Michael Niedermayer [Sun, 30 Jun 2019 21:28:13 +0000 (23:28 +0200)]
avcodec/ilbcdec: Simplify use of unsigned and fix more undefined overflows
Fixes: signed integer overflow:
2147475672 + 8192 cannot be represented in type 'int'
Fixes: 15415/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ILBC_fuzzer-
5712074128228352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Sun, 30 Jun 2019 15:54:45 +0000 (17:54 +0200)]
avcodec/golomb: Correct the doxy about get_ue_golomb() and errors
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Sat, 29 Jun 2019 21:23:25 +0000 (23:23 +0200)]
avformat/utils: Check timebase before use in estimate_timings()
Fixes: division by 0
Fixes: 15480/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-
5746727434321920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Sat, 29 Jun 2019 19:53:09 +0000 (21:53 +0200)]
avcodec/hq_hqa: Use ff_set_dimensions()
Fixes: 15530/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-
5637370344374272
Fixes: signed integer overflow: 65312 * 65312 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Fri, 28 Jun 2019 17:20:43 +0000 (19:20 +0200)]
avcodec/rv10: Fix integer overflow in aspect ratio compare
Fixes: signed integer overflow: 2040 *
1187872 cannot be represented in type 'int'
Fixes: 15368/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV20_fuzzer-
5681657136283648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Fri, 28 Jun 2019 18:02:32 +0000 (20:02 +0200)]
avcodec/tta: Limit decoder to 16 channels
libtta 2.3 has a limit of 6 channels, so 16 is substantially above the "official" already
Fixes: OOM
Fixes: 15249/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-
5643988125614080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Fri, 28 Jun 2019 18:38:56 +0000 (20:38 +0200)]
avcodec/sanm: Optimize fill_frame() with av_memcpy_backptr()
Fixes: Timeout (76 sec -> 24 sec)
Fixes: 15043/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-
5699856238116864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Wed, 26 Jun 2019 22:02:31 +0000 (00:02 +0200)]
avformat/vividas: Check for input length in get_v()
Fixes: out of array read
Fixes: 15286/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-
5658245101780992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Wed, 26 Jun 2019 22:15:03 +0000 (00:15 +0200)]
avcodec/4xm: Fix signed integer overflows in idct()
Fixes: signed integer overflow: 20242 * 121095 cannot be represented in type 'int'
Fixes: 15310/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-
5737051745419264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Sun, 23 Jun 2019 23:01:04 +0000 (01:01 +0200)]
avcodec/qdm2: Check checksum_size for 0
Fixes: Infinite loop
Fixes: 15337/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-
5757428949319680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Sun, 23 Jun 2019 23:01:03 +0000 (01:01 +0200)]
avcodec/qdm2: error out of qdm2_fft_decode_tones() before entering endless loop
Fixes: signed integer overflow:
2147483646 + 2 cannot be represented in type 'int'
Fixes: infinite loop
Fixes: 15396/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-
5116605501014016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Sun, 23 Jun 2019 23:01:02 +0000 (01:01 +0200)]
avcodec/qdm2: Do not read out of array in fix_coding_method_array()
Instead we ask for a sample, its unclear what to do in this case.
Fixes: index 30 out of bounds for type 'int8_t [30][64]'
Fixes: 15339/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-
5749441484554240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Tue, 25 Jun 2019 22:23:47 +0000 (00:23 +0200)]
avcodec/simple_idct_template: Fix integer overflow in idctSparseColAdd()
Fixes: signed integer overflow:
1106434976 +
1041773512 cannot be represented in type 'int'
Fixes: 15421/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV2_fuzzer-
5669209314426880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Tue, 25 Jun 2019 22:03:01 +0000 (00:03 +0200)]
avcodec/simple_idct_template: Fix integer overflow in idctSparseCol()
Fixes: signed integer overflow: -
1027919784 + -
1120041624 cannot be represented in type 'int'
Fixes: 15406/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-
5700646528876544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Tue, 25 Jun 2019 21:42:43 +0000 (23:42 +0200)]
avcodec/svq3: Use ff_set_dimension()
Fixes: OOM
Fixes: 15410/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-
5659464805384192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Sat, 22 Jun 2019 17:21:50 +0000 (19:21 +0200)]
avcodec/iff: Check ham vs bpp
This checks the ham value much stricter and avoids hitting cases which cannot be reached
with data from the libavformat demuxer.
