May 2017 - ffmpeg-cvslog - lists.ffmpeg.org

avcodec/wavpack: Fix runtime error: signed integer overflow: 2013265955 - -134217694 cannot be represented in type 'int'
by Michael Niedermayer 31 May '17

31 May '17

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Wed May 31 22:53:02 2017 +0200| [a47273c803edfbc43793349b74429ae29b05c003] | committer: Michael Niedermayer avcodec/wavpack: Fix runtime error: signed integer overflow: 2013265955 - -134217694 cannot be represented in type 'int' Fixes: 1922/clusterfuzz-testcase-minimized-5561194112876544 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a47273c803edfbc43… --- libavcodec/wavpack.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c index 929d9ef979..b216eb0683 100644 --- a/libavcodec/wavpack.c +++ b/libavcodec/wavpack.c @@ -245,7 +245,7 @@ static int wv_get_value(WavpackFrameContext *ctx, GetBitContext *gb, if (get_bits_left(gb) <= 0) goto error; if (get_bits1(gb)) { - add -= (mid - base); + add -= (mid - (unsigned)base); base = mid; } else add = mid - base - 1;

1 0

avcodec/cinepak: Check input packet size before frame reallocation
by Michael Niedermayer 31 May '17

31 May '17

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Wed May 31 22:18:23 2017 +0200| [e47057e932ff9a071d52fa1d5d4a956340eb2475] | committer: Michael Niedermayer avcodec/cinepak: Check input packet size before frame reallocation Reduces time spend decoding 1917/clusterfuzz-testcase-minimized-5023221273329664 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e47057e932ff9a071… --- libavcodec/cinepak.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/cinepak.c b/libavcodec/cinepak.c index d657e9c0c1..89e940ae0d 100644 --- a/libavcodec/cinepak.c +++ b/libavcodec/cinepak.c @@ -322,9 +322,6 @@ static int cinepak_decode (CinepakContext *s) int y0 = 0; int encoded_buf_size; - if (s->size < 10) - return AVERROR_INVALIDDATA; - frame_flags = s->data[0]; num_strips = AV_RB16 (&s->data[8]); encoded_buf_size = AV_RB24(&s->data[1]); @@ -439,6 +436,9 @@ static int cinepak_decode_frame(AVCodecContext *avctx, s->data = buf; s->size = buf_size; + if (s->size < 10) + return AVERROR_INVALIDDATA; + if ((ret = ff_reget_buffer(avctx, s->frame)) < 0) return ret;

1 0

avcodec/hevc_ps: Fix runtime error: signed integer overflow: 2147483628 + 256 cannot be represented in type 'int'
by Michael Niedermayer 31 May '17

31 May '17

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Wed May 31 22:02:07 2017 +0200| [6726328f7940a76c43b4d97ac37ababf363d042f] | committer: Michael Niedermayer avcodec/hevc_ps: Fix runtime error: signed integer overflow: 2147483628 + 256 cannot be represented in type 'int' Fixes: 1909/clusterfuzz-testcase-minimized-6732072662073344 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6726328f7940a76c4… --- libavcodec/hevc_ps.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c index 1808b0b420..656d969ce2 100644 --- a/libavcodec/hevc_ps.c +++ b/libavcodec/hevc_ps.c @@ -751,7 +751,7 @@ static int scaling_list_data(GetBitContext *gb, AVCodecContext *avctx, ScalingLi ff_hevc_diag_scan8x8_x[i]; scaling_list_delta_coef = get_se_golomb(gb); - next_coef = (next_coef + scaling_list_delta_coef + 256) % 256; + next_coef = (next_coef + 256U + scaling_list_delta_coef) % 256; sl->sl[size_id][matrix_id][pos] = next_coef; } }

1 0

avcodec/ra144: Fixes runtime error: signed integer overflow: 7160 * 327138 cannot be represented in type 'int'
by Michael Niedermayer 31 May '17

31 May '17

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Wed May 31 15:52:56 2017 +0200| [08cb69e870c1b2fdc3574780a3662b92bfd6ef79] | committer: Michael Niedermayer avcodec/ra144: Fixes runtime error: signed integer overflow: 7160 * 327138 cannot be represented in type 'int' Fixes: 1908/clusterfuzz-testcase-minimized-5392712477966336 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=08cb69e870c1b2fdc… --- libavcodec/ra144.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/ra144.c b/libavcodec/ra144.c index c869824e35..2ed7361e38 100644 --- a/libavcodec/ra144.c +++ b/libavcodec/ra144.c @@ -1512,7 +1512,7 @@ static void add_wav(int16_t *dest, int n, int skip_first, int *m, v[0] = 0; for (i=!skip_first; i<3; i++) - v[i] = (ff_gain_val_tab[n][i] * m[i]) >> ff_gain_exp_tab[n]; + v[i] = (ff_gain_val_tab[n][i] * (unsigned)m[i]) >> ff_gain_exp_tab[n]; if (v[0]) { for (i=0; i < BLOCKSIZE; i++)

