ -3036,13 +3091,7 @@ static VideoState *stream_open(const char *filename, AVInputFormat *iformat)
init_clock(&is->audclk, &is->audioq.serial);
init_clock(&is->extclk, &is->extclk.serial);
is->audio_clock_serial = -1;
if (startup_volume < 0)
av_log(NULL, AV_LOG_WARNING, "-volume=%d < 0, setting to 0\n", startup_volume);
if (startup_volume > 100)
av_log(NULL, AV_LOG_WARNING, "-volume=%d > 100, setting to 100\n", startup_volume);
startup_volume = av_clip(startup_volume, 0, 100);
startup_volume = av_clip(SDL_MIX_MAXVOLUME * startup_volume / 100, 0, SDL_MIX_MAXVOLUME);
is->audio_volume = startup_volume;
is->audio_volume = SDL_MIX_MAXVOLUME;
is->muted = 0;
is->av_sync_type = av_sync_type;
is->read_tid = SDL_CreateThread(read_thread, "read_thread", is);
@@ -3391,6 +3440,9 @@ static void event_loop(VideoState *cur_stream)
case FF_QUIT_EVENT:
do_exit(cur_stream);
break;
case FF_ALLOC_EVENT:
alloc_picture(event.user.data1);
break;
default:
break;
}
@@ -3520,8 +3572,6 @@ static const OptionDef options[] = {
{ "t", HAS_ARG, { .func_arg = opt_duration }, "play \"duration\" seconds of audio/video", "duration" },
{ "bytes", OPT_INT | HAS_ARG, { &seek_by_bytes }, "seek by bytes 0=off 1=on -1=auto", "val" },
{ "nodisp", OPT_BOOL, { &display_disable }, "disable graphical display" },
{ "noborder", OPT_BOOL, { &borderless }, "borderless window" },
{ "volume", OPT_INT | HAS_ARG, { &startup_volume}, "set startup volume 0=min 100=max", "volume" },
{ "f", HAS_ARG, { .func_arg = opt_format }, "force format", "fmt" },
{ "pix_fmt", HAS_ARG | OPT_EXPERT | OPT_VIDEO, { .func_arg = opt_frame_pix_fmt }, "set pixel format", "format" },
{ "stats", OPT_BOOL | OPT_EXPERT, { &show_status }, "show status", "" },

268
ffprobe.c
View File

@@ -37,7 +37,6 @@
#include "libavutil/hash.h"
#include "libavutil/opt.h"
#include "libavutil/pixdesc.h"
#include "libavutil/spherical.h"
#include "libavutil/stereo3d.h"
#include "libavutil/dict.h"
#include "libavutil/intreadwrite.h"
@@ -51,19 +50,6 @@
#include "libpostproc/postprocess.h"
#include "cmdutils.h"
#include "libavutil/thread.h"
#if !HAVE_THREADS
# ifdef pthread_mutex_lock
# undef pthread_mutex_lock
# endif
# define pthread_mutex_lock(a)
# ifdef pthread_mutex_unlock
# undef pthread_mutex_unlock
# endif
# define pthread_mutex_unlock(a)
#endif
typedef struct InputStream {
AVStream *st;
@@ -99,7 +85,6 @@ static int do_show_library_versions = 0;
static int do_show_pixel_formats = 0;
static int do_show_pixel_format_flags = 0;
static int do_show_pixel_format_components = 0;
static int do_show_log = 0;
static int do_show_chapter_tags = 0;
static int do_show_format_tags = 0;
@@ -162,8 +147,6 @@ typedef enum {
SECTION_ID_FRAME_TAGS,
SECTION_ID_FRAME_SIDE_DATA_LIST,
SECTION_ID_FRAME_SIDE_DATA,
SECTION_ID_FRAME_LOG,
SECTION_ID_FRAME_LOGS,
SECTION_ID_LIBRARY_VERSION,
SECTION_ID_LIBRARY_VERSIONS,
SECTION_ID_PACKET,
@@ -203,19 +186,17 @@ static struct section sections[] = {
[SECTION_ID_FORMAT] = { SECTION_ID_FORMAT, "format", 0, { SECTION_ID_FORMAT_TAGS, -1 } },
[SECTION_ID_FORMAT_TAGS] = { SECTION_ID_FORMAT_TAGS, "tags", SECTION_FLAG_HAS_VARIABLE_FIELDS, { -1 }, .element_name = "tag", .unique_name = "format_tags" },
[SECTION_ID_FRAMES] = { SECTION_ID_FRAMES, "frames", SECTION_FLAG_IS_ARRAY, { SECTION_ID_FRAME, SECTION_ID_SUBTITLE, -1 } },
[SECTION_ID_FRAME] = { SECTION_ID_FRAME, "frame", 0, { SECTION_ID_FRAME_TAGS, SECTION_ID_FRAME_SIDE_DATA_LIST, SECTION_ID_FRAME_LOGS, -1 } },
[SECTION_ID_FRAME] = { SECTION_ID_FRAME, "frame", 0, { SECTION_ID_FRAME_TAGS, SECTION_ID_FRAME_SIDE_DATA_LIST, -1 } },
[SECTION_ID_FRAME_TAGS] = { SECTION_ID_FRAME_TAGS, "tags", SECTION_FLAG_HAS_VARIABLE_FIELDS, { -1 }, .element_name = "tag", .unique_name = "frame_tags" },
[SECTION_ID_FRAME_SIDE_DATA_LIST] ={ SECTION_ID_FRAME_SIDE_DATA_LIST, "side_data_list", SECTION_FLAG_IS_ARRAY, { SECTION_ID_FRAME_SIDE_DATA, -1 }, .element_name = "side_data", .unique_name = "frame_side_data_list" },
[SECTION_ID_FRAME_SIDE_DATA_LIST] ={ SECTION_ID_FRAME_SIDE_DATA_LIST, "side_data_list", SECTION_FLAG_IS_ARRAY, { SECTION_ID_FRAME_SIDE_DATA, -1 } },
[SECTION_ID_FRAME_SIDE_DATA] = { SECTION_ID_FRAME_SIDE_DATA, "side_data", 0, { -1 } },
[SECTION_ID_FRAME_LOGS] = { SECTION_ID_FRAME_LOGS, "logs", SECTION_FLAG_IS_ARRAY, { SECTION_ID_FRAME_LOG, -1 } },
[SECTION_ID_FRAME_LOG] = { SECTION_ID_FRAME_LOG, "log", 0, { -1 }, },
[SECTION_ID_LIBRARY_VERSIONS] = { SECTION_ID_LIBRARY_VERSIONS, "library_versions", SECTION_FLAG_IS_ARRAY, { SECTION_ID_LIBRARY_VERSION, -1 } },
[SECTION_ID_LIBRARY_VERSION] = { SECTION_ID_LIBRARY_VERSION, "library_version", 0, { -1 } },
[SECTION_ID_PACKETS] = { SECTION_ID_PACKETS, "packets", SECTION_FLAG_IS_ARRAY, { SECTION_ID_PACKET, -1} },
[SECTION_ID_PACKETS_AND_FRAMES] = { SECTION_ID_PACKETS_AND_FRAMES, "packets_and_frames", SECTION_FLAG_IS_ARRAY, { SECTION_ID_PACKET, -1} },
[SECTION_ID_PACKET] = { SECTION_ID_PACKET, "packet", 0, { SECTION_ID_PACKET_TAGS, SECTION_ID_PACKET_SIDE_DATA_LIST, -1 } },
[SECTION_ID_PACKET_TAGS] = { SECTION_ID_PACKET_TAGS, "tags", SECTION_FLAG_HAS_VARIABLE_FIELDS, { -1 }, .element_name = "tag", .unique_name = "packet_tags" },
[SECTION_ID_PACKET_SIDE_DATA_LIST] ={ SECTION_ID_PACKET_SIDE_DATA_LIST, "side_data_list", SECTION_FLAG_IS_ARRAY, { SECTION_ID_PACKET_SIDE_DATA, -1 }, .element_name = "side_data", .unique_name = "packet_side_data_list" },
[SECTION_ID_PACKET_SIDE_DATA_LIST] ={ SECTION_ID_PACKET_SIDE_DATA_LIST, "side_data_list", SECTION_FLAG_IS_ARRAY, { SECTION_ID_PACKET_SIDE_DATA, -1 } },
[SECTION_ID_PACKET_SIDE_DATA] = { SECTION_ID_PACKET_SIDE_DATA, "side_data", 0, { -1 } },
[SECTION_ID_PIXEL_FORMATS] = { SECTION_ID_PIXEL_FORMATS, "pixel_formats", SECTION_FLAG_IS_ARRAY, { SECTION_ID_PIXEL_FORMAT, -1 } },
[SECTION_ID_PIXEL_FORMAT] = { SECTION_ID_PIXEL_FORMAT, "pixel_format", 0, { SECTION_ID_PIXEL_FORMAT_FLAGS, SECTION_ID_PIXEL_FORMAT_COMPONENTS, -1 } },
@@ -238,7 +219,7 @@ static struct section sections[] = {
[SECTION_ID_STREAM] = { SECTION_ID_STREAM, "stream", 0, { SECTION_ID_STREAM_DISPOSITION, SECTION_ID_STREAM_TAGS, SECTION_ID_STREAM_SIDE_DATA_LIST, -1 } },
[SECTION_ID_STREAM_DISPOSITION] = { SECTION_ID_STREAM_DISPOSITION, "disposition", 0, { -1 }, .unique_name = "stream_disposition" },
[SECTION_ID_STREAM_TAGS] = { SECTION_ID_STREAM_TAGS, "tags", SECTION_FLAG_HAS_VARIABLE_FIELDS, { -1 }, .element_name = "tag", .unique_name = "stream_tags" },
[SECTION_ID_STREAM_SIDE_DATA_LIST] ={ SECTION_ID_STREAM_SIDE_DATA_LIST, "side_data_list", SECTION_FLAG_IS_ARRAY, { SECTION_ID_STREAM_SIDE_DATA, -1 }, .element_name = "side_data", .unique_name = "stream_side_data_list" },
[SECTION_ID_STREAM_SIDE_DATA_LIST] ={ SECTION_ID_STREAM_SIDE_DATA_LIST, "side_data_list", SECTION_FLAG_IS_ARRAY, { SECTION_ID_STREAM_SIDE_DATA, -1 } },
[SECTION_ID_STREAM_SIDE_DATA] = { SECTION_ID_STREAM_SIDE_DATA, "side_data", 0, { -1 } },
[SECTION_ID_SUBTITLE] = { SECTION_ID_SUBTITLE, "subtitle", 0, { -1 } },
};
@@ -275,79 +256,11 @@ static uint64_t *nb_streams_packets;
static uint64_t *nb_streams_frames;
static int *selected_streams;
#if HAVE_THREADS
pthread_mutex_t log_mutex;
#endif
typedef struct LogBuffer {
char *context_name;
int log_level;
char *log_message;
AVClassCategory category;
char *parent_name;
AVClassCategory parent_category;
}LogBuffer;
static LogBuffer *log_buffer;
static int log_buffer_size;
static void log_callback(void *ptr, int level, const char *fmt, va_list vl)
{
AVClass* avc = ptr ? *(AVClass **) ptr : NULL;
va_list vl2;
char line[1024];
static int print_prefix = 1;
void *new_log_buffer;
va_copy(vl2, vl);
av_log_default_callback(ptr, level, fmt, vl);
av_log_format_line(ptr, level, fmt, vl2, line, sizeof(line), &print_prefix);
va_end(vl2);
#if HAVE_THREADS
pthread_mutex_lock(&log_mutex);
new_log_buffer = av_realloc_array(log_buffer, log_buffer_size + 1, sizeof(*log_buffer));
if (new_log_buffer) {
char *msg;
int i;
log_buffer = new_log_buffer;
memset(&log_buffer[log_buffer_size], 0, sizeof(log_buffer[log_buffer_size]));
log_buffer[log_buffer_size].context_name= avc ? av_strdup(avc->item_name(ptr)) : NULL;
if (avc) {
if (avc->get_category) log_buffer[log_buffer_size].category = avc->get_category(ptr);
else log_buffer[log_buffer_size].category = avc->category;
}
log_buffer[log_buffer_size].log_level = level;
msg = log_buffer[log_buffer_size].log_message = av_strdup(line);
for (i=strlen(msg) - 1; i>=0 && msg[i] == '\n'; i--) {
msg[i] = 0;
}
if (avc && avc->parent_log_context_offset) {
AVClass** parent = *(AVClass ***) (((uint8_t *) ptr) +
avc->parent_log_context_offset);
if (parent && *parent) {
log_buffer[log_buffer_size].parent_name = av_strdup((*parent)->item_name(parent));
log_buffer[log_buffer_size].parent_category =
(*parent)->get_category ? (*parent)->get_category(parent) :(*parent)->category;
}
}
log_buffer_size ++;
}
pthread_mutex_unlock(&log_mutex);
#endif
}
static void ffprobe_cleanup(int ret)
{
int i;
for (i = 0; i < FF_ARRAY_ELEMS(sections); i++)
av_dict_free(&(sections[i].entries_to_show));
#if HAVE_THREADS
pthread_mutex_destroy(&log_mutex);
#endif
}
struct unit_value {
@@ -1848,7 +1761,6 @@ static inline int show_tags(WriterContext *w, AVDictionary *tags, int section_id
}
static void print_pkt_side_data(WriterContext *w,
AVCodecParameters *par,
const AVPacketSideData *side_data,
int nb_side_data,
SectionID id_data_list,
@@ -1856,13 +1768,14 @@ static void print_pkt_side_data(WriterContext *w,
{
int i;
writer_print_section_header(w, id_data_list);
writer_print_section_header(w, SECTION_ID_STREAM_SIDE_DATA_LIST);
for (i = 0; i < nb_side_data; i++) {
const AVPacketSideData *sd = &side_data[i];
const char *name = av_packet_side_data_name(sd->type);
writer_print_section_header(w, id_data);
writer_print_section_header(w, SECTION_ID_STREAM_SIDE_DATA);
print_str("side_data_type", name ? name : "unknown");
print_int("side_data_size", sd->size);
if (sd->type == AV_PKT_DATA_DISPLAYMATRIX && sd->size >= 9*4) {
writer_print_integers(w, "displaymatrix", sd->data, 9, " %11d", 3, 4, 1);
print_int("rotation", av_display_rotation_get((int32_t *)sd->data));
@@ -1870,84 +1783,60 @@ static void print_pkt_side_data(WriterContext *w,
const AVStereo3D *stereo = (AVStereo3D *)sd->data;
print_str("type", av_stereo3d_type_name(stereo->type));
print_int("inverted", !!(stereo->flags & AV_STEREO3D_FLAG_INVERT));
} else if (sd->type == AV_PKT_DATA_SPHERICAL) {
const AVSphericalMapping *spherical = (AVSphericalMapping *)sd->data;
print_str("projection", av_spherical_projection_name(spherical->projection));
if (spherical->projection == AV_SPHERICAL_CUBEMAP) {
print_int("padding", spherical->padding);
} else if (spherical->projection == AV_SPHERICAL_EQUIRECTANGULAR_TILE) {
size_t l, t, r, b;
av_spherical_tile_bounds(spherical, par->width, par->height,
&l, &t, &r, &b);
print_int("bound_left", l);
print_int("bound_top", t);
print_int("bound_right", r);
print_int("bound_bottom", b);
}
print_int("yaw", (double) spherical->yaw / (1 << 16));
print_int("pitch", (double) spherical->pitch / (1 << 16));
print_int("roll", (double) spherical->roll / (1 << 16));
} else if (sd->type == AV_PKT_DATA_SKIP_SAMPLES && sd->size == 10) {
print_int("skip_samples", AV_RL32(sd->data));
print_int("discard_padding", AV_RL32(sd->data + 4));
print_int("skip_reason", AV_RL8(sd->data + 8));
print_int("discard_reason", AV_RL8(sd->data + 9));
}
writer_print_section_footer(w);
}
writer_print_section_footer(w);
}
static void clear_log(int need_lock)
static void print_color_range(WriterContext *w, enum AVColorRange color_range, const char *fallback)
{
int i;
if (need_lock)
pthread_mutex_lock(&log_mutex);
for (i=0; i<log_buffer_size; i++) {
av_freep(&log_buffer[i].context_name);
av_freep(&log_buffer[i].parent_name);
av_freep(&log_buffer[i].log_message);
const char *val = av_color_range_name(color_range);
if (!val || color_range == AVCOL_RANGE_UNSPECIFIED) {
print_str_opt("color_range", fallback);
} else {
print_str("color_range", val);
}
log_buffer_size = 0;
if(need_lock)
pthread_mutex_unlock(&log_mutex);
}
static int show_log(WriterContext *w, int section_ids, int section_id, int log_level)
static void print_color_space(WriterContext *w, enum AVColorSpace color_space)
{
int i;
pthread_mutex_lock(&log_mutex);
if (!log_buffer_size) {
pthread_mutex_unlock(&log_mutex);
return 0;
const char *val = av_color_space_name(color_space);
if (!val || color_space == AVCOL_SPC_UNSPECIFIED) {
print_str_opt("color_space", "unknown");
} else {
print_str("color_space", val);
}
writer_print_section_header(w, section_ids);
}
for (i=0; i<log_buffer_size; i++) {
if (log_buffer[i].log_level <= log_level) {
writer_print_section_header(w, section_id);
print_str("context", log_buffer[i].context_name);
print_int("level", log_buffer[i].log_level);
print_int("category", log_buffer[i].category);
if (log_buffer[i].parent_name) {
print_str("parent_context", log_buffer[i].parent_name);
print_int("parent_category", log_buffer[i].parent_category);
} else {
print_str_opt("parent_context", "N/A");
print_str_opt("parent_category", "N/A");
}
print_str("message", log_buffer[i].log_message);
writer_print_section_footer(w);
}
static void print_primaries(WriterContext *w, enum AVColorPrimaries color_primaries)
{
const char *val = av_color_primaries_name(color_primaries);
if (!val || color_primaries == AVCOL_PRI_UNSPECIFIED) {
print_str_opt("color_primaries", "unknown");
} else {
print_str("color_primaries", val);
}
clear_log(0);
pthread_mutex_unlock(&log_mutex);
}
writer_print_section_footer(w);
static void print_color_trc(WriterContext *w, enum AVColorTransferCharacteristic color_trc)
{
const char *val = av_color_transfer_name(color_trc);
if (!val || color_trc == AVCOL_TRC_UNSPECIFIED) {
print_str_opt("color_transfer", "unknown");
} else {
print_str("color_transfer", val);
}
}
return 0;
static void print_chroma_location(WriterContext *w, enum AVChromaLocation chroma_location)
{
const char *val = av_chroma_location_name(chroma_location);
if (!val || chroma_location == AVCHROMA_LOC_UNSPECIFIED) {
print_str_opt("chroma_location", "unspecified");
} else {
print_str("chroma_location", val);
}
}
static void show_packet(WriterContext *w, InputFile *ifile, AVPacket *pkt, int packet_idx)
@@ -1991,7 +1880,7 @@ static void show_packet(WriterContext *w, InputFile *ifile, AVPacket *pkt, int p
av_dict_free(&dict);
}
print_pkt_side_data(w, st->codecpar, pkt->side_data, pkt->side_data_elems,
print_pkt_side_data(w, pkt->side_data, pkt->side_data_elems,
SECTION_ID_PACKET_SIDE_DATA_LIST,
SECTION_ID_PACKET_SIDE_DATA);
}
@@ -2098,8 +1987,6 @@ static void show_frame(WriterContext *w, AVFrame *frame, AVStream *stream,
}
if (do_show_frame_tags)
show_tags(w, av_frame_get_metadata(frame), SECTION_ID_FRAME_TAGS);
if (do_show_log)
show_log(w, SECTION_ID_FRAME_LOGS, SECTION_ID_FRAME_LOG, do_show_log);
if (frame->nb_side_data) {
writer_print_section_header(w, SECTION_ID_FRAME_SIDE_DATA_LIST);
for (i = 0; i < frame->nb_side_data; i++) {
@@ -2109,6 +1996,7 @@ static void show_frame(WriterContext *w, AVFrame *frame, AVStream *stream,
writer_print_section_header(w, SECTION_ID_FRAME_SIDE_DATA);
name = av_frame_side_data_name(sd->type);
print_str("side_data_type", name ? name : "unknown");
print_int("side_data_size", sd->size);
if (sd->type == AV_FRAME_DATA_DISPLAYMATRIX && sd->size >= 9*4) {
writer_print_integers(w, "displaymatrix", sd->data, 9, " %11d", 3, 4, 1);
print_int("rotation", av_display_rotation_get((int32_t *)sd->data));
@@ -2138,7 +2026,6 @@ static av_always_inline int process_frame(WriterContext *w,
AVSubtitle sub;
int ret = 0, got_frame = 0;
clear_log(1);
if (dec_ctx && dec_ctx->codec) {
switch (par->codec_type) {
case AVMEDIA_TYPE_VIDEO:
@@ -2378,8 +2265,9 @@ static int show_stream(WriterContext *w, AVFormatContext *fmt_ctx, int stream_id
#endif
/* print AVI/FourCC tag */
print_str("codec_tag_string", av_fourcc2str(par->codec_tag));
print_fmt("codec_tag", "0x%04"PRIx32, par->codec_tag);
av_get_codec_tag_string(val_str, sizeof(val_str), par->codec_tag);
print_str("codec_tag_string", val_str);
print_fmt("codec_tag", "0x%04x", par->codec_tag);
switch (par->codec_type) {
case AVMEDIA_TYPE_VIDEO:
@@ -2406,29 +2294,12 @@ static int show_stream(WriterContext *w, AVFormatContext *fmt_ctx, int stream_id
if (s) print_str ("pix_fmt", s);
else print_str_opt("pix_fmt", "unknown");
print_int("level", par->level);
if (par->color_range != AVCOL_RANGE_UNSPECIFIED)
print_str ("color_range", av_color_range_name(par->color_range));
else
print_str_opt("color_range", "N/A");
s = av_get_colorspace_name(par->color_space);
if (s) print_str ("color_space", s);
else print_str_opt("color_space", "unknown");
if (par->color_trc != AVCOL_TRC_UNSPECIFIED)
print_str("color_transfer", av_color_transfer_name(par->color_trc));
else
print_str_opt("color_transfer", av_color_transfer_name(par->color_trc));
if (par->color_primaries != AVCOL_PRI_UNSPECIFIED)
print_str("color_primaries", av_color_primaries_name(par->color_primaries));
else
print_str_opt("color_primaries", av_color_primaries_name(par->color_primaries));
if (par->chroma_location != AVCHROMA_LOC_UNSPECIFIED)
print_str("chroma_location", av_chroma_location_name(par->chroma_location));
else
print_str_opt("chroma_location", av_chroma_location_name(par->chroma_location));
print_color_range(w, par->color_range, "N/A");
print_color_space(w, par->color_space);
print_color_trc(w, par->color_trc);
print_primaries(w, par->color_primaries);
print_chroma_location(w, par->chroma_location);
if (par->field_order == AV_FIELD_PROGRESSIVE)
print_str("field_order", "progressive");
@@ -2553,7 +2424,7 @@ static int show_stream(WriterContext *w, AVFormatContext *fmt_ctx, int stream_id
ret = show_tags(w, stream->metadata, in_program ? SECTION_ID_PROGRAM_STREAM_TAGS : SECTION_ID_STREAM_TAGS);
if (stream->nb_side_data) {
print_pkt_side_data(w, stream->codecpar, stream->side_data, stream->nb_side_data,
print_pkt_side_data(w, stream->side_data, stream->nb_side_data,
SECTION_ID_STREAM_SIDE_DATA_LIST,
SECTION_ID_STREAM_SIDE_DATA);
}
@@ -2713,14 +2584,6 @@ static int open_input_file(InputFile *ifile, const char *filename)
AVDictionary **opts;
int scan_all_pmts_set = 0;
fmt_ctx = avformat_alloc_context();
if (!fmt_ctx) {
print_error(filename, AVERROR(ENOMEM));
exit_program(1);
}
fmt_ctx->flags |= AVFMT_FLAG_KEEP_SIDE_DATA;
if (!av_dict_get(format_opts, "scan_all_pmts", NULL, AV_DICT_MATCH_CASE)) {
av_dict_set(&format_opts, "scan_all_pmts", "1", AV_DICT_DONT_OVERWRITE);
scan_all_pmts_set = 1;
@@ -2795,13 +2658,6 @@ static int open_input_file(InputFile *ifile, const char *filename)
if (err < 0)
exit(1);
if (do_show_log) {
// For loging it is needed to disable at least frame threads as otherwise
// the log information would need to be reordered and matches up to contexts and frames
// That is in fact possible but not trivial
av_dict_set(&codec_opts, "threads", "1", 0);
}
av_codec_set_pkt_timebase(ist->dec_ctx, stream->time_base);
ist->dec_ctx->framerate = stream->avg_frame_rate;
@@ -3157,7 +3013,6 @@ void show_help_default(const char *opt, const char *arg)
printf("\n");
show_help_children(avformat_get_class(), AV_OPT_FLAG_DECODING_PARAM);
show_help_children(avcodec_get_class(), AV_OPT_FLAG_DECODING_PARAM);
}
/**
@@ -3387,9 +3242,6 @@ static const OptionDef real_options[] = {
"show a particular entry from the format/container info", "entry" },
{ "show_entries", HAS_ARG, {.func_arg = opt_show_entries},
"show a set of specified entries", "entry_list" },
#if HAVE_THREADS
{ "show_log", OPT_INT|HAS_ARG, {(void*)&do_show_log}, "show log" },
#endif
{ "show_packets", 0, {(void*)&opt_show_packets}, "show packets info" },
{ "show_programs", 0, {(void*)&opt_show_programs}, "show programs info" },
{ "show_streams", 0, {(void*)&opt_show_streams}, "show streams info" },
@@ -3436,14 +3288,6 @@ int main(int argc, char **argv)
init_dynload();
#if HAVE_THREADS
ret = pthread_mutex_init(&log_mutex, NULL);
if (ret != 0) {
goto end;
}
#endif
av_log_set_callback(log_callback);
av_log_set_flags(AV_LOG_SKIP_REPEATED);
register_exit(ffprobe_cleanup);