Fixes: out of array access
Fixes: 15320/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-
5080476840099840
Fixes: 15423/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-
5630765833912320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Fri, 21 Jun 2019 20:43:23 +0000 (22:43 +0200)]
avcodec/ffwavesynth: use uint32_t to compute difference, it is enough
Fixes: signed integer overflow:
6494225984479297536 - -
6043795377581187040 cannot be represented in type 'long'
Fixes: 15285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-
5632780307791872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Fri, 21 Jun 2019 20:41:25 +0000 (22:41 +0200)]
avcodec/ffwavesynth: Simplify lcg_seek(), avoid negative case
Fixes: negation of -
9223372036854775808 cannot be represented in type 'int64_t' (aka 'long'); cast to an unsigned type to negate this value to itself
Fixes: 15289/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-
5709034499342336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Fri, 21 Jun 2019 20:08:27 +0000 (22:08 +0200)]
avcodec/ffwavesynth: Fix backward lcg_seek()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Fri, 21 Jun 2019 21:45:36 +0000 (23:45 +0200)]
avcodec/flicvideo: Fix off by 1 error in flic_decode_frame_24BPP()
Fixes: out of array access
Fixes: 15360/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-
5653837190266880
Fixes: 15412/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-
5740537648250880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Sat, 15 Jun 2019 21:28:25 +0000 (23:28 +0200)]
avcodec/vc1_block: Check for vlc error in vc1_decode_ac_coeff()
Fixes: index -1 out of bounds for type 'const uint8_t [185][2]'
Fixes: 15250/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-
5648992869810176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Tue, 18 Jun 2019 23:04:07 +0000 (01:04 +0200)]
avcodec/alac: Check lpc_quant
lpc_quant of 0 produces undefined behavior, thus disallow this.
If valid samples use this then such a sample would be quite
usefull to confirm the correct&lossles handling of this.
Fixes: libavcodec/alac.c:218:25: runtime error: shift exponent -1 is negative
Fixes: 15273/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-
5656388535058432
Fixes: 15276/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-
5761238417539072
Fixes: 15315/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-
5767260766994432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Mon, 3 Jun 2019 09:22:36 +0000 (11:22 +0200)]
avcodec/dxv: Initialize tex_funct to NULL
Fixes: Various anomalies
Fixes: 14493/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_fuzzer-
5071018000908288
Fixes: 14630/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_fuzzer-
5714888963391488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Andreas Rheinhardt [Wed, 19 Jun 2019 23:45:09 +0000 (01:45 +0200)]
vp9_metadata: Avoid allocations and copies of packet structures
This commit changes vp9_metadata to (a) use ff_bsf_get_packet_ref
instead of ff_bsf_get_packet (thereby avoiding one malloc and free per
filtered packet) and (b) to use only one packet structure at all,
thereby avoiding a call to av_packet_copy_props.
(b) has been made possible by the recent changes to ff_cbs_write_packet.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Andreas Rheinhardt [Wed, 19 Jun 2019 23:45:08 +0000 (01:45 +0200)]
mpeg2_metadata: Localize inserting of sequence display extensions
If a new sequence display extension had to be added, this was up until
now done at two places: One where a sequence display extension was
initialized with default values and one where the actual sequence
display extension was inserted into the fragment. This division of
labour is unnecessary and pointless; it has been changed.
Furthermore, if a sequence display extension has to be added, the
earlier code set some fields to their default value twice. This has been
changed, too.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Andreas Rheinhardt [Wed, 19 Jun 2019 23:45:07 +0000 (01:45 +0200)]
mpeg2_metadata: Avoid allocations and copies of packet structures
This commit changes mpeg2_metadata to (a) use ff_bsf_get_packet_ref
instead of ff_bsf_get_packet (thereby avoiding one malloc and free per
filtered packet) and (b) to use only one packet structure at all,
thereby avoiding a call to av_packet_copy_props.
