September 2016 - ffmpeg-cvslog

avformat/movenc: Check packet in mov_write_single_packet() too
by git＠videolan.org 28 Sep '16

28 Sep '16

ffmpeg | branch: release/3.0 | Michael Niedermayer <michael(a)niedermayer.cc> | Thu Sep 15 23:52:54 2016 +0200| [7fefa4138ddd8b4841459075b5e124b38b3806ee] | committer: Michael Niedermayer avformat/movenc: Check packet in mov_write_single_packet() too Fixes assertion failure Found-by: durandal117 Reviewed-by: Paul B Mahol <onemda(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 28343139330f557e00293933a4697c7d0fc19c56) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7fefa4138ddd8b484… --- libavformat/movenc.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/movenc.c b/libavformat/movenc.c index 6230f30..cdc3a00 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -4650,6 +4650,10 @@ static int mov_write_single_packet(AVFormatContext *s, AVPacket *pkt) int64_t frag_duration = 0; int size = pkt->size; + int ret = check_pkt(s, pkt); + if (ret < 0) + return ret; + if (mov->flags & FF_MOV_FLAG_FRAG_DISCONT) { int i; for (i = 0; i < s->nb_streams; i++)

1 0

avformat/movenc: Factor check_pkt() out
by git＠videolan.org 28 Sep '16

28 Sep '16

ffmpeg | branch: release/3.0 | Michael Niedermayer <michael(a)niedermayer.cc> | Thu Sep 15 23:52:42 2016 +0200| [a1f77124c87614b71745e08194c667fc04eaa07c] | committer: Michael Niedermayer avformat/movenc: Factor check_pkt() out Reviewed-by: Paul B Mahol <onemda(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit deabcd2c05b2b01689d91394bbf3908da17234ed) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a1f77124c87614b71… --- libavformat/movenc.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/libavformat/movenc.c b/libavformat/movenc.c index 4e51cdf..6230f30 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -4342,15 +4342,10 @@ static int mov_auto_flush_fragment(AVFormatContext *s, int force) return ret; } -int ff_mov_write_packet(AVFormatContext *s, AVPacket *pkt) +static int check_pkt(AVFormatContext *s, AVPacket *pkt) { MOVMuxContext *mov = s->priv_data; - AVIOContext *pb = s->pb; MOVTrack *trk = &mov->tracks[pkt->stream_index]; - AVCodecContext *enc = trk->enc; - unsigned int samples_in_chunk = 0; - int size = pkt->size, ret = 0; - uint8_t *reformatted_data = NULL; if (trk->entry) { int64_t duration = pkt->dts - trk->cluster[trk->entry - 1].dts; @@ -4374,6 +4369,23 @@ int ff_mov_write_packet(AVFormatContext *s, AVPacket *pkt) av_log(s, AV_LOG_ERROR, "Application provided duration: %"PRId64" is invalid\n", pkt->duration); return AVERROR(EINVAL); } + return 0; +} + +int ff_mov_write_packet(AVFormatContext *s, AVPacket *pkt) +{ + MOVMuxContext *mov = s->priv_data; + AVIOContext *pb = s->pb; + MOVTrack *trk = &mov->tracks[pkt->stream_index]; + AVCodecContext *enc = trk->enc; + unsigned int samples_in_chunk = 0; + int size = pkt->size, ret = 0; + uint8_t *reformatted_data = NULL; + + ret = check_pkt(s, pkt); + if (ret < 0) + return ret; + if (mov->flags & FF_MOV_FLAG_FRAGMENT) { int ret; if (mov->moov_written || mov->flags & FF_MOV_FLAG_EMPTY_MOOV) {

1 0

avformat/utils: fix timebase error in avformat_seek_file()
by git＠videolan.org 28 Sep '16

28 Sep '16

ffmpeg | branch: release/3.0 | Xinzheng Zhang <zhangxzheng(a)gmail.com> | Wed Sep 14 16:13:45 2016 +0800| [f2f7d49f41b1d4a1ac7d6054c12ce92b4708d4d5] | committer: Michael Niedermayer avformat/utils: fix timebase error in avformat_seek_file() When there is only one stream and stream_index has not specified, The ts has been transferd by the timebase of stream0 without modifying the stream_index In this condation it cause seek failure. Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit ecc04b4f2f29ac676e6c1d1ebf20ec45f5385f1e) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f2f7d49f41b1d4a1a… --- libavformat/utils.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavformat/utils.c b/libavformat/utils.c index 42b617e..c9bc6f2 100644 --- a/libavformat/utils.c +++ b/libavformat/utils.c @@ -2284,6 +2284,7 @@ int avformat_seek_file(AVFormatContext *s, int stream_index, int64_t min_ts, max_ts = av_rescale_rnd(max_ts, time_base.den, time_base.num * (int64_t)AV_TIME_BASE, AV_ROUND_DOWN | AV_ROUND_PASS_MINMAX); + stream_index = 0; } ret = s->iformat->read_seek2(s, stream_index, min_ts,