View File

@@ -32,10 +32,16 @@
#include <stdio.h>
#include "libavformat/avformat.h"
/* FIXME: those are internal headers, ffserver _really_ shouldn't use them */
#include "libavformat/ffm.h"
#include "libavformat/network.h"
#include "libavformat/os_support.h"
#include "libavformat/rtpdec.h"
#include "libavformat/rtpproto.h"
#include "libavformat/rtsp.h"
#include "libavformat/rtspcodes.h"
#include "libavformat/avio_internal.h"
#include "libavformat/internal.h"
#include "libavformat/url.h"
#include "libavutil/avassert.h"
#include "libavutil/avstring.h"
@@ -44,7 +50,6 @@
#include "libavutil/intreadwrite.h"
#include "libavutil/mathematics.h"
#include "libavutil/random_seed.h"
#include "libavutil/rational.h"
#include "libavutil/parseutils.h"
#include "libavutil/opt.h"
#include "libavutil/time.h"
@@ -156,7 +161,7 @@ typedef struct HTTPContext {
int feed_streams[FFSERVER_MAX_STREAMS]; /* index of streams in the feed */
int switch_feed_streams[FFSERVER_MAX_STREAMS]; /* index of streams in the feed */
int switch_pending;
AVFormatContext *pfmt_ctx; /* instance of FFServerStream for one user */
AVFormatContext fmt_ctx; /* instance of FFServerStream for one user */
int last_packet_sent; /* true if last data packet was sent */
int suppress_log;
DataRateData datarate;
@@ -164,7 +169,6 @@ typedef struct HTTPContext {
char protocol[16];
char method[16];
char url[128];
char clean_url[128*7];
int buffer_size;
uint8_t *buffer;
int is_packetized; /* if true, the stream is packetized */
@@ -188,6 +192,11 @@ typedef struct HTTPContext {
uint8_t *packet_buffer, *packet_buffer_ptr, *packet_buffer_end;
} HTTPContext;
typedef struct FeedData {
long long data_count;
float avg_frame_size; /* frame size averaged over last frames with exponential mean */
} FeedData;
static HTTPContext *first_http_ctx;
static FFServerConfig config = {
@@ -236,7 +245,8 @@ static int rtp_new_av_stream(HTTPContext *c,
/* utils */
static size_t htmlencode (const char *src, char **dest);
static inline void cp_html_entity (char *buffer, const char *entity);
static inline int check_codec_match(LayeredAVStream *ccf, AVStream *ccs, int stream);
static inline int check_codec_match(AVCodecContext *ccf, AVCodecContext *ccs,
int stream);
static const char *my_program_name;
@@ -255,21 +265,6 @@ static AVLFG random_state;
static FILE *logfile = NULL;
static void unlayer_stream(AVStream *st, LayeredAVStream *lst)
{
avcodec_free_context(&st->codec);
avcodec_parameters_free(&st->codecpar);
#define COPY(a) st->a = lst->a;
COPY(index)
COPY(id)
COPY(codec)
COPY(codecpar)
COPY(time_base)
COPY(pts_wrap_bits)
COPY(sample_aspect_ratio)
COPY(recommended_encoder_configuration)
}
static inline void cp_html_entity (char *buffer, const char *entity) {
if (!buffer || !entity)
return;
@@ -495,22 +490,20 @@ static void start_children(FFServerStream *feed)
return;
}
slash = strrchr(my_program_name, '/');
if (!slash) {
pathname = av_mallocz(sizeof("ffmpeg"));
} else {
pathname = av_mallocz(slash - my_program_name + sizeof("ffmpeg"));
if (pathname != NULL) {
memcpy(pathname, my_program_name, slash - my_program_name);
}
}
pathname = av_strdup (my_program_name);
if (!pathname) {
http_log("Could not allocate memory for children cmd line\n");
return;
}
/* use "ffmpeg" in the path of current program. Ignore user provided path */
/* replace "ffserver" with "ffmpeg" in the path of current
* program. Ignore user provided path */
strcat(pathname, "ffmpeg");
slash = strrchr(pathname, '/');
if (!slash)
slash = pathname;
else
slash++;
strcpy(slash, "ffmpeg");
for (; feed; feed = feed->next) {
@@ -943,22 +936,21 @@ static void close_connection(HTTPContext *c)
ffurl_close(c->rtp_handles[i]);
}
ctx = c->pfmt_ctx;
ctx = &c->fmt_ctx;
if (ctx) {
if (!c->last_packet_sent && c->state == HTTPSTATE_SEND_DATA_TRAILER) {
/* prepare header */
if (ctx->oformat && avio_open_dyn_buf(&ctx->pb) >= 0) {
av_write_trailer(ctx);
av_freep(&c->pb_buffer);
avio_close_dyn_buf(ctx->pb, &c->pb_buffer);
}
}
for(i=0; i<ctx->nb_streams; i++)
av_freep(&ctx->streams[i]);
av_freep(&ctx->streams);
av_freep(&ctx->priv_data);
if (!c->last_packet_sent && c->state == HTTPSTATE_SEND_DATA_TRAILER) {
/* prepare header */
if (ctx->oformat && avio_open_dyn_buf(&ctx->pb) >= 0) {
av_write_trailer(ctx);
av_freep(&c->pb_buffer);
avio_close_dyn_buf(ctx->pb, &c->pb_buffer);
}
}
for(i=0; i<ctx->nb_streams; i++)
av_freep(&ctx->streams[i]);
av_freep(&ctx->streams);
av_freep(&ctx->priv_data);
if (c->stream && !c->post && c->stream->stream_type == STREAM_TYPE_LIVE)
current_bandwidth -= c->stream->bandwidth;
@@ -1204,7 +1196,7 @@ static int extract_rates(char *rates, int ratelen, const char *request)
return 0;
}
static int find_stream_in_feed(FFServerStream *feed, AVCodecParameters *codec,
static int find_stream_in_feed(FFServerStream *feed, AVCodecContext *codec,
int bit_rate)
{
int i;
@@ -1212,7 +1204,7 @@ static int find_stream_in_feed(FFServerStream *feed, AVCodecParameters *codec,
int best = -1;
for (i = 0; i < feed->nb_streams; i++) {
AVCodecParameters *feed_codec = feed->streams[i]->codecpar;
AVCodecContext *feed_codec = feed->streams[i]->codec;
if (feed_codec->codec_id != codec->codec_id ||
feed_codec->sample_rate != codec->sample_rate ||
@@ -1253,7 +1245,7 @@ static int modify_current_stream(HTTPContext *c, char *rates)
return 0;
for (i = 0; i < req->nb_streams; i++) {
AVCodecParameters *codec = req->streams[i]->codecpar;
AVCodecContext *codec = req->streams[i]->codec;
switch(rates[i]) {
case 0:
@@ -1287,8 +1279,6 @@ static void get_word(char *buf, int buf_size, const char **pp)
const char *p;
char *q;
#define SPACE_CHARS " \t\r\n"
p = *pp;
p += strspn(p, SPACE_CHARS);
q = buf;
@@ -1702,7 +1692,7 @@ static int http_parse_request(HTTPContext *c)
memcpy(q, sdp_data, sdp_data_size);
q += sdp_data_size;
*q = '\0';
av_freep(&sdp_data);
av_free(sdp_data);
}
}
break;
@@ -1882,75 +1872,47 @@ static inline void print_stream_params(AVIOContext *pb, FFServerStream *stream)
int i, stream_no;
const char *type = "unknown";
char parameters[64];
LayeredAVStream *st;
AVStream *st;
AVCodec *codec;
stream_no = stream->nb_streams;
avio_printf(pb, "<table><tr><th>Stream<th>"
"type<th>kbit/s<th>codec<th>"
avio_printf(pb, "<table cellspacing=0 cellpadding=4><tr><th>Stream<th>"
"type<th>kbit/s<th align=left>codec<th align=left>"
"Parameters\n");
for (i = 0; i < stream_no; i++) {
st = stream->streams[i];
codec = avcodec_find_encoder(st->codecpar->codec_id);
codec = avcodec_find_encoder(st->codec->codec_id);
parameters[0] = 0;
switch(st->codecpar->codec_type) {
switch(st->codec->codec_type) {
case AVMEDIA_TYPE_AUDIO:
type = "audio";
snprintf(parameters, sizeof(parameters), "%d channel(s), %d Hz",
st->codecpar->channels, st->codecpar->sample_rate);
st->codec->channels, st->codec->sample_rate);
break;
case AVMEDIA_TYPE_VIDEO:
type = "video";
snprintf(parameters, sizeof(parameters),
"%dx%d, q=%d-%d, fps=%d", st->codecpar->width,
st->codecpar->height, st->codec->qmin, st->codec->qmax,
st->time_base.den / st->time_base.num);
"%dx%d, q=%d-%d, fps=%d", st->codec->width,
st->codec->height, st->codec->qmin, st->codec->qmax,
st->codec->time_base.den / st->codec->time_base.num);
break;
default:
abort();
}
avio_printf(pb, "<tr><td>%d<td>%s<td>%"PRId64
avio_printf(pb, "<tr><td align=right>%d<td>%s<td align=right>%"PRId64
"<td>%s<td>%s\n",
i, type, (int64_t)st->codecpar->bit_rate/1000,
i, type, (int64_t)st->codec->bit_rate/1000,
codec ? codec->name : "", parameters);
}
avio_printf(pb, "</table>\n");
}
static void clean_html(char *clean, int clean_len, char *dirty)
{
int i, o;
for (o = i = 0; o+10 < clean_len && dirty[i];) {
int len = strspn(dirty+i, "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ$-_.+!*(),?/ :;%");
if (len) {
if (o + len >= clean_len)
break;
memcpy(clean + o, dirty + i, len);
i += len;
o += len;
} else {
int c = dirty[i++];
switch (c) {
case '&': av_strlcat(clean+o, "&amp;" , clean_len - o); break;
case '<': av_strlcat(clean+o, "&lt;" , clean_len - o); break;
case '>': av_strlcat(clean+o, "&gt;" , clean_len - o); break;
case '\'': av_strlcat(clean+o, "&apos;" , clean_len - o); break;
case '\"': av_strlcat(clean+o, "&quot;" , clean_len - o); break;
default: av_strlcat(clean+o, "&#9785;", clean_len - o); break;
}
o += strlen(clean+o);
}
}
clean[o] = 0;
}
static void compute_status(HTTPContext *c)
{
HTTPContext *c1;
@@ -1981,8 +1943,8 @@ static void compute_status(HTTPContext *c)
avio_printf(pb, "<h1>%s Status</h1>\n", program_name);
/* format status */
avio_printf(pb, "<h2>Available Streams</h2>\n");
avio_printf(pb, "<table>\n");
avio_printf(pb, "<tr><th>Path<th>Served<br>Conns<th><br>bytes<th>Format<th>Bit rate<br>kbit/s<th>Video<br>kbit/s<th><br>Codec<th>Audio<br>kbit/s<th><br>Codec<th>Feed\n");
avio_printf(pb, "<table cellspacing=0 cellpadding=4>\n");
avio_printf(pb, "<tr><th valign=top>Path<th align=left>Served<br>Conns<th><br>bytes<th valign=top>Format<th>Bit rate<br>kbit/s<th align=left>Video<br>kbit/s<th><br>Codec<th align=left>Audio<br>kbit/s<th><br>Codec<th align=left valign=top>Feed\n");
stream = config.first_stream;
while (stream) {
char sfilename[1024];
@@ -2016,11 +1978,9 @@ static void compute_status(HTTPContext *c)
avio_printf(pb, "<tr><td><a href=\"/%s\">%s</a> ",
sfilename, stream->filename);
avio_printf(pb, "<td> %d <td> ",
avio_printf(pb, "<td align=right> %d <td align=right> ",
stream->conns_served);
// TODO: Investigate if we can make http bitexact so it always produces the same count of bytes
if (!config.bitexact)
fmt_bytecount(pb, stream->bytes_served);
fmt_bytecount(pb, stream->bytes_served);
switch(stream->stream_type) {
case STREAM_TYPE_LIVE: {
@@ -2032,12 +1992,12 @@ static void compute_status(HTTPContext *c)
const char *video_codec_name_extra = "";
for(i=0;i<stream->nb_streams;i++) {
LayeredAVStream *st = stream->streams[i];
AVCodec *codec = avcodec_find_encoder(st->codecpar->codec_id);
AVStream *st = stream->streams[i];
AVCodec *codec = avcodec_find_encoder(st->codec->codec_id);
switch(st->codecpar->codec_type) {
switch(st->codec->codec_type) {
case AVMEDIA_TYPE_AUDIO:
audio_bit_rate += st->codecpar->bit_rate;
audio_bit_rate += st->codec->bit_rate;
if (codec) {
if (*audio_codec_name)
audio_codec_name_extra = "...";
@@ -2045,7 +2005,7 @@ static void compute_status(HTTPContext *c)
}
break;
case AVMEDIA_TYPE_VIDEO:
video_bit_rate += st->codecpar->bit_rate;
video_bit_rate += st->codec->bit_rate;
if (codec) {
if (*video_codec_name)
video_codec_name_extra = "...";
@@ -2053,14 +2013,15 @@ static void compute_status(HTTPContext *c)
}
break;
case AVMEDIA_TYPE_DATA:
video_bit_rate += st->codecpar->bit_rate;
video_bit_rate += st->codec->bit_rate;
break;
default:
abort();
}
}
avio_printf(pb, "<td> %s <td> %d <td> %d <td> %s %s <td> "
avio_printf(pb, "<td align=center> %s <td align=right> %d "
"<td align=right> %d <td> %s %s <td align=right> "
"%d <td> %s %s",
stream->fmt->name, stream->bandwidth,
video_bit_rate / 1000, video_codec_name,
@@ -2075,8 +2036,8 @@ static void compute_status(HTTPContext *c)
}
break;
default:
avio_printf(pb, "<td> - <td> - "
"<td> - <td><td> - <td>\n");
avio_printf(pb, "<td align=center> - <td align=right> - "
"<td align=right> - <td><td align=right> - <td>\n");
break;
}
stream = stream->next;
@@ -2137,7 +2098,7 @@ static void compute_status(HTTPContext *c)
current_bandwidth, config.max_bandwidth);
avio_printf(pb, "<table>\n");
avio_printf(pb, "<tr><th>#<th>File<th>IP<th>URL<th>Proto<th>State<th>Target "
avio_printf(pb, "<tr><th>#<th>File<th>IP<th>Proto<th>State<th>Target "
"bit/s<th>Actual bit/s<th>Bytes transferred\n");
c1 = first_http_ctx;
i = 0;
@@ -2149,38 +2110,33 @@ static void compute_status(HTTPContext *c)
if (c1->stream) {
for (j = 0; j < c1->stream->nb_streams; j++) {
if (!c1->stream->feed)
bitrate += c1->stream->streams[j]->codecpar->bit_rate;
bitrate += c1->stream->streams[j]->codec->bit_rate;
else if (c1->feed_streams[j] >= 0)
bitrate += c1->stream->feed->streams[c1->feed_streams[j]]->codecpar->bit_rate;
bitrate += c1->stream->feed->streams[c1->feed_streams[j]]->codec->bit_rate;
}
}
i++;
p = inet_ntoa(c1->from_addr.sin_addr);
clean_html(c1->clean_url, sizeof(c1->clean_url), c1->url);
avio_printf(pb, "<tr><td><b>%d</b><td>%s%s<td>%s<td>%s<td>%s<td>%s"
"<td>",
avio_printf(pb, "<tr><td><b>%d</b><td>%s%s<td>%s<td>%s<td>%s"
"<td align=right>",
i, c1->stream ? c1->stream->filename : "",
c1->state == HTTPSTATE_RECEIVE_DATA ? "(input)" : "",
p,
c1->clean_url,
c1->state == HTTPSTATE_RECEIVE_DATA ? "(input)" : "", p,
c1->protocol, http_state[c1->state]);
fmt_bytecount(pb, bitrate);
avio_printf(pb, "<td>");
avio_printf(pb, "<td align=right>");
fmt_bytecount(pb, compute_datarate(&c1->datarate, c1->data_count) * 8);
avio_printf(pb, "<td>");
avio_printf(pb, "<td align=right>");
fmt_bytecount(pb, c1->data_count);
avio_printf(pb, "\n");
c1 = c1->next;
}
avio_printf(pb, "</table>\n");
if (!config.bitexact) {
/* date */
ti = time(NULL);
p = ctime(&ti);
avio_printf(pb, "<hr>Generated at %s", p);
}
/* date */
ti = time(NULL);
p = ctime(&ti);
avio_printf(pb, "<hr size=1 noshade>Generated at %s", p);
avio_printf(pb, "</body>\n</html>\n");
len = avio_close_dyn_buf(pb, &c->pb_buffer);
@@ -2306,14 +2262,17 @@ static int http_prepare_data(HTTPContext *c)
ctx = avformat_alloc_context();
if (!ctx)
return AVERROR(ENOMEM);
c->pfmt_ctx = ctx;
av_dict_copy(&(c->pfmt_ctx->metadata), c->stream->metadata, 0);
c->fmt_ctx = *ctx;
av_freep(&ctx);
av_dict_copy(&(c->fmt_ctx.metadata), c->stream->metadata, 0);
c->fmt_ctx.streams = av_mallocz_array(c->stream->nb_streams,
sizeof(AVStream *));
if (!c->fmt_ctx.streams)
return AVERROR(ENOMEM);
for(i=0;i<c->stream->nb_streams;i++) {
LayeredAVStream *src;
AVStream *st = avformat_new_stream(c->pfmt_ctx, NULL);
if (!st)
return AVERROR(ENOMEM);
AVStream *src;
c->fmt_ctx.streams[i] = av_mallocz(sizeof(AVStream));
/* if file or feed, then just take streams from FFServerStream
* struct */
@@ -2323,40 +2282,39 @@ static int http_prepare_data(HTTPContext *c)
else
src = c->stream->feed->streams[c->stream->feed_streams[i]];
unlayer_stream(c->pfmt_ctx->streams[i], src); //TODO we no longer copy st->internal, does this matter?
av_assert0(!c->pfmt_ctx->streams[i]->priv_data);
if (src->codec->flags & AV_CODEC_FLAG_BITEXACT)
c->pfmt_ctx->flags |= AVFMT_FLAG_BITEXACT;
*(c->fmt_ctx.streams[i]) = *src;
c->fmt_ctx.streams[i]->priv_data = 0;
/* XXX: should be done in AVStream, not in codec */
c->fmt_ctx.streams[i]->codec->frame_number = 0;
}
/* set output format parameters */
c->pfmt_ctx->oformat = c->stream->fmt;
av_assert0(c->pfmt_ctx->nb_streams == c->stream->nb_streams);
c->fmt_ctx.oformat = c->stream->fmt;
c->fmt_ctx.nb_streams = c->stream->nb_streams;
