summaryrefslogtreecommitdiff
path: root/libavcodec
Commit message (Collapse)AuthorAge
* avcodec/motion_est: Fix invalid left shift of negative numbersAndreas Rheinhardt2021-04-01
| | | | | | Affected many FATE-tests. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/g2meet: Fix undefined NULL + 0Andreas Rheinhardt2021-04-01
| | | | | | Affected the g2m4 FATE-test. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/vmdvideo: Fix NULL + 0Andreas Rheinhardt2021-04-01
| | | | | | Affected the FATE tests filter-gradfun-sample and sierra-vmd-video. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/mss12: Don't apply non-zero offset to null pointerAndreas Rheinhardt2021-04-01
| | | | | | Affected the FATE tests mss2-wmv and mss1-pal. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/lcldec: Fix undefined NULL + 0Andreas Rheinhardt2021-04-01
| | | | | | Affected the FATE tests vsynth*-zlib, mszh and zlib. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/qtrleenc: Fix negative linesizes, don't use NULL + offsetAndreas Rheinhardt2021-04-01
| | | | | | | | | | | | | | | | | | | | | | | | | Before commit f1e17eb446577180ee9976730aacb46563766518, the qtrle encoder had undefined pointer arithmetic: Outside of a loop, two pointers were set to point to the ith element (with index i-1) of a line of a frame. At the end of each loop iteration, these pointers were decremented, so that they pointed to the -1th element of the line after the loop. Furthermore, one of these pointers can be NULL (in which case all pointer arithmetic is automatically undefined behaviour). Commit f1e17eb44 added a check in order to ensure that the elements never point to the -1th element of the array: The pointers are only decremented if they are bigger than the frame's base pointer (i.e. AVFrame.data[0]). Yet this check does not work at all in case of negative linesizes; furthermore in case the pointer that can be NULL is NULL initializing it still involves undefined pointer arithmetic. This commit fixes both of these issues: First, non-NULL pointers are initialized to point to the element after the ith element and decrementing is moved to the beginning of the loop. Second, if a pointer is NULL, it is just made to point to the other pointer, as this allows to avoid checks before decrementing it. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/qtrleenc: Use keyframe when no previous frame is availableAndreas Rheinhardt2021-04-01
| | | | | | | If keeping a reference to an earlier frame failed, the next frame must be an I frame for lack of reference frame. This commit implements this. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/proresdec2: Don't apply non-zero offset to null pointerAndreas Rheinhardt2021-04-01
| | | | | | | Affected ProRes without alpha; affected 32 FATE tests, e.g. prores-422, prores-422_proxy, prores-422_lt or matroska-prores-header-insertion-bz2. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/mpegvideo_enc: Don't apply non-zero offset to null pointerAndreas Rheinhardt2021-04-01
| | | | | | Affected many FATE tests (mostly vsynth ones). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/dcaenc: Fix undefined left shift of negative numbersAndreas Rheinhardt2021-04-01
| | | | | | Affected the acodec-dca and acodec-dca2 FATE tests. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/pnm_parser: Check image size addition for overflowMichael Niedermayer2021-04-01
| | | | | | | | | | Fixes: assertion failure Fixes: out of array access Fixes: 32664/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-6533642202513408.fuzz Fixes: 32669/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-6001928875147264 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/lscrdec: Check length in decode_idat()Michael Niedermayer2021-04-01
| | | | | | | | Fixes: out of array access Fixes: 32264/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LSCR_fuzzer-6684504010915840 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/h265_metadata_bsf: Check nb_units before accessing the first in ↵Michael Niedermayer2021-04-01
| | | | | | | | | | | | h265_metadata_update_fragment() Fixes: null pointer dereference Fixes: 32113/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-4803262287052800 Same as 0c48c332eeb2866d9353125f701e099c48889463 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/exr: Check oe in huf_decode() before useMichael Niedermayer2021-04-01
| | | | | | | | Fixes: out of array access Fixes: 31386/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5773234709594112 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/h264_slice: Check input SPS in ff_h264_update_thread_context()Michael Niedermayer2021-03-31
| | | | | | | | Fixes: crash Fixes: check_pkt.mp4 Found-by: Rafael Dutra <rafael.dutra@cispa.de> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpegpicture: Keep ff_mpeg_framesize_alloc() failure state consistentMichael Niedermayer2021-03-31
| | | | | | | | | Fixes: null pointer dereference Fixes: ff_put_pixels16_sse2.mp4 Found-by: Rafael Dutra <rafael.dutra@cispa.de> Regression-since: 4b2863ff01b1fe93d9a518523c9098d17a9d8c6f Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpegvideo: Update chroma_?_shift in ff_mpv_common_frame_size_change()Michael Niedermayer2021-03-31
| | | | | | | | Fixes: out of array access Fixes: 31201/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4627865612189696.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mjpegenc: Fix segfault when freeing incomplete contextAndreas Rheinhardt2021-03-31
| | | | | | | | | | When allocating the MJpegContext fails (or if the dimensions run afoul of the 65500x65500 limit), an attempt to free a subbuffer of said context leads to a segfault in ff_mjpeg_encode_close(). Seems to be a regression since 467d9e27e0cb2bf74f41dc832f2f8d191ba58ec9. Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avcodec/tiff: Avoid forward declarationsAndreas Rheinhardt2021-03-31
