October 2021 - ffmpeg-cvslog - lists.ffmpeg.org

avfilter/vf_bilateral: remove unused arguments
by Paul B Mahol 21 Oct '21

21 Oct '21

ffmpeg | branch: master | Paul B Mahol <onemda(a)gmail.com> | Thu Oct 21 21:15:48 2021 +0200| [4e4057e437972988e23b9d36092f17818871ac93] | committer: Paul B Mahol avfilter/vf_bilateral: remove unused arguments > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4e4057e437972988e… --- libavfilter/vf_bilateral.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/libavfilter/vf_bilateral.c b/libavfilter/vf_bilateral.c index 61c9084933..aecde64860 100644 --- a/libavfilter/vf_bilateral.c +++ b/libavfilter/vf_bilateral.c @@ -143,7 +143,6 @@ static int config_input(AVFilterLink *inlink) #define BILATERAL(type, name) \ static void bilateral_##name(BilateralContext *s, const uint8_t *ssrc, uint8_t *ddst, \ - float sigma_spatial, float sigma_range, \ int width, int height, int src_linesize, int dst_linesize) \ { \ type *dst = (type *)ddst; \ @@ -314,11 +313,11 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in) } if (s->depth <= 8) - bilateral_byte(s, in->data[plane], out->data[plane], s->sigmaS, s->sigmaR, + bilateral_byte(s, in->data[plane], out->data[plane], s->planewidth[plane], s->planeheight[plane], in->linesize[plane], out->linesize[plane]); else - bilateral_word(s, in->data[plane], out->data[plane], s->sigmaS, s->sigmaR, + bilateral_word(s, in->data[plane], out->data[plane], s->planewidth[plane], s->planeheight[plane], in->linesize[plane] / 2, out->linesize[plane] / 2); }

1 0

avfilter/vf_bilateral: remove unneeded multiplications
by Paul B Mahol 21 Oct '21

21 Oct '21

ffmpeg | branch: master | Paul B Mahol <onemda(a)gmail.com> | Thu Oct 21 21:05:02 2021 +0200| [f0ad40b525b5f882f048cf69139bbe496ba59eea] | committer: Paul B Mahol avfilter/vf_bilateral: remove unneeded multiplications > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f0ad40b525b5f882f… --- libavfilter/vf_bilateral.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/libavfilter/vf_bilateral.c b/libavfilter/vf_bilateral.c index 2a4a3df6cc..61c9084933 100644 --- a/libavfilter/vf_bilateral.c +++ b/libavfilter/vf_bilateral.c @@ -186,11 +186,11 @@ static void bilateral_##name(BilateralContext *s, const uint8_t *ssrc, uint8_t * *temp_factor_x++ = fc = inv_alpha_ + alpha_ * fp; \ fp = fc; \ } \ - --temp_x; *temp_x = 0.5f*((*temp_x) + (*--in_x)); \ + --temp_x; *temp_x = ((*temp_x) + (*--in_x)); \ tpr = *--texture_x; \ ypr = *in_x; \ \ - --temp_factor_x; *temp_factor_x = 0.5f*((*temp_factor_x) + 1); \ + --temp_factor_x; *temp_factor_x = ((*temp_factor_x) + 1); \ fp = 1; \ \ for (int x = width - 2; x >= 0; x--) { \ @@ -200,13 +200,13 @@ static void bilateral_##name(BilateralContext *s, const uint8_t *ssrc, uint8_t * float alpha_ = range_table[range_dist]; \ \ ycr = inv_alpha_ * (*--in_x) + alpha_ * ypr; \ - --temp_x; *temp_x = 0.5f*((*temp_x) + ycr); \ + --temp_x; *temp_x = ((*temp_x) + ycr); \ tpr = tcr; \ ypr = ycr; \ \ fc = inv_alpha_ + alpha_*fp; \ --temp_factor_x; \ - *temp_factor_x = 0.5f*((*temp_factor_x) + fc); \ + *temp_factor_x = ((*temp_factor_x) + fc); \ fp = fc; \ } \ } \ @@ -238,14 +238,14 @@ static void bilateral_##name(BilateralContext *s, const uint8_t *ssrc, uint8_t * ypf = line_factor_b; \ memcpy(ypf, &in_factor[h1 * width], sizeof(float) * width); \ for (int x = 0; x < width; x++) \ - map_factor_b[h1 * width + x] = 0.5f*(map_factor_b[h1 * width + x] + ypf[x]); \ + map_factor_b[h1 * width + x] = (map_factor_b[h1 * width + x] + ypf[x]); \ \ ycy = slice_factor_a; \ ypy = slice_factor_b; \ memcpy(ypy, &img_temp[h1 * width], sizeof(float) * width); \ for (int x = 0, k = 0; x < width; x++) { \ int idx = h1 * width + x; \ - img_out_f[idx] = 0.5f*(img_out_f[idx] + ypy[k++]) / map_factor_b[h1 * width + x]; \ + img_out_f[idx] = (img_out_f[idx] + ypy[k++]) / map_factor_b[h1 * width + x]; \ } \ \ for (int y = h1 - 1; y >= 0; y--) { \ @@ -270,11 +270,11 @@ static void bilateral_##name(BilateralContext *s, const uint8_t *ssrc, uint8_t * float ycc, fcc = inv_alpha_*(*xcf++) + alpha_*(*ypf_++); \ \ *ycf_++ = fcc; \ - *factor_ = 0.5f * (*factor_ + fcc); \ + *factor_ = (*factor_ + fcc); \ \ ycc = inv_alpha_*(*xcy++) + alpha_*(*ypy_++); \ *ycy_++ = ycc; \ - *out_ = 0.5f * (*out_ + ycc) / (*factor_); \ + *out_ = (*out_ + ycc) / (*factor_); \ out_++; \ factor_++; \ } \