c->got_key_frame = 0;
/* prepare header and save header data in a stream */
if (avio_open_dyn_buf(&c->pfmt_ctx->pb) < 0) {
if (avio_open_dyn_buf(&c->fmt_ctx.pb) < 0) {
/* XXX: potential leak */
return -1;
}
c->pfmt_ctx->pb->seekable = 0;
c->fmt_ctx.pb->seekable = 0;
/*
* HACK to avoid MPEG-PS muxer to spit many underflow errors
* Default value from FFmpeg
* Try to set it using configuration option
*/
c->pfmt_ctx->max_delay = (int)(0.7*AV_TIME_BASE);
c->fmt_ctx.max_delay = (int)(0.7*AV_TIME_BASE);
if ((ret = avformat_write_header(c->pfmt_ctx, NULL)) < 0) {
if ((ret = avformat_write_header(&c->fmt_ctx, NULL)) < 0) {
http_log("Error writing output header for stream '%s': %s\n",
c->stream->filename, av_err2str(ret));
return ret;
}
av_dict_free(&c->pfmt_ctx->metadata);
av_dict_free(&c->fmt_ctx.metadata);
len = avio_close_dyn_buf(c->pfmt_ctx->pb, &c->pb_buffer);
len = avio_close_dyn_buf(c->fmt_ctx.pb, &c->pb_buffer);
c->buffer_ptr = c->pb_buffer;
c->buffer_end = c->pb_buffer + len;
@@ -2425,7 +2383,7 @@ static int http_prepare_data(HTTPContext *c)
AVStream *st = c->fmt_in->streams[source_index];
pkt.stream_index = i;
if (pkt.flags & AV_PKT_FLAG_KEY &&
(st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO ||
(st->codec->codec_type == AVMEDIA_TYPE_VIDEO ||
c->stream->nb_streams == 1))
c->got_key_frame = 1;
if (!c->stream->send_on_key || c->got_key_frame)
@@ -2433,6 +2391,7 @@ static int http_prepare_data(HTTPContext *c)
}
}
} else {
AVCodecContext *codec;
AVStream *ist, *ost;
send_it:
ist = c->fmt_in->streams[source_index];
@@ -2453,11 +2412,13 @@ static int http_prepare_data(HTTPContext *c)
av_packet_unref(&pkt);
break;
}
codec = ctx->streams[0]->codec;
/* only one stream per RTP connection */
pkt.stream_index = 0;
} else {
ctx = c->pfmt_ctx;
ctx = &c->fmt_ctx;
/* Fudge here */
codec = ctx->streams[pkt.stream_index]->codec;
}
if (c->is_packetized) {
@@ -2499,6 +2460,7 @@ static int http_prepare_data(HTTPContext *c)
c->buffer_ptr = c->pb_buffer;
c->buffer_end = c->pb_buffer + len;
codec->frame_number++;
if (len == 0) {
av_packet_unref(&pkt);
goto redo;
@@ -2513,13 +2475,13 @@ static int http_prepare_data(HTTPContext *c)
/* last packet test ? */
if (c->last_packet_sent || c->is_packetized)
return -1;
ctx = c->pfmt_ctx;
ctx = &c->fmt_ctx;
/* prepare header */
if (avio_open_dyn_buf(&ctx->pb) < 0) {
/* XXX: potential leak */
return -1;
}
c->pfmt_ctx->pb->seekable = 0;
c->fmt_ctx.pb->seekable = 0;
av_write_trailer(ctx);
len = avio_close_dyn_buf(ctx->pb, &c->pb_buffer);
c->buffer_ptr = c->pb_buffer;
@@ -2857,10 +2819,9 @@ static int http_receive_data(HTTPContext *c)
}
for (i = 0; i < s->nb_streams; i++) {
LayeredAVStream *fst = feed->streams[i];
AVStream *fst = feed->streams[i];
AVStream *st = s->streams[i];
avcodec_parameters_to_context(fst->codec, st->codecpar);
avcodec_parameters_from_context(fst->codecpar, fst->codec);
avcodec_copy_context(fst->codec, st->codec);
}
avformat_close_input(&s);
@@ -3005,6 +2966,7 @@ static int prepare_sdp_description(FFServerStream *stream, uint8_t **pbuffer,
struct in_addr my_ip)
{
AVFormatContext *avc;
AVStream *avs = NULL;
AVOutputFormat *rtp_format = av_guess_format("rtp", NULL, NULL);
AVDictionaryEntry *entry = av_dict_get(stream->metadata, "title", NULL, 0);
int i;
@@ -3018,6 +2980,7 @@ static int prepare_sdp_description(FFServerStream *stream, uint8_t **pbuffer,
avc->oformat = rtp_format;
av_dict_set(&avc->metadata, "title",
entry ? entry->value : "No Title", 0);
avc->nb_streams = stream->nb_streams;
if (stream->is_multicast) {
snprintf(avc->filename, 1024, "rtp://%s:%d?multicast=1?ttl=%d",
inet_ntoa(stream->multicast_ip),
@@ -3025,23 +2988,30 @@ static int prepare_sdp_description(FFServerStream *stream, uint8_t **pbuffer,
} else
snprintf(avc->filename, 1024, "rtp://0.0.0.0");
avc->streams = av_malloc_array(avc->nb_streams, sizeof(*avc->streams));
if (!avc->streams)
goto sdp_done;
avs = av_malloc_array(avc->nb_streams, sizeof(*avs));
if (!avs)
goto sdp_done;
for(i = 0; i < stream->nb_streams; i++) {
AVStream *st = avformat_new_stream(avc, NULL);
if (!st)
goto sdp_done;
avc->streams[i] = &avs[i];
avc->streams[i]->codec = stream->streams[i]->codec;
avcodec_parameters_from_context(stream->streams[i]->codecpar, stream->streams[i]->codec);
unlayer_stream(st, stream->streams[i]);
avc->streams[i]->codecpar = stream->streams[i]->codecpar;
}
#define PBUFFER_SIZE 2048
*pbuffer = av_mallocz(PBUFFER_SIZE);
*pbuffer = av_mallocz(2048);
if (!*pbuffer)
goto sdp_done;
av_sdp_create(&avc, 1, *pbuffer, PBUFFER_SIZE);
av_sdp_create(&avc, 1, *pbuffer, 2048);
sdp_done:
av_freep(&avc->streams);
av_dict_free(&avc->metadata);
av_free(avc);
av_free(avs);
return *pbuffer ? strlen(*pbuffer) : AVERROR(ENOMEM);
}
@@ -3465,16 +3435,19 @@ static int rtp_new_av_stream(HTTPContext *c,
if (!st)
goto fail;
av_freep(&st->codec);
av_freep(&st->info);
st_internal = st->internal;
if (!c->stream->feed ||
c->stream->feed == c->stream)
unlayer_stream(st, c->stream->streams[stream_index]);
memcpy(st, c->stream->streams[stream_index], sizeof(AVStream));
else
unlayer_stream(st,
c->stream->feed->streams[c->stream->feed_streams[stream_index]]);
av_assert0(st->priv_data == NULL);
av_assert0(st->internal == st_internal);
memcpy(st,
c->stream->feed->streams[c->stream->feed_streams[stream_index]],
sizeof(AVStream));
st->priv_data = NULL;
st->internal = st_internal;
/* build destination RTP address */
ipaddr = inet_ntoa(dest_addr->sin_addr);
@@ -3542,15 +3515,15 @@ static int rtp_new_av_stream(HTTPContext *c,
/* ffserver initialization */
/* FIXME: This code should use avformat_new_stream() */
static LayeredAVStream *add_av_stream1(FFServerStream *stream,
static AVStream *add_av_stream1(FFServerStream *stream,
AVCodecContext *codec, int copy)
{
LayeredAVStream *fst;
AVStream *fst;
if(stream->nb_streams >= FF_ARRAY_ELEMS(stream->streams))
return NULL;
fst = av_mallocz(sizeof(*fst));
fst = av_mallocz(sizeof(AVStream));
if (!fst)
return NULL;
if (copy) {
@@ -3566,20 +3539,21 @@ static LayeredAVStream *add_av_stream1(FFServerStream *stream,
*/
fst->codec = codec;
//NOTE we previously allocated internal & internal->avctx, these seemed uneeded though
fst->priv_data = av_mallocz(sizeof(FeedData));
fst->internal = av_mallocz(sizeof(*fst->internal));
fst->internal->avctx = avcodec_alloc_context3(NULL);
fst->codecpar = avcodec_parameters_alloc();
fst->index = stream->nb_streams;
fst->time_base = codec->time_base;
fst->pts_wrap_bits = 33;
avpriv_set_pts_info(fst, 33, 1, 90000);
fst->sample_aspect_ratio = codec->sample_aspect_ratio;
stream->streams[stream->nb_streams++] = fst;
return fst;
}
/* return the stream number in the feed */
static int add_av_stream(FFServerStream *feed, LayeredAVStream *st)
static int add_av_stream(FFServerStream *feed, AVStream *st)
{
LayeredAVStream *fst;
AVStream *fst;
AVCodecContext *av, *av1;
int i;
@@ -3613,9 +3587,9 @@ static int add_av_stream(FFServerStream *feed, LayeredAVStream *st)
fst = add_av_stream1(feed, av, 0);
if (!fst)
return -1;
if (st->recommended_encoder_configuration)
fst->recommended_encoder_configuration =
av_strdup(st->recommended_encoder_configuration);
if (av_stream_get_recommended_encoder_configuration(st))
av_stream_set_recommended_encoder_configuration(fst,
av_strdup(av_stream_get_recommended_encoder_configuration(st)));
return feed->nb_streams - 1;
}
@@ -3631,6 +3605,57 @@ static void remove_stream(FFServerStream *stream)
}
}
/* specific MPEG4 handling : we extract the raw parameters */
static void extract_mpeg4_header(AVFormatContext *infile)
{
int mpeg4_count, i, size;
AVPacket pkt;
AVStream *st;
const uint8_t *p;
infile->flags |= AVFMT_FLAG_NOFILLIN | AVFMT_FLAG_NOPARSE;
mpeg4_count = 0;
for(i=0;i<infile->nb_streams;i++) {
st = infile->streams[i];
if (st->codec->codec_id == AV_CODEC_ID_MPEG4 &&
st->codec->extradata_size == 0) {
mpeg4_count++;
}
}
if (!mpeg4_count)
return;
printf("MPEG4 without extra data: trying to find header in %s\n",
infile->filename);
while (mpeg4_count > 0) {
if (av_read_frame(infile, &pkt) < 0)
break;
st = infile->streams[pkt.stream_index];
if (st->codec->codec_id == AV_CODEC_ID_MPEG4 &&
st->codec->extradata_size == 0) {
av_freep(&st->codec->extradata);
/* fill extradata with the header */
/* XXX: we make hard suppositions here ! */
p = pkt.data;
while (p < pkt.data + pkt.size - 4) {
/* stop when vop header is found */
if (p[0] == 0x00 && p[1] == 0x00 &&
p[2] == 0x01 && p[3] == 0xb6) {
size = p - pkt.data;
st->codec->extradata = av_mallocz(size + AV_INPUT_BUFFER_PADDING_SIZE);
st->codec->extradata_size = size;
memcpy(st->codec->extradata, pkt.data, size);
break;
}
p++;
}
mpeg4_count--;
}
av_packet_unref(&pkt);
}
}
/* compute the needed AVStream for each file */
static void build_file_streams(void)
{
@@ -3681,6 +3706,7 @@ static void build_file_streams(void)
avformat_close_input(&infile);
goto fail;
}
extract_mpeg4_header(infile);
for(i=0;i<infile->nb_streams;i++)
add_av_stream1(stream, infile->streams[i]->codec, 1);
@@ -3691,25 +3717,26 @@ static void build_file_streams(void)
}
static inline
int check_codec_match(LayeredAVStream *ccf, AVStream *ccs, int stream)
int check_codec_match(AVCodecContext *ccf, AVCodecContext *ccs, int stream)
{
int matches = 1;
/* FIXME: Missed check on AVCodecContext.flags */
#define CHECK_CODEC(x) (ccf->codecpar->x != ccs->codecpar->x)
#define CHECK_CODEC(x) (ccf->x != ccs->x)
if (CHECK_CODEC(codec_id) || CHECK_CODEC(codec_type)) {
http_log("Codecs do not match for stream %d\n", stream);
matches = 0;
} else if (CHECK_CODEC(bit_rate)) {
} else if (CHECK_CODEC(bit_rate) || CHECK_CODEC(flags)) {
http_log("Codec bitrates do not match for stream %d\n", stream);
matches = 0;
} else if (ccf->codecpar->codec_type == AVMEDIA_TYPE_VIDEO) {
if (av_cmp_q(ccf->time_base, ccs->time_base) ||
CHECK_CODEC(width) || CHECK_CODEC(height)) {
} else if (ccf->codec_type == AVMEDIA_TYPE_VIDEO) {
if (CHECK_CODEC(time_base.den) ||
CHECK_CODEC(time_base.num) ||
CHECK_CODEC(width) ||
CHECK_CODEC(height)) {
http_log("Codec width, height or framerate do not match for stream %d\n", stream);
matches = 0;
}
} else if (ccf->codecpar->codec_type == AVMEDIA_TYPE_AUDIO) {
} else if (ccf->codec_type == AVMEDIA_TYPE_AUDIO) {
if (CHECK_CODEC(sample_rate) ||
CHECK_CODEC(channels) ||
CHECK_CODEC(frame_size)) {
@@ -3779,8 +3806,7 @@ static int build_feed_streams(void)
matches = 1;
for(i=0;i<s->nb_streams;i++) {
AVStream *ss;
LayeredAVStream *sf;
AVStream *sf, *ss;
sf = feed->streams[i];
ss = s->streams[i];
@@ -3792,7 +3818,7 @@ static int build_feed_streams(void)
break;
}
matches = check_codec_match (sf, ss, i);
matches = check_codec_match (sf->codec, ss->codec, i);
if (!matches)
break;
}
@@ -3835,14 +3861,8 @@ drop:
goto bail;
}
s->oformat = feed->fmt;
for (i = 0; i<feed->nb_streams; i++) {
AVStream *st = avformat_new_stream(s, NULL); // FIXME free this
if (!st) {
http_log("Failed to allocate stream\n");
goto bail;
}
unlayer_stream(st, feed->streams[i]);
}
s->nb_streams = feed->nb_streams;
s->streams = feed->streams;
if (avformat_write_header(s, NULL) < 0) {
http_log("Container doesn't support the required parameters\n");
avio_closep(&s->pb);
@@ -3892,7 +3912,7 @@ static void compute_bandwidth(void)
for(stream = config.first_stream; stream; stream = stream->next) {
bandwidth = 0;
for(i=0;i<stream->nb_streams;i++) {
LayeredAVStream *st = stream->streams[i];
AVStream *st = stream->streams[i];
switch(st->codec->codec_type) {
case AVMEDIA_TYPE_AUDIO:
case AVMEDIA_TYPE_VIDEO:

View File

@@ -25,6 +25,9 @@
#include "libavutil/pixdesc.h"
#include "libavutil/avassert.h"
// FIXME those are internal headers, ffserver _really_ shouldn't use them
#include "libavformat/ffm.h"
#include "cmdutils.h"
#include "ffserver_config.h"
@@ -150,11 +153,6 @@ void ffserver_parse_acl_row(FFServerStream *stream, FFServerStream* feed,
}
nacl = av_mallocz(sizeof(*nacl));
if (!nacl) {
fprintf(stderr, "Failed to allocate FFServerIPAddressACL\n");
goto bail;
}
naclp = 0;
acl.next = 0;
@@ -187,7 +185,7 @@ bail:
static void add_codec(FFServerStream *stream, AVCodecContext *av,
FFServerConfig *config)
{
LayeredAVStream *st;
AVStream *st;
AVDictionary **opts, *recommended = NULL;
char *enc_config;
@@ -318,12 +316,12 @@ static void add_codec(FFServerStream *stream, AVCodecContext *av,
}
done:
st = av_mallocz(sizeof(*st));
st = av_mallocz(sizeof(AVStream));
if (!st)
return;
av_dict_get_string(recommended, &enc_config, '=', ',');
av_dict_free(&recommended);
st->recommended_encoder_configuration = enc_config;
av_stream_set_recommended_encoder_configuration(st, enc_config);
st->codec = av;
st->codecpar = avcodec_parameters_alloc();
avcodec_parameters_from_context(st->codecpar, av);
@@ -1053,7 +1051,6 @@ static int ffserver_parse_config_stream(FFServerConfig *config, const char *cmd,
AV_OPT_FLAG_VIDEO_PARAM, config) < 0)
goto nomem;
} else if (!av_strcasecmp(cmd, "BitExact")) {
config->bitexact = 1;
if (ffserver_save_avoption("flags", "+bitexact", AV_OPT_FLAG_VIDEO_PARAM, config) < 0)
goto nomem;
} else if (!av_strcasecmp(cmd, "DctFastint")) {

View File

@@ -21,8 +21,6 @@
#ifndef FFSERVER_CONFIG_H
#define FFSERVER_CONFIG_H
#define FFM_PACKET_SIZE 4096
#include "libavutil/dict.h"
#include "libavformat/avformat.h"
#include "libavformat/network.h"
@@ -49,24 +47,6 @@ typedef struct FFServerIPAddressACL {
struct in_addr last;
} FFServerIPAddressACL;
/**
* This holds the stream parameters for an AVStream, it cannot be a AVStream
* because AVStreams cannot be instanciated without a AVFormatContext, especially
* not outside libavformat.
*
* The fields of this struct have the same semantics as the fields of an AVStream.
*/
typedef struct LayeredAVStream {
int index;
int id;
AVCodecParameters *codecpar;
AVCodecContext *codec;
AVRational time_base;
int pts_wrap_bits;
AVRational sample_aspect_ratio;
char *recommended_encoder_configuration;
} LayeredAVStream;
/* description of each stream of the ffserver.conf file */
typedef struct FFServerStream {
enum FFServerStreamType stream_type;
@@ -82,7 +62,7 @@ typedef struct FFServerStream {
int prebuffer; /* Number of milliseconds early to start */
int64_t max_time; /* Number of milliseconds to run */
int send_on_key;
LayeredAVStream *streams[FFSERVER_MAX_STREAMS];
AVStream *streams[FFSERVER_MAX_STREAMS];
int feed_streams[FFSERVER_MAX_STREAMS]; /* index of streams in the feed */
char feed_filename[1024]; /* file name of the feed storage, or
input file name for a stream */
@@ -122,7 +102,6 @@ typedef struct FFServerConfig {
unsigned int nb_max_connections;
uint64_t max_bandwidth;
int debug;
int bitexact;
char logfilename[1024];
struct sockaddr_in http_addr;
struct sockaddr_in rtsp_addr;

