January 2019 - ffmpeg-cvslog - lists.ffmpeg.org

avformat/tee : Pass standards compliance value to slave muxers as well
by Karthick J 30 Jan '19

30 Jan '19

ffmpeg | branch: master | Karthick J <kjeyapal(a)akamai.com> | Wed Jan 30 19:18:59 2019 +0530| [789d3b98d1ded964c60213c05dbe1cf42ab8ae59] | committer: Nicolas George avformat/tee : Pass standards compliance value to slave muxers as well > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=789d3b98d1ded964c… --- libavformat/tee.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavformat/tee.c b/libavformat/tee.c index ef3b113a47..89a4ceb280 100644 --- a/libavformat/tee.c +++ b/libavformat/tee.c @@ -236,6 +236,7 @@ static int open_slave(AVFormatContext *avf, char *slave, TeeSlave *tee_slave) avf2->io_close = avf->io_close; avf2->interrupt_callback = avf->interrupt_callback; avf2->flags = avf->flags; + avf2->strict_std_compliance = avf->strict_std_compliance; tee_slave->stream_map = av_calloc(avf->nb_streams, sizeof(*tee_slave->stream_map)); if (!tee_slave->stream_map) {

1 0

avformat/http: clarify that ffmpeg will attempt to add missing CRLF
by Gyan Doshi 29 Jan '19

29 Jan '19

ffmpeg | branch: master | Gyan Doshi <ffmpeg(a)gyani.pro> | Mon Jan 28 12:38:02 2019 +0530| [2e2b44baba575a33aa66796bc0a0f93070ab6c53] | committer: Gyan Doshi avformat/http: clarify that ffmpeg will attempt to add missing CRLF > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2e2b44baba575a33a… --- libavformat/http.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/http.c b/libavformat/http.c index 240304f6e6..a0a0636cf2 100644 --- a/libavformat/http.c +++ b/libavformat/http.c @@ -541,7 +541,7 @@ static int http_open(URLContext *h, const char *uri, int flags, int len = strlen(s->headers); if (len < 2 || strcmp("\r\n", s->headers + len - 2)) { av_log(h, AV_LOG_WARNING, - "No trailing CRLF found in HTTP header.\n"); + "No trailing CRLF found in HTTP header. Adding it.\n"); ret = av_reallocp(&s->headers, len + 3); if (ret < 0) return ret;

1 0

avcodec/arbc: clear decoder state when seeking
by James Almer 28 Jan '19

28 Jan '19

ffmpeg | branch: master | James Almer <jamrial(a)gmail.com> | Mon Jan 28 13:16:32 2019 -0300| [286e58bb1f2d14bc2652430413987554e4e71668] | committer: James Almer avcodec/arbc: clear decoder state when seeking Reviewed-by: Paul B Mahol <onemda(a)gmail.com> Signed-off-by: James Almer <jamrial(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=286e58bb1f2d14bc2… --- libavcodec/arbc.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/libavcodec/arbc.c b/libavcodec/arbc.c index 01a146f934..4558304f12 100644 --- a/libavcodec/arbc.c +++ b/libavcodec/arbc.c @@ -181,6 +181,13 @@ static av_cold int decode_init(AVCodecContext *avctx) return 0; } +static void decode_flush(AVCodecContext *avctx) +{ + ARBCContext *s = avctx->priv_data; + + av_frame_unref(s->prev_frame); +} + static av_cold int decode_close(AVCodecContext *avctx) { ARBCContext *s = avctx->priv_data; @@ -198,6 +205,7 @@ AVCodec ff_arbc_decoder = { .priv_data_size = sizeof(ARBCContext), .init = decode_init, .decode = decode_frame, + .flush = decode_flush, .close = decode_close, .capabilities = AV_CODEC_CAP_DR1, .caps_internal = FF_CODEC_CAP_INIT_CLEANUP,