(b) has been made possible by the recent changes to ff_cbs_write_packet.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Andreas Rheinhardt [Wed, 19 Jun 2019 23:45:06 +0000 (01:45 +0200)]
h265_metadata: Correct error check
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Andreas Rheinhardt [Wed, 19 Jun 2019 23:45:05 +0000 (01:45 +0200)]
h265_metadata: Avoid allocations and copies of packet structures
This commit changes h265_metadata to (a) use ff_bsf_get_packet_ref
instead of ff_bsf_get_packet (thereby avoiding one malloc and free per
filtered packet) and (b) to use only one packet structure at all,
thereby avoiding a call to av_packet_copy_props.
(b) has been made possible by the recent changes to ff_cbs_write_packet.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Andreas Rheinhardt [Wed, 19 Jun 2019 23:45:04 +0000 (01:45 +0200)]
h264_redundant_pps: Fix looping over an access unit's units
When looping over an access unit's units in positive direction and
deleting some of them, one needs to make sure that a unit that is at
the position of a unit that just got deleted gets checked, too.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Andreas Rheinhardt [Wed, 19 Jun 2019 23:45:03 +0000 (01:45 +0200)]
h264_redundant_pps: Avoid allocations and copies of packet structures
This commit changes h264_redundant_pps to (a) use ff_bsf_get_packet_ref
instead of ff_bsf_get_packet (thereby avoiding one malloc and free per
filtered packet) and (b) to use only one packet structure at all,
thereby avoiding a call to av_packet_copy_props.
(b) has been made possible by the recent changes to ff_cbs_write_packet.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Andreas Rheinhardt [Wed, 19 Jun 2019 23:45:00 +0000 (01:45 +0200)]
av1_metadata: Error out if fragment is empty
If the fragment is empty after parsing (i.e. it contains no OBUs), then
the check for the type of the fragment's first OBU is nonsensical; so
error out in this case just as h264_metadata and hevc_metadata do.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Andreas Rheinhardt [Mon, 17 Jun 2019 03:42:14 +0000 (05:42 +0200)]
h264_metadata: Localize code for display orientation
The recent changes to h264_metadata (enabled by the recent changes to
ff_cbs_write_packet) made it possible to add side_data to the output
packet at any place, not only after the output packet has been written
and the properties of the input packet copied. This means that one can
now localize the code to add display orientation side-data to the packet
to the place dealing with said display-orientation.
Furthermore, the documentation of av_display_rotation_set states that
the matrix will be fully overwritten by it, so there is no need to
allocate it with av_mallocz.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Andreas Rheinhardt [Mon, 17 Jun 2019 03:42:13 +0000 (05:42 +0200)]
h264_metadata: Avoid allocations and copies of packet structures
This commit changes h264_metadata to (a) use ff_bsf_get_packet_ref
instead of ff_bsf_get_packet (thereby avoiding one malloc and free per
filtered packet) and (b) to use only one packet structure at all,
thereby avoiding a call to av_packet_copy_props.
(b) has been made possible by the recent changes to ff_cbs_write_packet.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Andreas Rheinhardt [Mon, 17 Jun 2019 03:42:12 +0000 (05:42 +0200)]
av1/h264_metadata, filter_units: Count down when deleting units
When testing whether a particular unit should be kept or discarded, it
is best to start at the very last unit of a fragment and count down,
because that way a unit that will eventually be deleted won't be
memmoved during earlier deletions; and frag/au->nb_units need only be
evaluated once in this case and the counter is automatically correct
when a unit got deleted.
It also works for double loops, i.e. when looping over all SEI messages
in all SEI units of an access unit.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Andreas Rheinhardt [Mon, 17 Jun 2019 03:42:11 +0000 (05:42 +0200)]
filter_units: Avoid allocations and copies of packet structures
This commit changes filter_units to (a) use ff_bsf_get_packet_ref
instead of ff_bsf_get_packet (thereby avoiding one malloc and free per
filtered packet) and (b) to use only one packet structure at all,
thereby avoiding a call to av_packet_copy_props (or, in case of
passthrough, to av_packet_move_ref).
