summaryrefslogtreecommitdiff
path: root/libavcodec
Commit message (Collapse)AuthorAge
* avcodec/adpcm_swf: support decoding multiple fixed-sized blocks at onceZane van Iperen2020-10-21
| | | | | | For incoming packets from WAV. Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
* avcodec/notchlc: Revert incorrect compression boundMichael Niedermayer2020-10-20
| | | | | | | Revert "avcodec/notchlc: Check uncompressed size against input for LZ4" Found-by: durandal_1707 This reverts commit 51002362c4ed301e54cea1597666cd5cc9a134f3.
* avcodec/decode/ff_get_buffer: Check for overflow in FFALIGN()Michael Niedermayer2020-10-20
| | | | | | | | Fixes: signed integer overflow: 2147483647 + 64 cannot be represented in type 'int' Fixes: 26218/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CRI_fuzzer-5734075396259840 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/cri: Check for end of image in unpack_10bit()Michael Niedermayer2020-10-20
| | | | | | | | Fixes: out of array write Fixes: 26242/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CRI_fuzzer-5161495882891264 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/adpcm: Check channels before use for ADPCM_PSXMichael Niedermayer2020-10-20
| | | | | | | | | Fixes: division by zero Fixes: 26293/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_PSX_fuzzer-5176665237618688 Fixes: 26331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_PSX_fuzzer-5632330364092416 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mobiclip: Avoid signed integer overflows in idct()Michael Niedermayer2020-10-20
| | | | | | | | Fixes: signed integer overflow: 536870912 + 1610612736 cannot be represented in type 'int' Fixes: 26288/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-6194364759670784 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/exr: Check limits to avoid overflow in delta computationMichael Niedermayer2020-10-20
| | | | | | | | | Fixes: signed integer overflow: 553590816 - -2145378049 cannot be represented in type 'int' Fixes: 26315/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5938755121446912 Fixes: 26340/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5644316208529408 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/notchlc: Check uncompressed size against input for LZ4Michael Niedermayer2020-10-20
| | | | | | | | | | Fixes: OOM Fixes: 26168/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-6019839015256064 Equation is based on LZ4_COMPRESSBOUND from lz4.h Suggested-by: Paul Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/h264idct_template: Fix integer overflow in ↵Michael Niedermayer2020-10-20
| | | | | | | | | | ff_h264_chroma422_dc_dequant_idct() Fixes: signed integer overflow: 241173056 + 1953511200 cannot be represented in type 'int' Fixes: 26086/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5068366420901888 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/movtextenc: Cleanup generically on init failureAndreas Rheinhardt2020-10-19
| | | | | Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextenc: Remove redundant function parametersAndreas Rheinhardt2020-10-19
| | | | | | | | | | | It makes no sense to call the functions to write styl, hlit or hclr boxes with a different box name than "styl", "hlit" or "hclr". Therefore this commit inlines these values in the functions, removes the function parameter containing the box's name and removes the (non obsolete) box names from the list of boxes. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextenc: Simplify writing to AVBPrintAndreas Rheinhardt2020-10-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The mov_text encoder uses an AVBPrint to assemble the subtitles; yet mov_text subtitles are not pure text; they also have a binary portion that was mostly handled as follows: uint32_t size = /* calculation */; size = AV_RB32(&size); av_bprint_append_data(bprint, (const char*)&size, 4); Here AV_RB32() is a no-op on big-endian systems and a LE-BE swap on little-endian systems, making the output endian-independent. Yet this is ugly and unclean: On LE systems, the variable size from the snippet above won't contain the correct value any more. Furthermore, using this pattern leads to lots of small writes to the AVBPrint. This commit therefore changes this to using a temporary buffer instead: uint8_t buf[4]; AV_WB32(buf, /* size calculation */); av_bprint_append_data(bprint, buf, 4); This method also allows to use bigger buffers holding more than one element, saving calls to av_bprint_append_data() and reducing codesize. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextenc: Fix undefined left shifts outside the range of intAndreas Rheinhardt2020-10-19
| | | | | Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextenc: Fix memleak on (re)allocation errorAndreas Rheinhardt2020-10-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Up until now, the mov_text encoder used the dynamic array API for its list of style attributes; it used the (horrible) av_dynarray_add() which works with an array of pointers; on error it frees its array but not the buffers referenced by the pointers said array contains. It also returns no error code, encouraging not to check for errors. These properties imply that this function may only be used if the buffers referenced by the list either need not be freed at all or if they are freed by other means (i.e. if the list contains non-ownership pointers). In this case, the style attributes are owned by the pointers of the dynamic list. Ergo the old style attributes leak on a subsequent reallocation failure. But given that the (re)allocation isn't checked for success, the style attribute intended to be added to the list also leaks because the only pointer to it gets overwritten in the belief that it is now owned by the list. This commit fixes this by switching to av_fast_realloc() and an array containing the styles directly instead of pointers to individually allocated style attributes. The current style attributes are now no longer individually allocated, instead they are part of the context. Furthermore, av_fast_realloc() allows to easily distinguish between valid and allocated elements, thereby allowing to reuse the array (which up until now has always been freed after processing an AVSubtitleRect). Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextenc: Don't presume every style to have a fontAndreas Rheinhardt2020-10-19
