September 2016 - ffmpeg-cvslog

avformat/movenc: Factor check_pkt() out
by git＠videolan.org 28 Sep '16

28 Sep '16

ffmpeg | branch: release/3.1 | Michael Niedermayer <michael(a)niedermayer.cc> | Thu Sep 15 23:52:42 2016 +0200| [03f996d1834610bd735406aac3ee6df47a946406] | committer: Michael Niedermayer avformat/movenc: Factor check_pkt() out Reviewed-by: Paul B Mahol <onemda(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit deabcd2c05b2b01689d91394bbf3908da17234ed) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=03f996d1834610bd7… --- libavformat/movenc.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/libavformat/movenc.c b/libavformat/movenc.c index 788ab3c..917fdaf 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -4592,15 +4592,10 @@ static int mov_auto_flush_fragment(AVFormatContext *s, int force) return ret; } -int ff_mov_write_packet(AVFormatContext *s, AVPacket *pkt) +static int check_pkt(AVFormatContext *s, AVPacket *pkt) { MOVMuxContext *mov = s->priv_data; - AVIOContext *pb = s->pb; MOVTrack *trk = &mov->tracks[pkt->stream_index]; - AVCodecParameters *par = trk->par; - unsigned int samples_in_chunk = 0; - int size = pkt->size, ret = 0; - uint8_t *reformatted_data = NULL; if (trk->entry) { int64_t duration = pkt->dts - trk->cluster[trk->entry - 1].dts; @@ -4624,6 +4619,23 @@ int ff_mov_write_packet(AVFormatContext *s, AVPacket *pkt) av_log(s, AV_LOG_ERROR, "Application provided duration: %"PRId64" is invalid\n", pkt->duration); return AVERROR(EINVAL); } + return 0; +} + +int ff_mov_write_packet(AVFormatContext *s, AVPacket *pkt) +{ + MOVMuxContext *mov = s->priv_data; + AVIOContext *pb = s->pb; + MOVTrack *trk = &mov->tracks[pkt->stream_index]; + AVCodecParameters *par = trk->par; + unsigned int samples_in_chunk = 0; + int size = pkt->size, ret = 0; + uint8_t *reformatted_data = NULL; + + ret = check_pkt(s, pkt); + if (ret < 0) + return ret; + if (mov->flags & FF_MOV_FLAG_FRAGMENT) { int ret; if (mov->moov_written || mov->flags & FF_MOV_FLAG_EMPTY_MOOV) {

1 0

avformat/utils: fix timebase error in avformat_seek_file()
by git＠videolan.org 28 Sep '16

28 Sep '16

ffmpeg | branch: release/3.1 | Xinzheng Zhang <zhangxzheng(a)gmail.com> | Wed Sep 14 16:13:45 2016 +0800| [c68ce48260cf374480439b8f0d658f02fe9932d4] | committer: Michael Niedermayer avformat/utils: fix timebase error in avformat_seek_file() When there is only one stream and stream_index has not specified, The ts has been transferd by the timebase of stream0 without modifying the stream_index In this condation it cause seek failure. Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit ecc04b4f2f29ac676e6c1d1ebf20ec45f5385f1e) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c68ce48260cf37448… --- libavformat/utils.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavformat/utils.c b/libavformat/utils.c index 1711bef..5be1e86 100644 --- a/libavformat/utils.c +++ b/libavformat/utils.c @@ -2414,6 +2414,7 @@ int avformat_seek_file(AVFormatContext *s, int stream_index, int64_t min_ts, max_ts = av_rescale_rnd(max_ts, time_base.den, time_base.num * (int64_t)AV_TIME_BASE, AV_ROUND_DOWN | AV_ROUND_PASS_MINMAX); + stream_index = 0; } ret = s->iformat->read_seek2(s, stream_index, min_ts,

1 0

avcodec/g726: Add missing ADDB output mask
by git＠videolan.org 28 Sep '16

28 Sep '16

ffmpeg | branch: release/3.1 | Michael Niedermayer <michael(a)niedermayer.cc> | Wed Sep 14 13:06:53 2016 +0200| [ac8ac46641adef208485baebc3734463bf0bd266] | committer: Michael Niedermayer avcodec/g726: Add missing ADDB output mask Fixes: 1.poc Fixes out of array read Found-by: 连一汉 <lianyihan(a)360.cn> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit a5af1240fce845f645440364c1335e0f8e44ee6c) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ac8ac46641adef208… --- libavcodec/g726.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/g726.c b/libavcodec/g726.c index c7d138e..ca7f856 100644 --- a/libavcodec/g726.c +++ b/libavcodec/g726.c @@ -206,7 +206,7 @@ static int16_t g726_decode(G726Context* c, int I) if (I_sig) /* get the sign */ dq = -dq; - re_signal = c->se + dq; + re_signal = (int16_t)(c->se + dq); /* Update second order predictor coefficient A2 and A1 */ pk0 = (c->sez + dq) ? sgn(c->sez + dq) : 0;

