February 2020 - ffmpeg-cvslog

avcodec/magicyuv: Check that there are enough lines for interlacing to be possible
by Michael Niedermayer 25 Feb '20

25 Feb '20

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sat Feb 22 00:42:30 2020 +0100| [f8a0e9f9f71cf5650bdc250ff7475e0f7d8e8420] | committer: Michael Niedermayer avcodec/magicyuv: Check that there are enough lines for interlacing to be possible Fixes: out of array access Fixes: 20763/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_fuzzer-5759562508664832 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f8a0e9f9f71cf5650… --- libavcodec/magicyuv.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/libavcodec/magicyuv.c b/libavcodec/magicyuv.c index 21a32785bc..aacd0d4d7d 100644 --- a/libavcodec/magicyuv.c +++ b/libavcodec/magicyuv.c @@ -659,6 +659,17 @@ static int magy_decode_frame(AVCodecContext *avctx, void *data, return AVERROR_INVALIDDATA; } + if (s->interlaced) { + if ((s->slice_height >> s->vshift[1]) < 2) { + av_log(avctx, AV_LOG_ERROR, "impossible slice height\n"); + return AVERROR_INVALIDDATA; + } + if ((avctx->coded_height % s->slice_height) && ((avctx->coded_height % s->slice_height) >> s->vshift[1]) < 2) { + av_log(avctx, AV_LOG_ERROR, "impossible height\n"); + return AVERROR_INVALIDDATA; + } + } + for (i = 0; i < s->planes; i++) { av_fast_malloc(&s->slices[i], &s->slices_size[i], s->nb_slices * sizeof(Slice)); if (!s->slices[i])

1 0

avformat/mvdec: Check stream numbers
by Michael Niedermayer 25 Feb '20

25 Feb '20

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Feb 23 09:27:27 2020 +0100| [618a9bea65112a27a106e02ada3ae475cc8ac1ac] | committer: Michael Niedermayer avformat/mvdec: Check stream numbers Fixes: null pointer dereference Fixes: 20768/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5638648978735104.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=618a9bea65112a27a… --- libavformat/mvdec.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavformat/mvdec.c b/libavformat/mvdec.c index f9f7e38137..64166a84b1 100644 --- a/libavformat/mvdec.c +++ b/libavformat/mvdec.c @@ -363,6 +363,12 @@ static int mv_read_header(AVFormatContext *avctx) if ((ret = read_table(avctx, NULL, parse_global_var)) < 0) return ret; + if (mv->nb_audio_tracks < 0 || mv->nb_video_tracks < 0 || + (mv->nb_audio_tracks == 0 && mv->nb_video_tracks == 0)) { + av_log(avctx, AV_LOG_ERROR, "Stream count is invalid.\n"); + return AVERROR_INVALIDDATA; + } + if (mv->nb_audio_tracks > 1) { avpriv_request_sample(avctx, "Multiple audio streams support"); return AVERROR_PATCHWELCOME;

