ffmpeg.git
7 weeks agoBump minor versions again on master to keep 4.2 versions separate from master n4.3-dev
Michael Niedermayer [Sun, 21 Jul 2019 16:31:20 +0000 (18:31 +0200)]
Bump minor versions again on master to keep 4.2 versions separate from master

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
7 weeks agoBump minor versions to separate 4.2 from master
Michael Niedermayer [Sun, 21 Jul 2019 16:31:20 +0000 (18:31 +0200)]
Bump minor versions to separate 4.2 from master

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
7 weeks agoChangelog: Add 4.2 cut marker
Michael Niedermayer [Sun, 21 Jul 2019 16:25:21 +0000 (18:25 +0200)]
Changelog: Add 4.2 cut marker

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
7 weeks agodoc/APIchanges: Fill in missing Fields, add 4.2 cut marker
Michael Niedermayer [Sun, 21 Jul 2019 16:24:06 +0000 (18:24 +0200)]
doc/APIchanges: Fill in missing Fields, add 4.2 cut marker

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavcodec/utils: Check close before calling it
Michael Niedermayer [Sat, 20 Jul 2019 22:08:55 +0000 (00:08 +0200)]
avcodec/utils: Check close before calling it

Fixes: NULL pointer dereference
Fixes: 15733/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IDF_fuzzer-5658616977162240

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agotools/target_dec_fuzzer: Free parser in case of avcodec_open2() failure
Michael Niedermayer [Sun, 7 Jul 2019 20:50:42 +0000 (22:50 +0200)]
tools/target_dec_fuzzer: Free parser in case of avcodec_open2() failure

Fixes: memleak
Fixes: part of 15529/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVPX_VP8_fuzzer-5140143700180992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavcodec/vorbisdec: Check vlc for floor0 dec vector offset
Michael Niedermayer [Sun, 7 Jul 2019 21:23:53 +0000 (23:23 +0200)]
avcodec/vorbisdec: Check vlc for floor0 dec vector offset

Fixes: out of array access
Fixes: 15649/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5729191309344768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavcodec/vorbisdec: amplitude bits can be more than 25 bits
Michael Niedermayer [Sun, 7 Jul 2019 21:16:12 +0000 (23:16 +0200)]
avcodec/vorbisdec: amplitude bits can be more than 25 bits

Fixes: assertion failure, invalid shift
Fixes: 15583/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5640157484548096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavutil/softfloat_ieee754: Fix odd bit position for exponent and sign in av_bits2sf_ie...
Michael Niedermayer [Sun, 7 Jul 2019 12:47:58 +0000 (14:47 +0200)]
avutil/softfloat_ieee754: Fix odd bit position for exponent and sign in av_bits2sf_ieee754()

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavcodec/alsdec: fix undefined shift in multiply()
Michael Niedermayer [Sat, 6 Jul 2019 22:03:51 +0000 (00:03 +0200)]
avcodec/alsdec: fix undefined shift in multiply()

Fixes: left shift of negative value -6
Fixes: 15564/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5701655938465792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavcodec/alsdec: Fix 2 integer overflows
Michael Niedermayer [Sat, 6 Jul 2019 21:20:30 +0000 (23:20 +0200)]
avcodec/alsdec: Fix 2 integer overflows

Fixes: signed integer overflow: 1270564968 + 904828220 cannot be represented in type 'int'
Fixes: 15402/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5755426823471104

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavcodec/apedec: Fix various integer overflows
Michael Niedermayer [Sun, 16 Jun 2019 09:32:10 +0000 (11:32 +0200)]
avcodec/apedec: Fix various integer overflows

Fixes: signed integer overflow: -538976267 * 31 cannot be represented in type 'int'
Fixes: left shift of 65312 by 16 places cannot be represented in type 'int'
Fixes: 15255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5718831688843264
Fixes: 15547/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5691384901664768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavcodec/apedec: Fix multiple integer overflows in predictor_update_filter()
Michael Niedermayer [Sun, 16 Jun 2019 08:54:13 +0000 (10:54 +0200)]
avcodec/apedec: Fix multiple integer overflows in predictor_update_filter()

Fixes: signed integer overflow: -829262115 + -1410750414 cannot be represented in type 'int'
Fixes: 15251/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5651742252859392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavcodec/flicvideo: Make line_packets int
Michael Niedermayer [Fri, 21 Jun 2019 21:01:04 +0000 (23:01 +0200)]
avcodec/flicvideo: Make line_packets int

Fixes: signed integer overflow: -32768 * 196032 cannot be represented in type 'int'
Fixes: 15300/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-5733319519502336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agolavf/avio: remove ffio_open2_wrapper function
Jun Zhao [Sat, 13 Jul 2019 02:45:18 +0000 (10:45 +0800)]
lavf/avio: remove ffio_open2_wrapper function

Remove the function ffio_open2_wrapper, it's not being used anymore.

Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
8 weeks agolavfi/showinfo: support regions of interest sidedata
Jun Zhao [Sat, 9 Mar 2019 07:55:38 +0000 (15:55 +0800)]
lavfi/showinfo: support regions of interest sidedata

support regions of interest sidedata

Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
8 weeks agoavformat/aacdec: resync to the next adts frame on invalid data instead of aborting
James Almer [Sun, 21 Jul 2019 00:47:55 +0000 (21:47 -0300)]
avformat/aacdec: resync to the next adts frame on invalid data instead of aborting

Should fix ticket #6634

Signed-off-by: James Almer <jamrial@gmail.com>
8 weeks agoavformat/aacdec: factorize the adts frame resync code
James Almer [Sat, 20 Jul 2019 13:13:08 +0000 (10:13 -0300)]
avformat/aacdec: factorize the adts frame resync code

Signed-off-by: James Almer <jamrial@gmail.com>
8 weeks agoavcodec/dvbsubdec: Use ff_set_dimensions()
Michael Niedermayer [Fri, 19 Jul 2019 22:07:59 +0000 (00:07 +0200)]
avcodec/dvbsubdec: Use ff_set_dimensions()

