jellyfin/jellyfin-ffmpeg
1
0
Fork 0
mirror of https://github.com/jellyfin/jellyfin-ffmpeg.git synced 2024-10-07 03:13:23 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

New upstream version 4.0.2

Browse Source
This commit is contained in:
James Cowgill 2018-07-21 14:27:51 +01:00
parent 2ec5d73f71
commit eef9464d44
35 changed files with 329 additions and 133 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
Changelog
View File

@ -1,6 +1,53 @@
Entries are sorted chronologically from oldest to youngest within each release,
releases are sorted from youngest to oldest.
version 4.0.2:
- avcodec/dvdsub_parser: Allocate input padding
- avcodec/dvdsub_parser: Init output buf/size
- avcodec/dirac_dwt_template: Fix signedness regression in interleave()
- avformat/mov: Simplify last element computation in mov_estimate_video_delay()
- avformat/mov: Break out of inner loop early in mov_estimate_video_delay()
- avformat/mov: Eliminate variable buf_size from mov_estimate_video_delay()
- avformat/mov: remove modulo operations from mov_estimate_video_delay()
- avformat/movenc: Write version 2 of audio atom if channels is not known
- swresample/arm: rename labels to fix xcode build error
- avformat/movenc: Check input sample count
- avcodec/mjpegdec: Check for odd progressive RGB
- avcodec/vp8_parser: Do not leave data/size uninitialized
- avformat/mms: Add missing chunksize check
- avformat/pva: Check for EOF before retrying in read_part_of_packet()
- avformat/rmdec: Do not pass mime type in rm_read_multi() to ff_rm_read_mdpr_codecdata()
- avformat/asfdec_o: Check size_bmp more fully
- avformat/mxfdec: Fix av_log context
- avcodec/mpeg4videodec: Check for bitstream end in read_quant_matrix_ext()
- avcodec/indeo4: Check for end of bitstream in decode_mb_info()
- avcodec/ac3dec: Check channel_map index
- avcodec/mpeg4videodec: Remove use of FF_PROFILE_MPEG4_SIMPLE_STUDIO as indicator of studio profile
- avcodec/shorten: Fix undefined addition in shorten_decode_frame()
- avcodec/shorten: Fix undefined integer overflow
- avcodec/jpeg2000dec: Fixes invalid shifts in jpeg2000_decode_packets_po_iteration()
- avcodec/jpeg2000dec: Check that there are enough bytes for all tiles
- avformat/movenc: Use mov->fc consistently for av_log()
- avcodec/mpeg4videodec: Check read profile before setting it
- avformat/movenc: Do not pass AVCodecParameters in avpriv_request_sample
- avcodec/ac3_parser: Check init_get_bits8() for failure
- avformat/movenc: Check that frame_types other than EAC3_FRAME_TYPE_INDEPENDENT have a supported substream id
- avcodec/dpx: Check elements in 12bps planar path
- avcodec/escape124: Fix spelling errors in comment
- avcodec/ra144: Fix integer overflow in ff_eval_refl()
- avcodec/cscd: Check output buffer size for lzo.
- avcodec/escape124: Check buf_size against num_superblocks
- avcodec/h264_parser: Reduce needed history for parsing mb index
- avcodec/magicyuv: Check bits left in flags&1 branch
- avcodec/mjpegdec: Check for end of bitstream in ljpeg_decode_rgb_scan()
- ffmpeg: fix -stream_loop with multiple inputs
- ffmpeg: factorize input thread creation and destruction
- avformat/mpegts: parse large PMTs with multiple tables
- Revert "avcodec/mediacodecdec: wait on first frame after input buffers are full"
- avcodec/videotoolboxenc: fix invalid session on iOS
- avcodec/videotoolboxenc: split initialization
- avcodec/videotoolboxenc: fix mutex/cond leak in error path
version 4.0.1:
- avcodec/aacdec_fixed: Fix undefined integer overflow in apply_independent_coupling_fixed()
- avcodec/dirac_dwt_template: Fix undefined behavior in interleave()

2
RELEASE
View File

@ -1 +1 @@
4.0.1
4.0.2

2
VERSION
View File

@ -1 +1 @@
4.0.1
4.0.2

2
doc/Doxyfile
View File

@ -38,7 +38,7 @@ PROJECT_NAME = FFmpeg
# could be handy for archiving the generated documentation or if some version
# control system is used.
PROJECT_NUMBER = 4.0.1
PROJECT_NUMBER = 4.0.2
# Using the PROJECT_BRIEF tag one can provide an optional one line description
# for a project that appears at the top of each page and should give viewer a

