summaryrefslogtreecommitdiff
path: root/libavcodec
Commit message (Collapse)AuthorAge
* avcodec/atrac9dec: Clamp band_ext_data to max that can be read if skipped.Michael Niedermayer2019-12-28
| | | | | | | | | Fixes: out of array read Fixes: 19327/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5679823087468544 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Lynne <dev@lynne.ee> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/agm: Include block size in the MV check for flags == 3Michael Niedermayer2019-12-28
| | | | | | | | Fixes: out of array read Fixes: 19331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5644115983466496 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/wmadec: Keep track of exponent initialization per channelMichael Niedermayer2019-12-28
| | | | | | | | Fixes: division by 0 Fixes: 19123/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5655493121146880 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/iff: Check that video_size is large enough for the read parametersMichael Niedermayer2019-12-28
| | | | | | | | | | | video is allocated before parameters like bpp are read. Fixes: out of array access Fixes: 19084/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5718556033679360 Fixes: 19465/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5759908398235648 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/v4l2_m2m_enc: Check encoder pix_fmt matches pix_fmt on deviceAndriy Gelman2019-12-27
| | | | | | | | | | | | | | | | | | | Fixes #8079 During initialization of a v4l2m2m device, the configured pix_fmt can be different to the pix_fmt of the encoder (i.e. avctx->pix_fmt). For example on the Odroid XU4: ./ffmpeg -f lavfi -i yuvtestsrc -codec:v h264_v4l2m2m out.h264 will configure the v4l2 encoder to pix_fmt nv21, whereas the input frames will be yuv444p. This commit checks that the configured v4l2 pix_fmt on device is the same as avctx->pix_fmt. If they are different the initialization fails and an error is returned. Tested on RPI4 and Odroid XU4. Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com>
* avcodec/mvha: fix warning: variable 'size' set but not usedLimin Wang2019-12-27
| | | | | | Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Limin Wang <lance.lmwang@gmail.com> Signed-off-by: James Almer <jamrial@gmail.com>
* avcodec/vc1dec: remove the unneeded ()Limin Wang2019-12-26
| | | | | Signed-off-by: Limin Wang <lance.lmwang@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/ass: remove the unneeded ()Limin Wang2019-12-26
| | | | | Signed-off-by: Limin Wang <lance.lmwang@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/cbs_vp9: Check data_sizeMichael Niedermayer2019-12-26
| | | | | | | | | Fixes: out of array access Fixes: 19542/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5659498341728256 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: James Almer <jamrial@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/cbs_vp9: Check index_sizeMichael Niedermayer2019-12-25
| | | | | | | | | Fixes: out of array read Fixes: 19300/clusterfuzz-testcase-minimized-ffmpeg_BSF_VP9_METADATA_fuzzer-5653911730126848 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: James Almer <jamrial@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* lavc/midivid: check return value of init_get_bits8()Zhong Li2019-12-23
| | | | | | Fix CID 1456088 Signed-off-by: Zhong Li <zhongli_dev@126.com>
* avcodec/noise_bsf: remove superfluous fail labelJames Almer2019-12-23
| | | | Signed-off-by: James Almer <jamrial@gmail.com>
* avcodec/hevcdec: keep closed captions in sync between multiple thread contextsJames Almer2019-12-21
| | | | | | | Based on h264 code. Reviewed-by: Limin Wang <lance.lmwang@gmail.com> Signed-off-by: James Almer <jamrial@gmail.com>
* avcodec/h264_sei: fix the size of user data unregisteredLimin Wang2019-12-20
| | | | | | | According to the specifications, the payloadSize includes the 16-byte size of UUID. Signed-off-by: Limin Wang <lance.lmwang@gmail.com> Signed-off-by: James Almer <jamrial@gmail.com>
* avcodec/hevc_sei: switch to AVBufferRef buffer for a53 captionLimin Wang2019-12-20
| | | | | Signed-off-by: Limin Wang <lance.lmwang@gmail.com> Signed-off-by: James Almer <jamrial@gmail.com>
* avcodec/cbs_av1: add missing valid range of values for num_cb_points and ↵James Almer2019-12-19
| | | | | | | | | num_cr_points It is a requirement of bitstream conformance that num_cr_points is less than or equal to 10. It is a requirement of bitstream conformance that num_cb_points is less than or equal to 10. Signed-off-by: James Almer <jamrial@gmail.com>
* lavc/h264dec.h: remove unused ff_h264_decode_slice_headerLinjie Fu2019-12-17
| | | | | | | | | Once removed in 4a9bab3db0d9ec449ebc8b5e823374d1d1df7761. Introduced again in b25cd7540e7. Signed-off-by: Linjie Fu <fulinjie@zju.edu.cn> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* lavc/hevc_cabac: fix cbf_cb and cbf_cr for transform depth 4Linjie Fu2019-12-17
| | | | | | | | | | | The max transform depth is 5(from 0 to 4), so we need 5 cabac states for cbf_cb and cbf_cr. See Table 9-4 for details. Signed-off-by: Xu Guangxin <guangxin.xu@intel.com> Signed-off-by: Linjie Fu <linjie.fu@intel.com> Signed-off-by: James Almer <jamrial@gmail.com>
* vc2enc: zero padding of the coefficient bufferLynne2019-12-17
| | | | | | | | | | Wavelet types with large amounts of overreading/writing like 9_7 would write into the padding at high wavelet depths, which would remain and be read by the next frame's transform and quickly cause artifacts to appear for subsequent frames. This fix affects all frames encoded with a non-power-of-two width, with the artifacts varying between non-observable to very noticeable, depending on encoder settings, so reencoding is advisable.
