Welcome to mirror list, hosted at ThFree Co, Russian Federation.

github.com/FFmpeg/FFmpeg.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
path: root/libavcodec
AgeCommit message (Collapse)Author
2019-09-29avcodec/qtrleenc: fix undefined behaviourPaul B Mahol
Fixes #7991.
2019-09-29avcodec/cbs_av1: Make overread check more robustAndreas Rheinhardt
When performing a comparison of a signed int and an unsigned int, the signed int is first converted to an unsigned int, so that negative values are being treated as big, positive values. This can become a problem in an overread check, namely when an overread already happened. So change the type of the variable containing the amount of bits that need to be left to signed. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2019-09-29avcodec/cbs_h2645: Fix potential out-of-bounds array accessAndreas Rheinhardt
The maximum allowed index for an array access is FF_ARRAY_ELEMS - 1; yet the current code allowed FF_ARRAY_ELEMS. This wasn't dangerous in practice, as parameter sets with invalid ids were already filtered out during reading. Found via PVS-Studio (see ticket #8156). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2019-09-29avcodec/fitsdec: fix use of uninitialised valuesJames Almer
header.data_max and header.data_min are not necessarely set on all decoding scenarios. Fixes a Valgrind reported regression since cfa193779103c97bbfc28273a0ab12c114b6786d. Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: James Almer <jamrial@gmail.com>
2019-09-28avcodec/motionpixels: Mark 2 functions as always_inlineMichael Niedermayer
Fixes: Timeout (30sec -> 25sec) Fixes: 17050/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOTIONPIXELS_fuzzer-5719149803732992 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-28avcodec/ituh263dec: Make the condition for the studio slice start code match ↵Michael Niedermayer
between ff_h263_resync() and ff_mpeg4_decode_studio_slice_header() If they mismatch an infinite loop can occur Fixes: Timeout (infinite loop) Fixes: 17043/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5695051748868096 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-28avcodec/ralf: Fix integer overflow in decode_channel()Michael Niedermayer
Fixes: signed integer overflow: -1094995519 * 64 cannot be represented in type 'int' Fixes: 17030/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5640695838146560 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-28vcodec/vc1: compute rangex/y only for P/B framesMichael Niedermayer
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int' Fixes: 16976/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-4847262047404032 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-28avcodec/vc1_pred: Fix invalid shifts in scaleforopp()Michael Niedermayer
Fixes: left shift of negative value -2 Fixes: 16964/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5757853565976576 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-28avcodec/vc1_block: Fix invalid shift with rangeredfrmMichael Niedermayer
Fixes: left shift of negative value -7 Fixes: 16959/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-5200360825683968 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-28avcodec/vc1: Check for excessive resolutionMichael Niedermayer
Fixes: overflow in aspect ratio calculation Fixes: signed integer overflow: 393215 * 14594 cannot be represented in type 'int' Fixes: 15728/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5661588893204480 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-28avcodec/vc1: check REFDISTMichael Niedermayer
"9.1.1.43 P Reference Distance (REFDIST)" "The value of REFDIST shall be less than, or equal to, 16." Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-28avcodec/apedec: Allocate decoded_buffer after successful ff_get_buffer()Michael Niedermayer
We need to reset samples in this case to avoid being stuck with incorrect samples value. Fixes: OOM Fixes: Timeout Fixes: 16627/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5638059583864832 Fixes: 17089/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5672188463546368 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-28avcodec/apedec: Fix several integer overflows in predictor_update_filter() ↵Michael Niedermayer
and do_apply_filter() Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself Fixes: signed integer overflow: -14527961 - 2147483425 cannot be represented in type 'int' Fixes: 16380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5645957131141120 Fixes: 16968/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5716169901735936 Fixes: 17074/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5198710497083392 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-28avcodec/hevc_cabac: Tighten the limit on k in ff_hevc_cu_qp_delta_abs()Michael Niedermayer