View File

@@ -158,7 +158,7 @@ typedef struct FourXContext {
#define FIX_1_847759065 121095
#define FIX_2_613125930 171254
#define MULTIPLY(var, const) (((var) * (const)) >> 16)
#define MULTIPLY(var, const) ((int)((var) * (unsigned)(const)) >> 16)
static void idct(int16_t block[64])
{
@@ -351,6 +351,8 @@ static int decode_p_block(FourXContext *f, uint16_t *dst, const uint16_t *src,
index = size2index[log2h][log2w];
av_assert0(index >= 0);
if (get_bits_left(&f->gb) < 1)
return AVERROR_INVALIDDATA;
h = 1 << log2h;
code = get_vlc2(&f->gb, block_type_vlc[1 - (f->version > 1)][index].table,
BLOCK_TYPE_VLC_BITS, 1);
@@ -496,9 +498,9 @@ static int decode_i_block(FourXContext *f, int16_t *block)
{
int code, i, j, level, val;
if (get_bits_left(&f->gb) < 2){
av_log(f->avctx, AV_LOG_ERROR, "%d bits left before decode_i_block()\n", get_bits_left(&f->gb));
return -1;
if (get_bits_left(&f->pre_gb) < 2) {
av_log(f->avctx, AV_LOG_ERROR, "%d bits left before decode_i_block()\n", get_bits_left(&f->pre_gb));
return AVERROR_INVALIDDATA;
}
/* DC coef */
@@ -523,6 +525,10 @@ static int decode_i_block(FourXContext *f, int16_t *block)
break;
if (code == 0xf0) {
i += 16;
if (i >= 64) {
av_log(f->avctx, AV_LOG_ERROR, "run %d overflow\n", i);
return 0;
}
} else {
if (code & 0xf) {
level = get_xbits(&f->gb, code & 0xf);
@@ -732,7 +738,7 @@ static int decode_i2_frame(FourXContext *f, const uint8_t *buf, int length)
for (x = 0; x < width; x += 16) {
unsigned int color[4] = { 0 }, bits;
if (buf_end - buf < 8)
return -1;
return AVERROR_INVALIDDATA;
// warning following is purely guessed ...
color[0] = bytestream2_get_le16u(&g3);
color[1] = bytestream2_get_le16u(&g3);

View File

@@ -37,9 +37,7 @@ OBJS = allcodecs.o \
jni.o \
mathtables.o \
mediacodec.o \
mpeg12framerate.o \
options.o \
mjpegenc_huffman.o \
parser.o \
profiles.o \
qsv_api.o \
@@ -75,7 +73,6 @@ OBJS-$(CONFIG_GOLOMB) += golomb.o
OBJS-$(CONFIG_H263DSP) += h263dsp.o
OBJS-$(CONFIG_H264CHROMA) += h264chroma.o
OBJS-$(CONFIG_H264DSP) += h264dsp.o h264idct.o
OBJS-$(CONFIG_H264PARSE) += h264_parse.o h2645_parse.o h264_ps.o
OBJS-$(CONFIG_H264PRED) += h264pred.o
OBJS-$(CONFIG_H264QPEL) += h264qpel.o
OBJS-$(CONFIG_HPELDSP) += hpeldsp.o
@@ -84,7 +81,7 @@ OBJS-$(CONFIG_HUFFYUVDSP) += huffyuvdsp.o
OBJS-$(CONFIG_HUFFYUVENCDSP) += huffyuvencdsp.o
OBJS-$(CONFIG_IDCTDSP) += idctdsp.o simple_idct.o jrevdct.o
OBJS-$(CONFIG_IIRFILTER) += iirfilter.o
OBJS-$(CONFIG_MDCT15) += mdct15.o
OBJS-$(CONFIG_IMDCT15) += imdct15.o
OBJS-$(CONFIG_INTRAX8) += intrax8.o intrax8dsp.o
OBJS-$(CONFIG_IVIDSP) += ivi_dsp.o
OBJS-$(CONFIG_JNI) += ffjni.o jni.o
@@ -92,7 +89,6 @@ OBJS-$(CONFIG_JPEGTABLES) += jpegtables.o
OBJS-$(CONFIG_LIBXVID) += libxvid_rc.o
OBJS-$(CONFIG_LLAUDDSP) += lossless_audiodsp.o
OBJS-$(CONFIG_LLVIDDSP) += lossless_videodsp.o
OBJS-$(CONFIG_LLVIDENCDSP) += lossless_videoencdsp.o
OBJS-$(CONFIG_LPC) += lpc.o
OBJS-$(CONFIG_LSP) += lsp.o
OBJS-$(CONFIG_LZF) += lzf.o
@@ -177,7 +173,9 @@ OBJS-$(CONFIG_AMRWB_DECODER) += amrwbdec.o celp_filters.o \
acelp_vectors.o \
acelp_pitch_delay.o
OBJS-$(CONFIG_AMV_ENCODER) += mjpegenc.o mjpegenc_common.o \
mjpegenc_huffman.o
mpegvideo_enc.o motion_est.o \
ratecontrol.o mpeg12data.o \
mpegvideo.o
OBJS-$(CONFIG_ANM_DECODER) += anm.o
OBJS-$(CONFIG_ANSI_DECODER) += ansi.o cga_data.o
OBJS-$(CONFIG_APE_DECODER) += apedec.o
@@ -193,11 +191,8 @@ OBJS-$(CONFIG_ASV2_DECODER) += asvdec.o asv.o mpeg12data.o
OBJS-$(CONFIG_ASV2_ENCODER) += asvenc.o asv.o mpeg12data.o
OBJS-$(CONFIG_ATRAC1_DECODER) += atrac1.o atrac.o
OBJS-$(CONFIG_ATRAC3_DECODER) += atrac3.o atrac.o
OBJS-$(CONFIG_ATRAC3AL_DECODER) += atrac3.o atrac.o
OBJS-$(CONFIG_ATRAC3P_DECODER) += atrac3plusdec.o atrac3plus.o \
atrac3plusdsp.o atrac.o
OBJS-$(CONFIG_ATRAC3PAL_DECODER) += atrac3plusdec.o atrac3plus.o \
atrac3plusdsp.o atrac.o
OBJS-$(CONFIG_AURA_DECODER) += cyuv.o
OBJS-$(CONFIG_AURA2_DECODER) += aura.o
OBJS-$(CONFIG_AVRN_DECODER) += avrndec.o mjpegdec.o
@@ -221,14 +216,13 @@ OBJS-$(CONFIG_BMV_VIDEO_DECODER) += bmvvideo.o
OBJS-$(CONFIG_BRENDER_PIX_DECODER) += brenderpix.o
OBJS-$(CONFIG_C93_DECODER) += c93.o
OBJS-$(CONFIG_CAVS_DECODER) += cavs.o cavsdec.o cavsdsp.o \
cavsdata.o
cavsdata.o mpeg12data.o
OBJS-$(CONFIG_CCAPTION_DECODER) += ccaption_dec.o
OBJS-$(CONFIG_CDGRAPHICS_DECODER) += cdgraphics.o
OBJS-$(CONFIG_CDXL_DECODER) += cdxl.o
OBJS-$(CONFIG_CFHD_DECODER) += cfhd.o cfhddata.o
OBJS-$(CONFIG_CINEPAK_DECODER) += cinepak.o
OBJS-$(CONFIG_CINEPAK_ENCODER) += cinepakenc.o elbg.o
OBJS-$(CONFIG_CLEARVIDEO_DECODER) += clearvideo.o
OBJS-$(CONFIG_CLJR_DECODER) += cljrdec.o
OBJS-$(CONFIG_CLJR_ENCODER) += cljrenc.o
OBJS-$(CONFIG_CLLC_DECODER) += cllc.o canopus.o
@@ -241,10 +235,11 @@ OBJS-$(CONFIG_CYUV_DECODER) += cyuv.o
OBJS-$(CONFIG_DCA_DECODER) += dcadec.o dca.o dcadata.o dcahuff.o \
dca_core.o dca_exss.o dca_xll.o dca_lbr.o \
dcadsp.o dcadct.o synth_filter.o
OBJS-$(CONFIG_DCA_ENCODER) += dcaenc.o dca.o dcadata.o dcahuff.o
OBJS-$(CONFIG_DCA_ENCODER) += dcaenc.o dca.o dcadata.o
OBJS-$(CONFIG_DDS_DECODER) += dds.o
OBJS-$(CONFIG_DIRAC_DECODER) += diracdec.o dirac.o diracdsp.o diractab.o \
dirac_arith.o dirac_dwt.o dirac_vlc.o
dirac_arith.o mpeg12data.o dirac_dwt.o \
dirac_vlc.o
OBJS-$(CONFIG_DFA_DECODER) += dfa.o
OBJS-$(CONFIG_DNXHD_DECODER) += dnxhddec.o dnxhddata.o
OBJS-$(CONFIG_DNXHD_ENCODER) += dnxhdenc.o dnxhddata.o
@@ -294,7 +289,6 @@ OBJS-$(CONFIG_FLASHSV_ENCODER) += flashsvenc.o
OBJS-$(CONFIG_FLASHSV2_ENCODER) += flashsv2enc.o
OBJS-$(CONFIG_FLASHSV2_DECODER) += flashsv.o
OBJS-$(CONFIG_FLIC_DECODER) += flicvideo.o
OBJS-$(CONFIG_FMVC_DECODER) += fmvc.o
OBJS-$(CONFIG_FOURXM_DECODER) += 4xm.o
OBJS-$(CONFIG_FRAPS_DECODER) += fraps.o
OBJS-$(CONFIG_FRWU_DECODER) += frwu.o
@@ -317,9 +311,10 @@ OBJS-$(CONFIG_H263_ENCODER) += mpeg4videoenc.o mpeg4video.o \
h263.o ituh263enc.o flvenc.o h263data.o
OBJS-$(CONFIG_H264_DECODER) += h264dec.o h264_cabac.o h264_cavlc.o \
h264_direct.o h264_loopfilter.o \
h264_mb.o h264_picture.o \
h264_mb.o h264_picture.o h264_ps.o \
h264_refs.o h264_sei.o \
h264_slice.o h264data.o
h264_slice.o h264data.o h264_parse.o \
h2645_parse.o
OBJS-$(CONFIG_H264_CUVID_DECODER) += cuvid.o
OBJS-$(CONFIG_H264_MEDIACODEC_DECODER) += mediacodecdec.o
OBJS-$(CONFIG_H264_MMAL_DECODER) += mmaldec.o
@@ -334,7 +329,7 @@ OBJS-$(CONFIG_H264_VAAPI_ENCODER) += vaapi_encode_h264.o vaapi_encode_h26x.
OBJS-$(CONFIG_H264_VIDEOTOOLBOX_ENCODER) += videotoolboxenc.o
OBJS-$(CONFIG_HAP_DECODER) += hapdec.o hap.o
OBJS-$(CONFIG_HAP_ENCODER) += hapenc.o hap.o
OBJS-$(CONFIG_HEVC_DECODER) += hevcdec.o hevc_mvs.o hevc_ps.o hevc_sei.o \
OBJS-$(CONFIG_HEVC_DECODER) += hevc.o hevc_mvs.o hevc_ps.o hevc_sei.o \
hevc_cabac.o hevc_refs.o hevcpred.o \
hevcdsp.o hevc_filter.o h2645_parse.o hevc_data.o
OBJS-$(CONFIG_HEVC_CUVID_DECODER) += cuvid.o
@@ -384,8 +379,7 @@ OBJS-$(CONFIG_METASOUND_DECODER) += metasound.o metasound_data.o \
OBJS-$(CONFIG_MICRODVD_DECODER) += microdvddec.o ass.o
OBJS-$(CONFIG_MIMIC_DECODER) += mimic.o
OBJS-$(CONFIG_MJPEG_DECODER) += mjpegdec.o
OBJS-$(CONFIG_MJPEG_ENCODER) += mjpegenc.o mjpegenc_common.o \
mjpegenc_huffman.o
OBJS-$(CONFIG_MJPEG_ENCODER) += mjpegenc.o mjpegenc_common.o
OBJS-$(CONFIG_MJPEGB_DECODER) += mjpegbdec.o
OBJS-$(CONFIG_MJPEG_VAAPI_ENCODER) += vaapi_encode_mjpeg.o
OBJS-$(CONFIG_MLP_DECODER) += mlpdec.o mlpdsp.o
@@ -414,11 +408,10 @@ OBJS-$(CONFIG_MPEGVIDEO_DECODER) += mpeg12dec.o mpeg12.o mpeg12data.o
OBJS-$(CONFIG_MPEG1VIDEO_DECODER) += mpeg12dec.o mpeg12.o mpeg12data.o
OBJS-$(CONFIG_MPEG1VIDEO_ENCODER) += mpeg12enc.o mpeg12.o
OBJS-$(CONFIG_MPEG2_MMAL_DECODER) += mmaldec.o
OBJS-$(CONFIG_MPEG2_QSV_DECODER) += qsvdec_other.o
OBJS-$(CONFIG_MPEG2_QSV_DECODER) += qsvdec_mpeg2.o
OBJS-$(CONFIG_MPEG2_QSV_ENCODER) += qsvenc_mpeg2.o
OBJS-$(CONFIG_MPEG2VIDEO_DECODER) += mpeg12dec.o mpeg12.o mpeg12data.o
OBJS-$(CONFIG_MPEG2VIDEO_ENCODER) += mpeg12enc.o mpeg12.o
OBJS-$(CONFIG_MPEG2_VAAPI_ENCODER) += vaapi_encode_mpeg2.o
OBJS-$(CONFIG_MPEG4_DECODER) += xvididct.o
OBJS-$(CONFIG_MPEG4_MEDIACODEC_DECODER) += mediacodecdec.o
OBJS-$(CONFIG_MPEG4_OMX_ENCODER) += omx.o
@@ -443,9 +436,8 @@ OBJS-$(CONFIG_NELLYMOSER_DECODER) += nellymoserdec.o nellymoser.o
OBJS-$(CONFIG_NELLYMOSER_ENCODER) += nellymoserenc.o nellymoser.o
OBJS-$(CONFIG_NUV_DECODER) += nuv.o rtjpeg.o
OBJS-$(CONFIG_ON2AVC_DECODER) += on2avc.o on2avcdata.o
OBJS-$(CONFIG_OPUS_DECODER) += opusdec.o opus.o opus_celt.o opus_rc.o \
opus_pvq.o opus_silk.o opustab.o vorbis_data.o
OBJS-$(CONFIG_OPUS_ENCODER) += opusenc.o opus_rc.o opustab.o opus_pvq.o
OBJS-$(CONFIG_OPUS_DECODER) += opusdec.o opus.o opus_celt.o \
opus_silk.o vorbis_data.o
OBJS-$(CONFIG_PAF_AUDIO_DECODER) += pafaudio.o
OBJS-$(CONFIG_PAF_VIDEO_DECODER) += pafvideo.o
OBJS-$(CONFIG_PAM_DECODER) += pnmdec.o pnm.o
@@ -460,7 +452,6 @@ OBJS-$(CONFIG_PGMYUV_DECODER) += pnmdec.o pnm.o
OBJS-$(CONFIG_PGMYUV_ENCODER) += pnmenc.o
OBJS-$(CONFIG_PGSSUB_DECODER) += pgssubdec.o
OBJS-$(CONFIG_PICTOR_DECODER) += pictordec.o cga_data.o
OBJS-$(CONFIG_PIXLET_DECODER) += pixlet.o
OBJS-$(CONFIG_PJS_DECODER) += textdec.o ass.o
OBJS-$(CONFIG_PNG_DECODER) += png.o pngdec.o pngdsp.o
OBJS-$(CONFIG_PNG_ENCODER) += png.o pngenc.o
@@ -471,13 +462,11 @@ OBJS-$(CONFIG_PRORES_LGPL_DECODER) += proresdec_lgpl.o proresdsp.o proresdat
OBJS-$(CONFIG_PRORES_ENCODER) += proresenc_anatoliy.o
OBJS-$(CONFIG_PRORES_AW_ENCODER) += proresenc_anatoliy.o
OBJS-$(CONFIG_PRORES_KS_ENCODER) += proresenc_kostya.o proresdata.o
OBJS-$(CONFIG_PSD_DECODER) += psd.o
OBJS-$(CONFIG_PTX_DECODER) += ptx.o
OBJS-$(CONFIG_QCELP_DECODER) += qcelpdec.o \
celp_filters.o acelp_vectors.o \
acelp_filters.o
OBJS-$(CONFIG_QDM2_DECODER) += qdm2.o
OBJS-$(CONFIG_QDMC_DECODER) += qdmc.o
OBJS-$(CONFIG_QDRAW_DECODER) += qdrw.o
OBJS-$(CONFIG_QPEG_DECODER) += qpeg.o
OBJS-$(CONFIG_QTRLE_DECODER) += qtrle.o
@@ -510,7 +499,6 @@ OBJS-$(CONFIG_SAMI_DECODER) += samidec.o ass.o htmlsubtitles.o
OBJS-$(CONFIG_S302M_DECODER) += s302m.o
OBJS-$(CONFIG_S302M_ENCODER) += s302menc.o
OBJS-$(CONFIG_SANM_DECODER) += sanm.o
OBJS-$(CONFIG_SCPR_DECODER) += scpr.o
OBJS-$(CONFIG_SCREENPRESSO_DECODER) += screenpresso.o
OBJS-$(CONFIG_SDX2_DPCM_DECODER) += dpcm.o
OBJS-$(CONFIG_SGI_DECODER) += sgidec.o
@@ -533,7 +521,6 @@ OBJS-$(CONFIG_SOL_DPCM_DECODER) += dpcm.o
OBJS-$(CONFIG_SONIC_DECODER) += sonic.o
OBJS-$(CONFIG_SONIC_ENCODER) += sonic.o
OBJS-$(CONFIG_SONIC_LS_ENCODER) += sonic.o
OBJS-$(CONFIG_SPEEDHQ_DECODER) += speedhq.o simple_idct.o
OBJS-$(CONFIG_SP5X_DECODER) += sp5xdec.o
OBJS-$(CONFIG_SRT_DECODER) += srtdec.o ass.o htmlsubtitles.o
OBJS-$(CONFIG_SRT_ENCODER) += srtenc.o ass_split.o
@@ -547,7 +534,8 @@ OBJS-$(CONFIG_SUNRAST_ENCODER) += sunrastenc.o
OBJS-$(CONFIG_SVQ1_DECODER) += svq1dec.o svq1.o svq13.o h263data.o
OBJS-$(CONFIG_SVQ1_ENCODER) += svq1enc.o svq1.o h263data.o \
h263.o ituh263enc.o
OBJS-$(CONFIG_SVQ3_DECODER) += svq3.o svq13.o mpegutils.o h264data.o
OBJS-$(CONFIG_SVQ3_DECODER) += svq3.o svq13.o mpegutils.o \
h264_parse.o h264data.o h264_ps.o h2645_parse.o
OBJS-$(CONFIG_TEXT_DECODER) += textdec.o ass.o
OBJS-$(CONFIG_TEXT_ENCODER) += srtenc.o ass_split.o
OBJS-$(CONFIG_TAK_DECODER) += takdec.o tak.o takdsp.o
@@ -591,7 +579,7 @@ OBJS-$(CONFIG_VC1_DECODER) += vc1dec.o vc1_block.o vc1_loopfilter.o
wmv2dsp.o wmv2data.o
OBJS-$(CONFIG_VC1_CUVID_DECODER) += cuvid.o
OBJS-$(CONFIG_VC1_MMAL_DECODER) += mmaldec.o
OBJS-$(CONFIG_VC1_QSV_DECODER) += qsvdec_other.o
OBJS-$(CONFIG_VC1_QSV_DECODER) += qsvdec_vc1.o
OBJS-$(CONFIG_VC2_ENCODER) += vc2enc.o vc2enc_dwt.o diractab.o
OBJS-$(CONFIG_VCR1_DECODER) += vcr1.o
OBJS-$(CONFIG_VMDAUDIO_DECODER) += vmdaudio.o
@@ -609,11 +597,8 @@ OBJS-$(CONFIG_VP7_DECODER) += vp8.o vp56rac.o
OBJS-$(CONFIG_VP8_DECODER) += vp8.o vp56rac.o
OBJS-$(CONFIG_VP8_CUVID_DECODER) += cuvid.o
OBJS-$(CONFIG_VP8_MEDIACODEC_DECODER) += mediacodecdec.o
OBJS-$(CONFIG_VP8_QSV_DECODER) += qsvdec_other.o
OBJS-$(CONFIG_VP8_VAAPI_ENCODER) += vaapi_encode_vp8.o
OBJS-$(CONFIG_VP9_DECODER) += vp9.o vp9data.o vp9dsp.o vp9lpf.o vp9recon.o \
vp9block.o vp9prob.o vp9mvs.o vp56rac.o \
vp9dsp_8bpp.o vp9dsp_10bpp.o vp9dsp_12bpp.o
OBJS-$(CONFIG_VP9_DECODER) += vp9.o vp9dsp.o vp56rac.o vp9dsp_8bpp.o \
vp9dsp_10bpp.o vp9dsp_12bpp.o
OBJS-$(CONFIG_VP9_CUVID_DECODER) += cuvid.o
OBJS-$(CONFIG_VP9_MEDIACODEC_DECODER) += mediacodecdec.o
OBJS-$(CONFIG_VPLAYER_DECODER) += textdec.o ass.o
@@ -652,7 +637,6 @@ OBJS-$(CONFIG_XFACE_ENCODER) += xfaceenc.o xface.o
OBJS-$(CONFIG_XL_DECODER) += xl.o
OBJS-$(CONFIG_XMA1_DECODER) += wmaprodec.o wma.o wma_common.o
OBJS-$(CONFIG_XMA2_DECODER) += wmaprodec.o wma.o wma_common.o
OBJS-$(CONFIG_XPM_DECODER) += xpmdec.o
OBJS-$(CONFIG_XSUB_DECODER) += xsubdec.o
OBJS-$(CONFIG_XSUB_ENCODER) += xsubenc.o
OBJS-$(CONFIG_XWD_DECODER) += xwddec.o
@@ -674,8 +658,6 @@ OBJS-$(CONFIG_PCM_ALAW_DECODER) += pcm.o
OBJS-$(CONFIG_PCM_ALAW_ENCODER) += pcm.o
OBJS-$(CONFIG_PCM_BLURAY_DECODER) += pcm-bluray.o
OBJS-$(CONFIG_PCM_DVD_DECODER) += pcm-dvd.o
OBJS-$(CONFIG_PCM_F16LE_DECODER) += pcm.o
OBJS-$(CONFIG_PCM_F24LE_DECODER) += pcm.o
OBJS-$(CONFIG_PCM_F32BE_DECODER) += pcm.o
OBJS-$(CONFIG_PCM_F32BE_ENCODER) += pcm.o
OBJS-$(CONFIG_PCM_F32LE_DECODER) += pcm.o
@@ -786,7 +768,7 @@ OBJS-$(CONFIG_ADPCM_YAMAHA_ENCODER) += adpcmenc.o adpcm_data.o
# hardware accelerators
OBJS-$(CONFIG_D3D11VA) += dxva2.o
OBJS-$(CONFIG_DXVA2) += dxva2.o
OBJS-$(CONFIG_VAAPI) += vaapi_decode.o
OBJS-$(CONFIG_VAAPI) += vaapi.o
OBJS-$(CONFIG_VDA) += vda.o videotoolbox.o
OBJS-$(CONFIG_VIDEOTOOLBOX) += videotoolbox.o
OBJS-$(CONFIG_VDPAU) += vdpau.o
@@ -829,20 +811,34 @@ OBJS-$(CONFIG_ISO_MEDIA) += mpeg4audio.o mpegaudiodata.o
OBJS-$(CONFIG_ADTS_MUXER) += mpeg4audio.o
OBJS-$(CONFIG_CAF_DEMUXER) += ac3tab.o
OBJS-$(CONFIG_DNXHD_DEMUXER) += dnxhddata.o
OBJS-$(CONFIG_FLAC_DEMUXER) += flac.o flacdata.o vorbis_data.o
OBJS-$(CONFIG_FLAC_MUXER) += flac.o flacdata.o vorbis_data.o
OBJS-$(CONFIG_FLV_DEMUXER) += mpeg4audio.o
OBJS-$(CONFIG_GXF_DEMUXER) += mpeg12data.o
OBJS-$(CONFIG_IFF_DEMUXER) += iff.o
OBJS-$(CONFIG_LATM_MUXER) += mpeg4audio.o
OBJS-$(CONFIG_MATROSKA_AUDIO_MUXER) += mpeg4audio.o
OBJS-$(CONFIG_MATROSKA_MUXER) += mpeg4audio.o
OBJS-$(CONFIG_MATROSKA_AUDIO_MUXER) += mpeg4audio.o vorbis_data.o \
flac.o flacdata.o
OBJS-$(CONFIG_MATROSKA_MUXER) += flac.o flacdata.o vorbis_data.o
OBJS-$(CONFIG_MOV_DEMUXER) += ac3tab.o
OBJS-$(CONFIG_MP2_MUXER) += mpegaudiodata.o mpegaudiodecheader.o
OBJS-$(CONFIG_MP3_MUXER) += mpegaudiodata.o mpegaudiodecheader.o
OBJS-$(CONFIG_MPEGTS_MUXER) += mpeg4audio.o
OBJS-$(CONFIG_MXF_MUXER) += dnxhddata.o
OBJS-$(CONFIG_NUT_MUXER) += mpegaudiodata.o
OBJS-$(CONFIG_NUT_DEMUXER) += mpegaudiodata.o mpeg4audio.o
OBJS-$(CONFIG_OGA_MUXER) += flac.o flacdata.o
OBJS-$(CONFIG_OGG_DEMUXER) += mpeg12data.o \
dirac.o vorbis_data.o
OBJS-$(CONFIG_OGG_MUXER) += flac.o flacdata.o \
vorbis_data.o
OBJS-$(CONFIG_RTP_MUXER) += mpeg4audio.o
OBJS-$(CONFIG_SPDIF_DEMUXER) += aacadtsdec.o mpeg4audio.o
OBJS-$(CONFIG_SPDIF_MUXER) += dca.o
OBJS-$(CONFIG_TAK_DEMUXER) += tak.o
OBJS-$(CONFIG_WEBM_MUXER) += mpeg4audio.o
OBJS-$(CONFIG_WEBM_MUXER) += mpeg4audio.o mpegaudiodata.o \
flac.o flacdata.o \
vorbis_data.o
# libavfilter dependencies
OBJS-$(CONFIG_ELBG_FILTER) += elbg.o
@@ -941,7 +937,8 @@ OBJS-$(CONFIG_G729_PARSER) += g729_parser.o
OBJS-$(CONFIG_GSM_PARSER) += gsm_parser.o
OBJS-$(CONFIG_H261_PARSER) += h261_parser.o
OBJS-$(CONFIG_H263_PARSER) += h263_parser.o
OBJS-$(CONFIG_H264_PARSER) += h264_parser.o h264_sei.o h264data.o
OBJS-$(CONFIG_H264_PARSER) += h264_parser.o h264_parse.o h2645_parse.o \
h264_ps.o h264_sei.o h264data.o
OBJS-$(CONFIG_HEVC_PARSER) += hevc_parser.o h2645_parse.o hevc_ps.o hevc_data.o
OBJS-$(CONFIG_MJPEG_PARSER) += mjpeg_parser.o
OBJS-$(CONFIG_MLP_PARSER) += mlp_parser.o mlp.o
@@ -958,14 +955,12 @@ OBJS-$(CONFIG_PNG_PARSER) += png_parser.o
OBJS-$(CONFIG_PNM_PARSER) += pnm_parser.o pnm.o
OBJS-$(CONFIG_RV30_PARSER) += rv34_parser.o
OBJS-$(CONFIG_RV40_PARSER) += rv34_parser.o
OBJS-$(CONFIG_SIPR_PARSER) += sipr_parser.o
OBJS-$(CONFIG_TAK_PARSER) += tak_parser.o tak.o
OBJS-$(CONFIG_VC1_PARSER) += vc1_parser.o vc1.o vc1data.o \
simple_idct.o wmv2data.o
OBJS-$(CONFIG_VP3_PARSER) += vp3_parser.o
OBJS-$(CONFIG_VP8_PARSER) += vp8_parser.o
OBJS-$(CONFIG_VP9_PARSER) += vp9_parser.o
OBJS-$(CONFIG_XMA_PARSER) += xma_parser.o
# bitstream filters
OBJS-$(CONFIG_AAC_ADTSTOASC_BSF) += aac_adtstoasc_bsf.o aacadtsdec.o \
@@ -973,7 +968,6 @@ OBJS-$(CONFIG_AAC_ADTSTOASC_BSF) += aac_adtstoasc_bsf.o aacadtsdec.o \
OBJS-$(CONFIG_CHOMP_BSF) += chomp_bsf.o
OBJS-$(CONFIG_DUMP_EXTRADATA_BSF) += dump_extradata_bsf.o
OBJS-$(CONFIG_DCA_CORE_BSF) += dca_core_bsf.o
OBJS-$(CONFIG_EXTRACT_EXTRADATA_BSF) += extract_extradata_bsf.o
OBJS-$(CONFIG_H264_MP4TOANNEXB_BSF) += h264_mp4toannexb_bsf.o
OBJS-$(CONFIG_HEVC_MP4TOANNEXB_BSF) += hevc_mp4toannexb_bsf.o
OBJS-$(CONFIG_IMX_DUMP_HEADER_BSF) += imx_dump_header_bsf.o
@@ -1020,18 +1014,15 @@ SKIPHEADERS-$(CONFIG_QSV) += qsv.h qsv_internal.h
SKIPHEADERS-$(CONFIG_QSVDEC) += qsvdec.h
SKIPHEADERS-$(CONFIG_QSVENC) += qsvenc.h
SKIPHEADERS-$(CONFIG_XVMC) += xvmc.h
SKIPHEADERS-$(CONFIG_VAAPI) += vaapi_decode.h vaapi_encode.h
SKIPHEADERS-$(CONFIG_VAAPI) += vaapi_encode.h vaapi_internal.h
SKIPHEADERS-$(CONFIG_VDA) += vda.h vda_vt_internal.h
SKIPHEADERS-$(CONFIG_VDPAU) += vdpau.h vdpau_internal.h
SKIPHEADERS-$(CONFIG_VIDEOTOOLBOX) += videotoolbox.h vda_vt_internal.h
TESTPROGS = avpacket \
celp_math \
imgconvert \
TESTPROGS = imgconvert \
jpeg2000dwt \
mathops \
options \
mjpegenc_huffman \
utils \
TESTPROGS-$(CONFIG_CABAC) += cabac