76
fftools/ffmpeg.c
View File

@ -4015,49 +4015,63 @@ static void *input_thread(void *arg)
return NULL;
}
static void free_input_thread(int i)
{
InputFile *f = input_files[i];
AVPacket pkt;
if (!f || !f->in_thread_queue)
return;
av_thread_message_queue_set_err_send(f->in_thread_queue, AVERROR_EOF);
while (av_thread_message_queue_recv(f->in_thread_queue, &pkt, 0) >= 0)
av_packet_unref(&pkt);
pthread_join(f->thread, NULL);
f->joined = 1;
av_thread_message_queue_free(&f->in_thread_queue);
}
static void free_input_threads(void)
{
int i;
for (i = 0; i < nb_input_files; i++) {
InputFile *f = input_files[i];
AVPacket pkt;
for (i = 0; i < nb_input_files; i++)
free_input_thread(i);
}
if (!f || !f->in_thread_queue)
continue;
av_thread_message_queue_set_err_send(f->in_thread_queue, AVERROR_EOF);
while (av_thread_message_queue_recv(f->in_thread_queue, &pkt, 0) >= 0)
av_packet_unref(&pkt);
static int init_input_thread(int i)
{
int ret;
InputFile *f = input_files[i];
pthread_join(f->thread, NULL);
f->joined = 1;
if (nb_input_files == 1)
return 0;
if (f->ctx->pb ? !f->ctx->pb->seekable :
strcmp(f->ctx->iformat->name, "lavfi"))
f->non_blocking = 1;
ret = av_thread_message_queue_alloc(&f->in_thread_queue,
f->thread_queue_size, sizeof(AVPacket));
if (ret < 0)
return ret;
if ((ret = pthread_create(&f->thread, NULL, input_thread, f))) {
av_log(NULL, AV_LOG_ERROR, "pthread_create failed: %s. Try to increase `ulimit -v` or decrease `ulimit -s`.\n", strerror(ret));
av_thread_message_queue_free(&f->in_thread_queue);
return AVERROR(ret);
}
return 0;
}
static int init_input_threads(void)
{
int i, ret;
if (nb_input_files == 1)
return 0;
for (i = 0; i < nb_input_files; i++) {
InputFile *f = input_files[i];
if (f->ctx->pb ? !f->ctx->pb->seekable :
strcmp(f->ctx->iformat->name, "lavfi"))
f->non_blocking = 1;
ret = av_thread_message_queue_alloc(&f->in_thread_queue,
f->thread_queue_size, sizeof(AVPacket));
ret = init_input_thread(i);
if (ret < 0)
return ret;
if ((ret = pthread_create(&f->thread, NULL, input_thread, f))) {
av_log(NULL, AV_LOG_ERROR, "pthread_create failed: %s. Try to increase `ulimit -v` or decrease `ulimit -s`.\n", strerror(ret));
av_thread_message_queue_free(&f->in_thread_queue);
return AVERROR(ret);
}
}
return 0;
}
@ -4199,7 +4213,7 @@ static int process_input(int file_index)
AVFormatContext *is;
InputStream *ist;
AVPacket pkt;
int ret, i, j;
int ret, thread_ret, i, j;
int64_t duration;
int64_t pkt_dts;
@ -4222,7 +4236,15 @@ static int process_input(int file_index)
avcodec_flush_buffers(avctx);
}
}
#if HAVE_THREADS
free_input_thread(file_index);
#endif
ret = seek_to_start(ifile, is);
#if HAVE_THREADS
thread_ret = init_input_thread(file_index);
if (thread_ret < 0)
return thread_ret;
#endif
if (ret < 0)
av_log(NULL, AV_LOG_WARNING, "Seek to start failed.\n");
else

4
libavcodec/ac3_parser.c
View File

@ -162,7 +162,9 @@ int avpriv_ac3_parse_header(AC3HeaderInfo **phdr, const uint8_t *buf,
return AVERROR(ENOMEM);
hdr = *phdr;
init_get_bits8(&gb, buf, size);
err = init_get_bits8(&gb, buf, size);
if (err < 0)
return AVERROR_INVALIDDATA;
err = ff_ac3_parse_header(&gb, hdr);
if (err < 0)
return AVERROR_INVALIDDATA;

7
libavcodec/ac3dec.c
View File

@ -1690,6 +1690,7 @@ dependent_frame:
if (s->frame_type == EAC3_FRAME_TYPE_DEPENDENT) {
uint64_t ich_layout = avpriv_ac3_channel_layout_tab[s->prev_output_mode & ~AC3_OUTPUT_LFEON];
int channel_map_size = ff_ac3_channels_tab[s->output_mode & ~AC3_OUTPUT_LFEON] + s->lfe_on;
uint64_t channel_layout;
int extend = 0;
@ -1718,6 +1719,9 @@ dependent_frame:
custom_channel_map_locations[ch][1]);
if (index < 0)
return AVERROR_INVALIDDATA;
if (extend >= channel_map_size)
return AVERROR_INVALIDDATA;
extended_channel_map[index] = offset + channel_map[extend++];
} else {
int i;
@ -1728,6 +1732,9 @@ dependent_frame:
1LL << i);
if (index < 0)
return AVERROR_INVALIDDATA;
if (extend >= channel_map_size)
return AVERROR_INVALIDDATA;
extended_channel_map[index] = offset + channel_map[extend++];
}
}

2
libavcodec/cscd.c
View File

@ -81,7 +81,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
switch ((buf[0] >> 1) & 7) {
case 0: { // lzo compression
int outlen = c->decomp_size, inlen = buf_size - 2;
if (av_lzo1x_decode(c->decomp_buf, &outlen, &buf[2], &inlen)) {
if (av_lzo1x_decode(c->decomp_buf, &outlen, &buf[2], &inlen) || outlen) {
av_log(avctx, AV_LOG_ERROR, "error during lzo decompression\n");
return AVERROR_INVALIDDATA;
}

4
libavcodec/dirac_dwt_template.c
View File

@ -57,8 +57,8 @@ static av_always_inline void RENAME(interleave)(TYPE *dst, TYPE *src0, TYPE *src
{
int i;
for (i = 0; i < w2; i++) {
dst[2*i ] = (src0[i] + (unsigned)add) >> shift;
dst[2*i+1] = (src1[i] + (unsigned)add) >> shift;
dst[2*i ] = ((int)(src0[i] + (unsigned)add)) >> shift;
dst[2*i+1] = ((int)(src1[i] + (unsigned)add)) >> shift;
}
}

