July 2020 - FFmpeg-trac - lists.ffmpeg.org

#8786(avfilter:new): af_loudnorm: FINAL_FRAME handling does not update loudness anymore
by FFmpeg 12 Jul '20

12 Jul '20

#8786: af_loudnorm: FINAL_FRAME handling does not update loudness anymore ----------------------------------+--------------------------------------- Reporter: slomo | Type: defect Status: new | Priority: normal Component: avfilter | Version: unspecified Keywords: loudnorm | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | ----------------------------------+--------------------------------------- At the last frame there will be up to 3s of samples left in the buffer. These are currently copied out into a new AVFrame and then handled specially. While they were all already passed to the input EBUR128 context and the corresponding gain adjustments for them were stored in the deltas array in the previous INNER_FRAME processing, the whole last frame in the FINAL_FRAME handling is using the same index into that array. Currently the last 30 gain adjustments stored in the deltas array are not used at all In theory every 100ms (i.e. up to 30 times) the index into the deltas array would have to be incremented in the FINAL_FRAME handling, and like in the INNER_FRAME handling it would make sense to do linear interpolation between the current/next gain. I've found this while porting the filter to Rust for a GStreamer plugin, the code of which can be found here: https://gitlab.freedesktop.org/gstreamer/gst-plugins- rs/-/blob/master/audio/audiofx/src/audioloudnorm.rs . This also contains lots of code comments for all the steps, which might be helpful to take over to the ffmpeg code too. My solution for this might not be the best or most simple approach, but during my testing they worked so feel free to adapt them for the ffmpeg code. You can find the solution for this issue here: https://gitlab.freedesktop.org/gstreamer/gst-plugins- rs/-/blob/1730de6cea10cb73ff1ab882a8235d540bfa5061/audio/audiofx/src/audioloudnorm.rs#L735 If you agree that the above approach (incrementing the index every 100ms and linear interpolation as for INNER_FRAME) is the right thing to do here, I can also prepare a patch for the C code in ffmpeg. -- Ticket URL: <https://trac.ffmpeg.org/ticket/8786> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 4

#8718(undetermined:new): Heap buffer overflow in crash_dnn_execute_layer_pad due to integer overflow in memcpy
by FFmpeg 11 Jul '20

