July 2021 - ffmpeg-cvslog - lists.ffmpeg.org

avformat/wavdec: Use 64bit in new_pos computation
by Michael Niedermayer 31 Jul '21

31 Jul '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Tue Apr 27 20:57:02 2021 +0200| [9b57d2f0a967195dc1c72fda8f3a983a0132a243] | committer: Michael Niedermayer avformat/wavdec: Use 64bit in new_pos computation Fixes: signed integer overflow: 129 * 16711680 cannot be represented in type 'int' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-6742285317439488 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9b57d2f0a967195dc… --- libavformat/wavdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c index d2fb81ca7f..5992ef4bcf 100644 --- a/libavformat/wavdec.c +++ b/libavformat/wavdec.c @@ -718,7 +718,7 @@ smv_retry: if (wav->smv_last_stream) { uint64_t old_pos = avio_tell(s->pb); uint64_t new_pos = wav->smv_data_ofs + - wav->smv_block * wav->smv_block_size; + wav->smv_block * (int64_t)wav->smv_block_size; if (avio_seek(s->pb, new_pos, SEEK_SET) < 0) { ret = AVERROR_EOF; goto smv_out;

1 0

avformat/sbgdec: Check for overflow in timestamp preparation
by Michael Niedermayer 31 Jul '21

31 Jul '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Tue Apr 27 20:53:32 2021 +0200| [9dbed908403b0d97ae70881fab68020f148b6b11] | committer: Michael Niedermayer avformat/sbgdec: Check for overflow in timestamp preparation Fixes: signed integer overflow: 9223372036854775807 + 86400000000 cannot be represented in type 'long' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6731040263634944 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9dbed908403b0d97a… --- libavformat/sbgdec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/sbgdec.c b/libavformat/sbgdec.c index bd72db5f08..21a918db44 100644 --- a/libavformat/sbgdec.c +++ b/libavformat/sbgdec.c @@ -1292,6 +1292,10 @@ static int generate_intervals(void *log, struct sbg_script *s, int sample_rate, ev1 = &s->events[i]; ev2 = &s->events[(i + 1) % s->nb_events]; ev1->ts_int = ev1->ts; + + if (!ev1->fade.slide && ev1 >= ev2 && ev2->ts > INT64_MAX - period) + return AVERROR_INVALIDDATA; + ev1->ts_trans = ev1->fade.slide ? ev1->ts : ev2->ts + (ev1 < ev2 ? 0 : period); }

1 0

avformat/dsicin: Check packet size for overflow
by Michael Niedermayer 31 Jul '21

31 Jul '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Fri Apr 23 19:44:08 2021 +0200| [9d1c47ec033d038e04578eaf0767c8983250d03d] | committer: Michael Niedermayer avformat/dsicin: Check packet size for overflow Fixes: signed integer overflow: 24672 + 2147483424 cannot be represented in type 'int' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_DSICIN_fuzzer-6731325979623424 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9d1c47ec033d038e0… --- libavformat/dsicin.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/libavformat/dsicin.c b/libavformat/dsicin.c index 5693b11e8c..481f365a53 100644 --- a/libavformat/dsicin.c +++ b/libavformat/dsicin.c @@ -166,7 +166,8 @@ static int cin_read_packet(AVFormatContext *s, AVPacket *pkt) CinDemuxContext *cin = s->priv_data; AVIOContext *pb = s->pb; CinFrameHeader *hdr = &cin->frame_header; - int rc, palette_type, pkt_size; + int rc, palette_type; + int64_t pkt_size; int ret; if (cin->audio_buffer_size == 0) { @@ -182,7 +183,9 @@ static int cin_read_packet(AVFormatContext *s, AVPacket *pkt) } /* palette and video packet */ - pkt_size = (palette_type + 3) * hdr->pal_colors_count + hdr->video_frame_size; + pkt_size = (palette_type + 3LL) * hdr->pal_colors_count + hdr->video_frame_size; + if (pkt_size + 4 > INT_MAX) + return AVERROR_INVALIDDATA; pkt_size = ffio_limit(pb, pkt_size);

1 0

avformat/dsfdec: Change order of operations in bitrate computation
by Michael Niedermayer 31 Jul '21