1 0

avformat/movenc: Check first DTS similar to dts difference
by git＠videolan.org 28 Sep '16

28 Sep '16

ffmpeg | branch: release/3.1 | Michael Niedermayer <michael(a)niedermayer.cc> | Fri Sep 9 13:11:43 2016 +0200| [21a979773783bb4e1baa2597150f25151328c93f] | committer: Michael Niedermayer avformat/movenc: Check first DTS similar to dts difference Fixes assertion failure Fixes: b84b53855a0b74560e64c6f45f505a13/signal_sigabrt_7ffff6ae7c37_3837_ef4e243ea5b4fa8d0becf4afe9166604.avi Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 68f4c2163ec6d4534ae1756dbcf259845f2e4d2c) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=21a979773783bb4e1… --- libavformat/movenc.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavformat/movenc.c b/libavformat/movenc.c index d614933..788ab3c 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -4612,6 +4612,13 @@ int ff_mov_write_packet(AVFormatContext *s, AVPacket *pkt) pkt->dts = trk->cluster[trk->entry - 1].dts + 1; pkt->pts = AV_NOPTS_VALUE; } + } else if (pkt->dts <= INT_MIN || pkt->dts >= INT_MAX) { + av_log(s, AV_LOG_ERROR, "Application provided initial timestamp: %"PRId64" is out of range for mov/mp4 format\n", + pkt->dts + ); + + pkt->dts = 0; + pkt->pts = AV_NOPTS_VALUE; } if (pkt->duration < 0 || pkt->duration > INT_MAX) { av_log(s, AV_LOG_ERROR, "Application provided duration: %"PRId64" is invalid\n", pkt->duration);

1 0

avcodec/avpacket: clear side_data_elems
by git＠videolan.org 28 Sep '16

28 Sep '16

ffmpeg | branch: release/3.1 | Michael Niedermayer <michael(a)niedermayer.cc> | Mon Sep 12 13:13:42 2016 +0200| [c2087fc48b46ac478944b4e6c59ae2a3a05da0e1] | committer: Michael Niedermayer avcodec/avpacket: clear side_data_elems Fixes null pointer dereference Found-by: 连一汉 <lianyihan(a)360.cn> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 5e1bf9d8c0d2cdbbf17b06a5dfdf87a635b3203b) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c2087fc48b46ac478… --- libavcodec/avpacket.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/libavcodec/avpacket.c b/libavcodec/avpacket.c index d70ee5d..bb0fc6c 100644 --- a/libavcodec/avpacket.c +++ b/libavcodec/avpacket.c @@ -199,6 +199,7 @@ static int copy_packet_data(AVPacket *pkt, const AVPacket *src, int dup) { pkt->data = NULL; pkt->side_data = NULL; + pkt->side_data_elems = 0; if (pkt->buf) { AVBufferRef *ref = av_buffer_ref(src->buf); if (!ref) @@ -208,9 +209,11 @@ static int copy_packet_data(AVPacket *pkt, const AVPacket *src, int dup) } else { DUP_DATA(pkt->data, src->data, pkt->size, 1, ALLOC_BUF); } - if (pkt->side_data_elems && dup) + if (src->side_data_elems && dup) { pkt->side_data = src->side_data; - if (pkt->side_data_elems && !dup) { + pkt->side_data_elems = src->side_data_elems; + } + if (src->side_data_elems && !dup) { return av_copy_packet_side_data(pkt, src); } return 0;