11 Jul '20

#8718: Heap buffer overflow in crash_dnn_execute_layer_pad due to integer overflow in memcpy -------------------------------------+------------------------------------- Reporter: assafsion | Type: defect Status: new | Priority: critical Component: | Version: git- undetermined | master Keywords: | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- This bug apply to all the 4 *different* memcpy calls exist in the function dnn_execute_layer_pad. Calling to calculate_operand_data_length to calculate the destination buffer size an integer overflow occurs. This could allow an attacker to control the address of the source and destination buffer inside the memcpy and to cause a read/write overflow. This is highly critical and could allow an attacker to execute code. I compiled ffmpeg on Ubuntu 18.04 with the following configuration: configuration: --cc=clang --extra-cflags='-O0 -g3 -fsanitize=address -Wno- error -fPIC' --extra-ldflags='-O0 -g3 -fsanitize=address -Wno-error -fPIC' --enable-debug --disable-asm --disable-optimizations --disable-shared --enable-libopenjpeg --enable-gpl --enable-libass --enable-libfdk-aac --enable-libmp3lame --enable-libopus --enable-libtheora --enable-libvorbis --enable-libvpx --enable-libx264 --enable-nonfree the bug could be reproduced while running the following command line: ffmpeg -v debug -i 10.jpg -vf format=rgb24,sr=dnn_backend=native:model=crash_dnn_execute_layer_pad_3 derain.jpg the output after running the command: ffmpeg version N-97806-gf603d10b1e Copyright (c) 2000-2020 the FFmpeg developers built with clang version 6.0.0-1ubuntu2 (tags/RELEASE_600/final) configuration: --cc=clang --extra-cflags='-O0 -g3 -fsanitize=address -Wno-error -fPIC' --extra-ldflags='-O0 -g3 -fsanitize=address -Wno-error -fPIC' --enable-debug --disable-asm --disable-optimizations --disable- shared --enable-libopenjpeg --enable-gpl --enable-libass --enable-libfdk- aac --enable-libmp3lame --enable-libopus --enable-libtheora --enable- libvorbis --enable-libvpx --enable-libx264 --enable-nonfree libavutil 56. 45.100 / 56. 45.100 libavcodec 58. 84.100 / 58. 84.100 libavformat 58. 43.100 / 58. 43.100 libavdevice 58. 9.103 / 58. 9.103 libavfilter 7. 81.100 / 7. 81.100 libswscale 5. 6.101 / 5. 6.101 libswresample 3. 6.100 / 3. 6.100 libpostproc 55. 6.100 / 55. 6.100 Splitting the commandline. Reading option '-v' ... matched as option 'v' (set logging level) with argument 'debug'. Reading option '-i' ... matched as input url with argument '10.jpg'. Reading option '-vf' ... matched as option 'vf' (set video filters) with argument 'format=rgb24,sr=dnn_backend=native:model=crash_dnn_execute_layer_pad_3'. Reading option 'derain.jpg' ... matched as output url. Finished splitting the commandline. Parsing a group of options: global . Applying option v (set logging level) with argument debug. Successfully parsed a group of options. Parsing a group of options: input url 10.jpg. Successfully parsed a group of options. Opening an input file: 10.jpg. [NULL @ 0x61b000000080] Opening '10.jpg' for reading [file @ 0x60c000000040] Setting default whitelist 'file,crypto,data' [image2 @ 0x61b000000080] Format image2 probed with size=2048 and score=50 [image2 @ 0x61b000000080] Before avformat_find_stream_info() pos: 0 bytes read:18522 seeks:0 nb_streams:1 [mjpeg @ 0x619000000580] marker=d8 avail_size_in_buf=18520 [mjpeg @ 0x619000000580] marker parser used 0 bytes (0 bits) [mjpeg @ 0x619000000580] marker=e0 avail_size_in_buf=18518 [mjpeg @ 0x619000000580] marker parser used 16 bytes (128 bits) [mjpeg @ 0x619000000580] marker=e1 avail_size_in_buf=18500 [mjpeg @ 0x619000000580] marker parser used 12833 bytes (102664 bits) [mjpeg @ 0x619000000580] marker=db avail_size_in_buf=5664 [mjpeg @ 0x619000000580] index=0 [mjpeg @ 0x619000000580] qscale[0]: 2 [mjpeg @ 0x619000000580] marker parser used 67 bytes (536 bits) [mjpeg @ 0x619000000580] marker=db avail_size_in_buf=5595 [mjpeg @ 0x619000000580] index=1 [mjpeg @ 0x619000000580] qscale[1]: 8 [mjpeg @ 0x619000000580] marker parser used 67 bytes (536 bits) [mjpeg @ 0x619000000580] marker=c0 avail_size_in_buf=5526 [mjpeg @ 0x619000000580] Changing bps from 0 to 8 [mjpeg @ 0x619000000580] sof0: picture: 432x173 [mjpeg @ 0x619000000580] component 0 1:1 id: 0 quant:0 [mjpeg @ 0x619000000580] component 1 1:1 id: 1 quant:1 [mjpeg @ 0x619000000580] component 2 1:1 id: 2 quant:1 [mjpeg @ 0x619000000580] pix fmt id 11111100 [mjpeg @ 0x619000000580] Format yuvj444p chosen by get_format(). [mjpeg @ 0x619000000580] marker parser used 17 bytes (136 bits) [mjpeg @ 0x619000000580] marker=c4 avail_size_in_buf=5507 [mjpeg @ 0x619000000580] marker parser used 0 bytes (0 bits) [mjpeg @ 0x619000000580] marker=c4 avail_size_in_buf=5478 [mjpeg @ 0x619000000580] marker parser used 0 bytes (0 bits) [mjpeg @ 0x619000000580] marker=c4 avail_size_in_buf=5420 [mjpeg @ 0x619000000580] marker parser used 0 bytes (0 bits) [mjpeg @ 0x619000000580] marker=c4 avail_size_in_buf=5393 [mjpeg @ 0x619000000580] marker parser used 0 bytes (0 bits) [mjpeg @ 0x619000000580] escaping removed 16 bytes [mjpeg @ 0x619000000580] marker=da avail_size_in_buf=5360 [mjpeg @ 0x619000000580] marker parser used 5344 bytes (42752 bits) [mjpeg @ 0x619000000580] marker=d9 avail_size_in_buf=0 [mjpeg @ 0x619000000580] decode frame unused 0 bytes [image2 @ 0x61b000000080] After avformat_find_stream_info() pos: 18522 bytes read:18522 seeks:0 frames:1 Input #0, image2, from '10.jpg': Duration: 00:00:00.04, start: 0.000000, bitrate: 3704 kb/s Stream #0:0, 1, 1/25: Video: mjpeg (Baseline), 1 reference frame, yuvj444p(pc, bt470bg/unknown/unknown, center), 432x173 [SAR 96:96 DAR 432:173], 0/1, 25 tbr, 25 tbn, 25 tbc Successfully opened the file. Parsing a group of options: output url derain.jpg. Applying option vf (set video filters) with argument format=rgb24,sr=dnn_backend=native:model=crash_dnn_execute_layer_pad_3. Successfully parsed a group of options. Opening an output file: derain.jpg. Successfully opened the file. Stream mapping: Stream #0:0 -> #0:0 (mjpeg (native) -> mjpeg (native)) Press [q] to stop, [?] for help cur_dts is invalid st:0 (0) [init:0 i_done:0 finish:0] (this is harmless if it occurs once at the start per stream) [mjpeg @ 0x619000000a80] marker=d8 avail_size_in_buf=18520 [mjpeg @ 0x619000000a80] marker parser used 0 bytes (0 bits) [mjpeg @ 0x619000000a80] marker=e0 avail_size_in_buf=18518 [mjpeg @ 0x619000000a80] marker parser used 16 bytes (128 bits) [mjpeg @ 0x619000000a80] marker=e1 avail_size_in_buf=18500 [mjpeg @ 0x619000000a80] marker parser used 12833 bytes (102664 bits) [mjpeg @ 0x619000000a80] marker=db avail_size_in_buf=5664 [mjpeg @ 0x619000000a80] index=0 [mjpeg @ 0x619000000a80] qscale[0]: 2 [mjpeg @ 0x619000000a80] marker parser used 67 bytes (536 bits) [mjpeg @ 0x619000000a80] marker=db avail_size_in_buf=5595 [mjpeg @ 0x619000000a80] index=1 [mjpeg @ 0x619000000a80] qscale[1]: 8 [mjpeg @ 0x619000000a80] marker parser used 67 bytes (536 bits) [mjpeg @ 0x619000000a80] marker=c0 avail_size_in_buf=5526 [mjpeg @ 0x619000000a80] sof0: picture: 432x173 [mjpeg @ 0x619000000a80] component 0 1:1 id: 0 quant:0 [mjpeg @ 0x619000000a80] component 1 1:1 id: 1 quant:1 [mjpeg @ 0x619000000a80] component 2 1:1 id: 2 quant:1 [mjpeg @ 0x619000000a80] pix fmt id 11111100 [mjpeg @ 0x619000000a80] Format yuvj444p chosen by get_format(). [mjpeg @ 0x619000000a80] marker parser used 17 bytes (136 bits) [mjpeg @ 0x619000000a80] marker=c4 avail_size_in_buf=5507 [mjpeg @ 0x619000000a80] class=0 index=0 nb_codes=8 [mjpeg @ 0x619000000a80] marker parser used 27 bytes (216 bits) [mjpeg @ 0x619000000a80] marker=c4 avail_size_in_buf=5478 [mjpeg @ 0x619000000a80] class=1 index=0 nb_codes=226 [mjpeg @ 0x619000000a80] marker parser used 56 bytes (448 bits) [mjpeg @ 0x619000000a80] marker=c4 avail_size_in_buf=5420 [mjpeg @ 0x619000000a80] class=0 index=1 nb_codes=6 [mjpeg @ 0x619000000a80] marker parser used 25 bytes (200 bits) [mjpeg @ 0x619000000a80] marker=c4 avail_size_in_buf=5393 [mjpeg @ 0x619000000a80] class=1 index=1 nb_codes=82 [mjpeg @ 0x619000000a80] marker parser used 31 bytes (248 bits) [mjpeg @ 0x619000000a80] escaping removed 16 bytes [mjpeg @ 0x619000000a80] marker=da avail_size_in_buf=5360 [mjpeg @ 0x619000000a80] component: 0 [mjpeg @ 0x619000000a80] component: 1 [mjpeg @ 0x619000000a80] component: 2 [mjpeg @ 0x619000000a80] marker parser used 5343 bytes (42742 bits) [mjpeg @ 0x619000000a80] marker=d9 avail_size_in_buf=0 [mjpeg @ 0x619000000a80] decode frame unused 0 bytes detected 32 logical cores [Parsed_format_0 @ 0x610000000040] Setting 'pix_fmts' to value 'rgb24' [Parsed_sr_1 @ 0x610000000140] Setting 'dnn_backend' to value 'native' [Parsed_sr_1 @ 0x610000000140] Setting 'model' to value 'crash_dnn_execute_layer_pad_3' [file @ 0x60d000000040] Setting default whitelist 'file,crypto,data' [AVIOContext @ 0x6120000001c0] Statistics: 145 bytes read, 0 seeks [graph 0 input from stream 0:0 @ 0x610000000240] Setting 'video_size' to value '432x173' [graph 0 input from stream 0:0 @ 0x610000000240] Setting 'pix_fmt' to value '14' [graph 0 input from stream 0:0 @ 0x610000000240] Setting 'time_base' to value '1/25' [graph 0 input from stream 0:0 @ 0x610000000240] Setting 'pixel_aspect' to value '96/96' [graph 0 input from stream 0:0 @ 0x610000000240] Setting 'frame_rate' to value '25/1' [graph 0 input from stream 0:0 @ 0x610000000240] w:432 h:173 pixfmt:yuvj444p tb:1/25 fr:25/1 sar:96/96 [format @ 0x610000000440] Setting 'pix_fmts' to value 'yuvj420p|yuvj422p|yuvj444p' [auto_scaler_0 @ 0x610000001d40] Setting 'flags' to value 'bicubic' [auto_scaler_0 @ 0x610000001d40] w:iw h:ih flags:'bicubic' interl:0 [Parsed_format_0 @ 0x610000000040] auto-inserting filter 'auto_scaler_0' between the filter 'graph 0 input from stream 0:0' and the filter 'Parsed_format_0' [auto_scaler_1 @ 0x610000002a40] Setting 'flags' to value 'bicubic' [auto_scaler_1 @ 0x610000002a40] w:iw h:ih flags:'bicubic' interl:0 [Parsed_sr_1 @ 0x610000000140] auto-inserting filter 'auto_scaler_1' between the filter 'Parsed_format_0' and the filter 'Parsed_sr_1' [auto_scaler_2 @ 0x610000003740] Setting 'flags' to value 'bicubic' [auto_scaler_2 @ 0x610000003740] w:iw h:ih flags:'bicubic' interl:0 [format @ 0x610000000440] auto-inserting filter 'auto_scaler_2' between the filter 'Parsed_sr_1' and the filter 'format' [AVFilterGraph @ 0x6090000006e0] query_formats: 5 queried, 1 merged, 3 already done, 0 delayed [auto_scaler_1 @ 0x610000002a40] picking yuv444p out of 6 ref:rgb24 alpha:0 [auto_scaler_2 @ 0x610000003740] picking yuvj444p out of 3 ref:yuv444p alpha:0 [swscaler @ 0x62f000000400] deprecated pixel format used, make sure you did set range correctly [swscaler @ 0x62f000000400] Forcing full internal H chroma due to input having non subsampled chroma [auto_scaler_0 @ 0x610000001d40] w:432 h:173 fmt:yuvj444p sar:96/96 -> w:432 h:173 fmt:rgb24 sar:1/1 flags:0x4 [auto_scaler_1 @ 0x610000002a40] w:432 h:173 fmt:rgb24 sar:1/1 -> w:432 h:173 fmt:yuv444p sar:1/1 flags:0x4 AddressSanitizer:DEADLYSIGNAL ================================================================= ==95910==ERROR: AddressSanitizer: SEGV on unknown address 0x7fff2cda1a7c (pc 0x7ffff2d53595 bp 0x7fffffff6b00 sp 0x7fffffff6288 T0) ==95910==The signal is caused by a WRITE memory access. #0 0x7ffff2d53594 /build/glibc- OTsEL5/glibc-2.27/string/../sysdeps/x86_64/multiarch/memmove-vec- unaligned-erms.S:307 #1 0x4e215d in __asan_memcpy (/home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/ffmpeg_g+0x4e215d) #2 0x1318940 in dnn_execute_layer_pad /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/libavfilter/dnn/dnn_backend_native_layer_pad.c:124:17 #3 0x130f6ee in ff_dnn_execute_model_native /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/libavfilter/dnn/dnn_backend_native.c:276:9 #4 0xe5a10f in config_props /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/libavfilter/vf_sr.c:133:14 #5 0x6c1d38 in avfilter_config_links /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/libavfilter/avfilter.c:369:28 #6 0x6c08bd in avfilter_config_links /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/libavfilter/avfilter.c:307:24 #7 0x6c08bd in avfilter_config_links /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/libavfilter/avfilter.c:307:24 #8 0x6c08bd in avfilter_config_links /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/libavfilter/avfilter.c:307:24 #9 0x6d1dbc in graph_config_links /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/libavfilter/avfiltergraph.c:261:24 #10 0x6d0bb6 in avfilter_graph_config /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/libavfilter/avfiltergraph.c:1279:16 #11 0x568e88 in configure_filtergraph /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg_filter.c:1106:16 #12 0x5d66a3 in ifilter_send_frame /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:2166:15 #13 0x5d5669 in send_frame_to_filters /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:2247:15 #14 0x5d0f2b in decode_video /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:2446:11 #15 0x59ba41 in process_input_packet /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:2600:19 #16 0x5be936 in process_input /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:4491:5 #17 0x597af6 in transcode_step /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:4611:11 #18 0x590da5 in transcode /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:4665:15 #19 0x58efda in main /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:4866:9 #20 0x7ffff2cb9b96 in __libc_start_main /build/glibc- OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310 #21 0x423839 in _start (/home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/ffmpeg_g+0x423839) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /build/glibc- OTsEL5/glibc-2.27/string/../sysdeps/x86_64/multiarch/memmove-vec- unaligned-erms.S:307 ==95910==ABORTING [1] + Done "/usr/bin/gdb" --interpreter=mi --tty=${DbgTerm} 0<"/tmp/Microsoft-MIEngine-In-l1la0r3g.zlb" 1>"/tmp /Microsoft-MIEngine-Out-kftego55.fig" -- Ticket URL: <https://trac.ffmpeg.org/ticket/8718> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 11