View File

@@ -36,7 +36,7 @@
#include "libavutil/fixed_dsp.h"
#include "avcodec.h"
#if !USE_FIXED
#include "mdct15.h"
#include "imdct15.h"
#endif
#include "fft.h"
#include "mpeg4audio.h"
@@ -327,7 +327,7 @@ struct AACContext {
#if USE_FIXED
AVFixedDSPContext *fdsp;
#else
MDCT15Context *mdct480;
IMDCT15Context *mdct480;
AVFloatDSPContext *fdsp;
#endif /* USE_FIXED */
int random_state;

View File

@@ -49,14 +49,14 @@ static int aac_adtstoasc_filter(AVBSFContext *bsfc, AVPacket *out)
if (ret < 0)
return ret;
if (bsfc->par_in->extradata && in->size >= 2 && (AV_RB16(in->data) >> 4) != 0xfff)
goto finish;
if (in->size < AAC_ADTS_HEADER_SIZE)
goto packet_too_small;
init_get_bits(&gb, in->data, AAC_ADTS_HEADER_SIZE * 8);
if (bsfc->par_in->extradata && show_bits(&gb, 12) != 0xfff)
goto finish;
if (avpriv_aac_parse_header(&gb, &hdr) < 0) {
av_log(bsfc, AV_LOG_ERROR, "Error parsing ADTS frame header!\n");
ret = AVERROR_INVALIDDATA;

View File

@@ -35,6 +35,7 @@
#define AAC_RENAME(x) x ## _fixed
#define AAC_RENAME_32(x) x ## _fixed_32
typedef int INTFLOAT;
typedef unsigned UINTFLOAT; ///< Equivalent to INTFLOAT, Used as temporal cast to avoid undefined sign overflow operations.
typedef int64_t INT64FLOAT;
typedef int16_t SHORTFLOAT;
typedef SoftFloat AAC_FLOAT;
@@ -45,7 +46,7 @@ typedef int AAC_SIGNE;
#define Q30(x) (int)((x)*1073741824.0 + 0.5)
#define Q31(x) (int)((x)*2147483648.0 + 0.5)
#define RANGE15(x) x
#define GET_GAIN(x, y) (-(y) << (x)) + 1024
#define GET_GAIN(x, y) (-(y) * (1 << (x))) + 1024
#define AAC_MUL16(x, y) (int)(((int64_t)(x) * (y) + 0x8000) >> 16)
#define AAC_MUL26(x, y) (int)(((int64_t)(x) * (y) + 0x2000000) >> 26)
#define AAC_MUL30(x, y) (int)(((int64_t)(x) * (y) + 0x20000000) >> 30)
@@ -72,7 +73,7 @@ typedef int AAC_SIGNE;
#define AAC_MSUB31_V3(x, y, z) (int)((((int64_t)(x) * (z)) - \
((int64_t)(y) * (z)) + \
0x40000000) >> 31)
#define AAC_HALF_SUM(x, y) (x) >> 1 + (y) >> 1
#define AAC_HALF_SUM(x, y) (((x) >> 1) + ((y) >> 1))
#define AAC_SRA_R(x, y) (int)(((x) + (1 << ((y) - 1))) >> (y))
#else
@@ -83,6 +84,7 @@ typedef int AAC_SIGNE;
#define AAC_RENAME(x) x
#define AAC_RENAME_32(x) x
typedef float INTFLOAT;
typedef float UINTFLOAT;
typedef float INT64FLOAT;
typedef float SHORTFLOAT;
typedef float AAC_FLOAT;

View File

@@ -557,13 +557,13 @@ static void search_for_pns(AACEncContext *s, AVCodecContext *avctx, SingleChanne
const float pns_transient_energy_r = FFMIN(0.7f, lambda / 140.f);
int refbits = avctx->bit_rate * 1024.0 / avctx->sample_rate
/ ((avctx->flags & AV_CODEC_FLAG_QSCALE) ? 2.0f : avctx->channels)
/ ((avctx->flags & CODEC_FLAG_QSCALE) ? 2.0f : avctx->channels)
* (lambda / 120.f);
/** Keep this in sync with twoloop's cutoff selection */
float rate_bandwidth_multiplier = 1.5f;
int prev = -1000, prev_sf = -1;
int frame_bit_rate = (avctx->flags & AV_CODEC_FLAG_QSCALE)
int frame_bit_rate = (avctx->flags & CODEC_FLAG_QSCALE)
? (refbits * rate_bandwidth_multiplier * avctx->sample_rate / 1024)
: (avctx->bit_rate / avctx->channels);
@@ -694,12 +694,12 @@ static void mark_pns(AACEncContext *s, AVCodecContext *avctx, SingleChannelEleme
const float pns_transient_energy_r = FFMIN(0.7f, lambda / 140.f);
int refbits = avctx->bit_rate * 1024.0 / avctx->sample_rate
/ ((avctx->flags & AV_CODEC_FLAG_QSCALE) ? 2.0f : avctx->channels)
/ ((avctx->flags & CODEC_FLAG_QSCALE) ? 2.0f : avctx->channels)
* (lambda / 120.f);
/** Keep this in sync with twoloop's cutoff selection */
float rate_bandwidth_multiplier = 1.5f;
int frame_bit_rate = (avctx->flags & AV_CODEC_FLAG_QSCALE)
int frame_bit_rate = (avctx->flags & CODEC_FLAG_QSCALE)
? (refbits * rate_bandwidth_multiplier * avctx->sample_rate / 1024)
: (avctx->bit_rate / avctx->channels);
@@ -843,25 +843,25 @@ static void search_for_ms(AACEncContext *s, ChannelElement *cpe)
sce0->ics.swb_sizes[g],
sce0->sf_idx[w*16+g],
sce0->band_type[w*16+g],
lambda / band0->threshold, INFINITY, &b1, NULL, 0);
lambda / (band0->threshold + FLT_MIN), INFINITY, &b1, NULL, 0);
dist1 += quantize_band_cost(s, &sce1->coeffs[start + (w+w2)*128],
R34,
sce1->ics.swb_sizes[g],
sce1->sf_idx[w*16+g],
sce1->band_type[w*16+g],
lambda / band1->threshold, INFINITY, &b2, NULL, 0);
lambda / (band1->threshold + FLT_MIN), INFINITY, &b2, NULL, 0);
dist2 += quantize_band_cost(s, M,
M34,
sce0->ics.swb_sizes[g],
mididx,
midcb,
lambda / minthr, INFINITY, &b3, NULL, 0);
lambda / (minthr + FLT_MIN), INFINITY, &b3, NULL, 0);
dist2 += quantize_band_cost(s, S,
S34,
sce1->ics.swb_sizes[g],
sididx,
sidcb,
mslambda / (minthr * bmax), INFINITY, &b4, NULL, 0);
mslambda / (minthr * bmax + FLT_MIN), INFINITY, &b4, NULL, 0);
B0 += b1+b2;
B1 += b3+b4;
dist1 -= b1+b2;

View File

@@ -71,7 +71,7 @@ static void search_for_quantizers_twoloop(AVCodecContext *avctx,
{
int start = 0, i, w, w2, g, recomprd;
int destbits = avctx->bit_rate * 1024.0 / avctx->sample_rate
/ ((avctx->flags & AV_CODEC_FLAG_QSCALE) ? 2.0f : avctx->channels)
/ ((avctx->flags & CODEC_FLAG_QSCALE) ? 2.0f : avctx->channels)
* (lambda / 120.f);
int refbits = destbits;
int toomanybits, toofewbits;
@@ -136,7 +136,7 @@ static void search_for_quantizers_twoloop(AVCodecContext *avctx,
* (lambda / (avctx->global_quality ? avctx->global_quality : 120));
}
if (avctx->flags & AV_CODEC_FLAG_QSCALE) {
if (avctx->flags & CODEC_FLAG_QSCALE) {
/**
* Constant Q-scale doesn't compensate MS coding on its own
* No need to be overly precise, this only controls RD
@@ -184,7 +184,7 @@ static void search_for_quantizers_twoloop(AVCodecContext *avctx,
* AAC_CUTOFF_FROM_BITRATE is calibrated for effective bitrate.
*/
float rate_bandwidth_multiplier = 1.5f;
int frame_bit_rate = (avctx->flags & AV_CODEC_FLAG_QSCALE)
int frame_bit_rate = (avctx->flags & CODEC_FLAG_QSCALE)
? (refbits * rate_bandwidth_multiplier * avctx->sample_rate / 1024)
: (avctx->bit_rate / avctx->channels);
@@ -332,7 +332,7 @@ static void search_for_quantizers_twoloop(AVCodecContext *avctx,
sce->coeffs + start,
nzslope * cleanup_factor);
energy2uplim *= de_psy_factor;
if (!(avctx->flags & AV_CODEC_FLAG_QSCALE)) {
if (!(avctx->flags & CODEC_FLAG_QSCALE)) {
/** In ABR, we need to priorize less and let rate control do its thing */
energy2uplim = sqrtf(energy2uplim);
}
@@ -346,7 +346,7 @@ static void search_for_quantizers_twoloop(AVCodecContext *avctx,
sce->coeffs + start,
2.0f);
energy2uplim *= de_psy_factor;
if (!(avctx->flags & AV_CODEC_FLAG_QSCALE)) {
if (!(avctx->flags & CODEC_FLAG_QSCALE)) {
/** In ABR, we need to priorize less and let rate control do its thing */
energy2uplim = sqrtf(energy2uplim);
}