1 0

avcodec/svq3: Reintroduce slice_type
by git＠videolan.org 28 Sep '16

28 Sep '16

ffmpeg | branch: release/3.1 | Michael Niedermayer <michael(a)niedermayer.cc> | Thu Sep 8 21:15:55 2016 +0200| [ed1c6f701a7861c77e89530d081e87da6fb3d3a7] | committer: Michael Niedermayer avcodec/svq3: Reintroduce slice_type Fixes out of array read Fixes: 1642cd3962249d6aaf0eec2836023fb6/signal_sigsegv_2557a72_2995_04efaf2ff57a052f609a3b4a2ea4e622.mov Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 2d3099ad8ee67a4612633ea02c7fce10e5537579) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ed1c6f701a7861c77… --- libavcodec/svq3.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/libavcodec/svq3.c b/libavcodec/svq3.c index 5e7d164..8c176f6 100644 --- a/libavcodec/svq3.c +++ b/libavcodec/svq3.c @@ -102,6 +102,7 @@ typedef struct SVQ3Context { int prev_frame_num; enum AVPictureType pict_type; + enum AVPictureType slice_type; int low_delay; int mb_x, mb_y; @@ -1057,7 +1058,7 @@ static int svq3_decode_slice_header(AVCodecContext *avctx) return -1; } - s->pict_type = ff_h264_golomb_to_pict_type[slice_id]; + s->slice_type = ff_h264_golomb_to_pict_type[slice_id]; if ((header & 0x9F) == 2) { i = (s->mb_num < 64) ? 6 : (1 + av_log2(s->mb_num - 1)); @@ -1426,6 +1427,8 @@ static int svq3_decode_frame(AVCodecContext *avctx, void *data, if (svq3_decode_slice_header(avctx)) return -1; + s->pict_type = s->slice_type; + if (s->pict_type != AV_PICTURE_TYPE_B) FFSWAP(H264Picture*, s->next_pic, s->last_pic); @@ -1539,6 +1542,9 @@ static int svq3_decode_frame(AVCodecContext *avctx, void *data, if (svq3_decode_slice_header(avctx)) return -1; } + if (s->slice_type != s->pict_type) { + avpriv_request_sample(avctx, "non constant slice type\n"); + } /* TODO: support s->mb_skip_run */ }

1 0

avcodec/ccaption_dec: Use simple array instead of AVBuffer
by git＠videolan.org 28 Sep '16

28 Sep '16

ffmpeg | branch: release/3.1 | Michael Niedermayer <michael(a)niedermayer.cc> | Fri Sep 9 10:26:15 2016 +0200| [65c10f0f5c5212f903feb30a5f65700caa6f0b2e] | committer: Michael Niedermayer avcodec/ccaption_dec: Use simple array instead of AVBuffer This is simpler and fixes an out of array read, fixing it with AVBuffers would be more complex Fixes: e00d9e6e50e5495cc93fea41147b97bb/asan_heap-oob_12dcdbb_8798_b32a97ea722dd37bb5066812cc674552.mov Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 752e6dfa3ea97e7901870bdd9e5a51f860607240) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=65c10f0f5c5212f90… --- libavcodec/ccaption_dec.c | 27 +++++++++++---------------- 1 file changed, 11 insertions(+), 16 deletions(-) diff --git a/libavcodec/ccaption_dec.c b/libavcodec/ccaption_dec.c index 3b15149..360c687 100644 --- a/libavcodec/ccaption_dec.c +++ b/libavcodec/ccaption_dec.c @@ -247,7 +247,8 @@ typedef struct CCaptionSubContext { int64_t last_real_time; char prev_cmd[2]; /* buffer to store pkt data */ - AVBufferRef *pktbuf; + uint8_t *pktbuf; + int pktbuf_size; int readorder; } CCaptionSubContext; @@ -273,11 +274,7 @@ static av_cold int init_decoder(AVCodecContext *avctx) if (ret < 0) { return ret; } - /* allocate pkt buffer */ - ctx->pktbuf = av_buffer_alloc(128); - if (!ctx->pktbuf) { - ret = AVERROR(ENOMEM); - } + return ret; } @@ -285,7 +282,8 @@ static av_cold int close_decoder(AVCodecContext *avctx) { CCaptionSubContext *ctx = avctx->priv_data; av_bprint_finalize(&ctx->buffer, NULL); - av_buffer_unref(&ctx->pktbuf); + av_freep(&ctx->pktbuf); + ctx->pktbuf_size = 0; return 0; } @@ -729,16 +727,13 @@ static int decode(AVCodecContext *avctx, void *data, int *got_sub, AVPacket *avp int ret = 0; int i; - if (ctx->pktbuf->size < len) { - ret = av_buffer_realloc(&ctx->pktbuf, len); - if (ret < 0) { - av_log(ctx, AV_LOG_WARNING, "Insufficient Memory of %d truncated to %d\n", len, ctx->pktbuf->size); - len = ctx->pktbuf->size; - ret = 0; - } + av_fast_padded_malloc(&ctx->pktbuf, &ctx->pktbuf_size, len); + if (!ctx->pktbuf) { + av_log(ctx, AV_LOG_WARNING, "Insufficient Memory of %d truncated to %d\n", len, ctx->pktbuf_size); + return AVERROR(ENOMEM); } - memcpy(ctx->pktbuf->data, avpkt->data, len); - bptr = ctx->pktbuf->data; + memcpy(ctx->pktbuf, avpkt->data, len); + bptr = ctx->pktbuf; for (i = 0; i < len; i += 3) { uint8_t cc_type = *(bptr + i) & 3;

