February 2017 - ffmpeg-cvslog

lavf/matroskadec: Fix demuxing sipr.
by git＠videolan.org 28 Feb '17

28 Feb '17

ffmpeg | branch: master | Carl Eugen Hoyos <cehoyos(a)ag.or.at> | Tue Feb 28 21:51:26 2017 +0100| [b8a7dcbde2e1ed99bf07a83b1ddf47d7895360ad] | committer: Carl Eugen Hoyos lavf/matroskadec: Fix demuxing sipr. Regression since 2c8d876d > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b8a7dcbde2e1ed99b… --- libavformat/matroskadec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index 7223e94..11265fb 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -2289,7 +2289,7 @@ static int matroska_parse_tracks(AVFormatContext *s) track->audio.coded_framesize <= 0 || track->audio.sub_packet_h <= 0 || track->audio.frame_size <= 0 || - track->audio.sub_packet_size <= 0) + track->audio.sub_packet_size <= 0 && codec_id != AV_CODEC_ID_SIPR) return AVERROR_INVALIDDATA; track->audio.buf = av_malloc_array(track->audio.sub_packet_h, track->audio.frame_size);

1 0

MAINTAINERS: Make formating of ffmpeg-security entry the same as others
by git＠videolan.org 28 Feb '17

28 Feb '17

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Thu Feb 23 17:34:40 2017 +0100| [3d66eb6ec3336c28d2ad074f2f09fbbe53eb288a] | committer: Michael Niedermayer MAINTAINERS: Make formating of ffmpeg-security entry the same as others Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3d66eb6ec3336c28d… --- MAINTAINERS | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/MAINTAINERS b/MAINTAINERS index 9c12fec..db55346 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -60,11 +60,7 @@ mailing lists Baptiste Coudurier, Lou Logan Google+ Paul B Mahol, Michael Niedermayer, Alexander Strasser Twitter Lou Logan, Reynaldo H. Verdejo Pinochet Launchpad Timothy Gu -ffmpeg-security Andreas Cadhalpun - Carl Eugen Hoyos - Clément Bœsch - Michael Niedermayer - Reimar Doeffinger +ffmpeg-security Andreas Cadhalpun, Carl Eugen Hoyos, Clément Bœsch, Michael Niedermayer, Reimar Doeffinger libavutil

1 0

MAINTAINERS: add wm4 to ffmpeg-security
by git＠videolan.org 28 Feb '17

28 Feb '17

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Thu Feb 23 17:34:41 2017 +0100| [4f218682071c956a29e386237ff1f2545aee54df] | committer: Michael Niedermayer MAINTAINERS: add wm4 to ffmpeg-security wm4 will be added to the ffmpeg-security alias when this patch is applied Reviewed-by: Paul B Mahol <onemda(a)gmail.com> Reviewed-by: Clément Bœsch <u(a)pkh.me> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4f218682071c956a2… --- MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/MAINTAINERS b/MAINTAINERS index db55346..e39cf88 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -60,7 +60,7 @@ mailing lists Baptiste Coudurier, Lou Logan Google+ Paul B Mahol, Michael Niedermayer, Alexander Strasser Twitter Lou Logan, Reynaldo H. Verdejo Pinochet Launchpad Timothy Gu -ffmpeg-security Andreas Cadhalpun, Carl Eugen Hoyos, Clément Bœsch, Michael Niedermayer, Reimar Doeffinger +ffmpeg-security Andreas Cadhalpun, Carl Eugen Hoyos, Clément Bœsch, Michael Niedermayer, Reimar Doeffinger, wm4 libavutil

