November 2019 - ffmpeg-cvslog

avcodec/utils: Check block_align
by Michael Niedermayer 01 Nov '19

01 Nov '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Thu Oct 31 09:31:22 2019 +0100| [f011572e66c8dd2f0ac3cb147a769e91f24e0202] | committer: Michael Niedermayer avcodec/utils: Check block_align Fixes: out of array access Fixes: 18432/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5675574936207360 Fixes: 18326/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5071752362721280 Fixes: 18384/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV1_fuzzer-5769439500304384 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f011572e66c8dd2f0… --- libavcodec/utils.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/utils.c b/libavcodec/utils.c index 6cc770b1ea..75e7035b8a 100644 --- a/libavcodec/utils.c +++ b/libavcodec/utils.c @@ -694,6 +694,11 @@ int attribute_align_arg avcodec_open2(AVCodecContext *avctx, const AVCodec *code ret = AVERROR(EINVAL); goto free_and_end; } + if (avctx->block_align < 0) { + av_log(avctx, AV_LOG_ERROR, "Invalid block align: %d\n", avctx->block_align); + ret = AVERROR(EINVAL); + goto free_and_end; + } avctx->codec = codec; if ((avctx->codec_type == AVMEDIA_TYPE_UNKNOWN || avctx->codec_type == codec->type) &&

1 0

avfilter/vf_lut3d: simplify code
by Limin Wang 01 Nov '19

01 Nov '19

ffmpeg | branch: master | Limin Wang <lance.lmwang(a)gmail.com> | Wed Oct 30 21:20:55 2019 +0800| [99fc5059fbee8a0fd2957f958b34fdec1e9ca361] | committer: Michael Niedermayer avfilter/vf_lut3d: simplify code Signed-off-by: Limin Wang <lance.lmwang(a)gmail.com> Reviewed-by: Paul B Mahol <onemda(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=99fc5059fbee8a0fd… --- libavfilter/vf_lut3d.c | 54 ++++++-------------------------------------------- 1 file changed, 6 insertions(+), 48 deletions(-) diff --git a/libavfilter/vf_lut3d.c b/libavfilter/vf_lut3d.c index cd0aba1f69..9e820a17c9 100644 --- a/libavfilter/vf_lut3d.c +++ b/libavfilter/vf_lut3d.c @@ -711,34 +711,13 @@ static int query_formats(AVFilterContext *ctx) static int config_input(AVFilterLink *inlink) { - int depth, is16bit = 0, planar = 0; + int depth, is16bit, planar; LUT3DContext *lut3d = inlink->dst->priv; const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(inlink->format); depth = desc->comp[0].depth; - - switch (inlink->format) { - case AV_PIX_FMT_RGB48: - case AV_PIX_FMT_BGR48: - case AV_PIX_FMT_RGBA64: - case AV_PIX_FMT_BGRA64: - is16bit = 1; - break; - case AV_PIX_FMT_GBRP9: - case AV_PIX_FMT_GBRP10: - case AV_PIX_FMT_GBRP12: - case AV_PIX_FMT_GBRP14: - case AV_PIX_FMT_GBRP16: - case AV_PIX_FMT_GBRAP10: - case AV_PIX_FMT_GBRAP12: - case AV_PIX_FMT_GBRAP16: - is16bit = 1; - case AV_PIX_FMT_GBRP: - case AV_PIX_FMT_GBRAP: - planar = 1; - break; - } - + is16bit = desc->comp[0].depth > 8; + planar = desc->flags & AV_PIX_FMT_FLAG_PLANAR; ff_fill_rgba_map(lut3d->rgba_map, inlink->format); lut3d->step = av_get_padded_bits_per_pixel(desc) >> (3 + is16bit); @@ -1558,34 +1537,13 @@ DEFINE_INTERP_FUNC_1D(spline, 16) static int config_input_1d(AVFilterLink *inlink) { - int depth, is16bit = 0, planar = 0; + int depth, is16bit, planar; LUT1DContext *lut1d = inlink->dst->priv; const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(inlink->format); depth = desc->comp[0].depth; - - switch (inlink->format) { - case AV_PIX_FMT_RGB48: - case AV_PIX_FMT_BGR48: - case AV_PIX_FMT_RGBA64: - case AV_PIX_FMT_BGRA64: - is16bit = 1; - break; - case AV_PIX_FMT_GBRP9: - case AV_PIX_FMT_GBRP10: - case AV_PIX_FMT_GBRP12: - case AV_PIX_FMT_GBRP14: - case AV_PIX_FMT_GBRP16: - case AV_PIX_FMT_GBRAP10: - case AV_PIX_FMT_GBRAP12: - case AV_PIX_FMT_GBRAP16: - is16bit = 1; - case AV_PIX_FMT_GBRP: - case AV_PIX_FMT_GBRAP: - planar = 1; - break; - } - + is16bit = desc->comp[0].depth > 8; + planar = desc->flags & AV_PIX_FMT_FLAG_PLANAR; ff_fill_rgba_map(lut1d->rgba_map, inlink->format); lut1d->step = av_get_padded_bits_per_pixel(desc) >> (3 + is16bit);

