April 2023 - FFmpeg-trac - lists.ffmpeg.org

#10320(avutil:new): `av_opt_set_int()` overflow/not-working bug
by FFmpeg 15 Apr '23

15 Apr '23

#10320: `av_opt_set_int()` overflow/not-working bug -------------------------------------+------------------------------------- Reporter: think3r | Type: defect Status: new | Priority: normal Component: avutil | Version: git- Keywords: Integer | master overflow | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- = `av_opt_set_int()` function will overflow/failed when set a large `uint64_t` number * below is the test code from `libavutil/tests/opt.c` : {{{ diff --git a/libavutil/tests/opt.c b/libavutil/tests/opt.c index 5799e45c6a..c950cfab16 100644 --- a/libavutil/tests/opt.c +++ b/libavutil/tests/opt.c @@ -49,6 +49,7 @@ typedef struct TestContext { void *binary2; int binary_size2; int64_t num64; + uint64_t numu64; float flt; double dbl; char *escape; @@ -86,6 +87,7 @@ static const AVOption test_options[]= { {"bin1", "set binary value", OFFSET(binary1), AV_OPT_TYPE_BINARY, { .str=NULL }, 0, 0, 1 }, {"bin2", "set binary value", OFFSET(binary2), AV_OPT_TYPE_BINARY, { .str="" }, 0, 0, 1 }, {"num64", "set num 64bit", OFFSET(num64), AV_OPT_TYPE_INT64, { .i64 = 1 }, 0, 100, 1 }, + {"numu64", "set num u64", OFFSET(numu64), AV_OPT_TYPE_UINT64, { .i64 = 0xb4000078c6bdbb60 }, 0, UINT_MAX, 1 }, {"flt", "set float", OFFSET(flt), AV_OPT_TYPE_FLOAT, { .dbl = 1.0 / 3 }, 0, 100, 1 }, {"dbl", "set double", OFFSET(dbl), AV_OPT_TYPE_DOUBLE, { .dbl = 1.0 / 3 }, 0, 100, 1 }, {"bool1", "set boolean value", OFFSET(bool1), AV_OPT_TYPE_BOOL, { .i64 = -1 }, -1, 1, 1 }, }}} * The error : `Value -5476376628152124416.000000 for parameter 'numu64' out of range [0 - 4.29497e+09]` * Reason : Loss of precision when convert between `int64_t`/`uint64_t` and `double`. Which will happends on : 1. `AVOption.max` and `AVOption.min` 2. `write_number()` in file `libavutil/opt.c` -- Ticket URL: <https://trac.ffmpeg.org/ticket/10320> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 2

Re: [FFmpeg-trac] #1920(avcodec:closed): dts-hd core extraction
by FFmpeg 14 Apr '23

14 Apr '23

#1920: dts-hd core extraction -------------------------------------+----------------------------------- Reporter: Selur | Owner: (none) Type: enhancement | Status: closed Priority: wish | Component: avcodec Version: git-master | Resolution: fixed Keywords: dca | Blocked By: Blocking: | Reproduced by developer: 1 Analyzed by developer: 0 | -------------------------------------+----------------------------------- Comment (by Manwol moon): Fantastic work on this one! [https://www.retainingnanaimo.com/ Retaining Wall Project] -- Ticket URL: <https://trac.ffmpeg.org/ticket/1920#comment:14> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 0

#10318(ffmpeg:new): Null pointer dereference in ffmpeg (avpriv_slicethread_create libavutil/slicethread.c:151)
by FFmpeg 14 Apr '23

