summaryrefslogtreecommitdiff
path: root/libavcodec
Commit message (Collapse)AuthorAge
* avcodec/bsf: Simplify getting codec nameAndreas Rheinhardt2021-04-06
| | | | | | | | All codec ids on BSF whitelists have a codec descriptor, so one can just use avcodec_get_name() without worrying about the case of what happens when no codec descriptor is found. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avcodec/options: Remove always-true checkAndreas Rheinhardt2021-04-05
| | | | | | Every codec has a name. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avcodec/wmavoice: Check operations that can failAndreas Rheinhardt2021-04-03
| | | | | | There might be segfaults on failure. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avcodec/mjpegdec: Fix leak in case ICC array allocations fail partiallyAndreas Rheinhardt2021-04-03
| | | | | | | | | If only one of the two arrays used for the ICC profile could be successfully allocated, it might be overwritten and leak when the next ICC entry is encountered. Fix this by using a common struct, so that one has only one array to allocate. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avcodec/cfhd: Keep track of which subbands have been readMichael Niedermayer2021-04-03
| | | | | | | | | | | | | | This avoids use of uninitialized data also several checks are inside the band reading code so it is important that it is run at least once Fixes: out of array accesses Fixes: 28209/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-5684714694377472 Fixes: 32124/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-5425980681355264 Fixes: 30519/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-4558757155700736 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/cfhd: Require valid setup before Lowpass coefficients, BandHeader ↵Michael Niedermayer2021-04-03
| | | | | | | | | and BandSecondPass Previously the code skipped all security checks when these where encountered but prior data was incorrect. Also replace an always true condition by an assert Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/cfhd: Check transform_type consistentlyMichael Niedermayer2021-04-03
| | | | | | | | | | Fixes: out of array accesses Fixes: 29754/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-6333598414274560 Fixes: 30519/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-6298424511168512 Fixes: 30739/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-5011292836462592 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mjpegdec: Check initializing Huffman tablesAndreas Rheinhardt2021-04-03
| | | | | Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avcodec/mjpegdec: Fix leak in case of invalid external Huffman tablesAndreas Rheinhardt2021-04-03
| | | | | | | | | | | | | When using external Huffman tables fails during init, the decoder reverts back to using the default Huffman tables; and when doing so, the current VLC tables leak because init_default_huffman_tables() doesn't free them before overwriting them. Sample: samples.ffmpeg.org/archive/all/avi+mjpeg+pcm_s16le++mjpeg-interlace.avi Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avcodec/a64multienc: Don't use static buffers, fix potential racesAndreas Rheinhardt2021-04-03
| | | | | | | | | | | | render_charset() used static buffers that are always completely initialized before every use, so that it is unnecessary for the values in these arrays to be kept after leaving the function. Given that this is not only unnecessary, but harmful due to the possibility of data races if several instances of a64multi/a64multi5 run simultaneously these buffers have been replaced by ordinary buffers on the stack (they are small enough for this). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avcodec/rawdec: Free bitstream_bufAndreas Rheinhardt2021-04-03
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avcodec/ass_split: Don't presume strlen to be >= 2Andreas Rheinhardt2021-04-02
| | | | | | Fixes potential heap-buffer-overflow. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/binkaudio: Check return value of functions that can failAndreas Rheinhardt2021-04-02
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/binkaudio: Fix memleak upon init failureAndreas Rheinhardt2021-04-02
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/flacenc: Fix memleak upon init errorAndreas Rheinhardt2021-04-02
| | | | | | An AVMD5 struct would leak if an error happened after its allocation. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/proresenc_anatoliy: Fix memleak upon init errorAndreas Rheinhardt2021-04-02
| | | | | | | A buffer may leak in case of YUVA444P10 with dimensions that are not both divisible by 16. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/bsf: Fix segfault when freeing half-allocated BSFAndreas Rheinhardt2021-04-02
| | | | | | | When allocating a BSF fails, it could happen that the BSF's close function has been called despite a failure to allocate the private data. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avcodec/av1_metadata_bsf: Check for the existence of unitsAndreas Rheinhardt2021-04-02
| | | | | | | Fixes a crash with ISOBMFF extradata containing no OBUs. Reviewed-by: James Almer <jamrial@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avcodec/h264_metadata_bsf: Don't add AUD to extradataAndreas Rheinhardt2021-04-02