10
libavcodec/dpx.c
View File

@ -408,12 +408,14 @@ static int decode_frame(AVCodecContext *avctx,
if (elements == 4)
*dst[3]++ = read16(&buf, endian) >> 4;
} else {
*dst[2]++ = read12in32(&buf, &rgbBuffer,
&n_datum, endian);
if (elements >= 3)
*dst[2]++ = read12in32(&buf, &rgbBuffer,
&n_datum, endian);
*dst[0]++ = read12in32(&buf, &rgbBuffer,
&n_datum, endian);
*dst[1]++ = read12in32(&buf, &rgbBuffer,
&n_datum, endian);
if (elements >= 2)
*dst[1]++ = read12in32(&buf, &rgbBuffer,
&n_datum, endian);
if (elements == 4)
*dst[3]++ = read12in32(&buf, &rgbBuffer,
&n_datum, endian);

9
libavcodec/dvdsub_parser.c
View File

@ -44,6 +44,9 @@ static int dvdsub_parse(AVCodecParserContext *s,
{
DVDSubParseContext *pc = s->priv_data;
*poutbuf = buf;
*poutbuf_size = buf_size;
if (pc->packet_index == 0) {
if (buf_size < 2 || AV_RB16(buf) && buf_size < 6) {
if (buf_size)
@ -54,7 +57,11 @@ static int dvdsub_parse(AVCodecParserContext *s,
if (pc->packet_len == 0) /* HD-DVD subpicture packet */
pc->packet_len = AV_RB32(buf+2);
av_freep(&pc->packet);
pc->packet = av_malloc(pc->packet_len);
if ((unsigned)pc->packet_len > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) {
av_log(avctx, AV_LOG_ERROR, "packet length %d is invalid\n", pc->packet_len);
return buf_size;
}
pc->packet = av_malloc(pc->packet_len + AV_INPUT_BUFFER_PADDING_SIZE);
}
if (pc->packet) {
if (pc->packet_index + buf_size <= pc->packet_len) {

3
libavcodec/error_resilience.c
View File

@ -814,8 +814,7 @@ static int er_supported(ERContext *s)
{
if(s->avctx->hwaccel && s->avctx->hwaccel->decode_slice ||
!s->cur_pic.f ||
s->cur_pic.field_picture ||
s->avctx->profile == FF_PROFILE_MPEG4_SIMPLE_STUDIO
s->cur_pic.field_picture
)
return 0;
return 1;

6
libavcodec/escape124.c
View File

@ -221,7 +221,11 @@ static int escape124_decode_frame(AVCodecContext *avctx,
// This call also guards the potential depth reads for the
// codebook unpacking.
if (get_bits_left(&gb) < 64)
// Check if the amount we will read minimally is available on input.
// The 64 represent the immediately next 2 frame_* elements read, the 23/4320
// represent a lower bound of the space needed for skipped superblocks. Non
// skipped SBs need more space.
if (get_bits_left(&gb) < 64 + s->num_superblocks * 23LL / 4320)
return -1;
frame_flags = get_bits_long(&gb, 32);

6
libavcodec/h263dec.c
View File

@ -47,9 +47,10 @@
static enum AVPixelFormat h263_get_format(AVCodecContext *avctx)
{
MpegEncContext *s = avctx->priv_data;
/* MPEG-4 Studio Profile only, not supported by hardware */
if (avctx->bits_per_raw_sample > 8) {
av_assert1(avctx->profile == FF_PROFILE_MPEG4_SIMPLE_STUDIO);
av_assert1(s->studio_profile);
return avctx->pix_fmt;
}
@ -669,7 +670,8 @@ retry:
av_assert1(s->bitstream_buffer_size == 0);
frame_end:
ff_er_frame_end(&s->er);
if (!s->studio_profile)
ff_er_frame_end(&s->er);
if (avctx->hwaccel) {
ret = avctx->hwaccel->end_frame(avctx);

19
libavcodec/h264_parser.c
View File

@ -121,20 +121,23 @@ static int h264_find_frame_end(H264ParseContext *p, const uint8_t *buf,
}
state = 7;
} else {
unsigned int mb, last_mb = p->parse_last_mb;
GetBitContext gb;
p->parse_history[p->parse_history_count++] = buf[i];
if (p->parse_history_count > 5) {
unsigned int mb, last_mb = p->parse_last_mb;
GetBitContext gb;
init_get_bits(&gb, p->parse_history, 8*p->parse_history_count);
p->parse_history_count = 0;
mb= get_ue_golomb_long(&gb);
init_get_bits(&gb, p->parse_history, 8*p->parse_history_count);
mb= get_ue_golomb_long(&gb);
if (get_bits_left(&gb) > 0 || p->parse_history_count > 5) {
p->parse_last_mb = mb;
if (pc->frame_start_found) {
if (mb <= last_mb)
if (mb <= last_mb) {
i -= p->parse_history_count - 1;
p->parse_history_count = 0;
goto found;
}
} else
pc->frame_start_found = 1;
p->parse_history_count = 0;
state = 7;
}
}
@ -149,7 +152,7 @@ found:
pc->frame_start_found = 0;
if (p->is_avc)
return next_avc;
return i - (state & 5) - 5 * (state > 7);
return i - (state & 5);
}
static int scan_mmco_reset(AVCodecParserContext *s, GetBitContext *gb,

5
libavcodec/indeo4.c
View File

@ -492,6 +492,11 @@ static int decode_mb_info(IVI45DecContext *ctx, IVIBandDesc *band,
mb->b_mv_x =
mb->b_mv_y = 0;
if (get_bits_left(&ctx->gb) < 1) {
av_log(avctx, AV_LOG_ERROR, "Insufficient input for mb info\n");
return AVERROR_INVALIDDATA;
}
if (get_bits1(&ctx->gb)) {
if (ctx->frame_type == IVI4_FRAMETYPE_INTRA) {
av_log(avctx, AV_LOG_ERROR, "Empty macroblock in an INTRA picture!\n");