1 0

avcodec/motion_est: remove duplicate function
by Marton Balint 28 Jan '19

28 Jan '19

ffmpeg | branch: master | Marton Balint <cus(a)passwd.hu> | Sun Jan 6 14:26:11 2019 +0100| [483d02918872fb382e7d630b9ef5b2551283c2f4] | committer: Marton Balint avcodec/motion_est: remove duplicate function Signed-off-by: Marton Balint <cus(a)passwd.hu> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=483d02918872fb382… --- libavcodec/motion_est.c | 4 +-- libavcodec/motion_est_template.c | 62 +--------------------------------------- 2 files changed, 3 insertions(+), 63 deletions(-) diff --git a/libavcodec/motion_est.c b/libavcodec/motion_est.c index 8b5ce2117a..759eea479d 100644 --- a/libavcodec/motion_est.c +++ b/libavcodec/motion_est.c @@ -633,7 +633,7 @@ static inline int h263_mv4_search(MpegEncContext *s, int mx, int my, int shift) if(P[i][1] > (c->ymax<<shift)) P[i][1]= (c->ymax<<shift); } - dmin4 = epzs_motion_search4(s, &mx4, &my4, P, block, block, s->p_mv_table, (1<<16)>>shift); + dmin4 = epzs_motion_search2(s, &mx4, &my4, P, block, block, s->p_mv_table, (1<<16)>>shift, 1); dmin4= c->sub_motion_search(s, &mx4, &my4, dmin4, block, block, size, h); @@ -795,7 +795,7 @@ static int interlaced_search(MpegEncContext *s, int ref_index, P_MV1[0]= mx; //FIXME not correct if block != field_select P_MV1[1]= my / 2; - dmin = epzs_motion_search2(s, &mx_i, &my_i, P, block, field_select+ref_index, mv_table, (1<<16)>>1); + dmin = epzs_motion_search2(s, &mx_i, &my_i, P, block, field_select+ref_index, mv_table, (1<<16)>>1, 0); dmin= c->sub_motion_search(s, &mx_i, &my_i, dmin, block, field_select+ref_index, size, h); diff --git a/libavcodec/motion_est_template.c b/libavcodec/motion_est_template.c index 0c21bbfe1a..014038e54f 100644 --- a/libavcodec/motion_est_template.c +++ b/libavcodec/motion_est_template.c @@ -989,76 +989,16 @@ int ff_epzs_motion_search(MpegEncContext *s, int *mx_ptr, int *my_ptr, } } -static int epzs_motion_search4(MpegEncContext * s, - int *mx_ptr, int *my_ptr, int P[10][2], - int src_index, int ref_index, int16_t (*last_mv)[2], - int ref_mv_scale) -{ - MotionEstContext * const c= &s->me; - int best[2]={0, 0}; - int d, dmin; - unsigned map_generation; - const int penalty_factor= c->penalty_factor; - const int size=1; - const int h=8; - const int ref_mv_stride= s->mb_stride; - const int ref_mv_xy= s->mb_x + s->mb_y *ref_mv_stride; - me_cmp_func cmpf, chroma_cmpf; - LOAD_COMMON - int flags= c->flags; - LOAD_COMMON2 - - cmpf = s->mecc.me_cmp[size]; - chroma_cmpf = s->mecc.me_cmp[size + 1]; - - map_generation= update_map_generation(c); - - dmin = 1000000; - - /* first line */ - if (s->first_slice_line) { - CHECK_MV(P_LEFT[0]>>shift, P_LEFT[1]>>shift) - CHECK_CLIPPED_MV((last_mv[ref_mv_xy][0]*ref_mv_scale + (1<<15))>>16, - (last_mv[ref_mv_xy][1]*ref_mv_scale + (1<<15))>>16) - CHECK_MV(P_MV1[0]>>shift, P_MV1[1]>>shift) - }else{ - CHECK_MV(P_MV1[0]>>shift, P_MV1[1]>>shift) - //FIXME try some early stop - CHECK_MV(P_MEDIAN[0]>>shift, P_MEDIAN[1]>>shift) - CHECK_MV(P_LEFT[0]>>shift, P_LEFT[1]>>shift) - CHECK_MV(P_TOP[0]>>shift, P_TOP[1]>>shift) - CHECK_MV(P_TOPRIGHT[0]>>shift, P_TOPRIGHT[1]>>shift) - CHECK_CLIPPED_MV((last_mv[ref_mv_xy][0]*ref_mv_scale + (1<<15))>>16, - (last_mv[ref_mv_xy][1]*ref_mv_scale + (1<<15))>>16) - } - if(dmin>64*4){ - CHECK_CLIPPED_MV((last_mv[ref_mv_xy+1][0]*ref_mv_scale + (1<<15))>>16, - (last_mv[ref_mv_xy+1][1]*ref_mv_scale + (1<<15))>>16) - if(s->mb_y+1<s->end_mb_y) //FIXME replace at least with last_slice_line - CHECK_CLIPPED_MV((last_mv[ref_mv_xy+ref_mv_stride][0]*ref_mv_scale + (1<<15))>>16, - (last_mv[ref_mv_xy+ref_mv_stride][1]*ref_mv_scale + (1<<15))>>16) - } - - dmin= diamond_search(s, best, dmin, src_index, ref_index, penalty_factor, size, h, flags); - - *mx_ptr= best[0]; - *my_ptr= best[1]; - - return dmin; -} - -//try to merge with above FIXME (needs PSNR test) static int epzs_motion_search2(MpegEncContext * s, int *mx_ptr, int *my_ptr, int P[10][2], int src_index, int ref_index, int16_t (*last_mv)[2], - int ref_mv_scale) + int ref_mv_scale, const int size) { MotionEstContext * const c= &s->me; int best[2]={0, 0}; int d, dmin; unsigned map_generation; const int penalty_factor= c->penalty_factor; - const int size=0; //FIXME pass as arg const int h=8; const int ref_mv_stride= s->mb_stride; const int ref_mv_xy= s->mb_x + s->mb_y *ref_mv_stride;