#8773(undetermined:new): libavcodec/libaomenc.c fails to build (undeclared symbols/variables)
by FFmpeg 10 Jul '20

10 Jul '20

#8773: libavcodec/libaomenc.c fails to build (undeclared symbols/variables) -------------------------------------+------------------------------------- Reporter: | Type: defect slycordinator | Status: new | Priority: normal Component: | Version: undetermined | unspecified Keywords: | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- Summary of the bug: libavcodec/libaomenc.c fails to build; gives [error: ‘AV1E_SET_ENABLE_*_PARTITIONS’ undeclared here] How to reproduce: {{{ Download current git sources ffmpeg-snapshot.tar.bz2 Unpack configure to build libaom make }}} CC libavcodec/libfdk-aacenc.o libavcodec/libaomenc.c:148:6: error: ‘AV1E_SET_ENABLE_1TO4_PARTITIONS’ undeclared here (not in a function); did you mean ‘AV1E_SET_ENABLE_RESTORATION’? 148 | [AV1E_SET_ENABLE_1TO4_PARTITIONS] = "AV1E_SET_ENABLE_1TO4_PARTITIONS", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | AV1E_SET_ENABLE_RESTORATION libavcodec/libaomenc.c:148:6: error: array index in initializer not of integer type libavcodec/libaomenc.c:148:6: note: (near initialization for ‘ctlidstr’) CC libavcodec/libmp3lame.o libavcodec/libaomenc.c:149:6: error: ‘AV1E_SET_ENABLE_AB_PARTITIONS’ undeclared here (not in a function); did you mean ‘AV1E_SET_ENABLE_RESTORATION’? 149 | [AV1E_SET_ENABLE_AB_PARTITIONS] = "AV1E_SET_ENABLE_AB_PARTITIONS", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | AV1E_SET_ENABLE_RESTORATION libavcodec/libaomenc.c:149:6: error: array index in initializer not of integer type libavcodec/libaomenc.c:149:6: note: (near initialization for ‘ctlidstr’) libavcodec/libaomenc.c:150:6: error: ‘AV1E_SET_ENABLE_RECT_PARTITIONS’ undeclared here (not in a function); did you mean ‘AV1E_SET_ENABLE_RESTORATION’? 150 | [AV1E_SET_ENABLE_RECT_PARTITIONS] = "AV1E_SET_ENABLE_RECT_PARTITIONS", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | AV1E_SET_ENABLE_RESTORATION libavcodec/libaomenc.c:150:6: error: array index in initializer not of integer type libavcodec/libaomenc.c:150:6: note: (near initialization for ‘ctlidstr’) CC libavcodec/libopus.o libavcodec/libaomenc.c:151:6: error: ‘AV1E_SET_ENABLE_ANGLE_DELTA’ undeclared here (not in a function); did you mean ‘AV1E_SET_ENABLE_SUPERRES’? 151 | [AV1E_SET_ENABLE_ANGLE_DELTA] = "AV1E_SET_ENABLE_ANGLE_DELTA", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ | AV1E_SET_ENABLE_SUPERRES libavcodec/libaomenc.c:151:6: error: array index in initializer not of integer type libavcodec/libaomenc.c:151:6: note: (near initialization for ‘ctlidstr’) libavcodec/libaomenc.c:152:6: error: ‘AV1E_SET_ENABLE_CFL_INTRA’ undeclared here (not in a function); did you mean ‘AV1E_SET_ENABLE_JNT_COMP’? 152 | [AV1E_SET_ENABLE_CFL_INTRA] = "AV1E_SET_ENABLE_CFL_INTRA", | ^~~~~~~~~~~~~~~~~~~~~~~~~ | AV1E_SET_ENABLE_JNT_COMP libavcodec/libaomenc.c:152:6: error: array index in initializer not of integer type libavcodec/libaomenc.c:152:6: note: (near initialization for ‘ctlidstr’) libavcodec/libaomenc.c:153:6: error: ‘AV1E_SET_ENABLE_FILTER_INTRA’ undeclared here (not in a function); did you mean ‘AV1E_SET_ENABLE_ORDER_HINT’? 153 | [AV1E_SET_ENABLE_FILTER_INTRA] = "AV1E_SET_ENABLE_FILTER_INTRA", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ | AV1E_SET_ENABLE_ORDER_HINT libavcodec/libaomenc.c:153:6: error: array index in initializer not of integer type libavcodec/libaomenc.c:153:6: note: (near initialization for ‘ctlidstr’) libavcodec/libaomenc.c:154:6: error: ‘AV1E_SET_ENABLE_INTRA_EDGE_FILTER’ undeclared here (not in a function) 154 | [AV1E_SET_ENABLE_INTRA_EDGE_FILTER] = "AV1E_SET_ENABLE_INTRA_EDGE_FILTER", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ libavcodec/libaomenc.c:154:6: error: array index in initializer not of integer type libavcodec/libaomenc.c:154:6: note: (near initialization for ‘ctlidstr’) libavcodec/libaomenc.c:155:6: error: ‘AV1E_SET_ENABLE_PAETH_INTRA’ undeclared here (not in a function); did you mean ‘AV1E_SET_ENABLE_ORDER_HINT’? 155 | [AV1E_SET_ENABLE_PAETH_INTRA] = "AV1E_SET_ENABLE_PAETH_INTRA", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ | AV1E_SET_ENABLE_ORDER_HINT libavcodec/libaomenc.c:155:6: error: array index in initializer not of integer type libavcodec/libaomenc.c:155:6: note: (near initialization for ‘ctlidstr’) libavcodec/libaomenc.c:156:6: error: ‘AV1E_SET_ENABLE_SMOOTH_INTRA’ undeclared here (not in a function); did you mean ‘AV1E_SET_ENABLE_ORDER_HINT’? 156 | [AV1E_SET_ENABLE_SMOOTH_INTRA] = "AV1E_SET_ENABLE_SMOOTH_INTRA", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ | AV1E_SET_ENABLE_ORDER_HINT libavcodec/libaomenc.c:156:6: error: array index in initializer not of integer type libavcodec/libaomenc.c:156:6: note: (near initialization for ‘ctlidstr’) libavcodec/libaomenc.c:157:6: error: ‘AV1E_SET_ENABLE_PALETTE’ undeclared here (not in a function); did you mean ‘AV1E_SET_ENABLE_SUPERRES’? 157 | [AV1E_SET_ENABLE_PALETTE] = "AV1E_SET_ENABLE_PALETTE", | ^~~~~~~~~~~~~~~~~~~~~~~ | AV1E_SET_ENABLE_SUPERRES libavcodec/libaomenc.c:157:6: error: array index in initializer not of integer type libavcodec/libaomenc.c:157:6: note: (near initialization for ‘ctlidstr’) CC libavcodec/libopusdec.o CC libavcodec/libopusenc.o CC libavcodec/libvorbisdec.o make: *** [ffbuild/common.mak:59: libavcodec/libaomenc.o] Error 1 make: *** Waiting for unfinished jobs.... make: Leaving directory '/tmp/tmp.ShpjTBD5DM/ffmpeg' -- Ticket URL: <https://trac.ffmpeg.org/ticket/8773> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 2