(b) has been made possible by the recent changes to ff_cbs_write_packet.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Andreas Rheinhardt [Mon, 17 Jun 2019 03:42:10 +0000 (05:42 +0200)]
filter_units: Reindent after previous commit
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Andreas Rheinhardt [Mon, 17 Jun 2019 03:42:09 +0000 (05:42 +0200)]
filter_units: Don't use fake loop
According to the BSF API, when a BSF is finished with an input packet,
it should return AVERROR(EAGAIN) to signal that another packet should be
sent to the BSF via av_bsf_send_packet that the actual BSF can receive
via ff_bsf_get_packet[_ref]. filter_units on the other hand simply called
ff_bsf_get_packet again if the first packet received didn't result in
any output. This call of course returned AVERROR(EAGAIN) which was
returned, but it is nevertheless better to not include a fake loop.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Andreas Rheinhardt [Mon, 17 Jun 2019 03:42:08 +0000 (05:42 +0200)]
filter_units: Unref packet on failure
According to the API, the packet structure a bsf receives must not be
touched on failure, yet filter_units nevertheless did it.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Andreas Rheinhardt [Mon, 17 Jun 2019 03:42:07 +0000 (05:42 +0200)]
av1_metadata: Avoid allocations and copies of packet structures
This commit changes av1_metadata to (a) use ff_bsf_get_packet_ref
instead of ff_bsf_get_packet (thereby avoiding one malloc and free per
filtered packet) and (b) to use only one packet structure at all,
thereby avoiding a call to av_packet_copy_props.
(b) has been made possible by the recent changes to ff_cbs_write_packet.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Andreas Rheinhardt [Mon, 17 Jun 2019 03:42:06 +0000 (05:42 +0200)]
cbs: Allow non-blank packets in ff_cbs_write_packet
Up until now, ff_cbs_write_packet always initialized the packet
structure it received without documenting this behaviour; furthermore,
the packet's buffer would (on success) be overwritten with the new
buffer without unreferencing the old. This meant that the input packet
had to be either clean (otherwise there would be memleaks) in which case
the initialization is redundant or uninitialized. ff_cbs_write_packet
was never used with uninitialized packets, so the initialization was
redundant. Worse yet, it forced callers to use more than one packet and
made it difficult to add side-data to a packet designated for output,
because said side-data could only be attached after the call to
ff_cbs_write_packet.
This has been changed. It is now allowed to use a non-blank packet.
The currently existing buffer will be unreferenced and replaced by
the new one, as will be the accompanying fields (i.e. data and size).
The rest isn't touched at all.
This change will enable us to use only one packet in the bitstream
filters that rely on CBS.
This commit also updates the documentation of ff_cbs_write_extradata
and ff_cbs_write_packet (to better describe existing behaviour and in
the latter case to also describe the new behaviour).
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Amir Pauker [Fri, 21 Jun 2019 14:15:17 +0000 (07:15 -0700)]
avcodec/h264dec: set AVFrame decode_error_flags in case of decoding error
set AVFrame decode_error_flags in case h->slice_ctx->er.error_occurred is set
after the call to ff_h264_execute_decode_slices. This allows the user to detect
concealed decoding errors in the call to avcodec_receive_frame
Signed-off-by: Amir Pauker <amir@livelyvideo.tv>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Amir Pauker [Fri, 21 Jun 2019 14:15:17 +0000 (07:15 -0700)]
avcodec/error_resilience: set AVFrame decode_error_flags in case of decoding error
Signed-off-by: Amir Pauker <amir@livelyvideo.tv>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Mark Thompson [Mon, 3 Jun 2019 23:19:03 +0000 (00:19 +0100)]
libx265: Update ROI behaviour to match documentation
Equivalent to the previous patch for libx264.
Mark Thompson [Mon, 3 Jun 2019 23:19:02 +0000 (00:19 +0100)]
libx264: Update ROI behaviour to match documentation
Fix the quantisation offset - use the whole range, and don't change the
offset size based on bit depth.