1 0

avformat/dashenc: Skip writing trailer for MP4 output when in streaming mode
by Karthick J 28 Jan '19

28 Jan '19

ffmpeg | branch: master | Karthick J <kjeyapal(a)akamai.com> | Tue Jan 22 11:43:21 2019 +0530| [1db30d6cec70d9b28c80cb743220dd2502b8df30] | committer: Karthick J avformat/dashenc: Skip writing trailer for MP4 output when in streaming mode In streaming mode mp4 trailer is not required for playout. > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1db30d6cec70d9b28… --- libavformat/dashenc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/dashenc.c b/libavformat/dashenc.c index 9c90cf17e5..6299e179c2 100644 --- a/libavformat/dashenc.c +++ b/libavformat/dashenc.c @@ -1210,7 +1210,7 @@ static int dash_init(AVFormatContext *s) if (os->segment_type == SEGMENT_TYPE_MP4) { if (c->streaming) - av_dict_set(&opts, "movflags", "frag_every_frame+dash+delay_moov+skip_sidx", 0); + av_dict_set(&opts, "movflags", "frag_every_frame+dash+delay_moov+skip_sidx+skip_trailer", 0); else av_dict_set(&opts, "movflags", "frag_custom+dash+delay_moov", 0); } else {

1 0

avcodec/rscc: Avoid returning frames that have nearly no undamaged pixels in them
by Michael Niedermayer 28 Jan '19

28 Jan '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sat Jan 19 00:00:49 2019 +0100| [eb1f95eb355ff9477e70bedfe0602c2380b05969] | committer: Michael Niedermayer avcodec/rscc: Avoid returning frames that have nearly no undamaged pixels in them Fixes: Timeout Fixes: 12192/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RSCC_fuzzer-6279038004363264 Before: clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RSCC_fuzzer-6279038004363264 in 15423 ms After: clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RSCC_fuzzer-6279038004363264 in 190 ms Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=eb1f95eb355ff9477… --- libavcodec/rscc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/libavcodec/rscc.c b/libavcodec/rscc.c index 7921f149ed..e4b51973d8 100644 --- a/libavcodec/rscc.c +++ b/libavcodec/rscc.c @@ -64,6 +64,7 @@ typedef struct RsccContext { /* zlib interaction */ uint8_t *inflated_buf; uLongf inflated_size; + int valid_pixels } RsccContext; static av_cold int rscc_init(AVCodecContext *avctx) @@ -347,8 +348,11 @@ static int rscc_decode_frame(AVCodecContext *avctx, void *data, } memcpy (frame->data[1], ctx->palette, AVPALETTE_SIZE); } - - *got_frame = 1; + // We only return a picture when enough of it is undamaged, this avoids copying nearly broken frames around + if (ctx->valid_pixels < ctx->inflated_size) + ctx->valid_pixels += pixel_size; + if (ctx->valid_pixels >= ctx->inflated_size * (100 - avctx->discard_damaged_percentage) / 100) + *got_frame = 1; ret = avpkt->size; end:

1 0

avcodec: Add discard_sample_percentage
by Michael Niedermayer 28 Jan '19

28 Jan '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sat Jan 19 00:00:48 2019 +0100| [5bcefceec8b648bc4c06c98ff7649ccdb140a0bb] | committer: Michael Niedermayer avcodec: Add discard_sample_percentage Suggested-by: BBB Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5bcefceec8b648bc4… --- doc/APIchanges | 3 +++ libavcodec/avcodec.h | 8 ++++++++ libavcodec/options_table.h | 1 + libavcodec/version.h | 2 +- tests/ref/fate/api-mjpeg-codec-param | 2 ++ tests/ref/fate/api-png-codec-param | 2 ++ 6 files changed, 17 insertions(+), 1 deletion(-) diff --git a/doc/APIchanges b/doc/APIchanges index a39a3ff2ba..784a5e5bd2 100644 --- a/doc/APIchanges +++ b/doc/APIchanges @@ -15,6 +15,9 @@ libavutil: 2017-10-21 API changes, most recent first: +2019-01-27 - XXXXXXXXXX - lavc 58.46.100 - avcodec.h + Add discard_damaged_percentage + 2019-01-08 - xxxxxxxxxx - lavu 56.26.100 - frame.h Add AV_FRAME_DATA_REGIONS_OF_INTEREST diff --git a/libavcodec/avcodec.h b/libavcodec/avcodec.h index 72dc277dfd..f554c53f0e 100644 --- a/libavcodec/avcodec.h +++ b/libavcodec/avcodec.h @@ -3345,6 +3345,14 @@ typedef struct AVCodecContext { * used as reference pictures). */ int extra_hw_frames; + + /** + * The percentage of damaged samples to discard a frame. + * + * - decoding: set by user + * - encoding: unused + */ + int discard_damaged_percentage; } AVCodecContext; #if FF_API_CODEC_GET_SET diff --git a/libavcodec/options_table.h b/libavcodec/options_table.h index 2f36ec7b8e..a3235bcd57 100644 --- a/libavcodec/options_table.h +++ b/libavcodec/options_table.h @@ -479,6 +479,7 @@ static const AVOption avcodec_options[] = { {"allow_high_depth", "allow to output YUV pixel formats with a different chroma sampling than 4:2:0 and/or other than 8 bits per component", 0, AV_OPT_TYPE_CONST, {.i64 = AV_HWACCEL_FLAG_ALLOW_HIGH_DEPTH }, INT_MIN, INT_MAX, V | D, "hwaccel_flags"}, {"allow_profile_mismatch", "attempt to decode anyway if HW accelerated decoder's supported profiles do not exactly match the stream", 0, AV_OPT_TYPE_CONST, {.i64 = AV_HWACCEL_FLAG_ALLOW_PROFILE_MISMATCH }, INT_MIN, INT_MAX, V | D, "hwaccel_flags"}, {"extra_hw_frames", "Number of extra hardware frames to allocate for the user", OFFSET(extra_hw_frames), AV_OPT_TYPE_INT, { .i64 = -1 }, -1, INT_MAX, V|D }, +{"discard_damaged_percentage", "Percentage of damaged samples to discard a frame", OFFSET(discard_damaged_percentage), AV_OPT_TYPE_INT, {.i64 = 95 }, 0, 100, V|D }, {NULL}, }; diff --git a/libavcodec/version.h b/libavcodec/version.h index 5c9b688524..6a10536dcc 100644 --- a/libavcodec/version.h +++ b/libavcodec/version.h @@ -28,7 +28,7 @@ #include "libavutil/version.h" #define LIBAVCODEC_VERSION_MAJOR 58 -#define LIBAVCODEC_VERSION_MINOR 45 +#define LIBAVCODEC_VERSION_MINOR 46 #define LIBAVCODEC_VERSION_MICRO 100 #define LIBAVCODEC_VERSION_INT AV_VERSION_INT(LIBAVCODEC_VERSION_MAJOR, \ diff --git a/tests/ref/fate/api-mjpeg-codec-param b/tests/ref/fate/api-mjpeg-codec-param index 0d2b55cff1..0815919d7d 100644 --- a/tests/ref/fate/api-mjpeg-codec-param +++ b/tests/ref/fate/api-mjpeg-codec-param @@ -138,6 +138,7 @@ stream=0, decode=0 max_pixels=2147483647 hwaccel_flags=0x00000001 extra_hw_frames=-1 + discard_damaged_percentage=95 stream=0, decode=1 b=0 ab=0 @@ -278,3 +279,4 @@ stream=0, decode=1 max_pixels=2147483647 hwaccel_flags=0x00000001 extra_hw_frames=-1 + discard_damaged_percentage=95 diff --git a/tests/ref/fate/api-png-codec-param b/tests/ref/fate/api-png-codec-param index 1ae94a2e91..a47d0963da 100644 --- a/tests/ref/fate/api-png-codec-param +++ b/tests/ref/fate/api-png-codec-param @@ -138,6 +138,7 @@ stream=0, decode=0 max_pixels=2147483647 hwaccel_flags=0x00000001 extra_hw_frames=-1 + discard_damaged_percentage=95 stream=0, decode=1 b=0 ab=0 @@ -278,3 +279,4 @@ stream=0, decode=1 max_pixels=2147483647 hwaccel_flags=0x00000001 extra_hw_frames=-1 + discard_damaged_percentage=95