* lavc/vaapi_encode: grow packet if vaMapBuffer returns multiple buffersLinjie Fu2019-12-17
| | | | | | | | | | | | Currently, assigning new buffer for pkt when multiple buffers were returned from vaMapBuffer will overwrite the previous encoded pkt data and lead to encode issues. Iterate through the buf_list first to find out the total buffer size needed for the pkt, allocate the whole pkt to avoid repeated reallocation and memcpy, then copy data from each buf to pkt. Signed-off-by: Linjie Fu <linjie.fu@intel.com>
* lavc/allcodecs: Add mpeg4 omx encoder, missed in 0e387232Carl Eugen Hoyos2019-12-16
|
* lavc/cbs_h2645_syntax_template: Fix memleakAndriy Gelman2019-12-16
| | | | | | | | | | | | | | | | | payload_count is used to track the number of SEI payloads. It is also used to free the SEIs in cbs_h264_free_sei()/cbs_h265_free_sei(). Currently, payload_count is set after for loop is completed. Hence if there is an error and the function exits, the payload remains zero causing a memleak. This commit keeps track of payload_count inside the for loop to fix the issue. Note that that the contents of current are initialized with av_mallocz() so there is no need to zero initialize payload_count. Found-by: libFuzzer Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com>
* h264_mp4toannexb: Remove unnecessary checkAndreas Rheinhardt2019-12-15
| | | | | | | | | | | There can be at most 31 SPS and 255 PPS in the mp4/Matroska extradata. Given that each has a size of at most 2^16-1, the length of the output derived from these parameter sets can never overflow an ordinary 32 bit integer. So use a simple uint32_t instead of uint64_t and replace the unnecessary check with an av_assert1. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/adpcm: Clip predictor for APCMichael Niedermayer2019-12-15
| | | | | | | | Fixes: signed integer overflow: -2147483648 - 13 cannot be represented in type 'int' Fixes: 18893/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_APC_fuzzer-5630760442920960 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/targa: Check colors vs. available spaceMichael Niedermayer2019-12-15
| | | | | | | | Fixes: Timeout (37sec -> 52ms) Fixes: 18892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TARGA_fuzzer-5739537854889984 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/dstdec: Use get_ur_golomb_jpegls()Michael Niedermayer2019-12-15
| | | | | | | | | Fixes: shift exponent -4 is negative Fixes: 17793/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5766088435957760 Fixes: 18989/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5175008116867072 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/wmavoice: Check remaining input in parse_packet_header()Michael Niedermayer2019-12-15
| | | | | | | | Fixes: Infinite loop Fixes: 18914/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5731902946541568 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/wmalosslessdec: Fix 2 overflows in mclmsMichael Niedermayer2019-12-15
| | | | | | | | Fixes: signed integer overflow: 2038337026 + 109343477 cannot be represented in type 'int' Fixes: 18886/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5673660505653248 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/decode: Fix integer overflow in max_samples checkMichael Niedermayer2019-12-15
| | | | | | | | Fixes: signed integer overflow: 1677721600 * 32 cannot be represented in type 'int' Fixes: 18885/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5741242185154560 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/wmaprodec: Fixes integer overflow with 32bit samplesMichael Niedermayer2019-12-15
| | | | | | | | Fixes: left shift of 1 by 31 places cannot be represented in type 'int' Fixes: 18860/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAPRO_fuzzer-5755223125786624 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/adpcm: Fix invalid shift in xa_decode()Michael Niedermayer2019-12-15
| | | | | | | | Fixes: left shift of negative value -1 Fixes: 18859/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_XA_fuzzer-5748474213040128 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/wmavoice: Add FF_CODEC_CAP_INIT_CLEANUPMichael Niedermayer2019-12-15
| | | | | | | | Fixes: memleaks Fixes: 18855/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5687647317524480 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/wmalosslessdec: Fix several integer issuesMichael Niedermayer2019-12-15
| | | | | | | | Fixes: shift exponent -1 is negative (and others) Fixes: 18852/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5660855295541248 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/wmalosslessdec: Check that padding bits is not more than sample bitsMichael Niedermayer2019-12-15
| | | | | | | | Fixes: left shift of 1 by 31 places cannot be represented in type 'int' Fixes: 18817/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5713317180211200 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/iff: Skip overflowing runs in decode_delta_d()Michael Niedermayer2019-12-15