1 0

avcodec/ttadsp: Fix integer overflows in tta_filter_process_c()
by Michael Niedermayer 21 Oct '21

21 Oct '21

ffmpeg | branch: release/4.4 | Michael Niedermayer <michael(a)niedermayer.cc> | Fri Oct 15 00:04:59 2021 +0200| [404c9331dde21f0e7b1b10649b2e348e854f45bb] | committer: Michael Niedermayer avcodec/ttadsp: Fix integer overflows in tta_filter_process_c() Fixes: signed integer overflow: 822841647 + 1647055738 cannot be represented in type 'int' Fixes: 39935/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-4592657142251520 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit f24028c798397af720acb838357785aa705a8122) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=404c9331dde21f0e7… --- libavcodec/ttadsp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/ttadsp.c b/libavcodec/ttadsp.c index 1d1443aee0..99dd66a0c2 100644 --- a/libavcodec/ttadsp.c +++ b/libavcodec/ttadsp.c @@ -47,9 +47,9 @@ static void tta_filter_process_c(int32_t *qmi, int32_t *dx, int32_t *dl, *error = *in; *in += (round >> shift); - dl[4] = -dl[5]; dl[5] = -dl[6]; - dl[6] = *in - dl[7]; dl[7] = *in; - dl[5] += dl[6]; dl[4] += dl[5]; + dl[4] = -(unsigned)dl[5]; dl[5] = -(unsigned)dl[6]; + dl[6] = *in -(unsigned)dl[7]; dl[7] = *in; + dl[5] += (unsigned)dl[6]; dl[4] += (unsigned)dl[5]; } av_cold void ff_ttadsp_init(TTADSPContext *c)

1 0

avutil/mathematics: Document av_rescale_rnd() behavior on non int64 results
by Michael Niedermayer 21 Oct '21

21 Oct '21

ffmpeg | branch: release/4.4 | Michael Niedermayer <michael(a)niedermayer.cc> | Wed Oct 20 19:51:08 2021 +0200| [875fbddd7d7b342f98ded3dfddf2ad7b30569b50] | committer: Michael Niedermayer avutil/mathematics: Document av_rescale_rnd() behavior on non int64 results Reviewed-by: Derek Buitenhuis <derek.buitenhuis(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit e154353fdb73dc1b3c1519350244d5346f761850) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=875fbddd7d7b342f9… --- libavutil/mathematics.h | 1 + 1 file changed, 1 insertion(+) diff --git a/libavutil/mathematics.h b/libavutil/mathematics.h index 54901800ba..64d4137a60 100644 --- a/libavutil/mathematics.h +++ b/libavutil/mathematics.h @@ -134,6 +134,7 @@ int64_t av_rescale(int64_t a, int64_t b, int64_t c) av_const; * * The operation is mathematically equivalent to `a * b / c`, but writing that * directly can overflow, and does not support different rounding methods. + * If the result is not representable then INT64_MIN is returned. * * @see av_rescale(), av_rescale_q(), av_rescale_q_rnd() */