1 0

avcodec/g726: Add missing ADDB output mask
by git＠videolan.org 28 Sep '16

28 Sep '16

ffmpeg | branch: release/3.0 | Michael Niedermayer <michael(a)niedermayer.cc> | Wed Sep 14 13:06:53 2016 +0200| [9357aa67572ce630267144ecd923c643a0982617] | committer: Michael Niedermayer avcodec/g726: Add missing ADDB output mask Fixes: 1.poc Fixes out of array read Found-by: 连一汉 <lianyihan(a)360.cn> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit a5af1240fce845f645440364c1335e0f8e44ee6c) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9357aa67572ce6302… --- libavcodec/g726.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/g726.c b/libavcodec/g726.c index c3d018f..f3de9e7 100644 --- a/libavcodec/g726.c +++ b/libavcodec/g726.c @@ -206,7 +206,7 @@ static int16_t g726_decode(G726Context* c, int I) if (I_sig) /* get the sign */ dq = -dq; - re_signal = c->se + dq; + re_signal = (int16_t)(c->se + dq); /* Update second order predictor coefficient A2 and A1 */ pk0 = (c->sez + dq) ? sgn(c->sez + dq) : 0;

1 0

avcodec/ccaption_dec: Use simple array instead of AVBuffer
by git＠videolan.org 28 Sep '16

28 Sep '16

ffmpeg | branch: release/3.0 | Michael Niedermayer <michael(a)niedermayer.cc> | Fri Sep 9 10:26:15 2016 +0200| [d669b7f4f6e8bfe4db5501c7f1d95bdae84f1f1f] | committer: Michael Niedermayer avcodec/ccaption_dec: Use simple array instead of AVBuffer This is simpler and fixes an out of array read, fixing it with AVBuffers would be more complex Fixes: e00d9e6e50e5495cc93fea41147b97bb/asan_heap-oob_12dcdbb_8798_b32a97ea722dd37bb5066812cc674552.mov Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 752e6dfa3ea97e7901870bdd9e5a51f860607240) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d669b7f4f6e8bfe4d… --- libavcodec/ccaption_dec.c | 27 +++++++++++---------------- 1 file changed, 11 insertions(+), 16 deletions(-) diff --git a/libavcodec/ccaption_dec.c b/libavcodec/ccaption_dec.c index 790f071..4b42dbc 100644 --- a/libavcodec/ccaption_dec.c +++ b/libavcodec/ccaption_dec.c @@ -135,7 +135,8 @@ typedef struct CCaptionSubContext { int64_t last_real_time; char prev_cmd[2]; /* buffer to store pkt data */ - AVBufferRef *pktbuf; + uint8_t *pktbuf; + int pktbuf_size; } CCaptionSubContext; @@ -160,11 +161,7 @@ static av_cold int init_decoder(AVCodecContext *avctx) if (ret < 0) { return ret; } - /* allocate pkt buffer */ - ctx->pktbuf = av_buffer_alloc(128); - if (!ctx->pktbuf) { - ret = AVERROR(ENOMEM); - } + return ret; } @@ -172,7 +169,8 @@ static av_cold int close_decoder(AVCodecContext *avctx) { CCaptionSubContext *ctx = avctx->priv_data; av_bprint_finalize(&ctx->buffer, NULL); - av_buffer_unref(&ctx->pktbuf); + av_freep(&ctx->pktbuf); + ctx->pktbuf_size = 0; return 0; } @@ -578,16 +576,13 @@ static int decode(AVCodecContext *avctx, void *data, int *got_sub, AVPacket *avp int ret = 0; int i; - if (ctx->pktbuf->size < len) { - ret = av_buffer_realloc(&ctx->pktbuf, len); - if (ret < 0) { - av_log(ctx, AV_LOG_WARNING, "Insufficient Memory of %d truncated to %d\n", len, ctx->pktbuf->size); - len = ctx->pktbuf->size; - ret = 0; - } + av_fast_padded_malloc(&ctx->pktbuf, &ctx->pktbuf_size, len); + if (!ctx->pktbuf) { + av_log(ctx, AV_LOG_WARNING, "Insufficient Memory of %d truncated to %d\n", len, ctx->pktbuf_size); + return AVERROR(ENOMEM); } - memcpy(ctx->pktbuf->data, avpkt->data, len); - bptr = ctx->pktbuf->data; + memcpy(ctx->pktbuf, avpkt->data, len); + bptr = ctx->pktbuf; for (i = 0; i < len; i += 3) { uint8_t cc_type = *(bptr + i) & 3;