Fixes: signed integer overflow: 65313 * 65313 cannot be represented in type 'int'
Fixes: 15740/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVBSUB_fuzzer-5641749164195840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavcodec/ffwavesynth: Check if there is enough extradata before allocation
Michael Niedermayer [Sun, 14 Jul 2019 22:35:49 +0000 (00:35 +0200)]
avcodec/ffwavesynth: Check if there is enough extradata before allocation

Fixes: OOM
Fixes: 15750/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5702090367696896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavcodec/ffwavesynth: More correct cast in wavesynth_seek()
Michael Niedermayer [Sun, 14 Jul 2019 22:35:48 +0000 (00:35 +0200)]
avcodec/ffwavesynth: More correct cast in wavesynth_seek()

Fixes: signed integer overflow: 553590816 - -9223372036315799520 cannot be represented in type 'long'
Fixes: 15743/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5705835377852416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavcodec/ffwavesynth: Check sample rate before use
Michael Niedermayer [Sun, 14 Jul 2019 22:35:47 +0000 (00:35 +0200)]
avcodec/ffwavesynth: Check sample rate before use

Fixes: division by zero
Fixes: 15725/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5641231956180992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavcodec/tak_parser: don't return error values
James Almer [Wed, 17 Jul 2019 22:22:00 +0000 (19:22 -0300)]
avcodec/tak_parser: don't return error values

The API does not allow it.

Also set poutbuf and poutbuf_size to NULL/0 on error.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
8 weeks agoavcodec/cbs_h265: add support for Alpha Channel Info SEI messages
James Almer [Fri, 21 Jun 2019 01:21:26 +0000 (22:21 -0300)]
avcodec/cbs_h265: add support for Alpha Channel Info SEI messages

As defined in sections F.14.2.8 and F.14.3.8

Reviewed-by: Mark Thompson <sw@jkqxz.net>
Signed-off-by: James Almer <jamrial@gmail.com>
8 weeks agocbs_h2645: Fix infinite loop in more_rbsp_data
Andreas Rheinhardt [Wed, 5 Jun 2019 02:18:54 +0000 (04:18 +0200)]
cbs_h2645: Fix infinite loop in more_rbsp_data

cbs_h2645_read_more_rbsp_data does not handle malformed input very well:
1. If there were <= 8 bits left in the bitreader, these bits were read
via show_bits. But show_bits requires the number of bits to be read to
be > 0 (internally it shifts by 32 - number of bits to be read which is
undefined behaviour if said number is zero; there is also an assert for
this, but it is only an av_assert2). Furthermore, in this case a shift
by -1 was performed which is of course undefined behaviour, too.
2. If there were > 0 and <= 8 bits left and all of them were zero
(this can only happen for defective input), it was reported that there
was further RBSP data.

This can lead to an infinite loop in H.265's cbs_h265_read_extension_data
corresponding to the [vsp]ps_extension_data_flag syntax elements. If the
relevant flag indicates the (potential) occurence of these syntax elements,
while all bits after this flag are zero, cbs_h2645_read_more_rbsp_data
always returns 1 on x86. Given that a checked bitstream reader is used,
we are also not "saved" by an overflow in the bitstream reader's index.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agoavformat/mux: correct error msg for when BSF filtering fails
Gyan Doshi [Tue, 16 Jul 2019 12:36:42 +0000 (18:06 +0530)]
avformat/mux: correct error msg for when BSF filtering fails

8 weeks agoavcodec/flashsv: add FF_CODEC_CAP_INIT_CLEANUP to flashsv2
Michael Niedermayer [Sun, 7 Jul 2019 09:05:53 +0000 (11:05 +0200)]
avcodec/flashsv: add FF_CODEC_CAP_INIT_CLEANUP to flashsv2

Fixes: memleaks on error paths during init
Fixes: 15548/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLASHSV2_fuzzer-6324019382452224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavcodec/flashsv: add FF_CODEC_CAP_INIT_CLEANUP to flashsv1
Michael Niedermayer [Sun, 7 Jul 2019 09:05:53 +0000 (11:05 +0200)]
avcodec/flashsv: add FF_CODEC_CAP_INIT_CLEANUP to flashsv1

Fixes: memleaks on error paths during init
Fixes: 15533/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLASHSV_fuzzer-5647977168764928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavformat/utils: Check rfps_duration_sum for overflow
Michael Niedermayer [Thu, 4 Jul 2019 21:01:19 +0000 (23:01 +0200)]
avformat/utils: Check rfps_duration_sum for overflow

Fixes: signed integer overflow: 9151595917793558550 + 297519050751678697 cannot be represented in type 'long'
Fixes: 15496/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5722866475073536

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavcodec/agm: Fix overflow of signed shift
Michael Niedermayer [Sun, 30 Jun 2019 17:45:29 +0000 (19:45 +0200)]
avcodec/agm: Fix overflow of signed shift

Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 15328/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5637545171353600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavcodec/h264_refs: Also check reference in ff_h264_build_ref_list()
Michael Niedermayer [Sun, 30 Jun 2019 20:19:22 +0000 (22:19 +0200)]
avcodec/h264_refs: Also check reference in ff_h264_build_ref_list()

Fixes: out of array read
Fixes: 15409/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5758846959616000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavcodec/h264_cavlc: Fix integer overflows with motion vector residual addition
Michael Niedermayer [Wed, 26 Jun 2019 22:55:29 +0000 (00:55 +0200)]
avcodec/h264_cavlc: Fix integer overflows with motion vector residual addition

Fixes: signed integer overflow: 14 + 2147483647 cannot be represented in type 'int'
Fixes: 14794/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5677380695228416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavcodec/atrac9dec: Check conditions before apply_band_extension() to avoid out of...
Michael Niedermayer [Sat, 15 Jun 2019 19:34:18 +0000 (21:34 +0200)]
avcodec/atrac9dec: Check conditions before apply_band_extension() to avoid out of array read in initialization of unused variables

Fixes: global-buffer-overflow
Fixes: 15247/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5671602181636096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agotools/target_dem_fuzzer: ignore avformat_find_stream_info() failure
Michael Niedermayer [Thu, 13 Jun 2019 11:00:47 +0000 (13:00 +0200)]
tools/target_dem_fuzzer: ignore avformat_find_stream_info() failure

Such a failure should not be fatal and its worth testing this path too

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavutil/mips: refactor msa load and store macros.
Shiyou Yin [Wed, 17 Jul 2019 09:35:00 +0000 (17:35 +0800)]
avutil/mips: refactor msa load and store macros.