Iterate the list in reverse order. The first region in the list is the one
that applies in the case of overlapping regions.
Mark Thompson [Mon, 3 Jun 2019 23:19:01 +0000 (00:19 +0100)]
lavu/frame: Improve ROI documentation
Clarify and add examples for the behaviour of the quantisation offset,
and define how multiple ranges should be handled.
Mark Thompson [Mon, 6 May 2019 21:02:23 +0000 (22:02 +0100)]
lavc/h265_profile_level: Add new profiles
Monochrome 10 and Main 10 Still Picture profiles are added by the 2018
version of the standard.
Mark Thompson [Mon, 6 May 2019 21:02:22 +0000 (22:02 +0100)]
lavc/h265_profile_level: Add unit test
Operates in the same way as the h264-levels test.
Mark Thompson [Mon, 6 May 2019 21:02:21 +0000 (22:02 +0100)]
h265_metadata: Add option to set the level of the stream
To match the same option in h264_metadata.
Mark Thompson [Mon, 6 May 2019 21:02:20 +0000 (22:02 +0100)]
lavc/h265_profile_level: Do not allow high tier at level < 4
Mark Thompson [Mon, 6 May 2019 21:02:19 +0000 (22:02 +0100)]
lavc/h265_profile_level: Fix DPB size calculation
The maxDpbPicBuf value which is used in the DPB size calculation depends
on the profile (it's usually 6, but 7 for screen-extended profiles).
Paul B Mahol [Sun, 7 Jul 2019 09:33:19 +0000 (11:33 +0200)]
avcodec/cngdec: set .caps_internal
Calvin Walton [Fri, 21 Jun 2019 13:08:03 +0000 (09:08 -0400)]
vf_drawtext: Add pkt_pos, pkt_duration, pkt_size as variables
Changes to vf_drawtext.c written by
Calvin Walton <calvin.walton@kepstin.ca>
Changes to filters.texi written by
greg Luce <electron.rotoscope@gmail.com>
with lots of help from Moritz Barsnick and Gyan
Fixes #7947.
Michael Niedermayer [Thu, 20 Jun 2019 22:47:19 +0000 (00:47 +0200)]
avcodec/alsdec: Add FF_CODEC_CAP_INIT_CLEANUP
Fixes: multiple memleaks
Fixes: 15293/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-
5642409288925184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Thu, 20 Jun 2019 22:47:17 +0000 (00:47 +0200)]
avcodec/alsdec: Fix integer overflow with buffer number
Fixes: signed integer overflow: 65313 * 65313 cannot be represented in type 'int'
Fixes: 15290/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-
5738074249625600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Thu, 20 Jun 2019 22:47:16 +0000 (00:47 +0200)]
avcodec/alsdec: Fixes signed integer overflow in LSB addition
Fixes: signed integer overflow: 8 *
536870912 cannot be represented in type 'int'
Fixes: 15281/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-
5744458785619968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Thu, 20 Jun 2019 22:47:15 +0000 (00:47 +0200)]
avcodec/alsdec: Check opt_order / sb_length in ra_block handling
Fixes: out of array access
Fixes: 15277/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-
5184853437317120
Fixes: 15280/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-
5741062137577472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Wed, 19 Jun 2019 21:27:21 +0000 (23:27 +0200)]
avcodec/alsdec: Fix integer overflow with shifting samples
Fixes: signed integer overflow: -
346039050 * 8 cannot be represented in type 'int'
Fixes: 15283/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-
5692700268953600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Wed, 19 Jun 2019 21:17:31 +0000 (23:17 +0200)]
avcodec/alsdec: Fix undefined behavior in decode_rice()
Fixes: left shift of 72 by 26 places cannot be represented in type 'int'
Fixes: 15279/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-
5700665621348352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Wed, 19 Jun 2019 19:53:43 +0000 (21:53 +0200)]
avcodec/alsdec: Fixes invalid shifts in read_var_block_data() and INTERLEAVE_OUTPUT()
Fixes: left shift of negative value -6
Fixes: 15275/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-
5742361767837696
Fixes: signed integer overflow:
41582592 * 256 cannot be represented in type 'int'
Fixes: 15296/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-
5739558227935232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Andreas Rheinhardt [Sat, 6 Jul 2019 16:59:22 +0000 (18:59 +0200)]
matroskadec: Fix overflow introduced in
a569a7b3
This commit fixes an overflow introduced in
a569a7b3 that affected EBML
elements that the Matroska demuxer doesn't want to parse like CRC-32
elements. The return value of avio_skip (the new position on success or
an AVERROR on failure) has been assigned to an integer which meant that
new positions in the range of 2GB to 4GB-1 etc. were considered errors.
