ffmpeg.git
16 months agoavfilter/vf_xfade: fix excessive number of queued frames
Paul B Mahol [Sun, 30 Aug 2020 09:07:51 +0000 (11:07 +0200)]
avfilter/vf_xfade: fix excessive number of queued frames

Also do not abort in some cases too early when transition is over.

Fixes #8823.

16 months agoavcodec/truemotion1: Cleanup generically after init failure
Andreas Rheinhardt [Sat, 29 Aug 2020 07:39:40 +0000 (09:39 +0200)]
avcodec/truemotion1: Cleanup generically after init failure

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
16 months agoavcodec/y41penc: Remove empty close function
Andreas Rheinhardt [Sat, 29 Aug 2020 15:59:17 +0000 (17:59 +0200)]
avcodec/y41penc: Remove empty close function

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
16 months agoavcodec/yuv4enc: Remove empty functions
Andreas Rheinhardt [Sat, 29 Aug 2020 15:55:15 +0000 (17:55 +0200)]
avcodec/yuv4enc: Remove empty functions

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
16 months agoavcodec/wnv1: Move temporary variables from context to stack
Andreas Rheinhardt [Sat, 29 Aug 2020 15:14:18 +0000 (17:14 +0200)]
avcodec/wnv1: Move temporary variables from context to stack

Here it even leads to the complete removal of the context.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
16 months agoavcodec/wnv1: Use LE bitstream reader, avoid copying packet, fix memleak
Andreas Rheinhardt [Sat, 29 Aug 2020 14:12:05 +0000 (16:12 +0200)]
avcodec/wnv1: Use LE bitstream reader, avoid copying packet, fix memleak

The Winnov WNV1 format is designed for a little-endian bitstream reader;
yet our decoder reversed every byte bitwise (in a buffer only
allocated for this purpose) to use a big-endian bitstream reader. This
commit stops this.

Two things needed to be done to achieve this: The codes in the table used
to initialize a VLC reader needed to be reversed bitwise (when
initializing a VLC in LE mode, it is expected that the first bit to be
read is in the least significant bit; with BE codes the first bit to be
read is the most significant bit of the code) and the following
expression needed to be adapted:

ff_reverse[get_bits(&w->gb, 8 - w->shift)]

But this is easy: When only the bits read are reversed, they coincide
with what a little-endian bitstream reader reads that reads the
original, not-reversed data. But ff_reverse always reverses the full
eight bits and this also performs a shift by (8 - (8 - w->shift)) on top
of reversing the bits read. So the above line needs to be changed to

get_bits(&w->gb, 8 - w->shift) << w->shift

and this also shows why the variable shift is named the way it is.

Finally, this also fixes a hypothetical memleak: For gigantic packets,
initializing a GetBitContext can fail and in this case, the buffer
containing the reversed data would leak.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
16 months agoavcodec/roqvideoenc: Cleanup generically after init failure
Andreas Rheinhardt [Sat, 29 Aug 2020 07:05:17 +0000 (09:05 +0200)]
avcodec/roqvideoenc: Cleanup generically after init failure

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
16 months agoavcodec/roqvideodec: Cleanup generically after init failure
Andreas Rheinhardt [Sat, 29 Aug 2020 07:04:42 +0000 (09:04 +0200)]
avcodec/roqvideodec: Cleanup generically after init failure

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
16 months agoavcodec/mss3: Cleanup generically after init failure
Andreas Rheinhardt [Sat, 29 Aug 2020 06:51:55 +0000 (08:51 +0200)]
avcodec/mss3: Cleanup generically after init failure

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
16 months agoavcodec/mss3: Remove unnecessary free of unallocated frame
Andreas Rheinhardt [Sat, 29 Aug 2020 06:49:45 +0000 (08:49 +0200)]
avcodec/mss3: Remove unnecessary free of unallocated frame

The frame will only be allocated a few lines below.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
16 months agoavcodec/interplayvideo: Cleanup generically after init failure
Andreas Rheinhardt [Sat, 29 Aug 2020 06:43:42 +0000 (08:43 +0200)]
avcodec/interplayvideo: Cleanup generically after init failure

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
16 months agoavcodec/eacmv: Cleanup generically after init failure
Andreas Rheinhardt [Sat, 29 Aug 2020 06:26:03 +0000 (08:26 +0200)]
avcodec/eacmv: Cleanup generically after init failure

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
16 months agoavcodec/cinepakenc: Cleanup generically after init failure
Andreas Rheinhardt [Sat, 29 Aug 2020 06:37:17 +0000 (08:37 +0200)]
avcodec/cinepakenc: Cleanup generically after init failure

Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
16 months agoavcodec/truemotion2: Avoid duplicating array, fix memleak
Andreas Rheinhardt [Sat, 29 Aug 2020 07:40:39 +0000 (09:40 +0200)]
avcodec/truemotion2: Avoid duplicating array, fix memleak

TrueMotion 2.0 uses Huffmann trees. To parse them, the decoder allocates
arrays for the codes, their lengths and their value; afterwards a VLC
table is initialized using these values. If everything up to this point
succeeds, a new buffer of the same size as the already allocated arrays
for the values is allocated and upon success the values are copied into
the new array; all the old arrays are then freed. Yet if allocating the
new array fails, the old arrays get freed, but the VLC table doesn't.

This leak is fixed by not allocating a new array at all; instead the old
array is simply reused, ensuring that nothing can fail after the
creation of the VLC table.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agolibavformat/mxfenc: color_range should be inclusive
Harry Mallon [Thu, 20 Aug 2020 13:58:53 +0000 (14:58 +0100)]
libavformat/mxfenc: color_range should be inclusive

MXF CDCI color range was being set to (1<<sc->component_depth) - 1
for full range but it should be (1<<sc->component_depth) as 0 is
a valid value.

Signed-off-by: Harry Mallon <harry.mallon@codex.online>
17 months agoavformat/mxfdec: Read video range from CDCIEssenceDescriptor
Harry Mallon [Thu, 20 Aug 2020 13:58:52 +0000 (14:58 +0100)]
avformat/mxfdec: Read video range from CDCIEssenceDescriptor

* Capture black_ref, white_ref and color_range and recognise
  full and narrow range.