1 0

swscale/swscale_unscaled: fix gbrap10be md5 different on big endian system
by Limin Wang 01 Nov '19

01 Nov '19

ffmpeg | branch: master | Limin Wang <lance.lmwang(a)gmail.com> | Wed Oct 30 21:20:52 2019 +0800| [a5e24be52ab0ebea908a566a1b0dbf2584f5631a] | committer: Michael Niedermayer swscale/swscale_unscaled: fix gbrap10be md5 different on big endian system You can reproduce it by below command: ./ffmpeg -f lavfi -i "testsrc=duration=1:rate=30" -vf format=gbrap10 -vcodec rawvideo \ -pix_fmt gbrap10le -flags +bitexact -sws_flags +accurate_rnd+bitexact -fflags +bitexact \ -frames:v 1 -f nut md5: little-endian: f91e2edd8098276579c1929e5e160416 big-endian: ba4d011dbbdc78ccbf6cc7d698630929 Signed-off-by: Limin Wang <lance.lmwang(a)gmail.com> Reviewed-by: Paul B Mahol <onemda(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a5e24be52ab0ebea9… --- libswscale/swscale_unscaled.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libswscale/swscale_unscaled.c b/libswscale/swscale_unscaled.c index e0b9e99373..d9260c151a 100644 --- a/libswscale/swscale_unscaled.c +++ b/libswscale/swscale_unscaled.c @@ -2048,6 +2048,7 @@ void ff_get_unscaled_swscale(SwsContext *c) IS_DIFFERENT_ENDIANESS(srcFormat, dstFormat, AV_PIX_FMT_GBRP12) || IS_DIFFERENT_ENDIANESS(srcFormat, dstFormat, AV_PIX_FMT_GBRP14) || IS_DIFFERENT_ENDIANESS(srcFormat, dstFormat, AV_PIX_FMT_GBRP16) || + IS_DIFFERENT_ENDIANESS(srcFormat, dstFormat, AV_PIX_FMT_GBRAP10) || IS_DIFFERENT_ENDIANESS(srcFormat, dstFormat, AV_PIX_FMT_GBRAP12) || IS_DIFFERENT_ENDIANESS(srcFormat, dstFormat, AV_PIX_FMT_GBRAP16) || IS_DIFFERENT_ENDIANESS(srcFormat, dstFormat, AV_PIX_FMT_RGB444) ||

