Commit Graph

41646 Commits

Author SHA1 Message Date
Michael Niedermayer cf7ea65ca0 avcodec/bitstream: Check for more conflicting codes in build_table()
Fixes: out of array read
Fixes: 14563/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5646451545210880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-14 21:36:39 +02:00
Michael Niedermayer fefadc70d2 avcodec/bitstream: Check for integer code truncation in build_table()
Fixes: out of array read
Fixes: 14563/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5646451545210880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-14 21:36:39 +02:00
Matthieu Bouron 5d3c20525b avcodec/mediacodecdec: re-indent after previous commit 2019-06-13 11:41:18 +02:00
Matthieu Bouron 5462ad4e21 avcodec/mediacodecdec: remove unneeded else block in ff_mediacodec_dec_send() 2019-06-13 11:41:18 +02:00
Matthieu Bouron 5529db1d82 avcodec/mediacodecdec: try to receive a frame after signaling EOF to the codec
Avoids returning EAGAIN after signaling EOF to the codec in
ff_mediacodec_dec_send() so we can try to receive a frame before
returning in mediacodec_receive_frame().

This helps avoiding an extra round-trip between avcodec_send_frame() and
avcodec_receive_frame() while draining the remaining frames.
2019-06-13 11:41:18 +02:00
Alejandro Solozabal 52c4c6a39b avcodec/omx: Correct av_log() log message
Print the right library name, which is trying to open, on the log message.

Signed-off-by: Alejandro Solozabal <a.solozabal@hotmail.com>
2019-06-12 22:29:11 +01:00
U. Artie Eoff d1c7f4c05f vaapi_encode_mjpeg: fix bad component id bug
The compound literals assigned to "components"
only exist within the scope of the if/else
block (thanks Mark Thompson for the better
explanation).

Thus, after this if/else block, "components"
ends up pointing to an arbitrary/undefined
array.  With some compilers and depending on
optimization settings, these arbitrary values
may end up being the same value (i.e. 0 with
GNU GCC 9.x).  Unfortunately, the GNU GCC
compiler, at least, never prints any warnings
about this.

This patch fixes this issue by assigning the
constant arrays to local variables at function
scope and then pointing "components" to those
as necessary.