| | | | | | | This is a regression since switching to the generic CBS BSF code. Reviewed-by: James Almer <jamrial@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avcodec/tiff: Don't use separate temporary buffer for faxAndreas Rheinhardt2021-04-02
| | | | | | | | Also don't unnecessarily copy the input data around if it needn't be reversed; and remove a redundant memset -- av_fast_padded_malloc() already does this for us. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avcodec/msmpeg4enc: Don't use code for static init that can failAndreas Rheinhardt2021-04-02
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/ac3enc: Simplify AC-3 bit countingAndreas Rheinhardt2021-04-02
| | | | | | | | | | | | | | When encoding E-AC-3, whether coupling is on or not determines whether an additional frame based coupling exponent strategy element frmcplexpstr (of size five bits) is present in the bitstream. So just add five to the number of bits when counting them instead of adding 5*s->cpl_on (the latter field is currently only 0 or 1, so it doesn't make a difference). Furthermore, move some parts of the bit allocation that doesn't change per-frame to count_frame_bits_fixed() (which is only run once during init). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avcodec/[e]ac3enc: Fix indentationAndreas Rheinhardt2021-04-02
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avcodec/ac3enc: Avoid needlessly copying encoded packets aroundAndreas Rheinhardt2021-04-02
| | | | | | | | | AC-3 and EAC-3 are codecs whose packet sizes are known in advance, so one can use the min_size parameter of ff_alloc_packet2() to allocate exactly this amount. This avoids a memcpy later in av_packet_make_refcounted() in encode_simple_internal(). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avcodec/ac3enc: Use actual size of buffer in init_put_bits()Andreas Rheinhardt2021-04-02
| | | | | | | | | | | | Since the very beginning (since de6d9b6404bfd1c589799142da5a95428f146edd) the AC-3 encoder used AC3_MAX_CODED_FRAME_SIZE (namely 3840) for the size of the output buffer (without any check at all). This causes problems when encoding EAC-3 for which the maximum is too small, smaller than the actual size of the buffer: One can run into asserts used by the PutBits API. Ticket #8513 is about such a case and this commit fixes it by using the real size of the buffer. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avcodec/adpcmenc: don't share a single AVClass between multiple AVCodecs.Zane van Iperen2021-04-02
| | | | | | | Temporary fix until AVClass::child_class_next is gone. Reviewed-By: James Almer <jamrial@gmail.com> Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
* avcodec/flashsv2enc: Fix undefined NULL + 0Andreas Rheinhardt2021-04-01
| | | | | | Affected the vsynth*-flashsv2 FATE-tests. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/motion_est: Fix invalid left shift of negative numbersAndreas Rheinhardt2021-04-01
| | | | | | Affected many FATE-tests. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/g2meet: Fix undefined NULL + 0Andreas Rheinhardt2021-04-01
| | | | | | Affected the g2m4 FATE-test. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/vmdvideo: Fix NULL + 0Andreas Rheinhardt2021-04-01
| | | | | | Affected the FATE tests filter-gradfun-sample and sierra-vmd-video. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/mss12: Don't apply non-zero offset to null pointerAndreas Rheinhardt2021-04-01
| | | | | | Affected the FATE tests mss2-wmv and mss1-pal. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/lcldec: Fix undefined NULL + 0Andreas Rheinhardt2021-04-01
| | | | | | Affected the FATE tests vsynth*-zlib, mszh and zlib. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/qtrleenc: Fix negative linesizes, don't use NULL + offsetAndreas Rheinhardt2021-04-01
| | | | | | | | | | | | | | | | | | | | | | | | | Before commit f1e17eb446577180ee9976730aacb46563766518, the qtrle encoder had undefined pointer arithmetic: Outside of a loop, two pointers were set to point to the ith element (with index i-1) of a line of a frame. At the end of each loop iteration, these pointers were decremented, so that they pointed to the -1th element of the line after the loop. Furthermore, one of these pointers can be NULL (in which case all pointer arithmetic is automatically undefined behaviour). Commit f1e17eb44 added a check in order to ensure that the elements never point to the -1th element of the array: The pointers are only decremented if they are bigger than the frame's base pointer (i.e. AVFrame.data[0]). Yet this check does not work at all in case of negative linesizes; furthermore in case the pointer that can be NULL is NULL initializing it still involves undefined pointer arithmetic. This commit fixes both of these issues: First, non-NULL pointers are initialized to point to the element after the ith element and decrementing is moved to the beginning of the loop. Second, if a pointer is NULL, it is just made to point to the other pointer, as this allows to avoid checks before decrementing it. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/qtrleenc: Use keyframe when no previous frame is availableAndreas Rheinhardt2021-04-01
| | | | | | | If keeping a reference to an earlier frame failed, the next frame must be an I frame for lack of reference frame. This commit implements this. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/proresdec2: Don't apply non-zero offset to null pointerAndreas Rheinhardt2021-04-01