Replace STnxm_UB and LDnxm_SH with new macros ST_{H/W/D}{1/2/4/8}.
The old macros are difficult to use because they don't follow the same parameter passing rules.
Changing details as following:
1. remove LD4x4_SH.
2. replace ST2x4_UB with ST_H4.
3. replace ST4x2_UB with ST_W2.
4. replace ST4x4_UB with ST_W4.
5. replace ST4x8_UB with ST_W8.
6. replace ST6x4_UB with ST_W2 and ST_H2.
7. replace ST8x1_UB with ST_D1.
8. replace ST8x2_UB with ST_D2.
9. replace ST8x4_UB with ST_D4.
10. replace ST8x8_UB with ST_D8.
11. replace ST12x4_UB with ST_D4 and ST_W4.

Examples of new macro: ST_H4(in, idx0, idx1, idx2, idx3, pdst, stride)
ST_H4 store four half-word elements in vector 'in' to pdst with stride.
About the macro name:
1) 'ST' means store operation.
2) 'H/W/D' means type of vector element is 'half-word/word/double-word'.
3) Number '1/2/4/8' means how many elements will be stored.
About the macro parameter:
1) 'in0, in1...' 128-bits vector.
2) 'idx0, idx1...' elements index.
3) 'pdst' destination pointer to store to
4) 'stride' stride of each store operation.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavformat/ifv: Check for EOF in read_index()
Michael Niedermayer [Wed, 17 Jul 2019 23:00:11 +0000 (01:00 +0200)]
avformat/ifv: Check for EOF in read_index()

Fixes: Timeout
Fixes: 15567/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5758451487080448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agomatroskadec: Remove redundant const
Andreas Rheinhardt [Thu, 18 Jul 2019 19:07:20 +0000 (21:07 +0200)]
matroskadec: Remove redundant const

The typedef used to define EbmlSyntax already includes a const qualifier
so that it is unnecessary to include another const qualifier in future
definitions and declarations. Given that MSVC warns about this, this
commit removes these redundant const qualifiers.

Suggested-by: Hendrik Leppkes <h.leppkes@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agomatroskadec: Add sizes to forward declarations
Andreas Rheinhardt [Wed, 17 Jul 2019 03:29:40 +0000 (05:29 +0200)]
matroskadec: Add sizes to forward declarations

Unknown-length elements end when an element not allowed in them, but
allowed at a higher level is encountered. In order to check for this,
c1abd95a added a pointer to every syntax level's parent to each
EbmlSyntax. Given that the parent must of course also reference the
child in order to be able to enter said child level, one needs to use
forward declarations.
These forward declarations constitute tentative definitions and tentative
definitions with internal linkage (like our syntaxes) must not be an
incomplete type. Yet they were an incomplete type and while GCC and
Clang did not even warn about this (on default warning levels), it
broke compilation with MSVC. Therefore this commit adds the sizes.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agoavcodec/dnxhd_parser: Fix parser when input does not have nicely sized packets
Michael Niedermayer [Sat, 6 Jul 2019 09:51:09 +0000 (11:51 +0200)]
avcodec/dnxhd_parser: Fix parser when input does not have nicely sized packets

Fixes: out of array access
Fixes: 15522/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DNXHD_fuzzer-5747756078989312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavformat/rawdec: Make the raw packet size configurable
Michael Niedermayer [Sat, 6 Jul 2019 09:32:48 +0000 (11:32 +0200)]
avformat/rawdec: Make the raw packet size configurable

This allows testing parsers with a wider range of input packet sizes.
Which is important and usefull for regression testing, some of our
parsers in fact to not work if the packet size is changed from 1024

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavcodec/dnxhd_parser: Optimize insufficient buf size case
Michael Niedermayer [Sat, 6 Jul 2019 07:52:50 +0000 (09:52 +0200)]
avcodec/dnxhd_parser: Optimize insufficient buf size case

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavcodec/dnxhd_parser: remove unneeded code
Michael Niedermayer [Sat, 6 Jul 2019 07:51:46 +0000 (09:51 +0200)]
avcodec/dnxhd_parser: remove unneeded code

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavcodec/parser: Check next index validity in ff_combine_frame()
Michael Niedermayer [Sat, 6 Jul 2019 07:21:52 +0000 (09:21 +0200)]
avcodec/parser: Check next index validity in ff_combine_frame()

Fixes: out of array access
Fixes: 15522/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DNXHD_fuzzer-5747756078989312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavformat/takdec: Check for multiple streaminfo
Michael Niedermayer [Tue, 2 Jul 2019 19:11:57 +0000 (21:11 +0200)]
avformat/takdec: Check for multiple streaminfo

Fixes: memleak
Fixes: 15446/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5662875831500800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavformat/takdec: Free buffer on error pathes
Michael Niedermayer [Tue, 2 Jul 2019 18:35:30 +0000 (20:35 +0200)]
avformat/takdec: Free buffer on error pathes

Fixes: memleak
Fixes: 15446/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5662875831500800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavcodec/ivi: Ask for samples with odd tiles
Michael Niedermayer [Tue, 2 Jul 2019 17:57:08 +0000 (19:57 +0200)]
avcodec/ivi: Ask for samples with odd tiles

Fixes: Assertion failure
Fixes: 15422/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO5_fuzzer-5676625481433088

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 weeks agoavcodec: clarify the allocation requirements for intra_matrix and inter_matrix fields
James Almer [Mon, 15 Jul 2019 14:38:36 +0000 (11:38 -0300)]
avcodec: clarify the allocation requirements for intra_matrix and inter_matrix fields

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
8 weeks agoavformat/matroskadec: Improve check for level 1 duplicates
Andreas Rheinhardt [Thu, 16 May 2019 22:30:21 +0000 (00:30 +0200)]
avformat/matroskadec: Improve check for level 1 duplicates

If a file uses unknown-length level 1 elements besides clusters and such
elements are after the first cluster, then these elements will usually
be parsed twice: Once during parsing of the file header and once when
reading the file reaches the position where these elements are located.
The second time the element is parsed leads to a "Duplicate element"
error message. Known-length elements are not affected by this as they
are skipped except during parsing the header.