1 0

avcodec/utils: Ensure 8x8 alignment for ARGO in avcodec_align_dimensions2()
by Michael Niedermayer 21 Oct '21

21 Oct '21

ffmpeg | branch: release/4.4 | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Oct 10 23:13:43 2021 +0200| [32b68a62328a98e8ea5fb8b8a4c09704ff565334] | committer: Michael Niedermayer avcodec/utils: Ensure 8x8 alignment for ARGO in avcodec_align_dimensions2() Fixes: out of array access Fixes: 39736/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ARGO_fuzzer-4820016722214912 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 17e36fac0b5432f67e25adca7186c57f2dbe1c71) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=32b68a62328a98e8e… --- libavcodec/utils.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libavcodec/utils.c b/libavcodec/utils.c index 08c37a1d93..825094d2f3 100644 --- a/libavcodec/utils.c +++ b/libavcodec/utils.c @@ -268,6 +268,7 @@ void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height, h_align = 4; } if (s->codec_id == AV_CODEC_ID_JV || + s->codec_id == AV_CODEC_ID_ARGO || s->codec_id == AV_CODEC_ID_INTERPLAY_VIDEO) { w_align = 8; h_align = 8; @@ -298,8 +299,8 @@ void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height, break; case AV_PIX_FMT_BGR0: if (s->codec_id == AV_CODEC_ID_ARGO) { - w_align = 4; - h_align = 4; + w_align = 8; + h_align = 8; } break; default:

1 0

avformat/matroskadec: Reset state also on failure in matroska_reset_status()
by Michael Niedermayer 21 Oct '21

21 Oct '21

ffmpeg | branch: release/4.4 | Michael Niedermayer <michael(a)niedermayer.cc> | Thu Jun 24 19:53:47 2021 +0200| [bac4bb747a233f23b3183594207328f4a067e1fb] | committer: Michael Niedermayer avformat/matroskadec: Reset state also on failure in matroska_reset_status() The calling code does not handle failures and will fail with assertion failures later. Seeking can always fail even when the position was previously read. Fixes: Assertion failure Fixes: 35253/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-4693059982983168 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit d115eec97929e23fd1b06df2d95f48cf5000eb87) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bac4bb747a233f23b… --- libavformat/matroskadec.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index a2efdb42b0..fb1849f9c3 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -802,20 +802,22 @@ static int matroska_read_close(AVFormatContext *s); static int matroska_reset_status(MatroskaDemuxContext *matroska, uint32_t id, int64_t position) { + int64_t err = 0; if (position >= 0) { - int64_t err = avio_seek(matroska->ctx->pb, position, SEEK_SET); - if (err < 0) - return err; - } + err = avio_seek(matroska->ctx->pb, position, SEEK_SET); + if (err > 0) + err = 0; + } else + position = avio_tell(matroska->ctx->pb); matroska->current_id = id; matroska->num_levels = 1; matroska->unknown_count = 0; - matroska->resync_pos = avio_tell(matroska->ctx->pb); + matroska->resync_pos = position; if (id) matroska->resync_pos -= (av_log2(id) + 7) / 8; - return 0; + return err; } static int matroska_resync(MatroskaDemuxContext *matroska, int64_t last_pos) @@ -1871,6 +1873,7 @@ static int matroska_parse_seekhead_entry(MatroskaDemuxContext *matroska, uint32_t saved_id = matroska->current_id; int64_t before_pos = avio_tell(matroska->ctx->pb); int ret = 0; + int ret2; /* seek */ if (avio_seek(matroska->ctx->pb, pos, SEEK_SET) == pos) { @@ -1895,7 +1898,9 @@ static int matroska_parse_seekhead_entry(MatroskaDemuxContext *matroska, } /* Seek back - notice that in all instances where this is used * it is safe to set the level to 1. */ - matroska_reset_status(matroska, saved_id, before_pos); + ret2 = matroska_reset_status(matroska, saved_id, before_pos); + if (ret >= 0) + ret = ret2; return ret; }