| | | | | | | Affected ProRes without alpha; affected 32 FATE tests, e.g. prores-422, prores-422_proxy, prores-422_lt or matroska-prores-header-insertion-bz2. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/mpegvideo_enc: Don't apply non-zero offset to null pointerAndreas Rheinhardt2021-04-01
| | | | | | Affected many FATE tests (mostly vsynth ones). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/dcaenc: Fix undefined left shift of negative numbersAndreas Rheinhardt2021-04-01
| | | | | | Affected the acodec-dca and acodec-dca2 FATE tests. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/pnm_parser: Check image size addition for overflowMichael Niedermayer2021-04-01
| | | | | | | | | | Fixes: assertion failure Fixes: out of array access Fixes: 32664/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-6533642202513408.fuzz Fixes: 32669/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-6001928875147264 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/lscrdec: Check length in decode_idat()Michael Niedermayer2021-04-01
| | | | | | | | Fixes: out of array access Fixes: 32264/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LSCR_fuzzer-6684504010915840 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/h265_metadata_bsf: Check nb_units before accessing the first in ↵Michael Niedermayer2021-04-01
| | | | | | | | | | | | h265_metadata_update_fragment() Fixes: null pointer dereference Fixes: 32113/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-4803262287052800 Same as 0c48c332eeb2866d9353125f701e099c48889463 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/exr: Check oe in huf_decode() before useMichael Niedermayer2021-04-01
| | | | | | | | Fixes: out of array access Fixes: 31386/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5773234709594112 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/h264_slice: Check input SPS in ff_h264_update_thread_context()Michael Niedermayer2021-03-31
| | | | | | | | Fixes: crash Fixes: check_pkt.mp4 Found-by: Rafael Dutra <rafael.dutra@cispa.de> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpegpicture: Keep ff_mpeg_framesize_alloc() failure state consistentMichael Niedermayer2021-03-31
| | | | | | | | | Fixes: null pointer dereference Fixes: ff_put_pixels16_sse2.mp4 Found-by: Rafael Dutra <rafael.dutra@cispa.de> Regression-since: 4b2863ff01b1fe93d9a518523c9098d17a9d8c6f Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpegvideo: Update chroma_?_shift in ff_mpv_common_frame_size_change()Michael Niedermayer2021-03-31
| | | | | | | | Fixes: out of array access Fixes: 31201/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4627865612189696.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mjpegenc: Fix segfault when freeing incomplete contextAndreas Rheinhardt2021-03-31
| | | | | | | | | | When allocating the MJpegContext fails (or if the dimensions run afoul of the 65500x65500 limit), an attempt to free a subbuffer of said context leads to a segfault in ff_mjpeg_encode_close(). Seems to be a regression since 467d9e27e0cb2bf74f41dc832f2f8d191ba58ec9. Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avcodec/tiff: Avoid forward declarationsAndreas Rheinhardt2021-03-31
| | | | | | | | | | | In this case it also fixes a potential for compilation failures: Not all compilers can handle the case in which a function with a forward declaration declared with an attribute to always inline it is called before the function body appears. E.g. GCC 4.2.1 on OS X 10.6 doesn't like it. Reviewed-by: Pavel Koshevoy <pkoshevoy@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avcodec/dv_profile: PAL DV files with dsf flag 0 - detect via pal flag and ↵Mark Plomer2021-03-30
| | | | | | | | | | | | | buf_size Some old DV AVI files have the DSF-Flag of frames set to 0, although it is PAL (maybe rendered with an old Ulead Media Studio Pro) ... this causes ffmpeg/VLC-player to produce/play corrupted video (other players/editors like VirtualDub work fine). Fixes ticket #8333 and replaces/extends hack for ticket #2177 Signed-off-by: Marton Balint <cus@passwd.hu>
* avcodec/put_bits: Don't set size_in_bits, fix overflowAndreas Rheinhardt2021-03-30
| | | | | | | | | | | | | | | | | | A PutBitContext has a field called size_in_bits which is set to the context's bitsize init_put_bits(); but it isn't used at all (the PutBits API uses pointers directly and not bit indexes), so remove it (due to ABI concerns the actual element is only removed at the next bump). Furthermore, the multiplication inherent in setting this field can lead to undefined integer overflows. This is particularly true for FFV1, which uses a very big worst-case buffer (37*4*width*height; even ordinary 1080p triggers an overflow). Ticket #8350 is about this overflow which this commit fixes. This means that the effective range of the PutBits API is no longer restricted by the /8 as long as one isn't using put_bits_(count|left). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* Avoid intermediate bitcount for number of bytes in PutBitContextAndreas Rheinhardt2021-03-30
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/dvenc: Avoid using PutBitContext fields directlyAndreas Rheinhardt2021-03-30
| | | | | | Also avoid using bitcounts in case one is actually byte-aligned. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-17 07:18:43 +0000