This commit fixes this by explicitly adding a check for whether the
position of the element to be parsed is the same as the position of the
already known level 1 element.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agoavformat/matroskadec: Use file offsets for level 1 elements
Andreas Rheinhardt [Thu, 16 May 2019 22:30:20 +0000 (00:30 +0200)]
avformat/matroskadec: Use file offsets for level 1 elements

This commit converts the MatroskaLevel1Element struct to use file-based
offsets, as opposed to the current practice of using offsets relative to
the beginning of the segment in it. This also includes a change from
uint64_t to int64_t.

This is in preparation to another patch that improves the check for
duplicate level 1 elements.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agoavformat/matroskadec: Reindent after previous commit
Andreas Rheinhardt [Thu, 16 May 2019 22:30:19 +0000 (00:30 +0200)]
avformat/matroskadec: Reindent after previous commit

Also use the smallest scope possible for a loop variable.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agoavformat/matroskadec: Accept more unknown-length elements II
Andreas Rheinhardt [Thu, 16 May 2019 22:30:18 +0000 (00:30 +0200)]
avformat/matroskadec: Accept more unknown-length elements II

Up until now, one last kind of unknown-length element hasn't been
properly handled: Unknown-length elements that are supposed to be
skipped, i.e. the level 1 elements that might reside after the
clusters.

This commit changes this. To do this, ebml_parse got a mode that
essentially tries to skip everything except when parsing is needed
(namely for unknown-length elements for which parsing is necessary
as they can't be skipped). This mode is selected by using a NULL
as destination where the parsed data should be written to.
It is used to parse the level 1 elements in matroska_parse_cluster.

The syntax list used for parsing must of course include links to
the syntax of all the master elements that might need to be parsed.
In other words: Instead of matroska_clusters (which contained every
level 1 element except clusters as EBML_NONE elements designated to
be skipped) matroska_segment is needed and used; matroska_clusters has
been removed.

Furthermore, matroska_segment has been reordered so that clusters are at
the front as this is now the most common case for this list.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agoavformat/matroskadec: Fix probing of unknown-length headers
Andreas Rheinhardt [Thu, 16 May 2019 22:30:17 +0000 (00:30 +0200)]
avformat/matroskadec: Fix probing of unknown-length headers

matroska_probe did not support the case of an unknown-length EBML header
at all; given that libavformat's Matroska muxer used to produce such
files in the streaming case, support for them has been added.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agoavformat/matroskadec: Accept more unknown-length elements
Andreas Rheinhardt [Thu, 16 May 2019 22:30:16 +0000 (00:30 +0200)]
avformat/matroskadec: Accept more unknown-length elements

The current Matroska specifications mandate that only two elements may
use an unknown-length length: Segments and clusters. But this was not
always so: For the greater part of Matroska's existence, all master
elements were allowed to make use of the unknown-length feature.

And there were muxers creating such files: For several years
libavformat's Matroska muxer used unknown-length for all master
elements when the output wasn't seekable. This only stopped in March
2010 with 2529bb30. And even afterwards it was possible (albeit
unlikely) for libavformat to create unknown-length master elements
that are in violation of today's specifications, namely if the master
element was so big that the seek backwards to update the size could
no longer be performed inside the AVIOContext's write buffer. This
has only been fixed in October 2016 (with the patches that introduced
support for writing CRC-32 elements).

Libavformat's Matroska demuxer meanwhile has never really supported
unknown-length elements besides segments and clusters. Support for the
latter was hardcoded. This commit changes this: Now all master elements
for which a syntax to parse them is available are supported. This
includes the files produced by old versions of libavformat's muxer.

More precisely, master elements that have unknown length and are about
to be parsed (not skipped) are supported; only a warning is emitted for
them. For normal files, this means that level 1 elements after the
clusters that are encountered after the clusters have been parsed (i.e.
not because they are referenced by the seekhead at the beginning of the
file) are still unsupported (they would be skipped at this point if
their length were known).

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agoavformat/matroskadec: Improve invalid length error handling
Andreas Rheinhardt [Thu, 16 May 2019 22:30:15 +0000 (00:30 +0200)]
avformat/matroskadec: Improve invalid length error handling

1. Up until now, the error message for EBML numbers whose length exceeds
the limits imposed upon them because of the element's type did not
distinguish between known-length and unknown-length elements. As a
consequence, the numerical value of the define constant
EBML_UNKNOWN_LENGTH was emitted as part of the error message which is
of course not appropriate. This commit changes this by adding error
messages designed for unknown-length elements.

2. We impose some (arbitrary) sanity checks on the lengths of certain
element types; these checks were conducted before the checks depending
on whether the element exceeds its containing master element. Now the
order has been reversed, because a failure at the (formerly) latter
check implies that the file is truly erroneous and not only fails our
arbitrary length limit. Moreover, this increases the informativeness of
the error messages.

3. Furthermore, the error message in general has been changed by replacing
the type of the element (something internal to this demuxer and
therefore suitable as debug output at best, not as an error message
intended for ordinary users) with the element ID. The element's position
has been added, too.

