August 2019 - ffmpeg-cvslog - lists.ffmpeg.org

avcodec: add IMM5 decoder
by Paul B Mahol 29 Aug '19

29 Aug '19

ffmpeg | branch: master | Paul B Mahol <onemda(a)gmail.com> | Fri Sep 14 11:14:15 2018 +0200| [7c0b3ba7ddaa6540560c8b7884697a7487b669e4] | committer: Paul B Mahol avcodec: add IMM5 decoder > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7c0b3ba7ddaa65405… --- Changelog | 1 + configure | 1 + libavcodec/Makefile | 1 + libavcodec/allcodecs.c | 1 + libavcodec/avcodec.h | 1 + libavcodec/codec_desc.c | 7 ++ libavcodec/imm5.c | 193 ++++++++++++++++++++++++++++++++++++++++++++++++ libavcodec/version.h | 4 +- libavformat/riff.c | 1 + 9 files changed, 208 insertions(+), 2 deletions(-) diff --git a/Changelog b/Changelog index f1cddc4274..20e42964da 100644 --- a/Changelog +++ b/Changelog @@ -7,6 +7,7 @@ version <next>: - Intel QSV-accelerated VP9 decoding - support for TrueHD in mp4 - Supoort AMD AMF encoder on Linux (via Vulkan) +- IMM5 video decoder version 4.2: diff --git a/configure b/configure index 691ae9bd4f..08a54a7e9f 100755 --- a/configure +++ b/configure @@ -2723,6 +2723,7 @@ huffyuv_encoder_select="bswapdsp huffman huffyuvencdsp llvidencdsp" hymt_decoder_select="huffyuv_decoder" iac_decoder_select="imc_decoder" imc_decoder_select="bswapdsp fft mdct sinewin" +imm5_decoder_select="h264_decoder hevc_decoder" indeo3_decoder_select="hpeldsp" indeo4_decoder_select="ividsp" indeo5_decoder_select="ividsp" diff --git a/libavcodec/Makefile b/libavcodec/Makefile index e49188357b..1167238292 100644 --- a/libavcodec/Makefile +++ b/libavcodec/Makefile @@ -393,6 +393,7 @@ OBJS-$(CONFIG_IFF_ILBM_DECODER) += iff.o OBJS-$(CONFIG_ILBC_DECODER) += ilbcdec.o OBJS-$(CONFIG_IMC_DECODER) += imc.o OBJS-$(CONFIG_IMM4_DECODER) += imm4.o +OBJS-$(CONFIG_IMM5_DECODER) += imm5.o OBJS-$(CONFIG_INDEO2_DECODER) += indeo2.o OBJS-$(CONFIG_INDEO3_DECODER) += indeo3.o OBJS-$(CONFIG_INDEO4_DECODER) += indeo4.o ivi.o diff --git a/libavcodec/allcodecs.c b/libavcodec/allcodecs.c index 22985325e0..5130fca026 100644 --- a/libavcodec/allcodecs.c +++ b/libavcodec/allcodecs.c @@ -158,6 +158,7 @@ extern AVCodec ff_hymt_decoder; extern AVCodec ff_idcin_decoder; extern AVCodec ff_iff_ilbm_decoder; extern AVCodec ff_imm4_decoder; +extern AVCodec ff_imm5_decoder; extern AVCodec ff_indeo2_decoder; extern AVCodec ff_indeo3_decoder; extern AVCodec ff_indeo4_decoder; diff --git a/libavcodec/avcodec.h b/libavcodec/avcodec.h index d234271c5b..de4feb6a65 100644 --- a/libavcodec/avcodec.h +++ b/libavcodec/avcodec.h @@ -457,6 +457,7 @@ enum AVCodecID { AV_CODEC_ID_AGM, AV_CODEC_ID_LSCR, AV_CODEC_ID_VP4, + AV_CODEC_ID_IMM5, /* various PCM "codecs" */ AV_CODEC_ID_FIRST_AUDIO = 0x10000, ///< A dummy id pointing at the start of audio codecs diff --git a/libavcodec/codec_desc.c b/libavcodec/codec_desc.c index 4d033c20ff..e6373be504 100644 --- a/libavcodec/codec_desc.c +++ b/libavcodec/codec_desc.c @@ -1726,6 +1726,13 @@ static const AVCodecDescriptor codec_descriptors[] = { .long_name = NULL_IF_CONFIG_SMALL("On2 VP4"), .props = AV_CODEC_PROP_LOSSY, }, + { + .id = AV_CODEC_ID_IMM5, + .type = AVMEDIA_TYPE_VIDEO, + .name = "imm5", + .long_name = NULL_IF_CONFIG_SMALL("Infinity IMM5"), + .props = AV_CODEC_PROP_LOSSY, + }, /* various PCM "codecs" */ { diff --git a/libavcodec/imm5.c b/libavcodec/imm5.c new file mode 