1 0

MAINTAINERS: Add Rodger Combs to ffmpeg-security
by git＠videolan.org 28 Feb '17

28 Feb '17

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Thu Feb 23 17:34:42 2017 +0100| [7f62368bacdbf6fdc769876f5e4ad5a18afb46ef] | committer: Michael Niedermayer MAINTAINERS: Add Rodger Combs to ffmpeg-security Rodger Combs will be added to the ffmpeg-security alias when this patch is applied Reviewed-by: Paul B Mahol <onemda(a)gmail.com> Reviewed-by: Clément Bœsch <u(a)pkh.me> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7f62368bacdbf6fdc… --- MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/MAINTAINERS b/MAINTAINERS index e39cf88..6b17b13 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -60,7 +60,7 @@ mailing lists Baptiste Coudurier, Lou Logan Google+ Paul B Mahol, Michael Niedermayer, Alexander Strasser Twitter Lou Logan, Reynaldo H. Verdejo Pinochet Launchpad Timothy Gu -ffmpeg-security Andreas Cadhalpun, Carl Eugen Hoyos, Clément Bœsch, Michael Niedermayer, Reimar Doeffinger, wm4 +ffmpeg-security Andreas Cadhalpun, Carl Eugen Hoyos, Clément Bœsch, Michael Niedermayer, Reimar Doeffinger, Rodger Combs, wm4 libavutil

1 0

avcodec/vp56: Factorize vp56_render_mb() out
by git＠videolan.org 28 Feb '17

28 Feb '17

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sat Feb 25 21:07:22 2017 +0100| [4c0139463c8f0a6f28e7b193c2a85608a7635bbd] | committer: Michael Niedermayer avcodec/vp56: Factorize vp56_render_mb() out Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4c0139463c8f0a6f2… --- libavcodec/vp56.c | 77 +++++++++++++++++-------------------------------------- 1 file changed, 23 insertions(+), 54 deletions(-) diff --git a/libavcodec/vp56.c b/libavcodec/vp56.c index b36c99f..a9a1a0c 100644 --- a/libavcodec/vp56.c +++ b/libavcodec/vp56.c @@ -400,30 +400,18 @@ static void vp56_mc(VP56Context *s, int b, int plane, uint8_t *src, } } -static int vp56_decode_mb(VP56Context *s, int row, int col, int is_alpha) +static av_always_inline void vp56_render_mb(VP56Context *s, int row, int col, int is_alpha, VP56mb mb_type) { - AVFrame *frame_current, *frame_ref; - VP56mb mb_type; - VP56Frame ref_frame; int b, ab, b_max, plane, off; - int ret; - - if (s->frames[VP56_FRAME_CURRENT]->key_frame) - mb_type = VP56_MB_INTRA; - else - mb_type = vp56_decode_mv(s, row, col); - ref_frame = ff_vp56_reference_frame[mb_type]; - - ret = s->parse_coeff(s); - if (ret < 0) - return ret; + AVFrame *frame_current, *frame_ref; + VP56Frame ref_frame = ff_vp56_reference_frame[mb_type]; vp56_add_predictors_dc(s, ref_frame); frame_current = s->frames[VP56_FRAME_CURRENT]; frame_ref = s->frames[ref_frame]; if (mb_type != VP56_MB_INTRA && !frame_ref->data[0]) - return 0; + return; ab = 6*is_alpha; b_max = 6 - 2*is_alpha; @@ -473,57 +461,38 @@ static int vp56_decode_mb(VP56Context *s, int row, int col, int is_alpha) s->block_coeff[4][0] = 0; s->block_coeff[5][0] = 0; } - return 0; } -static int vp56_conceal_mb(VP56Context *s, int row, int col, int is_alpha) +static int vp56_decode_mb(VP56Context *s, int row, int col, int is_alpha) { - AVFrame *frame_current, *frame_ref; VP56mb mb_type; - VP56Frame ref_frame; - int b, ab, b_max, plane, off; + int ret; if (s->frames[VP56_FRAME_CURRENT]->key_frame) mb_type = VP56_MB_INTRA; else - mb_type = vp56_conceal_mv(s, row, col); - ref_frame = ff_vp56_reference_frame[mb_type]; + mb_type = vp56_decode_mv(s, row, col); - frame_current = s->frames[VP56_FRAME_CURRENT]; - frame_ref = s->frames[ref_frame]; - if (mb_type != VP56_MB_INTRA && !frame_ref->data[0]) - return 0; + ret = s->parse_coeff(s); + if (ret < 0) + return ret; - ab = 6*is_alpha; - b_max = 6 - 2*is_alpha; + vp56_render_mb(s, row, col, is_alpha, mb_type); - switch (mb_type) { - case VP56_MB_INTRA: - for (b=0; b<b_max; b++) { - plane = ff_vp56_b2p[b+ab]; - s->vp3dsp.idct_put(frame_current->data[plane] + s->block_offset[b], - s->stride[plane], s->block_coeff[b]); - } - break; + return 0; +} - case VP56_MB_INTER_NOVEC_PF: - case VP56_MB_INTER_NOVEC_GF: - for (b=0; b<b_max; b++) { - plane = ff_vp56_b2p[b+ab]; - off = s->block_offset[b]; - s->hdsp.put_pixels_tab[1][0](frame_current->data[plane] + off, - frame_ref->data[plane] + off, - s->stride[plane], 8); - s->vp3dsp.idct_add(frame_current->data[plane] + off, - s->stride[plane], s->block_coeff[b]); - } - break; - } +static int vp56_conceal_mb(VP56Context *s, int row, int col, int is_alpha) +{ + VP56mb mb_type; + + if (s->frames[VP56_FRAME_CURRENT]->key_frame) + mb_type = VP56_MB_INTRA; + else + mb_type = vp56_conceal_mv(s, row, col); + + vp56_render_mb(s, row, col, is_alpha, mb_type); - if (is_alpha) { - s->block_coeff[4][0] = 0; - s->block_coeff[5][0] = 0; - } return 0; }