Signed-off-by: Harry Mallon <harry.mallon@codex.online>
17 months agox86/cfhddsp: zero extend int arguments
James Almer [Fri, 28 Aug 2020 22:40:09 +0000 (19:40 -0300)]
x86/cfhddsp: zero extend int arguments

if taken from stack, they may have garbage in the upper bits otherwise.
Also, there are only 8 arguments, so don't attempt to load 11.

Fixes SIGSEV crashes in some targets.

Reviewed-by: durandal_1707
Signed-off-by: James Almer <jamrial@gmail.com>
17 months agoavformat/mov: See if mfra makes up the difference for an incomplete sidx.
Dale Curtis [Thu, 13 Aug 2020 22:02:02 +0000 (15:02 -0700)]
avformat/mov: See if mfra makes up the difference for an incomplete sidx.

A few popular sites have started generating MP4 files which have a
sidx plus an mfra. The sidx accounts for all size except the mfra,
so the old code did not mark the fragment index as complete.

Instead we can just check if there's an mfra and if its size makes
up the difference we can mark the index as complete.

Bug: https://crbug.com/1107130
Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
17 months agoavcodec/flacdec: use designated initializers for AVClass
Paul B Mahol [Thu, 27 Aug 2020 23:15:56 +0000 (01:15 +0200)]
avcodec/flacdec: use designated initializers for AVClass

17 months agoavcodec/cfhd: Remove unused-but-set variable
Andreas Rheinhardt [Fri, 21 Aug 2020 09:44:16 +0000 (11:44 +0200)]
avcodec/cfhd: Remove unused-but-set variable

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/af_arnndn: use memcpy for copying in compute_rnn()
Paul B Mahol [Thu, 27 Aug 2020 18:32:52 +0000 (20:32 +0200)]
avfilter/af_arnndn: use memcpy for copying in compute_rnn()

17 months agoavfilter/af_arnndn: use scalarproduct_float() in dct function
Paul B Mahol [Thu, 27 Aug 2020 16:49:02 +0000 (18:49 +0200)]
avfilter/af_arnndn: use scalarproduct_float() in dct function

17 months agoavfilter/af_compensationdelay: always initialize w_ptr with 0
Paul B Mahol [Thu, 27 Aug 2020 16:06:15 +0000 (18:06 +0200)]
avfilter/af_compensationdelay: always initialize w_ptr with 0

It will be changed later anyway, and in case inlink have 0 channels
(should never happen) it will not pick some random value.

17 months agoavfilter/vf_xfade: do not use alpha for average rgb color
Paul B Mahol [Thu, 27 Aug 2020 12:42:44 +0000 (14:42 +0200)]
avfilter/vf_xfade: do not use alpha for average rgb color

17 months agoavfilter/vf_xfade: add corner wipe transforms
Paul B Mahol [Thu, 27 Aug 2020 11:49:14 +0000 (13:49 +0200)]
avfilter/vf_xfade: add corner wipe transforms

17 months agoRevert "avfilter/yadif: simplify the code for better readability"
Limin Wang [Wed, 26 Aug 2020 23:30:30 +0000 (07:30 +0800)]
Revert "avfilter/yadif: simplify the code for better readability"

This reverts commit 2a9b934675b9e2d3850b46f8a618c19b03f02551.

17 months agoavfilter/af_headphone: Fix leak of channel layouts list on error
Andreas Rheinhardt [Mon, 24 Aug 2020 20:21:51 +0000 (22:21 +0200)]
avfilter/af_headphone: Fix leak of channel layouts list on error

In case the multichannel HRIR mode was enabled, an error could happen
between allocating a channel layouts list and attaching it to its target
destination. If an error happened, the list would leak. This is fixed by
attaching the list to its target directly after its allocation.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/af_headphone: Fix segfault upon allocation failure
Andreas Rheinhardt [Mon, 24 Aug 2020 03:26:57 +0000 (05:26 +0200)]
avfilter/af_headphone: Fix segfault upon allocation failure

The headphone filter uses a variable number of inpads and allocates them
in its init function; if all goes well, the number of inpads coincides
with a number stored in the filter's private context. Yet if allocating a
subsequent inpad fails, the uninit function nevertheless uses the number
stored in the private context to determine the number of inpads to free
and not the AVFilterContext's nb_inputs. This will lead to an access
beyond the end of the allocated AVFilterContext.input_pads array and
an invalid free.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/vf_signature: Avoid cast from function pointer to void*
Andreas Rheinhardt [Mon, 24 Aug 2020 22:55:56 +0000 (00:55 +0200)]
avfilter/vf_signature: Avoid cast from function pointer to void*

The signature filter uses qsort, but its compare function doesn't have
the signature required of such a function; therefore it casts the
function pointer to void. Yet this is wrong:
C90 only guarantees that one can convert a pointer to any incomplete
type or object type to void* and back with the result comparing equal
to the original which makes pointers to void generic pointers to
incomplete or object type. Yet C90 lacks a generic function pointer
type.
C99 additionally guarantees that a pointer to a function of one type may
be converted to a pointer to a function of another type with the result
and the original comparing equal when converting back.
This makes any function pointer type a generic function pointer type.
Yet even this does not make pointers to void generic function pointers.

Both GCC and Clang emit warnings for this when in pedantic mode.