13
libavcodec/jpeg2000dec.c
View File

@ -343,7 +343,10 @@ static int get_siz(Jpeg2000DecoderContext *s)
s->numXtiles = ff_jpeg2000_ceildiv(s->width - s->tile_offset_x, s->tile_width);
s->numYtiles = ff_jpeg2000_ceildiv(s->height - s->tile_offset_y, s->tile_height);
if (s->numXtiles * (uint64_t)s->numYtiles > INT_MAX/sizeof(*s->tile)) {
// There must be at least a SOT and SOD per tile, their minimum size is 14
if (s->numXtiles * (uint64_t)s->numYtiles > INT_MAX/sizeof(*s->tile) ||
s->numXtiles * s->numYtiles * 14LL > bytestream2_size(&s->g)
) {
s->numXtiles = s->numYtiles = 0;
return AVERROR(EINVAL);
}
@ -1248,10 +1251,10 @@ static int jpeg2000_decode_packets_po_iteration(Jpeg2000DecoderContext *s, Jpeg2
if (reslevelno >= codsty->nreslevels)
continue;
if (yc % (1 << (rlevel->log2_prec_height + reducedresno)) && y != tile->coord[1][0]) //FIXME this is a subset of the check
if (yc % (1LL << (rlevel->log2_prec_height + reducedresno)) && y != tile->coord[1][0]) //FIXME this is a subset of the check
continue;
if (xc % (1 << (rlevel->log2_prec_width + reducedresno)) && x != tile->coord[0][0]) //FIXME this is a subset of the check
if (xc % (1LL << (rlevel->log2_prec_width + reducedresno)) && x != tile->coord[0][0]) //FIXME this is a subset of the check
continue;
// check if a precinct exists
@ -1319,10 +1322,10 @@ static int jpeg2000_decode_packets_po_iteration(Jpeg2000DecoderContext *s, Jpeg2
uint8_t reducedresno = codsty->nreslevels - 1 -reslevelno; // ==> N_L - r
Jpeg2000ResLevel *rlevel = comp->reslevel + reslevelno;
if (yc % (1 << (rlevel->log2_prec_height + reducedresno)) && y != tile->coord[1][0]) //FIXME this is a subset of the check
if (yc % (1LL << (rlevel->log2_prec_height + reducedresno)) && y != tile->coord[1][0]) //FIXME this is a subset of the check
continue;
if (xc % (1 << (rlevel->log2_prec_width + reducedresno)) && x != tile->coord[0][0]) //FIXME this is a subset of the check
if (xc % (1LL << (rlevel->log2_prec_width + reducedresno)) && x != tile->coord[0][0]) //FIXME this is a subset of the check
continue;
// check if a precinct exists

4
libavcodec/magicyuv.c
View File

@ -240,6 +240,8 @@ static int magy_decode_slice10(AVCodecContext *avctx, void *tdata,
dst = (uint16_t *)p->data[i] + j * sheight * stride;
if (flags & 1) {
if (get_bits_left(&gb) < bps * width * height)
return AVERROR_INVALIDDATA;
for (k = 0; k < height; k++) {
for (x = 0; x < width; x++)
dst[x] = get_bits(&gb, bps);
@ -368,6 +370,8 @@ static int magy_decode_slice(AVCodecContext *avctx, void *tdata,
dst = p->data[i] + j * sheight * stride;
if (flags & 1) {
if (get_bits_left(&gb) < 8* width * height)
return AVERROR_INVALIDDATA;
for (k = 0; k < height; k++) {
for (x = 0; x < width; x++)
dst[x] = get_bits(&gb, 8);

8
libavcodec/mediacodecdec_common.c
View File

@ -443,6 +443,8 @@ static int mediacodec_dec_flush_codec(AVCodecContext *avctx, MediaCodecDecContex
FFAMediaCodec *codec = s->codec;
int status;
s->output_buffer_count = 0;
s->draining = 0;
s->flushing = 0;
s->eos = 0;
@ -670,7 +672,10 @@ int ff_mediacodec_dec_receive(AVCodecContext *avctx, MediaCodecDecContext *s,
/* If the codec is flushing or need to be flushed, block for a fair
* amount of time to ensure we got a frame */
output_dequeue_timeout_us = OUTPUT_DEQUEUE_BLOCK_TIMEOUT_US;
} else if (!wait) {
} else if (s->output_buffer_count == 0 || !wait) {
/* If the codec hasn't produced any frames, do not block so we
* can push data to it as fast as possible, and get the first
* frame */
output_dequeue_timeout_us = 0;
}
@ -704,6 +709,7 @@ int ff_mediacodec_dec_receive(AVCodecContext *avctx, MediaCodecDecContext *s,
}
}
s->output_buffer_count++;
return 0;
} else {
status = ff_AMediaCodec_releaseOutputBuffer(codec, index, 0);

1
libavcodec/mediacodecdec_common.h
View File

@ -64,6 +64,7 @@ typedef struct MediaCodecDecContext {
int display_width;
int display_height;
uint64_t output_buffer_count;
ssize_t current_input_buffer;
bool delay_flush;

9
libavcodec/mjpegdec.c
View File

@ -626,6 +626,10 @@ unk_pixfmt:
avpriv_report_missing_feature(s->avctx, "Lowres for weird subsampling");
return AVERROR_PATCHWELCOME;
}
if ((AV_RB32(s->upscale_h) || AV_RB32(s->upscale_v)) && s->progressive && s->avctx->pix_fmt == AV_PIX_FMT_GBRP) {
avpriv_report_missing_feature(s->avctx, "progressive for weird subsampling");
return AVERROR_PATCHWELCOME;
}
if (s->ls) {
memset(s->upscale_h, 0, sizeof(s->upscale_h));
memset(s->upscale_v, 0, sizeof(s->upscale_v));
@ -1055,6 +1059,11 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int nb_components, int p
for (mb_x = 0; mb_x < s->mb_width; mb_x++) {
int modified_predictor = predictor;
if (get_bits_left(&s->gb) < 1) {
av_log(s->avctx, AV_LOG_ERROR, "bitstream end in rgb_scan\n");
return AVERROR_INVALIDDATA;
}
if (s->restart_interval && !s->restart_count){
s->restart_count = s->restart_interval;
resync_mb_x = mb_x;