Fixes #7915

Signed-off-by: U. Artie Eoff <ullysses.a.eoff@intel.com>
2019-06-12 22:27:13 +01:00
Peter Ross 3d6029bf50 VP4 video decoder 2019-06-12 20:06:20 +10:00
Peter Ross f6dfd01494 avcodec/vp3: spin off get_eob_run and get_coeff coeff functions
these reoutines are shared by vp3 and vp4.
2019-06-12 20:06:20 +10:00
Michael Niedermayer 2837076814 avcodec/mjpegdec: Check for non ls PAL8
Fixes: Null-dereference READ in av_malloc
Fixes: 15002/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-5643474625363968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-12 12:01:32 +02:00
Michael Niedermayer 5f7032e7ba avcodec/v4l2_m2m_dec: Fix memleak on ff_v4l2_m2m_codec_init() failure
Fixes: 13579/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1_V4L2M2M_fuzzer-5753560726241280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-12 12:01:32 +02:00
Michael Niedermayer fed448ae84 avcodec/interplayvideo: check decoding_map_size with video_data_size
Fixes: Timeout (90543 ms -> 59 ms)
Fixes: 14721/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_VIDEO_fuzzer-5697492148027392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-12 12:01:32 +02:00
Michael Niedermayer 0bd4232a08 avcodec/h264_parse: Use 64bit for expectedpoc and expected_delta_per_poc_cycle
Fixes: signed integer overflow: -2142516591 + -267814575 cannot be represented in type 'int'
Fixes: 14450/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5716105319940096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-12 12:01:26 +02:00
Peter Ross 6df1fc52ce avcodec/vp3data: combine eob_run_base and eob_run_get_bits tables 2019-06-08 09:37:26 +10:00
Andreas Rheinhardt 739bd76fef cbs_av1, cbs_jpeg, cbs_mpeg2, cbs_vp9: Fix undef
READ has already been undefined at this point; it is obviously intended
to undef WRITE.
Furthermore, leb128 (in cbs_av1) was undefined too often and
inconsistently.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2019-06-07 21:24:07 +01:00
Michael Niedermayer 0513deb85d avcodec/mss4: Check input size against skip bits
Fixes: Timeout (17sec -> 20ms)
Fixes: 14615/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MTS2_fuzzer-5093007763701760
Fixes: 14797/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MTS2_fuzzer-5651696119709696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-05 13:19:59 +02:00
Michael Niedermayer 162ea4eab7 avcodec/dxv: Check op_offset in dxv_decompress_cocg()
Fixes: signed integer overflow: -2147483648 - 12 cannot be represented in type 'int'
Fixes: 14732/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_fuzzer-5735273129836544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-05 13:19:59 +02:00
Michael Niedermayer e2bd17a4a8 avcodec/diracdec: Fix integer overflow in global_mv()
Fixes: signed integer overflow: 16384 * 196607 cannot be represented in type 'int'
Fixes: 14810/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5091232683917312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-05 13:19:59 +02:00
Andreas Rheinhardt beecb08804 bitstream_filters: Correct dump_extradata description
The default is to dump extradata to keyframes, not all frames.
Also improve the description of the relevant AVOption.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2019-06-04 20:04:05 +05:30
Michael Niedermayer c661a2ed82 avcodec/vmnc: Check available space against chunks before reget_buffer()
Fixes: Timeout (16sec -> 60ms)
Fixes: 14673/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMNC_fuzzer-5640217517621248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-04 13:06:41 +02:00
Michael Niedermayer f41f320f93 avcodec/pafvideo: Clear frame buffer later
This way the clearing can be skipped in case of some errors.

Fixes: Timeout (11sec -> 344ms)
Fixes: 14670/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PAF_VIDEO_fuzzer-5769534503387136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-04 13:06:41 +02:00
Michael Niedermayer d0747319db avcodec/aacdec_template: skip apply_tns() if max_sfb is 0 (from previous header decode failure)
Fixes: NULL pointer dereference
Fixes: 14723/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5654612436058112
Fixes: 14724/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5712607111020544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-04 13:06:41 +02:00
Michael Niedermayer 2fd599f490 avcodec/arbc: Skip tiles in fill_tileX() which are completely outside
Fixes: signed integer overflow: 2052526848 + 147237888 cannot be represented in type 'int'
Fixes: 14441/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ARBC_fuzzer-5717632944177152
Fixes: 14453/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ARBC_fuzzer-5739679254577152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-04 13:06:41 +02:00
Michael Niedermayer 889fda061c avcodec/aacdec_fixed: Handle more extreem cases in noise_scale()
Its unclear if these cases have any relevance in real files

Fixes: shift exponent -2 is negative
Fixes: 14489/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5681941631729664

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-04 13:06:41 +02:00
Michael Niedermayer 2d1efb54d5 avcodec/aacdec_template: Merge 3 #ifs related to noise handling
Fewer #if and fewer lines

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-04 13:06:41 +02:00
Michael Niedermayer 9f2cc5d099 avcodec/aacdec_fixed: ssign seems always -1 in noise_scale(), simplify 2019-06-04 13:06:41 +02:00
James Almer e3c3029ab6 avcodec/cbs_h264: add support for Alternative Transfer Characteristics SEI message
Reviewed-by: Mark Thompson <sw@jkqxz.net>
Signed-off-by: James Almer <jamrial@gmail.com>
2019-06-03 19:21:38 -03:00
Mark Thompson 1708c11ff3 vaapi_encode: Refactor encode misc parameter buffer creation
This removes the use of the nonstandard combined structures, which
generated some warnings with clang and will cause alignment problems
with some parameter buffer types.
2019-06-03 21:16:22 +01:00
Mark Thompson 4ee530b247 vaapi_encode: Remove unused function 2019-06-03 21:16:22 +01:00
Mark Thompson 9158c2fe4a vaapi_encode: Warn if input has cropping information
Cropping is not supported by VAAPI encode.
2019-06-02 17:30:41 +01:00
Michael Niedermayer 269da27f8e avcodec/gdv: Check remaining output after decode 5/6/8/
Improves: Timeout (355sec -> 97sec)
Improves: 14709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_GDV_fuzzer-5704215281795072