This commit fixes this by modifying the compare function to comply with
the expected signature.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/vf_signature: Fix leak of string upon error
Andreas Rheinhardt [Mon, 24 Aug 2020 22:20:35 +0000 (00:20 +0200)]
avfilter/vf_signature: Fix leak of string upon error

If an error happens between allocating a string intended to be used as
an inpad's name and attaching it to its input pad, the string leaks.
Fix this by inserting the inpad directly after allocating its string.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/vf_signature: Fix leak of inpads' names
Andreas Rheinhardt [Mon, 24 Aug 2020 22:20:01 +0000 (00:20 +0200)]
avfilter/vf_signature: Fix leak of inpads' names

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/af_afir: Avoid allocating AVFilterPad names
Andreas Rheinhardt [Sat, 22 Aug 2020 03:20:01 +0000 (05:20 +0200)]
avfilter/af_afir: Avoid allocating AVFilterPad names

If the names are always the same, they need not be duplicated; doing so
saves allocations, checks for the allocations as well as frees.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/af_aiir: Fix segfault and leak upon allocation failure
Andreas Rheinhardt [Sat, 22 Aug 2020 02:47:14 +0000 (04:47 +0200)]
avfilter/af_aiir: Fix segfault and leak upon allocation failure

The aiir filter adds output pads in its init function. Each of these
output pads had a name which was allocated and to be freed in the uninit
function. Given that the aiir filter has between one and two outputs,
one output pad's name was freed unconditionally and a second was freed
conditionally.

Yet if adding output pads fails, there are no output pads at all and
trying to free a nonexistent pad's name will lead to a segfault.

Furthermore, if the name could be successfully allocated, yet adding the
new pad fails, the name would leak.

This commit fixes this by not allocating the pads' names at all any
more: They are constant anyway. This allows to remove the code to free
them and hence fixes the aforementioned bugs.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/avf_aphasemeter: Don't allocate outpad names
Andreas Rheinhardt [Sat, 22 Aug 2020 02:33:58 +0000 (04:33 +0200)]
avfilter/avf_aphasemeter: Don't allocate outpad names

These names are always the same, so not using duplicates saves
allocations, checks for the allocations as well as frees.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/vf_bm3d: Don't allocate inpad names
Andreas Rheinhardt [Sat, 22 Aug 2020 02:17:11 +0000 (04:17 +0200)]
avfilter/vf_bm3d: Don't allocate inpad names

These names are always the same, so not using duplicates saves
allocations, checks for the allocations as well as frees.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/f_ebur128: Don't allocate outpad names
Andreas Rheinhardt [Sat, 22 Aug 2020 02:13:28 +0000 (04:13 +0200)]
avfilter/f_ebur128: Don't allocate outpad names

These names are mostly the same, so not using duplicates saves
allocations, checks for the allocations as well as frees.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/vf_decimate: Don't allocate inpad names
Andreas Rheinhardt [Sat, 22 Aug 2020 02:03:21 +0000 (04:03 +0200)]
avfilter/vf_decimate: Don't allocate inpad names

These names are always the same, so not using duplicates saves
allocations, checks for the allocations as well as frees.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/vf_fieldmatch: Don't allocate inpad names
Andreas Rheinhardt [Sat, 22 Aug 2020 01:57:55 +0000 (03:57 +0200)]
avfilter/vf_fieldmatch: Don't allocate inpad names

These names are always the same, so not using duplicates saves
allocations, checks for the allocations as well as frees.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/vf_premultiply: Fix leak of names of inpads
Andreas Rheinhardt [Sat, 22 Aug 2020 01:51:46 +0000 (03:51 +0200)]
avfilter/vf_premultiply: Fix leak of names of inpads

These names leak because freeing them in the uninit function has been
forgotten. Instead of adding the freeing code, this commit stops
allocating these names. They are constants anyway.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/af_anequalizer: Don't allocate outpad names
Andreas Rheinhardt [Sat, 22 Aug 2020 01:29:25 +0000 (03:29 +0200)]
avfilter/af_anequalizer: Don't allocate outpad names

These names are always the same, so not using duplicates saves
allocations, checks for the allocations as well as frees.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/af_anequalizer: Fix memleak when inserting pad fails
Andreas Rheinhardt [Sat, 22 Aug 2020 01:23:51 +0000 (03:23 +0200)]
avfilter/af_anequalizer: Fix memleak when inserting pad fails

It has been forgotten to free the name of the second outpad if attaching
the first one to the AVFilterContext fails. Fixing this is easy: Only
prepare the second outpad after (and if) the first outpad has been
successfully attached to the AVFilterContext.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavcodec/x86/cfhddsp: try to fix build on x32
Paul B Mahol [Wed, 26 Aug 2020 21:38:10 +0000 (23:38 +0200)]
avcodec/x86/cfhddsp: try to fix build on x32

17 months agoavfilter/vf_xfade: add fadegrays transition
Paul B Mahol [Wed, 26 Aug 2020 21:23:33 +0000 (23:23 +0200)]
avfilter/vf_xfade: add fadegrays transition

17 months agoavcodec/cfhd: add x86 SIMD
Paul B Mahol [Sun, 9 Aug 2020 15:47:34 +0000 (17:47 +0200)]
avcodec/cfhd: add x86 SIMD

Overall speed changes for 1920x1080, yuv422p10le, 60fps from: 0.19x to 0.343x

17 months agoavcodec/tiff: Check jpeg context against jpeg frame parameters
Michael Niedermayer [Wed, 19 Aug 2020 23:05:35 +0000 (01:05 +0200)]
avcodec/tiff: Check jpeg context against jpeg frame parameters

Fixes: out of array access
Fixes: 24825/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-6326925027704832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavcodec/tiff: Restrict tag order based on specification
Michael Niedermayer [Wed, 19 Aug 2020 23:05:35 +0000 (01:05 +0200)]
avcodec/tiff: Restrict tag order based on specification

"The entries in an IFD must be sorted in ascending order by Tag. Note that this is
 not the order in which the fields are described in this document."

This way various dimensions, sample and bit sizes cannot be changed at
arbitrary times which reduces the potential for bugs.
The tag reading code also on various places assumes that numerically previous
tags have already been parsed, so this needs to be enforced one way or another.

If this commit causes problems with real world files which are not easy to fix
then some other form of checks are needed to ensure the various dependencies
in the tag reading are not violated.

