January 2025 - ffmpeg-cvslog - lists.ffmpeg.org

avcodec/h263dec: Check against previous dimensions instead of coded
by Michael Niedermayer 31 Jan '25

31 Jan '25

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Thu Jan 30 02:28:32 2025 +0100| [0fe33c99a26a06a6875c4abfb96362a65145264b] | committer: Michael Niedermayer avcodec/h263dec: Check against previous dimensions instead of coded Fixes: out of array access Fixes: crash-a41ef3db699013f669b076f02f36942925f5a98c Found-by: Kacper Michajlow <kasper93(a)gmail.com> Reviewed-by: Kacper Michajlow <kasper93(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0fe33c99a26a06a68… --- libavcodec/h263dec.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/libavcodec/h263dec.c b/libavcodec/h263dec.c index 0c23012584..5eefdc4602 100644 --- a/libavcodec/h263dec.c +++ b/libavcodec/h263dec.c @@ -431,6 +431,7 @@ int ff_h263_decode_frame(AVCodecContext *avctx, AVFrame *pict, MpegEncContext *s = avctx->priv_data; int ret; int slice_ret = 0; + int bak_width, bak_height; /* no supplementary picture */ if (buf_size == 0) { @@ -482,6 +483,9 @@ retry: if (ret < 0) return ret; + bak_width = s->width; + bak_height = s->height; + /* let's go :-) */ if (CONFIG_WMV2_DECODER && s->msmpeg4_version == MSMP4_WMV2) { ret = ff_wmv2_decode_picture_header(s); @@ -501,11 +505,12 @@ retry: } if (ret < 0 || ret == FRAME_SKIPPED) { - if ( s->width != avctx->coded_width - || s->height != avctx->coded_height) { + if ( s->width != bak_width + || s->height != bak_height) { av_log(s->avctx, AV_LOG_WARNING, "Reverting picture dimensions change due to header decoding failure\n"); - s->width = avctx->coded_width; - s->height= avctx->coded_height; + s->width = bak_width; + s->height= bak_height; + } } if (ret == FRAME_SKIPPED)

1 0

avformat/hls: Print input format in error message
by Michael Niedermayer 31 Jan '25

31 Jan '25

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Tue Jan 28 12:51:58 2025 +0100| [d8455331302c72cde2f0b72f255004a91189dd93] | committer: Michael Niedermayer avformat/hls: Print input format in error message Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d8455331302c72cde… --- libavformat/hls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/hls.c b/libavformat/hls.c index 93f6d1f102..d2787ade46 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -758,7 +758,7 @@ static int test_segment(AVFormatContext *s, const AVInputFormat *in_fmt, struct matchF = 3; if (!(matchA & matchF)) { - av_log(s, AV_LOG_ERROR, "detected format extension %s mismatches allowed extensions in url %s\n", in_fmt->extensions ? in_fmt->extensions : "none", seg->url); + av_log(s, AV_LOG_ERROR, "detected format %s extension %s mismatches allowed extensions in url %s\n", in_fmt->name, in_fmt->extensions ? in_fmt->extensions : "none", seg->url); return AVERROR_INVALIDDATA; } }

1 0

doc/filters: fix typo in format filter
by Gyan Doshi 31 Jan '25

31 Jan '25

ffmpeg | branch: master | Gyan Doshi <ffmpeg(a)gyani.pro> | Fri Jan 31 23:33:40 2025 +0530| [221816456a60bb909845f34afbec8c7589865e85] | committer: Gyan Doshi doc/filters: fix typo in format filter The inline example for option color_ranges used 'color_spaces' Fixes #11441 > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=221816456a60bb909… --- doc/filters.texi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/filters.texi b/doc/filters.texi index a14c7e7e77..c2817b2661 100644 --- a/doc/filters.texi +++ b/doc/filters.texi @@ -14330,7 +14330,7 @@ A '|'-separated list of color space names, such as @item color_ranges A '|'-separated list of color range names, such as -"color_spaces=tv|pc". +"color_ranges=tv|pc". @end table

1 0

avcodec/jpegxl_parse{,r}: fix integer overflow for some malformed files
by Leo Izen 30 Jan '25