1 0

avformat/mux: Cosmetics
by Andreas Rheinhardt 25 Feb '20

25 Feb '20

ffmpeg | branch: master | Andreas Rheinhardt <andreas.rheinhardt(a)gmail.com> | Tue Aug 13 04:47:17 2019 +0200| [f701414bd54639f0b0cc72e129ac1a6e9141c6f8] | committer: Michael Niedermayer avformat/mux: Cosmetics Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f701414bd54639f0b… --- libavformat/mux.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/libavformat/mux.c b/libavformat/mux.c index 3533932a58..d88746e8c5 100644 --- a/libavformat/mux.c +++ b/libavformat/mux.c @@ -928,13 +928,13 @@ int ff_interleave_add_packet(AVFormatContext *s, AVPacket *pkt, { int ret; AVPacketList **next_point, *this_pktl; - AVStream *st = s->streams[pkt->stream_index]; - int chunked = s->max_chunk_size || s->max_chunk_duration; + AVStream *st = s->streams[pkt->stream_index]; + int chunked = s->max_chunk_size || s->max_chunk_duration; - this_pktl = av_malloc(sizeof(AVPacketList)); + this_pktl = av_malloc(sizeof(AVPacketList)); if (!this_pktl) return AVERROR(ENOMEM); - if ((pkt->flags & AV_PKT_FLAG_UNCODED_FRAME)) { + if (pkt->flags & AV_PKT_FLAG_UNCODED_FRAME) { av_assert0(pkt->size == UNCODED_FRAME_PACKET_SIZE); av_assert0(((AVFrame *)pkt->data)->buf); } else { @@ -947,7 +947,7 @@ int ff_interleave_add_packet(AVFormatContext *s, AVPacket *pkt, av_packet_move_ref(&this_pktl->pkt, pkt); pkt = &this_pktl->pkt; - if (s->streams[pkt->stream_index]->last_in_packet_buffer) { + if (st->last_in_packet_buffer) { next_point = &(st->last_in_packet_buffer->next); } else { next_point = &s->internal->packet_buffer; @@ -959,8 +959,8 @@ int ff_interleave_add_packet(AVFormatContext *s, AVPacket *pkt, st->interleaver_chunk_duration += pkt->duration; if ( (s->max_chunk_size && st->interleaver_chunk_size > s->max_chunk_size) || (max && st->interleaver_chunk_duration > max)) { - st->interleaver_chunk_size = 0; - this_pktl->pkt.flags |= CHUNK_START; + st->interleaver_chunk_size = 0; + pkt->flags |= CHUNK_START; if (max && st->interleaver_chunk_duration > max) { int64_t syncoffset = (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO)*max/2; int64_t syncto = av_rescale(pkt->dts + syncoffset, 1, max)*max - syncoffset; @@ -971,7 +971,7 @@ int ff_interleave_add_packet(AVFormatContext *s, AVPacket *pkt, } } if (*next_point) { - if (chunked && !(this_pktl->pkt.flags & CHUNK_START)) + if (chunked && !(pkt->flags & CHUNK_START)) goto next_non_null; if (compare(s, &s->internal->packet_buffer_end->pkt, pkt)) { @@ -992,8 +992,7 @@ next_non_null: this_pktl->next = *next_point; - s->streams[pkt->stream_index]->last_in_packet_buffer = - *next_point = this_pktl; + st->last_in_packet_buffer = *next_point = this_pktl; return 0; }

1 0

avformat/segafilmenc: Add deinit function
by Andreas Rheinhardt 25 Feb '20

25 Feb '20

ffmpeg | branch: master | Andreas Rheinhardt <andreas.rheinhardt(a)gmail.com> | Tue Jan 14 04:13:36 2020 +0100| [da304e78b5175cb45b06116006e1901cef077ffd] | committer: Michael Niedermayer avformat/segafilmenc: Add deinit function Prevents memleaks when the trailer is never written or when shifting the data fails when writing the trailer. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=da304e78b5175cb45… --- libavformat/segafilmenc.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/libavformat/segafilmenc.c b/libavformat/segafilmenc.c index 7778609e9a..93c482ef7d 100644 --- a/libavformat/segafilmenc.c +++ b/libavformat/segafilmenc.c @@ -360,10 +360,23 @@ static int film_write_header(AVFormatContext *format_context) packet = packet->next; av_freep(&prev); } + film->start = film->last = NULL; return 0; } +static void film_deinit(AVFormatContext *format_context) +{ + FILMOutputContext *film = format_context->priv_data; + FILMPacket *packet = film->start; + while (packet != NULL) { + FILMPacket *next = packet->next; + av_free(packet); + packet = next; + } + film->start = film->last = NULL; +} + AVOutputFormat ff_segafilm_muxer = { .name = "film_cpk", .long_name = NULL_IF_CONFIG_SMALL("Sega FILM / CPK"), @@ -374,4 +387,5 @@ AVOutputFormat ff_segafilm_muxer = { .init = film_init, .write_trailer = film_write_header, .write_packet = film_write_packet, + .deinit = film_deinit, };