1 0

avcodec/avpacket: clear side_data_elems
by git＠videolan.org 28 Sep '16

28 Sep '16

ffmpeg | branch: release/3.0 | Michael Niedermayer <michael(a)niedermayer.cc> | Mon Sep 12 13:13:42 2016 +0200| [26a8fc1c00d58652ebcd5809e76eb5fc9b9e2a44] | committer: Michael Niedermayer avcodec/avpacket: clear side_data_elems Fixes null pointer dereference Found-by: 连一汉 <lianyihan(a)360.cn> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 5e1bf9d8c0d2cdbbf17b06a5dfdf87a635b3203b) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=26a8fc1c00d58652e… --- libavcodec/avpacket.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/libavcodec/avpacket.c b/libavcodec/avpacket.c index b2079f6..6de85de 100644 --- a/libavcodec/avpacket.c +++ b/libavcodec/avpacket.c @@ -184,6 +184,7 @@ static int copy_packet_data(AVPacket *pkt, const AVPacket *src, int dup) { pkt->data = NULL; pkt->side_data = NULL; + pkt->side_data_elems = 0; if (pkt->buf) { AVBufferRef *ref = av_buffer_ref(src->buf); if (!ref) @@ -193,9 +194,11 @@ static int copy_packet_data(AVPacket *pkt, const AVPacket *src, int dup) } else { DUP_DATA(pkt->data, src->data, pkt->size, 1, ALLOC_BUF); } - if (pkt->side_data_elems && dup) + if (src->side_data_elems && dup) { pkt->side_data = src->side_data; - if (pkt->side_data_elems && !dup) { + pkt->side_data_elems = src->side_data_elems; + } + if (src->side_data_elems && !dup) { return av_copy_packet_side_data(pkt, src); } return 0;

1 0

avformat/movenc: Check first DTS similar to dts difference
by git＠videolan.org 28 Sep '16

28 Sep '16

ffmpeg | branch: release/3.0 | Michael Niedermayer <michael(a)niedermayer.cc> | Fri Sep 9 13:11:43 2016 +0200| [b7b3b0086d4e87caa2f8a54d472e20c80ce23369] | committer: Michael Niedermayer avformat/movenc: Check first DTS similar to dts difference Fixes assertion failure Fixes: b84b53855a0b74560e64c6f45f505a13/signal_sigabrt_7ffff6ae7c37_3837_ef4e243ea5b4fa8d0becf4afe9166604.avi Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 68f4c2163ec6d4534ae1756dbcf259845f2e4d2c) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b7b3b0086d4e87caa… --- libavformat/movenc.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavformat/movenc.c b/libavformat/movenc.c index b9c0f7a..4e51cdf 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -4362,6 +4362,13 @@ int ff_mov_write_packet(AVFormatContext *s, AVPacket *pkt) pkt->dts = trk->cluster[trk->entry - 1].dts + 1; pkt->pts = AV_NOPTS_VALUE; } + } else if (pkt->dts <= INT_MIN || pkt->dts >= INT_MAX) { + av_log(s, AV_LOG_ERROR, "Application provided initial timestamp: %"PRId64" is out of range for mov/mp4 format\n", + pkt->dts + ); + + pkt->dts = 0; + pkt->pts = AV_NOPTS_VALUE; } if (pkt->duration < 0 || pkt->duration > INT_MAX) { av_log(s, AV_LOG_ERROR, "Application provided duration: %"PRId64" is invalid\n", pkt->duration);

1 0

avformat/mov: Fix potential integer overflow in mov_read_keys
by git＠videolan.org 28 Sep '16

