summaryrefslogtreecommitdiff
path: root/libavcodec
Commit message (Collapse)AuthorAge
* avcodec/apedec: Check remaining space in decode_array_0000()Michael Niedermayer2019-10-16
| | | | | | | | | Fixes: Timeout (? -> 2sec) Fixes: 17886/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5728165124636672 Fixes: 18131/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5710803432374272 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/apedec: Check error flag after entropy_decode*Michael Niedermayer2019-10-16
| | | | | | | | Fixes: 17886/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5728165124636672 Fixes: 18131/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5710803432374272 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* lavc/libxavs2: fix parameter setting result determinationhwren2019-10-15
| | | | | Signed-off-by: hwren <hwrenx@126.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/av1_parse: Use av_fast_realloc() for OBU arrayJames Almer2019-10-15
| | | | | | | Based on commits 22bec0d33f4231487547581a1f77e2e8e6eade88 and cebb446911fdc6c42d5a480b441b025c399e4a88. Signed-off-by: James Almer <jamrial@gmail.com>
* avcodec/av1_parse: simplify memset callJames Almer2019-10-15
| | | | | | | | Removed (new_size - pkt->nals_allocated) because this value is always 1 during the call. Based on commit 78b86c30d3860135042505dd4a9cbd95c4e6257d. Signed-off-by: James Almer <jamrial@gmail.com>
* avcodec/h2645_parse: Reset nal_buffer_size on uninitAndriy Gelman2019-10-14
| | | | | | | Without reseting nal_buffer_size, av_fast_realloc will fail if ff_h2645_packet_split is called with the unitialized pkt as argument. Signed-off-by: James Almer <jamrial@gmail.com>
* avcodec/mips: Fixed four warnings in vc1dspgxw2019-10-14
| | | | | | | | | Change the stride argument to ptrdiff_t in the following functions: ff_put_no_rnd_vc1_chroma_mc8_mmi, ff_put_no_rnd_vc1_chroma_mc4_mmi, ff_avg_no_rnd_vc1_chroma_mc8_mmi, ff_avg_no_rnd_vc1_chroma_mc4_mmi. Reviewed-by: Shiyou Yin <yinshiyou-hf@loongson.cn> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/wmaprodec: Check that the streams channels do not exceed the overall ↵Michael Niedermayer2019-10-14
| | | | | | | | | | | | channels Fixes: NULL pointer dereference Fixes: 18075/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA1_fuzzer-5708262036471808 Fixes: 18087/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA1_fuzzer-5740627634946048 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/zmbvenc: Correct offset in bufferAndreas Rheinhardt2019-10-12
| | | | | | | | | | | | | | | | | | | | zmbvenc allocates a buffer for a picture with padding on all four sides: The stride is choosen so large that it already contains padding on the right; the height also includes padding rows. The padding on the right of each row is also reused as padding for the left of the next row. So one still needs to add padding on the left for the first row. This is done by offsetting the actual pointer used to access the picture from the pointer returned by av_mallocz and the formula for this offset was wrong, because it ignored that a pixel can take more than one byte when calculating the offset resulting from the left padding of the first row. This fixes accesses outside of the allocated buffer that were reported in tickets #7980 and #7994. No writes were ever attempted outside of the buffer. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/qdmc: Check input space in qdmc_get_vlc()Michael Niedermayer2019-10-12
| | | | | | | | | Fixes: Timeout (125sec -> 0.4sec) Fixes: 18059/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDMC_fuzzer-5656195825664000 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* libavcodec/amfenc_h264.c: Changed loop filter flag default value.OvchinnikovDmitrii2019-10-11
| | | | The value has been changed to match the recommended(by AMF Encoder team)
* avcodec/dstdec: Check for input exhaustionMichael Niedermayer2019-10-10
| | | | | | | | | Fixes: Timeout (239sec -> 16sec) Fixes: 17811/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5715508149616640 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/wmaprodec: Fix cleanup on errorMichael Niedermayer2019-10-10
| | | | | | | | | Fixes: memleaks Fixes: 18023/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA2_fuzzer-5642535011090432 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/pcm: Check bits_per_coded_sampleMichael Niedermayer2019-10-10
