May 2021 - ffmpeg-cvslog - lists.ffmpeg.org

avutil/mem: use GCC builtins to check for overflow in av_size_mult()
by James Almer 31 May '21

31 May '21

ffmpeg | branch: master | James Almer <jamrial(a)gmail.com> | Thu May 27 11:58:57 2021 -0300| [baf5cc5b7a016efaa0d9bf3dfe62ad74ef4ffafe] | committer: James Almer avutil/mem: use GCC builtins to check for overflow in av_size_mult() Signed-off-by: James Almer <jamrial(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=baf5cc5b7a016efaa… --- libavutil/mem.h | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/libavutil/mem.h b/libavutil/mem.h index e21a1feaae..c876111afb 100644 --- a/libavutil/mem.h +++ b/libavutil/mem.h @@ -674,11 +674,18 @@ void *av_dynarray2_add(void **tab_ptr, int *nb_ptr, size_t elem_size, */ static inline int av_size_mult(size_t a, size_t b, size_t *r) { - size_t t = a * b; + size_t t; + +#if (!defined(__INTEL_COMPILER) && AV_GCC_VERSION_AT_LEAST(5,1)) || AV_HAS_BUILTIN(__builtin_mul_overflow) + if (__builtin_mul_overflow(a, b, &t)) + return AVERROR(EINVAL); +#else + t = a * b; /* Hack inspired from glibc: don't try the division if nelem and elsize * are both less than sqrt(SIZE_MAX). */ if ((a | b) >= ((size_t)1 << (sizeof(size_t) * 4)) && a && t / a != b) return AVERROR(EINVAL); +#endif *r = t; return 0; }

1 0

avformat/hls: relay format options to segment demuxer
by Gyan Doshi 30 May '21

30 May '21

ffmpeg | branch: master | Gyan Doshi <ffmpeg(a)gyani.pro> | Sat May 29 15:45:18 2021 +0530| [51f1194edae2020ec99b816bd045a29db0e469f8] | committer: Gyan Doshi avformat/hls: relay format options to segment demuxer Signed-off-by: Gyan Doshi <ffmpeg(a)gyani.pro> Reviewed-by: Steven Liu <lq(a)chinaffmpeg.org> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=51f1194edae2020ec… --- doc/demuxers.texi | 3 +++ libavformat/hls.c | 9 ++++++++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/doc/demuxers.texi b/doc/demuxers.texi index 13fe17ff4f..2575dad704 100644 --- a/doc/demuxers.texi +++ b/doc/demuxers.texi @@ -347,6 +347,9 @@ Enabled by default for HTTP/1.1 servers. @item http_seekable Use HTTP partial requests for downloading HTTP segments. 0 = disable, 1 = enable, -1 = auto, Default is auto. + +@item seg_format_options +Set options for the demuxer of media segments using a list of key=value pairs separated by @code{:}. @end table @section image2 diff --git a/libavformat/hls.c b/libavformat/hls.c index 8fc6924c90..c2ca23e973 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -207,6 +207,7 @@ typedef struct HLSContext { int64_t cur_timestamp; AVIOInterruptCB *interrupt_callback; AVDictionary *avio_opts; + AVDictionary *seg_format_opts; char *allowed_extensions; int max_reload; int http_persistent; @@ -1959,6 +1960,7 @@ static int hls_read_header(AVFormatContext *s) struct playlist *pls = c->playlists[i]; const AVInputFormat *in_fmt = NULL; char *url; + AVDictionary *seg_format_opts = NULL; if (!(pls->ctx = avformat_alloc_context())) { ret = AVERROR(ENOMEM); @@ -2017,7 +2019,10 @@ static int hls_read_header(AVFormatContext *s) if ((ret = ff_copy_whiteblacklists(pls->ctx, s)) < 0) goto fail; - ret = avformat_open_input(&pls->ctx, pls->segments[0]->url, in_fmt, NULL); + av_dict_copy(&seg_format_opts, c->seg_format_opts, 0); + + ret = avformat_open_input(&pls->ctx, pls->segments[0]->url, in_fmt, &seg_format_opts); + av_dict_free(&seg_format_opts); if (ret < 0) goto fail; @@ -2403,6 +2408,8 @@ static const AVOption hls_options[] = { OFFSET(http_multiple), AV_OPT_TYPE_BOOL, {.i64 = -1}, -1, 1, FLAGS}, {"http_seekable", "Use HTTP partial requests, 0 = disable, 1 = enable, -1 = auto", OFFSET(http_seekable), AV_OPT_TYPE_BOOL, { .i64 = -1}, -1, 1, FLAGS}, + {"seg_format_options", "Set options for segment demuxer", + OFFSET(seg_format_opts), AV_OPT_TYPE_DICT, {.str = NULL}, 0, 0, FLAGS}, {NULL} };

