summaryrefslogtreecommitdiff
path: root/libavcodec
Commit message (Collapse)AuthorAge
* avcodec/movtextdec: ReindentationAndreas Rheinhardt2020-10-19
| | | | | Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextdec: Use bytestream APIAndreas Rheinhardt2020-10-19
| | | | | | | Improves readability. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextdec: Avoid loop when writing UTF-8 character to AVBPrintAndreas Rheinhardt2020-10-19
| | | | | Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextdec: Remove unnecessary variableAndreas Rheinhardt2020-10-19
| | | | | | | | style_active doesn't do anything any more: It is already assured that style_active is one when one reaches the end of a style. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextdec: Fix immediately adjacent stylesAndreas Rheinhardt2020-10-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | The checks for whether a style should be opened/closed at the current character position are as follows: A variable entry contained the index of the currently active or potentially next active style. If the current character position coincided with the start of style[entry], the style was activated; this was followed by a check whether the current character position coincided with the end of style[entry]; if so, the style was deactivated and entry incremented. Afterwards the char was processed. The order of the checks leads to problems in case the endChar of style A coincides with the startChar of the next style (say B): Style B was never opened. When we are at said common position, the currently active style is A and so the start pos check does not succeed; but the end pos check does and it closes the currently active style A and increments entry. At the next iteration of the loop, the current character position is bigger than the start position of style B (which is style[entry]) and therefore the style is not activated. The solution is of course to first check for whether a style needs to be closed (and increment entry if it does) before checking whether the next style needs to be opened. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextdec: Skip empty stylesAndreas Rheinhardt2020-10-19
| | | | | | | | | | | | | | | They would either lead to unnecessary ASS tags being emitted (namely tags that are reset immediately thereafter) or would lead to problems when parsing: e.g. if a zero-length style immediately follows another style, the current code will end the preceding style and set the zero-length style as the next potentially active style, but it is only tested for activation when the next character is parsed at which point the current offset is already greater than both the starting as well as the end offset of the empty style. It will therefore neither be opened nor closed and all subsequent styles will be ignored. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextdec: Fix leaks on (re)allocation failureAndreas Rheinhardt2020-10-19
| | | | | | | | | | | | | | | | | | | | | Up until now, the 3GPP Timed Text decoder used av_dynarray_add() for a list of style entries. Said entries are individually allocated and owned by the pointers in the dynamic array and are therefore unsuitable for av_dynarray_add() which simply frees the array, but not the entries on error. In this case the intended new entry also leaks because it has been forgotten to free it. This commit fixes this. It is now allocated in one go and not reallocated multiple times (and it won't be overallocated any more). After all, the final number of elements (pending errors) is already known in advance. Furthermore, the style entries are now the entries of the new array, i.e. they are no longer allocated separately. This also removes one level of indirection. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextdec: Simplify finding default fontAndreas Rheinhardt2020-10-19
| | | | | | | There is no need to walk through the list of fonts twice. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextdec: Simplify checking for invalid extradataAndreas Rheinhardt2020-10-19
| | | | | | | | | Every font entry occupies at least three bytes, so checking early whether there is that much data available is a low-effort way to exclude invalid extradata. Doing so leads to an overall simplification. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextdec: Fix leaks of strings upon reallocation failureAndreas Rheinhardt2020-10-19
| | | | | | | | | | | | | | | | | | | | Up until now, the 3GPP Timed Text decoder used av_dynarray_add() for a list of font entries, a structure which contains an allocated string. The font entries are owned by the pointers in the dynamic array and are therefore unsuitable for av_dynarray_add() which simply frees the array, but not the font entries and of course not the strings. The latter all leak if reallocating the dynamic array fails. This commit fixes this. It stops reallocating the array altogether: After all, the final number of elements (pending errors) is already known in advance. Furthermore, the font entries are now the entries of the new array, i.e. the font entries are no longer allocated separately. This also removes one level of indirection. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextdec: Reset counter of fonts when freeing themAndreas Rheinhardt2020-10-19