31 Jul '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Fri Apr 23 19:39:16 2021 +0200| [5e38eff284637e9f7c3c25d020df549ca6667e40] | committer: Michael Niedermayer avformat/dsfdec: Change order of operations in bitrate computation Fixes: signed integer overflow: 538976288 * 67372036 cannot be represented in type 'int' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_DSF_fuzzer-6751696819716096 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5e38eff284637e9f7… --- libavformat/dsfdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/dsfdec.c b/libavformat/dsfdec.c index 02ee4c1231..c872f98cc2 100644 --- a/libavformat/dsfdec.c +++ b/libavformat/dsfdec.c @@ -130,7 +130,7 @@ static int dsf_read_header(AVFormatContext *s) return AVERROR_INVALIDDATA; } st->codecpar->block_align *= st->codecpar->channels; - st->codecpar->bit_rate = st->codecpar->channels * st->codecpar->sample_rate * 8LL; + st->codecpar->bit_rate = st->codecpar->channels * 8LL * st->codecpar->sample_rate; avpriv_set_pts_info(st, 64, 1, st->codecpar->sample_rate); avio_skip(pb, 4);

1 0

avformat/bfi: check nframes
by Michael Niedermayer 31 Jul '21

31 Jul '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Fri Apr 23 19:33:58 2021 +0200| [b4e77dfca1c2970446f79277034d8e60c3fe3f4e] | committer: Michael Niedermayer avformat/bfi: check nframes Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_BFI_fuzzer-6737028768202752 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b4e77dfca1c297044… --- libavformat/bfi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/bfi.c b/libavformat/bfi.c index bff6f0154e..69000118fa 100644 --- a/libavformat/bfi.c +++ b/libavformat/bfi.c @@ -73,6 +73,8 @@ static int bfi_read_header(AVFormatContext * s) return AVERROR_INVALIDDATA; bfi->nframes = avio_rl32(pb); + if (bfi->nframes < 0) + return AVERROR_INVALIDDATA; avio_rl32(pb); avio_rl32(pb); avio_rl32(pb);

1 0

avformat/avidec: fix position overflow in avi_load_index()
by Michael Niedermayer 31 Jul '21

31 Jul '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Fri Apr 23 19:11:03 2021 +0200| [527821a2dd6f19d9a4d2abe05833346ae86c66c6] | committer: Michael Niedermayer avformat/avidec: fix position overflow in avi_load_index() Fixes: signed integer overflow: 9223372033098784808 + 4294967072 cannot be represented in type 'long' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6732488912273408 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=527821a2dd6f19d9a… --- libavformat/avidec.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavformat/avidec.c b/libavformat/avidec.c index 2e261c94e6..5d695b9839 100644 --- a/libavformat/avidec.c +++ b/libavformat/avidec.c @@ -1776,7 +1776,10 @@ static int avi_load_index(AVFormatContext *s) size = avio_rl32(pb); if (avio_feof(pb)) break; - next = avio_tell(pb) + size + (size & 1); + next = avio_tell(pb); + if (next < 0 || next > INT64_MAX - size - (size & 1)) + break; + next += size + (size & 1LL); if (tag == MKTAG('i', 'd', 'x', '1') && avi_read_idx1(s, size) >= 0) {

1 0

avformat/asfdec_f: Check sizeX against padding
by Michael Niedermayer 31 Jul '21

31 Jul '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Fri Apr 23 17:35:20 2021 +0200| [f034c2e36acb7d0c11dc1849ddf8a67bde44eff4] | committer: Michael Niedermayer avformat/asfdec_f: Check sizeX against padding Fixes: signed integer overflow: 2147483607 + 64 cannot be represented in type 'int' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-6753897878257664 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f034c2e36acb7d0c1… --- libavformat/asfdec_f.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c index 053c815977..ff6ddfb967 100644 --- a/libavformat/asfdec_f.c +++ b/libavformat/asfdec_f.c @@ -415,7 +415,7 @@ static int asf_read_stream_properties(AVFormatContext *s, int64_t size) tag1 = avio_rl32(pb); avio_skip(pb, 20); if (sizeX > 40) { - if (size < sizeX - 40) + if (size < sizeX - 40 || sizeX - 40 > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) return AVERROR_INVALIDDATA; st->codecpar->extradata_size = ffio_limit(pb, sizeX - 40); st->codecpar->extradata = av_mallocz(st->codecpar->extradata_size +

1 0

avformat/aiffdec: Check for size overflow in header parsing
by Michael Niedermayer 31 Jul '21

31 Jul '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Fri Apr 23 17:28:29 2021 +0200| [bae2e1977744f42d56b85193d4910811de829714] | committer: Michael Niedermayer avformat/aiffdec: Check for size overflow in header parsing Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6723467048255488 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bae2e1977744f42d5… --- libavformat/aiffdec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/aiffdec.c b/libavformat/aiffdec.c index cade05a9d6..a826bc998a 100644 --- a/libavformat/aiffdec.c +++ b/libavformat/aiffdec.c @@ -100,6 +100,9 @@ static int get_aiff_header(AVFormatContext *s, int size, int sample_rate; unsigned int num_frames; + if (size == INT_MAX) + return AVERROR_INVALIDDATA; + if (size & 1) size++; par->codec_type = AVMEDIA_TYPE_AUDIO;