Fixes ticket #8001.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
Paul B Mahol [Sat, 6 Jul 2019 10:01:38 +0000 (12:01 +0200)]
avfilter/af_afftfilt: remove invalid scaling
Jun Zhao [Fri, 5 Jul 2019 04:26:43 +0000 (12:26 +0800)]
doc/filters: Document missing options for scale in/out color matrix
Document missing options for scale in/out color matrix
Reviewed-by: Gyan Doshi <ffmpeg@gyani.pro>
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
Jun Zhao [Fri, 5 Jul 2019 04:00:12 +0000 (12:00 +0800)]
lavfi/scale: Add sub-options for in_color_matrix/out_color_matrix
Add sub-options for in_color_matrix/out_color_matrix
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
James Almer [Sun, 30 Jun 2019 20:32:44 +0000 (17:32 -0300)]
avcodec/hevc_ps: fix range of num_tile_{columns,rows}_minus1
From 7.4.3.3.1:
num_tile_columns_minus1 shall be in the range of 0 to PicWidthInCtbsY - 1, inclusive.
num_tile_rows_minus1 shall be in the range of 0 to PicHeightInCtbsY - 1, inclusive.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
Cameron Cawley [Sat, 29 Jun 2019 23:00:44 +0000 (00:00 +0100)]
avformat/rpl: Calculate the duration of the video track
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Cameron Cawley [Fri, 14 Jun 2019 19:51:34 +0000 (20:51 +0100)]
avformat/rpl: Allow a file to have audio, but not video
Signed-off-by: Cameron Cawley <ccawley2011@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Cameron Cawley [Fri, 14 Jun 2019 19:51:33 +0000 (20:51 +0100)]
avformat/rpl: Fix detection of 8-bit linear formats
Was previously broken by commit
8cf5f94.
Fixes ticket #7859
Signed-off-by: Cameron Cawley <ccawley2011@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Paul B Mahol [Fri, 5 Jul 2019 10:51:29 +0000 (12:51 +0200)]
avfilter/vf_lut: fix regression with >8bit planar filtering
Steven Liu [Fri, 5 Jul 2019 03:52:49 +0000 (11:52 +0800)]
avformat/dashdec: fix code style in dash_read_packet
Jun Zhao [Fri, 28 Jun 2019 13:09:25 +0000 (21:09 +0800)]
doc/muxers: fix docs format for DASH muxer
fix docs format for DASH muxer
Reviewed-by: Gyan Doshi <ffmpeg@gyani.pro>
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
Steven Liu [Thu, 4 Jul 2019 08:11:47 +0000 (16:11 +0800)]
avformat/dashdec: refine and fix code style of dash_read_header
move the temp variable to the top of the expression paragraph
rename the pls to rep(representation)
Steven Liu [Thu, 4 Jul 2019 07:08:41 +0000 (15:08 +0800)]
avformat/dashdec: simplified code in open_demux_for_component
change from pls->ctx->streams[i]->codecpar to ist->codecpar
Signed-off-by: Steven Liu <lq@onvideo.cn>
Yonglin Luo [Wed, 3 Jul 2019 02:05:36 +0000 (10:05 +0800)]
libavfilter/vf_colorspace.c: fix demarcation point of gamma linearize function
The linearize function (usually refered to EOTF) is the inverse of
delinearize function (usually referred to OETF). Demarcation point of
EOTF should be beta*delta, but the actual value used now in the source
code is beta.