30 Jan '25

ffmpeg | branch: master | Leo Izen <leo.izen(a)gmail.com> | Wed Jan 29 14:58:15 2025 -0500| [0225fe857d0d174e5c2b36642f5e02670f50b444] | committer: Leo Izen avcodec/jpegxl_parse{,r}: fix integer overflow for some malformed files If there's a very large ISOBMFF box that needs to be skipped, it can cause an overflow for ctx->skip. There's already a safeguard to return quickly if ctx->skip > bufsize, so changing ctx->skip to int64_t will allow this to happen even if ctx->skip would overflow a signed int. Several other members are also changed to int64_t to avoid this problem in other possible scenarios. Signed-off-by: Leo Izen <leo.izen(a)gmail.com> Reported-by: Kacper Michajlow <kasper93(a)gmail.com> Fixes: clusterfuzz-testcase-minimized-fuzzer_loadfile-6085331937460224 > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0225fe857d0d174e5… --- libavcodec/jpegxl_parse.c | 5 +++-- libavcodec/jpegxl_parser.c | 16 ++++++++-------- 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/libavcodec/jpegxl_parse.c b/libavcodec/jpegxl_parse.c index 7cfdd3e7d5..022eed322d 100644 --- a/libavcodec/jpegxl_parse.c +++ b/libavcodec/jpegxl_parse.c @@ -450,7 +450,8 @@ int ff_jpegxl_collect_codestream_header(const uint8_t *input_buffer, int input_l uint8_t *buffer, int buflen, int *copied) { GetByteContext gb; - int pos = 0, last_box = 0; + int64_t pos = 0; + int last_box = 0; bytestream2_init(&gb, input_buffer, input_len); while (1) { @@ -516,5 +517,5 @@ int ff_jpegxl_collect_codestream_header(const uint8_t *input_buffer, int input_l break; } - return pos; + return FFMIN(pos, INT_MAX); } diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c index a888e9ae6e..68404229a5 100644 --- a/libavcodec/jpegxl_parser.c +++ b/libavcodec/jpegxl_parser.c @@ -155,12 +155,12 @@ typedef struct JXLParseContext { /* using ISOBMFF-based container */ int container; - int skip; + int64_t skip; int copied; - int collected_size; - int codestream_length; + int64_t collected_size; + int64_t codestream_length; int skipped_icc; - int next; + int64_t next; uint8_t cs_buffer[4096 + AV_INPUT_BUFFER_PADDING_SIZE]; } JXLParseContext; @@ -1396,7 +1396,7 @@ static int skip_boxes(JXLParseContext *ctx, const uint8_t *buf, int buf_size) return 0; } -static int try_parse(AVCodecParserContext *s, AVCodecContext *avctx, JXLParseContext *ctx, +static int64_t try_parse(AVCodecParserContext *s, AVCodecContext *avctx, JXLParseContext *ctx, const uint8_t *buf, int buf_size) { int ret, cs_buflen, header_skip; @@ -1489,10 +1489,10 @@ static int jpegxl_parse(AVCodecParserContext *s, AVCodecContext *avctx, } if ((!ctx->container || !ctx->codestream_length) && !ctx->next) { - ret = try_parse(s, avctx, ctx, pbuf, pindex); - if (ret < 0) + int64_t ret64 = try_parse(s, avctx, ctx, pbuf, pindex); + if (ret64 < 0) goto flush; - ctx->next = ret; + ctx->next = ret64; if (ctx->container) ctx->skip += ctx->next; }

1 0

avcodec/hevc/hevcdec: Don't add to null pointer
by Vitaly Buka 30 Jan '25

30 Jan '25

ffmpeg | branch: master | Vitaly Buka <vitalybuka(a)google.com> | Thu Jan 16 15:49:19 2025 -0800| [c5287178b4dc373e763f7cd49703a6e3192aab3a] | committer: James Almer avcodec/hevc/hevcdec: Don't add to null pointer `POS(1,` and `POS(2,` may trigger UBSAN report: "runtime error: applying non-zero offset 304 to null pointer" Looks like values are not used without `chroma_format_idc`, so maybe there is no other issues than the UB. Can't reproduce with "fate". Signed-off-by: Vitaly Buka <vitalybuka(a)google.com> Signed-off-by: James Almer <jamrial(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c5287178b4dc373e7… --- libavcodec/hevc/hevcdec.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c index 3655ed0039..7d3e844945 100644 --- a/libavcodec/hevc/hevcdec.c +++ b/libavcodec/hevc/hevcdec.c @@ -2040,9 +2040,10 @@ static void hls_prediction_unit(HEVCLocalContext *lc, int x0, int y0, int nPbW, int nPbH, int log2_cb_size, int partIdx, int idx) { -#define POS(c_idx, x, y) \ +#define POS(c_idx, x, y) \ + &s->cur_frame->f->data[c_idx] ? \ &s->cur_frame->f->data[c_idx][((y) >> sps->vshift[c_idx]) * linesize[c_idx] + \ - (((x) >> sps->hshift[c_idx]) << sps->pixel_shift)] + (((x) >> sps->hshift[c_idx]) << sps->pixel_shift)] : NULL const HEVCContext *const s = lc->parent; int merge_idx = 0; struct MvField current_mv = {{{ 0 }}};