100644 index 0000000000..917b414e66 --- /dev/null +++ b/libavcodec/imm5.c @@ -0,0 +1,193 @@ +/* + * Copyright (c) 2019 Paul B Mahol + * + * This file is part of FFmpeg. + * + * FFmpeg is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * FFmpeg is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with FFmpeg; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + */ + +#include "libavutil/intreadwrite.h" + +#include "avcodec.h" +#include "internal.h" + +typedef struct IMM5Context { + AVCodecContext *h264_avctx; // wrapper context for H264 + AVCodecContext *hevc_avctx; // wrapper context for HEVC +} IMM5Context; + +static const struct IMM5_unit { + uint8_t bits[14]; + uint8_t len; +} IMM5_units[14] = { + { { 0x00, 0x00, 0x00, 0x01, 0x67, 0x42, 0x80, 0x1E, 0xF4, 0x0B, 0x0F, 0x88 }, 12 }, + { { 0x00, 0x00, 0x00, 0x01, 0x67, 0x42, 0x80, 0x1E, 0xF4, 0x05, 0x83, 0xE2 }, 12 }, + { { 0x00, 0x00, 0x00, 0x01, 0x67, 0x42, 0x80, 0x1E, 0xF4, 0x05, 0x81, 0xE8, 0x80 }, 13 }, + { { 0x00, 0x00, 0x00, 0x01, 0x67, 0x42, 0x80, 0x1E, 0xF4, 0x0B, 0x04, 0xA2 }, 12 }, + { { 0x00, 0x00, 0x00, 0x01, 0x67, 0x42, 0x80, 0x1E, 0xF4, 0x05, 0x81, 0x28, 0x80 }, 13 }, + { { 0x00, 0x00, 0x00, 0x01, 0x67, 0x42, 0x80, 0x1E, 0xF4, 0x05, 0x80, 0x92, 0x20 }, 13 }, + { { 0x00, 0x00, 0x00, 0x01, 0x67, 0x42, 0x00, 0x1E, 0x9A, 0x74, 0x0B, 0x0F, 0xC8 }, 13 }, + { { 0x00, 0x00, 0x00, 0x01, 0x67, 0x42, 0x00, 0x1E, 0x9A, 0x74, 0x05, 0x83, 0xF2 }, 13 }, + { { 0x00, 0x00, 0x00, 0x01, 0x67, 0x42, 0x00, 0x1E, 0x9A, 0x74, 0x05, 0x81, 0xEC, 0x80 }, 14 }, + { { 0x00, 0x00, 0x00, 0x01, 0x67, 0x42, 0x00, 0x1E, 0x9A, 0x74, 0x0B, 0x04, 0xB2 }, 13 }, + { { 0x00, 0x00, 0x00, 0x01, 0x67, 0x42, 0x00, 0x1E, 0x9A, 0x74, 0x05, 0x81, 0x2C, 0x80 }, 14 }, + { { 0x00, 0x00, 0x00, 0x01, 0x67, 0x42, 0x00, 0x1E, 0x9A, 0x74, 0x05, 0x80, 0x93, 0x20 }, 14 }, + { { 0x00, 0x00, 0x00, 0x01, 0x68, 0xDE, 0x3C, 0x80 }, 8 }, + { { 0x00, 0x00, 0x00, 0x01, 0x68, 0xCE, 0x32, 0x28 }, 8 }, +}; + +static av_cold int imm5_init(AVCodecContext *avctx) +{ + IMM5Context *ctx = avctx->priv_data; + const AVCodec *codec; + int ret; + + codec = avcodec_find_decoder(AV_CODEC_ID_H264); + if (!codec) + return AVERROR_BUG; + ctx->h264_avctx = avcodec_alloc_context3(codec); + if (!ctx->h264_avctx) + return AVERROR(ENOMEM); + ctx->h264_avctx->thread_count = 1; + ctx->h264_avctx->flags = avctx->flags; + ctx->h264_avctx->flags2 = avctx->flags2; + ret = ff_codec_open2_recursive(ctx->h264_avctx, codec, NULL); + if (ret < 0) + return ret; + + codec = avcodec_find_decoder(AV_CODEC_ID_HEVC); + if (!codec) + return AVERROR_BUG; + ctx->hevc_avctx = avcodec_alloc_context3(codec); + if (!ctx->hevc_avctx) + return AVERROR(ENOMEM); + ctx->hevc_avctx->thread_count = 1; + ctx->hevc_avctx->flags = avctx->flags; + ctx->hevc_avctx->flags2 = avctx->flags2; + ret = ff_codec_open2_recursive(ctx->hevc_avctx, codec, NULL); + if (ret < 0) + return ret; + + return 0; +} + +static int imm5_decode_frame(AVCodecContext *avctx, void *data, + int *got_frame, AVPacket *avpkt) +{ + IMM5Context *ctx = avctx->priv_data; + AVFrame *frame = data; + AVCodecContext *codec_avctx = ctx->h264_avctx; + int ret; + + if (avpkt->size > 24 && avpkt->data[8] <= 1 && AV_RL32(avpkt->data + 4) + 24ULL <= avpkt->size) { + int codec_type = avpkt->data[1]; + int index = avpkt->data[10]; + int new_size = AV_RL32(avpkt->data + 4); + int offset, off; + + if (codec_type == 0xA) { + codec_avctx = ctx->hevc_avctx; + } else if (index == 17) { + index = 4; + } else if (index == 18) { + index = 5; + } + + if (index >= 1 && index <= 12) { + ret = av_packet_make_writable(avpkt); + if (ret < 0) + return ret; + + index -= 1; + off = offset = IMM5_units[index].len; + if (codec_type == 2) { + offset += IMM5_units[12].len; + } else { + offset += IMM5_units[13].len; + } + + avpkt->data += 24 - offset; + avpkt->size = new_size + offset; + + memcpy(avpkt->data, IMM5_units[index].bits, IMM5_units[index].len); + if (codec_type == 2) { + memcpy(avpkt->data + off, IMM5_units[12].bits, IMM5_units[12].len); + } else { + memcpy(avpkt->data + off, IMM5_units[13].bits, IMM5_units[13].len); + } + } else { + avpkt->data += 24; + avpkt->size -= 24; + } + } + + ret = avcodec_send_packet(codec_avctx, avpkt); + if (ret < 0) { + av_log(avctx, AV_LOG_ERROR, "Error submitting a packet for decoding\n"); + return ret; + } + + ret = avcodec_receive_frame(codec_avctx, frame); + if (ret < 0) + return ret; + + avctx->pix_fmt = codec_avctx->pix_fmt; + avctx->coded_width = codec_avctx->coded_width; + avctx->coded_height = codec_avctx->coded_height; + avctx->width = codec_avctx->width; + avctx->height = codec_avctx->height; + avctx->bit_rate = codec_avctx->bit_rate; + avctx->colorspace = codec_avctx->colorspace; + avctx->color_range = codec_avctx->color_range; + avctx->color_trc = codec_avctx->color_trc; + avctx->color_primaries = codec_avctx->color_primaries; + avctx->chroma_sample_location = codec_avctx->chroma_sample_location; + + *got_frame = 1; + + return avpkt->size; +} + +static void imm5_flush(AVCodecContext *avctx) +{ + IMM5Context *ctx = avctx->priv_data; + + avcodec_flush_buffers(ctx->h264_avctx); + avcodec_flush_buffers(ctx->hevc_avctx); +} + +static av_cold int imm5_close(AVCodecContext *avctx) +{ + IMM5Context *ctx = avctx->priv_data; + + avcodec_free_context(&ctx->h264_avctx); + avcodec_free_context(&ctx->hevc_avctx); + + return 0; +} + +AVCodec ff_imm5_decoder = { + .name = "imm5", + .long_name = NULL_IF_CONFIG_SMALL("Infinity IMM5"), + .type = AVMEDIA_TYPE_VIDEO, + .id = AV_CODEC_ID_IMM5, + .init = imm5_init, + .decode = imm5_decode_frame, + .close = imm5_close, + .flush = imm5_flush, + .priv_data_size = sizeof(IMM5Context), + .caps_internal = FF_CODEC_CAP_INIT_THREADSAFE | + FF_CODEC_CAP_INIT_CLEANUP, +}; diff --git a/libavcodec/version.h b/libavcodec/version.h index cda6dbae47..ed767c8867 100644 --- a/libavcodec/version.h +++ b/libavcodec/version.h @@ -28,8 +28,8 @@ #include "libavutil/version.h" #define LIBAVCODEC_VERSION_MAJOR 58 -#define LIBAVCODEC_VERSION_MINOR 55 -#define LIBAVCODEC_VERSION_MICRO 102 +#define LIBAVCODEC_VERSION_MINOR 56 +#define LIBAVCODEC_VERSION_MICRO 100 #define LIBAVCODEC_VERSION_INT AV_VERSION_INT(LIBAVCODEC_VERSION_MAJOR, \ LIBAVCODEC_VERSION_MINOR, \ diff --git a/libavformat/riff.c b/libavformat/riff.c index e755ad8d5f..610974ebf0 100644 --- a/libavformat/riff.c +++ b/libavformat/riff.c @@ -488,6 +488,7 @@ const AVCodecTag ff_codec_bmp_tags[] = { { AV_CODEC_ID_AGM, MKTAG('A', 'G', 'M', '6') }, { AV_CODEC_ID_AGM, MKTAG('A', 'G', 'M', '7') }, { AV_CODEC_ID_LSCR, MKTAG('L', 'S', 'C', 'R') }, + { AV_CODEC_ID_IMM5, MKTAG('I', 'M', 'M', '5') }, { AV_CODEC_ID_NONE, 0 } };