1 0

avcodec/nvenc: disable s12m timestamps by default
by Timo Rothenpieler 29 May '21

29 May '21

ffmpeg | branch: release/4.4 | Timo Rothenpieler <timo(a)rothenpieler.org> | Sat May 29 22:53:38 2021 +0200| [8d172d940946dce59841b1c95059f3b38f68ca61] | committer: Timo Rothenpieler avcodec/nvenc: disable s12m timestamps by default Leads to weird crashes with valid looking input data for otherwise unknown reasons. > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8d172d940946dce59… --- libavcodec/nvenc_hevc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/nvenc_hevc.c b/libavcodec/nvenc_hevc.c index 441e7871d2..82fbb23bf7 100644 --- a/libavcodec/nvenc_hevc.c +++ b/libavcodec/nvenc_hevc.c @@ -148,7 +148,7 @@ static const AVOption options[] = { { "middle", "", 0, AV_OPT_TYPE_CONST, { .i64 = 2 }, 0, 0, VE, "b_ref_mode" }, #endif { "a53cc", "Use A53 Closed Captions (if available)", OFFSET(a53_cc), AV_OPT_TYPE_BOOL, { .i64 = 1 }, 0, 1, VE }, - { "s12m_tc", "Use timecode (if available)", OFFSET(s12m_tc), AV_OPT_TYPE_BOOL, { .i64 = 1 }, 0, 1, VE }, + { "s12m_tc", "Use timecode (if available)", OFFSET(s12m_tc), AV_OPT_TYPE_BOOL, { .i64 = 0 }, 0, 1, VE }, { "dpb_size", "Specifies the DPB size used for encoding (0 means automatic)", OFFSET(dpb_size), AV_OPT_TYPE_INT, { .i64 = 0 }, 0, INT_MAX, VE }, #ifdef NVENC_HAVE_MULTIPASS

1 0

avcodec/nvenc: disable s12m timestamps by default
by Timo Rothenpieler 29 May '21

29 May '21

ffmpeg | branch: master | Timo Rothenpieler <timo(a)rothenpieler.org> | Sat May 29 22:53:38 2021 +0200| [8d0fea81c736280ff19283b05cd0ad935d1e35c5] | committer: Timo Rothenpieler avcodec/nvenc: disable s12m timestamps by default Leads to weird crashes with valid looking input data for otherwise unknown reasons. > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8d0fea81c736280ff… --- libavcodec/nvenc_hevc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/nvenc_hevc.c b/libavcodec/nvenc_hevc.c index 007099242a..2c8b2197cf 100644 --- a/libavcodec/nvenc_hevc.c +++ b/libavcodec/nvenc_hevc.c @@ -148,7 +148,7 @@ static const AVOption options[] = { { "middle", "", 0, AV_OPT_TYPE_CONST, { .i64 = 2 }, 0, 0, VE, "b_ref_mode" }, #endif { "a53cc", "Use A53 Closed Captions (if available)", OFFSET(a53_cc), AV_OPT_TYPE_BOOL, { .i64 = 1 }, 0, 1, VE }, - { "s12m_tc", "Use timecode (if available)", OFFSET(s12m_tc), AV_OPT_TYPE_BOOL, { .i64 = 1 }, 0, 1, VE }, + { "s12m_tc", "Use timecode (if available)", OFFSET(s12m_tc), AV_OPT_TYPE_BOOL, { .i64 = 0 }, 0, 1, VE }, { "dpb_size", "Specifies the DPB size used for encoding (0 means automatic)", OFFSET(dpb_size), AV_OPT_TYPE_INT, { .i64 = 0 }, 0, INT_MAX, VE }, #ifdef NVENC_HAVE_MULTIPASS