33
libavcodec/mpeg4videodec.c
View File

@ -1980,15 +1980,15 @@ static int mpeg4_decode_gop_header(MpegEncContext *s, GetBitContext *gb)
return 0;
}
static int mpeg4_decode_profile_level(MpegEncContext *s, GetBitContext *gb)
static int mpeg4_decode_profile_level(MpegEncContext *s, GetBitContext *gb, int *profile, int *level)
{
s->avctx->profile = get_bits(gb, 4);
s->avctx->level = get_bits(gb, 4);
*profile = get_bits(gb, 4);
*level = get_bits(gb, 4);
// for Simple profile, level 0
if (s->avctx->profile == 0 && s->avctx->level == 8) {
s->avctx->level = 0;
if (*profile == 0 && *level == 8) {
*level = 0;
}
return 0;
@ -2867,11 +2867,13 @@ static int decode_vop_header(Mpeg4DecContext *ctx, GetBitContext *gb)
return 0;
}
static void read_quant_matrix_ext(MpegEncContext *s, GetBitContext *gb)
static int read_quant_matrix_ext(MpegEncContext *s, GetBitContext *gb)
{
int i, j, v;
if (get_bits1(gb)) {
if (get_bits_left(gb) < 64*8)
return AVERROR_INVALIDDATA;
/* intra_quantiser_matrix */
for (i = 0; i < 64; i++) {
v = get_bits(gb, 8);
@ -2882,6 +2884,8 @@ static void read_quant_matrix_ext(MpegEncContext *s, GetBitContext *gb)
}
if (get_bits1(gb)) {
if (get_bits_left(gb) < 64*8)
return AVERROR_INVALIDDATA;
/* non_intra_quantiser_matrix */
for (i = 0; i < 64; i++) {
get_bits(gb, 8);
@ -2889,6 +2893,8 @@ static void read_quant_matrix_ext(MpegEncContext *s, GetBitContext *gb)
}
if (get_bits1(gb)) {
if (get_bits_left(gb) < 64*8)
return AVERROR_INVALIDDATA;
/* chroma_intra_quantiser_matrix */
for (i = 0; i < 64; i++) {
v = get_bits(gb, 8);
@ -2898,6 +2904,8 @@ static void read_quant_matrix_ext(MpegEncContext *s, GetBitContext *gb)
}
if (get_bits1(gb)) {
if (get_bits_left(gb) < 64*8)
return AVERROR_INVALIDDATA;
/* chroma_non_intra_quantiser_matrix */
for (i = 0; i < 64; i++) {
get_bits(gb, 8);
@ -2905,6 +2913,7 @@ static void read_quant_matrix_ext(MpegEncContext *s, GetBitContext *gb)
}
next_start_code_studio(gb);
return 0;
}
static void extension_and_user_data(MpegEncContext *s, GetBitContext *gb, int id)
@ -3211,13 +3220,19 @@ int ff_mpeg4_decode_picture_header(Mpeg4DecContext *ctx, GetBitContext *gb)
} else if (startcode == GOP_STARTCODE) {
mpeg4_decode_gop_header(s, gb);
} else if (startcode == VOS_STARTCODE) {
mpeg4_decode_profile_level(s, gb);
if (s->avctx->profile == FF_PROFILE_MPEG4_SIMPLE_STUDIO &&
(s->avctx->level > 0 && s->avctx->level < 9)) {
int profile, level;
mpeg4_decode_profile_level(s, gb, &profile, &level);
if (profile == FF_PROFILE_MPEG4_SIMPLE_STUDIO &&
(level > 0 && level < 9)) {
s->studio_profile = 1;
next_start_code_studio(gb);
extension_and_user_data(s, gb, 0);
} else if (s->studio_profile) {
avpriv_request_sample(s->avctx, "Mixes studio and non studio profile\n");
return AVERROR_PATCHWELCOME;
}
s->avctx->profile = profile;
s->avctx->level = level;
} else if (startcode == VISUAL_OBJ_STARTCODE) {
if (s->studio_profile) {
if ((ret = decode_studiovisualobject(ctx, gb)) < 0)

4
libavcodec/ra144.c
View File

@ -1569,11 +1569,11 @@ int ff_eval_refl(int *refl, const int16_t *coefs, AVCodecContext *avctx)
b = 0x1000000 / b;
for (j=0; j <= i; j++) {
#if CONFIG_FTRAPV
int a = bp2[j] - ((refl[i+1] * bp2[i-j]) >> 12);
int a = bp2[j] - ((int)(refl[i+1] * (unsigned)bp2[i-j]) >> 12);
if((int)(a*(unsigned)b) != a*(int64_t)b)
return 1;
#endif
bp1[j] = (int)((bp2[j] - ((refl[i+1] * bp2[i-j]) >> 12)) * (unsigned)b) >> 12;
bp1[j] = (int)((bp2[j] - ((int)(refl[i+1] * (unsigned)bp2[i-j]) >> 12)) * (unsigned)b) >> 12;
}
if ((unsigned) bp1[i] + 0x1000 > 0x1fff)