1 0

avcodec/msrle: add a flush() callback
by Paul B Mahol 29 Aug '19

29 Aug '19

ffmpeg | branch: master | Paul B Mahol <onemda(a)gmail.com> | Thu Aug 29 18:28:49 2019 +0200| [0067da587a08d32c1eaafa6d10eb27660f03c07a] | committer: Paul B Mahol avcodec/msrle: add a flush() callback The reference frame isn't valid after seeking. > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0067da587a08d32c1… --- libavcodec/msrle.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/libavcodec/msrle.c b/libavcodec/msrle.c index 61bc02df04..b83b3d2a41 100644 --- a/libavcodec/msrle.c +++ b/libavcodec/msrle.c @@ -148,6 +148,13 @@ static int msrle_decode_frame(AVCodecContext *avctx, return buf_size; } +static void msrle_decode_flush(AVCodecContext *avctx) +{ + MsrleContext *s = avctx->priv_data; + + av_frame_unref(s->frame); +} + static av_cold int msrle_decode_end(AVCodecContext *avctx) { MsrleContext *s = avctx->priv_data; @@ -167,5 +174,6 @@ AVCodec ff_msrle_decoder = { .init = msrle_decode_init, .close = msrle_decode_end, .decode = msrle_decode_frame, + .flush = msrle_decode_flush, .capabilities = AV_CODEC_CAP_DR1, };

1 0

configure: fix --enable-omx compile on raspberry pi
by Aman Gupta 29 Aug '19

29 Aug '19

ffmpeg | branch: master | Aman Gupta <aman(a)tmm1.net> | Thu Aug 29 08:44:45 2019 -0700| [59e651c0524450e2acb0cfb2838cd989e806899b] | committer: Aman Gupta configure: fix --enable-omx compile on raspberry pi Many ffmpeg + rpi compilation guides on the internet recommend using `./configure --enable-omx --enable-omx-rpi`. This fails to find the IL OMX headers on device because the omx require_headers check happens first before the add_cflags in omx_rpi. A workaround is to use `./configure --enable-omx-rpi` only, since omx_rpi already implies omx. But because many users expect to use existing scripts and commands, we swap the order here so omx_rpi special cases are applied first. In the past this wasn't an issue because users noticed the OMX_Core.h missing error and installed libomxil-bellagio-dev. But since 76c82843ccad1, the rpi specific headers from /opt/vc/include/IL are required. Signed-off-by: Aman Gupta <aman(a)tmm1.net> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=59e651c0524450e2a… --- configure | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure b/configure index 51dc77c780..691ae9bd4f 100755 --- a/configure +++ b/configure @@ -6358,10 +6358,10 @@ enabled opengl && { check_lib opengl GL/glx.h glXGetProcAddress "-lGL check_lib opengl ES2/gl.h glGetError "-isysroot=${sysroot} -Wl,-framework,OpenGLES" || die "ERROR: opengl not found." } -enabled omx && require_headers OMX_Core.h enabled omx_rpi && { check_headers OMX_Core.h || { ! enabled cross_compile && add_cflags -isystem/opt/vc/include/IL && check_headers OMX_Core.h ; } || die "ERROR: OpenMAX IL headers not found"; } && enable omx +enabled omx && require_headers OMX_Core.h enabled openssl && { check_pkg_config openssl openssl openssl/ssl.h OPENSSL_init_ssl || check_pkg_config openssl openssl openssl/ssl.h SSL_library_init || check_lib openssl openssl/ssl.h SSL_library_init -lssl -lcrypto ||

