May 2015 - ffmpeg-cvslog - lists.ffmpeg.org

mpegvideo: wmv2: Move function declarations
by git＠videolan.org 31 May '15

31 May '15

ffmpeg | branch: master | Vittorio Giovara <vittorio.giovara(a)gmail.com> | Fri May 29 19:44:01 2015 +0100| [2f15846ad7ad57beb0bca99c624affa0facf284b] | committer: Vittorio Giovara mpegvideo: wmv2: Move function declarations > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2f15846ad7ad57beb… --- libavcodec/h263dec.c | 1 + libavcodec/mpegvideo.c | 1 + libavcodec/mpegvideo.h | 11 ----------- libavcodec/mpegvideo_enc.c | 1 + libavcodec/mpegvideo_motion.c | 1 + libavcodec/msmpeg4.h | 1 - libavcodec/msmpeg4dec.c | 1 + libavcodec/wmv2.h | 14 ++++++++++++++ 8 files changed, 19 insertions(+), 12 deletions(-) diff --git a/libavcodec/h263dec.c b/libavcodec/h263dec.c index 0e08a8d..3d0d1de 100644 --- a/libavcodec/h263dec.c +++ b/libavcodec/h263dec.c @@ -39,6 +39,7 @@ #include "msmpeg4.h" #include "qpeldsp.h" #include "thread.h" +#include "wmv2.h" static enum AVPixelFormat h263_get_format(AVCodecContext *avctx) { diff --git a/libavcodec/mpegvideo.c b/libavcodec/mpegvideo.c index 4294eb6..49f2e66 100644 --- a/libavcodec/mpegvideo.c +++ b/libavcodec/mpegvideo.c @@ -44,6 +44,7 @@ #include "qpeldsp.h" #include "xvmc_internal.h" #include "thread.h" +#include "wmv2.h" #include <limits.h> static const uint8_t ff_default_chroma_qscale_table[32] = { diff --git a/libavcodec/mpegvideo.h b/libavcodec/mpegvideo.h index 4eff4d9..9c226cc 100644 --- a/libavcodec/mpegvideo.h +++ b/libavcodec/mpegvideo.h @@ -851,17 +851,6 @@ int ff_msmpeg4_decode_picture_header(MpegEncContext * s); int ff_msmpeg4_decode_ext_header(MpegEncContext * s, int buf_size); int ff_msmpeg4_decode_init(AVCodecContext *avctx); int ff_msmpeg4_encode_init(MpegEncContext *s); -int ff_wmv2_decode_picture_header(MpegEncContext * s); -int ff_wmv2_decode_secondary_picture_header(MpegEncContext * s); -void ff_wmv2_add_mb(MpegEncContext *s, int16_t block[6][64], uint8_t *dest_y, uint8_t *dest_cb, uint8_t *dest_cr); -void ff_mspel_motion(MpegEncContext *s, - uint8_t *dest_y, uint8_t *dest_cb, uint8_t *dest_cr, - uint8_t **ref_picture, op_pixels_func (*pix_op)[4], - int motion_x, int motion_y, int h); -int ff_wmv2_encode_picture_header(MpegEncContext * s, int picture_number); -void ff_wmv2_encode_mb(MpegEncContext * s, - int16_t block[6][64], - int motion_x, int motion_y); int ff_mpeg_ref_picture(AVCodecContext *avctx, Picture *dst, Picture *src); void