Fixes: out of array access
Fixes: 24825/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-6326925027704832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavcodec/tiff: Avoid abort with DNG RAW TIFF with YA8
Michael Niedermayer [Wed, 19 Aug 2020 22:59:35 +0000 (00:59 +0200)]
avcodec/tiff: Avoid abort with DNG RAW TIFF with YA8

Fixes: Assertion failure
Fixes: 24707/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5179910197608448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavcodec/tiff: Check the linearization table size
Michael Niedermayer [Wed, 19 Aug 2020 21:21:21 +0000 (23:21 +0200)]
avcodec/tiff: Check the linearization table size

Fixes: out of array access
Fixes: 24604/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4843529818603520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavcodec/libdav1d: Call ff_set_sar in addition to setting the frame SAR
Derek Buitenhuis [Tue, 25 Aug 2020 13:49:02 +0000 (14:49 +0100)]
avcodec/libdav1d: Call ff_set_sar in addition to setting the frame SAR

Similar to what we do in libaomdec.c.

Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
17 months agoavfilter/yadif: simplify the code for better readability
Limin Wang [Tue, 11 Aug 2020 16:21:54 +0000 (00:21 +0800)]
avfilter/yadif: simplify the code for better readability

Signed-off-by: Limin Wang <lance.lmwang@gmail.com>
17 months agoavformat/mpegtsenc: reindent the code
Limin Wang [Sun, 23 Aug 2020 15:32:31 +0000 (23:32 +0800)]
avformat/mpegtsenc: reindent the code

Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Limin Wang <lance.lmwang@gmail.com>
17 months agoavformat/mpegtsenc: add registration descriptor for AC-3 and EAC3
Limin Wang [Sun, 23 Aug 2020 15:02:31 +0000 (23:02 +0800)]
avformat/mpegtsenc: add registration descriptor for AC-3 and EAC3

Some DVB and ATSC captures are using the official MPEG2 registration
descriptor in addition to using the correct stream type and the
AC-3_audio_stream_descriptor/AC3_descriptor. So let's add it even if it is not
strictly needed for DVB/ATSC.

Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Limin Wang <lance.lmwang@gmail.com>
17 months agoavfilter/af_amerge: Fix segfault upon allocation failure
Andreas Rheinhardt [Mon, 24 Aug 2020 03:46:08 +0000 (05:46 +0200)]
avfilter/af_amerge: Fix segfault upon allocation failure

The amerge filter uses a variable number of inpads and allocates them
in its init function; if all goes well, the number of inpads coincides
with a number stored in the filter's private context. Yet if allocating a
subsequent inpad fails, the uninit function nevertheless uses the number
stored in the private context to determine the number of inpads to free
and not the AVFilterContext's nb_inputs. This will lead to an access
beyond the end of the allocated AVFilterContext.input_pads array and
an invalid free.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/avfilter: Fix indentation
Andreas Rheinhardt [Fri, 21 Aug 2020 23:54:26 +0000 (01:54 +0200)]
avfilter/avfilter: Fix indentation

Forgotten after fdd93eabfb2644f541f7aac9943abce26776ea73.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavcodec/cbs_av1: fix setting FrameWidth in frame_size_with_refs()
James Almer [Sun, 23 Aug 2020 23:45:12 +0000 (20:45 -0300)]
avcodec/cbs_av1: fix setting FrameWidth in frame_size_with_refs()

Section 5.9.7 of the spec states

    UpscaledWidth = RefUpscaledWidth[ ref_frame_idx[ i ] ]
    FrameWidth    = UpscaledWidth
    FrameHeight   = RefFrameHeight[ ref_frame_idx[ i ] ]
    RenderWidth   = RefRenderWidth[ ref_frame_idx[ i ] ]
    RenderHeight  = RefRenderHeight[ ref_frame_idx[ i ] ]

Meaning FrameWidth must not be set to RefFrameWidth[ ref_frame_idx[ i ] ]
like we're currently doing.

Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
17 months agoavcodec/av1_parser: fix parsing show_existing_frame headers
James Almer [Tue, 25 Aug 2020 18:01:43 +0000 (15:01 -0300)]
avcodec/av1_parser: fix parsing show_existing_frame headers

Regression since c8716b5029

Signed-off-by: James Almer <jamrial@gmail.com>
17 months agoavcodec/cbs_av1: use a more appropiate AV1ReferenceFrameState pointer variable name
James Almer [Tue, 25 Aug 2020 17:53:42 +0000 (14:53 -0300)]
avcodec/cbs_av1: use a more appropiate AV1ReferenceFrameState pointer variable name

frame is more commonly used for AV1RawFrameHeader and AV1RawFrame.

Signed-off-by: James Almer <jamrial@gmail.com>
17 months agoavcodec/cbs_av1: fix handling reference frames on show_existing_frame frames
James Almer [Mon, 24 Aug 2020 16:04:23 +0000 (13:04 -0300)]
avcodec/cbs_av1: fix handling reference frames on show_existing_frame frames

Implement Section 7.21 "Reference frame loading process" and Section 7.20
"Reference frame update process" for show_existing_frame frames, as required by
the definition in Section 7.4 "Decode frame wrapup process".

Signed-off-by: James Almer <jamrial@gmail.com>
17 months agoavcodec/cbs_av1: infer frame_type in show_existing_frame frames earlier
James Almer [Mon, 24 Aug 2020 15:21:51 +0000 (12:21 -0300)]
avcodec/cbs_av1: infer frame_type in show_existing_frame frames earlier

This follows the spec and will come in handy in the next commit.

Signed-off-by: James Almer <jamrial@gmail.com>
17 months agoavcodec/cbs_av1: add OrderHint to CodedBitstreamAV1Context
James Almer [Mon, 24 Aug 2020 15:37:23 +0000 (12:37 -0300)]
avcodec/cbs_av1: add OrderHint to CodedBitstreamAV1Context

This follows the spec and will come in handy in a following commit.

Signed-off-by: James Almer <jamrial@gmail.com>
17 months agolavf/rtpdec_jpeg: Fix JFIF version.
Carl Eugen Hoyos [Thu, 21 May 2020 20:03:08 +0000 (22:03 +0200)]
lavf/rtpdec_jpeg: Fix JFIF version.

