avcodec/hevc_sei: Check payload size in decode_nal_sei_message()
Fixes: out of array access Fixes: 29392/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4821602850177024.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavutil/eval: Remove CONFIG_TRAPV special handling
Fixes: division by zero Fixes: 29555/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVO_fuzzer-5149951447400448 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Bohan Li [Tue, 9 Feb 2021 04:04:41 +0000 (20:04 -0800)]
avcodec/libaomenc: add support for setting arbitrary libaom options
A new key & value API lets us gain access to newly added parameters
without adding explicit support for them in our wrapper. Add an
option utilizing this functionality in a similar manner to other
encoder libraries' wrappers.
avformat/wtvdec: Check len in parse_chunks() to avoid overflow
Fixes: signed integer overflow: 2147483647 + 7 cannot be represented in type 'int' Fixes: 30084/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-6192261941559296 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Peter Ross <pross@xvid.org> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
avformat/asfdec_f: Add an additional check for the extradata size
Fixes: OOM Fixes: 30066/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-6182309126602752 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: signed integer overflow: -1268324762623155200 * 8 cannot be represented in type 'long' Fixes: 30123/clusterfuzz-testcase-minimized-ffmpeg_dem_THREEDOSTR_fuzzer-6710765123928064 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
avcodec/g722enc: Validate parameters before using them
In case trellis is outside of 0..23, an invalid shift and/or a signed
integer overflow happens; furthermore, it can lead to the request to
allocate nonsense amounts of memory. So validate first.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Marton Balint [Sat, 30 Jan 2021 23:45:33 +0000 (00:45 +0100)]
avformat/libsrt: fix race condition with libsrt_network_wait_fd and epoll
The way SRT's async / epoll-based IO works is that the event status is stored
in the epoll containers. That is, if an event occurs on an SRT socket, and that
SRT socket isn't part of any epoll container, then that event is lost. If we
later add that socket to an epoll container, we still won't receive the event
even if it wasn't serviced.
Therefore we create the epoll and put the fd into it right after the connection
is established.
See http://lists.ffmpeg.org/pipermail/ffmpeg-devel/2021-January/275334.html
Both AC-3 encoder share the same options, yet they are nevertheless
duplicated in the binary; and the options applying to the EAC-3 encoder
are a proper subset of the options for the AC-3 encoders, so that it can
use the same options as the former by putting the options specific to
AC-3 at the front. This commit implements this.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
avcodec/aacdec_fixed: Move fixed-point sinewin tables to its only user
The fixed-point AAC decoder is the only user of the fixed-point sinewin
tables from sinewin; and it only uses a few of them (about 10% when
counting by size). This means that guarding initializing these tables by
an AVOnce (as done in 3719122065863f701026632f610175980d42b05a) is
unnecessary for them. Furthermore the array of pointers to the
individual arrays is also unneeded.
Therefore this commit moves these tables directly into aacdec_fixed.c;
this is done by ridding the original sinewin.h and sinewin_tablegen.h
headers completely of any fixed-point code at the cost of a bit of
duplicated code (the alternative is an ugly ifdef-mess).
This saves about 58KB from the binary when using hardcoded tables (as
these tables are hardcoded in this scenario); when not using hardcoded
tables, most of these savings only affect the .bss segment, but the rest
(< 1KB) contains relocations (i.e. savings in .data.rel.ro).
Reviewed-by: Lynne <dev@lynne.ee> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
ffbuild/common: Make deletion of templates possible
If a target to be built includes a template file, the target's .d file
includes the template file as a prerequisite; if the code were changed so
that the template file no longer exists, one would get an error from
make that it has no rule for the template file target. Therefore add a
dummy rule for template files to make deleting them possible.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Andriy Gelman [Sun, 31 Jan 2021 19:41:47 +0000 (14:41 -0500)]
avdevice/xcbgrab: don't assume xserver endianness
xserver defines the endianness of the grabbed images. Use this information
to set the correct pixel format.
This also fixes format selection in configuration depth=32/bpp=32 with
xserver on a little endian machine. Before the patch, the big endian
layout 0RGB was always selected which is incorrect because BGR0 should
be used. RGB24 was also incorrectly assumed (but this format was removed
in xserver 1.20).
The big-endian settings can be tested using docker+qemu from a little-endian
machine:
$ docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
$ docker run --rm -it -v /tmp:/tmp powerpc64/debian /bin/bash
To test AV_PIX_FMT_0RGB32
$ Xvfb :2 -screen 0 720x480x24 &
$ export DISPLAY=:2
$ xclock -geometry 720x480 -bg green #test different colors
On your host machine grab the frames using the following
command. View output to check that colors are rendered correctly
$ ./ffmpeg -y -f x11grab -i :2.0 -codec:v mpeg2video out.mp4
Other pixel formats can be tested by modifying how Xvfb is started in the docker
container:
AV_PIX_FMT_RGB565
$ Xvfb :2 -screen 0 720x480x16
AV_PIX_FMT_RGB555
$ Xvfb :2 -screen 0 720x480x15
AV_PIX_FMT_BGR24 / AV_PIX_FMT_RGB24
This is difficult to test because bpp=24 support was removed in xserver 1.20
https://lists.x.org/archives/xorg-devel/2018-February/056175.html?hmsr=joyk.com&utm_source=joyk.com&utm_medium=referral
However, I was able to run previous version of Xvfb (with some
modifications to force 24bpp) to check that images are rendered correctly.