| | | | | | | | | Fixes segfaults in the absence of fonts; this can happen because the file didn't contain any or because the allocation of the font-string failed. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextenc: Reset array counter after freeing arrayAndreas Rheinhardt2020-10-19
| | | | | | | | | Otherwise the mov_text encoder can segfault when given subtitles with more than one AVSubtitleRect if one of the first nb_rects - 1 rects contained a style attribute. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextenc: Fix potential use of uninitialized valueAndreas Rheinhardt2020-10-19
| | | | | | | | | | Background colour was never initialized if no style was available. Use a sane default of zero (i.e. completely transparent). Fixes Coverity issue #1461471. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextdec: ReindentationAndreas Rheinhardt2020-10-19
| | | | | Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextdec: Use bytestream APIAndreas Rheinhardt2020-10-19
| | | | | | | Improves readability. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextdec: Avoid loop when writing UTF-8 character to AVBPrintAndreas Rheinhardt2020-10-19
| | | | | Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextdec: Remove unnecessary variableAndreas Rheinhardt2020-10-19
| | | | | | | | style_active doesn't do anything any more: It is already assured that style_active is one when one reaches the end of a style. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextdec: Fix immediately adjacent stylesAndreas Rheinhardt2020-10-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | The checks for whether a style should be opened/closed at the current character position are as follows: A variable entry contained the index of the currently active or potentially next active style. If the current character position coincided with the start of style[entry], the style was activated; this was followed by a check whether the current character position coincided with the end of style[entry]; if so, the style was deactivated and entry incremented. Afterwards the char was processed. The order of the checks leads to problems in case the endChar of style A coincides with the startChar of the next style (say B): Style B was never opened. When we are at said common position, the currently active style is A and so the start pos check does not succeed; but the end pos check does and it closes the currently active style A and increments entry. At the next iteration of the loop, the current character position is bigger than the start position of style B (which is style[entry]) and therefore the style is not activated. The solution is of course to first check for whether a style needs to be closed (and increment entry if it does) before checking whether the next style needs to be opened. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextdec: Skip empty stylesAndreas Rheinhardt2020-10-19
| | | | | | | | | | | | | | | They would either lead to unnecessary ASS tags being emitted (namely tags that are reset immediately thereafter) or would lead to problems when parsing: e.g. if a zero-length style immediately follows another style, the current code will end the preceding style and set the zero-length style as the next potentially active style, but it is only tested for activation when the next character is parsed at which point the current offset is already greater than both the starting as well as the end offset of the empty style. It will therefore neither be opened nor closed and all subsequent styles will be ignored. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextdec: Fix leaks on (re)allocation failureAndreas Rheinhardt2020-10-19
| | | | | | | | | | | | | | | | | | | | | Up until now, the 3GPP Timed Text decoder used av_dynarray_add() for a list of style entries. Said entries are individually allocated and owned by the pointers in the dynamic array and are therefore unsuitable for av_dynarray_add() which simply frees the array, but not the entries on error. In this case the intended new entry also leaks because it has been forgotten to free it. This commit fixes this. It is now allocated in one go and not reallocated multiple times (and it won't be overallocated any more). After all, the final number of elements (pending errors) is already known in advance. Furthermore, the style entries are now the entries of the new array, i.e. they are no longer allocated separately. This also removes one level of indirection. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextdec: Simplify finding default fontAndreas Rheinhardt2020-10-19
| | | | | | | There is no need to walk through the list of fonts twice. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextdec: Simplify checking for invalid extradataAndreas Rheinhardt2020-10-19
| | | | | | | | | Every font entry occupies at least three bytes, so checking early whether there is that much data available is a low-effort way to exclude invalid extradata. Doing so leads to an overall simplification. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextdec: Fix leaks of strings upon reallocation failureAndreas Rheinhardt2020-10-19
| | | | | | | | | | | | | | | | | | | | Up until now, the 3GPP Timed Text decoder used av_dynarray_add() for a list of font entries, a structure which contains an allocated string. The font entries are owned by the pointers in the dynamic array and are therefore unsuitable for av_dynarray_add() which simply frees the array, but not the font entries and of course not the strings. The latter all leak if reallocating the dynamic array fails. This commit fixes this. It stops reallocating the array altogether: After all, the final number of elements (pending errors) is already known in advance. Furthermore, the font entries are now the entries of the new array, i.e. the font entries are no longer allocated separately. This also removes one level of indirection. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/movtextdec: Reset counter of fonts when freeing themAndreas Rheinhardt2020-10-19