1 0

avcodec/ivi: Allocate bufs later
by Michael Niedermayer 29 Aug '19

29 Aug '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Wed Aug 14 01:28:09 2019 +0200| [15a65c13e18464fa3077812f0a21131dcf7830cb] | committer: Michael Niedermayer avcodec/ivi: Allocate bufs later Fixes: Timeout (24sec->2sec) Fixes: 15951/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO5_fuzzer-5095433266790400 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=15a65c13e18464fa3… --- libavcodec/ivi.c | 39 ++++++++++++++++++++------------------- 1 file changed, 20 insertions(+), 19 deletions(-) diff --git a/libavcodec/ivi.c b/libavcodec/ivi.c index 73fcf51b7b..18192cbf23 100644 --- a/libavcodec/ivi.c +++ b/libavcodec/ivi.c @@ -354,23 +354,11 @@ av_cold int ff_ivi_init_planes(AVCodecContext *avctx, IVIPlaneDesc *planes, cons band->height = b_height; band->pitch = width_aligned; band->aheight = height_aligned; - band->bufs[0] = av_mallocz(buf_size); - band->bufs[1] = av_mallocz(buf_size); + av_assert0(!band->bufs[0] && !band->bufs[1] && + !band->bufs[2] && !band->bufs[3]); band->bufsize = buf_size/2; - if (!band->bufs[0] || !band->bufs[1]) - return AVERROR(ENOMEM); + av_assert0(buf_size % 2 == 0); - /* allocate the 3rd band buffer for scalability mode */ - if (cfg->luma_bands > 1) { - band->bufs[2] = av_mallocz(buf_size); - if (!band->bufs[2]) - return AVERROR(ENOMEM); - } - if (is_indeo4) { - band->bufs[3] = av_mallocz(buf_size); - if (!band->bufs[3]) - return AVERROR(ENOMEM); - } /* reset custom vlc */ planes[p].bands[0].blk_vlc.cust_desc.num_rows = 0; } @@ -945,6 +933,15 @@ static void ivi_output_plane(IVIPlaneDesc *plane, uint8_t *dst, ptrdiff_t dst_pi } } +static void *prepare_buf(IVI45DecContext *ctx, IVIBandDesc *band, int i) +{ + if (ctx->pic_conf.luma_bands <= 1 && i == 2) + return NULL; + if (!band->bufs[i]) + band->bufs[i] = av_mallocz(2 * band->bufsize); + return band->bufs[i]; +} + /** * Decode an Indeo 4 or 5 band. * @@ -959,18 +956,22 @@ static int decode_band(IVI45DecContext *ctx, int result, i, t, idx1, idx2, pos; IVITile *tile; - band->buf = band->bufs[ctx->dst_buf]; + band->buf = prepare_buf(ctx, band, ctx->dst_buf); if (!band->buf) { av_log(avctx, AV_LOG_ERROR, "Band buffer points to no data!\n"); return AVERROR_INVALIDDATA; } if (ctx->is_indeo4 && ctx->frame_type == IVI4_FRAMETYPE_BIDIR) { - band->ref_buf = band->bufs[ctx->b_ref_buf]; - band->b_ref_buf = band->bufs[ctx->ref_buf]; + band->ref_buf = prepare_buf(ctx, band, ctx->b_ref_buf); + band->b_ref_buf = prepare_buf(ctx, band, ctx->ref_buf); + if (!band->b_ref_buf) + return AVERROR(ENOMEM); } else { - band->ref_buf = band->bufs[ctx->ref_buf]; + band->ref_buf = prepare_buf(ctx, band, ctx->ref_buf); band->b_ref_buf = 0; } + if (!band->ref_buf) + return AVERROR(ENOMEM); band->data_ptr = ctx->frame_data + (get_bits_count(&ctx->gb) >> 3); result = ctx->decode_band_hdr(ctx, band, avctx);