Reviewed-by: Carl Eugen Hoyos <ceffmpeg@gmail.com> Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com>
Paul B Mahol [Fri, 5 Feb 2021 11:23:57 +0000 (12:23 +0100)]
avfilter/avfilter: move enable_str expression parsing into avfilter_init_dict()
This ensures that needed arrays are always allocated and properly initialized.
Previously if code would use only avfilter_init_dict() to set options for filters
it would not allocate arrays for timeline processing thus it would crash if
user supplied enable option for filter(s).
Limin Wang [Tue, 2 Feb 2021 12:41:22 +0000 (20:41 +0800)]
avformat/mxfenc: prefer to use the configured metadata
The metadata company_name, product_name, product_version from input
file will be deleted to avoid overwriting information
Please to test with below commands:
./ffmpeg -i ../fate-suite/mxf/Sony-00001.mxf -c:v copy -c:a copy out.mxf
and
./ffmpeg -i ../fate-suite/mxf/Sony-00001.mxf -c:v copy -c:a copy \
-metadata company_name="xxx" \
-metadata product_name="xxx" \
-metadata product_version="xxx" \
out.mxf
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se> Signed-off-by: Limin Wang <lance.lmwang@gmail.com>
Fixes: signed integer overflow: 2099257366 * 2 cannot be represented in type 'int' Fixes: 27486/clusterfuzz-testcase-minimized-ffmpeg_dem_FOURXM_fuzzer-5112179134824448 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
avformat/mov: Use av_mul_q() to avoid integer overflows
Fixes: signed integer overflow: 538976288 * 538976288 cannot be represented in type 'int' Fixes: 27473/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5758978289827840 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
avcodec/vp9dsp_template: Fix integer overflows in itxfm_wrapper
Fixes: signed integer overflow: 2147483641 + 32 cannot be represented in type 'int' Fixes: 27452/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5078752576667648 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
avformat/rmdec: Reorder operations to avoid overflow
Fixes: signed integer overflow: -2147483648 - 14 cannot be represented in type 'int' Fixes: 27659/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-5697250168406016 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
avcodec/rscc: Check inflated_buf size whan it is used
Fixes: out of array access Fixes: 27434/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RSCC_fuzzer-5196757675540480 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Fixes: signed integer overflow: 999999999 * 8 cannot be represented in type 'int' Fixes: 30048/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5864289917337600 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Peter Ross <pross@xvid.org> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
sfan5 [Thu, 4 Feb 2021 01:33:17 +0000 (09:33 +0800)]
avformat/dashdec: Avoid segfault when URL template is unexpectedly missing
This isn't supposed to happen, but unfinished support for non-templated
manifests and lack of e.g. presentationTimeOffset handling can provoke
such a situation even with well-formed input.
Steven Liu [Mon, 18 Jan 2021 06:22:08 +0000 (14:22 +0800)]
avformat/dashdec: rename variable name for more readable
Rename is_init_section_common_audio to is_init_section_common_subtitle
for is_common_init_section_exist(c->subtitles, c->n_subtitles).
Because it is checked to subtitles, not audio.
Steven Liu [Mon, 18 Jan 2021 06:22:07 +0000 (14:22 +0800)]
avformat/dashdec: check init_section before use it.
because there have no Initialization in SegmentTemplate,
so it will have no init_section for init segment file.
but in the is_common_init_section_exist function it will be used for
check to url, url_offset and size, so check init_section
before use init_section.
And fix code style in is_common_init_section_exist,
make the code block short when it too long.
avformat/rtsp: Fix build failure when RTP demuxers are disabled
rtsp.c uses a check of the form "if (CONFIG_RTSP_DEMUXER && ...) {}"
with the intent to make the code compilable even though the part guarded
by this check contains calls to functions that don't exist when the RTSP
demuxer is disabled. Yet even then compilers still need a declaration of
all the functions in the dead code block and error out if not (due to
our usage of -Werror=implicit-function-declaration) and no such
declaration exists for a static function in rtsp.c. Simply adding a
declaration leads to a "used but never defined" warning, therefore this
commit resorts to an #if.
Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Jose Da Silva [Mon, 1 Feb 2021 03:51:10 +0000 (19:51 -0800)]
avcodec/xbmdec: get_nibble() minor speed increase, and binary reduction
Replace av_isxdigit(*ptr) and convert(*ptr) with get_nibble(*ptr) which
returns a valid nibble=={0x00..0x0f} or false==255 for all other values.
This way we only need to work with *ptr once instead of twice.
Removing inline av_isxdigit(x) functions also shrinks executable size.
Jose Da Silva [Mon, 1 Feb 2021 03:51:04 +0000 (19:51 -0800)]
avcodec/xbmdec: convert() minor speed increase
If we test for {0..9} first, we have tested for 10/16th of all possible
characters first and avoid testing the remaining 6/16th of all possible
characters, which can be either 6/16th lowercase or 6/16th uppercase.
Jose Da Silva [Mon, 1 Feb 2021 03:50:57 +0000 (19:50 -0800)]
avcodec/xbmenc: Pre-compute variables once for parse_str_int()
Some compilers are very intuitive, and others are not so much, so let's
pre-compute the variables e and keylen outside the for loop. Ensuring a
minor speed increase regardless of if compiler is smart enough to solve
this improvement for itself, or not.
Jose Da Silva [Mon, 1 Feb 2021 03:50:49 +0000 (19:50 -0800)]
avcodec/xbmenc: substitute end instead of recalculating end
Minor speed increase, end is calculated before entering parse_str_int(),
so let's take advantage of the value and avoid recalculating twice more.
This also allows parse_str_int() to work with file size larger than int.
projects / ffmpeg / log