ff_mpeg_unref_picture(AVCodecContext *avctx, Picture *picture); diff --git a/libavcodec/mpegvideo_enc.c b/libavcodec/mpegvideo_enc.c index 15cca64..a477818 100644 --- a/libavcodec/mpegvideo_enc.c +++ b/libavcodec/mpegvideo_enc.c @@ -56,6 +56,7 @@ #include "mpeg4video.h" #include "internal.h" #include "bytestream.h" +#include "wmv2.h" #include <limits.h> #define QUANT_BIAS_SHIFT 8 diff --git a/libavcodec/mpegvideo_motion.c b/libavcodec/mpegvideo_motion.c index 95414d1..a25b251 100644 --- a/libavcodec/mpegvideo_motion.c +++ b/libavcodec/mpegvideo_motion.c @@ -31,6 +31,7 @@ #include "mjpegenc.h" #include "msmpeg4.h" #include "qpeldsp.h" +#include "wmv2.h" #include <limits.h> static void gmc1_motion(MpegEncContext *s, diff --git a/libavcodec/msmpeg4.h b/libavcodec/msmpeg4.h index 0a8ecd9..23138dc 100644 --- a/libavcodec/msmpeg4.h +++ b/libavcodec/msmpeg4.h @@ -54,7 +54,6 @@ int ff_msmpeg4_decode_block(MpegEncContext * s, int16_t * block, int n, int coded, const uint8_t *scan_table); int ff_msmpeg4_pred_dc(MpegEncContext *s, int n, int16_t **dc_val_ptr, int *dir_ptr); -int ff_wmv2_decode_mb(MpegEncContext *s, int16_t block[6][64]); #define CONFIG_MSMPEG4_DECODER (CONFIG_MSMPEG4V1_DECODER || \ CONFIG_MSMPEG4V2_DECODER || \ diff --git a/libavcodec/msmpeg4dec.c b/libavcodec/msmpeg4dec.c index 2fc2de1..bc3cd76 100644 --- a/libavcodec/msmpeg4dec.c +++ b/libavcodec/msmpeg4dec.c @@ -32,6 +32,7 @@ #include "mpeg4video.h" #include "msmpeg4data.h" #include "vc1data.h" +#include "wmv2.h" #define DC_VLC_BITS 9 #define V2_INTRA_CBPC_VLC_BITS 3 diff --git a/libavcodec/wmv2.h b/libavcodec/wmv2.h index 03a8514..b77dd98 100644 --- a/libavcodec/wmv2.h +++ b/libavcodec/wmv2.h @@ -56,4 +56,18 @@ typedef struct Wmv2Context { void ff_wmv2_common_init(Wmv2Context *w); +int ff_wmv2_decode_mb(MpegEncContext *s, int16_t block[6][64]); +int ff_wmv2_encode_picture_header(MpegEncContext * s, int picture_number); +void ff_wmv2_encode_mb(MpegEncContext * s, int16_t block[6][64], + int motion_x, int motion_y); +int ff_wmv2_decode_picture_header(MpegEncContext * s); +int ff_wmv2_decode_secondary_picture_header(MpegEncContext * s); +void ff_wmv2_add_mb(MpegEncContext *s, int16_t block[6][64], + uint8_t *dest_y, uint8_t *dest_cb, uint8_t *dest_cr); + +void ff_mspel_motion(MpegEncContext *s, + uint8_t *dest_y, uint8_t *dest_cb, uint8_t *dest_cr, + uint8_t **ref_picture, op_pixels_func (*pix_op)[4], + int motion_x, int motion_y, int h); + #endif /* AVCODEC_WMV2_H */