1 0

avformat/segafilmenc: Combine several checks
by Andreas Rheinhardt 25 Feb '20

25 Feb '20

ffmpeg | branch: master | Andreas Rheinhardt <andreas.rheinhardt(a)gmail.com> | Tue Jan 14 04:13:35 2020 +0100| [ab44f0aee88032d2a406b689ff2ff144cf26b0ef] | committer: Michael Niedermayer avformat/segafilmenc: Combine several checks by moving them around. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ab44f0aee88032d2a… --- libavformat/segafilmenc.c | 26 +++++++++----------------- 1 file changed, 9 insertions(+), 17 deletions(-) diff --git a/libavformat/segafilmenc.c b/libavformat/segafilmenc.c index 5253c14368..7778609e9a 100644 --- a/libavformat/segafilmenc.c +++ b/libavformat/segafilmenc.c @@ -155,7 +155,6 @@ static int get_audio_codec_id(enum AVCodecID codec_id) static int film_init(AVFormatContext *format_context) { - AVStream *audio = NULL; FILMOutputContext *film = format_context->priv_data; film->audio_index = -1; film->video_index = -1; @@ -171,8 +170,12 @@ static int film_init(AVFormatContext *format_context) av_log(format_context, AV_LOG_ERROR, "Sega FILM allows a maximum of one audio stream.\n"); return AVERROR(EINVAL); } + if (get_audio_codec_id(st->codecpar->codec_id) < 0) { + av_log(format_context, AV_LOG_ERROR, + "Incompatible audio stream format.\n"); + return AVERROR(EINVAL); + } film->audio_index = i; - audio = st; } if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO) { @@ -200,11 +203,6 @@ static int film_init(AVFormatContext *format_context) return AVERROR(EINVAL); } - if (audio != NULL && get_audio_codec_id(audio->codecpar->codec_id) < 0) { - av_log(format_context, AV_LOG_ERROR, "Incompatible audio stream format.\n"); - return AVERROR(EINVAL); - } - return 0; } @@ -269,11 +267,9 @@ static int film_write_header(AVFormatContext *format_context) { int ret = 0; int64_t sample_table_size, stabsize, headersize; - int8_t audio_codec; AVIOContext *pb = format_context->pb; FILMOutputContext *film = format_context->priv_data; FILMPacket *prev, *packet; - AVStream *audio = NULL; AVStream *video = NULL; /* Calculate how much we need to reserve for the header; @@ -290,13 +286,6 @@ static int film_write_header(AVFormatContext *format_context) /* Seek back to the beginning to start writing the header now */ avio_seek(pb, 0, SEEK_SET); - if (film->audio_index > -1) - audio = format_context->streams[film->audio_index]; - - if (audio != NULL) { - audio_codec = get_audio_codec_id(audio->codecpar->codec_id); - } - /* First, write the FILM header; this is very simple */ ffio_wfourcc(pb, "FILM"); @@ -327,7 +316,10 @@ static int film_write_header(AVFormatContext *format_context) avio_wb32(pb, video->codecpar->width); avio_w8(pb, 24); /* Bits per pixel - observed to always be 24 */ - if (audio != NULL) { + if (film->audio_index > -1) { + AVStream *audio = format_context->streams[film->audio_index]; + int audio_codec = get_audio_codec_id(audio->codecpar->codec_id); + avio_w8(pb, audio->codecpar->channels); /* Audio channels */ avio_w8(pb, audio->codecpar->bits_per_coded_sample); /* Audio bit depth */ avio_w8(pb, audio_codec); /* Compression - 0 is PCM, 2 is ADX */