1 0

tools/target_dec_fuzzer: Adjust maxpixels for indeo4
by Michael Niedermayer 29 Aug '19

29 Aug '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Tue Aug 13 23:42:09 2019 +0200| [ba823394f65a5179cc338fc72e37ee7f48c5dac0] | committer: Michael Niedermayer tools/target_dec_fuzzer: Adjust maxpixels for indeo4 Fixes: Timeout (131sec -> 4sec) Fixes: 15581/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-5651105515569152 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ba823394f65a5179c… --- tools/target_dec_fuzzer.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c index 2aa7c67e2a..e22a0c5c34 100644 --- a/tools/target_dec_fuzzer.c +++ b/tools/target_dec_fuzzer.c @@ -137,6 +137,8 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { case AV_CODEC_ID_GDV: maxpixels /= 512; break; // Postprocessing in C case AV_CODEC_ID_HNM4_VIDEO:maxpixels /= 128; break; + // Cliping in C, generally slow even with small input + case AV_CODEC_ID_INDEO4: maxpixels /= 128; break; }

1 0

tools/target_dec_fuzzer: Adjust GDV pixel threshold down by a factor of 2
by Michael Niedermayer 29 Aug '19

29 Aug '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Tue Aug 13 22:06:12 2019 +0200| [96efaa9a1a22cc464951ea79b23246c0249613ab] | committer: Michael Niedermayer tools/target_dec_fuzzer: Adjust GDV pixel threshold down by a factor of 2 Fixes: Timeout (7sec -> 1sec) Fixes: 14709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_GDV_fuzzer-5704215281795072 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=96efaa9a1a22cc464… --- tools/target_dec_fuzzer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c index adef0a0e58..2aa7c67e2a 100644 --- a/tools/target_dec_fuzzer.c +++ b/tools/target_dec_fuzzer.c @@ -134,7 +134,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { case AV_CODEC_ID_SANM: maxpixels /= 16; break; case AV_CODEC_ID_GIF: maxpixels /= 16; break; // Performs slow frame rescaling in C - case AV_CODEC_ID_GDV: maxpixels /= 256; break; + case AV_CODEC_ID_GDV: maxpixels /= 512; break; // Postprocessing in C case AV_CODEC_ID_HNM4_VIDEO:maxpixels /= 128; break; }

1 0

tools/target_dec_fuzzer: adjust pixel threshold for SANM, as it allows coding gigantic images on tiny input
by Michael Niedermayer 29 Aug '19

29 Aug '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Mon Aug 12 10:40:30 2019 +0200| [738ff94f7c3866233063fc6b1087f6371063f840] | committer: Michael Niedermayer tools/target_dec_fuzzer: adjust pixel threshold for SANM, as it allows coding gigantic images on tiny input Fixes: Timeout (13sec ->1sec) Fixes: 16122/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5724944247291904 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=738ff94f7c3866233… --- tools/target_dec_fuzzer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c index c6b506b1ae..adef0a0e58 100644 --- a/tools/target_dec_fuzzer.c +++ b/tools/target_dec_fuzzer.c @@ -131,6 +131,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { case AV_CODEC_ID_DIRAC: maxpixels /= 8192; break; case AV_CODEC_ID_MSRLE: maxpixels /= 16; break; case AV_CODEC_ID_QTRLE: maxpixels /= 16; break; + case AV_CODEC_ID_SANM: maxpixels /= 16; break; case AV_CODEC_ID_GIF: maxpixels /= 16; break; // Performs slow frame rescaling in C case AV_CODEC_ID_GDV: maxpixels /= 256; break;

1 0

avcodec/tta: Fix integer overflow in prediction
by Michael Niedermayer 29 Aug '19