1 0

dxva2_hevc: re-write reference frame handling
by git＠videolan.org 31 May '15

31 May '15

ffmpeg | branch: master | Hendrik Leppkes <h.leppkes(a)gmail.com> | Thu May 28 18:25:37 2015 +0200| [902a55f7161ffea10e13c1e7df14022e2ed90514] | committer: Luca Barbato dxva2_hevc: re-write reference frame handling The old logic required an explicit clearing of the lists first and was prone to overflow the DXVA2 struct in some circumstances. Signed-off-by: Luca Barbato <lu_zero(a)gentoo.org> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=902a55f7161ffea10… --- libavcodec/dxva2_hevc.c | 40 ++++++++++++++++++++++------------------ 1 file changed, 22 insertions(+), 18 deletions(-) diff --git a/libavcodec/dxva2_hevc.c b/libavcodec/dxva2_hevc.c index a2abb97..5112bd2 100644 --- a/libavcodec/dxva2_hevc.c +++ b/libavcodec/dxva2_hevc.c @@ -57,7 +57,7 @@ static void fill_picture_parameters(const AVCodecContext *avctx, AVDXVAContext * DXVA_PicParams_HEVC *pp) { const HEVCFrame *current_picture = h->ref; - int i, j, k; + int i, j; memset(pp, 0, sizeof(*pp)); @@ -155,30 +155,34 @@ static void fill_picture_parameters(const AVCodecContext *avctx, AVDXVAContext * pp->log2_parallel_merge_level_minus2 = h->pps->log2_parallel_merge_level - 2; pp->CurrPicOrderCntVal = h->poc; - // empty the lists - memset(&pp->RefPicList, 0xff, sizeof(pp->RefPicList)); - memset(&pp->RefPicSetStCurrBefore, 0xff, sizeof(pp->RefPicSetStCurrBefore)); - memset(&pp->RefPicSetStCurrAfter, 0xff, sizeof(pp->RefPicSetStCurrAfter)); - memset(&pp->RefPicSetLtCurr, 0xff, sizeof(pp->RefPicSetLtCurr)); - // fill RefPicList from the DPB - for (i = 0, j = 0; i < FF_ARRAY_ELEMS(h->DPB); i++) { - const HEVCFrame *frame = &h->DPB[i]; - if (frame != current_picture && (frame->flags & (HEVC_FRAME_FLAG_LONG_REF | HEVC_FRAME_FLAG_SHORT_REF))) { - fill_picture_entry(&pp->RefPicList[j], ff_dxva2_get_surface_index(avctx, ctx, frame->frame), !!(frame->flags & HEVC_FRAME_FLAG_LONG_REF)); - pp->PicOrderCntValList[j] = frame->poc; + for (i = 0, j = 0; i < FF_ARRAY_ELEMS(pp->RefPicList); i++) { + const HEVCFrame *frame = NULL; + while (!frame && j < FF_ARRAY_ELEMS(h->DPB)) { + if (&h->DPB[j] != current_picture && (h->DPB[j].flags & (HEVC_FRAME_FLAG_LONG_REF | HEVC_FRAME_FLAG_SHORT_REF))) + frame = &h->DPB[j]; j++; } + + if (frame) { + fill_picture_entry(&pp->RefPicList[i], ff_dxva2_get_surface_index(avctx, ctx, frame->frame), !!(frame->flags & HEVC_FRAME_FLAG_LONG_REF)); + pp->PicOrderCntValList[i] = frame->poc; + } else { + pp->RefPicList[i].bPicEntry = 0xff; + pp->PicOrderCntValList[i] = 0; + } } #define DO_REF_LIST(ref_idx, ref_list) { \ const RefPicList *rpl = &h->rps[ref_idx]; \ - av_assert0(rpl->nb_refs <= FF_ARRAY_ELEMS(pp->ref_list)); \ - for (j = 0, k = 0; j < rpl->nb_refs; j++) { \ - if (rpl->ref[j]) { \ - pp->ref_list[k] = get_refpic_index(pp, ff_dxva2_get_surface_index(avctx, ctx, rpl->ref[j]->frame)); \ - k++; \ - } \ + for (i = 0, j = 0; i < FF_ARRAY_ELEMS(pp->ref_list); i++) { \ + const HEVCFrame *frame = NULL; \ + while (!frame && j < rpl->nb_refs) \ + frame = rpl->ref[j++]; \ + if (frame) \ + pp->ref_list[i] = get_refpic_index(pp, ff_dxva2_get_surface_index(avctx, ctx, frame->frame)); \ + else \ + pp->ref_list[i] = 0xff; \ } \ }

1 0

dxva2_hevc: fix 32x32 scaling lists
by git＠videolan.org 31 May '15

31 May '15

ffmpeg | branch: master | Hendrik Leppkes <h.leppkes(a)gmail.com> | Thu May 28 18:25:36 2015 +0200| [35818b8aaf4d669ed0bbb05c3fd06e619f2db01a] | committer: Luca Barbato dxva2_hevc: fix 32x32 scaling lists Signed-off-by: Luca Barbato <lu_zero(a)gentoo.org> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=35818b8aaf4d669ed… --- libavcodec/dxva2_hevc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/dxva2_hevc.c b/libavcodec/dxva2_hevc.c index 9d130d9..a2abb97 100644 --- a/libavcodec/dxva2_hevc.c +++ b/libavcodec/dxva2_hevc.c @@ -209,12 +209,12 @@ static void fill_scaling_lists(AVDXVAContext *ctx, const HEVCContext *h, DXVA_Qm qm->ucScalingLists2[i][j] = sl->sl[2][i][pos]; if (i < 2) - qm->ucScalingLists3[i][j] = sl->sl[3][i][pos]; + qm->ucScalingLists3[i][j] = sl->sl[3][i * 3][pos]; } qm->ucScalingListDCCoefSizeID2[i] = sl->sl_dc[0][i]; if (i < 2) - qm->ucScalingListDCCoefSizeID3[i] = sl->sl_dc[1][i]; + qm->ucScalingListDCCoefSizeID3[i] = sl->sl_dc[1][i * 3]; } }