#8784(ffmpeg:new): support comments in filter_complex_script files
by FFmpeg 10 Jul '20

10 Jul '20

#8784: support comments in filter_complex_script files -------------------------------------+------------------------------------- Reporter: RrnR | Type: | enhancement Status: new | Priority: normal Component: ffmpeg | Version: Keywords: | unspecified filter_complex_script comments | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- Suggestion to support comments in the script files referenced by filter_complex_script directive. Inline comments such as: {{{ nullsrc=size=1920x1080 [bg]; // this is a comment }}} should be relatively easy to incorporate into the scanner by treating the delimiter as an end-of-line token. Block (multi-line) comments might need a bit of thought. -- Ticket URL: <https://trac.ffmpeg.org/ticket/8784> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 1

#8782(undetermined:new): ffmpeg abort when parsing file
by FFmpeg 10 Jul '20

10 Jul '20

#8782: ffmpeg abort when parsing file -------------------------------------+------------------------------------- Reporter: lawhack | Type: defect Status: new | Priority: normal Component: | Version: undetermined | unspecified Keywords: bug , abort | Blocked By: ,crash | Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- Summary of the bug: use afl to fuzz the 4xm fileformat codec,ffmpeg abort when parsing some sample How to reproduce: {{{ % ffmpeg -vcodec 4xm -i sample -f null - ffmpeg version N-98388-g76a3ee996b Copyright (c) 2000-2020 the FFmpeg developers built on built with gcc 7 (Ubuntu 7.5.0-3ubuntu1~18.04) }}} Patches should be submitted to the ffmpeg-devel mailing list and not this bug tracker. -- Ticket URL: <https://trac.ffmpeg.org/ticket/8782> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 3

Re: [FFmpeg-trac] #3361(avcodec:new): aac_he mono not recogized (reported as stereo)
by FFmpeg 10 Jul '20

10 Jul '20

#3361: aac_he mono not recogized (reported as stereo) -------------------------------------+------------------------------------- Reporter: blacktrash | Owner: Type: defect | Status: new Priority: important | Component: avcodec Version: git-master | Resolution: Keywords: aac | Blocked By: regression | Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- Comment (by gordon): I am observing this bug as well attempting to downmix mono he-aac. using aac-lc instead of he-aac reports audio channel count correctly -- Ticket URL: <https://trac.ffmpeg.org/ticket/3361#comment:21> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 0

#8130(website:new): Patchwork accepted marks, where are they?
by FFmpeg 08 Jul '20

08 Jul '20

#8130: Patchwork accepted marks, where are they? ---------------------------------+--------------------------------------- Reporter: Balling | Type: task Status: new | Priority: normal Component: website | Version: unspecified Keywords: | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | ---------------------------------+--------------------------------------- Can you automate accepted marks on patchwork and recheck all old patches (some hashes comparison with master branch, maybe)? Because as of now this is very uncomfortable. I need to compare with github repo if the patch is there, etc. E.g. https://patchwork.ffmpeg.org/patch/14523/ https://github.com/FFmpeg/FFmpeg/commit/6b22e28f4c857b2d9c045001add083343f5… -- Ticket URL: <https://trac.ffmpeg.org/ticket/8130> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 4

#8780(avcodec:new): nvdec gives "No decoder surface left" error.
by FFmpeg 08 Jul '20

08 Jul '20

#8780: nvdec gives "No decoder surface left" error. ---------------------------------+--------------------------------------- Reporter: haviet | Type: defect Status: new | Priority: normal Component: avcodec | Version: unspecified Keywords: | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | ---------------------------------+--------------------------------------- Summary of the bug: My application (not ffmpeg.exe) uses nvdec to decode video streams receiving from IP cameras. Sometimes the error "No decoder surface left" occurs in unpredictable manner. I noticed the error via log files. I read the ticket #7562 but that ticket is different from my case that my app does not use any filter. How to reproduce: I could not reproduce the error in ffmpeg but I can reproduce the error by debugging my app in VS IDE. When the app runs normally I do like below: - Set a break point inside function "int ff_nvdec_start_frame(AVCodecContext *avctx, AVFrame *frame)". - Wait for some seconds. - Clear the break point and make the app continue running (F5). - Repeat above steps in several times then I should get the error. When the error occurs, flushing decoder does not help, but resetting decoder could mitigate the symptom. Snapshot of the break point https://ibb.co/vxvzW5S {{{ ffmpeg source 4.3., 4.2., ... built on Windows 10 with nvdec enabled }}} -- Ticket URL: <https://trac.ffmpeg.org/ticket/8780> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 0