1 0

libavformat/flacenc: reject too big picture blocks
by Mattias Wadman 01 Nov '19

01 Nov '19

ffmpeg | branch: master | Mattias Wadman <mattias.wadman(a)gmail.com> | Wed Oct 30 14:01:28 2019 +0100| [e447a4d112bcfee10126c54eb4481fa8712957c8] | committer: Michael Niedermayer libavformat/flacenc: reject too big picture blocks A too big picture will case the muxer to write a truncated block size (uint24) causing the output file to be corrupt. How to reproduce: Write a file with truncated block size: ffmpeg -y -f lavfi -i sine -f lavfi -i color=red:size=2400x2400 -map 0:a:0 -map 1:v:0 -c:v:0 bmp -disposition:1 attached_pic -t 1 test.flac Try to decode: ffmpeg -i test.flac test.wav Signed-off-by: Mattias Wadman <mattias.wadman(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e447a4d112bcfee10… --- libavformat/flacenc.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/libavformat/flacenc.c b/libavformat/flacenc.c index 93cc79bbe0..abbed38f89 100644 --- a/libavformat/flacenc.c +++ b/libavformat/flacenc.c @@ -93,7 +93,7 @@ static int flac_write_picture(struct AVFormatContext *s, AVPacket *pkt) AVDictionaryEntry *e; const char *mimetype = NULL, *desc = ""; const AVStream *st = s->streams[pkt->stream_index]; - int i, mimelen, desclen, type = 0; + int i, mimelen, desclen, type = 0, blocklen; if (!pkt->data) return 0; @@ -140,8 +140,14 @@ static int flac_write_picture(struct AVFormatContext *s, AVPacket *pkt) desc = e->value; desclen = strlen(desc); + blocklen = 4 + 4 + mimelen + 4 + desclen + 4 + 4 + 4 + 4 + 4 + pkt->size; + if (blocklen >= 1<<24) { + av_log(s, AV_LOG_ERROR, "Picture block too big %d >= %d\n", blocklen, 1<<24); + return AVERROR(EINVAL); + } + avio_w8(pb, 0x06); - avio_wb24(pb, 4 + 4 + mimelen + 4 + desclen + 4 + 4 + 4 + 4 + 4 + pkt->size); + avio_wb24(pb, blocklen); avio_wb32(pb, type);

1 0

avcodec/libtwolame: fix mono default bitrate
by James Cowgill 01 Nov '19

01 Nov '19

ffmpeg | branch: master | James Cowgill <jcowgill(a)debian.org> | Fri Nov 1 08:51:07 2019 +0000| [bb718d11ed992f4d12ad683e310b53bf1c519322] | committer: Paul B Mahol avcodec/libtwolame: fix mono default bitrate As of libtwolame 0.4.0, 384 kbps is not accepted as a valid bitrate for encoding mono audio and the maximum bitrate is now halved to 192 kbps to comply with the MP2 standard. Example error: twolame_init_params(): 384kbps is an invalid bitrate for mono encoding. Adjust the default bitrate calculation to take this into account. Signed-off-by: James Cowgill <jcowgill(a)debian.org> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bb718d11ed992f4d1… --- libavcodec/libtwolame.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/libavcodec/libtwolame.c b/libavcodec/libtwolame.c index 030f88868f..5ceb3d9f3f 100644 --- a/libavcodec/libtwolame.c +++ b/libavcodec/libtwolame.c @@ -78,8 +78,12 @@ static av_cold int twolame_encode_init(AVCodecContext *avctx) twolame_set_in_samplerate(s->glopts, avctx->sample_rate); twolame_set_out_samplerate(s->glopts, avctx->sample_rate); - if (!avctx->bit_rate) - avctx->bit_rate = avctx->sample_rate < 28000 ? 160000 : 384000; + if (!avctx->bit_rate) { + if ((s->mode == TWOLAME_AUTO_MODE && avctx->channels == 1) || s->mode == TWOLAME_MONO) + avctx->bit_rate = avctx->sample_rate < 28000 ? 80000 : 192000; + else + avctx->bit_rate = avctx->sample_rate < 28000 ? 160000 : 384000; + } if (avctx->flags & AV_CODEC_FLAG_QSCALE || !avctx->bit_rate) { twolame_set_VBR(s->glopts, TRUE);

1 0

doc/filters: fix overlay_opencl document typo
by Steven Liu 01 Nov '19

01 Nov '19

ffmpeg | branch: master | Steven Liu <lq(a)chinaffmpeg.org> | Fri Nov 1 16:42:36 2019 +0800| [2dd71bf95e369b6c03fd6f5c66ff1d143e752192] | committer: Steven Liu doc/filters: fix overlay_opencl document typo Reported-by: Yabo Wei <weiyabo(a)kuaishou.com> Signed-off-by: Steven Liu <lq(a)chinaffmpeg.org> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2dd71bf95e369b6c0… --- doc/filters.texi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/filters.texi b/doc/filters.texi index 7e9d50782a..6d893d8b87 100644 --- a/doc/filters.texi +++ b/doc/filters.texi @@ -20508,7 +20508,7 @@ Set the x coordinate of the overlaid video on the main video. Default value is @code{0}. @item y -Set the x coordinate of the overlaid video on the main video. +Set the y coordinate of the overlaid video on the main video. Default value is @code{0}. @end table

1 0