1 0

Merge commit '5c720657c23afd798ae0db7c7362eb859a89ab3d'
by git＠videolan.org 31 May '15

31 May '15

ffmpeg | branch: master | Michael Niedermayer <michaelni(a)gmx.at> | Mon Jun 1 00:57:07 2015 +0200| [9e1cdfb89be553b8d21239a7eeaa0d1bc0cbbf5a] | committer: Michael Niedermayer Merge commit '5c720657c23afd798ae0db7c7362eb859a89ab3d' * commit '5c720657c23afd798ae0db7c7362eb859a89ab3d': mov: always check avio_read return value Conflicts: libavformat/mov.c See: b71528d8967c1e10f499432fe26ff4713d1fd3b6 Merged-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9e1cdfb89be553b8d… ---

1 0

Merge commit 'bff0349d9da527084e1433167466d8afc9e25c7f'
by git＠videolan.org 31 May '15

31 May '15

ffmpeg | branch: master | Michael Niedermayer <michaelni(a)gmx.at> | Mon Jun 1 00:43:47 2015 +0200| [ebab902a1c3670c1e445d144f1d4365f32955a85] | committer: Michael Niedermayer Merge commit 'bff0349d9da527084e1433167466d8afc9e25c7f' * commit 'bff0349d9da527084e1433167466d8afc9e25c7f': avio: Add avio_read wrapper to simplify error checking Merged-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ebab902a1c3670c1e… ---