Values larger would fail subsequent tests. Fixes: signed integer overflow: 5 + 2147483646 cannot be represented in type 'int' Fixes: 16966/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5695709549953024 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-28avcodec/jpeg2000dwt: Fix undefined shifts of negative numbersAndreas Rheinhardt
Affected the vsynth*-jpeg2000 and the vsynth*-jpeg2000-97 FATE tests (where * ranges over { 1, 2, 3, _lena }) as well as ticket #7983. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-28avcodec/ituh263dec: Fix undefined left shift of negative numberAndreas Rheinhardt
Fixes ticket #8160. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-28avcodec/dnxhdenc: Fix undefined left shifts of negative numbersAndreas Rheinhardt
Affected 61 FATE-tests: 60 vsynth tests and lavf-mxf_opatom. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-28avcodec/ffv1enc: Fix out-of-bounds-array accessAndreas Rheinhardt
libavcodec/ffv1enc.c accessed an array of uint8_t [32] via array[0][j] in order to loop over all the uint8_t in this array of arrays. Of course this implied an out-of-bounds access for array[0] and UBSan complained about this. So replace this with nested loops; furthermore, factor this out into a function of its own to easily break out of the nested loops. This affected the FATE-tests vsynth1-ffv1, vsynth1-ffv1-v3-yuv420p, vsynth1-ffv1-v3-yuv422p10, vsynth1-ffv1-v3-yuv444p16, vsynth1-ffv1-v3-bgr0, vsynth1-ffv1-ffv1-v3-rgb48 as well as the corresponding vsynth2-*, vsynth3-* and the vsynth_lena-* tests. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-27avcodec/nvenc: make use of new GetLastErrorString functionTimo Rothenpieler
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org>
2019-09-27avcodec/nvenc: pass CUstream to nvenc when availableTimo Rothenpieler
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org>
2019-09-27avcodec/nvenc: add multiple reference frames supportRoman Arzumanyan
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org>
2019-09-27avcodec/nvenc: switch to dedicated dpb_size optionTimo Rothenpieler
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org>
2019-09-27lavc/mpeg4audio: add chan_config check to avoid indeterminate channelsJun Zhao
add chan_config check to avoid indeterminate channels. Signed-off-by: Jun Zhao <barryjzhao@tencent.com> Signed-off-by: James Almer <jamrial@gmail.com>
2019-09-27avcodec/mpeg4audio: fix doxy for ff_mpeg4audio_get_config_gb()James Almer
Signed-off-by: James Almer <jamrial@gmail.com>
2019-09-27avcodec: use avpriv_mpeg4audio_get_config2()James Almer
Signed-off-by: James Almer <jamrial@gmail.com>
2019-09-27avcodec/mpeg4audio: add avpriv_mpeg4audio_get_config2()James Almer
Identical to avpriv_mpeg4audio_get_config() except taking a size argument in bytes, and featuring a new logging context paremeter. Schedule avpriv_mpeg4audio_get_config() for removal as soon as major is bumped as well. Signed-off-by: James Almer <jamrial@gmail.com>
2019-09-26avcodec/4xm: Check index in decode_i_block() also in the path where its not ↵Michael Niedermayer
used. Fixes: Infinite loop Fixes: signed integer overflow: 2147483644 + 16 cannot be represented in type 'int' Fixes: 16169/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5662570416963584 Fixes: 16782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5743163859271680 Fixes: 17641/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5711603562971136 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-26avcodec/loco: Check for end of input in the first lineMichael Niedermayer
Fixes: Timeout (85sec -> 0.1sec) Fixes: 17634/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5666410809786368 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-26avcodec/atrac3: Check block_alignMichael Niedermayer
Fixes: Infinite loop Fixes: 17620/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3_fuzzer-5086123012915200 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-26avcodec/alsdec: Avoid dereferencing context pointer in inner interleave loopMichael Niedermayer
This makes the decoder faster Improves/Fixes: Timeout (22sec -> 20sec) Testcase: 17619/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5078510820917248 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-26avcodec/hcom: Check that there are dictionary entriesMichael Niedermayer