1 0

avformat/wavdec: Check smv_block_size
by Michael Niedermayer 21 Oct '21

21 Oct '21

ffmpeg | branch: release/4.4 | Michael Niedermayer <michael(a)niedermayer.cc> | Mon Oct 4 23:54:46 2021 +0200| [ea190a10d3f80c6206d480fa232445e3bcda7459] | committer: Michael Niedermayer avformat/wavdec: Check smv_block_size Fixes: Timeout Fixes: 39554/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-4915221701984256 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 849138f476f4b08656681bfc3aec5beac47777fb) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ea190a10d3f80c620… --- libavformat/wavdec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c index 212d198e99..b11c6091bc 100644 --- a/libavformat/wavdec.c +++ b/libavformat/wavdec.c @@ -498,6 +498,8 @@ static int wav_read_header(AVFormatContext *s) wav->smv_data_ofs = avio_tell(pb) + (size - 5) * 3; avio_rl24(pb); wav->smv_block_size = avio_rl24(pb); + if (!wav->smv_block_size) + return AVERROR_INVALIDDATA; avpriv_set_pts_info(vst, 32, 1, avio_rl24(pb)); vst->duration = avio_rl24(pb); avio_rl24(pb);

1 0

avformat/rmdec: Check for multiple audio_stream_info
by Michael Niedermayer 21 Oct '21

21 Oct '21

ffmpeg | branch: release/4.4 | Michael Niedermayer <michael(a)niedermayer.cc> | Wed Sep 29 20:49:27 2021 +0200| [6de9986c784cd24ce024645fa07dd5306c841cdf] | committer: Michael Niedermayer avformat/rmdec: Check for multiple audio_stream_info Fixes: memleak Fixes: 39166/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5153276690038784 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 8fe3566b8fdf4bcf5eed419c1aab6eb848287ff3) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6de9986c784cd24ce… --- libavformat/rmdec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c index ce42401e74..97378703d1 100644 --- a/libavformat/rmdec.c +++ b/libavformat/rmdec.c @@ -128,6 +128,10 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb, uint32_t version; int ret; + // Duplicate tags + if (st->codecpar->codec_type == AVMEDIA_TYPE_AUDIO) + return AVERROR_INVALIDDATA; + /* ra type header */ version = avio_rb16(pb); /* version */ if (version == 3) {

1 0

avcodec/apedec: Use 64bit to avoid overflow
by Michael Niedermayer 21 Oct '21

21 Oct '21

ffmpeg | branch: release/4.4 | Michael Niedermayer <michael(a)niedermayer.cc> | Wed Sep 29 20:53:53 2021 +0200| [1abb9ab2667f6ed30c48fe15052bc382893fbc9f] | committer: Michael Niedermayer avcodec/apedec: Use 64bit to avoid overflow Fixes: runtime error: signed integer overflow: 727298502 * 3 cannot be represented in type 'int' Fixes: 39172/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-638602483033702 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit f059b56195da9c0e2c11a5f7f357a3d6101e6bf0) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1abb9ab2667f6ed30… --- libavcodec/apedec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c index 3ce4484686..4684e40a46 100644 --- a/libavcodec/apedec.c +++ b/libavcodec/apedec.c @@ -1337,7 +1337,7 @@ static void do_apply_filter(APEContext *ctx, int version, APEFilter *f, absres = FFABSU(res); if (absres) *f->adaptcoeffs = APESIGN(res) * - (8 << ((absres > f->avg * 3) + (absres > (f->avg + f->avg / 3)))); + (8 << ((absres > f->avg * 3LL) + (absres > (f->avg + f->avg / 3)))); /* equivalent to the following code if (absres <= f->avg * 4 / 3) *f->adaptcoeffs = APESIGN(res) * 8;

1 0

avcodec/apedec: Fix undefined integer overflow in long_filter_ehigh_3830()
by Michael Niedermayer 21 Oct '21

21 Oct '21

ffmpeg | branch: release/4.4 | Michael Niedermayer <michael(a)niedermayer.cc> | Tue Sep 28 00:11:50 2021 +0200| [bda2d4989609e6be284575c5bc55a6deba3034d7] | committer: Michael Niedermayer avcodec/apedec: Fix undefined integer overflow in long_filter_ehigh_3830() Fixes: signed integer overflow: -2145648640 - 3357696 cannot be represented in type 'int' Fixes: 38899/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5358815017566208 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit ad517ee6e44f093e28021ffd51c7eb2e1394b1a9) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bda2d4989609e6be2… --- libavcodec/apedec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c index 904e433a3d..3ce4484686 100644 --- a/libavcodec/apedec.c +++ b/libavcodec/apedec.c @@ -979,7 +979,7 @@ static void long_filter_ehigh_3830(int32_t *buffer, int length) for (j = 7; j > 0; j--) delay[j] = delay[j - 1]; delay[0] = buffer[i]; - buffer[i] -= dotprod >> 9; + buffer[i] -= (unsigned)(dotprod >> 9); } }

1 0