1 0

mov: always check avio_read return value
by git＠videolan.org 31 May '15

31 May '15

ffmpeg | branch: master | Andreas Cadhalpun <Andreas.Cadhalpun(a)googlemail.com> | Tue May 26 14:24:39 2015 +0100| [5c720657c23afd798ae0db7c7362eb859a89ab3d] | committer: Luca Barbato mov: always check avio_read return value If avio_read fails, the buffer can contain uninitialized data. This fixes 'Conditional jump or move depends on uninitialised value(s)' valgrind warnings, and addresses a few memleaks. Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun(a)googlemail.com> Signed-off-by: Vittorio Giovara <vittorio.giovara(a)gmail.com> Signed-off-by: Luca Barbato <lu_zero(a)gentoo.org> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5c720657c23afd798… --- libavformat/mov.c | 123 +++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 101 insertions(+), 22 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 2cf6e8e..80681b7 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -394,7 +394,11 @@ static int mov_read_udta_string(MOVContext *c, AVIOContext *pb, MOVAtom atom) if (!raw && (data_type == 3 || (data_type == 0 && (langcode < 0x400 || langcode == 0x7fff)))) { // MAC Encoded mov_read_mac_string(c, pb, str_size, str, str_size_alloc); } else { - avio_read(pb, str, str_size); + int ret = ffio_read_size(pb, str, str_size); + if (ret < 0) { + av_free(str); + return ret; + } str[str_size] = 0; } c->fc->event_flags |= AVFMT_EVENT_FLAG_METADATA_UPDATED; @@ -417,6 +421,7 @@ static int mov_read_chpl(MOVContext *c, AVIOContext *pb, MOVAtom atom) int64_t start; int i, nb_chapters, str_len, version; char str[256+1]; + int ret; if ((atom.size -= 5) < 0) return 0; @@ -437,7 +442,9 @@ static int mov_read_chpl(MOVContext *c, AVIOContext *pb, MOVAtom atom) if ((atom.size -= 9+str_len) < 0) return 0; - avio_read(pb, str, str_len); + ret = ffio_read_size(pb, str, str_len); + if (ret < 0) + return ret; str[str_len] = 0; avpriv_new_chapter(c->fc, i, (AVRational){1,10000000}, start, AV_NOPTS_VALUE, str); } @@ -483,12 +490,15 @@ static int mov_read_dref(MOVContext *c, AVIOContext *pb, MOVAtom atom) /* macintosh alias record */ uint16_t volume_len, len; int16_t type; + int ret; avio_skip(pb, 10); volume_len = avio_r8(pb); volume_len = FFMIN(volume_len, 27); - avio_read(pb, dref->volume, 27); + ret = ffio_read_size(pb, dref->volume, 27); + if (ret < 0) + return ret; dref->volume[volume_len] = 0; av_log(c->fc, AV_LOG_DEBUG, "volume %s, len %d\n", dref->volume, volume_len); @@ -496,7 +506,9 @@ static int mov_read_dref(MOVContext *c, AVIOContext *pb, MOVAtom atom) len = avio_r8(pb); len = FFMIN(len, 63); - avio_read(pb, dref->filename, 63); + ret = ffio_read_size(pb, dref->filename, 63); + if (ret < 0) + return ret; dref->filename[len] = 0; av_log(c->fc, AV_LOG_DEBUG, "filename %s, len %d\n", dref->filename, len); @@ -523,7 +535,12 @@ static int mov_read_dref(MOVContext *c, AVIOContext *pb, MOVAtom atom) dref->path = av_mallocz(len+1); if (!dref->path) return AVERROR(ENOMEM); - avio_read(pb, dref->path, len); + + ret = ffio_read_size(pb, dref->path, len); + if (ret < 0) { + av_freep(&dref->path); + return ret; + } if (type == 18) // no additional processing needed continue; if (len > volume_len && !strncmp(dref->path, dref->volume, volume_len)) { @@ -540,7 +557,12 @@ static int mov_read_dref(MOVContext *c, AVIOContext *pb, MOVAtom atom) dref->dir = av_malloc(len+1); if (!dref->dir) return AVERROR(ENOMEM); - avio_read(pb, dref->dir, len); + + ret = ffio_read_size(pb, dref->dir, len); + if (ret < 0) { + av_freep(&dref->dir); + return ret; + } dref->dir[len] = 0; for (j = 0; j < len; j++) if (dref->dir[j] == ':') @@ -562,6 +584,7 @@ static int mov_read_hdlr(MOVContext *c, AVIOContext *pb, MOVAtom atom) uint32_t av_unused ctype; int64_t