1 0

avcodec/pnm: Use ff_set_dimensions()
by Michael Niedermayer 31 May '17

31 May '17

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Wed May 31 13:39:45 2017 +0200| [a1c0d1d906d27d3f9e1b058bb065f897f90c1c7c] | committer: Michael Niedermayer avcodec/pnm: Use ff_set_dimensions() Fixes: OOM Fixes: 1906/clusterfuzz-testcase-minimized-4599315114754048 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a1c0d1d906d27d3f9… --- libavcodec/pnm.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/libavcodec/pnm.c b/libavcodec/pnm.c index 4753923631..b06a6e81b5 100644 --- a/libavcodec/pnm.c +++ b/libavcodec/pnm.c @@ -24,6 +24,7 @@ #include "libavutil/imgutils.h" #include "avcodec.h" +#include "internal.h" #include "pnm.h" static inline int pnm_space(int c) @@ -61,6 +62,7 @@ int ff_pnm_decode_header(AVCodecContext *avctx, PNMContext * const s) { char buf1[32], tuple_type[32]; int h, w, depth, maxval; + int ret; pnm_get(s, buf1, sizeof(buf1)); if(buf1[0] != 'P') @@ -111,8 +113,9 @@ int ff_pnm_decode_header(AVCodecContext *avctx, PNMContext * const s) av_image_check_size(w, h, 0, avctx) || s->bytestream >= s->bytestream_end) return AVERROR_INVALIDDATA; - avctx->width = w; - avctx->height = h; + ret = ff_set_dimensions(avctx, w, h); + if (ret < 0) + return ret; s->maxval = maxval; if (depth == 1) { if (maxval == 1) { @@ -154,8 +157,9 @@ int ff_pnm_decode_header(AVCodecContext *avctx, PNMContext * const s) if(w <= 0 || h <= 0 || av_image_check_size(w, h, 0, avctx) || s->bytestream >= s->bytestream_end) return AVERROR_INVALIDDATA; - avctx->width = w; - avctx->height = h; + ret = ff_set_dimensions(avctx, w, h); + if (ret < 0) + return ret; if (avctx->pix_fmt != AV_PIX_FMT_MONOWHITE && avctx->pix_fmt != AV_PIX_FMT_MONOBLACK) { pnm_get(s, buf1, sizeof(buf1));

1 0

avcodec/cavsdec: Fix runtime error: signed integer overflow: 59 + 2147483600 cannot be represented in type 'int'
by Michael Niedermayer 31 May '17

31 May '17

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Wed May 31 13:21:58 2017 +0200| [58f8cd4ac576028ef492a005bd06b1f22c3a6879] | committer: Michael Niedermayer avcodec/cavsdec: Fix runtime error: signed integer overflow: 59 + 2147483600 cannot be represented in type 'int' Fixes: 1903/clusterfuzz-testcase-minimized-5359318167715840 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=58f8cd4ac576028ef… --- libavcodec/cavsdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c index 800c1af462..7a5f795dab 100644 --- a/libavcodec/cavsdec.c +++ b/libavcodec/cavsdec.c @@ -615,7 +615,7 @@ static inline int decode_residual_inter(AVSContext *h) /* get quantizer */ if (h->cbp && !h->qp_fixed) - h->qp = (h->qp + get_se_golomb(&h->gb)) & 63; + h->qp = (h->qp + (unsigned)get_se_golomb(&h->gb)) & 63; for (block = 0; block < 4; block++) if (h->cbp & (1 << block)) decode_residual_block(h, &h->gb, inter_dec, 0, h->qp,

1 0

examples/encode_video: slightly improve error reporting
by Stefano Sabatini 31 May '17

31 May '17

ffmpeg | branch: master | Stefano Sabatini <stefasab(a)gmail.com> | Tue May 23 12:22:09 2017 +0200| [ddae6794585405ad59cf1baa855ec3e2f55bb7a1] | committer: Stefano Sabatini examples/encode_video: slightly improve error reporting > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ddae6794585405ad5… --- doc/examples/encode_video.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/doc/examples/encode_video.c b/doc/examples/encode_video.c index 107bea2992..8cd13219bb 100644 --- a/doc/examples/encode_video.c +++ b/doc/examples/encode_video.c @@ -89,7 +89,7 @@ int main(int argc, char **argv) /* find the mpeg1video encoder */ codec = avcodec_find_encoder_by_name(codec_name); if (!codec) { - fprintf(stderr, "Codec not found\n"); + fprintf(stderr, "Codec '%s' not found\n", codec_name); exit(1); } @@ -126,8 +126,9 @@ int main(int argc, char **argv) av_opt_set(c->priv_data, "preset", "slow", 0); /* open it */ - if (avcodec_open2(c, codec, NULL) < 0) { - fprintf(stderr, "Could not open codec\n"); + ret = avcodec_open2(c, codec, NULL); + if (ret < 0) { + fprintf(stderr, "Could not open codec: %s\n", av_err2str(ret)); exit(1); }