1 0

avfilter/vf_zscale: fix crash on unaligned input
by Jacob Ruiz 25 Feb '20

25 Feb '20

ffmpeg | branch: master | Jacob Ruiz <jruiz(a)ruiz.org> | Thu Feb 13 22:50:38 2020 -0800| [ba2581adb26f5df1c8b605ae80fc3005f4e53ee0] | committer: Paul B Mahol avfilter/vf_zscale: fix crash on unaligned input > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ba2581adb26f5df1c… --- libavfilter/vf_zscale.c | 59 ++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 49 insertions(+), 10 deletions(-) diff --git a/libavfilter/vf_zscale.c b/libavfilter/vf_zscale.c index 46c5dd7f38..023a5d10e9 100644 --- a/libavfilter/vf_zscale.c +++ b/libavfilter/vf_zscale.c @@ -44,6 +44,8 @@ #include "libavutil/imgutils.h" #include "libavutil/avassert.h" +#define ZIMG_ALIGNMENT 32 + static const char *const var_names[] = { "in_w", "iw", "in_h", "ih", @@ -502,6 +504,44 @@ static int graph_build(zimg_filter_graph **graph, zimg_graph_builder_params *par return 0; } +static int realign_frame(const AVPixFmtDescriptor *desc, AVFrame **frame) +{ + AVFrame *aligned = NULL; + int ret = 0, plane; + + /* Realign any unaligned input frame. */ + for (plane = 0; plane < 3; plane++) { + int p = desc->comp[plane].plane; + if ((uintptr_t)(*frame)->data[p] % ZIMG_ALIGNMENT || (*frame)->linesize[p] % ZIMG_ALIGNMENT) { + if (!(aligned = av_frame_alloc())) { + ret = AVERROR(ENOMEM); + goto fail; + } + + aligned->format = (*frame)->format; + aligned->width = (*frame)->width; + aligned->height = (*frame)->height; + + if ((ret = av_frame_get_buffer(aligned, ZIMG_ALIGNMENT)) < 0) + goto fail; + + if ((ret = av_frame_copy(aligned, *frame)) < 0) + goto fail; + + if ((ret = av_frame_copy_props(aligned, *frame)) < 0) + goto fail; + + av_frame_free(frame); + *frame = aligned; + return 0; + } + } + +fail: + av_frame_free(&aligned); + return ret; +} + static int filter_frame(AVFilterLink *link, AVFrame *in) { ZScaleContext *s = link->dst->priv; @@ -512,12 +552,14 @@ static int filter_frame(AVFilterLink *link, AVFrame *in) zimg_image_buffer dst_buf = { ZIMG_API_VERSION }; char buf[32]; int ret = 0, plane; - AVFrame *out; + AVFrame *out = NULL; - out = ff_get_video_buffer(outlink, outlink->w, outlink->h); - if (!out) { - av_frame_free(&in); - return AVERROR(ENOMEM); + if ((ret = realign_frame(desc, &in)) < 0) + goto fail; + + if (!(out = ff_get_video_buffer(outlink, outlink->w, outlink->h))) { + ret = AVERROR(ENOMEM); + goto fail; } av_frame_copy_props(out, in); @@ -546,11 +588,8 @@ static int filter_frame(AVFilterLink *link, AVFrame *in) link->dst->inputs[0]->w = in->width; link->dst->inputs[0]->h = in->height; - if ((ret = config_props(outlink)) < 0) { - av_frame_free(&in); - av_frame_free(&out); - return ret; - } + if ((ret = config_props(outlink)) < 0) + goto fail; zimg_image_format_default(&s->src_format, ZIMG_API_VERSION); zimg_image_format_default(&s->dst_format, ZIMG_API_VERSION);

1 0

avfilter/vf_convolve: reset fft/ifft pointers after free
by Paul B Mahol 25 Feb '20

25 Feb '20

ffmpeg | branch: master | Paul B Mahol <onemda(a)gmail.com> | Tue Feb 25 17:35:09 2020 +0100| [7e08a9237080cd8fbe0fa846548ff185e682e92f] | committer: Paul B Mahol avfilter/vf_convolve: reset fft/ifft pointers after free > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7e08a9237080cd8fb… --- libavfilter/vf_convolve.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavfilter/vf_convolve.c b/libavfilter/vf_convolve.c index 024eb68486..90ec98715b 100644 --- a/libavfilter/vf_convolve.c +++ b/libavfilter/vf_convolve.c @@ -590,7 +590,9 @@ static av_cold void uninit(AVFilterContext *ctx) for (j = 0; j < MAX_THREADS; j++) { av_fft_end(s->fft[i][j]); + s->fft[i][j] = NULL; av_fft_end(s->ifft[i][j]); + s->ifft[i][j] = NULL; } }

1 0

doc/filters: split tblend from blend
by Paul B Mahol 25 Feb '20

25 Feb '20

ffmpeg | branch: master | Paul B Mahol <onemda(a)gmail.com> | Tue Feb 25 13:23:14 2020 +0100| [ad65a15328c6db87e8f3ec94cc9fc16e1e241f3d] | committer: Paul B Mahol doc/filters: split tblend from blend > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ad65a15328c6db87e… --- doc/filters.texi | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/doc/filters.texi b/doc/filters.texi index 5bc49ce17f..586ed9034b 100644 --- a/doc/filters.texi +++ b/doc/filters.texi @@ -6608,7 +6608,8 @@ The threshold below which a pixel value is considered black; it defaults to @end table -@section blend, tblend +@anchor{blend} +@section blend Blend two video frames into each other. @@ -17817,6 +17818,11 @@ the position in the file of the input frame, NAN if unknown @section swapuv Swap U & V plane. +@section tblend +Blend successive video frames. + +See @ref{blend} + @section telecine Apply telecine process to the video.