29 Aug '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Aug 11 20:56:44 2019 +0200| [7e9aecc9f358901426c134978e764ee7beac4944] | committer: Michael Niedermayer avcodec/tta: Fix integer overflow in prediction Fixes: signed integer overflow: -395281576 + -1827578048 cannot be represented in type 'int' Fixes: 16038/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5646109705240576 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7e9aecc9f35890142… --- libavcodec/tta.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/libavcodec/tta.c b/libavcodec/tta.c index 4d27fcd555..304f3a81df 100644 --- a/libavcodec/tta.c +++ b/libavcodec/tta.c @@ -227,7 +227,7 @@ static int tta_decode_frame(AVCodecContext *avctx, void *data, GetBitContext gb; int i, ret; int cur_chan = 0, framelen = s->frame_length; - int32_t *p; + uint32_t *p; if (avctx->err_recognition & AV_EF_CRCCHECK) { if (buf_size < 4 || @@ -261,7 +261,7 @@ static int tta_decode_frame(AVCodecContext *avctx, void *data, } i = 0; - for (p = s->decode_buffer; p < s->decode_buffer + (framelen * s->channels); p++) { + for (p = s->decode_buffer; (int32_t*)p < s->decode_buffer + (framelen * s->channels); p++) { int32_t *predictor = &s->ch_ctx[cur_chan].predictor; TTAFilter *filter = &s->ch_ctx[cur_chan].filter; TTARice *rice = &s->ch_ctx[cur_chan].rice; @@ -334,7 +334,7 @@ static int tta_decode_frame(AVCodecContext *avctx, void *data, // decorrelate in case of multiple channels if (s->channels > 1) { int32_t *r = p - 1; - for (*p += *r / 2; r > p - s->channels; r--) + for (*p += *r / 2; r > (int32_t*)p - s->channels; r--) *r = *(r + 1) - *r; } cur_chan = 0; @@ -358,13 +358,13 @@ static int tta_decode_frame(AVCodecContext *avctx, void *data, switch (s->bps) { case 1: { uint8_t *samples = (uint8_t *)frame->data[0]; - for (p = s->decode_buffer; p < s->decode_buffer + (framelen * s->channels); p++) + for (p = s->decode_buffer; (int32_t*)p < s->decode_buffer + (framelen * s->channels); p++) *samples++ = *p + 0x80; break; } case 2: { int16_t *samples = (int16_t *)frame->data[0]; - for (p = s->decode_buffer; p < s->decode_buffer + (framelen * s->channels); p++) + for (p = s->decode_buffer; (int32_t*)p < s->decode_buffer + (framelen * s->channels); p++) *samples++ = *p; break; }

1 0

avcodec/vb: Check input packet size to be large enough to contain flags
by Michael Niedermayer 29 Aug '19

29 Aug '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Mon Aug 12 00:21:49 2019 +0200| [dea2591d4fbc989ca82bc8a8ad7d16aacdc89af1] | committer: Michael Niedermayer avcodec/vb: Check input packet size to be large enough to contain flags Fixes: Timeout (->9sec) Fixes: 16292/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VB_fuzzer-5747063496638464 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=dea2591d4fbc989ca… --- libavcodec/vb.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/vb.c b/libavcodec/vb.c index c6dd6fb456..d9c6b93a73 100644 --- a/libavcodec/vb.c +++ b/libavcodec/vb.c @@ -199,6 +199,9 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, uint32_t size; int offset = 0; + if (avpkt->size < 2) + return AVERROR_INVALIDDATA; + bytestream2_init(&c->stream, avpkt->data, avpkt->size); if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)

1 0

avcodec/cavsdec: Limit the number of access units per packet to 2
by Michael Niedermayer 29 Aug '19

29 Aug '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sat Aug 10 17:34:37 2019 +0200| [37bc8e3249c88b733bcc0d8c74cdf668292e4d63] | committer: Michael Niedermayer avcodec/cavsdec: Limit the number of access units per packet to 2 Fixes: Timeout (122sec -> 13ms) Fixes: 15978/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5148925004087296 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=37bc8e3249c88b733… --- libavcodec/cavsdec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c index 5f3b354518..1c4f71824a 100644 --- a/libavcodec/cavsdec.c +++ b/libavcodec/cavsdec.c @@ -1215,6 +1215,7 @@ static int cavs_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, int input_size, ret; const uint8_t *buf_end; const uint8_t *buf_ptr; + int frame_start = 0; if (buf_size == 0) { if (!h->low_delay && h->DPB[0].f->data[0]) { @@ -1248,6 +1249,9 @@ static int cavs_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, h->got_keyframe = 1; } case PIC_PB_START_CODE: + if (frame_start > 1) + return AVERROR_INVALIDDATA; + frame_start ++; if (*got_frame) av_frame_unref(data); *got_frame = 0;

1 0