November 2014 - ffmpeg-cvslog

avcodec/hevc_ps: Check return code from pps_range_extensions()
by git＠videolan.org 30 Nov '14

30 Nov '14

ffmpeg | branch: release/2.4 | Michael Niedermayer <michaelni(a)gmx.at> | Thu Nov 27 02:31:46 2014 +0100| [2ba17ac96c72273f0848cbaf6d73697a68f25277] | committer: Michael Niedermayer avcodec/hevc_ps: Check return code from pps_range_extensions() Fixes out of array read Fixes: asan_heap-oob_177e222_885_cov_1532528832_MERGE_D_TI_3.bit Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> (cherry picked from commit 9f9440bd8122cc8798139c9370db0873a24ae14b) Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2ba17ac96c72273f0… --- libavcodec/hevc_ps.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c index 4e1c561..0d6ede2 100644 --- a/libavcodec/hevc_ps.c +++ b/libavcodec/hevc_ps.c @@ -1375,7 +1375,8 @@ int ff_hevc_decode_nal_pps(HEVCContext *s) int pps_range_extensions_flag = get_bits1(gb); /* int pps_extension_7bits = */ get_bits(gb, 7); if (sps->ptl.general_ptl.profile_idc == FF_PROFILE_HEVC_REXT && pps_range_extensions_flag) { - pps_range_extensions(s, pps, sps); + if ((ret = pps_range_extensions(s, pps, sps)) < 0) + goto err; } }

1 0

avcodec/pngdec: Check IHDR/IDAT order
by git＠videolan.org 30 Nov '14

30 Nov '14

ffmpeg | branch: release/2.4 | Michael Niedermayer <michaelni(a)gmx.at> | Wed Nov 26 15:45:47 2014 +0100| [f2595a6c38eeed80cd228c5db142873c95f6b4d3] | committer: Michael Niedermayer avcodec/pngdec: Check IHDR/IDAT order Fixes out of array access Fixes: asan_heap-oob_20a6c26_2690_cov_3434532168_mail.png Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> (cherry picked from commit 79ceaf827be0b070675d4cd0a55c3386542defd8) Conflicts: libavcodec/pngdec.c > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f2595a6c38eeed80c… --- libavcodec/pngdec.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c index 835d962..fa7b713 100644 --- a/libavcodec/pngdec.c +++ b/libavcodec/pngdec.c @@ -582,6 +582,12 @@ static int decode_frame(AVCodecContext *avctx, case MKTAG('I', 'H', 'D', 'R'): if (length != 13) goto fail; + + if (s->state & PNG_IDAT) { + av_log(avctx, AV_LOG_ERROR, "IHDR after IDAT\n"); + goto fail; + } + s->width = bytestream2_get_be32(&s->gb); s->height = bytestream2_get_be32(&s->gb); if (av_image_check_size(s->width, s->height, 0, avctx)) {

1 0

avcodec/rawdec: Check the return code of avpicture_get_size()
by git＠videolan.org 30 Nov '14

30 Nov '14

ffmpeg | branch: release/2.4 | Michael Niedermayer <michaelni(a)gmx.at> | Wed Nov 26 18:56:39 2014 +0100| [12e064d6c2ae66bd501872ab4fc2033588419f85] | committer: Michael Niedermayer avcodec/rawdec: Check the return code of avpicture_get_size() Fixes out of array access Fixes: asan_heap-oob_22388d0_3435_cov_3297128910_small_roll5_FlashCine1.cine Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> (cherry picked from commit 1d3a3b9f8907625b361420d48fe05716859620ff) Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=12e064d6c2ae66bd5… --- libavcodec/rawdec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/rawdec.c b/libavcodec/rawdec.c index 28792a1..647dfa9 100644 --- a/libavcodec/rawdec.c +++ b/libavcodec/rawdec.c @@ -172,6 +172,9 @@ static int raw_decode(AVCodecContext *avctx, void *data, int *got_frame, context->frame_size = avpicture_get_size(avctx->pix_fmt, avctx->width, avctx->height); } + if (context->frame_size < 0) + return context->frame_size; + need_copy = !avpkt->buf || context->is_2_4_bpp || context->is_yuv2 || context->is_lt_16bpp; frame->pict_type = AV_PICTURE_TYPE_I;

1 0

avcodec/utils: Check that the data is complete in avpriv_bprint_to_extradata()
by git＠videolan.org 30 Nov '14

30 Nov '14

ffmpeg | branch: release/2.4 | Michael Niedermayer <michaelni(a)gmx.at> | Tue Nov 25 14:45:30 2014 +0100| [991a2034796b18012f65b53e6bb8ce521c881a36] | committer: Michael Niedermayer avcodec/utils: Check that the data is complete in avpriv_bprint_to_extradata() Fixes out of array read Fixes: asan_heap-oob_4d2250_814_cov_2745172097_JACOsub_capability_tester.jss Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> (cherry picked from commit 3d5d95db3f5d8e2093e9e19d0c46e86f54ed2a5d) Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=991a2034796b18012… --- libavcodec/utils.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/utils.c b/libavcodec/utils.c index ca6fe2d..4e95ab0 100644 --- a/libavcodec/utils.c +++ b/libavcodec/utils.c @@ -3610,6 +3610,11 @@ int avpriv_bprint_to_extradata(AVCodecContext *avctx, struct AVBPrint *buf) ret = av_bprint_finalize(buf, &str); if (ret < 0) return ret; + if (!av_bprint_is_complete(buf)) { + av_free(str); + return AVERROR(ENOMEM); + } + avctx->extradata = str; /* Note: the string is NUL terminated (so extradata can be read as a * string), but the ending character is not accounted in the size (in