#8776(ffmpeg:new): ffmpeg pad filter in_w constant is wrong
by FFmpeg 06 Jul '20

06 Jul '20

#8776: ffmpeg pad filter in_w constant is wrong --------------------------------------+---------------------------------- Reporter: abdullah2993 | Type: defect Status: new | Priority: normal Component: ffmpeg | Version: 4.2 Keywords: pad | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | --------------------------------------+---------------------------------- Summary of the bug: with some images when using {{{ -filter_complex "[0:v]pad=iw:ih+10:0:0" }}} the padded area is less then the input image eventhough we are using iw to set the width of the padding Sample Image: [https://i.imgur.com/e0ZQdcp.jpg] How to reproduce: {{{ ffmpeg.exe -i in.jpg -filter_complex "[0:v]pad=iw:ih+10:0:0" out.jpg }}} Report log: {{{ ffmpeg started on 2020-07-06 at 20:03:30 Report written to "ffmpeg-20200706-200330.log" Command line: "C:\\ProgramData\\chocolatey\\lib\\ffmpeg\\tools\\ffmpeg\\bin\\ffmpeg.exe" -i e0ZQdcp.jpg -filter_complex "[0:v]pad=iw:ih+10:0:0" _tmp__1594044405775090000_c2769cf415c601ed85d2583664c62104.jpg -report ffmpeg version 4.2.1 Copyright (c) 2000-2019 the FFmpeg developers built with gcc 9.1.1 (GCC) 20190807 configuration: --enable-gpl --enable-version3 --enable-sdl2 --enable- fontconfig --enable-gnutls --enable-iconv --enable-libass --enable- libdav1d --enable-libbluray --enable-libfreetype --enable-libmp3lame --enable-libopencore-amrnb --enable-libopencore-amrwb --enable-libopenjpeg --enable-libopus --enable-libshine --enable-libsnappy --enable-libsoxr --enable-libtheora --enable-libtwolame --enable-libvpx --enable-libwavpack --enable-libwebp --enable-libx264 --enable-libx265 --enable-libxml2 --enable-libzimg --enable-lzma --enable-zlib --enable-gmp --enable- libvidstab --enable-libvorbis --enable-libvo-amrwbenc --enable-libmysofa --enable-libspeex --enable-libxvid --enable-libaom --enable-libmfx --enable-amf --enable-ffnvcodec --enable-cuvid --enable-d3d11va --enable- nvenc --enable-nvdec --enable-dxva2 --enable-avisynth --enable-libopenmpt libavutil 56. 31.100 / 56. 31.100 libavcodec 58. 54.100 / 58. 54.100 libavformat 58. 29.100 / 58. 29.100 libavdevice 58. 8.100 / 58. 8.100 libavfilter 7. 57.100 / 7. 57.100 libswscale 5. 5.100 / 5. 5.100 libswresample 3. 5.100 / 3. 5.100 libpostproc 55. 5.100 / 55. 5.100 Splitting the commandline. Reading option '-i' ... matched as input url with argument 'e0ZQdcp.jpg'. Reading option '-filter_complex' ... matched as option 'filter_complex' (create a complex filtergraph) with argument '[0:v]pad=iw:ih+10:0:0'. Reading option '_tmp__1594044405775090000_c2769cf415c601ed85d2583664c62104.jpg' ... matched as output url. Reading option '-report' ... matched as option 'report' (generate a report) with argument '1'. Finished splitting the commandline. Parsing a group of options: global . Applying option filter_complex (create a complex filtergraph) with argument [0:v]pad=iw:ih+10:0:0. Applying option report (generate a report) with argument 1. Successfully parsed a group of options. Parsing a group of options: input url e0ZQdcp.jpg. Successfully parsed a group of options. Opening an input file: e0ZQdcp.jpg. [NULL @ 000001b4fba4a500] Opening 'e0ZQdcp.jpg' for reading [file @ 000001b4fba4b580] Setting default whitelist 'file,crypto' [image2 @ 000001b4fba4a500] Format image2 probed with size=2048 and score=50 [image2 @ 000001b4fba4a500] Before avformat_find_stream_info() pos: 0 bytes read:12276 seeks:0 nb_streams:1 [mjpeg @ 000001b4fba5c840] marker=d8 avail_size_in_buf=12274 [mjpeg @ 000001b4fba5c840] marker parser used 0 bytes (0 bits) [mjpeg @ 000001b4fba5c840] marker=db avail_size_in_buf=12272 [mjpeg @ 000001b4fba5c840] index=0 [mjpeg @ 000001b4fba5c840] qscale[0]: 1 [mjpeg @ 000001b4fba5c840] marker parser used 67 bytes (536 bits) [mjpeg @ 000001b4fba5c840] marker=db avail_size_in_buf=12203 [mjpeg @ 000001b4fba5c840] index=1 [mjpeg @ 000001b4fba5c840] qscale[1]: 1 [mjpeg @ 000001b4fba5c840] marker parser used 67 bytes (536 bits) [mjpeg @ 000001b4fba5c840] marker=c0 avail_size_in_buf=12134 [mjpeg @ 000001b4fba5c840] Changing bps from 0 to 8 [mjpeg @ 000001b4fba5c840] sof0: picture: 623x640 [mjpeg @ 000001b4fba5c840] component 0 2:2 id: 0 quant:0 [mjpeg @ 000001b4fba5c840] component 1 1:1 id: 1 quant:1 [mjpeg @ 000001b4fba5c840] component 2 1:1 id: 2 quant:1 [mjpeg @ 000001b4fba5c840] pix fmt id 22111100 [mjpeg @ 000001b4fba5c840] Format yuvj420p chosen by get_format(). [mjpeg @ 000001b4fba5c840] marker parser used 17 bytes (136 bits) [mjpeg @ 000001b4fba5c840] marker=c4 avail_size_in_buf=12115 [mjpeg @ 000001b4fba5c840] marker parser used 0 bytes (0 bits) [mjpeg @ 000001b4fba5c840] marker=c4 avail_size_in_buf=12083 [mjpeg @ 000001b4fba5c840] marker parser used 0 bytes (0 bits) [mjpeg @ 000001b4fba5c840] marker=c4 avail_size_in_buf=11988 [mjpeg @ 000001b4fba5c840] marker parser used 0 bytes (0 bits) [mjpeg @ 000001b4fba5c840] marker=c4 avail_size_in_buf=11960 [mjpeg @ 000001b4fba5c840] marker parser used 0 bytes (0 bits) [mjpeg @ 000001b4fba5c840] escaping removed 74 bytes [mjpeg @ 000001b4fba5c840] marker=da avail_size_in_buf=11921 [mjpeg @ 000001b4fba5c840] marker parser used 11847 bytes (94776 bits) [mjpeg @ 000001b4fba5c840] marker=d9 avail_size_in_buf=0 [mjpeg @ 000001b4fba5c840] decode frame unused 0 bytes [image2 @ 000001b4fba4a500] After avformat_find_stream_info() pos: 12276 bytes read:12276 seeks:0 frames:1 Input #0, image2, from 'e0ZQdcp.jpg': Duration: 00:00:00.04, start: 0.000000, bitrate: 2455 kb/s Stream #0:0, 1, 1/25: Video: mjpeg (Baseline), yuvj420p(pc, bt470bg/unknown/unknown), 623x640, 25 tbr, 25 tbn, 25 tbc Successfully opened the file. [Parsed_pad_0 @ 000001b4fba5ce40] Setting 'width' to value 'iw' [Parsed_pad_0 @ 000001b4fba5ce40] Setting 'height' to value 'ih+10' [Parsed_pad_0 @ 000001b4fba5ce40] Setting 'x' to value '0' [Parsed_pad_0 @ 000001b4fba5ce40] Setting 'y' to value '0' Parsing a group of options: output url _tmp__1594044405775090000_c2769cf415c601ed85d2583664c62104.jpg. Successfully parsed a group of options. Opening an output file: _tmp__1594044405775090000_c2769cf415c601ed85d2583664c62104.jpg. Successfully opened the file. Stream mapping: Stream #0:0 (mjpeg) -> pad pad -> Stream #0:0 (mjpeg) Press [q] to stop, [?] for help cur_dts is invalid st:0 (0) [init:0 i_done:0 finish:0] (this is harmless if it occurs once at the start per stream) [mjpeg @ 000001b4fba54380] marker=d8 avail_size_in_buf=12274 [mjpeg @ 000001b4fba54380] marker parser used 0 bytes (0 bits) [mjpeg @ 000001b4fba54380] marker=db avail_size_in_buf=12272 [mjpeg @ 000001b4fba54380] index=0 [mjpeg @ 000001b4fba54380] qscale[0]: 1 [mjpeg @ 000001b4fba54380] marker parser used 67 bytes (536 bits) [mjpeg @ 000001b4fba54380] marker=db avail_size_in_buf=12203 [mjpeg @ 000001b4fba54380] index=1 [mjpeg @ 000001b4fba54380] qscale[1]: 1 [mjpeg @ 000001b4fba54380] marker parser used 67 bytes (536 bits) [mjpeg @ 000001b4fba54380] marker=c0 avail_size_in_buf=12134 [mjpeg @ 000001b4fba54380] sof0: picture: 623x640 [mjpeg @ 000001b4fba54380] component 0 2:2 id: 0 quant:0 [mjpeg @ 000001b4fba54380] component 1 1:1 id: 1 quant:1 [mjpeg @ 000001b4fba54380] component 2 1:1 id: 2 quant:1 [mjpeg @ 000001b4fba54380] pix fmt id 22111100 [mjpeg @ 000001b4fba54380] Format yuvj420p chosen by get_format(). [mjpeg @ 000001b4fba54380] marker parser used 17 bytes (136 bits) [mjpeg @ 000001b4fba54380] marker=c4 avail_size_in_buf=12115 [mjpeg @ 000001b4fba54380] class=0 index=0 nb_codes=11 [mjpeg @ 000001b4fba54380] marker parser used 30 bytes (240 bits) [mjpeg @ 000001b4fba54380] marker=c4 avail_size_in_buf=12083 [mjpeg @ 000001b4fba54380] class=1 index=0 nb_codes=214 [mjpeg @ 000001b4fba54380] marker parser used 93 bytes (744 bits) [mjpeg @ 000001b4fba54380] marker=c4 avail_size_in_buf=11988 [mjpeg @ 000001b4fba54380] class=0 index=1 nb_codes=8 [mjpeg @ 000001b4fba54380] marker parser used 26 bytes (208 bits) [mjpeg @ 000001b4fba54380] marker=c4 avail_size_in_buf=11960 [mjpeg @ 000001b4fba54380] class=1 index=1 nb_codes=82 [mjpeg @ 000001b4fba54380] marker parser used 37 bytes (296 bits) [mjpeg @ 000001b4fba54380] escaping removed 74 bytes [mjpeg @ 000001b4fba54380] marker=da avail_size_in_buf=11921 [mjpeg @ 000001b4fba54380] component: 0 [mjpeg @ 000001b4fba54380] component: 1 [mjpeg @ 000001b4fba54380] component: 2 [mjpeg @ 000001b4fba54380] marker parser used 11846 bytes (94765 bits) [mjpeg @ 000001b4fba54380] marker=d9 avail_size_in_buf=0 [mjpeg @ 000001b4fba54380] decode frame unused 0 bytes detected 12 logical cores [Parsed_pad_0 @ 000001b4fba59780] Setting 'width' to value 'iw' [Parsed_pad_0 @ 000001b4fba59780] Setting 'height' to value 'ih+10' [Parsed_pad_0 @ 000001b4fba59780] Setting 'x' to value '0' [Parsed_pad_0 @ 000001b4fba59780] Setting 'y' to value '0' [graph 0 input from stream 0:0 @ 000001b4fba5c0c0] Setting 'video_size' to value '623x640' [graph 0 input from stream 0:0 @ 000001b4fba5c0c0] Setting 'pix_fmt' to value '12' [graph 0 input from stream 0:0 @ 000001b4fba5c0c0] Setting 'time_base' to value '1/25' [graph 0 input from stream 0:0 @ 000001b4fba5c0c0] Setting 'pixel_aspect' to value '0/1' [graph 0 input from stream 0:0 @ 000001b4fba5c0c0] Setting 'sws_param' to value 'flags=2' [graph 0 input from stream 0:0 @ 000001b4fba5c0c0] Setting 'frame_rate' to value '25/1' [graph 0 input from stream 0:0 @ 000001b4fba5c0c0] w:623 h:640 pixfmt:yuvj420p tb:1/25 fr:25/1 sar:0/1 sws_param:flags=2 [format @ 000001b4fbb07980] Setting 'pix_fmts' to value 'yuvj420p|yuvj422p|yuvj444p' [AVFilterGraph @ 000001b4fba59680] query_formats: 4 queried, 3 merged, 0 already done, 0 delayed [Parsed_pad_0 @ 000001b4fba59780] w:623 h:640 -> w:622 h:650 x:0 y:0 color:0x000000FF [Parsed_pad_0 @ 000001b4fba59780] Input area 0:0:623:640 not within the padded area 0:0:622:650 or zero-sized [Parsed_pad_0 @ 000001b4fba59780] Failed to configure input pad on Parsed_pad_0 Error reinitializing filters! Failed to inject frame into filter network: Invalid argument Error while processing the decoded data for stream #0:0 [AVIOContext @ 000001b4fba53800] Statistics: 12276 bytes read, 0 seeks Conversion failed! }}} -- Ticket URL: <https://trac.ffmpeg.org/ticket/8776> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 1