4
libavcodec/shorten.c
View File

@ -177,7 +177,7 @@ static void fix_bitshift(ShortenContext *s, int32_t *buffer)
buffer[i] = 0;
} else if (s->bitshift != 0) {
for (i = 0; i < s->blocksize; i++)
buffer[i] *= 1 << s->bitshift;
buffer[i] *= 1U << s->bitshift;
}
}
@ -682,7 +682,7 @@ static int shorten_decode_frame(AVCodecContext *avctx, void *data,
else {
int32_t sum = (s->version < 2) ? 0 : s->nmean / 2;
for (i = 0; i < s->nmean; i++)
sum += s->offset[channel][i];
sum += (unsigned)s->offset[channel][i];
coffset = sum / s->nmean;
if (s->version >= 2)
coffset = s->bitshift == 0 ? coffset : coffset >> s->bitshift - 1 >> 1;

76
libavcodec/videotoolboxenc.c
View File

@ -1262,19 +1262,16 @@ static int vtenc_create_encoder(AVCodecContext *avctx,
return 0;
}
static av_cold int vtenc_init(AVCodecContext *avctx)
static int vtenc_configure_encoder(AVCodecContext *avctx)
{
CFMutableDictionaryRef enc_info;
CFMutableDictionaryRef pixel_buffer_info;
CMVideoCodecType codec_type;
VTEncContext *vtctx = avctx->priv_data;
CFStringRef profile_level;
CFBooleanRef has_b_frames_cfbool;
CFNumberRef gamma_level = NULL;
int status;
pthread_once(&once_ctrl, loadVTEncSymbols);
codec_type = get_cm_codec_type(avctx->codec_id);
if (!codec_type) {
av_log(avctx, AV_LOG_ERROR, "Error: no mapping for AVCodecID %d\n", avctx->codec_id);
@ -1304,8 +1301,6 @@ static av_cold int vtenc_init(AVCodecContext *avctx)
if (!get_vt_hevc_profile_level(avctx, &profile_level)) return AVERROR(EINVAL);
}
vtctx->session = NULL;
enc_info = CFDictionaryCreateMutable(
kCFAllocatorDefault,
20,
@ -1335,8 +1330,6 @@ static av_cold int vtenc_init(AVCodecContext *avctx)
pixel_buffer_info = NULL;
}
pthread_mutex_init(&vtctx->lock, NULL);
pthread_cond_init(&vtctx->cv_sample_sent, NULL);
vtctx->dts_delta = vtctx->has_b_frames ? -1 : 0;
get_cv_transfer_function(avctx, &vtctx->transfer_function, &gamma_level);
@ -1363,8 +1356,32 @@ static av_cold int vtenc_init(AVCodecContext *avctx)
pixel_buffer_info,
&vtctx->session);
if (status < 0)
goto init_cleanup;
init_cleanup:
if (gamma_level)
CFRelease(gamma_level);
if (pixel_buffer_info)
CFRelease(pixel_buffer_info);
CFRelease(enc_info);
return status;
}
static av_cold int vtenc_init(AVCodecContext *avctx)
{
VTEncContext *vtctx = avctx->priv_data;
CFBooleanRef has_b_frames_cfbool;
int status;
pthread_once(&once_ctrl, loadVTEncSymbols);
pthread_mutex_init(&vtctx->lock, NULL);
pthread_cond_init(&vtctx->cv_sample_sent, NULL);
vtctx->session = NULL;
status = vtenc_configure_encoder(avctx);
if (status) return status;
status = VTSessionCopyProperty(vtctx->session,
kVTCompressionPropertyKey_AllowFrameReordering,
@ -1378,16 +1395,7 @@ static av_cold int vtenc_init(AVCodecContext *avctx)
}
avctx->has_b_frames = vtctx->has_b_frames;
init_cleanup:
if (gamma_level)
CFRelease(gamma_level);
if (pixel_buffer_info)
CFRelease(pixel_buffer_info);
CFRelease(enc_info);
return status;
return 0;
}
static void vtenc_get_frame_info(CMSampleBufferRef buffer, bool *is_key_frame)
@ -2167,8 +2175,27 @@ static int create_cv_pixel_buffer(AVCodecContext *avctx,
#if TARGET_OS_IPHONE
pix_buf_pool = VTCompressionSessionGetPixelBufferPool(vtctx->session);
if (!pix_buf_pool) {
av_log(avctx, AV_LOG_ERROR, "Could not get pixel buffer pool.\n");
return AVERROR_EXTERNAL;
/* On iOS, the VT session is invalidated when the APP switches from
* foreground to background and vice versa. Fetch the actual error code
* of the VT session to detect that case and restart the VT session
* accordingly. */
OSStatus vtstatus;
vtstatus = VTCompressionSessionPrepareToEncodeFrames(vtctx->session);
if (vtstatus == kVTInvalidSessionErr) {
CFRelease(vtctx->session);
vtctx->session = NULL;
status = vtenc_configure_encoder(avctx);
if (status == 0)
pix_buf_pool = VTCompressionSessionGetPixelBufferPool(vtctx->session);
}
if (!pix_buf_pool) {
av_log(avctx, AV_LOG_ERROR, "Could not get pixel buffer pool.\n");
return AVERROR_EXTERNAL;
}
else
av_log(avctx, AV_LOG_WARNING, "VT session restarted because of a "
"kVTInvalidSessionErr error.\n");
}
status = CVPixelBufferPoolCreatePixelBuffer(NULL,
@ -2473,13 +2500,14 @@ static av_cold int vtenc_close(AVCodecContext *avctx)
{
VTEncContext *vtctx = avctx->priv_data;
pthread_cond_destroy(&vtctx->cv_sample_sent);
pthread_mutex_destroy(&vtctx->lock);
if(!vtctx->session) return 0;
VTCompressionSessionCompleteFrames(vtctx->session,
kCMTimeIndefinite);
clear_frame_queue(vtctx);
pthread_cond_destroy(&vtctx->cv_sample_sent);
pthread_mutex_destroy(&vtctx->lock);
CFRelease(vtctx->session);
vtctx->session = NULL;