1 0

doc/filters: mention commands for v360 filter
by Paul B Mahol 25 Feb '20

25 Feb '20

ffmpeg | branch: master | Paul B Mahol <onemda(a)gmail.com> | Tue Feb 25 13:17:32 2020 +0100| [2e6db121a89c59fc744415d3e3e89c432d992207] | committer: Paul B Mahol doc/filters: mention commands for v360 filter > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2e6db121a89c59fc7… --- doc/filters.texi | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/doc/filters.texi b/doc/filters.texi index 8300aac4a3..5bc49ce17f 100644 --- a/doc/filters.texi +++ b/doc/filters.texi @@ -19130,6 +19130,10 @@ v360=eac:equirect:in_stereo=sbs:in_trans=1:ih_flip=1:out_stereo=tb @end example @end itemize +@subsection Commands + +This filter supports subset of above options as @ref{commands}. + @section vaguedenoiser Apply a wavelet based denoiser.

1 0

avcodec/utvideodec: add support for UQY0
by Paul B Mahol 25 Feb '20

25 Feb '20

ffmpeg | branch: master | Paul B Mahol <onemda(a)gmail.com> | Tue Feb 25 13:09:20 2020 +0100| [022796c82f5dde0079d5cfdb7fd8ead3e8bc446d] | committer: Paul B Mahol avcodec/utvideodec: add support for UQY0 > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=022796c82f5dde007… --- libavcodec/utvideodec.c | 14 ++++++++++++++ libavformat/riff.c | 1 + 2 files changed, 15 insertions(+) diff --git a/libavcodec/utvideodec.c b/libavcodec/utvideodec.c index d5af9d53a8..4da257fc61 100644 --- a/libavcodec/utvideodec.c +++ b/libavcodec/utvideodec.c @@ -890,6 +890,15 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, } } break; + case AV_PIX_FMT_YUV420P10: + for (i = 0; i < 3; i++) { + ret = decode_plane10(c, i, (uint16_t *)frame.f->data[i], frame.f->linesize[i] / 2, + avctx->width >> !!i, avctx->height >> !!i, + plane_start[i], plane_start[i + 1] - 1024, c->frame_pred == PRED_LEFT); + if (ret) + return ret; + } + break; case AV_PIX_FMT_YUV422P10: for (i = 0; i < 3; i++) { ret = decode_plane10(c, i, (uint16_t *)frame.f->data[i], frame.f->linesize[i] / 2, @@ -948,6 +957,11 @@ static av_cold int decode_init(AVCodecContext *avctx) avctx->pix_fmt = AV_PIX_FMT_YUV444P; avctx->colorspace = AVCOL_SPC_BT470BG; break; + case MKTAG('U', 'Q', 'Y', '0'): + c->planes = 3; + c->pro = 1; + avctx->pix_fmt = AV_PIX_FMT_YUV420P10; + break; case MKTAG('U', 'Q', 'Y', '2'): c->planes = 3; c->pro = 1; diff --git a/libavformat/riff.c b/libavformat/riff.c index b15d5e9753..3679b181df 100644 --- a/libavformat/riff.c +++ b/libavformat/riff.c @@ -403,6 +403,7 @@ const AVCodecTag ff_codec_bmp_tags[] = { { AV_CODEC_ID_UTVIDEO, MKTAG('U', 'L', 'H', '0') }, { AV_CODEC_ID_UTVIDEO, MKTAG('U', 'L', 'H', '2') }, { AV_CODEC_ID_UTVIDEO, MKTAG('U', 'L', 'H', '4') }, + { AV_CODEC_ID_UTVIDEO, MKTAG('U', 'Q', 'Y', '0') }, { AV_CODEC_ID_UTVIDEO, MKTAG('U', 'Q', 'Y', '2') }, { AV_CODEC_ID_UTVIDEO, MKTAG('U', 'Q', 'R', 'A') }, { AV_CODEC_ID_UTVIDEO, MKTAG('U', 'Q', 'R', 'G') },

1 0