1 0

avcodec/flacdec: Call ff_flacdsp_init() unconditionally
by git＠videolan.org 30 Nov '14

30 Nov '14

ffmpeg | branch: release/2.4 | Michael Niedermayer <michaelni(a)gmx.at> | Wed Nov 26 03:29:03 2014 +0100| [a654f483cd64aa739da5dfaa1b4ca0acb9f478f7] | committer: Michael Niedermayer avcodec/flacdec: Call ff_flacdsp_init() unconditionally Fixes out of array access Fixes: signal_sigsegv_324b135_3398_cov_246853371_short.flac Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> (cherry picked from commit e5c01ccdf5a9a330d4c51a9b9ea721fd8f1fb70b) Conflicts: libavcodec/flacdec.c > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a654f483cd64aa739… --- libavcodec/flacdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/flacdec.c b/libavcodec/flacdec.c index c9dbc14..a48b177 100644 --- a/libavcodec/flacdec.c +++ b/libavcodec/flacdec.c @@ -473,10 +473,10 @@ static int decode_frame(FLACContext *s) ret = allocate_buffers(s); if (ret < 0) return ret; - ff_flacdsp_init(&s->dsp, s->avctx->sample_fmt, s->bps); s->got_streaminfo = 1; dump_headers(s->avctx, (FLACStreaminfo *)s); } + ff_flacdsp_init(&s->dsp, s->avctx->sample_fmt, s->bps); // dump_headers(s->avctx, (FLACStreaminfo *)s);

1 0

avcodec/mjpegdec: Fix context fields becoming inconsistent
by git＠videolan.org 30 Nov '14

30 Nov '14

ffmpeg | branch: release/2.4 | Michael Niedermayer <michaelni(a)gmx.at> | Tue Nov 25 13:53:06 2014 +0100| [8524009161b0430ba961a4e6fcd8125a695edd7c] | committer: Michael Niedermayer avcodec/mjpegdec: Fix context fields becoming inconsistent Fixes out of array access Fixes: asan_heap-oob_1ca4f85_2760_cov_144449187_miss_congeniality_pegasus_ljpg.avi Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> (cherry picked from commit 0eecf40935b22644e6cd74c586057237ecfd6844) Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8524009161b0430ba… --- libavcodec/mjpegdec.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index 2cf55fd..5fdf9be 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -1596,6 +1596,8 @@ static int mjpeg_decode_app(MJpegDecodeContext *s) } if (id == AV_RB32("LJIF")) { + int rgb = s->rgb; + int pegasus_rct = s->pegasus_rct; if (s->avctx->debug & FF_DEBUG_PICT_INFO) av_log(s->avctx, AV_LOG_INFO, "Pegasus lossless jpeg header found\n"); @@ -1605,17 +1607,27 @@ static int mjpeg_decode_app(MJpegDecodeContext *s) skip_bits(&s->gb, 16); /* unknown always 0? */ switch (i=get_bits(&s->gb, 8)) { case 1: - s->rgb = 1; - s->pegasus_rct = 0; + rgb = 1; + pegasus_rct = 0; break; case 2: - s->rgb = 1; - s->pegasus_rct = 1; + rgb = 1; + pegasus_rct = 1; break; default: av_log(s->avctx, AV_LOG_ERROR, "unknown colorspace %d\n", i); } + len -= 9; + if (s->got_picture) + if (rgb != s->rgb || pegasus_rct != s->pegasus_rct) { + av_log(s->avctx, AV_LOG_WARNING, "Mismatching LJIF tag\n"); + goto out; + } + + s->rgb = rgb; + s->pegasus_rct = pegasus_rct; + goto out; } if (id == AV_RL32("colr") && len > 0) {

1 0

avcodec/mjpegdec: Check for pixfmtid 0x42111100 || 0x24111100 with more than 8 bits
by git＠videolan.org 30 Nov '14

30 Nov '14

ffmpeg | branch: release/2.4 | Michael Niedermayer <michaelni(a)gmx.at> | Tue Nov 25 01:14:38 2014 +0100| [47f345de1dd25178f82f3da68fc584050d3f0ad2] | committer: Michael Niedermayer avcodec/mjpegdec: Check for pixfmtid 0x42111100 || 0x24111100 with more than 8 bits These cases are not supported yet Fixes assertion failure Fixes: signal_sigabrt_7ffff6ac7bb9_1_cov_1553101927_00.jpg Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> (cherry picked from commit 0bf416f2628137e5389050fa323c329692dd4ba6) Conflicts: libavcodec/mjpegdec.c > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=47f345de1dd25178f… --- libavcodec/mjpegdec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index 8966672..2cf55fd 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -514,6 +514,8 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s) else s->avctx->pix_fmt = AV_PIX_FMT_YUV420P16; s->avctx->color_range = s->cs_itu601 ? AVCOL_RANGE_MPEG : AVCOL_RANGE_JPEG; if (pix_fmt_id == 0x42111100) { + if (s->bits > 8) + goto unk_pixfmt; s->upscale_h = 6; s->chroma_height = (s->height + 1) / 2; }