4. Finally, the length limit for EBML_NONE elements has been changed so
that all unknown-length elements of EBML_NONE-type trigger an error.
This is done because unknown-length elements can't be skipped and need
to be parsed, but there is no syntax to parse available for EBML_NONE
elements. This is done in preparation for a further patch which allows
more unknown-length elements than just clusters and segments.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agoavformat/matroskadec: Don't skip too much when unseekable
Andreas Rheinhardt [Thu, 16 May 2019 22:30:14 +0000 (00:30 +0200)]
avformat/matroskadec: Don't skip too much when unseekable

The Matroska (and WebM) file format achieves forward-compability by
insisting that demuxers ignore and skip elements they don't know about.
Unfortunately, this complicates the detection of errors as errors
resulting from loosing sync can't be reliably distinguished from
unknown elements that are part of a future version of the standard.

Up until now, the strategy to deal with this situation was to skip all
unknown elements that are not obviously erroneous; if an error happened,
it was tried to seek to the last known good position to resync from (and
resync to level 1 elements). This is working fine if the input is
seekable, but if it is not, then the skipped data can usually not be
rechecked lateron. This is particularly acute if unknown-length clusters
are in use, as the check for whether a child element exceeds the
containing master element is ineffective in this situation.

To remedy this, a new heuristic has been introduced: If an unknown
element is encountered in non-seekable mode, an error is presumed to
have happened based upon a combination of the length of the row of the
already encountered unknown elements and of how far away skipping this
element would take us.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agoavformat/matroskadec: Typos, nits and cosmetics
Andreas Rheinhardt [Thu, 16 May 2019 22:30:13 +0000 (00:30 +0200)]
avformat/matroskadec: Typos, nits and cosmetics

Cosmetics include reordering EbmlType so that EBML_SINT is adjacent to
the other numbers (and matches the order in the switch in ebml_parse)
and also reordering the switch for assignment of default values so that
it matches the order in EbmlType.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agoavformat/matroskadec: Reuse positions
Andreas Rheinhardt [Thu, 16 May 2019 22:30:12 +0000 (00:30 +0200)]
avformat/matroskadec: Reuse positions

Up until now, avio_tell was used multiple times in ebml_parse and its
subroutines, although the result of these calls can usually be simply
derived from the result of earlier calls to avio_tell. This has been
changed. Unnecessary calls to avio_tell in ebml_parse are avoided now.

Furthermore, there has been a slight change in the output of some error
messages relating to elements exceeding their containing master element:
The reported position of the element now points to the first byte of the
element ID and no longer to the first byte of the element's payload.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agoavformat/matroskadec: Redo EOF handling
Andreas Rheinhardt [Thu, 16 May 2019 22:30:11 +0000 (00:30 +0200)]
avformat/matroskadec: Redo EOF handling

This commit closes the last hole in the system of checks for a
known-length file ending too early: Now an error message is emitted
in case the file ends directly after an EBML element.

Furthermore, this commit adds a check and a corresponding warning
whether there is data beyond the Matroska segment (only reasonable for
known-length segments). If everything looks alright, then parsing is
stopped as soon as EOF is reached (in contrast, the earlier code would
always call matroska_resync at the end).

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agoavformat/matroskadec: Combine arrays
Andreas Rheinhardt [Thu, 16 May 2019 22:30:10 +0000 (00:30 +0200)]
avformat/matroskadec: Combine arrays

By including SimpleBlocks and BlockGroups twice in the same EbmlSyntax
array (with different semantics), one can reduce the duplication of the
other values.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agoavformat/matroskadec: Don't reset cluster position
Andreas Rheinhardt [Thu, 16 May 2019 22:30:09 +0000 (00:30 +0200)]
avformat/matroskadec: Don't reset cluster position

The new code does not rely on whether the cluster's position is set or
not to infer whether a cluster needs to be closed or not (instead, this
is done in ebml_parse), so there is no need to reset the cluster's
position at all any more. It will be automatically set to the correct
value when a cluster is entered.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agoavformat/matroskadec: Make cluster parsing level compatible
Andreas Rheinhardt [Thu, 16 May 2019 22:30:08 +0000 (00:30 +0200)]
avformat/matroskadec: Make cluster parsing level compatible

Before this commit, the parsing of clusters mixed EBML levels by
allowing elements from different levels in a EbmlSyntax (namely
matroska_cluster_parsing). This has been changed. And the level
is now explicitly used to determine how to parse.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agoavformat/matroskadec: Redo level handling
Andreas Rheinhardt [Sun, 23 Jun 2019 23:46:54 +0000 (01:46 +0200)]
avformat/matroskadec: Redo level handling

This commit changes how levels are handled: If the level used for
ebml_parse ends directly after an element that has been consumed, then
ebml_parse ends the level itself (and any known-length levels that end
there as well) and informs the caller via the return value; if the
current level is of unknown-length, then the level is ended as soon as
an element that is not valid on the current level, but on a higher
level is encountered (or if EOF has been encountered).

This is designed for situations where one wants to parse master elements
incrementally, i.e. not in one go via ebml_parse_nest.

The (incremental) parsing of clusters still mixes levels by using a
syntax list that contains elements from different levels and the level
is still ended manually via a call to ebml_level_end if the last cluster
was an unknown-length cluster (known-length clusters are already ended
when their last element is read), but only if the next element is a
cluster, too. A  different level 1 element following an unknown-length
cluster will currently simply be presumed to be part of the earlier
cluster. Fixing this will be done in a future patch. The modifications
to matroska_parse_cluster contained in this patch are only intended not
to cause regressions.

Nevertheless, the fact that known-length levels are automatically ended
in ebml_parse when their last element has been read already fixes a bogus
error message introduced in 9326117b that was emitted when a known-length
cluster is followed by another level 1 element other than a cluster in
which case the cluster's level was not ended (which only happened when
a new cluster has been encountered) so that the length check (introduced
in 9326117b) failed for the level 1 element as it is of course not
contained in the previous cluster. Most Matroska files were affected by
this.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agoavformat/matroskadec: Link to parents in syntax tables
Andreas Rheinhardt [Thu, 16 May 2019 22:30:06 +0000 (00:30 +0200)]
avformat/matroskadec: Link to parents in syntax tables

By linking to the syntax of the parent (i.e. the containing master
element) one can check whether an element is actually part of a higher
level in the EBML hierarchy. Knowing this is important for
unknown-length levels, because they end when an element that doesn't
belong to this, but to a higher hierarchy level is encountered.