| | | | | | | | Fixes: Timeout (107sec - 75ms> Fixes: 18812/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-6295585225441280 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/apedec: Set error on error in ape_decode_value_3860()Michael Niedermayer2019-12-15
| | | | | | | | Fixes: Timeout (unknown -> 15sec) Fixes: 18808/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5677586072207360 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/pnm: Check that the header is not truncatedMichael Niedermayer2019-12-15
| | | | | | | Fixes: Ticket8430 Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mp3_header_decompress_bsf: Check sample_rate_indexMichael Niedermayer2019-12-15
| | | | | | | | | Fixes: out of array read Fixes: 19309/clusterfuzz-testcase-minimized-ffmpeg_BSF_MP3_HEADER_DECOMPRESS_fuzzer-5651002950942720 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* lavc/pnmdec: Fix 16bit decoding.Carl Eugen Hoyos2019-12-14
| | | | | Regression since cdb5479c Reported by irc user tTh from Mixart-Myrys
* avcodec/simple_idct_template: fix integer overflowPaul B Mahol2019-12-14
|
* avcodec/cbs_av1_syntax_template: Check num_y_pointsMichael Niedermayer2019-12-13
| | | | | | | | | | | | | "It is a requirement of bitstream conformance that num_y_points is less than or equal to 14." Fixes: index 24 out of bounds for type 'uint8_t [24]' Fixes: 19282/clusterfuzz-testcase-minimized-ffmpeg_BSF_AV1_FRAME_MERGE_fuzzer-5747424845103104 Note, also needs a23dd33606d5 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: jamrial Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/v210dec: move the stride read after its fully initializedMichael Niedermayer2019-12-12
| | | | | | | | | | Fixes: out of array read Fixes: 19129/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_V210_fuzzer-5068171023482880 Maybe fixes: 19130/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_V210_fuzzer-5637264407527424 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Limin Wang <lance.lmwang@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* lavc/utils.c: fix code indentationsLinjie Fu2019-12-12
| | | | | | | Introduced since 4b4a02b8. Signed-off-by: Linjie Fu <linjie.fu@intel.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* lavc/mips: simplify the switch codeLinjie Fu2019-12-12
| | | | | Signed-off-by: Linjie Fu <linjie.fu@intel.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* lavc/x265: set preferred_transfer_characteristics for HLGZhong Li2019-12-12
| | | | | | | | | | | "HEVC HDR UHDTV Bitstreams using HLG10 shall also contain the alternative_transfer_characteristics SEI message. The alternative_transfer_characteristics SEI message shall be inserted on the HEVC DVB_RAP, and preferred_transfer_characteristics shall be set equal to "18", indicating Recommendation ITU-R BT. 2100 [45] HLG system." Signed-off-by: Zhong Li <zhongli_dev@126.com>
* lavc/qsvenc: add Tiles encode support for HEVCLinjie Fu2019-12-12
| | | | | | | | | | | | | | | | | | | | | | Add -tile_rows and -tile_cols option to specify the number of tile rows and columns for ICL+ (gen 11) platform. A tile must wholly contain all the slices within it. Slices cannot cross tile boundaries. So the slice number would be implicitly resized to the max(nSlice, nTile). Example: ffmpeg -v verbose -hwaccel qsv -init_hw_device qsv=hw -filter_hw_device hw -f rawvideo -s:v 1920x1080 -i ./input.nv12 -vf format=nv12,hwupload=extra_hw_frames=64 -c:v hevc_qsv -tile_rows 2 -tile_cols 2 -slices 4 -y output.h265 Also dump the actual quantity of encoded tiled rows and columns in run time. Fix the enhancement #8400. Signed-off-by: Linjie Fu <linjie.fu@intel.com>
* lavc: add MPEG-H 3D Audio codec idYuki Tsuchiya2019-12-12
| | | | Signed-off-by: James Almer <jamrial@gmail.com>
* lavc/codec_desc: introduce AV_CODEC_PROP_INTRA_ONLY flag to audio codecYuki Tsuchiya2019-12-12
| | | | | | | Introduce AV_CODEC_PROP_INTRA_ONLY flag to audio codec as well as video codec to support non intra-only audio codec. Signed-off-by: Yuki Tsuchiya <Yuki.Tsuchiya@sony.com> Signed-off-by: James Almer <jamrial@gmail.com>
* avcodec/mlp_parser: mark sync frames as key framesJames Almer2019-12-12
| | | | Signed-off-by: James Almer <jamrial@gmail.com>
* avcodec/cbs_av1: fix array size for ar_coeffs_cb_plus_128 and ↵James Almer2019-12-11
| | | | | | | | | | | | | | | | | | | | | | ar_coeffs_cr_plus_128 Taking into account the code fb(2, ar_coeff_lag); num_pos_luma = 2 * current->ar_coeff_lag * (current->ar_coeff_lag + 1); if (current->num_y_points) num_pos_chroma = num_pos_luma + 1; else num_pos_chroma = num_pos_luma; Max value for ar_coeff_lag is 3 (two bits), for num_pos_luma 24, and for num_pos_chroma 25. Both ar_coeffs_cb_plus_128 and ar_coeffs_cr_plus_128 may have up to num_pos_chroma values. Reviewed-by: Ronald S. Bultje <rsbultje@gmail.com> Signed-off-by: James Almer <jamrial@gmail.com>
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-21 12:39:53 +0000