1 0

swscale/x86/rgb2rgb_template: handle the first 2 lines with C in rgb24toyv12_*()
by git＠videolan.org 30 Nov '14

30 Nov '14

ffmpeg | branch: release/2.4 | Michael Niedermayer <michaelni(a)gmx.at> | Thu Nov 20 00:43:45 2014 +0100| [af0a95ee033b61113a7059ac66e2f5776c90330c] | committer: Michael Niedermayer swscale/x86/rgb2rgb_template: handle the first 2 lines with C in rgb24toyv12_*() This avoids out of array accesses Should fix Ticket3451 Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> (cherry picked from commit 4388e78a0f022c8572996f9ab568a39b5f716f9d) Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=af0a95ee033b61113… --- libswscale/x86/rgb2rgb_template.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/libswscale/x86/rgb2rgb_template.c b/libswscale/x86/rgb2rgb_template.c index 3899d0a..7796d38 100644 --- a/libswscale/x86/rgb2rgb_template.c +++ b/libswscale/x86/rgb2rgb_template.c @@ -1634,6 +1634,16 @@ static inline void RENAME(rgb24toyv12)(const uint8_t *src, uint8_t *ydst, uint8_ #define BGR2V_IDX "16*4+16*34" int y; const x86_reg chromWidth= width>>1; + + if (height > 2) { + ff_rgb24toyv12_c(src, ydst, udst, vdst, width, 2, lumStride, chromStride, srcStride, rgb2yuv); + src += 2*srcStride; + ydst += 2*lumStride; + udst += chromStride; + vdst += chromStride; + height -= 2; + } + for (y=0; y<height-2; y+=2) { int i; for (i=0; i<2; i++) {

1 0

doc/APIchanges: Fix some wrong versions
by git＠videolan.org 30 Nov '14

30 Nov '14

ffmpeg | branch: release/2.4 | Michael Niedermayer <michaelni(a)gmx.at> | Tue Nov 18 11:52:17 2014 +0100| [2abc6e930ba13af44a846438d63c9d06c0e285dd] | committer: Michael Niedermayer doc/APIchanges: Fix some wrong versions Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> (cherry picked from commit 4eae568a0712b8b59cb74b3882963f938c26eab4) Conflicts: doc/APIchanges > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2abc6e930ba13af44… --- doc/APIchanges | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/APIchanges b/doc/APIchanges index 8a28029..7dd1101 100644 --- a/doc/APIchanges +++ b/doc/APIchanges @@ -214,10 +214,10 @@ API changes, most recent first: 2014-05-11 - 14aef38 / 66e6c8a - lavu 52.83.100 / 53.14.0 - pixfmt.h Add AV_PIX_FMT_VDA for new-style VDA acceleration. -2014-05-xx - xxxxxxx - lavu 52.82.0 - fifo.h +2014-05-xx - xxxxxxx - lavu 52.82.100 - fifo.h Add av_fifo_freep() function. -2014-05-02 - ba52fb11 - lavu 52.81.0 - opt.h +2014-05-02 - ba52fb11 - lavu 52.81.100 - opt.h Add av_opt_set_dict2() function. 2014-05-01 - e77b985 / a2941c8 - lavc 55.60.103 / 55.50.3 - avcodec.h

1 0

avformat/hlsenc: Free context after hls_append_segment
by git＠videolan.org 30 Nov '14

30 Nov '14

ffmpeg | branch: release/2.4 | Michael Niedermayer <michaelni(a)gmx.at> | Sun Nov 16 04:02:56 2014 +0100| [3bb48296ef0f54fad7d73c93a36e676ba391b037] | committer: Michael Niedermayer avformat/hlsenc: Free context after hls_append_segment Fixes reading uninitialized memory Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> (cherry picked from commit 530eb6acf8ee867bf00728bf7efaf505da107e17) Conflicts: libavformat/hlsenc.c > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3bb48296ef0f54fad… --- libavformat/hlsenc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavformat/hlsenc.c b/libavformat/hlsenc.c index cc142fa..3fceb08 100644 --- a/libavformat/hlsenc.c +++ b/libavformat/hlsenc.c @@ -329,9 +329,10 @@ static int hls_write_trailer(struct AVFormatContext *s) av_write_trailer(oc); avio_closep(&oc->pb); - avformat_free_context(oc); av_free(hls->basename); hls_append_segment(hls, hls->duration); + avformat_free_context(oc); + hls->avf = NULL; hls_window(s, 1); hls_free_segments(hls);

1 0