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
2019-05-31 22:44:30 +02:00
Nick Renieris 768382a577 avcodec/tiff: Recognize DNG/CinemaDNG images
Additionally:
- Renamed TIFF_WHITE_LEVEL to DNG_WHITE_LEVEL since it is specified
  in the DNG spec.
- Added/changed some comments to be more precise in differentiating
  between TIFF, TIFF/EP and DNG values.

Related to ticket: https://trac.ffmpeg.org/ticket/4364

Signed-off-by: Nick Renieris <velocityra@gmail.com>
2019-05-30 19:27:05 +02:00
Nick Renieris bff8034a7e libavcodec/tiff: Process SubIFDs tag with multiple entries
SubIFDs that were part of more than single-sized "SubIFDs" tags were
being ignored due to existing code ignoring that case.

This patch makes is so the first entry is read, which is not ideal
but enough for some DNG images present in the wild to be decodeable
More specifically, the first SubIFD which we would process with this
patch is the main image and the second one is a second thumbnail,
which is not as important to decode.

In DNG images with the .tiff extension, it solves the issue where
the TIFF thumbnail in IFD 0 was incorrectly parsed (related
confusion: [1]).

Embedded thumbnails for DNG images can still be decoded with the
"-thumbnail" option.

Related to ticket: https://trac.ffmpeg.org/ticket/4364

[1]: https://superuser.com/questions/546879/creating-video-from-dng-images-with-ffmpeg

Signed-off-by: Nick Renieris <velocityra@gmail.com>
2019-05-30 19:27:05 +02:00
Nick Renieris 2a5638bd11 avcodec/tiff: Option to decode embedded thumbnail
Adds the "-thumbnail" option, that works like the current "-subifd"
option, but only for non-full-sized images.

This is particularly useful for DNG images (see next commit) that
have SubIFDs that are not necessarily thumbnails.

Signed-off-by: Nick Renieris <velocityra@gmail.com>
2019-05-30 19:27:05 +02:00
James Almer 47dc490f27 avcodec/cbs_mpeg2: fix leak of extra_information_slice buffer in cbs_mpeg2_read_slice_header()
cbs_mpeg2_free_slice() calls av_buffer_unref() on extra_information_ref,
meaning allocating with av_malloc() was not the intention.

Signed-off-by: James Almer <jamrial@gmail.com>
2019-05-29 00:16:41 +01:00
Andreas Rheinhardt 3d727577fb cbs_mpeg2: Correct error codes
Up until now, things that are merely unsupported by cbs_mpeg2 have been
declared to be invalid input. This has been changed.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2019-05-29 00:16:26 +01:00
Andreas Rheinhardt 818cf5be7d cbs_mpeg2: Fix storage type for frame_centre_*_offset
The frame_centre_horizontal/vertical_offset values contained in picture
display extensions are actually signed values (i.e. it is possible to
indicate that the display device should add black bars/pillars).

The files sony-ct3.bs and tcela-6.bits (which are both used in fate
tests for mpeg2_metadata) contain picture display extensions; the former
even contains a negative frame_centre_vertical_offset. Fortunately, the
old code did not damage the picture display extensions when one did a
cycle of reading and writing. For the same reason the fate tests needn't
be updated either.