1 0

avcodec/dca: Fix multiple runtime error: signed integer overflow
by git＠videolan.org 28 Feb '17

28 Feb '17

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Feb 26 20:28:02 2017 +0100| [949d2176ef0a37c6ecbb65be0f1199536a2d9278] | committer: Michael Niedermayer avcodec/dca: Fix multiple runtime error: signed integer overflow Fixes: 680/clusterfuzz-testcase-5416627266912256 Fixes: 681/clusterfuzz-testcase-5013323462475776 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=949d2176ef0a37c6e… --- libavcodec/dca_xll.c | 4 ++-- libavcodec/dcadsp.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/dca_xll.c b/libavcodec/dca_xll.c index 3dfde6b..6cebda3 100644 --- a/libavcodec/dca_xll.c +++ b/libavcodec/dca_xll.c @@ -652,7 +652,7 @@ static void chs_filter_band_data(DCAXllDecoder *s, DCAXllChSet *c, int band) int64_t err = 0; for (k = 0; k < order; k++) err += (int64_t)buf[j + k] * coeff[order - k - 1]; - buf[j + k] -= clip23(norm16(err)); + buf[j + k] -= (SUINT)clip23(norm16(err)); } } else { // Inverse fixed coefficient prediction @@ -1308,7 +1308,7 @@ static int combine_residual_frame(DCAXllDecoder *s, DCAXllChSet *c) // Undo embedded core downmix pre-scaling int scale_inv = o->dmix_scale_inv[c->hier_ofs + ch]; for (n = 0; n < nsamples; n++) - dst[n] += clip23((mul16(src[n], scale_inv) + round) >> shift); + dst[n] += (SUINT)clip23((mul16(src[n], scale_inv) + round) >> shift); } else { // No downmix scaling for (n = 0; n < nsamples; n++) diff --git a/libavcodec/dcadsp.c b/libavcodec/dcadsp.c index 3d637f6..1503d00 100644 --- a/libavcodec/dcadsp.c +++ b/libavcodec/dcadsp.c @@ -300,7 +300,7 @@ static void decor_c(int32_t *dst, const int32_t *src, int coeff, ptrdiff_t len) int i; for (i = 0; i < len; i++) - dst[i] += (int)(src[i] * (SUINT)coeff + (1 << 2)) >> 3; + dst[i] += (SUINT)((int)(src[i] * (SUINT)coeff + (1 << 2)) >> 3); } static void dmix_sub_xch_c(int32_t *dst1, int32_t *dst2,