14 Apr '23

#10318: Null pointer dereference in ffmpeg (avpriv_slicethread_create libavutil/slicethread.c:151) -------------------------------------+------------------------------------- Reporter: Youngseok | Type: defect Choi | Status: new | Priority: normal Component: ffmpeg | Version: git- Keywords: fuzzing | master SIGSEGV | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- Hi, our fuzzer found a new SEGV bug in ffmpeg. **Command Input** {{{ ffmpeg -lowres 1 -i poc_file -subcmp 41 .mpG }}} poc_file is attached. **Command Output** {{{ ffmpeg version N-110167-g97c95961f0 Copyright (c) 2000-2023 the FFmpeg developers built with gcc 7 (Ubuntu 7.5.0-3ubuntu1~18.04) configuration: --prefix=/home/youngseok/subjects/latest_asan_install/ffmpeg --extra- cflags='-fsanitize=address -g -O0' --extra-cxxflags='-fsanitize=address -g -O0' --extra-ldflags='-fsanitize=address -g -O0' --disable-optimizations --disable-stripping libavutil 58. 5.100 / 58. 5.100 libavcodec 60. 9.100 / 60. 9.100 libavformat 60. 4.101 / 60. 4.101 libavdevice 60. 2.100 / 60. 2.100 libavfilter 9. 5.100 / 9. 5.100 libswscale 7. 2.100 / 7. 2.100 libswresample 4. 11.100 / 4. 11.100 [h263 @ 0x617000000080] Format h263 detected only with low score of 25, misdetection possible! Input #0, h263, from '/home/youngseok/data/230411/asan_inter_30_30_shrink5_1_230308/ffmpeg/1_id:000014/poc_file': Duration: N/A, bitrate: N/A Stream #0:0: Video: h263, yuv420p, 128x96 [SAR 12:11 DAR 16:11], 29.97 fps, 29.97 tbr, 1200k tbn Stream mapping: Stream #0:0 -> #0:0 (h263 (native) -> mpeg1video (native)) Press [q] to stop, [?] for help [h263 @ 0x619000002380] warning: first frame is no keyframe [h263 @ 0x619000002380] run overflow at 4x0 i:0 [h263 @ 0x619000002380] Error at MB: 4 [mpeg1video @ 0x619000003780] too many threads/slices (4), reducing to 3 [mpeg @ 0x617000000b00] VBV buffer size not set, using default size of 230KB If you want the mpeg file to be compliant to some specification Like DVD, VCD or others, make sure you set the correct buffer size Output #0, mpeg, to '.mpG': Metadata: encoder : Lavf60.4.101 Stream #0:0: Video: mpeg1video, yuv420p(progressive), 64x48 [SAR 12:11 DAR 16:11], q=2-31, 200 kb/s, 29.97 fps, 90k tbn Metadata: encoder : Lavc60.9.100 mpeg1video Side data: cpb: bitrate max/min/avg: 0/0/200000 buffer size: 0 vbv_delay: N/A [h263 @ 0x619000002380] Reverting picture dimensions change due to header decoding failured=N/A [h263 @ 0x619000002380] header damaged Error while decoding stream #0:0: Invalid data found when processing input [h263 @ 0x619000002380] warning: first frame is no keyframe [h263 @ 0x619000002380] run overflow at 3x0 i:0 [h263 @ 0x619000002380] Error at MB: 3 internal error in cmp function selection }}} **Stack Trace** (Asan) {{{ ==17389==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000000000 bp 0x7fffe94eda30 sp 0x7fffe94ed8d8 T18) ==17389==Hint: pc points to the zero page. ==17389==The signal is caused by a READ memory access. ==17389==Hint: address points to the zero page. AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV (<unknown module>) Thread T18 created by T0 here: #0 0x7ffff6e4fd2f in __interceptor_pthread_create (/usr/lib/x86_64 -linux-gnu/libasan.so.4+0x37d2f) #1 0x555558d989bf in avpriv_slicethread_create libavutil/slicethread.c:151 #2 0x55555762a527 in ff_slice_thread_init libavcodec/pthread_slice.c:164 #3 0x555557620b2f in ff_thread_init libavcodec/pthread.c:76 #4 0x555556b4b1f4 in avcodec_open2 libavcodec/avcodec.c:309 #5 0x555555b10810 in init_output_stream fftools/ffmpeg.c:3238 #6 0x555555af527c in init_output_stream_wrapper fftools/ffmpeg.c:739 #7 0x555555afab20 in do_video_out fftools/ffmpeg.c:1270 #8 0x555555afc9d6 in reap_filters fftools/ffmpeg.c:1431 #9 0x555555b1887c in transcode_step fftools/ffmpeg.c:4007 #10 0x555555b18a9e in transcode fftools/ffmpeg.c:4044 #11 0x555555b196f8 in main fftools/ffmpeg.c:4182 #12 0x7ffff5601c86 in __libc_start_main (/lib/x86_64-linux- gnu/libc.so.6+0x21c86) }}} **Environment** Built with address sanitizer. {{{ ffmpeg version N-110167-g97c95961f0 Copyright (c) 2000-2023 the FFmpeg developers built with gcc 7 (Ubuntu 7.5.0-3ubuntu1~18.04) configuration: --prefix=/home/youngseok/subjects/latest_asan_install/ffmpeg --extra- cflags='-fsanitize=address -g -O0' --extra-cxxflags='-fsanitize=address -g -O0' --extra-ldflags='-fsanitize=address -g -O0' --disable-optimizations --disable-stripping }}} -- Ticket URL: <https://trac.ffmpeg.org/ticket/10318> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 2