| | | | | | | | | | Fixes: shift exponent -2 is negative Fixes: 17736/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PCM_F16LE_fuzzer-5742815929171968 Fixes: 17998/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PCM_F24LE_fuzzer-5716980383875072 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/magicyuv: remove duplicate codeLimin Wang2019-10-10
| | | | | | Signed-off-by: Limin Wang <lance.lmwang@gmail.com> Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/scpr: Check minimum size of type 17Michael Niedermayer2019-10-10
| | | | | | | | | Improves: Timeout (85sec -> 46sec) Improves: 17644/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-5715704283660288 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/exr: Allow duplicate use of channel indexesMichael Niedermayer2019-10-10
| | | | | | | Fixes: Ticket #8203 Reported-by: durandal_1707 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/fitsdec: Fail on 0 naxisnMichael Niedermayer2019-10-10
| | | | | | | | | Fixes: Timeout (100+ sec -> 23ms) Fixes: 17769/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5678314672357376 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* lavc/qsvdec: Add GPU-accelerated memory copy supportLinjie Fu2019-10-09
| | | | | | | | | | | | | | | | GPU copy enables or disables GPU accelerated copying between video and system memory. This may lead to a notable performance improvement. Memory must be sequent and aligned with 128x64. CMD: ffmpeg -init_hw_device qsv=hw -filter_hw_device hw -c:v h264_qsv -gpu_copy on -i input.h264 -f null - or: ffmpeg -c:v h264_qsv -gpu_copy on -i input.h264 -f null - Signed-off-by: Linjie Fu <linjie.fu@intel.com> Signed-off-by: ChaoX A Liu <chaox.a.liu@intel.com> Signed-off-by: Zhong Li <zhong.li@intel.com>
* lavc/qsv: remove vaapi device free functionZhong Li2019-10-09
| | | | | | It is not needed since av_buffer_unref() will call it internally Signed-off-by: Zhong Li <zhong.li@intel.com>
* avcodec/dxv: Subtract 12 earlier in dxv_decompress_cocg()Michael Niedermayer2019-10-08
| | | | | | | the data_start is after reading 12 bytes and if its subtracted at the very end the intermediate might overflow Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* libavcodec/dxv: Remove redundant seekMichael Niedermayer2019-10-08
| | | | | | | This seeks to the position the previous call to dxv_decompress_opcodes() positioned us in case of success Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/ituh263dec: Check input for minimal frame sizeMichael Niedermayer2019-10-08
| | | | | | | | Fixes: Timeout (28sec -> 3sec) Fixes: 17559/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H263_fuzzer-5681050776240128 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/truemotion1: Check that the input has enough space for a minimal ↵Michael Niedermayer2019-10-08
| | | | | | | | | | index_stream Fixes: Timeout (18sec -> 0.4sec) Fixes: 17585/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION1_fuzzer-5117015135617024 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/sunrast: Check that the input is large enough for the maximally ↵Michael Niedermayer2019-10-08
| | | | | | | | | | | compressed image Fixes: Timeout (17sec -> 15ms) Fixes: 17224/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SUNRAST_fuzzer-5663218491457536 Fixes: 17224/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SUNRAST_fuzzer-5735590015795200 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/sunrast: Check for availability of maplength before allocating imageMichael Niedermayer2019-10-08
| | | | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/jpeglsdec: Apply transform only to initialized linesMichael Niedermayer2019-10-08
| | | | | | | | Fixes: Timeout (110sec -> 1sec) Fixes: 17123/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMV_fuzzer-5636452758585344 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/jpeglsdec: Return error codes from ls_decode_line()Michael Niedermayer2019-10-08
| | | | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/flac_parser: Make expected_frame_num, expected_sample_num 64bitMichael Niedermayer2019-10-08
| | | | | | | | Fixes: Integer overflow Fixes: 17199/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5696145187143680 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/pngdec: add logging context to logSteven Liu2019-10-08
| | | | | Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
* avcodec/videotoolbox: add logging context to logSteven Liu2019-10-08
| | | | Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
* avcodec/mpegvideo_enc: add logging context to logSteven Liu2019-10-08
| | | | | | Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
* Change libvpxenc default to crf=32.elliottk2019-10-07
| | | | | | | | | Current default is 200kbps, which produces inconsistent results (too high for low-res, too low for hi-res). Use CRF instead, which will adapt. Affects VP9. Also have VP8 use a default bitrate of 256kbps. Signed-off-by: James Zern <jzern@google.com>
* lavc/qsv: fix a memory leak in ff_qsv_set_display_handle()Zhong Li2019-10-08
| | | | | Reported-by: Linjie Fu <linjie.fu@intel.com> Signed-off-by: Zhong Li <zhong.li@intel.com>
* avcodec/flac_parser: CosmeticsAndreas Rheinhardt2019-10-07
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/flac_parser: Don't leave stale pointer in memoryAndreas Rheinhardt2019-10-07
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/flac_parser: Don't modify size of the input bufferAndreas Rheinhardt2019-10-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When flushing, MAX_FRAME_HEADER_SIZE bytes (always zero) are supposed to be written to the fifo buffer in order to be able to check the rest of the buffer for frame headers. It was intended to write these by writing a small buffer of size MAX_FRAME_HEADER_SIZE to the buffer. But the way it was actually done ensured that this did not happen: First, it would be checked whether the size of the input buffer was zero, in which case it buf_size would be set to MAX_FRAME_HEADER_SIZE and read_end would be set to indicate that MAX_FRAME_HEADER_SIZE bytes need to be written. Then it would be made sure that there is enough space in the fifo for the data to be written. Afterwards the data is written. The check used here is for whether buf_size is zero or not. But if it was zero initially, it is MAX_FRAME_HEADER_SIZE now, so that not the designated buffer for writing MAX_FRAME_HEADER_SIZE is written; instead the padded buffer (from the stack of av_parser_parse2()) is used. This works because AV_INPUT_BUFFER_PADDING_SIZE >= MAX_FRAME_HEADER_SIZE. Lateron, buf_size is set to zero again. Given that since 7edbd536, the actual amount of data read is no longer automatically equal to buf_size, it is completely unnecessary to modify buf_size at all. Moreover, modifying it is dangerous: Some allocations can fail and because buf_size is never reset to zero in this codepath, the parser might return a value > 0 on flushing. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/flac_parser: Remove superfluous checksAndreas Rheinhardt2019-10-07
| | | | | | | | | | For a parser, the input buffer is always != NULL: In case of flushing, the indicated size of the input buffer will be zero and the input buffer will point to a zeroed buffer of size 0 + AV_INPUT_BUFFER_PADDING. Therefore one does not need to check for whether said buffer is NULL or not. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/flac_parser: Fix number of buffered headersAndreas Rheinhardt2019-10-07
| | | | | | | Only decrement the number of buffered headers if a header has actually been freed. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/flac_parser: Fix off-by-one errorAndreas Rheinhardt2019-10-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The flac parser uses a fifo to buffer its data. Consequently, when searching for sync codes of flac packets, one needs to take care of the possibility of wraparound. This is done by using an optimized start code search that works on each of the continuous buffers separately and by explicitly checking whether the last pre-wrap byte and the first post-wrap byte constitute a valid sync code. Moreover, the last MAX_FRAME_HEADER_SIZE - 1 bytes ought not to be searched for (the start of) a sync code because a header that might be found in this region might not be completely available. These bytes ought to be searched lateron when more data is available or when flushing. Unfortunately there was an off-by-one error in the calculation of the length to search of the post-wrap buffer: It was too large, because the calculation was based on the amount of bytes available in the fifo from the last pre-wrap byte onwards. This meant that a header might be parsed twice (once prematurely and once regularly when more data is available); it could also mean that an invalid header will be treated as valid (namely if the length of said invalid header