See also b1931321

17 months agodoc/examples: Always open files as "binary", not "text".
Carl Eugen Hoyos [Wed, 24 Jun 2020 22:01:36 +0000 (00:01 +0200)]
doc/examples: Always open files as "binary", not "text".

Fixes ticket #8638.

17 months agodnn/native: add log error message
Ting Fu [Tue, 25 Aug 2020 03:47:50 +0000 (11:47 +0800)]
dnn/native: add log error message

Signed-off-by: Ting Fu <ting.fu@intel.com>
17 months agodnn/native: unify error return to DNN_ERROR
Ting Fu [Tue, 25 Aug 2020 03:47:49 +0000 (11:47 +0800)]
dnn/native: unify error return to DNN_ERROR

Unify all error return as DNN_ERROR, in order to cease model executing
when return error in ff_dnn_execute_model_native layer_func.pf_exec

Signed-off-by: Ting Fu <ting.fu@intel.com>
17 months agodnn: move output name from DNNModel.set_input_output to DNNModule.execute_model
Guo, Yejun [Thu, 13 Aug 2020 08:19:48 +0000 (16:19 +0800)]
dnn: move output name from DNNModel.set_input_output to DNNModule.execute_model

currently, output is set both at DNNModel.set_input_output and
DNNModule.execute_model, it makes sense that the output name is
provided at model inference time so all the output info is set
at a single place.

and so DNNModel.set_input_output is renamed to DNNModel.set_input

Signed-off-by: Guo, Yejun <yejun.guo@intel.com>
17 months agolavfi/hflip: Support Bayer pixel formats.
Carl Eugen Hoyos [Sun, 26 Jul 2020 19:58:31 +0000 (21:58 +0200)]
lavfi/hflip: Support Bayer pixel formats.

Fixes part of ticket #8819.

17 months agolavf/mxfdec: Limit score for files with run-in.
Carl Eugen Hoyos [Mon, 24 Aug 2020 19:37:00 +0000 (21:37 +0200)]
lavf/mxfdec: Limit score for files with run-in.

Only return AVPROBE_SCORE_MAX if the header partition pack key
is at the start of the file.
Fixes ticket #8846.

Reviewed-by: Tomas Härdin
17 months agoavcodec/aacdec_template: add more checks to make sure only 22.2 gets to 22.2
Jan Ekström [Tue, 18 Aug 2020 17:49:00 +0000 (20:49 +0300)]
avcodec/aacdec_template: add more checks to make sure only 22.2 gets to 22.2

Validates the set channel layout as well as verifies that the received
layout to the function matches the reference layout, so that it matches
the implemented re-ordering logic.

Fixes #8845

17 months agoavcodec/aacdec_template: keep tabs on layout in sniff_channel_order
Jan Ekström [Tue, 18 Aug 2020 17:25:03 +0000 (20:25 +0300)]
avcodec/aacdec_template: keep tabs on layout in sniff_channel_order

This way the layout set at various points can be checked instead
of only having the layout at the end.

17 months agoSet AVSTREAM_PARSE_HEADERS flag for AV1 MP4 streams
Vikas Agrawal [Fri, 21 Aug 2020 06:37:18 +0000 (12:07 +0530)]
Set AVSTREAM_PARSE_HEADERS flag for AV1 MP4 streams

It help initialize chroma format and other info properly
Chroma format wasn't correct if I use below code:
        avformat_find_stream_info(fmtc, NULL);
        iVideoStream = av_find_best_stream(fmtc, AVMEDIA_TYPE_VIDEO, -1, -1, NULL, 0);
        eChromaFormat = (AVPixelFormat)fmtc->streams[iVideoStream]->codecpar->format;

Signed-off-by: James Almer <jamrial@gmail.com>
17 months agofate: remove "-v 0" from ffprobe tests.
Nicolas George [Fri, 21 Aug 2020 11:03:50 +0000 (13:03 +0200)]
fate: remove "-v 0" from ffprobe tests.

17 months agodnn_backend_native_layer_mathbinary: add floormod support
Mingyu Yin [Sun, 23 Aug 2020 15:12:13 +0000 (23:12 +0800)]
dnn_backend_native_layer_mathbinary: add floormod support

Signed-off-by: Mingyu Yin <mingyu.yin@intel.com>
17 months agodnn_backend_native_layer_mathbinary: change to function pointer
Mingyu Yin [Sun, 23 Aug 2020 15:12:12 +0000 (23:12 +0800)]
dnn_backend_native_layer_mathbinary: change to function pointer

Signed-off-by: Mingyu Yin <mingyu.yin@intel.com>
17 months agoavcodec/av1_parser: read frame properties directly from AV1RawFrameHeader
James Almer [Sun, 23 Aug 2020 19:23:57 +0000 (16:23 -0300)]
avcodec/av1_parser: read frame properties directly from AV1RawFrameHeader

Simplifies code

Reviewed-by: Mark Thompson <sw@jkqxz.net>
Signed-off-by: James Almer <jamrial@gmail.com>
17 months agoavcodec/cbs_av1: infer frame_type when parsing a show_existing_frame frame
James Almer [Sun, 23 Aug 2020 19:23:56 +0000 (16:23 -0300)]
avcodec/cbs_av1: infer frame_type when parsing a show_existing_frame frame

Reviewed-by: Mark Thompson <sw@jkqxz.net>
Signed-off-by: James Almer <jamrial@gmail.com>
17 months agoavcodec/cbs_av1: infer frame sizes when not coded in the bitstream
James Almer [Sun, 23 Aug 2020 19:17:12 +0000 (16:17 -0300)]
avcodec/cbs_av1: infer frame sizes when not coded in the bitstream

This makes them available for all frames within a Temporal Unit.