View File

@@ -42,7 +42,7 @@
#include "internal.h"
#include "get_bits.h"
#include "fft.h"
#include "mdct15.h"
#include "imdct15.h"
#include "lpc.h"
#include "kbdwin.h"
#include "sinewin.h"
@@ -284,35 +284,29 @@ static int latm_decode_audio_specific_config(struct LATMContext *latmctx,
AACContext *ac = &latmctx->aac_ctx;
AVCodecContext *avctx = ac->avctx;
MPEG4AudioConfig m4ac = { 0 };
GetBitContext gbc;
int config_start_bit = get_bits_count(gb);
int sync_extension = 0;
int bits_consumed, esize, i;
int bits_consumed, esize;
if (asclen > 0) {
if (asclen) {
sync_extension = 1;
asclen = FFMIN(asclen, get_bits_left(gb));
init_get_bits(&gbc, gb->buffer, config_start_bit + asclen);
skip_bits_long(&gbc, config_start_bit);
} else if (asclen == 0) {
gbc = *gb;
} else {
return AVERROR_INVALIDDATA;
} else
asclen = get_bits_left(gb);
if (config_start_bit % 8) {
avpriv_request_sample(latmctx->aac_ctx.avctx,
"Non-byte-aligned audio-specific config");
return AVERROR_PATCHWELCOME;
}
if (get_bits_left(gb) <= 0)
if (asclen <= 0)
return AVERROR_INVALIDDATA;
bits_consumed = decode_audio_specific_config(NULL, avctx, &m4ac,
gb->buffer + (config_start_bit / 8),
asclen, sync_extension);
bits_consumed = decode_audio_specific_config_gb(NULL, avctx, &m4ac,
&gbc, config_start_bit,
sync_extension);
if (bits_consumed < config_start_bit)
if (bits_consumed < 0)
return AVERROR_INVALIDDATA;
bits_consumed -= config_start_bit;
if (asclen == 0)
asclen = bits_consumed;
if (!latmctx->initialized ||
ac->oc[1].m4ac.sample_rate != m4ac.sample_rate ||
@@ -325,7 +319,7 @@ static int latm_decode_audio_specific_config(struct LATMContext *latmctx,
}
latmctx->initialized = 0;
esize = (asclen + 7) / 8;
esize = (bits_consumed+7) / 8;
if (avctx->extradata_size < esize) {
av_free(avctx->extradata);
@@ -335,15 +329,12 @@ static int latm_decode_audio_specific_config(struct LATMContext *latmctx,
}
avctx->extradata_size = esize;
gbc = *gb;
for (i = 0; i < esize; i++) {
avctx->extradata[i] = get_bits(&gbc, 8);
}
memcpy(avctx->extradata, gb->buffer + (config_start_bit/8), esize);
memset(avctx->extradata+esize, 0, AV_INPUT_BUFFER_PADDING_SIZE);
}
skip_bits_long(gb, asclen);
skip_bits_long(gb, bits_consumed);
return 0;
return bits_consumed;
}
static int read_stream_mux_config(struct LATMContext *latmctx,
@@ -384,6 +375,8 @@ static int read_stream_mux_config(struct LATMContext *latmctx,
int ascLen = latm_get_value(gb);
if ((ret = latm_decode_audio_specific_config(latmctx, gb, ascLen)) < 0)
return ret;
ascLen -= ret;
skip_bits_long(gb, ascLen);
}
latmctx->frame_length_type = get_bits(gb, 3);
@@ -411,6 +404,8 @@ static int read_stream_mux_config(struct LATMContext *latmctx,
} else {
int esc;
do {
if (get_bits_left(gb) < 9)
return AVERROR_INVALIDDATA;
esc = get_bits(gb, 1);
skip_bits(gb, 8);
} while (esc);
@@ -431,6 +426,8 @@ static int read_payload_length_info(struct LATMContext *ctx, GetBitContext *gb)
if (ctx->frame_length_type == 0) {
int mux_slot_length = 0;
do {
if (get_bits_left(gb) < 8)
return AVERROR_INVALIDDATA;
tmp = get_bits(gb, 8);
mux_slot_length += tmp;
} while (tmp == 255);
@@ -460,7 +457,7 @@ static int read_audio_mux_element(struct LATMContext *latmctx,
}
if (latmctx->audio_mux_version_A == 0) {
int mux_slot_length_bytes = read_payload_length_info(latmctx, gb);
if (mux_slot_length_bytes * 8 > get_bits_left(gb)) {
if (mux_slot_length_bytes < 0 || mux_slot_length_bytes * 8LL > get_bits_left(gb)) {
av_log(latmctx->aac_ctx.avctx, AV_LOG_ERROR, "incomplete frame\n");
return AVERROR_INVALIDDATA;
} else if (mux_slot_length_bytes * 8 + 256 < get_bits_left(gb)) {
@@ -559,7 +556,7 @@ AVCodec ff_aac_decoder = {
AV_SAMPLE_FMT_FLTP, AV_SAMPLE_FMT_NONE
},
.capabilities = AV_CODEC_CAP_CHANNEL_CONF | AV_CODEC_CAP_DR1,
.caps_internal = FF_CODEC_CAP_INIT_THREADSAFE,
.caps_internal = FF_CODEC_CAP_INIT_THREADSAFE | FF_CODEC_CAP_INIT_CLEANUP,
.channel_layouts = aac_channel_layout,
.flush = flush,
.priv_class = &aac_decoder_class,
@@ -584,7 +581,7 @@ AVCodec ff_aac_latm_decoder = {
AV_SAMPLE_FMT_FLTP, AV_SAMPLE_FMT_NONE
},
.capabilities = AV_CODEC_CAP_CHANNEL_CONF | AV_CODEC_CAP_DR1,
.caps_internal = FF_CODEC_CAP_INIT_THREADSAFE,
.caps_internal = FF_CODEC_CAP_INIT_THREADSAFE | FF_CODEC_CAP_INIT_CLEANUP,
.channel_layouts = aac_channel_layout,
.flush = flush,
.profiles = NULL_IF_CONFIG_SMALL(ff_aac_profiles),

View File

@@ -125,7 +125,7 @@ static inline int *DEC_SQUAD(int *dst, unsigned idx)
static inline int *DEC_UPAIR(int *dst, unsigned idx, unsigned sign)
{
dst[0] = (idx & 15) * (1 - (sign & 0xFFFFFFFE));
dst[1] = (idx >> 4 & 15) * (1 - ((sign & 1) << 1));
dst[1] = (idx >> 4 & 15) * (1 - ((sign & 1) * 2));
return dst + 2;
}
@@ -134,16 +134,16 @@ static inline int *DEC_UQUAD(int *dst, unsigned idx, unsigned sign)
{
unsigned nz = idx >> 12;
dst[0] = (idx & 3) * (1 + (((int)sign >> 31) << 1));
dst[0] = (idx & 3) * (1 + (((int)sign >> 31) * 2));
sign <<= nz & 1;
nz >>= 1;
dst[1] = (idx >> 2 & 3) * (1 + (((int)sign >> 31) << 1));
dst[1] = (idx >> 2 & 3) * (1 + (((int)sign >> 31) * 2));
sign <<= nz & 1;
nz >>= 1;
dst[2] = (idx >> 4 & 3) * (1 + (((int)sign >> 31) << 1));
dst[2] = (idx >> 4 & 3) * (1 + (((int)sign >> 31) * 2));
sign <<= nz & 1;
nz >>= 1;
dst[3] = (idx >> 6 & 3) * (1 + (((int)sign >> 31) << 1));
dst[3] = (idx >> 6 & 3) * (1 + (((int)sign >> 31) * 2));
return dst + 4;
}
@@ -155,9 +155,9 @@ static void vector_pow43(int *coefs, int len)
for (i=0; i<len; i++) {
coef = coefs[i];
if (coef < 0)
coef = -(int)ff_cbrt_tab_fixed[-coef];
coef = -(int)ff_cbrt_tab_fixed[(-coef) & 8191];
else
coef = (int)ff_cbrt_tab_fixed[coef];
coef = (int)ff_cbrt_tab_fixed[ coef & 8191];
coefs[i] = coef;
}
}
@@ -171,31 +171,36 @@ static void subband_scale(int *dst, int *src, int scale, int offset, int len)
s = offset - (s >> 2);
if (s > 0) {
if (s > 31) {
for (i=0; i<len; i++) {
dst[i] = 0;
}
} else if (s > 0) {
round = 1 << (s-1);
for (i=0; i<len; i++) {
out = (int)(((int64_t)src[i] * c) >> 32);
dst[i] = ((int)(out+round) >> s) * ssign;
}
}
else {
} else if (s > -32) {
s = s + 32;
round = 1 << (s-1);
for (i=0; i<len; i++) {
out = (int)((int64_t)((int64_t)src[i] * c + round) >> s);
dst[i] = out * ssign;
dst[i] = out * (unsigned)ssign;
}
} else {
av_log(NULL, AV_LOG_ERROR, "Overflow in subband_scale()\n");
}
}
static void noise_scale(int *coefs, int scale, int band_energy, int len)
{
int ssign = scale < 0 ? -1 : 1;
int s = FFABS(scale);
int s = -scale;
unsigned int round;
int i, out, c = exp2tab[s & 3];
int nlz = 0;
av_assert0(s >= 0);
while (band_energy > 0x7fff) {
band_energy >>= 1;
nlz++;
@@ -203,19 +208,28 @@ static void noise_scale(int *coefs, int scale, int band_energy, int len)
c /= band_energy;
s = 21 + nlz - (s >> 2);
if (s > 0) {
round = 1 << (s-1);
if (s > 31) {
for (i=0; i<len; i++) {
coefs[i] = 0;
}
} else if (s >= 0) {
round = s ? 1 << (s-1) : 0;
for (i=0; i<len; i++) {
out = (int)(((int64_t)coefs[i] * c) >> 32);
coefs[i] = ((int)(out+round) >> s) * ssign;
coefs[i] = -((int)(out+round) >> s);
}
}
else {
s = s + 32;
round = 1 << (s-1);
for (i=0; i<len; i++) {
out = (int)((int64_t)((int64_t)coefs[i] * c + round) >> s);
coefs[i] = out * ssign;
if (s > 0) {
round = 1 << (s-1);
for (i=0; i<len; i++) {
out = (int)((int64_t)((int64_t)coefs[i] * c + round) >> s);
coefs[i] = -out;
}
} else {
for (i=0; i<len; i++)
coefs[i] = -(int64_t)coefs[i] * c * (1 << -s);
}
}
}
@@ -296,8 +310,12 @@ static av_always_inline void predict(PredictorState *ps, int *coef,
if (output_enable) {
int shift = 28 - pv.exp;
if (shift < 31)
*coef += (pv.mant + (1 << (shift - 1))) >> shift;
if (shift < 31) {
if (shift > 0) {
*coef += (unsigned)((pv.mant + (1 << (shift - 1))) >> shift);
} else
*coef += (unsigned)pv.mant << -shift;
}
}
e0 = av_int2sf(*coef, 2);
@@ -362,7 +380,9 @@ static void apply_dependent_coupling_fixed(AACContext *ac,
shift = (gain-1024) >> 3;
}
if (shift < 0) {
if (shift < -31) {
// Nothing to do
} else if (shift < 0) {
shift = -shift;
round = 1 << (shift - 1);
@@ -370,7 +390,7 @@ static void apply_dependent_coupling_fixed(AACContext *ac,
for (k = offsets[i]; k < offsets[i + 1]; k++) {
tmp = (int)(((int64_t)src[group * 128 + k] * c + \
(int64_t)0x1000000000) >> 37);
dest[group * 128 + k] += (tmp + round) >> shift;
dest[group * 128 + k] += (tmp + (int64_t)round) >> shift;
}
}
}
@@ -379,7 +399,7 @@ static void apply_dependent_coupling_fixed(AACContext *ac,
for (k = offsets[i]; k < offsets[i + 1]; k++) {
tmp = (int)(((int64_t)src[group * 128 + k] * c + \
(int64_t)0x1000000000) >> 37);
dest[group * 128 + k] += tmp << shift;
dest[group * 128 + k] += tmp * (1U << shift);
}
}
}
@@ -402,7 +422,7 @@ static void apply_independent_coupling_fixed(AACContext *ac,
int i, c, shift, round, tmp;
const int gain = cce->coup.gain[index][0];
const int *src = cce->ch[0].ret;
int *dest = target->ret;
unsigned int *dest = target->ret;
const int len = 1024 << (ac->oc[1].m4ac.sbr == 1);
c = cce_scale_fixed[gain & 7];
@@ -419,7 +439,7 @@ static void apply_independent_coupling_fixed(AACContext *ac,
else {
for (i = 0; i < len; i++) {
tmp = (int)(((int64_t)src[i] * c + (int64_t)0x1000000000) >> 37);
dest[i] += tmp << shift;
dest[i] += tmp * (1U << shift);
}
}
}