| | | | | | | | | | | If allocating fonts fails when reading the header, all fonts are freed, yet the counter of fonts is not reset and no error is returned; when subtitles are decoded lateron, the inexistent list of fonts is searched for the matching font for this particular entry which of course leads to a segfault. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/aacdec_fixed: Limit index in vector_pow43()Michael Niedermayer2020-10-18
| | | | | | | | Fixes: out of array access Fixes: 26087/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5724825462767616 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/h264_slice: fix undefined integer overflow with POC in error concealmentMichael Niedermayer2020-10-18
| | | | | | | | | | Alternatively the POC could be changed to 64bit. the large values seem to be within what is allowed. Fixes: signed integer overflow: 2147483646 + 2 cannot be represented in type 'int' Fixes: 26076/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5711127201447936 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/decode: Consider discarded samples in max_samplesMichael Niedermayer2020-10-18
| | | | | | | | Fixes: Timeout (several minutes -> 3 sec) Fixes: 25246/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5943400661254144 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg12dec: Limit maximum A53 CC sizeMichael Niedermayer2020-10-18
| | | | | | | | | | | | | | This is more than 10 times the size of the largest i found. And also alot more than our encoder could handle (our encoder is limited to max 31) Without any limit megabyte+ sized blocks can be reallocated millions of times. Sadly the SCTE-20 spec does not seem to contain any hard limit directly, so this limit here is arbitrary Fixes: Timeout (25sec -> 152ms) Fixes: 25714/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG2VIDEO_fuzzer-5713633336885248 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/photocd: Use ff_set_dimensions()Michael Niedermayer2020-10-18
| | | | | | | | Fixes: out of memory Fixes: 25588/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PHOTOCD_fuzzer-6612945080156160 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/asvenc: Avoid reversing output data twiceAndreas Rheinhardt2020-10-18
| | | | | | | | | | | | | | | | The ASUS V2 format is designed for a little-endian bitstream reader, yet our encoder used an ordinary big-endian bitstream writer to write it; the bits of every byte were swapped at the end and some data (namely the numbers not in static tables) had to be bitreversed before writing it at all, so that it would be reversed twice. This commit stops doing so; instead, a little-endian bitstream writer is used. This also necessitated to switch certain static tables, which required trivial modifications to the decoder (that uses the same tables). Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/asvenc: Simplify flushing and padding packetAndreas Rheinhardt2020-10-18
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/asvdec: Avoid reversing input data twiceAndreas Rheinhardt2020-10-18
| | | | | | | | | | Up until now the ASV2 decoder used an ordinary big-endian bitreader to read data actually destined for a little-endian bitreader; this is done by reversing the whole input packet bitwise, using the big-endian bigreader and reversing (and shifting) the result again. This commit stops this and instead uses a little-endian bitreader directly. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/nvenc: update driver versions for SDK 11.0Timo Rothenpieler2020-10-17
|
* avcodec/mv30: Fix multiple integer overflowsMichael Niedermayer2020-10-17
| | | | | | | | Fixes: signed integer overflow: -895002 * 2400 cannot be represented in type 'int' Fixes: 26052/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MV30_fuzzer-5431812577558528 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/smacker: Check remaining bits in SMK_BLK_FULLMichael Niedermayer2020-10-17
| | | | | | | | Fixes: out of array access Fixes: 26047/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKER_fuzzer-5083031667474432 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/cook: Check subpacket index against maxMichael Niedermayer2020-10-17
| | | | | | | | | Fixes: off by 1 error Fixes: index 5 out of bounds for type 'COOKSubpacket [5]' Fixes: 25772/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5762459498184704.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/utils: Check for overflow with ATRAC* in get_audio_frame_duration()Michael Niedermayer2020-10-17
| | | | | | | | Fixes: signed integer overflow: 1024 * 13129048 cannot be represented in type 'int' Fixes: 26378/clusterfuzz-testcase-minimized-ffmpeg_dem_CODEC2RAW_fuzzer-5634018353348608 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/hevcpred_template: Fix diagonal chroma availability in 4:2:2 edge ↵Michael Niedermayer2020-10-17
| | | | | | | | | case in intra_pred Fixes: pixel decode issue.ts Fixes: raw frame.hevc Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/hevc_mvs: Cleanup ff_hevc_set_neighbour_available()Michael Niedermayer2020-10-17
| | | | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/adpcmenc: remove BLKSIZE #defineZane van Iperen2020-10-17
| | | | Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
* avcodec/adpcm_ima_wav: support custom block size for encodingZane van Iperen2020-10-17
| | | | Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
* avcodec/adpcm_yamaha: support custom block size for encodingZane van Iperen2020-10-17
| | | | Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
* avcodec/adpcm_ima_apm: support custom block size for encodingZane van Iperen2020-10-17
| | | | Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
* avcodec/adpcm_ima_ssi: support custom block size for encodingZane van Iperen2020-10-17
| | | | Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
* avcodec/adpcm_ms: support custom block size for encodingZane van Iperen2020-10-17
| | | | | | Fixes tickets #6585 and #7109 Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
* avcodec/adpcmenc: add "block_size" optionZane van Iperen2020-10-17
| | | | Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
* avcodec/av1dec: add cur_frame.spatial_id and temporal_id to AV1FrameJames Almer2020-10-16
| | | | | | | Will be used by hwaccels, which have access to a frame's AV1RawFrameHeader but not its AV1RawOBUHeader. Signed-off-by: James Almer <jamrial@gmail.com>
* avcodec/movtextenc: cosmeticsAndriy Gelman2020-10-15
| | | | | | Change pointer position. Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com>
* avcodec/movtextenc: fix writing to bytestream on BE archesAndriy Gelman2020-10-15
| | | | | | | | | | | | | | | | | | Fixes fate-binsub-movtextenc on PPC64 Currently tags are written in reverse order on BE arches. This is fixed by using MKBETAG() and AV_RB32() to be arch agnostics. Also s->font_count is of type int. On BE arches with 32bit int, count = AV_RB16(&s->font_count) will read two most significant bytes instead of the least significant bytes. This is fixed by assigning s->font_count to count first. The final change is modifying the type of len. On BE arches the most significant byte of the int was written instead of the least significant byte. Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com>
* avcodec/asvenc: Inline constantsAndreas Rheinhardt2020-10-16
| | | | | Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/asvdec: Use init_get_bits8()Andreas Rheinhardt2020-10-16
| | | | | Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/asvdec: Reduce the size of some VLCsAndreas Rheinhardt2020-10-16
| | | | | Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/ylc: Inline constantsAndreas Rheinhardt2020-10-16
| | | | | Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/v3/408enc: Remove empty close functionsAndreas Rheinhardt2020-10-16
| | | | | Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/exr: Fix overflow with many blocksMichael Niedermayer2020-10-15
| | | | | | | | Fixes: signed integer overflow: 1073741827 * 8 cannot be represented in type 'int' Fixes: 25621/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6304841641754624 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/Makefile: add missing av1_cuvid entryJames Almer2020-10-15
| | | | Signed-off-by: James Almer <jamrial@gmail.com>
* avcodec/vp9dsp_template: Fix integer overflows in idct16_1d()Michael Niedermayer2020-10-15
| | | | | | | | Fixes: signed integer overflow: -190760 * 11585 cannot be represented in type 'int' Fixes: 25471/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5743354917421056 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/ansi: Check initial dimensionsMichael Niedermayer2020-10-15
| | | | | | | | Fixes: Timeout (minutes to less than 1sec) Fixes: 25682/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ANSI_fuzzer-6320712032452608 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/hevcdec: Check slice_cb_qp_offset / slice_cr_qp_offsetMichael Niedermayer2020-10-15
| | | | | | | | Fixes: signed integer overflow: 29 + 2147483640 cannot be represented in type 'int' Fixes: 25413/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5697909331591168 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/sonic: Check for overreadMichael Niedermayer2020-10-15
| | | | | | | | Fixes: Timeout (too long -> 1.3 sec) Fixes: 24358/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5107284099989504 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mobiclip: Check that Motion vectors are within the input frameMichael Niedermayer2020-10-15
| | | | | | | | | | | | The MV checks did not consider the width and height of the block, also they had some off by 1 errors. This resulted in undefined behavior and crashes. This commit instead errors out on these Fixes: out of array read Fixes: 26080/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-5758146355920896 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mobiclip: set the bitstream size to the inputMichael Niedermayer2020-10-15
| | | | | | | | | Fixes: out of array read Fixes: 25453/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-5163575973511168 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/allcodecs: move av1_cuvid below libaom_av1James Almer2020-10-15
| | | | | | Software decoders should always be first. Signed-off-by: James Almer <jamrial@gmail.com>
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-12 09:49:53 +0000