3
libavcodec/vp8_parser.c
View File

@ -28,6 +28,9 @@ static int parse(AVCodecParserContext *s,
unsigned int frame_type;
unsigned int profile;
*poutbuf = buf;
*poutbuf_size = buf_size;
if (buf_size < 3)
return buf_size;

3
libavformat/asfdec_o.c
View File

@ -706,7 +706,8 @@ static int parse_video_info(AVIOContext *pb, AVStream *st)
st->codecpar->codec_id = ff_codec_get_id(ff_codec_bmp_tags, tag);
size_bmp = FFMAX(size_asf, size_bmp);
if (size_bmp > BMP_HEADER_SIZE) {
if (size_bmp > BMP_HEADER_SIZE &&
size_bmp < INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) {
int ret;
st->codecpar->extradata_size = size_bmp - BMP_HEADER_SIZE;
if (!(st->codecpar->extradata = av_malloc(st->codecpar->extradata_size +

44
libavformat/mms.c
View File

@ -94,24 +94,26 @@ int ff_mms_asf_header_parser(MMSContext *mms)
}
}
} else if (!memcmp(p, ff_asf_stream_header, sizeof(ff_asf_guid))) {
flags = AV_RL16(p + sizeof(ff_asf_guid)*3 + 24);
stream_id = flags & 0x7F;
//The second condition is for checking CS_PKT_STREAM_ID_REQUEST packet size,
//we can calculate the packet size by stream_num.
//Please see function send_stream_selection_request().
if (mms->stream_num < MMS_MAX_STREAMS &&
46 + mms->stream_num * 6 < sizeof(mms->out_buffer)) {
mms->streams = av_fast_realloc(mms->streams,
&mms->nb_streams_allocated,
(mms->stream_num + 1) * sizeof(MMSStream));
if (!mms->streams)
return AVERROR(ENOMEM);
mms->streams[mms->stream_num].id = stream_id;
mms->stream_num++;
} else {
av_log(NULL, AV_LOG_ERROR,
"Corrupt stream (too many A/V streams)\n");
return AVERROR_INVALIDDATA;
if (end - p >= (sizeof(ff_asf_guid) * 3 + 26)) {
flags = AV_RL16(p + sizeof(ff_asf_guid)*3 + 24);
stream_id = flags & 0x7F;
//The second condition is for checking CS_PKT_STREAM_ID_REQUEST packet size,
//we can calculate the packet size by stream_num.
//Please see function send_stream_selection_request().
if (mms->stream_num < MMS_MAX_STREAMS &&
46 + mms->stream_num * 6 < sizeof(mms->out_buffer)) {
mms->streams = av_fast_realloc(mms->streams,
&mms->nb_streams_allocated,
(mms->stream_num + 1) * sizeof(MMSStream));
if (!mms->streams)
return AVERROR(ENOMEM);
mms->streams[mms->stream_num].id = stream_id;
mms->stream_num++;
} else {
av_log(NULL, AV_LOG_ERROR,
"Corrupt stream (too many A/V streams)\n");
return AVERROR_INVALIDDATA;
}
}
} else if (!memcmp(p, ff_asf_ext_stream_header, sizeof(ff_asf_guid))) {
if (end - p >= 88) {
@ -143,6 +145,12 @@ int ff_mms_asf_header_parser(MMSContext *mms)
}
} else if (!memcmp(p, ff_asf_head1_guid, sizeof(ff_asf_guid))) {
chunksize = 46; // see references [2] section 3.4. This should be set 46.
if (chunksize > end - p) {
av_log(NULL, AV_LOG_ERROR,
"Corrupt stream (header chunksize %"PRId64" is invalid)\n",
chunksize);
return AVERROR_INVALIDDATA;
}
}
p += chunksize;
}

22
libavformat/mov.c
View File

@ -3299,22 +3299,21 @@ static void mov_estimate_video_delay(MOVContext *c, AVStream* st) {
int ctts_sample = 0;
int64_t pts_buf[MAX_REORDER_DELAY + 1]; // Circular buffer to sort pts.
int buf_start = 0;
int buf_size = 0;
int j, r, num_swaps;
for (j = 0; j < MAX_REORDER_DELAY + 1; j++)
pts_buf[j] = INT64_MIN;
if (st->codecpar->video_delay <= 0 && msc->ctts_data &&
st->codecpar->codec_id == AV_CODEC_ID_H264) {
st->codecpar->video_delay = 0;
for(ind = 0; ind < st->nb_index_entries && ctts_ind < msc->ctts_count; ++ind) {
if (buf_size == (MAX_REORDER_DELAY + 1)) {
// If circular buffer is full, then move the first element forward.
buf_start = (buf_start + 1) % buf_size;
} else {
++buf_size;
}
// Point j to the last elem of the buffer and insert the current pts there.
j = (buf_start + buf_size - 1) % buf_size;
j = buf_start;
buf_start = (buf_start + 1);
if (buf_start == MAX_REORDER_DELAY + 1)
buf_start = 0;
pts_buf[j] = st->index_entries[ind].timestamp + msc->ctts_data[ctts_ind].duration;
// The timestamps that are already in the sorted buffer, and are greater than the
@ -3325,10 +3324,13 @@ static void mov_estimate_video_delay(MOVContext *c, AVStream* st) {
// go through, to keep this buffer in sorted order.
num_swaps = 0;
while (j != buf_start) {
r = (j - 1 + buf_size) % buf_size;
r = j - 1;
if (r < 0) r = MAX_REORDER_DELAY;
if (pts_buf[j] < pts_buf[r]) {
FFSWAP(int64_t, pts_buf[j], pts_buf[r]);
++num_swaps;
} else {
break;
}
j = r;
}