28 Sep '16

ffmpeg | branch: release/3.0 | Sergey Volk <servolk(a)google.com> | Wed Sep 7 14:05:35 2016 -0700| [9259b7f38e008720096532cd4e666a9889f3c578] | committer: Michael Niedermayer avformat/mov: Fix potential integer overflow in mov_read_keys Actual allocation size is computed as (count + 1)*sizeof(meta_keys), so we need to check that (count + 1) won't cause overflow. Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 347cb14b7cba7560e53f4434b419b9d8800253e7) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9259b7f38e0087200… --- libavformat/mov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index bcba9bb..6b90d08 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -3149,7 +3149,7 @@ static int mov_read_keys(MOVContext *c, AVIOContext *pb, MOVAtom atom) avio_skip(pb, 4); count = avio_rb32(pb); - if (count > UINT_MAX / sizeof(*c->meta_keys)) { + if (count > UINT_MAX / sizeof(*c->meta_keys) - 1) { av_log(c->fc, AV_LOG_ERROR, "The 'keys' atom with the invalid key count: %d\n", count); return AVERROR_INVALIDDATA;

1 0

swscale/swscale_unscaled: Try to fix Rgb16ToPlanarRgb16Wrapper() with slices
by git＠videolan.org 28 Sep '16

28 Sep '16

ffmpeg | branch: release/3.0 | Michael Niedermayer <michael(a)niedermayer.cc> | Sat Sep 3 12:15:24 2016 +0200| [cb8a29f872909aa88f34b1b9b8e4a355af889ee6] | committer: Michael Niedermayer swscale/swscale_unscaled: Try to fix Rgb16ToPlanarRgb16Wrapper() with slices Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit e57d99dd4e0d8fe2992da0d65b563580e35ce728) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cb8a29f872909aa88… --- libswscale/swscale_unscaled.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/libswscale/swscale_unscaled.c b/libswscale/swscale_unscaled.c index 9662a10..b2d1401 100644 --- a/libswscale/swscale_unscaled.c +++ b/libswscale/swscale_unscaled.c @@ -558,6 +558,8 @@ static int Rgb16ToPlanarRgb16Wrapper(SwsContext *c, const uint8_t *src[], int bpc = dst_format->comp[0].depth; int alpha = src_format->flags & AV_PIX_FMT_FLAG_ALPHA; int swap = 0; + int i; + if ( HAVE_BIGENDIAN && !(src_format->flags & AV_PIX_FMT_FLAG_BE) || !HAVE_BIGENDIAN && src_format->flags & AV_PIX_FMT_FLAG_BE) swap++; @@ -571,6 +573,12 @@ static int Rgb16ToPlanarRgb16Wrapper(SwsContext *c, const uint8_t *src[], src_format->name, dst_format->name); return srcSliceH; } + + for(i=0; i<4; i++) { + dst2013[i] += stride2013[i] * srcSliceY / 2; + dst1023[i] += stride1023[i] * srcSliceY / 2; + } + switch (c->srcFormat) { case AV_PIX_FMT_RGB48LE: case AV_PIX_FMT_RGB48BE:

1 0

swscale/swscale_unscaled: Fix packed_16bpc_bswap() with slices
by git＠videolan.org 28 Sep '16

28 Sep '16

ffmpeg | branch: release/3.0 | Michael Niedermayer <michael(a)niedermayer.cc> | Fri Sep 2 20:25:24 2016 +0200| [6744d3f6b953884fd092bd6fc460513e7531defe] | committer: Michael Niedermayer swscale/swscale_unscaled: Fix packed_16bpc_bswap() with slices Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 47bc1bdafb0950ccf128eaa491d8fd7cc0978813) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6744d3f6b953884fd… --- libswscale/swscale_unscaled.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libswscale/swscale_unscaled.c b/libswscale/swscale_unscaled.c index 74f3467..9662a10 100644 --- a/libswscale/swscale_unscaled.c +++ b/libswscale/swscale_unscaled.c @@ -352,6 +352,7 @@ static int packed_16bpc_bswap(SwsContext *c, const uint8_t *src[], int min_stride = FFMIN(FFABS(srcstr), FFABS(dststr)); if(!dstPtr || !srcPtr) continue; + dstPtr += (srcSliceY >> c->chrDstVSubSample) * dststr; for (i = 0; i < (srcSliceH >> c->chrDstVSubSample); i++) { for (j = 0; j < min_stride; j++) { dstPtr[j] = av_bswap16(srcPtr[j]);

1 0