1 0

avcodec/aaccoder: Add minimal bias in search_for_ms()
by Michael Niedermayer 31 Jul '21

31 Jul '21

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Mon May 31 21:00:32 2021 +0200| [75a099fc734a4ee2b1347d0a3d8c53d883b95174] | committer: Michael Niedermayer avcodec/aaccoder: Add minimal bias in search_for_ms() Fixes: floating point division by 0 Fixes: Ticket8218 Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=75a099fc734a4ee2b… --- libavcodec/aaccoder.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavcodec/aaccoder.c b/libavcodec/aaccoder.c index baa82489b1..11b0559e1c 100644 --- a/libavcodec/aaccoder.c +++ b/libavcodec/aaccoder.c @@ -843,25 +843,25 @@ static void search_for_ms(AACEncContext *s, ChannelElement *cpe) sce0->ics.swb_sizes[g], sce0->sf_idx[w*16+g], sce0->band_type[w*16+g], - lambda / band0->threshold, INFINITY, &b1, NULL, 0); + lambda / (band0->threshold + FLT_MIN), INFINITY, &b1, NULL, 0); dist1 += quantize_band_cost(s, &sce1->coeffs[start + (w+w2)*128], R34, sce1->ics.swb_sizes[g], sce1->sf_idx[w*16+g], sce1->band_type[w*16+g], - lambda / band1->threshold, INFINITY, &b2, NULL, 0); + lambda / (band1->threshold + FLT_MIN), INFINITY, &b2, NULL, 0); dist2 += quantize_band_cost(s, M, M34, sce0->ics.swb_sizes[g], mididx, midcb, - lambda / minthr, INFINITY, &b3, NULL, 0); + lambda / (minthr + FLT_MIN), INFINITY, &b3, NULL, 0); dist2 += quantize_band_cost(s, S, S34, sce1->ics.swb_sizes[g], sididx, sidcb, - mslambda / (minthr * bmax), INFINITY, &b4, NULL, 0); + mslambda / (minthr * bmax + FLT_MIN), INFINITY, &b4, NULL, 0); B0 += b1+b2; B1 += b3+b4; dist1 -= b1+b2;

1 0

avcodec/noise_bsf: restore dropamount for backwards compatibility
by Gyan Doshi 30 Jul '21

