November 2018 - ffmpeg-cvslog

avcodec/diracdec: Check slice numbers for overflows in relation to picture dimensions
by Michael Niedermayer 01 Nov '18

01 Nov '18

ffmpeg | branch: release/3.3 | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Jul 22 21:26:24 2018 +0200| [c07d568603d33fe3d3c38d888da859f202299382] | committer: Michael Niedermayer avcodec/diracdec: Check slice numbers for overflows in relation to picture dimensions Fixes: signed integer overflow: 88 * 33685506 cannot be represented in type 'int' Fixes: 9433/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5725943535501312 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit f457c0ad7f73e31e99761f2ad3738cf3b3c24ca0) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c07d568603d33fe3d… --- libavcodec/diracdec.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavcodec/diracdec.c b/libavcodec/diracdec.c index eeaa8f4498..5a4877386b 100644 --- a/libavcodec/diracdec.c +++ b/libavcodec/diracdec.c @@ -1242,7 +1242,10 @@ static int dirac_unpack_idwt_params(DiracContext *s) else { s->num_x = get_interleaved_ue_golomb(gb); s->num_y = get_interleaved_ue_golomb(gb); - if (s->num_x * s->num_y == 0 || s->num_x * (uint64_t)s->num_y > INT_MAX) { + if (s->num_x * s->num_y == 0 || s->num_x * (uint64_t)s->num_y > INT_MAX || + s->num_x * (uint64_t)s->avctx->width > INT_MAX || + s->num_y * (uint64_t)s->avctx->height > INT_MAX + ) { av_log(s->avctx,AV_LOG_ERROR,"Invalid numx/y\n"); s->num_x = s->num_y = 0; return AVERROR_INVALIDDATA;

1 0

avcodec/diracdec: Change frame_number to 64bit as its a 32bit from the bitstream and we also have a -1 special case
by Michael Niedermayer 01 Nov '18

01 Nov '18

ffmpeg | branch: release/3.3 | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Jul 22 20:45:39 2018 +0200| [ee5b42ce2f2f45a28d12643cf86538f7a7535d47] | committer: Michael Niedermayer avcodec/diracdec: Change frame_number to 64bit as its a 32bit from the bitstream and we also have a -1 special case Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int' Fixes: 9291/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-6324345860259840 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 462d1be6dec5ff4768be8c202f359cbf037db3c6) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ee5b42ce2f2f45a28… --- libavcodec/diracdec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/diracdec.c b/libavcodec/diracdec.c index 5d63464f6c..eeaa8f4498 100644 --- a/libavcodec/diracdec.c +++ b/libavcodec/diracdec.c @@ -140,7 +140,7 @@ typedef struct DiracContext { GetBitContext gb; AVDiracSeqHeader seq; int seen_sequence_header; - int frame_number; /* number of the next frame to display */ + int64_t frame_number; /* number of the next frame to display */ Plane plane[3]; int chroma_x_shift; int chroma_y_shift; @@ -2300,7 +2300,7 @@ static int dirac_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, } if (*got_frame) - s->frame_number = picture->display_picture_number + 1; + s->frame_number = picture->display_picture_number + 1LL; return buf_idx; }

1 0

avcodec/dirac_dwt_template: Fix several integer overflows in horizontal_compose_daub97i()
by Michael Niedermayer 01 Nov '18

01 Nov '18

ffmpeg | branch: release/3.3 | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Jul 22 19:11:04 2018 +0200| [d5c48e8536d007a0cfdaf3e7cd5ab428db948374] | committer: Michael Niedermayer avcodec/dirac_dwt_template: Fix several integer overflows in horizontal_compose_daub97i() Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int' Fixes: 8926/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-6047609228623872 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 69cac9e130dc8c9d2a5b8012011df372974adf35) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d5c48e8536d007a0c… --- libavcodec/dirac_dwt_template.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavcodec/dirac_dwt_template.c b/libavcodec/dirac_dwt_template.c index 2369c8d15b..5d55d932a1 100644 --- a/libavcodec/dirac_dwt_template.c +++ b/libavcodec/dirac_dwt_template.c @@ -190,15 +190,15 @@ static void RENAME(horizontal_compose_daub97i)(uint8_t *_b, uint8_t *_temp, int // second stage combined with interleave and shift b0 = b2 = COMPOSE_DAUB97iL0(temp[w2], temp[0], temp[w2]); - b[0] = (b0 + 1) >> 1; + b[0] = ~((~b0) >> 1); for (x = 1; x < w2; x++) { b2 = COMPOSE_DAUB97iL0(temp[x+w2-1], temp[x ], temp[x+w2]); b1 = COMPOSE_DAUB97iH0( b0, temp[x+w2-1], b2 ); - b[2*x-1] = (b1 + 1) >> 1; - b[2*x ] = (b2 + 1) >> 1; + b[2*x-1] = ~((~b1) >> 1); + b[2*x ] = ~((~b2) >> 1); b0 = b2; } - b[w-1] = (COMPOSE_DAUB97iH0(b2, temp[w-1], b2) + 1) >> 1; + b[w-1] = ~((~COMPOSE_DAUB97iH0(b2, temp[w-1], b2)) >> 1); } static void RENAME(vertical_compose_dirac53iH0)(uint8_t *_b0, uint8_t *_b1, uint8_t *_b2,

1 0

avcodec/diracdec: Prevent integer overflow in intermediate in global_mv()
by Michael Niedermayer 01 Nov '18