title_size; char *title_str; + int ret; if (c->fc->nb_streams < 1) // meta before first trak return 0; @@ -596,7 +619,12 @@ static int mov_read_hdlr(MOVContext *c, AVIOContext *pb, MOVAtom atom) title_str = av_malloc(title_size + 1); /* Add null terminator */ if (!title_str) return AVERROR(ENOMEM); - avio_read(pb, title_str, title_size); + + ret = ffio_read_size(pb, title_str, title_size); + if (ret < 0) { + av_freep(&title_str); + return ret; + } title_str[title_size] = 0; if (title_str[0]) { int off = (!c->isom && title_str[0] == title_size - 1); @@ -773,8 +801,10 @@ static int mov_read_ftyp(MOVContext *c, AVIOContext *pb, MOVAtom atom) char minor_ver_str[11]; /* 32 bit integer -> 10 digits + null */ char* comp_brands_str; uint8_t type[5] = {0}; + int ret = ffio_read_size(pb, type, 4); + if (ret < 0) + return ret; - avio_read(pb, type, 4); if (strcmp(type, "qt ")) c->isom = 1; av_log(c->fc, AV_LOG_DEBUG, "ISO: File Type Major Brand: %.4s\n",(char *)&type); @@ -789,7 +819,12 @@ static int mov_read_ftyp(MOVContext *c, AVIOContext *pb, MOVAtom atom) comp_brands_str = av_malloc(comp_brand_size + 1); /* Add null terminator */ if (!comp_brands_str) return AVERROR(ENOMEM); - avio_read(pb, comp_brands_str, comp_brand_size); + + ret = ffio_read_size(pb, comp_brands_str, comp_brand_size); + if (ret < 0) { + av_freep(&comp_brands_str); + return ret; + } comp_brands_str[comp_brand_size] = 0; av_dict_set(&c->fc->metadata, "compatible_brands", comp_brands_str, 0); av_freep(&comp_brands_str); @@ -916,6 +951,7 @@ static int mov_read_mvhd(MOVContext *c, AVIOContext *pb, MOVAtom atom) static int mov_read_smi(MOVContext *c, AVIOContext *pb, MOVAtom atom) { AVStream *st; + int ret; if (c->fc->nb_streams < 1) return 0; @@ -932,7 +968,11 @@ static int mov_read_smi(MOVContext *c, AVIOContext *pb, MOVAtom atom) return AVERROR(ENOMEM); st->codec->extradata_size = 0x5a + atom.size; memcpy(st->codec->extradata, "SVQ3", 4); // fake - avio_read(pb, st->codec->extradata + 0x5a, atom.size); + + ret = ffio_read_size(pb, st->codec->extradata + 0x5a, atom.size); + if (ret < 0) + return ret; + av_log(c->fc, AV_LOG_TRACE, "Reading SMI %"PRId64" %s\n", atom.size, st->codec->extradata + 0x5a); return 0; } @@ -974,12 +1014,15 @@ static int mov_read_colr(MOVContext *c, AVIOContext *pb, MOVAtom atom) AVStream *st; char color_parameter_type[5] = { 0 }; int color_primaries, color_trc, color_matrix; + int ret; if (c->fc->nb_streams < 1) return 0; st = c->fc->streams[c->fc->nb_streams - 1]; - avio_read(pb, color_parameter_type, 4); + ret = ffio_read_size(pb, color_parameter_type, 4); + if (ret < 0) + return ret; if (strncmp(color_parameter_type, "nclx", 4) && strncmp(color_parameter_type, "nclc", 4)) { av_log(c->fc, AV_LOG_WARNING, "unsupported color_parameter_type %s\n", @@ -1095,13 +1138,18 @@ static int mov_read_extradata(MOVContext *c, AVIOContext *pb, MOVAtom atom) st->codec->extradata_size= size - FF_INPUT_BUFFER_PADDING_SIZE; AV_WB32( buf , atom.size + 8); AV_WL32( buf + 4, atom.type); - avio_read(pb, buf + 8, atom.size); + + err = ffio_read_size(pb, buf + 8, atom.size); + if (err < 0) + return err; + return 0; } static int mov_read_wave(MOVContext *c, AVIOContext *pb, MOVAtom atom) { AVStream *st; + int ret; if (c->fc->nb_streams < 1) return 0; @@ -1117,9 +1165,11 @@ static int mov_read_wave(MOVContext *c, AVIOContext *pb, MOVAtom atom) if (!st->codec->extradata) return AVERROR(ENOMEM); st->codec->extradata_size = atom.size; - avio_read(pb, st->codec->extradata, atom.size); + + ret = ffio_read_size(pb, st->codec->extradata, atom.size); + if (ret < 0) + return ret; } else if (atom.size > 8) { /* to read frma, esds atoms */ - int ret; if ((ret = mov_read_default(c, pb, atom)) < 0) return ret; } else @@ -1134,6 +1184,7 @@ static int