#8717(avfilter:new): Heap buffer overflow in crash_dnn_execute_layer_pad
by FFmpeg 05 Jul '20

05 Jul '20

#8717: Heap buffer overflow in crash_dnn_execute_layer_pad -----------------------------------+-------------------------------------- Reporter: assafsion | Type: defect Status: new | Priority: critical Component: avfilter | Version: git-master Keywords: | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -----------------------------------+-------------------------------------- dnn_backend_native_layer_pad.c the call to dnn_execute_layer_pad could cause a heap buffer overflow caused by a missing check of the variable input_operand_index while accessing operands and setting the dimensions. this could cause a write/read buffer overflow and may use as a primitive to leak addresses or sensitive memory and edit them. I compiled ffmpeg on Ubuntu 18.04 with the following configuration: configuration: --cc=clang --extra-cflags='-O0 -g3 -fsanitize=address -Wno- error -fPIC' --extra-ldflags='-O0 -g3 -fsanitize=address -Wno-error -fPIC' --enable-debug --disable-asm --disable-optimizations --disable-shared --enable-libopenjpeg --enable-gpl --enable-libass --enable-libfdk-aac --enable-libmp3lame --enable-libopus --enable-libtheora --enable-libvorbis --enable-libvpx --enable-libx264 --enable-nonfree the bug could be reproduced while running the following command line: ffmpeg -v debug -i 10.jpg -vf format=rgb24,sr=dnn_backend=native:model=crash_dnn_execute_layer_pad_2 derain.jpg the output after running the command: ffmpeg version N-97806-gf603d10b1e Copyright (c) 2000-2020 the FFmpeg developers built with clang version 6.0.0-1ubuntu2 (tags/RELEASE_600/final) configuration: --cc=clang --extra-cflags='-O0 -g3 -fsanitize=address -Wno-error -fPIC' --extra-ldflags='-O0 -g3 -fsanitize=address -Wno-error -fPIC' --enable-debug --disable-asm --disable-optimizations --disable- shared --enable-libopenjpeg --enable-gpl --enable-libass --enable-libfdk- aac --enable-libmp3lame --enable-libopus --enable-libtheora --enable- libvorbis --enable-libvpx --enable-libx264 --enable-nonfree libavutil 56. 45.100 / 56. 45.100 libavcodec 58. 84.100 / 58. 84.100 libavformat 58. 43.100 / 58. 43.100 libavdevice 58. 9.103 / 58. 9.103 libavfilter 7. 81.100 / 7. 81.100 libswscale 5. 6.101 / 5. 6.101 libswresample 3. 6.100 / 3. 6.100 libpostproc 55. 6.100 / 55. 6.100 Splitting the commandline. Reading option '-v' ... matched as option 'v' (set logging level) with argument 'debug'. Reading option '-i' ... matched as input url with argument '10.jpg'. Reading option '-vf' ... matched as option 'vf' (set video filters) with argument 'format=rgb24,sr=dnn_backend=native:model=crash_dnn_execute_layer_pad_2'. Reading option 'derain.jpg' ... matched as output url. Finished splitting the commandline. Parsing a group of options: global . Applying option v (set logging level) with argument debug. Successfully parsed a group of options. Parsing a group of options: input url 10.jpg. Successfully parsed a group of options. Opening an input file: 10.jpg. [NULL @ 0x61b000000080] Opening '10.jpg' for reading [file @ 0x60c000000040] Setting default whitelist 'file,crypto,data' [image2 @ 0x61b000000080] Format image2 probed with size=2048 and score=50 [image2 @ 0x61b000000080] Before avformat_find_stream_info() pos: 0 bytes read:18522 seeks:0 nb_streams:1 [mjpeg @ 0x619000000580] marker=d8 avail_size_in_buf=18520 [mjpeg @ 0x619000000580] marker parser used 0 bytes (0 bits) [mjpeg @ 0x619000000580] marker=e0 avail_size_in_buf=18518 [mjpeg @ 0x619000000580] marker parser used 16 bytes (128 bits) [mjpeg @ 0x619000000580] marker=e1 avail_size_in_buf=18500 [mjpeg @ 0x619000000580] marker parser used 12833 bytes (102664 bits) [mjpeg @ 0x619000000580] marker=db avail_size_in_buf=5664 [mjpeg @ 0x619000000580] index=0 [mjpeg @ 0x619000000580] qscale[0]: 2 [mjpeg @ 0x619000000580] marker parser used 67 bytes (536 bits) [mjpeg @ 0x619000000580] marker=db avail_size_in_buf=5595 [mjpeg @ 0x619000000580] index=1 [mjpeg @ 0x619000000580] qscale[1]: 8 [mjpeg @ 0x619000000580] marker parser used 67 bytes (536 bits) [mjpeg @ 0x619000000580] marker=c0 avail_size_in_buf=5526 [mjpeg @ 0x619000000580] Changing bps from 0 to 8 [mjpeg @ 0x619000000580] sof0: picture: 432x173 [mjpeg @ 0x619000000580] component 0 1:1 id: 0 quant:0 [mjpeg @ 0x619000000580] component 1 1:1 id: 1 quant:1 [mjpeg @ 0x619000000580] component 2 1:1 id: 2 quant:1 [mjpeg @ 0x619000000580] pix fmt id 11111100 [mjpeg @ 0x619000000580] Format yuvj444p chosen by get_format(). [mjpeg @ 0x619000000580] marker parser used 17 bytes (136 bits) [mjpeg @ 0x619000000580] marker=c4 avail_size_in_buf=5507 [mjpeg @ 0x619000000580] marker parser used 0 bytes (0 bits) [mjpeg @ 0x619000000580] marker=c4 avail_size_in_buf=5478 [mjpeg @ 0x619000000580] marker parser used 0 bytes (0 bits) [mjpeg @ 0x619000000580] marker=c4 avail_size_in_buf=5420 [mjpeg @ 0x619000000580] marker parser used 0 bytes (0 bits) [mjpeg @ 0x619000000580] marker=c4 avail_size_in_buf=5393 [mjpeg @ 0x619000000580] marker parser used 0 bytes (0 bits) [mjpeg @ 0x619000000580] escaping removed 16 bytes [mjpeg @ 0x619000000580] marker=da avail_size_in_buf=5360 [mjpeg @ 0x619000000580] marker parser used 5344 bytes (42752 bits) [mjpeg @ 0x619000000580] marker=d9 avail_size_in_buf=0 [mjpeg @ 0x619000000580] decode frame unused 0 bytes [image2 @ 0x61b000000080] After avformat_find_stream_info() pos: 18522 bytes read:18522 seeks:0 frames:1 Input #0, image2, from '10.jpg': Duration: 00:00:00.04, start: 0.000000, bitrate: 3704 kb/s Stream #0:0, 1, 1/25: Video: mjpeg (Baseline), 1 reference frame, yuvj444p(pc, bt470bg/unknown/unknown, center), 432x173 [SAR 96:96 DAR 432:173], 0/1, 25 tbr, 25 tbn, 25 tbc Successfully opened the file. Parsing a group of options: output url derain.jpg. Applying option vf (set video filters) with argument format=rgb24,sr=dnn_backend=native:model=crash_dnn_execute_layer_pad_2. Successfully parsed a group of options. Opening an output file: derain.jpg. Successfully opened the file. Stream mapping: Stream #0:0 -> #0:0 (mjpeg (native) -> mjpeg (native)) Press [q] to stop, [?] for help cur_dts is invalid st:0 (0) [init:0 i_done:0 finish:0] (this is harmless if it occurs once at the start per stream) [mjpeg @ 0x619000000a80] marker=d8 avail_size_in_buf=18520 [mjpeg @ 0x619000000a80] marker parser used 0 bytes (0 bits) [mjpeg @ 0x619000000a80] marker=e0 avail_size_in_buf=18518 [mjpeg @ 0x619000000a80] marker parser used 16 bytes (128 bits) [mjpeg @ 0x619000000a80] marker=e1 avail_size_in_buf=18500 [mjpeg @ 0x619000000a80] marker parser used 12833 bytes (102664 bits) [mjpeg @ 0x619000000a80] marker=db avail_size_in_buf=5664 [mjpeg @ 0x619000000a80] index=0 [mjpeg @ 0x619000000a80] qscale[0]: 2 [mjpeg @ 0x619000000a80] marker parser used 67 bytes (536 bits) [mjpeg @ 0x619000000a80] marker=db avail_size_in_buf=5595 [mjpeg @ 0x619000000a80] index=1 [mjpeg @ 0x619000000a80] qscale[1]: 8 [mjpeg @ 0x619000000a80] marker parser used 67 bytes (536 bits) [mjpeg @ 0x619000000a80] marker=c0 avail_size_in_buf=5526 [mjpeg @ 0x619000000a80] sof0: picture: 432x173 [mjpeg @ 0x619000000a80] component 0 1:1 id: 0 quant:0 [mjpeg @ 0x619000000a80] component 1 1:1 id: 1 quant:1 [mjpeg @ 0x619000000a80] component 2 1:1 id: 2 quant:1 [mjpeg @ 0x619000000a80] pix fmt id 11111100 [mjpeg @ 0x619000000a80] Format yuvj444p chosen by get_format(). [mjpeg @ 0x619000000a80] marker parser used 17 bytes (136 bits) [mjpeg @ 0x619000000a80] marker=c4 avail_size_in_buf=5507 [mjpeg @ 0x619000000a80] class=0 index=0 nb_codes=8 [mjpeg @ 0x619000000a80] marker parser used 27 bytes (216 bits) [mjpeg @ 0x619000000a80] marker=c4 avail_size_in_buf=5478 [mjpeg @ 0x619000000a80] class=1 index=0 nb_codes=226 [mjpeg @ 0x619000000a80] marker parser used 56 bytes (448 bits) [mjpeg @ 0x619000000a80] marker=c4 avail_size_in_buf=5420 [mjpeg @ 0x619000000a80] class=0 index=1 nb_codes=6 [mjpeg @ 0x619000000a80] marker parser used 25 bytes (200 bits) [mjpeg @ 0x619000000a80] marker=c4 avail_size_in_buf=5393 [mjpeg @ 0x619000000a80] class=1 index=1 nb_codes=82 [mjpeg @ 0x619000000a80] marker parser used 31 bytes (248 bits) [mjpeg @ 0x619000000a80] escaping removed 16 bytes [mjpeg @ 0x619000000a80] marker=da