Sometimes there are different syntaxes dealing with the same elements.
In this case it is important to use a parent that contains all the
elements at the parent level; whether this is the syntax actually used
to enter the child's level is irrelevant. This affects the list of level
1 elements (which has been used as parent for matroska_cluster, too) and
it affects recursive elements (currently only the SimpleTag), where the
non-recursive parent has to be choosen.

This is in preparation for a patch that redoes level handling.

Finally, the segment id has been added to ebml_syntax. This will enable
handling of unknown-length EBML headers.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agoavformat/matroskadec: Introduce a "last known good" position
Andreas Rheinhardt [Thu, 16 May 2019 22:30:05 +0000 (00:30 +0200)]
avformat/matroskadec: Introduce a "last known good" position

Currently, resyncing during reading packets works as follows:
The current position is recorded, then a call to matroska_parse_cluster
is made and if said call fails, the demuxer tries to resync from the
earlier position. If the call doesn't fail, but also doesn't deliver a
packet, then this is looped.

There are two problems with this approach:
1. The Matroska file format aims to be forward-compatible; to achieve
this, a demuxer should simply ignore and skip elements it doesn't
know about. But it is not possible to reliably distinguish unknown
elements from junk. If matroska_parse_cluster encounters an unknown
element, it can therefore not simply error out; instead it returns zero
and the loop is iterated which includes an update of the position that
is intended to be used in case of errors, i.e. the element that is
skipped is not searched for level 1 element ids to resync to at all if
later calls to matroska_parse_cluster return an error.
Notice that in case that sync has been lost there can be a chain of
several unknown/possibly junk elements before an error is detected.

2. Even if a call to matroska_parse_cluster delivers a packet, this does
not mean that everything is fine. E.g. it might be that some of the
block's data is missing and that the data that was presumed to be from
the block just read actually contains the beginning of the next element.
This will only be apparent at the next call of matroska_read_packet,
which uses the (false) end of the earlier block as resync position so
that in the (not unlikely) case that the call to matroska_parse_cluster
fails, the data believed to be part of the earlier block is not searched
for a level 1 element to resync to.

To counter this, a "last known good" position is introduced. When an
element id that is known to be allowed at this position in the hierarchy
(according to the syntax currently in use for parsing) is read and some
further checks (regarding the length of the element and its containing
master element) are passed, then the beginning of the current element is
treated as a "good" position and recorded as such in the
MatroskaDemuxContext. Because of 2., only the start of the element is
treated as a "good" position, not the whole element. If an error occurs
later during parsing of clusters, the resync process starts at the last
known good position.

Given that when the header is damaged the subsequent resync never skips over
data and is therefore unaffected by both issues, the "last known good"
concept is not used there.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agoavformat/matroskadec: Refactor some functions
Andreas Rheinhardt [Thu, 16 May 2019 22:30:04 +0000 (00:30 +0200)]
avformat/matroskadec: Refactor some functions

Since the changes to the parsing of SimpleBlocks, both ebml_parse_id and
ebml_parse_elem are only called from one place, so that it is possible
to inline these two function calls. This is done, but not completely:
ebml_parse_id still exists in a modified form. This is done in
preparation for a further patch regarding the handling of
unknown-length elements.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agoavformat/matroskadec: Use proper levels after discontínuity
Andreas Rheinhardt [Thu, 16 May 2019 22:30:03 +0000 (00:30 +0200)]
avformat/matroskadec: Use proper levels after discontínuity

The earlier code set the level to zero upon seeking and after a
discontinuity although in both cases parsing (re)starts at a level 1
element.

Also set the segment's length to unkown if an error occured in order not
to drop any valid data that happens to be beyond the designated end of
the segment.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agoavformat/matroskadec: Add function to reset status
Andreas Rheinhardt [Thu, 16 May 2019 22:30:02 +0000 (00:30 +0200)]
avformat/matroskadec: Add function to reset status

This function will be useful later to reset the status (e.g. current
level and the already parsed id).

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
8 weeks agoavformat/matroskadec: Don't abort resyncing upon seek failure
Andreas Rheinhardt [Thu, 16 May 2019 22:30:01 +0000 (00:30 +0200)]
avformat/matroskadec: Don't abort resyncing upon seek failure

When an error happens, the Matroska demuxer tries to resync to level 1
elements from an earlier position onwards. If the seek to said earlier
position fails, the demuxer currently treats this as an unrecoverable
error. And that behaviour is suboptimal as said failure is nothing
unrecoverable or unexpected (when the input isn't seekable).
It is preferable to simply resync from the earliest position available
(i.e. the start of the AVIOContext's buffer) onwards if the seek failed.

Here are some scenarios that might be treated as unrecoverable errors
by the current code if the input isn't seekable. They all have in
common that the current position is so far away from the desired
position that the seek can't be fulfilled from the AVIOContext's buffer:

1. Blocks (both SimpleBlocks as well as a Block in a BlockGroup) for
which reading them as binary EBML elements succeeds, but whose parsing
triggers an error (e.g. an invalid TrackNumber). In this case the
earlier position from which resyncing begins is at the start of the block
(or even earlier).
2. BlockGroups, whose parsing fails in one of the latter elements. Just
as in 1., the start of the BlockGroup (the target of the seek) might be
so far away from the current position that it is no longer in the
buffer.
3. At the beginning of parsing a cluster, the cluster is parsed until a
SimpleBlock or a BlockGroup is encountered. So if the input is damaged
between the beginning of the cluster and the first occurrence of a
SimpleBlock/BlockGroup and if said damage makes the demuxer read/skip so
much data that the beginning of the cluster is no longer in the buffer,
demuxing will currently fail completely.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2 months agoavcodec: remove reference to AVPacket's destruct field
James Almer [Mon, 15 Jul 2019 14:18:23 +0000 (11:18 -0300)]
avcodec: remove reference to AVPacket's destruct field

The field was removed years ago.