1 0

avformat/mov: fix overflow in drift timestamp calculation
by James Almer 30 Jan '25

30 Jan '25

ffmpeg | branch: master | James Almer <jamrial(a)gmail.com> | Tue Jan 28 21:23:11 2025 -0300| [02958ab7156b4e14f1918f2b72c6d3678852698f] | committer: James Almer avformat/mov: fix overflow in drift timestamp calculation Fixes: signed integer overflow: 7803923888585309955 - -3407677434275325337 cannot be represented in type 'int64_t' (aka 'long') Fixes: 377736723/clusterfuzz-testcase-minimized-media_pipeline_integration_fuzzer-5052449500889088 Signed-off-by: James Almer <jamrial(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=02958ab7156b4e14f… --- libavformat/mov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index c016ce8e41..2c8be51063 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -3541,7 +3541,7 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom) current_dts += sc->stts_data[i].duration * (uint64_t)sample_count; if (current_dts > corrected_dts) { - int64_t drift = (current_dts - corrected_dts)/FFMAX(sample_count, 1); + int64_t drift = av_sat_sub64(current_dts, corrected_dts) / FFMAX(sample_count, 1); uint32_t correction = (sc->stts_data[i].duration > drift) ? drift : sc->stts_data[i].duration - 1; current_dts -= correction * (uint64_t)sample_count; sc->stts_data[i].duration -= correction;

1 0

ffmpeg_demux: don't print input error for AVERROR_EXIT
by Gyan Doshi 30 Jan '25

30 Jan '25

ffmpeg | branch: master | Gyan Doshi <ffmpeg(a)gyani.pro> | Mon Jan 27 11:03:28 2025 +0530| [1911a6ec26236588f72413c2b9bfe54a97a6a145] | committer: Gyan Doshi ffmpeg_demux: don't print input error for AVERROR_EXIT This error code is for expected exits, like after listing options for a device. > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1911a6ec26236588f… --- fftools/ffmpeg_demux.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fftools/ffmpeg_demux.c b/fftools/ffmpeg_demux.c index 0fd095d8ae..5ff75eed1a 100644 --- a/fftools/ffmpeg_demux.c +++ b/fftools/ffmpeg_demux.c @@ -1726,8 +1726,9 @@ int ifile_open(const OptionsContext *o, const char *filename, Scheduler *sch) /* open the input file with generic avformat function */ err = avformat_open_input(&ic, filename, file_iformat, &o->g->format_opts); if (err < 0) { - av_log(d, AV_LOG_ERROR, - "Error opening input: %s\n", av_err2str(err)); + if (err != AVERROR_EXIT) + av_log(d, AV_LOG_ERROR, + "Error opening input: %s\n", av_err2str(err)); if (err == AVERROR_PROTOCOL_NOT_FOUND) av_log(d, AV_LOG_ERROR, "Did you mean file:%s?\n", filename); return err;

1 0

avformat/vqf: fix memory leak in add_metadata()
by Kacper Michajłow 29 Jan '25

29 Jan '25

ffmpeg | branch: master | Kacper Michajłow <kasper93(a)gmail.com> | Sun Jan 26 20:40:27 2025 +0100| [4ba9ae7742a6f8a29d6486e25ff5709a075edb5b] | committer: Jan Ekström avformat/vqf: fix memory leak in add_metadata() Signed-off-by: Kacper Michajłow <kasper93(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4ba9ae7742a6f8a29… --- libavformat/vqf.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavformat/vqf.c b/libavformat/vqf.c index 58b1546f53..fbe54739cd 100644 --- a/libavformat/vqf.c +++ b/libavformat/vqf.c @@ -66,10 +66,10 @@ static int add_metadata(AVFormatContext *s, uint32_t tag, return AVERROR(ENOMEM); ret = avio_read(s->pb, buf, len); - if (ret < 0) - return ret; - if (len != ret) - return AVERROR_INVALIDDATA; + if (ret < 0 || ret != len) { + av_free(buf); + return ret < 0 ? ret : AVERROR_INVALIDDATA; + } buf[len] = 0; AV_WL32(key, tag); return av_dict_set(&s->metadata, key, buf, AV_DICT_DONT_STRDUP_VAL);