mov_read_wave(MOVContext *c, AVIOContext *pb, MOVAtom atom) static int mov_read_glbl(MOVContext *c, AVIOContext *pb, MOVAtom atom) { AVStream *st; + int ret; if (c->fc->nb_streams < 1) return 0; @@ -1156,7 +1207,11 @@ static int mov_read_glbl(MOVContext *c, AVIOContext *pb, MOVAtom atom) if (!st->codec->extradata) return AVERROR(ENOMEM); st->codec->extradata_size = atom.size; - avio_read(pb, st->codec->extradata, atom.size); + + ret = ffio_read_size(pb, st->codec->extradata, atom.size); + if (ret < 0) + return ret; + return 0; } @@ -1164,6 +1219,7 @@ static int mov_read_dvc1(MOVContext *c, AVIOContext *pb, MOVAtom atom) { AVStream *st; uint8_t profile_level; + int ret; if (c->fc->nb_streams < 1) return 0; @@ -1182,7 +1238,11 @@ static int mov_read_dvc1(MOVContext *c, AVIOContext *pb, MOVAtom atom) return AVERROR(ENOMEM); st->codec->extradata_size = atom.size - 7; avio_seek(pb, 6, SEEK_CUR); - avio_read(pb, st->codec->extradata, st->codec->extradata_size); + + ret = ffio_read_size(pb, st->codec->extradata, st->codec->extradata_size); + if (ret < 0) + return ret; + return 0; } @@ -1194,6 +1254,7 @@ static int mov_read_dvc1(MOVContext *c, AVIOContext *pb, MOVAtom atom) static int mov_read_strf(MOVContext *c, AVIOContext *pb, MOVAtom atom) { AVStream *st; + int ret; if (c->fc->nb_streams < 1) return 0; @@ -1210,7 +1271,11 @@ static int mov_read_strf(MOVContext *c, AVIOContext *pb, MOVAtom atom) return AVERROR(ENOMEM); st->codec->extradata_size = atom.size - 40; avio_skip(pb, 40); - avio_read(pb, st->codec->extradata, atom.size - 40); + + ret = ffio_read_size(pb, st->codec->extradata, atom.size - 40); + if (ret < 0) + return ret; + return 0; } @@ -1568,12 +1633,16 @@ static int mov_parse_stsd_data(MOVContext *c, AVIOContext *pb, AVStream *st, MOVStreamContext *sc, int size) { + int ret; + if (st->codec->codec_tag == MKTAG('t','m','c','d')) { st->codec->extradata_size = size; st->codec->extradata = av_malloc(size + FF_INPUT_BUFFER_PADDING_SIZE); if (!st->codec->extradata) return AVERROR(ENOMEM); - avio_read(pb, st->codec->extradata, size); + ret = ffio_read_size(pb, st->codec->extradata, size); + if (ret < 0) + return ret; } else { /* other codec type, just skip (rtp, mp4s ...) */ avio_skip(pb, size); @@ -1879,6 +1948,7 @@ static int mov_read_stsz(MOVContext *c, AVIOContext *pb, MOVAtom atom) unsigned int i, entries, sample_size, field_size, num_bytes; GetBitContext gb; unsigned char* buf; + int ret; if (c->fc->nb_streams < 1) return 0; @@ -1927,10 +1997,11 @@ static int mov_read_stsz(MOVContext *c, AVIOContext *pb, MOVAtom atom) return AVERROR(ENOMEM); } - if (avio_read(pb, buf, num_bytes) < num_bytes) { + ret = ffio_read_size(pb, buf, num_bytes); + if (ret < 0) { av_freep(&sc->sample_sizes); av_free(buf); - return AVERROR_INVALIDDATA; + return ret; } init_get_bits(&gb, buf, 8*num_bytes); @@ -2460,6 +2531,7 @@ static int mov_read_replaygain(MOVContext *c, AVIOContext *pb, int size) for (i = 0; i < 2; i++) { uint8_t **p; uint32_t len, tag; + int ret; if (end - avio_tell(pb) <= 12) break; @@ -2484,7 +2556,11 @@ static int mov_read_replaygain(MOVContext *c, AVIOContext *pb, int size) *p = av_malloc(len + 1); if (!*p) break; - avio_read(pb, *p, len); + ret = ffio_read_size(pb, *p, len); + if (ret < 0) { + av_freep(p); + return ret; + } (*p)[len] = 0; } @@ -2890,7 +2966,10 @@ static int mov_read_cmov(MOVContext *c, AVIOContext *pb, MOVAtom atom) av_free(cmov_data); return AVERROR(ENOMEM); } - avio_read(pb, cmov_data, cmov_len); + ret = ffio_read_size(pb, cmov_data, cmov_len); + if (ret < 0) + goto free_and_return; + if (uncompress (moov_data, (uLongf *) &moov_len, (const Bytef *)cmov_data, cmov_len) != Z_OK) goto free_and_return; if (ffio_init_context(&ctx, moov_data, moov_len, 0, NULL, NULL, NULL, NULL) != 0)