1 0

tools/target_dec_fate.list: add entries upto 1214
by Michael Niedermayer 28 Jan '19

28 Jan '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sat Jan 19 01:21:28 2019 +0100| [b860f2218a74723e5ad731888d513a3f68be6af0] | committer: Michael Niedermayer tools/target_dec_fate.list: add entries upto 1214 Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b860f2218a74723e5… --- tools/target_dec_fate.list | 63 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) diff --git a/tools/target_dec_fate.list b/tools/target_dec_fate.list index f6b56261bb..b20137bfef 100644 --- a/tools/target_dec_fate.list +++ b/tools/target_dec_fate.list @@ -61,6 +61,69 @@ 722/clusterfuzz-testcase-5711268868521984 target_dec_dca_fuzzer 723/clusterfuzz-testcase-6471394663596032 target_dec_wavpack_fuzzer 724/clusterfuzz-testcase-6738249571631104 target_dec_pictor_fuzzer +729/clusterfuzz-testcase-5154831595470848 target_dec_wavpack_fuzzer +730/clusterfuzz-testcase-5265113739165696 target_dec_vp8_fuzzer +731/clusterfuzz-testcase-5391628980191232 target_dec_flac_fuzzer +732/clusterfuzz-testcase-4872990070145024 target_dec_dca_fuzzer +733/clusterfuzz-testcase-4682158096515072 target_dec_mjpeg_fuzzer +734/clusterfuzz-testcase-4821293192970240 target_dec_h264_fuzzer +736/clusterfuzz-testcase-5580263943831552 target_dec_mpeg4_fuzzer +741/clusterfuzz-testcase-5869962004529152 target_dec_movtext_fuzzer +755/clusterfuzz-testcase-5369072516595712 target_dec_h264_fuzzer +758/clusterfuzz-testcase-4720832028868608 target_dec_vp5_fuzzer +761/clusterfuzz-testcase-5442222252097536 target_dec_wavpack_fuzzer +762/clusterfuzz-testcase-5927683747741696 target_dec_dca_fuzzer +763/clusterfuzz-testcase-6007567320875008 target_dec_amrwb_fuzzer +764/clusterfuzz-testcase-6273034652483584 target_dec_mpeg2video_fuzzer +766/clusterfuzz-testcase-4603047080624128 target_dec_vp6_fuzzer +767/clusterfuzz-testcase-6743603416137728 target_dec_vp6f_fuzzer +768/clusterfuzz-testcase-4807444305805312 target_dec_rv40_fuzzer +772/clusterfuzz-testcase-5453962780082176 target_dec_h264_fuzzer +773/clusterfuzz-testcase-6362160458366976 target_dec_vp6f_fuzzer +779/clusterfuzz-testcase-5568669545398272 target_dec_mpeg4_fuzzer +780/clusterfuzz-testcase-6393552642768896 target_dec_gif_fuzzer +807/clusterfuzz-testcase-6470061042696192 target_dec_vp6f_fuzzer +808/clusterfuzz-testcase-4715513349406720 target_dec_wavpack_fuzzer +809/clusterfuzz-testcase-6172687908995072 target_dec_vp6f_fuzzer +810/clusterfuzz-testcase-5249282825256960 target_dec_targa_fuzzer +811/clusterfuzz-testcase-6465493076541440 target_dec_mjpeg_fuzzer +822/clusterfuzz-testcase-4873433189974016 target_dec_wavpack_fuzzer +823/clusterfuzz-testcase-6727060074528768 