View File

@@ -134,7 +134,7 @@ static av_cold int che_configure(AACContext *ac,
if (!ac->che[type][id]) {
if (!(ac->che[type][id] = av_mallocz(sizeof(ChannelElement))))
return AVERROR(ENOMEM);
AAC_RENAME(ff_aac_sbr_ctx_init)(ac, &ac->che[type][id]->sbr, type);
AAC_RENAME(ff_aac_sbr_ctx_init)(ac, &ac->che[type][id]->sbr);
}
if (type != TYPE_CCE) {
if (*channels >= MAX_CHANNELS - (type == TYPE_CPE || (type == TYPE_SCE && ac->oc[1].m4ac.ps == 1))) {
@@ -406,11 +406,15 @@ static uint64_t sniff_channel_order(uint8_t (*layout_map)[3], int tags)
/**
* Save current output configuration if and only if it has been locked.
*/
static void push_output_configuration(AACContext *ac) {
static int push_output_configuration(AACContext *ac) {
int pushed = 0;
if (ac->oc[1].status == OC_LOCKED || ac->oc[0].status == OC_NONE) {
ac->oc[0] = ac->oc[1];
pushed = 1;
}
ac->oc[1].status = OC_NONE;
return pushed;
}
/**
@@ -452,7 +456,7 @@ static int output_configure(AACContext *ac,
int id = layout_map[i][1];
id_map[type][id] = type_counts[type]++;
if (id_map[type][id] >= MAX_ELEM_ID) {
avpriv_request_sample(ac->avctx, "Too large remapped id");
avpriv_request_sample(ac->avctx, "Remapped id too large\n");
return AVERROR_PATCHWELCOME;
}
}
@@ -715,13 +719,6 @@ static void decode_channel_map(uint8_t layout_map[][3],
}
}
static inline void relative_align_get_bits(GetBitContext *gb,
int reference_position) {
int n = (reference_position - get_bits_count(gb) & 7);
if (n)
skip_bits(gb, n);
}
/**
* Decode program configuration element; reference: table 4.2.
*
@@ -729,7 +726,7 @@ static inline void relative_align_get_bits(GetBitContext *gb,
*/
static int decode_pce(AVCodecContext *avctx, MPEG4AudioConfig *m4ac,
uint8_t (*layout_map)[3],
GetBitContext *gb, int byte_align_ref)
GetBitContext *gb)
{
int num_front, num_side, num_back, num_lfe, num_assoc_data, num_cc;
int sampling_index;
@@ -777,7 +774,7 @@ static int decode_pce(AVCodecContext *avctx, MPEG4AudioConfig *m4ac,
decode_channel_map(layout_map + tags, AAC_CHANNEL_CC, gb, num_cc);
tags += num_cc;
relative_align_get_bits(gb, byte_align_ref);
align_get_bits(gb);
/* comment field, first byte is length */
comment_len = get_bits(gb, 8) * 8;
@@ -799,7 +796,6 @@ static int decode_pce(AVCodecContext *avctx, MPEG4AudioConfig *m4ac,
*/
static int decode_ga_specific_config(AACContext *ac, AVCodecContext *avctx,
GetBitContext *gb,
int get_bit_alignment,
MPEG4AudioConfig *m4ac,
int channel_config)
{
@@ -823,7 +819,7 @@ static int decode_ga_specific_config(AACContext *ac, AVCodecContext *avctx,
if (channel_config == 0) {
skip_bits(gb, 4); // element_instance_tag
tags = decode_pce(avctx, m4ac, layout_map, gb, get_bit_alignment);
tags = decode_pce(avctx, m4ac, layout_map, gb);
if (tags < 0)
return tags;
} else {
@@ -945,25 +941,37 @@ static int decode_eld_specific_config(AACContext *ac, AVCodecContext *avctx,
* @param ac pointer to AACContext, may be null
* @param avctx pointer to AVCCodecContext, used for logging
* @param m4ac pointer to MPEG4AudioConfig, used for parsing
* @param gb buffer holding an audio specific config
* @param get_bit_alignment relative alignment for byte align operations
* @param data pointer to buffer holding an audio specific config
* @param bit_size size of audio specific config or data in bits
* @param sync_extension look for an appended sync extension
*
* @return Returns error status or number of consumed bits. <0 - error
*/
static int decode_audio_specific_config_gb(AACContext *ac,
AVCodecContext *avctx,
MPEG4AudioConfig *m4ac,
GetBitContext *gb,
int get_bit_alignment,
int sync_extension)
static int decode_audio_specific_config(AACContext *ac,
AVCodecContext *avctx,
MPEG4AudioConfig *m4ac,
const uint8_t *data, int64_t bit_size,
int sync_extension)
{
GetBitContext gb;
int i, ret;
GetBitContext gbc = *gb;
if ((i = ff_mpeg4audio_get_config_gb(m4ac, &gbc, sync_extension)) < 0)
if (bit_size < 0 || bit_size > INT_MAX) {
av_log(avctx, AV_LOG_ERROR, "Audio specific config size is invalid\n");
return AVERROR_INVALIDDATA;
}
ff_dlog(avctx, "audio specific config size %d\n", (int)bit_size >> 3);
for (i = 0; i < bit_size >> 3; i++)
ff_dlog(avctx, "%02x ", data[i]);
ff_dlog(avctx, "\n");
if ((ret = init_get_bits(&gb, data, bit_size)) < 0)
return ret;
if ((i = avpriv_mpeg4audio_get_config(m4ac, data, bit_size,
sync_extension)) < 0)
return AVERROR_INVALIDDATA;
if (m4ac->sampling_index > 12) {
av_log(avctx, AV_LOG_ERROR,
"invalid sampling rate index %d\n",
@@ -978,7 +986,7 @@ static int decode_audio_specific_config_gb(AACContext *ac,
return AVERROR_INVALIDDATA;
}
skip_bits_long(gb, i);
skip_bits_long(&gb, i);
switch (m4ac->object_type) {
case AOT_AAC_MAIN:
@@ -986,12 +994,12 @@ static int decode_audio_specific_config_gb(AACContext *ac,
case AOT_AAC_LTP:
case AOT_ER_AAC_LC:
case AOT_ER_AAC_LD:
if ((ret = decode_ga_specific_config(ac, avctx, gb, get_bit_alignment,
if ((ret = decode_ga_specific_config(ac, avctx, &gb,
m4ac, m4ac->chan_config)) < 0)
return ret;
break;
case AOT_ER_AAC_ELD:
if ((ret = decode_eld_specific_config(ac, avctx, gb,
if ((ret = decode_eld_specific_config(ac, avctx, &gb,
m4ac, m4ac->chan_config)) < 0)
return ret;
break;
@@ -1009,33 +1017,7 @@ static int decode_audio_specific_config_gb(AACContext *ac,
m4ac->sample_rate, m4ac->sbr,
m4ac->ps);
return get_bits_count(gb);
}
static int decode_audio_specific_config(AACContext *ac,
AVCodecContext *avctx,
MPEG4AudioConfig *m4ac,
const uint8_t *data, int64_t bit_size,
int sync_extension)
{
int i, ret;
GetBitContext gb;
if (bit_size < 0 || bit_size > INT_MAX) {
av_log(avctx, AV_LOG_ERROR, "Audio specific config size is invalid\n");
return AVERROR_INVALIDDATA;
}
ff_dlog(avctx, "audio specific config size %d\n", (int)bit_size >> 3);
for (i = 0; i < bit_size >> 3; i++)
ff_dlog(avctx, "%02x ", data[i]);
ff_dlog(avctx, "\n");
if ((ret = init_get_bits(&gb, data, bit_size)) < 0)
return ret;
return decode_audio_specific_config_gb(ac, avctx, m4ac, &gb, 0,
sync_extension);
return get_bits_count(&gb);
}
/**
@@ -1136,6 +1118,9 @@ static av_cold int aac_decode_init(AVCodecContext *avctx)
AACContext *ac = avctx->priv_data;
int ret;
if (avctx->sample_rate > 96000)
return AVERROR_INVALIDDATA;
ret = ff_thread_once(&aac_table_init, &aac_static_table_init);
if (ret != 0)
return AVERROR_UNKNOWN;
@@ -1207,7 +1192,7 @@ static av_cold int aac_decode_init(AVCodecContext *avctx)
AAC_RENAME_32(ff_mdct_init)(&ac->mdct_small, 8, 1, 1.0 / RANGE15(128.0));
AAC_RENAME_32(ff_mdct_init)(&ac->mdct_ltp, 11, 0, RANGE15(-2.0));
#if !USE_FIXED
ret = ff_mdct15_init(&ac->mdct480, 1, 5, -1.0f);
ret = ff_imdct15_init(&ac->mdct480, 5);
if (ret < 0)
return ret;
#endif
@@ -1277,6 +1262,8 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics,
const MPEG4AudioConfig *const m4ac = &ac->oc[1].m4ac;
const int aot = m4ac->object_type;
const int sampling_index = m4ac->sampling_index;
int ret_fail = AVERROR_INVALIDDATA;
if (aot != AOT_ER_AAC_ELD) {
if (get_bits1(gb)) {
av_log(ac->avctx, AV_LOG_ERROR, "Reserved bit set.\n");
@@ -1327,8 +1314,10 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics,
ics->num_swb = ff_aac_num_swb_512[sampling_index];
ics->tns_max_bands = ff_tns_max_bands_512[sampling_index];
}
if (!ics->num_swb || !ics->swb_offset)
return AVERROR_BUG;
if (!ics->num_swb || !ics->swb_offset) {
ret_fail = AVERROR_BUG;
goto fail;
}
} else {
ics->swb_offset = ff_swb_offset_1024[sampling_index];
ics->num_swb = ff_aac_num_swb_1024[sampling_index];
@@ -1352,7 +1341,8 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics,
if (aot == AOT_ER_AAC_LD) {
av_log(ac->avctx, AV_LOG_ERROR,
"LTP in ER AAC LD not yet implemented.\n");
return AVERROR_PATCHWELCOME;
ret_fail = AVERROR_PATCHWELCOME;
goto fail;
}
if ((ics->ltp.present = get_bits(gb, 1)))
decode_ltp(&ics->ltp, gb, ics->max_sfb);
@@ -1371,7 +1361,7 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics,
return 0;
fail:
ics->max_sfb = 0;
return AVERROR_INVALIDDATA;
return ret_fail;
}
/**
@@ -1631,25 +1621,24 @@ static int decode_spectrum_and_dequant(AACContext *ac, INTFLOAT coef[1024],
}
} else if (cbt_m1 == NOISE_BT - 1) {
for (group = 0; group < (AAC_SIGNE)g_len; group++, cfo+=128) {
#if !USE_FIXED
float scale;
#endif /* !USE_FIXED */
INTFLOAT band_energy;
#if USE_FIXED
for (k = 0; k < off_len; k++) {
ac->random_state = lcg_random(ac->random_state);
#if USE_FIXED
cfo[k] = ac->random_state >> 3;
#else
cfo[k] = ac->random_state;
#endif /* USE_FIXED */
}
#if USE_FIXED
band_energy = ac->fdsp->scalarproduct_fixed(cfo, cfo, off_len);
band_energy = fixed_sqrt(band_energy, 31);
noise_scale(cfo, sf[idx], band_energy, off_len);
#else
float scale;
for (k = 0; k < off_len; k++) {
ac->random_state = lcg_random(ac->random_state);
cfo[k] = ac->random_state;
}
band_energy = ac->fdsp->scalarproduct_float(cfo, cfo, off_len);
scale = sf[idx] / sqrtf(band_energy);
ac->fdsp->vector_fmul_scalar(cfo, cfo, scale, off_len);
@@ -1958,16 +1947,17 @@ static int decode_ics(AACContext *ac, SingleChannelElement *sce,
global_gain = get_bits(gb, 8);
if (!common_window && !scale_flag) {
if (decode_ics_info(ac, ics, gb) < 0)
return AVERROR_INVALIDDATA;
ret = decode_ics_info(ac, ics, gb);
if (ret < 0)
goto fail;
}
if ((ret = decode_band_types(ac, sce->band_type,
sce->band_type_run_end, gb, ics)) < 0)
return ret;
goto fail;
if ((ret = decode_scalefactors(ac, sce->sf, gb, global_gain, ics,
sce->band_type, sce->band_type_run_end)) < 0)
return ret;
goto fail;
pulse_present = 0;
if (!scale_flag) {
@@ -1975,37 +1965,48 @@ static int decode_ics(AACContext *ac, SingleChannelElement *sce,
if (ics->window_sequence[0] == EIGHT_SHORT_SEQUENCE) {
av_log(ac->avctx, AV_LOG_ERROR,
"Pulse tool not allowed in eight short sequence.\n");
return AVERROR_INVALIDDATA;
ret = AVERROR_INVALIDDATA;
goto fail;
}
if (decode_pulses(&pulse, gb, ics->swb_offset, ics->num_swb)) {
av_log(ac->avctx, AV_LOG_ERROR,
"Pulse data corrupt or invalid.\n");
return AVERROR_INVALIDDATA;
ret = AVERROR_INVALIDDATA;
goto fail;
}
}
tns->present = get_bits1(gb);
if (tns->present && !er_syntax)
if (decode_tns(ac, tns, gb, ics) < 0)
return AVERROR_INVALIDDATA;
if (tns->present && !er_syntax) {
ret = decode_tns(ac, tns, gb, ics);
if (ret < 0)
goto fail;
}
if (!eld_syntax && get_bits1(gb)) {
avpriv_request_sample(ac->avctx, "SSR");
return AVERROR_PATCHWELCOME;
ret = AVERROR_PATCHWELCOME;
goto fail;
}
// I see no textual basis in the spec for this occurring after SSR gain
// control, but this is what both reference and real implmentations do
if (tns->present && er_syntax)
if (decode_tns(ac, tns, gb, ics) < 0)
return AVERROR_INVALIDDATA;
if (tns->present && er_syntax) {
ret = decode_tns(ac, tns, gb, ics);
if (ret < 0)
goto fail;
}
}
if (decode_spectrum_and_dequant(ac, out, gb, sce->sf, pulse_present,
&pulse, ics, sce->band_type) < 0)
return AVERROR_INVALIDDATA;
ret = decode_spectrum_and_dequant(ac, out, gb, sce->sf, pulse_present,
&pulse, ics, sce->band_type);
if (ret < 0)
goto fail;
if (ac->oc[1].m4ac.object_type == AOT_AAC_MAIN && !common_window)
apply_prediction(ac, sce);
return 0;
fail:
tns->present = 0;
return ret;
}
/**
@@ -2177,7 +2178,11 @@ static int decode_cce(AACContext *ac, GetBitContext *gb, ChannelElement *che)
coup->coupling_point += get_bits1(gb) || (coup->coupling_point >> 1);
sign = get_bits(gb, 1);
scale = AAC_RENAME(cce_scale)[get_bits(gb, 2)];
#if USE_FIXED
scale = get_bits(gb, 2);
#else
scale = cce_scale[get_bits(gb, 2)];
#endif
if ((ret = decode_ics(ac, sce, gb, 0, 0)))
return ret;
@@ -2191,6 +2196,10 @@ static int decode_cce(AACContext *ac, GetBitContext *gb, ChannelElement *che)
cge = coup->coupling_point == AFTER_IMDCT ? 1 : get_bits1(gb);
gain = cge ? get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60: 0;
gain_cache = GET_GAIN(scale, gain);
#if USE_FIXED
if ((abs(gain_cache)-1024) >> 3 > 30)
return AVERROR(ERANGE);
#endif
}
if (coup->coupling_point == AFTER_IMDCT) {
coup->gain[c][0] = gain_cache;
@@ -2208,6 +2217,10 @@ static int decode_cce(AACContext *ac, GetBitContext *gb, ChannelElement *che)
t >>= 1;
}
gain_cache = GET_GAIN(scale, t) * s;
#if USE_FIXED
if ((abs(gain_cache)-1024) >> 3 > 30)
return AVERROR(ERANGE);
#endif
}
}
coup->gain[c][idx] = gain_cache;
@@ -2381,7 +2394,7 @@ static int decode_extension_payload(AACContext *ac, GetBitContext *gb, int cnt,
* @param decode 1 if tool is used normally, 0 if tool is used in LTP.
* @param coef spectral coefficients
*/
static void apply_tns(INTFLOAT coef[1024], TemporalNoiseShaping *tns,
static void apply_tns(INTFLOAT coef_param[1024], TemporalNoiseShaping *tns,
IndividualChannelStream *ics, int decode)
{
const int mmm = FFMIN(ics->tns_max_bands, ics->max_sfb);
@@ -2389,6 +2402,10 @@ static void apply_tns(INTFLOAT coef[1024], TemporalNoiseShaping *tns,
int bottom, top, order, start, end, size, inc;
INTFLOAT lpc[TNS_MAX_ORDER];
INTFLOAT tmp[TNS_MAX_ORDER+1];
UINTFLOAT *coef = coef_param;
if(!mmm)
return;
for (w = 0; w < ics->num_windows; w++) {
bottom = ics->num_swb;
@@ -2418,7 +2435,7 @@ static void apply_tns(INTFLOAT coef[1024], TemporalNoiseShaping *tns,
// ar filter
for (m = 0; m < size; m++, start += inc)
for (i = 1; i <= FFMIN(m, order); i++)
coef[start] -= AAC_MUL26(coef[start - i * inc], lpc[i - 1]);
coef[start] -= AAC_MUL26((INTFLOAT)coef[start - i * inc], lpc[i - 1]);
} else {
// ma filter
for (m = 0; m < size; m++, start += inc) {
@@ -2488,7 +2505,7 @@ static void apply_ltp(AACContext *ac, SingleChannelElement *sce)
for (sfb = 0; sfb < FFMIN(sce->ics.max_sfb, MAX_LTP_LONG_SFB); sfb++)
if (ltp->used[sfb])
for (i = offsets[sfb]; i < offsets[sfb + 1]; i++)
sce->coeffs[i] += predFreq[i];
sce->coeffs[i] += (UINTFLOAT)predFreq[i];
}
}
@@ -2554,7 +2571,7 @@ static void imdct_and_windowing(AACContext *ac, SingleChannelElement *sce)
ac->mdct.imdct_half(&ac->mdct, buf, in);
#if USE_FIXED
for (i=0; i<1024; i++)
buf[i] = (buf[i] + 4) >> 3;
buf[i] = (buf[i] + 4LL) >> 3;
#endif /* USE_FIXED */
}
@@ -2633,7 +2650,7 @@ static void imdct_and_windowing_ld(AACContext *ac, SingleChannelElement *sce)
static void imdct_and_windowing_eld(AACContext *ac, SingleChannelElement *sce)
{
INTFLOAT *in = sce->coeffs;
UINTFLOAT *in = sce->coeffs;
INTFLOAT *out = sce->ret;
INTFLOAT *saved = sce->saved;
INTFLOAT *buf = ac->buf_mdct;
@@ -2945,11 +2962,10 @@ static int aac_decode_frame_int(AVCodecContext *avctx, void *data,
{
AACContext *ac = avctx->priv_data;
ChannelElement *che = NULL, *che_prev = NULL;
enum RawDataBlockType elem_type, che_prev_type = TYPE_END;
enum RawDataBlockType elem_type, elem_type_prev = TYPE_END;
int err, elem_id;
int samples = 0, multiplier, audio_found = 0, pce_found = 0;
int is_dmono, sce_count = 0;
int payload_alignment;
ac->frame = data;
@@ -2972,7 +2988,6 @@ static int aac_decode_frame_int(AVCodecContext *avctx, void *data,
// This may lead to an undefined profile being signaled
ac->avctx->profile = ac->oc[1].m4ac.object_type - 1;
payload_alignment = get_bits_count(gb);
ac->tags_mapped = 0;
// parse
while ((elem_type = get_bits(gb, 3)) != TYPE_END) {
@@ -3026,9 +3041,14 @@ static int aac_decode_frame_int(AVCodecContext *avctx, void *data,
case TYPE_PCE: {
uint8_t layout_map[MAX_ELEM_ID*4][3];
int tags;
push_output_configuration(ac);
tags = decode_pce(avctx, &ac->oc[1].m4ac, layout_map, gb,
payload_alignment);
int pushed = push_output_configuration(ac);
if (pce_found && !pushed) {
err = AVERROR_INVALIDDATA;
goto fail;
}
tags = decode_pce(avctx, &ac->oc[1].m4ac, layout_map, gb);
if (tags < 0) {
err = tags;
break;
@@ -3036,7 +3056,6 @@ static int aac_decode_frame_int(AVCodecContext *avctx, void *data,
if (pce_found) {
av_log(avctx, AV_LOG_ERROR,
"Not evaluating a further program_config_element as this construct is dubious at best.\n");
pop_output_configuration(ac);
} else {
err = output_configure(ac, layout_map, tags, OC_TRIAL_PCE, 1);
if (!err)
@@ -3055,7 +3074,7 @@ static int aac_decode_frame_int(AVCodecContext *avctx, void *data,
goto fail;
}
while (elem_id > 0)
elem_id -= decode_extension_payload(ac, gb, elem_id, che_prev, che_prev_type);
elem_id -= decode_extension_payload(ac, gb, elem_id, che_prev, elem_type_prev);
err = 0; /* FIXME */
break;
@@ -3064,10 +3083,8 @@ static int aac_decode_frame_int(AVCodecContext *avctx, void *data,
break;
}
if (elem_type < TYPE_DSE) {
che_prev = che;
che_prev_type = elem_type;
}
che_prev = che;
elem_type_prev = elem_type;
if (err)
goto fail;
@@ -3095,8 +3112,12 @@ static int aac_decode_frame_int(AVCodecContext *avctx, void *data,
ac->oc[1].status = OC_LOCKED;
}
if (multiplier)
avctx->internal->skip_samples_multiplier = 2;
if (multiplier) {
int side_size;
const uint8_t *side = av_packet_get_side_data(avpkt, AV_PKT_DATA_SKIP_SAMPLES, &side_size);
if (side && side_size>=4)
AV_WL32(side, 2*AV_RL32(side));
}
if (!ac->frame->data[0] && samples) {
av_log(avctx, AV_LOG_ERROR, "no frame data found\n");
@@ -3214,7 +3235,7 @@ static av_cold int aac_decode_close(AVCodecContext *avctx)
ff_mdct_end(&ac->mdct_ld);
ff_mdct_end(&ac->mdct_ltp);
#if !USE_FIXED
ff_mdct15_uninit(&ac->mdct480);
ff_imdct15_uninit(&ac->mdct480);
#endif
av_freep(&ac->fdsp);
return 0;

View File

@@ -28,6 +28,7 @@
* TODOs:
* add sane pulse detection
***********************************/
#include <float.h>
#include "libavutil/libm.h"
#include "libavutil/thread.h"
@@ -520,13 +521,13 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
int chan_el_counter[4];
FFPsyWindowInfo windows[AAC_MAX_CHANNELS];
if (s->last_frame == 2)
return 0;
/* add current frame to queue */
if (frame) {
if ((ret = ff_af_queue_add(&s->afq, frame)) < 0)
return ret;
} else {
if (!s->afq.remaining_samples || (!s->afq.frame_alloc && !s->afq.frame_count))
return 0;
}
copy_input_samples(s, frame);
@@ -769,7 +770,7 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
start_ch += chans;
}
if (avctx->flags & AV_CODEC_FLAG_QSCALE) {
if (avctx->flags & CODEC_FLAG_QSCALE) {
/* When using a constant Q-scale, don't mess with lambda */
break;
}
@@ -808,7 +809,7 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
/* Not so fast though */
ratio = sqrtf(ratio);
}
s->lambda = FFMIN(s->lambda * ratio, 65536.f);
s->lambda = av_clipf(s->lambda * ratio, FLT_EPSILON, 65536.f);
/* Keep iterating if we must reduce and lambda is in the sky */
if (ratio > 0.9f && ratio < 1.1f) {
@@ -841,6 +842,9 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
s->lambda_sum += s->lambda;
s->lambda_count++;
if (!frame)
s->last_frame++;
ff_af_queue_remove(&s->afq, avctx->frame_size, &avpkt->pts,
&avpkt->duration);
@@ -853,7 +857,7 @@ static av_cold int aac_encode_end(AVCodecContext *avctx)
{
AACEncContext *s = avctx->priv_data;
av_log(avctx, AV_LOG_INFO, "Qavg: %.3f\n", s->lambda_sum / s->lambda_count);
av_log(avctx, AV_LOG_INFO, "Qavg: %.3f\n", s->lambda_count ? s->lambda_sum / s->lambda_count : NAN);
ff_mdct_end(&s->mdct1024);
ff_mdct_end(&s->mdct128);

View File

@@ -112,6 +112,7 @@ typedef struct AACEncContext {
struct FFPsyPreprocessContext* psypp;
AACCoefficientsEncoder *coder;
int cur_channel; ///< current channel for coder context
int last_frame;
int random_state;
float lambda;
int last_frame_pb_count; ///< number of bits for the previous frame

View File

@@ -409,33 +409,33 @@ static void hybrid_synthesis(PSDSPContext *dsp, INTFLOAT out[2][38][64],
memset(out[0][n], 0, 5*sizeof(out[0][n][0]));
memset(out[1][n], 0, 5*sizeof(out[1][n][0]));
for (i = 0; i < 12; i++) {
out[0][n][0] += in[ i][n][0];
out[1][n][0] += in[ i][n][1];
out[0][n][0] += (UINTFLOAT)in[ i][n][0];
out[1][n][0] += (UINTFLOAT)in[ i][n][1];
}
for (i = 0; i < 8; i++) {
out[0][n][1] += in[12+i][n][0];
out[1][n][1] += in[12+i][n][1];
out[0][n][1] += (UINTFLOAT)in[12+i][n][0];
out[1][n][1] += (UINTFLOAT)in[12+i][n][1];
}
for (i = 0; i < 4; i++) {
out[0][n][2] += in[20+i][n][0];
out[1][n][2] += in[20+i][n][1];
out[0][n][3] += in[24+i][n][0];
out[1][n][3] += in[24+i][n][1];
out[0][n][4] += in[28+i][n][0];
out[1][n][4] += in[28+i][n][1];
out[0][n][2] += (UINTFLOAT)in[20+i][n][0];
out[1][n][2] += (UINTFLOAT)in[20+i][n][1];
out[0][n][3] += (UINTFLOAT)in[24+i][n][0];
out[1][n][3] += (UINTFLOAT)in[24+i][n][1];
out[0][n][4] += (UINTFLOAT)in[28+i][n][0];
out[1][n][4] += (UINTFLOAT)in[28+i][n][1];
}
}
dsp->hybrid_synthesis_deint(out, in + 27, 5, len);
} else {
for (n = 0; n < len; n++) {
out[0][n][0] = in[0][n][0] + in[1][n][0] + in[2][n][0] +
in[3][n][0] + in[4][n][0] + in[5][n][0];
out[1][n][0] = in[0][n][1] + in[1][n][1] + in[2][n][1] +
in[3][n][1] + in[4][n][1] + in[5][n][1];
out[0][n][1] = in[6][n][0] + in[7][n][0];
out[1][n][1] = in[6][n][1] + in[7][n][1];
out[0][n][2] = in[8][n][0] + in[9][n][0];
out[1][n][2] = in[8][n][1] + in[9][n][1];
out[0][n][0] = (UINTFLOAT)in[0][n][0] + in[1][n][0] + in[2][n][0] +
(UINTFLOAT)in[3][n][0] + in[4][n][0] + in[5][n][0];
out[1][n][0] = (UINTFLOAT)in[0][n][1] + in[1][n][1] + in[2][n][1] +
(UINTFLOAT)in[3][n][1] + in[4][n][1] + in[5][n][1];
out[0][n][1] = (UINTFLOAT)in[6][n][0] + in[7][n][0];
out[1][n][1] = (UINTFLOAT)in[6][n][1] + in[7][n][1];
out[0][n][2] = (UINTFLOAT)in[8][n][0] + in[9][n][0];
out[1][n][2] = (UINTFLOAT)in[8][n][1] + in[9][n][1];
}
dsp->hybrid_synthesis_deint(out, in + 7, 3, len);
}
@@ -499,13 +499,13 @@ static void map_idx_34_to_20(int8_t *par_mapped, const int8_t *par, int full)
static void map_val_34_to_20(INTFLOAT par[PS_MAX_NR_IIDICC])
{
#if USE_FIXED
par[ 0] = (int)(((int64_t)(par[ 0] + (par[ 1]>>1)) * 1431655765 + \
par[ 0] = (int)(((int64_t)(par[ 0] + (unsigned)(par[ 1]>>1)) * 1431655765 + \
0x40000000) >> 31);
par[ 1] = (int)(((int64_t)((par[ 1]>>1) + par[ 2]) * 1431655765 + \
par[ 1] = (int)(((int64_t)((par[ 1]>>1) + (unsigned)par[ 2]) * 1431655765 + \
0x40000000) >> 31);
par[ 2] = (int)(((int64_t)(par[ 3] + (par[ 4]>>1)) * 1431655765 + \
par[ 2] = (int)(((int64_t)(par[ 3] + (unsigned)(par[ 4]>>1)) * 1431655765 + \
0x40000000) >> 31);
par[ 3] = (int)(((int64_t)((par[ 4]>>1) + par[ 5]) * 1431655765 + \
par[ 3] = (int)(((int64_t)((par[ 4]>>1) + (unsigned)par[ 5]) * 1431655765 + \
0x40000000) >> 31);
#else
par[ 0] = (2*par[ 0] + par[ 1]) * 0.33333333f;
@@ -692,26 +692,17 @@ static void decorrelation(PSContext *ps, INTFLOAT (*out)[32][2], const INTFLOAT
for (i = 0; i < NR_PAR_BANDS[is34]; i++) {
for (n = n0; n < nL; n++) {
int decayed_peak;
int denom;
decayed_peak = (int)(((int64_t)peak_decay_factor * \
peak_decay_nrg[i] + 0x40000000) >> 31);
peak_decay_nrg[i] = FFMAX(decayed_peak, power[i][n]);
power_smooth[i] += (power[i][n] - power_smooth[i] + 2) >> 2;
peak_decay_diff_smooth[i] += (peak_decay_nrg[i] - power[i][n] - \
peak_decay_diff_smooth[i] + 2) >> 2;
denom = peak_decay_diff_smooth[i] + (peak_decay_diff_smooth[i] >> 1);
if (denom > power_smooth[i]) {
int p = power_smooth[i];
while (denom < 0x40000000) {
denom <<= 1;
p <<= 1;
}
transient_gain[i][n] = p / (denom >> 16);
}
else {
transient_gain[i][n] = 1 << 16;
}
power_smooth[i] += (power[i][n] + 2LL - power_smooth[i]) >> 2;
peak_decay_diff_smooth[i] += (peak_decay_nrg[i] + 2LL - power[i][n] - \
peak_decay_diff_smooth[i]) >> 2;
if (peak_decay_diff_smooth[i]) {
transient_gain[i][n] = FFMIN(power_smooth[i]*43691LL / peak_decay_diff_smooth[i], 1<<16);
} else
transient_gain[i][n] = 1 << 16;
}
}
#else
@@ -942,7 +933,7 @@ static void stereo_processing(PSContext *ps, INTFLOAT (*l)[32][2], INTFLOAT (*r)
int stop = ps->border_position[e+1];
INTFLOAT width = Q30(1.f) / ((stop - start) ? (stop - start) : 1);
#if USE_FIXED
width <<= 1;
width = FFMIN(2U*width, INT_MAX);
#endif
b = k_to_i[k];
h[0][0] = H11[0][e][b];
@@ -975,7 +966,7 @@ static void stereo_processing(PSContext *ps, INTFLOAT (*l)[32][2], INTFLOAT (*r)
h_step[1][3] = AAC_MSUB31_V3(H22[1][e+1][b], h[1][3], width);
}
ps->dsp.stereo_interpolate[!PS_BASELINE && ps->enable_ipdopd](
l[k] + start + 1, r[k] + start + 1,
l[k] + 1 + start, r[k] + 1 + start,
h, h_step, stop - start);
}
}