Reviewed-by: Mark Thompson <sw@jkqxz.net>
Signed-off-by: James Almer <jamrial@gmail.com>
17 months agoavfilter/af_aformat: Add uninit function
Andreas Rheinhardt [Sun, 9 Aug 2020 14:42:37 +0000 (16:42 +0200)]
avfilter/af_aformat: Add uninit function

Fixes memleaks in case init fails (e.g. because of invalid parameters
like 'aformat=sample_fmts=s16:cl=wtf') or also if query_formats is never
called.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/avfiltergraph: Remove unused macro parameter
Andreas Rheinhardt [Sun, 9 Aug 2020 13:21:25 +0000 (15:21 +0200)]
avfilter/avfiltergraph: Remove unused macro parameter

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter: Remove redundant ff_formats/channel_layouts_unref()
Andreas Rheinhardt [Fri, 7 Aug 2020 21:46:33 +0000 (23:46 +0200)]
avfilter: Remove redundant ff_formats/channel_layouts_unref()

ff_add_format() and ff_add_channel_layout() already unref the list upon
error.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/vf_hwdownload: Fix leak of formats list upon error
Andreas Rheinhardt [Fri, 7 Aug 2020 21:40:43 +0000 (23:40 +0200)]
avfilter/vf_hwdownload: Fix leak of formats list upon error

If adding the list of input formats to its AVFilterLink fails, the list
of output formats (which has not been attached to permanent storage yet)
leaks. This has been fixed by not creating the lists of in- and output
formats simultaneously. Instead creating said lists is relegated to
ff_formats_pixdesc_filter() (this also avoids the reallocations implicit
in using ff_add_format()) and the second list is only created after (and
if) the first list has been permanently attached to its AVFilterLink.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/formats: Fix double frees and memleaks on error
Andreas Rheinhardt [Fri, 7 Aug 2020 17:43:20 +0000 (19:43 +0200)]
avfilter/formats: Fix double frees and memleaks on error

The formats API deals with lists of channel layouts, sample rates,
pixel formats and sample formats. These lists are refcounted in a way in
which the list structure itself contains pointers to all of its owners.
Furthermore, it is possible for a list to be not owned by anyone yet;
this status is temporary until the list has been attached to an owner.
Adding an owner to a list involves reallocating the list's list of
owners and can therefore fail.

In order to reduce the amount of checks and cleanup code for the users
of this API, the API is supposed to be lenient when faced with input
lists that are NULL and it is supposed to clean up if adding an owner
to a list fails, so that a simple use case like

list = ff_make_format_list(foo_fmts);
if ((ret = ff_formats_ref(list, &ctx->inputs[0]->out_formats)) < 0)
    return ret;

needn't check whether list could be successfully allocated
(ff_formats_ref() return AVERROR(ENOMEM) if it couldn't) and it also
needn't free list if ff_formats_ref() couldn't add an owner for it.

But the cleaning up after itself was broken. The root cause was that
the refcount was decremented during unreferencing whether or not the
element to be unreferenced was actually an owner of the list or not.
This means that if the above sample code is continued by

if ((ret = ff_formats_ref(list, &ctx->inputs[1]->out_formats)) < 0)
    return ret;

and that if an error happens at the second ff_formats_ref() call, the
automatic cleaning of list will decrement the refcount from 1 (the sole
owner of list at this moment is ctx->input[0]->out_formats) to 0 and so
the list will be freed; yet ctx->input[0]->out_formats still points to
the list and this will lead to a double free/use-after-free when
ctx->input[0] is freed later.

Presumably in order to work around such an issue, commit
93afb338a405eac0f9e7b092bc26603378bfcca6 restricted unreferencing to
lists with owners. This does not solve the root cause (the above example
is not fixed by this) at all, but it solves some crashs.

This commit fixes the API: The list's refcount is only decremented if
an owner is removed from the list of owners and not if the
unref-function is called with a pointer that is not among the owners of
the list. Furtermore, the requirement for the list to have owners is
dropped.

This implies that if the first call to ff_formats_ref() in the above
example fails, the refcount which is initially zero during unreferencing
is not modified, so that the list will be freed automatically in said
call to ff_formats_ref() as every list whose refcount reaches zero is.

If on the other hand, the second call to ff_formats_ref() is the first
to fail, the refcount would stay at one during the automatic
unreferencing in ff_formats_ref(). The list would later be freed when
its last (and in this case sole) owner (namely
ctx->inputs[0]->out_formats) gets unreferenced.

The issues described here for ff_formats_ref() also affected the other
functions of this API. E.g. ff_add_format() failed to clean up after
itself if adding an entry to an already existing list failed (the case
of a freshly allocated list was handled specially and this commit also
removes said code). E.g. ff_all_formats() inherited the flaw.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/af_channelmap: Fix double-free of AVFilterChannelLayouts on error
Andreas Rheinhardt [Fri, 7 Aug 2020 16:54:18 +0000 (18:54 +0200)]
avfilter/af_channelmap: Fix double-free of AVFilterChannelLayouts on error

The query_formats function of the channelmap filter tries to allocate
a list of channel layouts which on success are attached to more permanent
objects (an AVFilterLink) for storage afterwards. If attaching succeeds,
the link becomes one of the common owners (in this case, the only owner)
of the list. Yet if the list has been successfully attached to the link
and an error happens lateron, the list was manually freed, which is wrong,
because it is owned by its link so that the link's pointer to the list will
become dangling and there will be a double-free/use-after-free when the link
is later cleaned up automatically.

This commit fixes this by removing the custom freeing code; this will
temporarily add a leaking codepath (if attaching the list fails, the list
will leak), but this will be fixed soon by making sure that an
AVFilterChannelLayouts without owner will be automatically freed when
attaching it to an AVFilterLink fails.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/vf_alphamerge: Fix double-free of AVFilterFormats on error
Andreas Rheinhardt [Fri, 7 Aug 2020 13:04:41 +0000 (15:04 +0200)]
avfilter/vf_alphamerge: Fix double-free of AVFilterFormats on error

The query_formats function of the alphamerge filter tries to allocate
two lists of formats which on success are attached to more permanent
objects (AVFilterLinks) for storage afterwards. If attaching a list
to an AVFilterLink succeeds, the link becomes one of the owners of
the list. Yet if attaching a list to one of its links succeeds and
an error happens lateron, both lists were manually freed, which is wrong
if the list is already owned by one or more links; these links' pointers
to their lists will become dangling and there will be a double-free/use-
after-free when these links are cleaned up automatically.