target_dec_pictor_fuzzer +826/clusterfuzz-testcase-5316921379520512 target_dec_tiff_fuzzer +830/clusterfuzz-testcase-6253175327686656 target_dec_mp2_fuzzer +839/clusterfuzz-testcase-4871084446842880 target_dec_wavpack_fuzzer +842/clusterfuzz-testcase-6361547318231040 target_dec_tiff_fuzzer +847/clusterfuzz-testcase-5291877358108672 target_dec_vp5_fuzzer +848/clusterfuzz-testcase-5432155620507648 target_dec_vp6f_fuzzer +850/clusterfuzz-testcase-5721296509861888 target_dec_vp6f_fuzzer +857/clusterfuzz-testcase-5319093760557056 target_dec_h264_fuzzer +858/clusterfuzz-testcase-5168477042114560 target_dec_h264_fuzzer +861/clusterfuzz-testcase-5688284384591872 target_dec_tiff_fuzzer +864/clusterfuzz-testcase-4774385942528000 target_dec_h264_fuzzer +870/clusterfuzz-testcase-5649105424482304 target_dec_mjpeg_fuzzer +873/clusterfuzz-testcase-5714546230558720 target_dec_mp3_fuzzer +874/clusterfuzz-testcase-5252796175613952 target_dec_tiff_fuzzer +894/clusterfuzz-testcase-4841537823309824 target_dec_wavpack_fuzzer +898/clusterfuzz-testcase-6149765467209728 target_dec_pictor_fuzzer +902/clusterfuzz-testcase-4561155144024064 target_dec_h264_fuzzer +911/clusterfuzz-testcase-5415105606975488 target_dec_h264_fuzzer +936/clusterfuzz-testcase-4700061919346688 target_dec_tiff_fuzzer +938/clusterfuzz-testcase-4791735110598656 target_dec_amrnb_fuzzer +939/clusterfuzz-testcase-6515070404132864 target_dec_h264_fuzzer +940/clusterfuzz-testcase-5200378381467648 target_dec_wavpack_fuzzer +943/clusterfuzz-testcase-5114865297391616 target_dec_jpegls_fuzzer +943/clusterfuzz-testcase-5114865297391616 target_dec_mjpeg_fuzzer +945/clusterfuzz-testcase-6037937588273152 target_dec_wavpack_fuzzer +979/clusterfuzz-testcase-4940780542099456 target_dec_h264_fuzzer +1044/clusterfuzz-testcase-minimized-ffmpeg_AUDIO_AV_CODEC_ID_DTS_fuzzer-6135262067294208 target_dec_dca_fuzzer +1072/clusterfuzz-testcase-6456688074817536 target_dec_aac_fuzzer +1080/clusterfuzz-testcase-5353236754071552 target_dec_dvdsub_fuzzer +1085/clusterfuzz-testcase-6089649833377792 target_dec_tiff_fuzzer +1133/clusterfuzz-testcase-minimized-ffmpeg_VIDEO_AV_CODEC_ID_MJPEG_fuzzer-4861925596856320 target_dec_mjpeg_fuzzer +1136/clusterfuzz-testcase-6024209379622912 target_dec_sipr_fuzzer +1137/clusterfuzz-testcase-6711216560930816 target_dec_jpegls_fuzzer +1141/clusterfuzz-testcase-6659734767665152 target_dec_amrnb_fuzzer +1213/clusterfuzz-testcase-minimized-6022987469815808 target_dec_tiff_fuzzer 1214/clusterfuzz-testcase-minimized-6130606599569408 target_dec_h264_fuzzer 5264/clusterfuzz-testcase-minimized-4621956621008896 target_dec_indeo5_fuzzer 7279/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5977332473921536 target_dec_g2m_fuzzer