is MAX_FRAME_HEADER_SIZE and the invalid byte that will be treated as the last byte of this potential header happens to be the right CRC-8). Should a header be parsed twice, the second instance will be the best child of the first instance; the first instance's score will be FLAC_HEADER_BASE_SCORE - FLAC_HEADER_CHANGED_PENALTY ( = 3) higher than the second instance's score. So the frame belonging to the first instance will be output and it will be done as a zero length frame (the difference of the header's offset and the child's offset). This has serious consequences when flushing, as returning a zero length buffer signals to the caller that no more data will be output; consequently the last frames not yet output will be dropped. Furthermore, a "sample/frame number mismatch in adjacent frames" warning got output when returning the zero-length frame belonging to the first header, because the child's sample/frame number of course didn't match the expected sample frame/number given its parent. filter/hdcd-mix.flac from the FATE-suite was affected by this (the last frame was omitted) which is the reason why several FATE-tests needed to be updated. Fixes ticket #5937. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/flac_parser: Don't allocate array separatelyAndreas Rheinhardt2019-10-07
| | | | | | | | | | | The FLACHeaderMarker structure contained a pointer to an array of int; said array was always allocated and freed at the same time as its referencing FLACHeaderMarker; the pointer was never modified to point to a different array and each FLACHeaderMarker had its own unique array. Furthermore, all these arrays had a constant size. Therefore include this array in the FLACHeaderMarker struct. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/flac_parser: Use native endianness when possibleAndreas Rheinhardt2019-10-07
| | | | | | | | | FLAC sync codes contain a byte equal to 0xFF and so the function that searches for sync codes first searched for this byte. It did this by checking four bytes at once; these bytes have been read via AV_RB32, but the test works just as well with native endianness. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/filter: Remove extra '; ' outside of functionsAndreas Rheinhardt2019-10-07
| | | | | | | | They are not allowed outside of functions. Fixes the warning "ISO C does not allow extra ‘;’ outside of a function [-Wpedantic]" when compiling with GCC and -pedantic. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/h2645_parse: Use av_fast_realloc() for nals arrayMichael Niedermayer2019-10-06
| | | | | | | | | Fixes: Timeout (17sec ->281ms) Fixes: 17833/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5638346914660352 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: James Almer <jamrial@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/cinepakenc: Fix invalid shiftsAndreas Rheinhardt2019-10-06
| | | | | | | | | | Fixes: left shift of 1 by 31 places cannot be represented in type 'int'. Affected the FATE-tests vsynth1-cinepak, vsynth2-cinepak and vsynth_lena-cinepak. Also fixes ticket #8220. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* lavc/options_table: Correct the flags for AVCodecContext.flags2Jun Zhao2019-10-06
| | | | | | | Correct the flags for AVCodecContext.flags2. Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
* avcodec/decode: fix indentationJun Zhao2019-10-06
| | | | | | | | fix indentation. Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Reviewed-by: Gyan Doshi <ffmpeg@gyani.pro> Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
* avcodec/tiff: Set FF_CODEC_CAP_INIT_CLEANUPMichael Niedermayer2019-10-03
| | | | | | | | | Fixes: memleaks Fixes: 17813/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5145600206569472 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/vc1_block: Fix invalid left shift in vc1_decode_p_mb()Michael Niedermayer2019-10-03
| | | | | | | | | Fixes: left shift of negative value -6 Fixes: 17810/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5638541240958976 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/wmaprodec: Check if there is a streamMichael Niedermayer2019-10-03
| | | | | | | | | | Fixes: null pointer dereference Fixes: signed integer overflow: 512 * 2147483647 cannot be represented in type 'int' Fixes: 17809/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA1_fuzzer-5634409947987968 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-23 03:57:04 +0000