01 Nov '18

ffmpeg | branch: release/3.3 | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Jul 22 18:58:34 2018 +0200| [922a29142e77221f685e875e14435abf7a691f5c] | committer: Michael Niedermayer avcodec/diracdec: Prevent integer overflow in intermediate in global_mv() Fixes: signed integer overflow: -393471 * 5460 cannot be represented in type 'int' Fixes: 8890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-6299775379963904 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 51290406461ed40b70e0e05b389a461a283f3367) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=922a29142e77221f6… --- libavcodec/diracdec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/diracdec.c b/libavcodec/diracdec.c index fee2b7787c..5d63464f6c 100644 --- a/libavcodec/diracdec.c +++ b/libavcodec/diracdec.c @@ -1399,8 +1399,8 @@ static void global_mv(DiracContext *s, DiracBlock *block, int x, int y, int ref) int *c = s->globalmc[ref].perspective; int m = (1<<ep) - (c[0]*x + c[1]*y); - int64_t mx = m * (int64_t)((A[0][0] * x + A[0][1]*y) + (1<<ez) * b[0]); - int64_t my = m * (int64_t)((A[1][0] * x + A[1][1]*y) + (1<<ez) * b[1]); + int64_t mx = m * (int64_t)((A[0][0] * (int64_t)x + A[0][1]*(int64_t)y) + (1<<ez) * b[0]); + int64_t my = m * (int64_t)((A[1][0] * (int64_t)x + A[1][1]*(int64_t)y) + (1<<ez) * b[1]); block->u.mv[ref][0] = (mx + (1<<(ez+ep))) >> (ez+ep); block->u.mv[ref][1] = (my + (1<<(ez+ep))) >> (ez+ep);

1 0

swresample/swresample: Fix input channel count in resample_first computation
by Michael Niedermayer 01 Nov '18

01 Nov '18

ffmpeg | branch: release/3.3 | Michael Niedermayer <michael(a)niedermayer.cc> | Tue Jul 24 22:44:12 2018 +0200| [31262860ccd33b704a31f945fa1b9442b4e328c7] | committer: Michael Niedermayer swresample/swresample: Fix input channel count in resample_first computation Found-by: Marcin Gorzel <gorzel(a)google.com> Reviewed-by: Marcin Gorzel <gorzel(a)google.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit bce4da85e8110b66040a5fb07ffc724ab4e09a86) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=31262860ccd33b704… --- libswresample/swresample.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libswresample/swresample.c b/libswresample/swresample.c index 170f76bc56..c740f5d5fd 100644 --- a/libswresample/swresample.c +++ b/libswresample/swresample.c @@ -318,7 +318,7 @@ av_cold int swr_init(struct SwrContext *s){ av_assert0(s->used_ch_count); av_assert0(s->out.ch_count); - s->resample_first= RSC*s->out.ch_count/s->in.ch_count - RSC < s->out_sample_rate/(float)s-> in_sample_rate - 1.0; + s->resample_first= RSC*s->out.ch_count/s->used_ch_count - RSC < s->out_sample_rate/(float)s-> in_sample_rate - 1.0; s->in_buffer= s->in; s->silence = s->in;

1 0

avutil/pixfmt: Document chroma plane size for odd resolutions
by Michael Niedermayer 01 Nov '18

01 Nov '18

ffmpeg | branch: release/3.3 | Michael Niedermayer <michael(a)niedermayer.cc> | Wed Jul 18 22:22:35 2018 +0200| [ea160f02137e515a7909b73eba172da008af614a] | committer: Michael Niedermayer avutil/pixfmt: Document chroma plane size for odd resolutions Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit be0b77e6e83b61c2da338201b5ddfae1c9acedc5) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ea160f02137e515a7… --- libavutil/pixfmt.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavutil/pixfmt.h b/libavutil/pixfmt.h index 5dafc341a1..926bf5ae43 100644 --- a/libavutil/pixfmt.h +++ b/libavutil/pixfmt.h @@ -42,6 +42,10 @@ * This is stored as BGRA on little-endian CPU architectures and ARGB on * big-endian CPUs. * + * @note + * If the resolution is not a multiple of the chroma subsampling factor + * then the chroma plane resolution must be rounded up. + * * @par * When the pixel format is palettized RGB32 (AV_PIX_FMT_PAL8), the palettized * image data is stored in AVFrame.data[0]. The palette is transported in

1 0

avcodec/vdpau: Initialise driver version variable explicitly
by Philip Langdale 01 Nov '18

01 Nov '18

ffmpeg | branch: master | Philip Langdale <philipl(a)overt.org> | Wed Oct 31 16:58:09 2018 -0700| [4a976200d7853588336005a394dd31d905f5caf6] | committer: Philip Langdale avcodec/vdpau: Initialise driver version variable explicitly If the identification string ever changed, we might not match anything in the sscanf(). At least have predictable behaviour. > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4a976200d78535883… --- libavcodec/vdpau.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/vdpau.c b/libavcodec/vdpau.c index 59454e8c4b..167f06d7ae 100644 --- a/libavcodec/vdpau.c +++ b/libavcodec/vdpau.c @@ -208,7 +208,7 @@ int ff_vdpau_common_init(AVCodecContext *avctx, VdpDecoderProfile profile, return vdpau_error(status); if (avctx->codec_id == AV_CODEC_ID_HEVC && strncmp(info_string, "NVIDIA ", 7) == 0 && !(avctx->hwaccel_flags & AV_HWACCEL_FLAG_ALLOW_PROFILE_MISMATCH)) { - int driver_version; + int driver_version = 0; sscanf(info_string, "NVIDIA VDPAU Driver Shared Library %d", &driver_version); if (driver_version < 410) { av_log(avctx, AV_LOG_VERBOSE, "HEVC with NVIDIA VDPAU drivers is buggy, skipping.\n");

1 0