View File

@@ -54,10 +54,10 @@ static void ps_hybrid_analysis_c(INTFLOAT (*out)[2], INTFLOAT (*in)[2],
INT64FLOAT sum_im = (INT64FLOAT)filter[i][6][0] * in[6][1];
for (j = 0; j < 6; j++) {
INTFLOAT in0_re = in[j][0];
INTFLOAT in0_im = in[j][1];
INTFLOAT in1_re = in[12-j][0];
INTFLOAT in1_im = in[12-j][1];
INT64FLOAT in0_re = in[j][0];
INT64FLOAT in0_im = in[j][1];
INT64FLOAT in1_re = in[12-j][0];
INT64FLOAT in1_im = in[12-j][1];
sum_re += (INT64FLOAT)filter[i][j][0] * (in0_re + in1_re) -
(INT64FLOAT)filter[i][j][1] * (in0_im - in1_im);
sum_im += (INT64FLOAT)filter[i][j][0] * (in0_im + in1_im) +
@@ -129,12 +129,12 @@ static void ps_decorrelate_c(INTFLOAT (*out)[2], INTFLOAT (*delay)[2],
INTFLOAT apd_im = in_im;
in_re = AAC_MSUB30(link_delay_re, fractional_delay_re,
link_delay_im, fractional_delay_im);
in_re -= a_re;
in_re -= (UINTFLOAT)a_re;
in_im = AAC_MADD30(link_delay_re, fractional_delay_im,
link_delay_im, fractional_delay_re);
in_im -= a_im;
ap_delay[m][n+5][0] = apd_re + AAC_MUL31(ag[m], in_re);
ap_delay[m][n+5][1] = apd_im + AAC_MUL31(ag[m], in_im);
in_im -= (UINTFLOAT)a_im;
ap_delay[m][n+5][0] = apd_re + (UINTFLOAT)AAC_MUL31(ag[m], in_re);
ap_delay[m][n+5][1] = apd_im + (UINTFLOAT)AAC_MUL31(ag[m], in_im);
}
out[n][0] = AAC_MUL16(transient_gain[n], in_re);
out[n][1] = AAC_MUL16(transient_gain[n], in_im);
@@ -149,10 +149,10 @@ static void ps_stereo_interpolate_c(INTFLOAT (*l)[2], INTFLOAT (*r)[2],
INTFLOAT h1 = h[0][1];
INTFLOAT h2 = h[0][2];
INTFLOAT h3 = h[0][3];
INTFLOAT hs0 = h_step[0][0];
INTFLOAT hs1 = h_step[0][1];
INTFLOAT hs2 = h_step[0][2];
INTFLOAT hs3 = h_step[0][3];
UINTFLOAT hs0 = h_step[0][0];
UINTFLOAT hs1 = h_step[0][1];
UINTFLOAT hs2 = h_step[0][2];
UINTFLOAT hs3 = h_step[0][3];
int n;
for (n = 0; n < len; n++) {
@@ -180,10 +180,10 @@ static void ps_stereo_interpolate_ipdopd_c(INTFLOAT (*l)[2], INTFLOAT (*r)[2],
INTFLOAT h01 = h[0][1], h11 = h[1][1];
INTFLOAT h02 = h[0][2], h12 = h[1][2];
INTFLOAT h03 = h[0][3], h13 = h[1][3];
INTFLOAT hs00 = h_step[0][0], hs10 = h_step[1][0];
INTFLOAT hs01 = h_step[0][1], hs11 = h_step[1][1];
INTFLOAT hs02 = h_step[0][2], hs12 = h_step[1][2];
INTFLOAT hs03 = h_step[0][3], hs13 = h_step[1][3];
UINTFLOAT hs00 = h_step[0][0], hs10 = h_step[1][0];
UINTFLOAT hs01 = h_step[0][1], hs11 = h_step[1][1];
UINTFLOAT hs02 = h_step[0][2], hs12 = h_step[1][2];
UINTFLOAT hs03 = h_step[0][3], hs13 = h_step[1][3];
int n;
for (n = 0; n < len; n++) {

View File

@@ -303,18 +303,21 @@ static av_cold int psy_3gpp_init(FFPsyContext *ctx) {
float bark;
int i, j, g, start;
float prev, minscale, minath, minsnr, pe_min;
int chan_bitrate = ctx->avctx->bit_rate / ((ctx->avctx->flags & AV_CODEC_FLAG_QSCALE) ? 2.0f : ctx->avctx->channels);
int chan_bitrate = ctx->avctx->bit_rate / ((ctx->avctx->flags & CODEC_FLAG_QSCALE) ? 2.0f : ctx->avctx->channels);
const int bandwidth = ctx->cutoff ? ctx->cutoff : AAC_CUTOFF(ctx->avctx);
const float num_bark = calc_bark((float)bandwidth);
if (bandwidth <= 0)
return AVERROR(EINVAL);
ctx->model_priv_data = av_mallocz(sizeof(AacPsyContext));
if (!ctx->model_priv_data)
return AVERROR(ENOMEM);
pctx = ctx->model_priv_data;
pctx = (AacPsyContext*) ctx->model_priv_data;
pctx->global_quality = (ctx->avctx->global_quality ? ctx->avctx->global_quality : 120) * 0.01f;
if (ctx->avctx->flags & AV_CODEC_FLAG_QSCALE) {
if (ctx->avctx->flags & CODEC_FLAG_QSCALE) {
/* Use the target average bitrate to compute spread parameters */
chan_bitrate = (int)(chan_bitrate / 120.0 * (ctx->avctx->global_quality ? ctx->avctx->global_quality : 120));
}
@@ -704,7 +707,7 @@ static void psy_3gpp_analyze_channel(FFPsyContext *ctx, int channel,
/* 5.6.1.3.2 "Calculation of the desired perceptual entropy" */
ctx->ch[channel].entropy = pe;
if (ctx->avctx->flags & AV_CODEC_FLAG_QSCALE) {
if (ctx->avctx->flags & CODEC_FLAG_QSCALE) {
/* (2.5 * 120) achieves almost transparent rate, and we want to give
* ample room downwards, so we make that equivalent to QSCALE=2.4
*/
@@ -794,7 +797,7 @@ static void psy_3gpp_analyze_channel(FFPsyContext *ctx, int channel,
if (pe < 1.15f * desired_pe) {
/* 6.6.1.3.6 "Final threshold modification by linearization" */
norm_fac = 1.0f / norm_fac;
norm_fac = norm_fac ? 1.0f / norm_fac : 0;
for (w = 0; w < wi->num_windows*16; w += 16) {
for (g = 0; g < num_bands; g++) {
AacPsyBand *band = &pch->band[w+g];

View File

@@ -81,7 +81,7 @@ static const int8_t vlc_sbr_lav[10] =
/** Initialize SBR. */
void AAC_RENAME(ff_aac_sbr_init)(void);
/** Initialize one SBR context. */
void AAC_RENAME(ff_aac_sbr_ctx_init)(AACContext *ac, SpectralBandReplication *sbr, int id_aac);
void AAC_RENAME(ff_aac_sbr_ctx_init)(AACContext *ac, SpectralBandReplication *sbr);
/** Close one SBR context. */
void AAC_RENAME(ff_aac_sbr_ctx_close)(SpectralBandReplication *sbr);
/** Decode one SBR element. */

View File

@@ -288,6 +288,8 @@ static void sbr_hf_inverse_filter(SBRDSPContext *dsp,
shift = a00.exp;
if (shift >= 3)
alpha0[k][0] = 0x7fffffff;
else if (shift <= -30)
alpha0[k][0] = 0;
else {
a00.mant <<= 1;
shift = 2-shift;
@@ -302,6 +304,8 @@ static void sbr_hf_inverse_filter(SBRDSPContext *dsp,
shift = a01.exp;
if (shift >= 3)
alpha0[k][1] = 0x7fffffff;
else if (shift <= -30)
alpha0[k][1] = 0;
else {
a01.mant <<= 1;
shift = 2-shift;
@@ -315,6 +319,8 @@ static void sbr_hf_inverse_filter(SBRDSPContext *dsp,
shift = a10.exp;
if (shift >= 3)
alpha1[k][0] = 0x7fffffff;
else if (shift <= -30)
alpha1[k][0] = 0;
else {
a10.mant <<= 1;
shift = 2-shift;
@@ -329,6 +335,8 @@ static void sbr_hf_inverse_filter(SBRDSPContext *dsp,
shift = a11.exp;
if (shift >= 3)
alpha1[k][1] = 0x7fffffff;
else if (shift <= -30)
alpha1[k][1] = 0;
else {
a11.mant <<= 1;
shift = 2-shift;
@@ -429,6 +437,7 @@ static void sbr_gain_calc(AACContext *ac, SpectralBandReplication *sbr,
av_add_sf(FLOAT_1, sbr->e_curr[e][m]),
av_add_sf(FLOAT_1, sbr->q_mapped[e][m]))));
}
sbr->gain[e][m] = av_add_sf(sbr->gain[e][m], FLOAT_MIN);
}
for (m = sbr->f_tablelim[k] - sbr->kx[1]; m < sbr->f_tablelim[k + 1] - sbr->kx[1]; m++) {
sum[0] = av_add_sf(sum[0], sbr->e_origmapped[e][m]);
@@ -562,25 +571,39 @@ static void sbr_hf_assemble(int Y1[38][64][2],
int idx = indexsine&1;
int A = (1-((indexsine+(kx & 1))&2));
int B = (A^(-idx)) + idx;
int *out = &Y1[i][kx][idx];
int shift, round;
unsigned *out = &Y1[i][kx][idx];
int shift;
unsigned round;
SoftFloat *in = sbr->s_m[e];
for (m = 0; m+1 < m_max; m+=2) {
shift = 22 - in[m ].exp;
round = 1 << (shift-1);
out[2*m ] += (in[m ].mant * A + round) >> shift;
int shift2;
shift = 22 - in[m ].exp;
shift2= 22 - in[m+1].exp;
if (shift < 1 || shift2 < 1) {
av_log(NULL, AV_LOG_ERROR, "Overflow in sbr_hf_assemble, shift=%d,%d\n", shift, shift2);
return;
}
if (shift < 32) {
round = 1 << (shift-1);
out[2*m ] += (int)(in[m ].mant * A + round) >> shift;
}
shift = 22 - in[m+1].exp;
round = 1 << (shift-1);
out[2*m+2] += (in[m+1].mant * B + round) >> shift;
if (shift2 < 32) {
round = 1 << (shift2-1);
out[2*m+2] += (int)(in[m+1].mant * B + round) >> shift2;
}
}
if(m_max&1)
{
shift = 22 - in[m ].exp;
round = 1 << (shift-1);
out[2*m ] += (in[m ].mant * A + round) >> shift;
shift = 22 - in[m ].exp;
if (shift < 1) {
av_log(NULL, AV_LOG_ERROR, "Overflow in sbr_hf_assemble, shift=%d\n", shift);
return;
} else if (shift < 32) {
round = 1 << (shift-1);
out[2*m ] += (int)(in[m ].mant * A + round) >> shift;
}
}
}
indexnoise = (indexnoise + m_max) & 0x1ff;

View File

@@ -81,12 +81,11 @@ static void sbr_turnoff(SpectralBandReplication *sbr) {
memset(&sbr->spectrum_params, -1, sizeof(SpectrumParameters));
}
av_cold void AAC_RENAME(ff_aac_sbr_ctx_init)(AACContext *ac, SpectralBandReplication *sbr, int id_aac)
av_cold void AAC_RENAME(ff_aac_sbr_ctx_init)(AACContext *ac, SpectralBandReplication *sbr)
{
if(sbr->mdct.mdct_bits)
return;
sbr->kx[0] = sbr->kx[1];
sbr->id_aac = id_aac;
sbr_turnoff(sbr);
sbr->data[0].synthesis_filterbank_samples_offset = SBR_SYNTHESIS_BUF_SIZE - (1280 - 128);
sbr->data[1].synthesis_filterbank_samples_offset = SBR_SYNTHESIS_BUF_SIZE - (1280 - 128);
@@ -624,24 +623,26 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
int abs_bord_trail = 16;
int num_rel_lead, num_rel_trail;
unsigned bs_num_env_old = ch_data->bs_num_env;
int bs_frame_class, bs_num_env;
ch_data->bs_freq_res[0] = ch_data->bs_freq_res[ch_data->bs_num_env];
ch_data->bs_amp_res = sbr->bs_amp_res_header;
ch_data->t_env_num_env_old = ch_data->t_env[bs_num_env_old];
switch (ch_data->bs_frame_class = get_bits(gb, 2)) {
switch (bs_frame_class = get_bits(gb, 2)) {
case FIXFIX:
ch_data->bs_num_env = 1 << get_bits(gb, 2);
bs_num_env = 1 << get_bits(gb, 2);
if (bs_num_env > 4) {
av_log(ac->avctx, AV_LOG_ERROR,
"Invalid bitstream, too many SBR envelopes in FIXFIX type SBR frame: %d\n",
bs_num_env);
return -1;
}
ch_data->bs_num_env = bs_num_env;
num_rel_lead = ch_data->bs_num_env - 1;
if (ch_data->bs_num_env == 1)
ch_data->bs_amp_res = 0;
if (ch_data->bs_num_env > 4) {
av_log(ac->avctx, AV_LOG_ERROR,
"Invalid bitstream, too many SBR envelopes in FIXFIX type SBR frame: %d\n",
ch_data->bs_num_env);
return -1;
}
ch_data->t_env[0] = 0;
ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail;
@@ -689,14 +690,15 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
abs_bord_trail += get_bits(gb, 2);
num_rel_lead = get_bits(gb, 2);
num_rel_trail = get_bits(gb, 2);
ch_data->bs_num_env = num_rel_lead + num_rel_trail + 1;
bs_num_env = num_rel_lead + num_rel_trail + 1;
if (ch_data->bs_num_env > 5) {
if (bs_num_env > 5) {
av_log(ac->avctx, AV_LOG_ERROR,
"Invalid bitstream, too many SBR envelopes in VARVAR type SBR frame: %d\n",
ch_data->bs_num_env);
bs_num_env);
return -1;
}
ch_data->bs_num_env = bs_num_env;
ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail;
@@ -711,6 +713,7 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
get_bits1_vector(gb, ch_data->bs_freq_res + 1, ch_data->bs_num_env);
break;
}
ch_data->bs_frame_class = bs_frame_class;
av_assert0(bs_pointer >= 0);
if (bs_pointer > ch_data->bs_num_env + 1) {
@@ -941,8 +944,14 @@ static void read_sbr_extension(AACContext *ac, SpectralBandReplication *sbr,
skip_bits_long(gb, *num_bits_left); // bs_fill_bits
*num_bits_left = 0;
} else {
#if 1
*num_bits_left -= AAC_RENAME(ff_ps_read_data)(ac->avctx, gb, &sbr->ps, *num_bits_left);
ac->avctx->profile = FF_PROFILE_AAC_HE_V2;
#else
avpriv_report_missing_feature(ac->avctx, "Parametric Stereo");
skip_bits_long(gb, *num_bits_left); // bs_fill_bits
*num_bits_left = 0;
#endif
}
break;
default:
@@ -1137,7 +1146,6 @@ int AAC_RENAME(ff_decode_sbr_extension)(AACContext *ac, SpectralBandReplication
if (bytes_read > cnt) {
av_log(ac->avctx, AV_LOG_ERROR,
"Expected to read %d SBR bytes actually read %d.\n", cnt, bytes_read);
sbr_turnoff(sbr);
}
return cnt;
}

View File

@@ -139,10 +139,10 @@ DECLARE_ALIGNED(32, extern float, ff_aac_kbd_short_128)[128];
DECLARE_ALIGNED(32, extern int, ff_aac_kbd_long_1024_fixed)[1024];
DECLARE_ALIGNED(32, extern int, ff_aac_kbd_long_512_fixed)[512];
DECLARE_ALIGNED(32, extern int, ff_aac_kbd_short_128_fixed)[128];
DECLARE_ALIGNED(32, extern const float, ff_aac_eld_window_512)[1920];
DECLARE_ALIGNED(32, extern const int, ff_aac_eld_window_512_fixed)[1920];
DECLARE_ALIGNED(32, extern const float, ff_aac_eld_window_480)[1800];
DECLARE_ALIGNED(32, extern const int, ff_aac_eld_window_480_fixed)[1800];
const DECLARE_ALIGNED(32, extern float, ff_aac_eld_window_512)[1920];
const DECLARE_ALIGNED(32, extern int, ff_aac_eld_window_512_fixed)[1920];
const DECLARE_ALIGNED(32, extern float, ff_aac_eld_window_480)[1800];
const DECLARE_ALIGNED(32, extern int, ff_aac_eld_window_480_fixed)[1800];
// @}
/* @name number of scalefactor window bands for long and short transform windows respectively

View File

@@ -6,6 +6,7 @@ OBJS-$(CONFIG_H264DSP) += aarch64/h264dsp_init_aarch64.o
OBJS-$(CONFIG_H264PRED) += aarch64/h264pred_init.o
OBJS-$(CONFIG_H264QPEL) += aarch64/h264qpel_init_aarch64.o
OBJS-$(CONFIG_HPELDSP) += aarch64/hpeldsp_init_aarch64.o
OBJS-$(CONFIG_IMDCT15) += aarch64/imdct15_init.o
OBJS-$(CONFIG_MPEGAUDIODSP) += aarch64/mpegaudiodsp_init.o
OBJS-$(CONFIG_NEON_CLOBBER_TEST) += aarch64/neontest.o
OBJS-$(CONFIG_VIDEODSP) += aarch64/videodsp_init.o
@@ -15,9 +16,6 @@ OBJS-$(CONFIG_DCA_DECODER) += aarch64/synth_filter_init.o
OBJS-$(CONFIG_RV40_DECODER) += aarch64/rv40dsp_init_aarch64.o
OBJS-$(CONFIG_VC1DSP) += aarch64/vc1dsp_init_aarch64.o
OBJS-$(CONFIG_VORBIS_DECODER) += aarch64/vorbisdsp_init.o
OBJS-$(CONFIG_VP9_DECODER) += aarch64/vp9dsp_init_10bpp_aarch64.o \
aarch64/vp9dsp_init_12bpp_aarch64.o \
aarch64/vp9dsp_init_aarch64.o
# ARMv8 optimizations
@@ -36,17 +34,10 @@ NEON-OBJS-$(CONFIG_H264PRED) += aarch64/h264pred_neon.o
NEON-OBJS-$(CONFIG_H264QPEL) += aarch64/h264qpel_neon.o \
aarch64/hpeldsp_neon.o
NEON-OBJS-$(CONFIG_HPELDSP) += aarch64/hpeldsp_neon.o
NEON-OBJS-$(CONFIG_IDCTDSP) += aarch64/idctdsp_init_aarch64.o \
aarch64/simple_idct_neon.o
NEON-OBJS-$(CONFIG_IMDCT15) += aarch64/imdct15_neon.o
NEON-OBJS-$(CONFIG_MDCT) += aarch64/mdct_neon.o
NEON-OBJS-$(CONFIG_MPEGAUDIODSP) += aarch64/mpegaudiodsp_neon.o
# decoders/encoders
NEON-OBJS-$(CONFIG_DCA_DECODER) += aarch64/synth_filter_neon.o
NEON-OBJS-$(CONFIG_VORBIS_DECODER) += aarch64/vorbisdsp_neon.o
NEON-OBJS-$(CONFIG_VP9_DECODER) += aarch64/vp9itxfm_16bpp_neon.o \
aarch64/vp9itxfm_neon.o \
aarch64/vp9lpf_16bpp_neon.o \
aarch64/vp9lpf_neon.o \
aarch64/vp9mc_16bpp_neon.o \
aarch64/vp9mc_neon.o

Some files were not shown because too many files have changed in this diff Show More