1 0

avformat/mov: Fix potential integer overflow in mov_read_keys
by git＠videolan.org 28 Sep '16

28 Sep '16

ffmpeg | branch: release/3.1 | Sergey Volk <servolk(a)google.com> | Wed Sep 7 14:05:35 2016 -0700| [7a3dc2f7b6c2fbe62aeed7839e736db395a6f76a] | committer: Michael Niedermayer avformat/mov: Fix potential integer overflow in mov_read_keys Actual allocation size is computed as (count + 1)*sizeof(meta_keys), so we need to check that (count + 1) won't cause overflow. Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 347cb14b7cba7560e53f4434b419b9d8800253e7) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7a3dc2f7b6c2fbe62… --- libavformat/mov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index 7266fd0..dd746b4 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -3243,7 +3243,7 @@ static int mov_read_keys(MOVContext *c, AVIOContext *pb, MOVAtom atom) avio_skip(pb, 4); count = avio_rb32(pb); - if (count > UINT_MAX / sizeof(*c->meta_keys)) { + if (count > UINT_MAX / sizeof(*c->meta_keys) - 1) { av_log(c->fc, AV_LOG_ERROR, "The 'keys' atom with the invalid key count: %d\n", count); return AVERROR_INVALIDDATA;

1 0

swscale/swscale_unscaled: Try to fix Rgb16ToPlanarRgb16Wrapper() with slices
by git＠videolan.org 28 Sep '16

28 Sep '16

ffmpeg | branch: release/3.1 | Michael Niedermayer <michael(a)niedermayer.cc> | Sat Sep 3 12:15:24 2016 +0200| [e91b7852dfae807b1996c30ec77e5bd7eb3a01a1] | committer: Michael Niedermayer swscale/swscale_unscaled: Try to fix Rgb16ToPlanarRgb16Wrapper() with slices Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit e57d99dd4e0d8fe2992da0d65b563580e35ce728) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e91b7852dfae807b1… --- libswscale/swscale_unscaled.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/libswscale/swscale_unscaled.c b/libswscale/swscale_unscaled.c index 8df0694..1f99462 100644 --- a/libswscale/swscale_unscaled.c +++ b/libswscale/swscale_unscaled.c @@ -558,6 +558,8 @@ static int Rgb16ToPlanarRgb16Wrapper(SwsContext *c, const uint8_t *src[], int bpc = dst_format->comp[0].depth; int alpha = src_format->flags & AV_PIX_FMT_FLAG_ALPHA; int swap = 0; + int i; + if ( HAVE_BIGENDIAN && !(src_format->flags & AV_PIX_FMT_FLAG_BE) || !HAVE_BIGENDIAN && src_format->flags & AV_PIX_FMT_FLAG_BE) swap++; @@ -571,6 +573,12 @@ static int Rgb16ToPlanarRgb16Wrapper(SwsContext *c, const uint8_t *src[], src_format->name, dst_format->name); return srcSliceH; } + + for(i=0; i<4; i++) { + dst2013[i] += stride2013[i] * srcSliceY / 2; + dst1023[i] += stride1023[i] * srcSliceY / 2; + } + switch (c->srcFormat) { case AV_PIX_FMT_RGB48LE: case AV_PIX_FMT_RGB48BE:

1 0

swscale/swscale_unscaled: Fix packed_16bpc_bswap() with slices
by git＠videolan.org 28 Sep '16

28 Sep '16

ffmpeg | branch: release/3.1 | Michael Niedermayer <michael(a)niedermayer.cc> | Fri Sep 2 20:25:24 2016 +0200| [5aaf7e31829d624803af4290120bc0fd4c34edd8] | committer: Michael Niedermayer swscale/swscale_unscaled: Fix packed_16bpc_bswap() with slices Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 47bc1bdafb0950ccf128eaa491d8fd7cc0978813) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5aaf7e31829d62480… --- libswscale/swscale_unscaled.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libswscale/swscale_unscaled.c b/libswscale/swscale_unscaled.c index b231abe..8df0694 100644 --- a/libswscale/swscale_unscaled.c +++ b/libswscale/swscale_unscaled.c @@ -352,6 +352,7 @@ static int packed_16bpc_bswap(SwsContext *c, const uint8_t *src[], int min_stride = FFMIN(FFABS(srcstr), FFABS(dststr)); if(!dstPtr || !srcPtr) continue; + dstPtr += (srcSliceY >> c->chrDstVSubSample) * dststr; for (i = 0; i < (srcSliceH >> c->chrDstVSubSample); i++) { for (j = 0; j < min_stride; j++) { dstPtr[j] = av_bswap16(srcPtr[j]);

1 0