1 0

avfilter/yadif_cuda: Fix time base for large denominators
by Philip Langdale 29 May '21

29 May '21

ffmpeg | branch: master | Philip Langdale <philipl(a)overt.org> | Sat May 29 13:15:55 2021 -0700| [8f8a7e491da5a4d5f6809dd1e56056c46f0cb123] | committer: Philip Langdale avfilter/yadif_cuda: Fix time base for large denominators This is the same fix applied to regular yadif. Signed-off-by: Philip Langdale <philipl(a)overt.org> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8f8a7e491da5a4d5f… --- libavfilter/vf_yadif_cuda.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/libavfilter/vf_yadif_cuda.c b/libavfilter/vf_yadif_cuda.c index 4e41c8b554..bbdbfc1adc 100644 --- a/libavfilter/vf_yadif_cuda.c +++ b/libavfilter/vf_yadif_cuda.c @@ -297,10 +297,9 @@ static int config_output(AVFilterLink *link) goto exit; } - link->time_base.num = ctx->inputs[0]->time_base.num; - link->time_base.den = ctx->inputs[0]->time_base.den * 2; - link->w = ctx->inputs[0]->w; - link->h = ctx->inputs[0]->h; + link->time_base = av_mul_q(ctx->inputs[0]->time_base, (AVRational){1, 2}); + link->w = ctx->inputs[0]->w; + link->h = ctx->inputs[0]->h; if(y->mode & 1) link->frame_rate = av_mul_q(ctx->inputs[0]->frame_rate,

1 0

avfilter/bwdif: Fix time base for large denominators
by Philip Langdale 29 May '21

29 May '21

ffmpeg | branch: master | Philip Langdale <philipl(a)overt.org> | Sat May 29 13:19:26 2021 -0700| [7885ab3036a3f2a5a1f317880a9a2c002e1239ff] | committer: Philip Langdale avfilter/bwdif: Fix time base for large denominators This is the same fix applied to regular yadif. Signed-off-by: Philip Langdale <philipl(a)overt.org> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7885ab3036a3f2a5a… --- libavfilter/vf_bwdif.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/libavfilter/vf_bwdif.c b/libavfilter/vf_bwdif.c index faba945c7f..49b6e73f11 100644 --- a/libavfilter/vf_bwdif.c +++ b/libavfilter/vf_bwdif.c @@ -335,10 +335,9 @@ static int config_props(AVFilterLink *link) BWDIFContext *s = link->src->priv; YADIFContext *yadif = &s->yadif; - link->time_base.num = link->src->inputs[0]->time_base.num; - link->time_base.den = link->src->inputs[0]->time_base.den * 2; - link->w = link->src->inputs[0]->w; - link->h = link->src->inputs[0]->h; + link->time_base = av_mul_q(ctx->inputs[0]->time_base, (AVRational){1, 2}); + link->w = link->src->inputs[0]->w; + link->h = link->src->inputs[0]->h; if(yadif->mode&1) link->frame_rate = av_mul_q(link->src->inputs[0]->frame_rate, (AVRational){2,1});