This commit fixes this by removing the custom freeing code; this will
temporarily add a leaking codepath (if attaching a list not already
owned by a link to a link fails, the list will leak), but this will
be fixed soon by making sure that an AVFilterFormats without owner will
be automatically freed when attaching it to an AVFilterLink fails.
At most one list leaks because as of this commit a new list is only
allocated after the old list has been successfully attached to a link.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/vf_overlay: Fix double-free of AVFilterFormats on error
Andreas Rheinhardt [Fri, 7 Aug 2020 12:42:57 +0000 (14:42 +0200)]
avfilter/vf_overlay: Fix double-free of AVFilterFormats on error

The query_formats function of the overlay filter tries to allocate
two lists (only one in a special case) of formats which on success
are attached to more permanent objects (AVFilterLinks) for storage
afterwards. If attaching a list to an AVFilterLink succeeds, it is
in turn owned by the AVFilterLink (or more exactly, the AVFilterLink
becomes one of the common owners of the list). Yet if attaching a list
to one of its links succeeds and an error happens lateron, both lists
were manually freed, whic is wrong if the list is already owned by one
or more links; these links' pointers to their lists will become dangling
and there will be a double-free/use-after-free when these links are
cleaned up automatically.

This commit fixes this by removing the custom freeing code; this will
temporarily add a leaking codepath (if attaching a list not already
owned by a link to a link fails, the list will leak), but this will
be fixed soon by making sure that an AVFilterFormats without owner will
be automatically freed when attaching it to an AVFilterLink fails.
Notice that at most one list leaks because a new list is only allocated
after the old list has been successfully attached to a link.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/vf_remap: Fix double-free of AVFilterFormats on error
Andreas Rheinhardt [Fri, 7 Aug 2020 12:21:56 +0000 (14:21 +0200)]
avfilter/vf_remap: Fix double-free of AVFilterFormats on error

The query_formats function of the remap filter tries to allocate
two lists of formats which on success are attached to more permanent objects
(AVFilterLinks) for storage afterwards. If attaching a list to an
AVFilterLink succeeds, it is in turn owned by the AVFilterLink (or more
exactly, the AVFilterLink becomes one of the common owners of the list).
Yet if attaching a list to one of its links succeeds and an error happens
lateron, both lists were manually freed, which means that is wrong if the
list is already owned by one or more links; these links' pointers to
their lists will become dangling and there will be a double-free/use-after-
free when these links are cleaned up automatically.

This commit fixes this by removing the custom free code; this will
temporarily add a leaking codepath (if attaching a list not already
owned by a link to a link fails, the list will leak), but this will
be fixed soon by making sure that an AVFilterFormats without owner will
be automatically freed when attaching it to an AVFilterLink fails.
Notice at most one list leaks because a new list is only allocated
after the old list has been successfully attached to a link.

Reviewed-by: Nicolas George <george@nsup.org>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/vf_showpalette: Fix double-free of AVFilterFormats on error
Andreas Rheinhardt [Fri, 7 Aug 2020 11:23:30 +0000 (13:23 +0200)]
avfilter/vf_showpalette: Fix double-free of AVFilterFormats on error

The query_formats function of the showpalette filter tries to allocate
two lists of formats which on success are attached to more permanent objects
(AVFilterLinks) for storage afterwards. If attaching a list to an
AVFilterLink succeeds, the link becomes one (in this case the only one)
of the owners of the list. Yet if attaching the first list to its link
succeeds and attaching the second list fails, both lists were manually
freed, which means that the first link's pointer to the first list
becomes dangling and there will be a double-free when the first link is
cleaned up automatically.

This commit fixes this by removing the custom free code; this will
temporarily add a leaking codepath (if attaching a list to a link fails,
the list will leak), but this will be fixed shortly by making sure that
an AVFilterFormats without owner will be automatically freed when
attaching it to an AVFilterLink fails. Notice at most one list leaks
because as of this commit a new list is only allocated after the old list
has been successfully attached to a link.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/af_amix: Fix double-free of AVFilterChannelLayouts on error
Andreas Rheinhardt [Fri, 7 Aug 2020 15:31:11 +0000 (17:31 +0200)]
avfilter/af_amix: Fix double-free of AVFilterChannelLayouts on error

The query_formats function of the amix filter tries to allocate a list
of channel layouts which are attached to more permanent objects
(an AVFilter's links) for storage afterwards on success. If attaching
a list to a link succeeds, the link becomes one of the common owners
of the list. Yet if a list has been successfully attached to links (or if
there were no links to attach it to in which case
ff_set_common_channel_layouts() already frees the list) and an error
happens lateron, the list was manually freed, which is wrong, because
the list has either already been freed or it is owned by its links in
which case these links' pointers to their list will become dangling and
there will be double-frees/uses-after-free when these links are cleaned
up automatically.

This commit fixes this by removing the custom freeing code; this is made
possible by using the list in ff_set_common_channel_layouts() directly
after its allocation (without anything that can fail in between).

Notice that ff_set_common_channel_layouts() is buggy itself which can
lead to double-frees on error. This is not fixed in this commit.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/af_amix: Don't needlessly reallocate table
Andreas Rheinhardt [Fri, 7 Aug 2020 14:08:42 +0000 (16:08 +0200)]
avfilter/af_amix: Don't needlessly reallocate table

Replace using ff_add_format() repeatedly by a single call to
ff_make_format_list(). (Right now this also fixes a memleak: If the
first ff_add_format() succeeds and a subsequent call fails, the list
leaks.)

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/vf_vpp_qsv: Fix leak of AVFilterFormats on error
Andreas Rheinhardt [Fri, 7 Aug 2020 03:54:34 +0000 (05:54 +0200)]
avfilter/vf_vpp_qsv: Fix leak of AVFilterFormats on error

The vpp_qsv's query_formats function allocated two AVFilterFormats,
before storing them permanently. If storing the first of them fails,
the function simply returns and the second leaks. This has been fixed by
only allocating the second AVFilterFormats structure after the first one
has been successfully stored.