Signed-off-by: James Almer <jamrial@gmail.com>
2 months agofate: add hls fmp4 segment type test case
Steven Liu [Sat, 13 Jul 2019 22:39:30 +0000 (06:39 +0800)]
fate: add hls fmp4 segment type test case

Tested-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
2 months agoavformat/hlsenc: use old way for fragment mp4 in HLS PUT method
Steven Liu [Sat, 13 Jul 2019 11:41:07 +0000 (19:41 +0800)]
avformat/hlsenc: use old way for fragment mp4 in HLS PUT method

fix ticket: 8015

Reported-by: Jun Zhao
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
2 months agodoc/codecs: Add missing documentation for nointra
Jun Zhao [Sun, 14 Jul 2019 07:02:11 +0000 (15:02 +0800)]
doc/codecs: Add missing documentation for nointra

Add missing documentation for nointra.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
2 months agoavformat/xmv: Make bitrate 64bit
Michael Niedermayer [Sat, 13 Jul 2019 18:12:41 +0000 (20:12 +0200)]
avformat/xmv: Make bitrate 64bit

Fixes: signed integer overflow: 32 * 538976288 cannot be represented in type 'int'
Fixes: 15633/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5752273981931520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 months agoavformat/vividas: Fixes overflow in shift in recover_key()
Michael Niedermayer [Fri, 28 Jun 2019 19:03:59 +0000 (21:03 +0200)]
avformat/vividas: Fixes overflow in shift in recover_key()

Fixes: left shift of 133 by 24 places cannot be represented in type 'int'
Fixes: 15365/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5716153105645568

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Reviewed-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 months agoavcodec/iff: Add "else" to make code look prettier
Michael Niedermayer [Sat, 13 Jul 2019 17:43:13 +0000 (19:43 +0200)]
avcodec/iff: Add "else" to make code look prettier

Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 months agodump_extra: Don't add extradata if it already exists
Andreas Rheinhardt [Sat, 13 Jul 2019 02:55:50 +0000 (04:55 +0200)]
dump_extra: Don't add extradata if it already exists

The dump_extra bitstream filter currently simply adds the extradata to
the packets indicated by the user without checking whether said
extradata already exists in the packets. Besides wasting space
duplicated extradata in the same packet/access unit is also forbidden
for some codecs, e.g. MPEG-2.

This check has been added to be able to use the mpeg2_qsv encoder (which
only adds the sequence headers to the first packet) in broadcast
scenarios where repeating sequence headers are required.

The check used here is not perfect: E.g. dump_extra would add the
extradata to a H.264 access unit consisting of an access unit delimiter,
SPS, PPS and slices.

Fixes #8007.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 months agoavfilter/vf_hysteresis: use time_base from framesync
Paul B Mahol [Sun, 14 Jul 2019 17:14:10 +0000 (19:14 +0200)]
avfilter/vf_hysteresis: use time_base from framesync

Fixes non-monotonous timestamps.

2 months agodoc/filters: document new remap filter option
Paul B Mahol [Sun, 14 Jul 2019 16:29:23 +0000 (18:29 +0200)]
doc/filters: document new remap filter option

2 months agoavfilter/vf_remap: add option to control output format
Paul B Mahol [Sun, 14 Jul 2019 16:18:29 +0000 (18:18 +0200)]
avfilter/vf_remap: add option to control output format

2 months agoavfilter/vf_remap: use time_base from framesync
Paul B Mahol [Sun, 14 Jul 2019 15:53:35 +0000 (17:53 +0200)]
avfilter/vf_remap: use time_base from framesync

Fixes non-monotonous timestamps.

2 months agoavfilter/vf_displace: use time_base from framesync
Paul B Mahol [Sun, 14 Jul 2019 15:50:37 +0000 (17:50 +0200)]
avfilter/vf_displace: use time_base from framesync

Fixes non-monotonous timestamps.

2 months agoavcodec/h264_slice: set the SEI parameters early on the AVCodecContext
Steve Lhomme [Wed, 29 May 2019 13:16:14 +0000 (15:16 +0200)]
avcodec/h264_slice: set the SEI parameters early on the AVCodecContext

It's better to do it before the buffers are actually created. At least in VLC
we currently don't support changing some parameters dynamically easily so we
don't use the information if it comes after the buffer are created.

Co-authored-by: James Almer <jamrial@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
2 months agoavcodec/hevcdec: set the SEI parameters early on the AVCodecContext
Steve Lhomme [Mon, 27 May 2019 14:06:47 +0000 (16:06 +0200)]
avcodec/hevcdec: set the SEI parameters early on the AVCodecContext

It's better to do it before the buffers are actually created. At least in VLC
we currently don't support changing some parameters dynamically easily so we
don't use the information if it comes after the buffer are created.

Co-authored-by: James Almer <jamrial@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
2 months agoavfilter/vf_midequalizer: always use framesync timestamps
Paul B Mahol [Sun, 14 Jul 2019 15:45:42 +0000 (17:45 +0200)]
avfilter/vf_midequalizer: always use framesync timestamps

2 months agoavfilter/vf_maskedmerge: always use framesync timestamps
Paul B Mahol [Sun, 14 Jul 2019 15:38:26 +0000 (17:38 +0200)]
avfilter/vf_maskedmerge: always use framesync timestamps

2 months agoavfilter/vf_threshold: use time_base from framesync
Paul B Mahol [Sun, 14 Jul 2019 15:28:04 +0000 (17:28 +0200)]
avfilter/vf_threshold: use time_base from framesync

Fixes non-monotonous timestamps.