For ITU Rec.709, they are 0.081 (0.018*4.5) and 0.018 respectively
(beta = 0.018 and delta = 4.5), and they correspond to pixel value 5
and 21 for an 8-bit image. Linearized result of pixel within that range
(5-21) will be different, but this commit will make linearize function
of the filter more accurate in the mathematical sense.
Signed-off-by: Yonglin Luo <vincenluo@tencent.com>
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
Paul B Mahol [Wed, 3 Jul 2019 12:52:44 +0000 (14:52 +0200)]
avfilter/vf_lut2: use time_base from framesync
Fixes non-monotonous timestamps.
Paul B Mahol [Wed, 3 Jul 2019 12:49:16 +0000 (14:49 +0200)]
avfilter/vf_midequalizer: use time_base from framesync
Fixes non-monotonous timestamps.
Paul B Mahol [Wed, 3 Jul 2019 12:42:54 +0000 (14:42 +0200)]
avfilter/vf_blend: use time_base from framesync
Fixes non-monotonous timestamps.
Paul B Mahol [Wed, 3 Jul 2019 12:38:05 +0000 (14:38 +0200)]
avfilter/vf_maskedclamp: use time_base from framesync
Fixes non-monotonous timestamps.
Paul B Mahol [Wed, 3 Jul 2019 12:35:18 +0000 (14:35 +0200)]
avfilter/vf_maskedmerge: use time_base from framesync
Fixes non-monotonous timestamps.
Peter Ross [Mon, 1 Jul 2019 12:00:24 +0000 (22:00 +1000)]
ifv: populate creation_time
Reviewed-by: Carl Eugen Hoyos <ceffmpeg@gmail.com>
Signed-off-by: Peter Ross <pross@xvid.org>
Paul B Mahol [Wed, 3 Jul 2019 06:53:35 +0000 (08:53 +0200)]
avfilter/af_deesser: remove extra ;
Jun Zhao [Wed, 19 Jun 2019 13:13:42 +0000 (21:13 +0800)]
lavf/dump: More disposition flag dump
More disposition flag dump
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
Jun Zhao [Thu, 20 Jun 2019 04:30:37 +0000 (12:30 +0800)]
ffmpeg_opt: Respect default disposition when select audio/video
Respect default disposition when select audio/video
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
Jun Zhao [Thu, 20 Jun 2019 04:26:27 +0000 (12:26 +0800)]
lavf/utils: Respect default disposition when select the AVStream
Respect default disposition when select the AVStream
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
Paul B Mahol [Sun, 30 Jun 2019 14:35:07 +0000 (16:35 +0200)]
avfilter: add deesser audio filter
Paul B Mahol [Tue, 2 Jul 2019 16:06:28 +0000 (18:06 +0200)]
avfilter/af_silenceremove: use input timestamp for timestamp recalculation
Guo, Yejun [Thu, 13 Jun 2019 05:30:44 +0000 (13:30 +0800)]
doc/filters: update how to generate native model for sr filter
Signed-off-by: Guo, Yejun <yejun.guo@intel.com>
Guo, Yejun [Thu, 13 Jun 2019 05:30:38 +0000 (13:30 +0800)]
tools/python: add script to convert TensorFlow model (.pb) to native model (.model)
For example, given TensorFlow model file espcn.pb,
to generate native model file espcn.model, just run:
python convert.py espcn.pb
In current implementation, the native model file is generated for
specific dnn network with hard-code python scripts maintained out of ffmpeg.
For example, srcnn network used by vf_sr is generated with
https://github.com/HighVoltageRocknRoll/sr/blob/master/generate_header_and_model.py#L85
In this patch, the script is designed as a general solution which
converts general TensorFlow model .pb file into .model file. The script
now has some tricky to be compatible with current implemention, will
be refined step by step.
The script is also added into ffmpeg source tree. It is expected there
will be many more patches and community needs the ownership of it.
Another technical direction is to do the conversion in c/c++ code within
ffmpeg source tree. While .pb file is organized with protocol buffers,
it is not easy to do such work with tiny c/c++ code, see more discussion
at http://ffmpeg.org/pipermail/ffmpeg-devel/2019-May/244496.html. So,
choose the python script.