1 0

avcodec/huffyuvdec: Check slice_offset/size
by Michael Niedermayer 28 Jan '19

28 Jan '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Mon Jan 21 00:39:43 2019 +0100| [fcbda8af175a1f305c46d6d46a4f90be4aa630ae] | committer: Michael Niedermayer avcodec/huffyuvdec: Check slice_offset/size Fixes: out of array access Fixes: 12447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-5201623956062208 Fixes: 12458/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-5705567736168448 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=fcbda8af175a1f305… --- libavcodec/huffyuvdec.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/huffyuvdec.c b/libavcodec/huffyuvdec.c index 8226c07743..27f650d7bf 100644 --- a/libavcodec/huffyuvdec.c +++ b/libavcodec/huffyuvdec.c @@ -1268,6 +1268,11 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, if (nb_slices > 1) { slice_offset = AV_RL32(avpkt->data + slices_info_offset + slice * 8); slice_size = AV_RL32(avpkt->data + slices_info_offset + slice * 8 + 4); + + if (slice_offset < 0 || slice_size <= 0 || (slice_offset&3) || + slice_offset + (int64_t)slice_size > buf_size) + return AVERROR_INVALIDDATA; + y_offset = height - (slice + 1) * slice_height; s->bdsp.bswap_buf((uint32_t *)s->bitstream_buffer, (const uint32_t *)(buf + slice_offset), slice_size / 4);

1 0

avcodec/ilbcdec: Fix undefined integer overflow lsf2poly()
by Michael Niedermayer 28 Jan '19

28 Jan '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Tue Jan 15 00:09:30 2019 +0100| [4523cc5e75c8ecfba8975d16e96c29f9bf70973f] | committer: Michael Niedermayer avcodec/ilbcdec: Fix undefined integer overflow lsf2poly() The addition is moved up into the context where the variable is unsigned avoiding the undefined behavior Fixes: runtime error: signed integer overflow: 2147481972 + 4096 cannot be represented in type 'int' Fixes: 12444/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ILBC_fuzzer-5755706244857856 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4523cc5e75c8ecfba… --- libavcodec/ilbcdec.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavcodec/ilbcdec.c b/libavcodec/ilbcdec.c index 643547f4ab..bba83a5896 100644 --- a/libavcodec/ilbcdec.c +++ b/libavcodec/ilbcdec.c @@ -408,11 +408,11 @@ static void lsf2poly(int16_t *a, int16_t *lsf) a[0] = 4096; for (i = 5; i > 0; i--) { - tmp = f[0][6 - i] + (unsigned)f[1][6 - i]; - a[6 - i] = (tmp + 4096) >> 13; + tmp = f[0][6 - i] + (unsigned)f[1][6 - i] + 4096; + a[6 - i] = tmp >> 13; - tmp = f[0][6 - i] - (unsigned)f[1][6 - i]; - a[5 + i] = (tmp + 4096) >> 13; + tmp = f[0][6 - i] - (unsigned)f[1][6 - i] + 4096; + a[5 + i] = tmp >> 13; } }

1 0