| | | | | | | | | | | In this case it also fixes a potential for compilation failures: Not all compilers can handle the case in which a function with a forward declaration declared with an attribute to always inline it is called before the function body appears. E.g. GCC 4.2.1 on OS X 10.6 doesn't like it. Reviewed-by: Pavel Koshevoy <pkoshevoy@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avcodec/dv_profile: PAL DV files with dsf flag 0 - detect via pal flag and ↵Mark Plomer2021-03-30
| | | | | | | | | | | | | buf_size Some old DV AVI files have the DSF-Flag of frames set to 0, although it is PAL (maybe rendered with an old Ulead Media Studio Pro) ... this causes ffmpeg/VLC-player to produce/play corrupted video (other players/editors like VirtualDub work fine). Fixes ticket #8333 and replaces/extends hack for ticket #2177 Signed-off-by: Marton Balint <cus@passwd.hu>
* avcodec/put_bits: Don't set size_in_bits, fix overflowAndreas Rheinhardt2021-03-30
| | | | | | | | | | | | | | | | | | A PutBitContext has a field called size_in_bits which is set to the context's bitsize init_put_bits(); but it isn't used at all (the PutBits API uses pointers directly and not bit indexes), so remove it (due to ABI concerns the actual element is only removed at the next bump). Furthermore, the multiplication inherent in setting this field can lead to undefined integer overflows. This is particularly true for FFV1, which uses a very big worst-case buffer (37*4*width*height; even ordinary 1080p triggers an overflow). Ticket #8350 is about this overflow which this commit fixes. This means that the effective range of the PutBits API is no longer restricted by the /8 as long as one isn't using put_bits_(count|left). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* Avoid intermediate bitcount for number of bytes in PutBitContextAndreas Rheinhardt2021-03-30
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/dvenc: Avoid using PutBitContext fields directlyAndreas Rheinhardt2021-03-30
| | | | | | Also avoid using bitcounts in case one is actually byte-aligned. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/proresenc_kostya: Factor flushing PutBitContext outAndreas Rheinhardt2021-03-30
| | | | | | | | | | | | | | | The function to write an ordinary (luma or chroma) plane as well as the function for writing an alpha plane have some similarities: They record the initial bitposition (despite said position always being byte-aligned), flush the PutBitContext themselves and return the amount of bytes they wrote. This commit factors this out; it also replaces bitpositions by bytepositions and it avoids recording the initial byteposition because said information is already available from the position at the end of the last plane. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/utvideoenc: Don't use bitcounts when byte-alignedAndreas Rheinhardt2021-03-30
| | | | | | | | | Despite write_huff_codes() receiving an ordinary buffer (not a PutBitContext), it returned the amount of data written in bits, not in bytes. This has been changed: There is now no intermediate bitcount any more. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec: Remove cumbersome way of checking for amount of bytes leftAndreas Rheinhardt2021-03-30
| | | | | | | | | | | | | Several encoders used code like the following to check for the amount of bytes left in a PutBitContext: pb->buf_end - pb->buf - (put_bits_count(pb) >> 3) Besides the fact that using the pointers directly might pose a maintainence burden in the future this also leads to suboptimal code: The above code reads all three pointers (buf, buf_ptr and buf_end), but touching buf is unnecessary and switching to put_bytes_left() automatically fixes this. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/put_bits: Add functions for amount of bytes written/leftAndreas Rheinhardt2021-03-30
| | | | | | | | | | | | | | | | | | | | Often a caller doesn't want the amount of bits written via a PutBitContext, but the amount of bytes. This in particular happens after one has flushed the PutBitContext (e.g. at the end of encoding, when one wants to know the actual packet size). The current way of doing this is with put_bits_count(pb)/8 (or (put_bits_count(pb) + 7)/8). Yet this has some issues: It contains implicit multiplications and divisions by 8 with a cast in between; it obscurs the intent; and it restricts the size of the buffer to (currently) INT_MAX/8 (or to 1/8 of the maximum of whatever put_bits_count() returns), although said restriction is not really necessary for users that don't need a bitcount. Corresponding functions for the amount of bytes left have also been addded. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/vorbisenc, wmavoice: Use put_bits_left() where appropriateAndreas Rheinhardt2021-03-30
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/dvenc: Remove dead error messageAndreas Rheinhardt2021-03-30
| | | | | | | The PutBits API checks the available space before every write, so this check for overread is dead. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/mlpenc: Avoid redundant temporary PutBitContextAndreas Rheinhardt2021-03-30
| | | | | | | We are already word-aligned here, so one can just as well flush the main PutBitContext. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/sonic: Remove outdated outcommented lineAndreas Rheinhardt2021-03-30
| | | | | | | Compilation would fail if it were outcommented as it refers to a nonexistent PutBitContext. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/vorbisenc: Remove always-false checkAndreas Rheinhardt2021-03-30