Fixes Coverity issue #1422231.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/vf_paletteuse: Fix leaks of AVFilterFormats on error
Andreas Rheinhardt [Fri, 7 Aug 2020 04:09:59 +0000 (06:09 +0200)]
avfilter/vf_paletteuse: Fix leaks of AVFilterFormats on error

The paletteuse's query_formats function allocated three AVFilterFormats
before storing them permanently. If allocating one of them failed, the
three AVFilterFormats structures would be freed with av_freep() which
does not free separately allocated subelements (namely the formats
array) which leak.

Furthermore, if storing one of the first two fails, the function simply
returns and the ones not yet stored leak.

These leaks have been fixed by only creating a new AVFilterFormats after
the last one has already been permanently stored. Furthermore, it is
enough to check whether the elements have been properly stored as
ff_formats_ref() by design returns AVERROR(ENOMEM) if it is provided a
NULL AVFilterFormats *.

Fixes Coverity issues #1270818 and #1270819.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/graphparser: Fix memleak when linking filters fails
Andreas Rheinhardt [Sun, 23 Aug 2020 09:12:30 +0000 (11:12 +0200)]
avfilter/graphparser: Fix memleak when linking filters fails

Parsing labeled outputs involves a check for an already known match
(a labeled input with the same name) to pair them together. If yes,
it is attempted to create a link between the two filters; in this case
the AVFilterInOuts have fulfilled their purpose and are freed. Yet if
creating the link fails, these AVFilterInOuts have up until now not been
freed, although they had already been removed from their respective lists
(which means that they are not freed automatically). In other words:
They leak. This commit fixes this.

This fixes ticket #7084. Said ticket contains an example program to
reproduce a leak. It can also be reproduced with ffmpeg alone, e.g. with
the complex filters "[0]null[1],[2]anull[0]" or with "[0]abitscope[0]".
All of these three examples involve media type mismatches which make it
impossible to create the links. The bug could also be triggered by other
means, e.g. failure to allocate the necessary AVFilterLink.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agofftools/ffmpeg: Fix leak of AVFilterInOut in case of error
Andreas Rheinhardt [Sun, 23 Aug 2020 01:49:48 +0000 (03:49 +0200)]
fftools/ffmpeg: Fix leak of AVFilterInOut in case of error

The AVFilterInOuts normally get freed in init_output_filter() when
the corresponding streams get created; yet if an error happens before
one reaches said point, they leak. Therefore this commit makes
ffmpeg_cleanup free them, too.

Fixes ticket #8267.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/graphparser: Check allocations for success
Andreas Rheinhardt [Sat, 22 Aug 2020 23:51:22 +0000 (01:51 +0200)]
avfilter/graphparser: Check allocations for success

parse_filter() did not check the return value of av_get_token() for
success; in case name (the name of a filter) was NULL, one got a
segfault in av_strlcpy() (called from create_filter()).

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/graphparser: Don't set pointer to one beyond '\0' of string
Andreas Rheinhardt [Sat, 22 Aug 2020 22:31:17 +0000 (00:31 +0200)]
avfilter/graphparser: Don't set pointer to one beyond '\0' of string

This happened in parse_link_name() if there was a '[' without matching
']'. While this is not undefined behaviour (pointer arithmetic one
beyond the end of an array works fine as long as there are no accesses),
it is potentially dangerous. It currently isn't (all callers of
parse_link_name() treat this as an error and don't access the string any
more), but making sure that this will never cause trouble in the future
seems nevertheless worthwhile.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agoavfilter/graphparser: Fix leaks when parsing inputs fails
Andreas Rheinhardt [Sat, 22 Aug 2020 21:54:13 +0000 (23:54 +0200)]
avfilter/graphparser: Fix leaks when parsing inputs fails

parse_inputs() uses a temporary linked list to parse the labeled inputs
of a filter; said linked list owns its elements (and their names). On
success, the list of unlabeled inputs is appened to the end of the list
of labeled inputs and the new list is returned; yet on failures, nothing
frees the already existing elements of the temporary linked list, leading
to a leak.

This can be triggered by e.g. using '-vf [v][' in the FFmpeg
command-line tool.

This leak seems to exist since 4e781c25b7b1955d1a9a0b0771c3ce1acb0957bd.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
17 months agocbs_av1: Fix test for presence of buffer_removal_time element
Mark Thompson [Sun, 23 Aug 2020 16:06:06 +0000 (17:06 +0100)]
cbs_av1: Fix test for presence of buffer_removal_time element

The frame must be in both the spatial and temporal layers for the
operating point, not just one of them.

17 months agoavcodec/v4l2_m2m_enc: reindent after previous commit
Andriy Gelman [Sun, 23 Aug 2020 17:34:01 +0000 (13:34 -0400)]
avcodec/v4l2_m2m_enc: reindent after previous commit

Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com>
17 months agoavcodec/v4l2_m2m_enc: buffer frame if it cannot be enqueued
Andriy Gelman [Sun, 23 Aug 2020 17:33:37 +0000 (13:33 -0400)]
avcodec/v4l2_m2m_enc: buffer frame if it cannot be enqueued

Currently if the frame buffers are full, the frame is unrefed and
dropped.  Instead buffer the frame so that it is enqueued in the
next v4l2_receive_packet() call.  The behavior was observed on
DragonBoard 410c.

Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com>
17 months agoavcodec/cbs_av1: always store temporal_id and spatial_id in CodedBitstreamAV1Context
James Almer [Sun, 23 Aug 2020 17:30:23 +0000 (14:30 -0300)]
avcodec/cbs_av1: always store temporal_id and spatial_id in CodedBitstreamAV1Context

Also infer them when not coded in the bitstream.

Reviewed-by: jkqxz
Signed-off-by: James Almer <jamrial@gmail.com>
17 months agoavfilter/af_afir: make use of vector_fmac_scalar() too
Paul B Mahol [Sun, 23 Aug 2020 15:50:00 +0000 (17:50 +0200)]
avfilter/af_afir: make use of vector_fmac_scalar() too