2 months agoavfilter/vf_blend: add 9bit support
Paul B Mahol [Sun, 14 Jul 2019 15:00:58 +0000 (17:00 +0200)]
avfilter/vf_blend: add 9bit support

2 months agoavcodec/dvbsub: add support for Display Definition Segment to DVB Subtitle encoder
Jernej Fijacko [Sat, 13 Jul 2019 17:33:16 +0000 (19:33 +0200)]
avcodec/dvbsub: add support for Display Definition Segment to DVB Subtitle encoder

Current version of dvbsub encoder doesn't support HD DVB subtitles. The high
resolution bitmaps are muxed into the stream but without the DDS (display definition
segment) the players asume that the DVB subtitles are in SD (720x576) resolution
which causes them to either render the subtitles too large and misplaced or don't
render them at all. By including the DDS as defined in section 7.7.1 of ETSI EN 300
743 (V1.3.1) this problem is fixed.

7.2.1 Display definition segment The display definition for a subtitle service may
be defined by the display definition segment if present in the stream. Absence of a
DDS implies that the stream is coded in accordance with EN 300 743 (V1.2.1) [5] and
that a display width of 720 pixels and a display height of 576 lines may be assumed.

https://www.etsi.org/deliver/etsi_en/300700_300799/300743/01.03.01_60/en_300743v010301p.pdf

Signed-off-by: Jernej Fijacko <mikrohard@gmail.com>
Signed-off-by: Marton Balint <cus@passwd.hu>
2 months agoavformat: Don't suggest deprecated function
Andreas Rheinhardt [Sat, 13 Jul 2019 16:48:48 +0000 (18:48 +0200)]
avformat: Don't suggest deprecated function

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
2 months agoavfilter/af_aiir: calculate group delay too
Paul B Mahol [Sat, 13 Jul 2019 13:43:17 +0000 (15:43 +0200)]
avfilter/af_aiir: calculate group delay too

2 months agoavcodec/pngdec: Check that previous_picture has same w/h/format
Michael Niedermayer [Wed, 10 Jul 2019 21:02:36 +0000 (23:02 +0200)]
avcodec/pngdec: Check that previous_picture has same w/h/format

Fixes: out of array access
Fixes: 15540/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-5684905029140480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 months agoavcodec/huffyuvdec: Check vertical subsampling in hymt
Michael Niedermayer [Wed, 3 Jul 2019 22:16:49 +0000 (00:16 +0200)]
avcodec/huffyuvdec: Check vertical subsampling in hymt

Fixes: out of array access
Fixes: 15484/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-5765377054736384
Fixes: 15559/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-5710295743332352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 months agoavcodec/huffyuv: remove gray8a (the format is listed but not supported by the impleme...
Michael Niedermayer [Wed, 3 Jul 2019 21:25:07 +0000 (23:25 +0200)]
avcodec/huffyuv: remove gray8a (the format is listed but not supported by the implementation)

Fixes: null pointer dereference
Fixes: 15464/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-5681391150301184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 months agotools/target_dec_fuzzer: Remove redundant av_free()
Michael Niedermayer [Thu, 11 Jul 2019 20:31:57 +0000 (22:31 +0200)]
tools/target_dec_fuzzer: Remove redundant av_free()

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 months agoavcodec/mpc8: Fixes invalid shift in mpc8_decode_frame()
Michael Niedermayer [Thu, 11 Jul 2019 18:02:24 +0000 (20:02 +0200)]
avcodec/mpc8: Fixes invalid shift in mpc8_decode_frame()

Fixes: left shift of negative value -456
Fixes: 15561/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC8_fuzzer-5758130404720640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 months agoavfilter/af_aiir: do not ignore k option for audio filtering
Paul B Mahol [Sat, 13 Jul 2019 10:25:54 +0000 (12:25 +0200)]
avfilter/af_aiir: do not ignore k option for audio filtering

Previously it was used only for displaying frequency response.

2 months agoavformat/mpegts: respect program number when merging streams
Marton Balint [Tue, 9 Jul 2019 20:32:06 +0000 (22:32 +0200)]
avformat/mpegts: respect program number when merging streams

merge_pmt_versions was not usable if multiple programs were present because
when it was searching for candidate streams it did not make sure that the PMT was
of the same program. This caused the streams of all programs to get merged into
a single (garbled) program.

This patch makes sure that the program number (service ID) is also matching
with the old streams when parsing the PMT making the feature useful for multi
program streams.

This change might cause issues for single program streams if the program number
changes, but I think it is acceptable because the goal of the option is to make
the parsing resilient to PID changes, and that is still working as expected.

Signed-off-by: Marton Balint <cus@passwd.hu>
2 months agoavformat/movenc: use unspecified language by default
Marton Balint [Sun, 19 May 2019 17:58:40 +0000 (19:58 +0200)]
avformat/movenc: use unspecified language by default

English was used before.

Signed-off-by: Marton Balint <cus@passwd.hu>
2 months agolavf/webm_chunk: Correct duration if start time > 0
Andreas Rheinhardt [Fri, 19 Apr 2019 22:03:16 +0000 (00:03 +0200)]
lavf/webm_chunk: Correct duration if start time > 0

Up until now, it was simply presumed that the first packet had a pts of
zero; otherwise the duration of the first chunk was wrong.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2 months agolavf/webm_chunk: Fix NULL dereference
Andreas Rheinhardt [Fri, 19 Apr 2019 22:03:15 +0000 (00:03 +0200)]
lavf/webm_chunk: Fix NULL dereference

The earlier version of the webm_chunk muxer had several bugs:

1. If the first packet of an audio stream didn't have a PTS of zero,
then no chunk will be started before a packet is delivered to the
underlying Matroska/WebM muxer, i.e. the AVFormatContext used to write
these packets had a NULL as AVIOContext for output. This is behind the
crash in ticket #5752.

2. If an error happens during writing a packet, the underlyimg
Matroska/WebM muxer context is freed. This leads to a use-after-free
coupled with a double-free in webm_chunk_write_trailer (which supposes
that the underlying AVFormatContext is still valid).

3. Even when no error occurs at all, webm_chunk_write_trailer is still
buggy: After the underlying Matroska/WebM muxer has written its trailer,
ending the chunk implicitly flushes it again which is illegal at this
point.

These bugs have been fixed.

Fixes #5752.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>