1 0

avcodec/pictordec: Check plane value before doing value/mask computations
by git＠videolan.org 28 Feb '17

28 Feb '17

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Feb 26 20:28:00 2017 +0100| [63e400a8807dca7b0ffa3841df2e31f7419abb8d] | committer: Michael Niedermayer avcodec/pictordec: Check plane value before doing value/mask computations Fixes integer overflow Fixes: 675/clusterfuzz-testcase-6722971232108544 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=63e400a8807dca7b0… --- libavcodec/pictordec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/pictordec.c b/libavcodec/pictordec.c index a3d72e3..a09ee37 100644 --- a/libavcodec/pictordec.c +++ b/libavcodec/pictordec.c @@ -77,10 +77,10 @@ static void picmemset(PicContext *s, AVFrame *frame, int value, int run, if (*y < 0) { *y = s->height - 1; *plane += 1; - value <<= bits_per_plane; - mask <<= bits_per_plane; if (*plane >= s->nb_planes) return; + value <<= bits_per_plane; + mask <<= bits_per_plane; } } }

1 0

avcodec/mpeg4videodec: Fix runtime error: left shift of negative value -2650
by git＠videolan.org 28 Feb '17

28 Feb '17

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Feb 26 20:27:59 2017 +0100| [25e93aacc2142f3b57f1e63c67ca46d304f154ef] | committer: Michael Niedermayer avcodec/mpeg4videodec: Fix runtime error: left shift of negative value -2650 Fixes: 674/clusterfuzz-testcase-6713275880308736 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=25e93aacc2142f3b5… --- libavcodec/mpeg4videodec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c index dac9538..9f9374d 100644 --- a/libavcodec/mpeg4videodec.c +++ b/libavcodec/mpeg4videodec.c @@ -283,12 +283,12 @@ static int mpeg4_decode_sprite_trajectory(Mpeg4DecContext *ctx, GetBitContext *g ctx->sprite_shift[1] = 0; break; case 2: - s->sprite_offset[0][0] = (sprite_ref[0][0] << (alpha + rho)) + + s->sprite_offset[0][0] = (sprite_ref[0][0] * (1 << alpha + rho)) + (-r * sprite_ref[0][0] + virtual_ref[0][0]) * (-vop_ref[0][0]) + (r * sprite_ref[0][1] - virtual_ref[0][1]) * (-vop_ref[0][1]) + (1 << (alpha + rho - 1)); - s->sprite_offset[0][1] = (sprite_ref[0][1] << (alpha + rho)) + + s->sprite_offset[0][1] = (sprite_ref[0][1] * (1 << alpha + rho)) + (-r * sprite_ref[0][1] + virtual_ref[0][1]) * (-vop_ref[0][0]) + (-r * sprite_ref[0][0] + virtual_ref[0][0]) *

1 0

avcodec/h264idct_template: Fix multiple runtime error: signed integer overflow
by git＠videolan.org 28 Feb '17