Fixes: out of array read Fixes: 17617/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCOM_fuzzer-5674970478280704 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-26avcodec/fitsdec: Prevent division by 0 with huge data_maxMichael Niedermayer
Fixes: division by 0 Fixes: 15657/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5738154838982656 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-26avcodec/dstdec: Fix integer overflow in samples_per_frame computationMichael Niedermayer
Fixes: Timeout (? -> 2ms) Fixes: 17616/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5198057947267072 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-26avcodec/g729_parser: Check block_sizeMichael Niedermayer
Fixes: Infinite loop Fixes: 17611/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5765134928052224 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-26avcodec/sbcdec: Initialize number of channelsMichael Niedermayer
Fixes: out of array access Fixes: 17609/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SBC_fuzzer-5758729319874560 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Reviewed-by: Moritz Barsnick <barsnick@gmx.net> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-26avcodec/exr: Fix undefined left shifts of negative numbersAndreas Rheinhardt
Affected the FATE-tests exr-rgb-scanline-pxr24-half-uint32-13x9 and exr-rgb-scanline-pxr24-uint32. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-26avcodec/hevc_ps: Remove dead code in vps_id checkAndriy Gelman
Since reading 4 bits always returns a value in the range [0, 15], the check for vps_id >= HEVC_MAX_VPS_COUNT, where HEVC_MAX_VPS_COUNT = 16, is redundant. Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com> Signed-off-by: James Almer <jamrial@gmail.com>
2019-09-26avcodec/truespeech: fix left shift of negative valuePaul B Mahol
2019-09-26avcodec/mpeg12dec: Sanitize start codes earlierAndreas Rheinhardt
The MPEG-1/2 decoder uses avpriv_find_start_code to search for start codes and worked with the resulting start code before checking that it is really a start code of a slice. In particular, if the picture is so big that a slice_vertical_position_extension is present, it added the slice_vertical_position_extension as if it had a slice. Then a left shift is performed, without making sure that the value to be shifted is nonnegative. Afterwards the end result is checked, but even if a start code of a non-slice has been found, it might pass these checks: If slice_vertical_position_extension is present a start code < SLICE_MIN_START_CODE can lead to a macroblock-row index that appears valid. Furthermore, the left shift might make an invalid start code appear valid by discarding the highest bit. This has been fixed by checking directly after avpriv_find_start_code has returned. Fixes ticket #8162 (which is about the undefined left shifts). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2019-09-26avcodec/pcm: CosmeticsAndreas Rheinhardt
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2019-09-26avcodec/pcm: Fix undefined shiftsAndreas Rheinhardt
Fixes the acodec-pcm-u16[lb]e FATE-tests. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2019-09-26avcodec/wavpackenc: Fix undefined shiftsAndreas Rheinhardt
Fixes ticket #8161 and the acodec-wavpack FATE-test. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2019-09-26lavc/qsv: add memory type messageZhong Li
Signed-off-by: Zhong Li <zhong.li@intel.com>
2019-09-26lavc/qsv: Fix MSDK initialization failure in system memory modeZhong Li
MSDK does not create internal acceleration device on Linux, So MFXVideoCORE_SetHandle() is necessary. It has been added for ff_qsv_init_session_device(). But missed for ff_qsv_init_internal_session() due to commit 1f26a23 overwrited commit db89f45 Fix #7030 Signed-off-by: Zhong Li <zhong.li@intel.com>
2019-09-26Revert "lavc/tiff: correct the default value of YCbCrSubsampling to 2x2"Carl Eugen Hoyos
This reverts commit eb5d0f18ff609ba2280cea4e2c6286d216c8756b. Together with 89f464e9, it breaks decoding of tiff files like fate-suite/exif/image_small.tiff
2019-09-25avcodec/dnxhdenc: return error if av_malloc failedLimin Wang
Signed-off-by: Limin Wang <lance.lmwang@gmail.com> Signed-off-by: James Almer <jamrial@gmail.com>
2019-09-25avcodec/decode: Check max_samples in get_buffer_internal()Michael Niedermayer
This checks max_samples at the same level as max_pixels Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-25avcodec: add max_samplesMichael Niedermayer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-09-25lavc/tiff: correct the default value of YCbCrSubsampling to 2x2Pavel Skakov
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-29 04:58:07 +0300