| | | | | | The PutBitContext is big enough: It has just been initialized to 8192B. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/setts_bsf: Check timebaseMichael Niedermayer2021-03-29
| | | | | | | | Fixes: Division by 0 Fixes: 30952/clusterfuzz-testcase-minimized-ffmpeg_BSF_SETTS_fuzzer-6601016202100736 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/dvbsubdec: Support computing clut only onceMichael Niedermayer2021-03-29
| | | | | | This avoids crafted files from consuming excessive resources recomputing the clut after each pixel change Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/sonic: Use unsigned temporary in predictor_calc_error()Michael Niedermayer2021-03-28
| | | | | | | | Fixes: signed integer overflow: -2147471366 - 18638 cannot be represented in type 'int' Fixes: 30157/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5171199746506752 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/libxvid: remove unnecessary output packet data checkJames Almer2021-03-26
| | | | | | | | The user buffers passed to avcodec_encode_video2() haven't been propagated to AVCodec.encode2 implementations since 93016f5d1d280f9cb7856883af287fa66affc04c. Also, the generic encode code already unrefs the packet if nothing was encoded. Signed-off-by: James Almer <jamrial@gmail.com>
* avcodec/h264_slice: Check sps in h264_slice_header_init()Michael Niedermayer2021-03-26
| | | | | | | | | Fixes: null pointer dereference Fixes: h264_slice_header_init.mp4 Found-by: Rafael Dutra <rafael.dutra@cispa.de> Tested-by: Rafael Dutra <rafael.dutra@cispa.de> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/aacpsy: Check model_priv_data before dereferencing in psy_3gpp_end()Michael Niedermayer2021-03-26
| | | | | | | | | Fixes: null pointer dereference Fixes: av_freep.mp4 Found-by: Rafael Dutra <rafael.dutra@cispa.de> Tested-by: Rafael Dutra <rafael.dutra@cispa.de> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/sga: Check for array end in lzss_decompress()Michael Niedermayer2021-03-26
| | | | | | | | | Fixes: out of array access Fixes: 31640/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SGA_fuzzer-5630883286614016 Fixes: 31619/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SGA_fuzzer-5176667708456960 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/ffwavesynth: Avoid signed integer overflow in phi_at()Michael Niedermayer2021-03-26
| | | | | | | | | Fixes: signed integer overflow: 2314885530818453536 - -9070214327174160352 cannot be represented in type 'long' Fixes: 31000/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-6558389742206976 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Nicolas George <george@nsup.org> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/pthread_frame: ReindentationAndreas Rheinhardt2021-03-26
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/pthread_frame: Check initializing mutexes/condition variablesAndreas Rheinhardt2021-03-26
| | | | | | | | | | | | | | | | | | Up until now, initializing the mutexes/condition variables wasn't checked by ff_frame_thread_init(). This commit changes this. Given that it is not documented to be save to destroy a zeroed but otherwise uninitialized mutex/condition variable, one has to choose between two approaches: Either one duplicates the code to free them in ff_frame_thread_init() in case of errors or one records which have been successfully initialized. This commit takes the latter approach: For each of the two structures with mutexes/condition variables an array containing the offsets of the members to initialize is added. Said array is used both for initializing and freeing and the only thing that needs to be recorded is how many of these have been successfully initialized. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/pthread_frame: Fix cleanup during initAndreas Rheinhardt2021-03-26
| | | | | | | | | | | | | | | | | In case an error happened when setting up the child threads, ff_frame_thread_init() would up until now call ff_frame_thread_free() to clean up all threads set up so far, including the current, not properly initialized one. But a half-allocated context needs special handling which ff_frame_thread_frame_free() doesn't provide. Notably, if allocating the AVCodecInternal, the codec's private data or setting the options fails, the codec's close function will be called (if there is one); it will also be called if the codec's init function fails, regardless of whether the FF_CODEC_CAP_INIT_CLEANUP is set. This is not supported by all codecs; in ticket #9099 it led to a crash. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/pthread_frame: Factor initializing single thread outAndreas Rheinhardt2021-03-26
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/adpcm_ima_cunning: reset state on flushZane van Iperen2021-03-25
| | | | Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
* avcodec/adpcm_ima_alp: reset state on flushZane van Iperen2021-03-25
| | | | Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
* avcodec/adpcm_ima_ssi: reset state on flushZane van Iperen2021-03-25
| | | | Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
* avcodec/adpcm_argo: reset state on flushZane van Iperen2021-03-25
| | | | | | | Commit 003b5c800fef909fa84dd2fae43d66bd434d3f7e introduced seeking in argo_asf, but this was missed, leading to non-deterministic output. Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
* avcodec/adpcm_aica: reset state in flush callbackZane van Iperen2021-03-25
| | | | Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
* avcodec/adpcm_zork: reset state in flush callbackZane van Iperen2021-03-25
| | | | Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-12 09:22:09 +0000