Furthermore these fields now use the trace output for matrices.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2019-05-29 00:16:26 +01:00
Andreas Rheinhardt 943e0f2e13 cbs_mpeg2: Improve checks for invalid values
MPEG-2 contains several elements that mustn't be zero according to the
specifications: horizontal/vertical_size_value, aspect_ratio_information,
frame_rate_code, the quantiser matrices, the colour_description
elements, picture_coding_type, the f_code[r][s] values and
quantiser_scale_code. It is now checked that the invalid values don't
occur.

The colour_description elements are treated specially in this regard:
Given that there are files in the wild which use illegal values for the
colour_description elements (some of them created by mpeg2_metadata),
they will be corrected to the value meaning "unknown" (namely 2) during
reading. This has been done in such a way that trace_headers will
nevertheless report the original value, together with a message about
the fixup.

Furthermore, the trace_headers output of user_data has been beautified.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2019-05-28 23:59:29 +01:00
Andreas Rheinhardt 73af9c6312 cbs_mpeg2: Correct and use enum values
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2019-05-28 23:59:26 +01:00
Michael Niedermayer 1680387c57 avcodec/diracdec: Check for arith decoder errors in dirac_unpack_block_motion_data()
Fixes: Timeout (54sec -> 188ms)
Fixes: 14585/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5649933052411904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-05-27 19:01:38 +02:00
Michael Niedermayer e66cd28ae5 avcodec/truemotion2: Fix several integer overflows in tm2_update_block()
Fixes: signed integer overflow: -1877966852 + -469491713 cannot be represented in type 'int'
Fixes: 14561/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5167608359288832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-05-27 19:01:38 +02:00
Michael Niedermayer a97b5d0a28 avcodec/ffv1dec_template: Optimize common case in run mode
Fixes: Timeout (14sec -> 9sec)
Fixes: 13398/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-5664106709778432

decode_line() becomes 1% faster for fate/vsynth2-ffv1.avi
for another fate sample there is a 0.5% speedup
the effect should be bigger for files with "flat" colored areas
the new faster branch is used in 97-100% of the cases in fate samples
compared to the older more complex (which i tested)

vsynth3-ffv1-v3-bgr0.avi had the lowest percentual useage of about 97%

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-05-27 19:01:38 +02:00
James Almer a001f77f17 avcodec/libdav1d: add support for RGB streams
Signed-off-by: James Almer <jamrial@gmail.com>
2019-05-27 13:21:52 -03:00
James Almer 25c2988893 avcodec/libdav1d: assert Dav1dPicture allocator_data is set before referencing its data
To ensure the custom allocator is effectively used.

Signed-off-by: James Almer <jamrial@gmail.com>
2019-05-27 12:49:01 -03:00
James Almer 608fc7bb7c avcodec/libdav1d: export level from the Sequence Header
Signed-off-by: James Almer <jamrial@gmail.com>
2019-05-27 12:47:33 -03:00
Shiyou Yin fff70991c0 avcodec/mips: [loongson] fix mpeg4 decoding error on loongson platform.
In function ff_dct_unquantize_mpeg2_intra_mmi,
addr0 shoudn't be changed before storage operation.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-05-26 21:04:18 +02:00
Derek Buitenhuis 1c65edbf52 avcodec/libx265: Support full range videos
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
2019-05-26 12:04:46 +01:00
Michael Niedermayer 43d76d0c39 avcodec/pngdec: Check nb_blocks
Fixes: Timeout (23sec -> 0.5sec)
Fixes: 14329/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LSCR_fuzzer-5679252923482112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-05-25 02:04:43 +02:00
Marton Balint 195dcba82f avcodec/scpr3: fix checking ret value of decode_run_i
Fixes Coverity CID 1441461.

Signed-off-by: Marton Balint <cus@passwd.hu>
2019-05-24 21:39:07 +02:00
Marton Balint 79bd31de00 avcodec/scpr: fix checking ret value of decode_run_i
Fixes Coverity CID 1441460.

Signed-off-by: Marton Balint <cus@passwd.hu>
2019-05-24 21:39:07 +02:00