1 0

avfilter/vf_yadif: Fix handing of tiny images
by Michael Niedermayer 29 May '21

29 May '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sat May 29 11:17:35 2021 +0200| [7971f62120a55c141ec437aa3f0bacc1c1a3526b] | committer: Michael Niedermayer avfilter/vf_yadif: Fix handing of tiny images Fixes: out of array access Fixes: Ticket8240 Fixes: CVE-2020-22021 Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7971f62120a55c141… --- libavfilter/vf_yadif.c | 32 ++++++++++++++++++-------------- 1 file changed, 18 insertions(+), 14 deletions(-) diff --git a/libavfilter/vf_yadif.c b/libavfilter/vf_yadif.c index 91cc79ecc3..b0d9fbaf1f 100644 --- a/libavfilter/vf_yadif.c +++ b/libavfilter/vf_yadif.c @@ -123,20 +123,22 @@ static void filter_edges(void *dst1, void *prev1, void *cur1, void *next1, uint8_t *next2 = parity ? cur : next; const int edge = MAX_ALIGN - 1; + int offset = FFMAX(w - edge, 3); /* Only edge pixels need to be processed here. A constant value of false * for is_not_edge should let the compiler ignore the whole branch. */ - FILTER(0, 3, 0) + FILTER(0, FFMIN(3, w), 0) - dst = (uint8_t*)dst1 + w - edge; - prev = (uint8_t*)prev1 + w - edge; - cur = (uint8_t*)cur1 + w - edge; - next = (uint8_t*)next1 + w - edge; + dst = (uint8_t*)dst1 + offset; + prev = (uint8_t*)prev1 + offset; + cur = (uint8_t*)cur1 + offset; + next = (uint8_t*)next1 + offset; prev2 = (uint8_t*)(parity ? prev : cur); next2 = (uint8_t*)(parity ? cur : next); - FILTER(w - edge, w - 3, 1) - FILTER(w - 3, w, 0) + FILTER(offset, w - 3, 1) + offset = FFMAX(offset, w - 3); + FILTER(offset, w, 0) } @@ -170,21 +172,23 @@ static void filter_edges_16bit(void *dst1, void *prev1, void *cur1, void *next1, uint16_t *next2 = parity ? cur : next; const int edge = MAX_ALIGN / 2 - 1; + int offset = FFMAX(w - edge, 3); mrefs /= 2; prefs /= 2; - FILTER(0, 3, 0) + FILTER(0, FFMIN(3, w), 0) - dst = (uint16_t*)dst1 + w - edge; - prev = (uint16_t*)prev1 + w - edge; - cur = (uint16_t*)cur1 + w - edge; - next = (uint16_t*)next1 + w - edge; + dst = (uint16_t*)dst1 + offset; + prev = (uint16_t*)prev1 + offset; + cur = (uint16_t*)cur1 + offset; + next = (uint16_t*)next1 + offset; prev2 = (uint16_t*)(parity ? prev : cur); next2 = (uint16_t*)(parity ? cur : next); - FILTER(w - edge, w - 3, 1) - FILTER(w - 3, w, 0) + FILTER(offset, w - 3, 1) + offset = FFMAX(offset, w - 3); + FILTER(offset, w, 0) } static int filter_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs)

1 0

avfilter/vf_vmafmotion: Check dimensions
by Michael Niedermayer 29 May '21

29 May '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sat May 29 09:58:31 2021 +0200| [82ad1b76751bcfad5005440db48c46a4de5d6f02] | committer: Michael Niedermayer avfilter/vf_vmafmotion: Check dimensions Fixes: out of array access Fixes: Ticket8241 Fixes: Ticket8246 Fixes: CVE-2020-22019 Fixes: CVE-2020-22033 Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=82ad1b76751bcfad5… --- libavfilter/vf_vmafmotion.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavfilter/vf_vmafmotion.c b/libavfilter/vf_vmafmotion.c index 2db4783d8d..454ebb8afa 100644 --- a/libavfilter/vf_vmafmotion.c +++ b/libavfilter/vf_vmafmotion.c @@ -238,6 +238,9 @@ int ff_vmafmotion_init(VMAFMotionData *s, int i; const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(fmt); + if (w < 3 || h < 3) + return AVERROR(EINVAL); + s->width = w; s->height = h; s->stride = FFALIGN(w * sizeof(uint16_t), 32);