avail_size_in_buf=5360 [mjpeg @ 0x619000000a80] component: 0 [mjpeg @ 0x619000000a80] component: 1 [mjpeg @ 0x619000000a80] component: 2 [mjpeg @ 0x619000000a80] marker parser used 5343 bytes (42742 bits) [mjpeg @ 0x619000000a80] marker=d9 avail_size_in_buf=0 [mjpeg @ 0x619000000a80] decode frame unused 0 bytes detected 32 logical cores [Parsed_format_0 @ 0x610000000040] Setting 'pix_fmts' to value 'rgb24' [Parsed_sr_1 @ 0x610000000140] Setting 'dnn_backend' to value 'native' [Parsed_sr_1 @ 0x610000000140] Setting 'model' to value 'crash_dnn_execute_layer_pad_2' [file @ 0x60d000000040] Setting default whitelist 'file,crypto,data' [AVIOContext @ 0x6120000001c0] Statistics: 145 bytes read, 0 seeks [graph 0 input from stream 0:0 @ 0x610000000240] Setting 'video_size' to value '432x173' [graph 0 input from stream 0:0 @ 0x610000000240] Setting 'pix_fmt' to value '14' [graph 0 input from stream 0:0 @ 0x610000000240] Setting 'time_base' to value '1/25' [graph 0 input from stream 0:0 @ 0x610000000240] Setting 'pixel_aspect' to value '96/96' [graph 0 input from stream 0:0 @ 0x610000000240] Setting 'frame_rate' to value '25/1' [graph 0 input from stream 0:0 @ 0x610000000240] w:432 h:173 pixfmt:yuvj444p tb:1/25 fr:25/1 sar:96/96 [format @ 0x610000000440] Setting 'pix_fmts' to value 'yuvj420p|yuvj422p|yuvj444p' [auto_scaler_0 @ 0x610000001d40] Setting 'flags' to value 'bicubic' [auto_scaler_0 @ 0x610000001d40] w:iw h:ih flags:'bicubic' interl:0 [Parsed_format_0 @ 0x610000000040] auto-inserting filter 'auto_scaler_0' between the filter 'graph 0 input from stream 0:0' and the filter 'Parsed_format_0' [auto_scaler_1 @ 0x610000002a40] Setting 'flags' to value 'bicubic' [auto_scaler_1 @ 0x610000002a40] w:iw h:ih flags:'bicubic' interl:0 [Parsed_sr_1 @ 0x610000000140] auto-inserting filter 'auto_scaler_1' between the filter 'Parsed_format_0' and the filter 'Parsed_sr_1' [auto_scaler_2 @ 0x610000003740] Setting 'flags' to value 'bicubic' [auto_scaler_2 @ 0x610000003740] w:iw h:ih flags:'bicubic' interl:0 [format @ 0x610000000440] auto-inserting filter 'auto_scaler_2' between the filter 'Parsed_sr_1' and the filter 'format' [AVFilterGraph @ 0x6090000006e0] query_formats: 5 queried, 1 merged, 3 already done, 0 delayed [auto_scaler_1 @ 0x610000002a40] picking yuv444p out of 6 ref:rgb24 alpha:0 [auto_scaler_2 @ 0x610000003740] picking yuvj444p out of 3 ref:yuv444p alpha:0 [swscaler @ 0x62f000000400] deprecated pixel format used, make sure you did set range correctly [swscaler @ 0x62f000000400] Forcing full internal H chroma due to input having non subsampled chroma [auto_scaler_0 @ 0x610000001d40] w:432 h:173 fmt:yuvj444p sar:96/96 -> w:432 h:173 fmt:rgb24 sar:1/1 flags:0x4 [auto_scaler_1 @ 0x610000002a40] w:432 h:173 fmt:rgb24 sar:1/1 -> w:432 h:173 fmt:yuv444p sar:1/1 flags:0x4 ================================================================= ==95694==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6130000040e0 at pc 0x000001317bb2 bp 0x7fffffff6b00 sp 0x7fffffff6af8 READ of size 4 at 0x6130000040e0 thread T0 #0 0x1317bb1 in dnn_execute_layer_pad /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/libavfilter/dnn/dnn_backend_native_layer_pad.c:84:18 #1 0x130f6ee in ff_dnn_execute_model_native /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/libavfilter/dnn/dnn_backend_native.c:276:9 #2 0xe5a10f in config_props /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/libavfilter/vf_sr.c:133:14 #3 0x6c1d38 in avfilter_config_links /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/libavfilter/avfilter.c:369:28 #4 0x6c08bd in avfilter_config_links /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/libavfilter/avfilter.c:307:24 #5 0x6c08bd in avfilter_config_links /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/libavfilter/avfilter.c:307:24 #6 0x6c08bd in avfilter_config_links /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/libavfilter/avfilter.c:307:24 #7 0x6d1dbc in graph_config_links /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/libavfilter/avfiltergraph.c:261:24 #8 0x6d0bb6 in avfilter_graph_config /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/libavfilter/avfiltergraph.c:1279:16 #9 0x568e88 in configure_filtergraph /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg_filter.c:1106:16 #10 0x5d66a3 in ifilter_send_frame /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:2166:15 #11 0x5d5669 in send_frame_to_filters /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:2247:15 #12 0x5d0f2b in decode_video /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:2446:11 #13 0x59ba41 in process_input_packet /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:2600:19 #14 0x5be936 in process_input /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:4491:5 #15 0x597af6 in transcode_step /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:4611:11 #16 0x590da5 in transcode /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:4665:15 #17 0x58efda in main /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:4866:9 #18 0x7ffff2cb9b96 in __libc_start_main /build/glibc- OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310 #19 0x423839 in _start (/home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/ffmpeg_g+0x423839) 0x6130000040e0 is located 32 bytes to the left of 352-byte region [0x613000004100,0x613000004260) allocated by thread T0 here: #0 0x4e4328 in posix_memalign (/home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/ffmpeg_g+0x4e4328) #1 0x4a3fdb8 in av_malloc /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/libavutil/mem.c:87:9 #2 0x4a40a24 in av_mallocz /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/libavutil/mem.c:241:17 #3 0x6be731 in avfilter_link /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/libavfilter/avfilter.c:156:12 #4 0x564ec6 in configure_output_video_filter /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg_filter.c:542:16 #5 0x563510 in configure_output_filter /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg_filter.c:684:37 #6 0x568dda in configure_filtergraph /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg_filter.c:1103:9 #7 0x5d66a3 in ifilter_send_frame /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:2166:15 #8 0x5d5669 in send_frame_to_filters /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:2247:15 #9 0x5d0f2b in decode_video /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:2446:11 #10 0x59ba41 in process_input_packet /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:2600:19 #11 0x5be936 in process_input /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:4491:5 #12 0x597af6 in transcode_step /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:4611:11 #13 0x590da5 in transcode /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:4665:15 #14 0x58efda in main /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/fftools/ffmpeg.c:4866:9 #15 0x7ffff2cb9b96 in __libc_start_main /build/glibc- OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310 SUMMARY: AddressSanitizer: heap-buffer-overflow /home/cyber/VulnResearch/ffmpeg/clean/13_5_ffmpeg/FFmpeg/libavfilter/dnn/dnn_backend_native_layer_pad.c:84:18 in dnn_execute_layer_pad Shadow bytes around the buggy address: 0x0c267fff87c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c267fff87d0: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa 0x0c267fff87e0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c267fff87f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c267fff8800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c267fff8810: 00 00 00 00 fa fa fa fa fa fa fa fa[fa]fa fa fa 0x0c267fff8820: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c267fff8830: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c267fff8840: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa 0x0c267fff8850: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c267fff8860: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==95694==ABORTING [1] + Done "/usr/bin/gdb" --interpreter=mi --tty=${DbgTerm} 0<"/tmp/Microsoft-MIEngine-In-j4a31k15.558" 1>"/tmp /Microsoft-MIEngine-Out-76pid8cq.9fv" -- Ticket URL: <https://trac.ffmpeg.org/ticket/8717> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 4