28 Feb '17

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Feb 26 20:28:01 2017 +0100| [4ea7744859dc3d214ef13e920f5d07b070920e3f] | committer: Michael Niedermayer avcodec/h264idct_template: Fix multiple runtime error: signed integer overflow Fixes: 677/clusterfuzz-testcase-6635120628858880 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Reviewed-by: Steven Liu <lingjiujianke(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4ea7744859dc3d214… --- libavcodec/h264idct_template.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/libavcodec/h264idct_template.c b/libavcodec/h264idct_template.c index c00900b..9c5a43c 100644 --- a/libavcodec/h264idct_template.c +++ b/libavcodec/h264idct_template.c @@ -40,10 +40,10 @@ void FUNCC(ff_h264_idct_add)(uint8_t *_dst, int16_t *_block, int stride) block[0] += 1 << 5; for(i=0; i<4; i++){ - const int z0= block[i + 4*0] + block[i + 4*2]; - const int z1= block[i + 4*0] - block[i + 4*2]; - const int z2= (block[i + 4*1]>>1) - block[i + 4*3]; - const int z3= block[i + 4*1] + (block[i + 4*3]>>1); + const SUINT z0= block[i + 4*0] + block[i + 4*2]; + const SUINT z1= block[i + 4*0] - block[i + 4*2]; + const SUINT z2= (block[i + 4*1]>>1) - block[i + 4*3]; + const SUINT z3= block[i + 4*1] + (block[i + 4*3]>>1); block[i + 4*0]= z0 + z3; block[i + 4*1]= z1 + z2; @@ -52,15 +52,15 @@ void FUNCC(ff_h264_idct_add)(uint8_t *_dst, int16_t *_block, int stride) } for(i=0; i<4; i++){ - const int z0= block[0 + 4*i] + block[2 + 4*i]; - const int z1= block[0 + 4*i] - block[2 + 4*i]; - const int z2= (block[1 + 4*i]>>1) - block[3 + 4*i]; - const int z3= block[1 + 4*i] + (block[3 + 4*i]>>1); - - dst[i + 0*stride]= av_clip_pixel(dst[i + 0*stride] + ((z0 + z3) >> 6)); - dst[i + 1*stride]= av_clip_pixel(dst[i + 1*stride] + ((z1 + z2) >> 6)); - dst[i + 2*stride]= av_clip_pixel(dst[i + 2*stride] + ((z1 - z2) >> 6)); - dst[i + 3*stride]= av_clip_pixel(dst[i + 3*stride] + ((z0 - z3) >> 6)); + const SUINT z0= block[0 + 4*i] + (SUINT)block[2 + 4*i]; + const SUINT z1= block[0 + 4*i] - (SUINT)block[2 + 4*i]; + const SUINT z2= (block[1 + 4*i]>>1) - (SUINT)block[3 + 4*i]; + const SUINT z3= block[1 + 4*i] + (SUINT)(block[3 + 4*i]>>1); + + dst[i + 0*stride]= av_clip_pixel(dst[i + 0*stride] + ((int)(z0 + z3) >> 6)); + dst[i + 1*stride]= av_clip_pixel(dst[i + 1*stride] + ((int)(z1 + z2) >> 6)); + dst[i + 2*stride]= av_clip_pixel(dst[i + 2*stride] + ((int)(z1 - z2) >> 6)); + dst[i + 3*stride]= av_clip_pixel(dst[i + 3*stride] + ((int)(z0 - z3) >> 6)); } memset(block, 0, 16 * sizeof(dctcoef));

1 0

avcodec/qdrw: check bytes per scanline for 2bpp images
by git＠videolan.org 27 Feb '17

27 Feb '17

ffmpeg | branch: master | Paul B Mahol <onemda(a)gmail.com> | Mon Feb 27 14:15:11 2017 +0100| [26a7d6a301b9b6c67153c87d42db145cdc0e57cf] | committer: Paul B Mahol avcodec/qdrw: check bytes per scanline for 2bpp images One byte less is read in case of small width. Closes #6194. Signed-off-by: Paul B Mahol <onemda(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=26a7d6a301b9b6c67… --- libavcodec/qdrw.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavcodec/qdrw.c b/libavcodec/qdrw.c index 20e673a..c92cd85 100644 --- a/libavcodec/qdrw.c +++ b/libavcodec/qdrw.c @@ -81,7 +81,10 @@ static int decode_rle_bpp2(AVCodecContext *avctx, AVFrame *p, GetByteContext *gb int pos = 0; /* size of packed line */ - size = left = bytestream2_get_be16(gbc); + if (offset / 4 > 200) + size = left = bytestream2_get_be16(gbc); + else + size = left = bytestream2_get_byte(gbc); if (bytestream2_get_bytes_left(gbc) < size) return AVERROR_INVALIDDATA;

1 0