30 Jul '21

ffmpeg | branch: master | Gyan Doshi <ffmpeg(a)gyani.pro> | Fri Jul 30 17:26:53 2021 +0530| [b9176dbfb7c209f2adf1f420df74b91df56c1fb3] | committer: Gyan Doshi avcodec/noise_bsf: restore dropamount for backwards compatibility > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b9176dbfb7c209f2a… --- doc/bitstream_filters.texi | 7 ++++++- libavcodec/noise_bsf.c | 19 +++++++++++++++---- tests/fate/matroska.mak | 2 +- 3 files changed, 22 insertions(+), 6 deletions(-) diff --git a/doc/bitstream_filters.texi b/doc/bitstream_filters.texi index 18a758635f..1900eb4352 100644 --- a/doc/bitstream_filters.texi +++ b/doc/bitstream_filters.texi @@ -538,11 +538,16 @@ Accepts an expression whose evaluation per-packet determines how often bytes in packet will be modified. A value below 0 will result in a variable frequency. Default is 0 which results in no modification. However, if neither amount nor drop is specified, amount will be set to @var{-1}. See below for accepted variables. -@item drop, dropamount +@item drop Accepts an expression evaluated per-packet whose value determines whether that packet is dropped. Evaluation to a positive value results in the packet being dropped. Evaluation to a negative value results in a variable chance of it being dropped, roughly inverse in proportion to the magnitude of the value. Default is 0 which results in no drops. See below for accepted variables. +@item dropamount +Accepts a non-negative integer, which assigns a variable chance of it being dropped, roughly inverse +in proportion to the value. Default is 0 which results in no drops. This option is kept for backwards +compatibility and is equivalent to setting drop to a negative value with the same magnitude +i.e. @code{dropamount=4} is the same as @code{drop=-4}. Ignored if drop is also specified. @end table Both @code{amount} and @code{drop} accept expressions containing the following variables: diff --git a/libavcodec/noise_bsf.c b/libavcodec/noise_bsf.c index 9d7ef93001..05b5d5f32b 100644 --- a/libavcodec/noise_bsf.c +++ b/libavcodec/noise_bsf.c @@ -65,6 +65,7 @@ typedef struct NoiseContext { char *amount_str; char *drop_str; + int dropamount; AVExpr *amount_pexpr; AVExpr *drop_pexpr; @@ -81,7 +82,7 @@ static int noise_init(AVBSFContext *ctx) int ret; if (!s->amount_str) { - s->amount_str = !s->drop_str ? av_strdup("-1") : av_strdup("0"); + s->amount_str = (!s->drop_str && !s->dropamount) ? av_strdup("-1") : av_strdup("0"); if (!s->amount_str) return AVERROR(ENOMEM); } @@ -93,6 +94,12 @@ static int noise_init(AVBSFContext *ctx) return ret; } + if (s->drop_str && s->dropamount) { + av_log(ctx, AV_LOG_WARNING, "Both drop '%s' and dropamount=%d set. Ignoring dropamount.\n", + s->drop_str, s->dropamount); + s->dropamount = 0; + } + if (s->drop_str) { ret = av_expr_parse(&s->drop_pexpr, s->drop_str, var_names, NULL, NULL, NULL, NULL, 0, ctx); @@ -114,7 +121,7 @@ static int noise_init(AVBSFContext *ctx) static int noise(AVBSFContext *ctx, AVPacket *pkt) { NoiseContext *s = ctx->priv_data; - int i, ret, amount, drop; + int i, ret, amount, drop = 0; double res; ret = ff_bsf_get_packet_ref(ctx, pkt); @@ -156,10 +163,14 @@ static int noise(AVBSFContext *ctx, AVPacket *pkt) drop = !!res; } + if(s->dropamount) { + drop = !(s->state % s->dropamount); + } + av_log(ctx, AV_LOG_VERBOSE, "Stream #%d packet %d pts %"PRId64" - amount %d drop %d\n", pkt->stream_index, (unsigned int)s->var_values[VAR_N], pkt->pts, amount, drop); - if (s->drop_str && drop) { + if (drop) { s->var_values[VAR_STATE] = ++s->state; av_packet_unref(pkt); return AVERROR(EAGAIN); @@ -198,7 +209,7 @@ static void noise_close(AVBSFContext *bsf) static const AVOption options[] = { { "amount", NULL, OFFSET(amount_str), AV_OPT_TYPE_STRING, { .str = NULL }, 0, 0, FLAGS }, { "drop", NULL, OFFSET(drop_str), AV_OPT_TYPE_STRING, { .str = NULL }, 0, 0, FLAGS }, - { "dropamount", NULL, OFFSET(drop_str), AV_OPT_TYPE_STRING, { .str = NULL }, 0, 0, FLAGS }, + { "dropamount", NULL, OFFSET(dropamount), AV_OPT_TYPE_INT, { .i64 = 0 }, 0, INT_MAX, FLAGS }, { NULL }, }; diff --git a/tests/fate/matroska.mak b/tests/fate/matroska.mak index b57765280a..625b2a4571 100644 --- a/tests/fate/matroska.mak +++ b/tests/fate/matroska.mak @@ -88,7 +88,7 @@ FATE_MATROSKA_FFMPEG_FFPROBE-$(call ALLYES, FILE_PROTOCOL MXF_DEMUXER \ MATROSKA_MUXER MATROSKA_DEMUXER \ FRAMECRC_MUXER PIPE_PROTOCOL) \ += fate-matroska-mastering-display-metadata -fate-matroska-mastering-display-metadata: CMD = transcode mxf $(TARGET_SAMPLES)/mxf/Meridian-Apple_ProResProxy-HDR10.mxf matroska "-map 0 -map 0:0 -c:v:0 copy -c:v:1 ffv1 -c:a:0 copy -bsf:a:0 noise=amount=3 -filter:a:1 aresample -c:a:1 pcm_s16be -bsf:a:1 noise=amount=-1:dropamount=-4" "-map 0 -c copy" "" "-show_entries stream_side_data_list:stream=index,codec_name" +fate-matroska-mastering-display-metadata: CMD = transcode mxf $(TARGET_SAMPLES)/mxf/Meridian-Apple_ProResProxy-HDR10.mxf matroska "-map 0 -map 0:0 -c:v:0 copy -c:v:1 ffv1 -c:a:0 copy -bsf:a:0 noise=amount=3 -filter:a:1 aresample -c:a:1 pcm_s16be -bsf:a:1 noise=amount=-1:drop=-4" "-map 0 -c copy" "" "-show_entries stream_side_data_list:stream=index,codec_name" # This test tests remuxing annex B H.264 into Matroska. It also tests writing # the correct interlaced flags and overriding the sample aspect ratio, leading

1 0