1 0

examples/encode_video: add log
by Stefano Sabatini 31 May '17

31 May '17

ffmpeg | branch: master | Stefano Sabatini <stefasab(a)gmail.com> | Tue May 23 11:50:40 2017 +0200| [002dbc5a1f2a6008acd29bd7cfa6733a745224bf] | committer: Stefano Sabatini examples/encode_video: add log This helps to visualize how the send/receive API works. > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=002dbc5a1f2a6008a… --- doc/examples/encode_video.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/doc/examples/encode_video.c b/doc/examples/encode_video.c index d2075c12bf..107bea2992 100644 --- a/doc/examples/encode_video.c +++ b/doc/examples/encode_video.c @@ -42,6 +42,9 @@ static void encode(AVCodecContext *enc_ctx, AVFrame *frame, AVPacket *pkt, int ret; /* send the frame to the encoder */ + if (frame) + printf("Send frame %3"PRId64"\n", frame->pts); + ret = avcodec_send_frame(enc_ctx, frame); if (ret < 0) { fprintf(stderr, "Error sending a frame for encoding\n"); @@ -57,7 +60,7 @@ static void encode(AVCodecContext *enc_ctx, AVFrame *frame, AVPacket *pkt, exit(1); } - printf("Write frame %3"PRId64" (size=%5d)\n", pkt->pts, pkt->size); + printf("Write packet %3"PRId64" (size=%5d)\n", pkt->pts, pkt->size); fwrite(pkt->data, 1, pkt->size, outfile); av_packet_unref(pkt); }

1 0

configure: Fix the msvcrt version check for mingw32
by Martin Storsjö 31 May '17

31 May '17

ffmpeg | branch: release/3.3 | Martin Storsjö <martin(a)martin.st> | Wed May 31 12:53:32 2017 +0300| [1cbeb16187c87655e1affaae075a9646aeb465e6] | committer: Hendrik Leppkes configure: Fix the msvcrt version check for mingw32 This was actually broken when committed in 46e3936fb04; the test never succeeded, and thus, _aligned_malloc wasn't actually used on legacy mingw. Signed-off-by: Martin Storsjö <martin(a)martin.st> (cherry picked from commit 427f7a1f9ec1977bcb57cb4d6e6f7228dc1e858b) > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1cbeb16187c87655e… --- configure | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure b/configure index 9b5789ab83..23823e3b70 100755 --- a/configure +++ b/configure @@ -5067,7 +5067,7 @@ probe_libc(){ add_${pfx}cppflags -U__STRICT_ANSI__ -D__USE_MINGW_ANSI_STDIO=1 check_${pfx}cpp_condition _mingw.h "defined(_WIN32_WINNT) && _WIN32_WINNT >= 0x0502" || add_${pfx}cppflags -D_WIN32_WINNT=0x0502 - check_${pfx}cpp_condition _mingw.h "__MSVCRT_VERSION__ < 0x0700__" && + check_${pfx}cpp_condition _mingw.h "__MSVCRT_VERSION__ < 0x0700" && add_${pfx}cppflags -D__MSVCRT_VERSION__=0x0700 eval test \$${pfx_no_}cc_type = "gcc" && add_${pfx}cppflags -D__printf__=__gnu_printf__

1 0

configure: Fix the msvcrt version check for mingw32
by Martin Storsjö 31 May '17

31 May '17

ffmpeg | branch: master | Martin Storsjö <martin(a)martin.st> | Wed May 31 12:53:32 2017 +0300| [47c43ce36f0c48b800b5367674839c16f10dc597] | committer: Hendrik Leppkes configure: Fix the msvcrt version check for mingw32 This was actually broken when committed in 46e3936fb04; the test never succeeded, and thus, _aligned_malloc wasn't actually used on legacy mingw. Signed-off-by: Martin Storsjö <martin(a)martin.st> (cherry picked from commit 427f7a1f9ec1977bcb57cb4d6e6f7228dc1e858b) > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=47c43ce36f0c48b80… --- configure | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure b/configure index 18464b3967..40eb2bbeb0 100755 --- a/configure +++ b/configure @@ -5082,7 +5082,7 @@ probe_libc(){ add_${pfx}cppflags -U__STRICT_ANSI__ -D__USE_MINGW_ANSI_STDIO=1 check_${pfx}cpp_condition _mingw.h "defined(_WIN32_WINNT) && _WIN32_WINNT >= 0x0502" || add_${pfx}cppflags -D_WIN32_WINNT=0x0502 - check_${pfx}cpp_condition _mingw.h "__MSVCRT_VERSION__ < 0x0700__" && + check_${pfx}cpp_condition _mingw.h "__MSVCRT_VERSION__ < 0x0700" && add_${pfx}cppflags -D__MSVCRT_VERSION__=0x0700 eval test \$${pfx_no_}cc_type = "gcc" && add_${pfx}cppflags -D__printf__=__gnu_printf__

1 0