Signed-off-by: Guo, Yejun <yejun.guo@intel.com>
Andreas Rheinhardt [Thu, 20 Jun 2019 04:33:41 +0000 (06:33 +0200)]
libavformat/subfile: Improve AVSEEK_SIZE/SEEK_END seeking
The subfile protocol treats an end of 0 as meaning "until EOF"; this got
implemented by simply setting the end to INT64_MAX. But seeking relative
to EOF or AVSEEK_SIZE seeking hasn't been adapted; the result is that
e.g. the duration of transport streams isn't correctly determined when
this option is used. This is fixed in this patch.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Zhong Li [Thu, 27 Jun 2019 08:58:24 +0000 (16:58 +0800)]
lavc/mjpegdec: make code aligned
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Zhong Li <zhong.li@intel.com>
Zhong Li [Thu, 27 Jun 2019 08:58:23 +0000 (16:58 +0800)]
lavc/mjpegdec: replace number with marker name
Make it easier to read.
Signed-off-by: Zhong Li <zhong.li@intel.com>
Zhong Li [Fri, 28 Jun 2019 05:18:43 +0000 (13:18 +0800)]
lavc/qsvenc: fix the incorrent map from bits to bytes
Reported-by:Maggie Sun <maggie.sun@intel.com>
Signed-off-by: Zhong Li <zhong.li@intel.com>
sfan5 [Mon, 1 Jul 2019 03:06:06 +0000 (11:06 +0800)]
avformat/dashdec: Fix reading values from SegmentTimeline inside Period
This was missed in commit
e752da546463e693865d92a837fc0e8d2b28db2e.
Bela Bodecs [Mon, 1 Jul 2019 02:24:21 +0000 (10:24 +0800)]
avformat/hlsenc: changing all filename length to MAX_URL_SIZE
Throughout hlsenc code, all filename related buffer lengths are set
hardcoded as 1024. This PATCH change it to general value as MAX_URL_SIZE
in internal.h
Reviewed-by: Steven Liu <lq@onvideo.cn>
Signed-off-by: Bela Bodecs <bodecsb@vivanet.hu>
Michael Niedermayer [Tue, 25 Jun 2019 08:29:57 +0000 (10:29 +0200)]
avcodec/hevc_ps: Change num_tile_rows/columns checks to sps->ctb_height/weight
Suggested-by: James Almer <jamrial@gmail.com>
Reviewed-by: James Almer <jamrial@gmail.com
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Thu, 13 Jun 2019 13:05:54 +0000 (15:05 +0200)]
avcodec/hevc_ps: Fix integer overflow with num_tile_rows and num_tile_columns
Fixes: signed integer overflow: -
2147483648 - 1 cannot be represented in type 'int'
Fixes: 14880/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-
5130977304641536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Sun, 16 Jun 2019 09:26:57 +0000 (11:26 +0200)]
avcodec/apedec: Add k < 24 check to the only k++ case which lacks such a check
Fixes: 15255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-
5718831688843264
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Sun, 9 Jun 2019 20:04:16 +0000 (22:04 +0200)]
avformat/aviobuf: Delay buffer downsizing until asserts are met
Fixes: Assertion failure
Fixes: 15151/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-
5757079496687616
Fixes: 15205/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-
5767573242642432
May fix: Ticket7094
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Wed, 12 Jun 2019 22:24:53 +0000 (00:24 +0200)]
avcodec/fitsdec: Check data_min/max
Fixes: division by 0
Fixes: 15206/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-
5657260212092928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Mon, 17 Jun 2019 19:13:17 +0000 (21:13 +0200)]
avcodec/m101: Fix off be 2 error
Fixes: out of array read
Fixes: 15263/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_M101_fuzzer-
5728999453491200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Michael Niedermayer [Mon, 17 Jun 2019 18:58:47 +0000 (20:58 +0200)]
avcodec/qdm2: Move fft_order check up
This avoids undefined computations with unchecked values
Fixes: shift exponent -21 is negative
Fixes: 15262/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-
5651261753393152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>