1 0

avformat/movenc: Check pal_size before use
by Michael Niedermayer 29 May '21

29 May '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sat May 29 09:22:27 2021 +0200| [4c1afa292520329eecd1cc7631bc59a8cca95c46] | committer: Michael Niedermayer avformat/movenc: Check pal_size before use Fixes: assertion failure Fixes: out of array read Fixes: Ticket8190 Fixes: CVE-2020-22015 Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4c1afa292520329ee… --- libavformat/movenc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavformat/movenc.c b/libavformat/movenc.c index 2ab507df15..7d839f447b 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -2160,11 +2160,13 @@ static int mov_write_video_tag(AVFormatContext *s, AVIOContext *pb, MOVMuxContex avio_wb16(pb, 0x18); /* Reserved */ if (track->mode == MODE_MOV && track->par->format == AV_PIX_FMT_PAL8) { - int pal_size = 1 << track->par->bits_per_coded_sample; - int i; + int pal_size, i; avio_wb16(pb, 0); /* Color table ID */ avio_wb32(pb, 0); /* Color table seed */ avio_wb16(pb, 0x8000); /* Color table flags */ + if (track->par->bits_per_coded_sample < 0 || track->par->bits_per_coded_sample > 8) + return AVERROR(EINVAL); + pal_size = 1 << track->par->bits_per_coded_sample; avio_wb16(pb, pal_size - 1); /* Color table size (zero-relative) */ for (i = 0; i < pal_size; i++) { uint32_t rgb = track->palette[i];

1 0

avcodec/lpc: Avoid floating point division by 0
by Michael Niedermayer 29 May '21

29 May '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Fri May 28 20:31:19 2021 +0200| [38d18fb57863bb9c54e68ae44aa780c5c282a184] | committer: Michael Niedermayer avcodec/lpc: Avoid floating point division by 0 Fixes: Ticket7996 Fixes: CVE-2020-20445 Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=38d18fb57863bb9c5… --- libavcodec/lpc.c | 2 +- libavcodec/lpc.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/lpc.c b/libavcodec/lpc.c index 1d1d04fd80..3ed61563ee 100644 --- a/libavcodec/lpc.c +++ b/libavcodec/lpc.c @@ -189,7 +189,7 @@ double ff_lpc_calc_ref_coefs_f(LPCContext *s, const float *samples, int len, compute_ref_coefs(autoc, order, ref, error); for (i = 0; i < order; i++) avg_err = (avg_err + error[i])/2.0f; - return signal/avg_err; + return avg_err ? signal/avg_err : NAN; } /** diff --git a/libavcodec/lpc.h b/libavcodec/lpc.h index 88ca247f87..52170fd623 100644 --- a/libavcodec/lpc.h +++ b/libavcodec/lpc.h @@ -143,7 +143,7 @@ static inline void compute_ref_coefs(const LPC_TYPE *autoc, int max_order, gen0[i] = gen1[i] = autoc[i + 1]; err = autoc[0]; - ref[0] = -gen1[0] / err; + ref[0] = -gen1[0] / ((USE_FIXED || err) ? err : 1); err += gen1[0] * ref[0]; if (error) error[0] = err; @@ -152,7 +152,7 @@ static inline void compute_ref_coefs(const LPC_TYPE *autoc, int max_order, gen1[j] = gen1[j + 1] + ref[i - 1] * gen0[j]; gen0[j] = gen1[j + 1] * ref[i - 1] + gen0[j]; } - ref[i] = -gen1[0] / err; + ref[i] = -gen1[0] / ((USE_FIXED || err) ? err : 1); err += gen1[0] * ref[i]; if (error) error[i] = err;

1 0