| | | | | | | | | | | If allocating fonts fails when reading the header, all fonts are freed, yet the counter of fonts is not reset and no error is returned; when subtitles are decoded lateron, the inexistent list of fonts is searched for the matching font for this particular entry which of course leads to a segfault. Reviewed-by: Philip Langdale <philipl@overt.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/aacdec_fixed: Limit index in vector_pow43()Michael Niedermayer2020-10-18
| | | | | | | | Fixes: out of array access Fixes: 26087/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5724825462767616 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/h264_slice: fix undefined integer overflow with POC in error concealmentMichael Niedermayer2020-10-18
| | | | | | | | | | Alternatively the POC could be changed to 64bit. the large values seem to be within what is allowed. Fixes: signed integer overflow: 2147483646 + 2 cannot be represented in type 'int' Fixes: 26076/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5711127201447936 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/decode: Consider discarded samples in max_samplesMichael Niedermayer2020-10-18
| | | | | | | | Fixes: Timeout (several minutes -> 3 sec) Fixes: 25246/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5943400661254144 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg12dec: Limit maximum A53 CC sizeMichael Niedermayer2020-10-18
| | | | | | | | | | | | | | This is more than 10 times the size of the largest i found. And also alot more than our encoder could handle (our encoder is limited to max 31) Without any limit megabyte+ sized blocks can be reallocated millions of times. Sadly the SCTE-20 spec does not seem to contain any hard limit directly, so this limit here is arbitrary Fixes: Timeout (25sec -> 152ms) Fixes: 25714/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG2VIDEO_fuzzer-5713633336885248 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/photocd: Use ff_set_dimensions()Michael Niedermayer2020-10-18
| | | | | | | | Fixes: out of memory Fixes: 25588/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PHOTOCD_fuzzer-6612945080156160 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/asvenc: Avoid reversing output data twiceAndreas Rheinhardt2020-10-18
| | | | | | | | | | | | | | | | The ASUS V2 format is designed for a little-endian bitstream reader, yet our encoder used an ordinary big-endian bitstream writer to write it; the bits of every byte were swapped at the end and some data (namely the numbers not in static tables) had to be bitreversed before writing it at all, so that it would be reversed twice. This commit stops doing so; instead, a little-endian bitstream writer is used. This also necessitated to switch certain static tables, which required trivial modifications to the decoder (that uses the same tables). Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/asvenc: Simplify flushing and padding packetAndreas Rheinhardt2020-10-18
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/asvdec: Avoid reversing input data twiceAndreas Rheinhardt2020-10-18
| | | | | | | | | | Up until now the ASV2 decoder used an ordinary big-endian bitreader to read data actually destined for a little-endian bitreader; this is done by reversing the whole input packet bitwise, using the big-endian bigreader and reversing (and shifting) the result again. This commit stops this and instead uses a little-endian bitreader directly. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/nvenc: update driver versions for SDK 11.0Timo Rothenpieler2020-10-17
|
* avcodec/mv30: Fix multiple integer overflowsMichael Niedermayer2020-10-17
| | | | | | | | Fixes: signed integer overflow: -895002 * 2400 cannot be represented in type 'int' Fixes: 26052/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MV30_fuzzer-5431812577558528 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/smacker: Check remaining bits in SMK_BLK_FULLMichael Niedermayer2020-10-17
| | | | | | | | Fixes: out of array access Fixes: 26047/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKER_fuzzer-5083031667474432 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/cook: Check subpacket index against maxMichael Niedermayer2020-10-17
| | | | | | | | | Fixes: off by 1 error Fixes: index 5 out of bounds for type 'COOKSubpacket [5]' Fixes: 25772/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5762459498184704.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/utils: Check for overflow with ATRAC* in get_audio_frame_duration()Michael Niedermayer2020-10-17
| | | | | | | | Fixes: signed integer overflow: 1024 * 13129048 cannot be represented in type 'int' Fixes: 26378/clusterfuzz-testcase-minimized-ffmpeg_dem_CODEC2RAW_fuzzer-5634018353348608 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/hevcpred_template: Fix diagonal chroma availability in 4:2:2 edge ↵Michael Niedermayer2020-10-17
| | | | | | | | | case in intra_pred Fixes: pixel decode issue.ts Fixes: raw frame.hevc Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/hevc_mvs: Cleanup ff_hevc_set_neighbour_available()Michael Niedermayer2020-10-17
| | | | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/adpcmenc: remove BLKSIZE #defineZane van Iperen2020-10-17
| | | | Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
* avcodec/adpcm_ima_wav: support custom block size for encodingZane van Iperen2020-10-17
| | | | Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
* avcodec/adpcm_yamaha: support custom block size for encodingZane van Iperen2020-10-17
| | | | Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
* avcodec/adpcm_ima_apm: support custom block size for encodingZane van Iperen2020-10-17
| | | | Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
* avcodec/adpcm_ima_ssi: support custom block size for encodingZane van Iperen2020-10-17
| | | | Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
* avcodec/adpcm_ms: support custom block size for encodingZane van Iperen2020-10-17
| | | | | | Fixes tickets #6585 and #7109 Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
* avcodec/adpcmenc: add "block_size" optionZane van Iperen2020-10-17
| | | | Signed-off-by: Zane van Iperen <zane@zanevaniperen.com>
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-12 06:55:16 +0000