17
libavformat/movenc.c
View File

@ -397,7 +397,7 @@ static int handle_eac3(MOVMuxContext *mov, AVPacket *pkt, MOVTrack *track)
if (avpriv_ac3_parse_header(&hdr, pkt->data, pkt->size) < 0) {
/* drop the packets until we see a good one */
if (!track->entry) {
av_log(mov, AV_LOG_WARNING, "Dropping invalid packet from start of the stream\n");
av_log(mov->fc, AV_LOG_WARNING, "Dropping invalid packet from start of the stream\n");
ret = 0;
} else
ret = AVERROR_INVALIDDATA;
@ -425,7 +425,7 @@ static int handle_eac3(MOVMuxContext *mov, AVPacket *pkt, MOVTrack *track)
if (hdr->substreamid == info->num_ind_sub + 1) {
//info->num_ind_sub++;
avpriv_request_sample(track->par, "Multiple independent substreams");
avpriv_request_sample(mov->fc, "Multiple independent substreams");
ret = AVERROR_PATCHWELCOME;
goto end;
} else if (hdr->substreamid < info->num_ind_sub ||
@ -433,6 +433,12 @@ static int handle_eac3(MOVMuxContext *mov, AVPacket *pkt, MOVTrack *track)
info->ec3_done = 1;
goto concatenate;
}
} else {
if (hdr->substreamid != 0) {
avpriv_request_sample(mov->fc, "Multiple non EAC3 independent substreams");
ret = AVERROR_PATCHWELCOME;
goto end;
}
}
/* fill the info needed for the "dec3" atom */
@ -1012,7 +1018,7 @@ static int mov_write_audio_tag(AVFormatContext *s, AVIOContext *pb, MOVMuxContex
uint32_t tag = track->tag;
if (track->mode == MODE_MOV) {
if (track->timescale > UINT16_MAX) {
if (track->timescale > UINT16_MAX || !track->par->channels) {
if (mov_get_lpcm_flags(track->par->codec_id))
tag = AV_RL32("lpcm");
version = 2;
@ -5209,6 +5215,11 @@ int ff_mov_write_packet(AVFormatContext *s, AVPacket *pkt)
else
samples_in_chunk = 1;
if (samples_in_chunk < 1) {
av_log(s, AV_LOG_ERROR, "fatal error, input packet contains no samples\n");
return AVERROR_PATCHWELCOME;
}
/* copy extradata if it exists */
if (trk->vos_len == 0 && par->extradata_size > 0 &&
!TAG_IS_AVCI(trk->tag) &&

1
libavformat/mpegts.c
View File

@ -447,6 +447,7 @@ static void write_section_data(MpegTSContext *ts, MpegTSFilter *tss1,
offset += tss->section_h_size;
tss->section_h_size = -1;
} else {
tss->section_h_size = -1;
tss->end_of_section_reached = 0;
break;
}

2
libavformat/mxfdec.c
View File

@ -2085,7 +2085,7 @@ static int mxf_parse_structural_metadata(MXFContext *mxf)
MXFEssenceContainerData *essence_data;
if (!(essence_data = mxf_resolve_strong_ref(mxf, &mxf->essence_container_data_refs[k], EssenceContainerData))) {
av_log(mxf, AV_LOG_TRACE, "could not resolve essence container data strong ref\n");
av_log(mxf->fc, AV_LOG_TRACE, "could not resolve essence container data strong ref\n");
continue;
}
if (!memcmp(component->source_package_ul, essence_data->package_ul, sizeof(UID)) && !memcmp(component->source_package_uid, essence_data->package_uid, sizeof(UID))) {

4
libavformat/pva.c
View File

@ -134,6 +134,10 @@ recover:
pes_flags = avio_rb16(pb);
pes_header_data_length = avio_r8(pb);
if (avio_feof(pb)) {
return AVERROR_EOF;
}
if (pes_signal != 1 || pes_header_data_length == 0) {
pva_log(s, AV_LOG_WARNING, "expected non empty signaled PES packet, "
"trying to recover\n");

2
libavformat/rmdec.c
View File

@ -522,7 +522,7 @@ static int rm_read_multi(AVFormatContext *s, AVIOContext *pb,
size2 = avio_rb32(pb);
ret = ff_rm_read_mdpr_codecdata(s, s->pb, st2, st2->priv_data,
size2, mime);
size2, NULL);
if (ret < 0)
return ret;
}

8
libswresample/arm/audio_convert_neon.S
View File

@ -22,7 +22,7 @@
#include "libavutil/arm/asm.S"
function swri_oldapi_conv_flt_to_s16_neon, export=1
_swri_oldapi_conv_flt_to_s16_neon:
.L_swri_oldapi_conv_flt_to_s16_neon:
subs r2, r2, #8
vld1.32 {q0}, [r1,:128]!
vcvt.s32.f32 q8, q0, #31
@ -67,7 +67,7 @@ _swri_oldapi_conv_flt_to_s16_neon:
endfunc
function swri_oldapi_conv_fltp_to_s16_2ch_neon, export=1
_swri_oldapi_conv_fltp_to_s16_2ch_neon:
.L_swri_oldapi_conv_fltp_to_s16_2ch_neon:
ldm r1, {r1, r3}
subs r2, r2, #8
vld1.32 {q0}, [r1,:128]!
@ -135,8 +135,8 @@ function swri_oldapi_conv_fltp_to_s16_nch_neon, export=1
cmp r3, #2
itt lt
ldrlt r1, [r1]
blt _swri_oldapi_conv_flt_to_s16_neon
beq _swri_oldapi_conv_fltp_to_s16_2ch_neon
blt .L_swri_oldapi_conv_flt_to_s16_neon
beq .L_swri_oldapi_conv_fltp_to_s16_2ch_neon
push {r4-r8, lr}
cmp r3, #4