1 0

lavc/vvcdec: ensure slices contain nonzero CTUs
by Nuo Mi 29 Jan '25

29 Jan '25

ffmpeg | branch: master | Nuo Mi <nuomi2021(a)gmail.com> | Sun Jan 26 11:10:21 2025 +0800| [ca3550948c4f1d9fe7dbdc24572b92e588846c7b] | committer: Nuo Mi lavc/vvcdec: ensure slices contain nonzero CTUs fixes https://github.com/ffvvc/tests/tree/main/fuzz/passed/000323.bit Co-authored-by: Frank Plowman <post(a)frankplowman.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ca3550948c4f1d9fe… --- libavcodec/vvc/ps.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/libavcodec/vvc/ps.c b/libavcodec/vvc/ps.c index c9f7c5c80f..01b4615eda 100644 --- a/libavcodec/vvc/ps.c +++ b/libavcodec/vvc/ps.c @@ -1232,7 +1232,7 @@ static int sh_alf_aps(const VVCSH *sh, const VVCFrameParamSets *fps) return 0; } -static void sh_slice_address(VVCSH *sh, const H266RawSPS *sps, const VVCPPS *pps) +static int sh_slice_address(VVCSH *sh, const H266RawSPS *sps, const VVCPPS *pps) { const int slice_address = sh->r->sh_slice_address; @@ -1256,6 +1256,11 @@ static void sh_slice_address(VVCSH *sh, const H266RawSPS *sps, const VVCPPS *pps sh->num_ctus_in_curr_slice += pps->r->row_height_val[tile_y] * pps->r->col_width_val[tile_x]; } } + + if (!sh->num_ctus_in_curr_slice) + return AVERROR_INVALIDDATA; + + return 0; } static void sh_qp_y(VVCSH *sh, const H266RawPPS *pps, const H266RawPictureHeader *ph) @@ -1352,7 +1357,9 @@ static int sh_derive(VVCSH *sh, const VVCFrameParamSets *fps) const H266RawPictureHeader *ph = fps->ph.r; int ret; - sh_slice_address(sh, sps, fps->pps); + ret = sh_slice_address(sh, sps, fps->pps); + if (ret < 0) + return ret; ret = sh_alf_aps(sh, fps); if (ret < 0) return ret;

1 0

lavc/vvcdec: remove unneeded VVCContext->pix_fmt
by Nuo Mi 29 Jan '25

29 Jan '25

ffmpeg | branch: master | Nuo Mi <nuomi2021(a)gmail.com> | Sun Jan 26 11:10:20 2025 +0800| [974d4a8f0a43baca57104359deb4b08703590135] | committer: Nuo Mi lavc/vvcdec: remove unneeded VVCContext->pix_fmt AVCodecContext->sw_pix_fmt is used to hold the software pixel format. Co-authored-by: Frank Plowman <post(a)frankplowman.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=974d4a8f0a43baca5… --- libavcodec/vvc/dec.c | 17 ++++++----------- libavcodec/vvc/dec.h | 2 -- 2 files changed, 6 insertions(+), 13 deletions(-) diff --git a/libavcodec/vvc/dec.c b/libavcodec/vvc/dec.c index daf537294f..51dd60ae92 100644 --- a/libavcodec/vvc/dec.c +++ b/libavcodec/vvc/dec.c @@ -799,18 +799,15 @@ static int export_frame_params(VVCContext *s, const VVCFrameContext *fc) AVCodecContext *c = s->avctx; const VVCSPS *sps = fc->ps.sps; const VVCPPS *pps = fc->ps.pps; - int ret; - // Reset HW config if pix_fmt/w/h change. - if (s->pix_fmt != sps->pix_fmt || c->coded_width != pps->width || c->coded_height != pps->height) { + // Reset the format if pix_fmt/w/h change. + if (c->sw_pix_fmt != sps->pix_fmt || c->coded_width != pps->width || c->coded_height != pps->height) { c->coded_width = pps->width; c->coded_height = pps->height; - ret = get_format(c, sps); - if (ret < 0) - return ret; - - c->pix_fmt = ret; - s->pix_fmt = sps->pix_fmt; + c->sw_pix_fmt = sps->pix_fmt; + c->pix_fmt = get_format(c, sps); + if (c->pix_fmt < 0) + return AVERROR_INVALIDDATA; } c->width = pps->width - ((pps->r->pps_conf_win_left_offset + pps->r->pps_conf_win_right_offset) << sps->hshift[CHROMA]); @@ -1138,8 +1135,6 @@ static av_cold int vvc_decode_init(AVCodecContext *avctx) GDR_SET_RECOVERED(s); ff_thread_once(&init_static_once, init_default_scale_m); - s->pix_fmt = AV_PIX_FMT_NONE; - return 0; } diff --git a/libavcodec/vvc/dec.h b/libavcodec/vvc/dec.h index 382311e3be..6aa3121550 100644 --- a/libavcodec/vvc/dec.h +++ b/libavcodec/vvc/dec.h @@ -241,8 +241,6 @@ typedef struct VVCContext { uint64_t nb_frames; ///< processed frames int nb_delayed; ///< delayed frames - - enum AVPixelFormat pix_fmt; ///< pix format of current frame } VVCContext ; #endif /* AVCODEC_VVC_DEC_H */

1 0