1 0

avio: Add avio_read wrapper to simplify error checking
by git＠videolan.org 31 May '15

31 May '15

ffmpeg | branch: master | Vittorio Giovara <vittorio.giovara(a)gmail.com> | Tue May 26 14:24:38 2015 +0100| [bff0349d9da527084e1433167466d8afc9e25c7f] | committer: Luca Barbato avio: Add avio_read wrapper to simplify error checking Signed-off-by: Luca Barbato <lu_zero(a)gentoo.org> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bff0349d9da527084… --- libavformat/avio_internal.h | 7 +++++++ libavformat/aviobuf.c | 8 ++++++++ 2 files changed, 15 insertions(+) diff --git a/libavformat/avio_internal.h b/libavformat/avio_internal.h index c8630ab..aff5564 100644 --- a/libavformat/avio_internal.h +++ b/libavformat/avio_internal.h @@ -85,6 +85,13 @@ int ffio_rewind_with_probe_data(AVIOContext *s, unsigned char *buf, int buf_size uint64_t ffio_read_varlen(AVIOContext *bc); +/** + * Read size bytes from AVIOContext into buf. + * Check that exactly size bytes have been read. + * @return number of bytes read or AVERROR + */ +int ffio_read_size(AVIOContext *s, unsigned char *buf, int size); + /** @warning must be called before any I/O */ int ffio_set_buf_size(AVIOContext *s, int buf_size); diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c index 59f807c..d3e3452 100644 --- a/libavformat/aviobuf.c +++ b/libavformat/aviobuf.c @@ -496,6 +496,14 @@ int avio_read(AVIOContext *s, unsigned char *buf, int size) return size1 - size; } +int ffio_read_size(AVIOContext *s, unsigned char *buf, int size) +{ + int ret = avio_read(s, buf, size); + if (ret != size) + return AVERROR_INVALIDDATA; + return ret; +} + int ffio_read_indirect(AVIOContext *s, unsigned char *buf, int size, const unsigned char **data) { if (s->buf_end - s->buf_ptr >= size && !s->write_flag) {

1 0

Merge commit 'cffb9ea81bd16d2ed8bce187b6bf0279c07b3b9b'
by git＠videolan.org 31 May '15

31 May '15

ffmpeg | branch: master | Michael Niedermayer <michaelni(a)gmx.at> | Mon Jun 1 00:36:36 2015 +0200| [3bd43430f86d58dac31add7b3913563622430eb1] | committer: Michael Niedermayer Merge commit 'cffb9ea81bd16d2ed8bce187b6bf0279c07b3b9b' * commit 'cffb9ea81bd16d2ed8bce187b6bf0279c07b3b9b': mov: reject zero bytes_per_frame with non-zero samples_per_frame See: 83a04f8cc16f656ee14b71fd7979a48c49c4b830 Merged-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3bd43430f86d58dac… ---

1 0

Merge commit 'a8a90906fb0ad0f8d3c68a97f182528ee3b5198c'
by git＠videolan.org 31 May '15

31 May '15

ffmpeg | branch: master | Michael Niedermayer <michaelni(a)gmx.at> | Mon Jun 1 00:35:39 2015 +0200| [348319f5438fa2117cf19c42317a7d7875876981] | committer: Michael Niedermayer Merge commit 'a8a90906fb0ad0f8d3c68a97f182528ee3b5198c' * commit 'a8a90906fb0ad0f8d3c68a97f182528ee3b5198c': mov: Correctly allocate ctts_data Conflicts: libavformat/mov.c Merged-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=348319f5438fa2117… ---

1 0

Merge commit '8e9c39e81fe5ba34010a7ba05cbe4ae31f177d89'
by git＠videolan.org 31 May '15

31 May '15

ffmpeg | branch: master | Michael Niedermayer <michaelni(a)gmx.at> | Mon Jun 1 00:35:56 2015 +0200| [2bedd17b64b63158132c1ed92f953956d5782f7b] | committer: Michael Niedermayer Merge commit '8e9c39e81fe5ba34010a7ba05cbe4ae31f177d89' * commit '8e9c39e81fe5ba34010a7ba05cbe4ae31f177d89': mov: abort on EOF in ff_mov_read_chan See: a5718863da99b54b6c853d45c84871c4a96a57c0 Merged-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2bedd17b64b631581… ---

1 0