#10306(undetermined:new): Segmentation Violation (cmp_inline in libavcodec/motion_est.c:219)
by FFmpeg 14 Apr '23

14 Apr '23

#10306: Segmentation Violation (cmp_inline in libavcodec/motion_est.c:219) -------------------------------------+------------------------------------- Reporter: Youngseok | Type: defect Choi | Status: new | Priority: normal Component: | Version: git- undetermined | master Keywords: fuzzing, | Blocked By: SIGSEGV | Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- Hello, our fuzzer found a new SEGV bug in FFmpeg. **Command Input** {{{ ffmpeg -i poc_file -subcmp 41 .mpG }}} poc_file is attached. **Command Output** {{{ ffmpeg version N-110167-g97c95961f0 Copyright (c) 2000-2023 the FFmpeg developers built with gcc 7 (Ubuntu 7.5.0-3ubuntu1~18.04) configuration: --prefix=/home/youngseok/subjects/latest_asan_install/ffmpeg --extra- cflags='-fsanitize=address -g -O0' --extra-cxxflags='-fsanitize=address -g -O0' --extra-ldflags='-fsanitize=address -g -O0' --disable-optimizations --disable-stripping libavutil 58. 5.100 / 58. 5.100 libavcodec 60. 9.100 / 60. 9.100 libavformat 60. 4.101 / 60. 4.101 libavdevice 60. 2.100 / 60. 2.100 libavfilter 9. 5.100 / 9. 5.100 libswscale 7. 2.100 / 7. 2.100 libswresample 4. 11.100 / 4. 11.100 [h263 @ 0x617000000080] Format h263 detected only with low score of 25, misdetection possible! Input #0, h263, from '/home/youngseok/data/230327/asan_inter_30_30_shrink5_1_230308/ffmpeg/1_id:000014/poc_file': Duration: N/A, bitrate: N/A Stream #0:0: Video: h263, yuv420p, 128x96 [SAR 12:11 DAR 16:11], 29.97 fps, 29.97 tbr, 1200k tbn Stream mapping: Stream #0:0 -> #0:0 (h263 (native) -> mpeg1video (native)) Press [q] to stop, [?] for help [New Thread 0x7ffff1cff700 (LWP 28631)] [h263 @ 0x619000002380] warning: first frame is no keyframe [h263 @ 0x619000002380] run overflow at 4x0 i:0 [h263 @ 0x619000002380] Error at MB: 4 [h263 @ 0x619000002380] concealing 48 DC, 48 AC, 48 MV errors in P frame /home/youngseok/data/230327/asan_inter_30_30_shrink5_1_230308/ffmpeg/1_id:000014/poc_file: corrupt decoded frame in stream 0 [New Thread 0x7ffff14fe700 (LWP 28632)] [New Thread 0x7ffff0cfd700 (LWP 28633)] [New Thread 0x7ffff04fc700 (LWP 28634)] [New Thread 0x7fffefcfb700 (LWP 28635)] [New Thread 0x7fffef4fa700 (LWP 28636)] [New Thread 0x7fffeecf9700 (LWP 28637)] [New Thread 0x7fffee4f8700 (LWP 28638)] [New Thread 0x7fffedcf7700 (LWP 28639)] [New Thread 0x7fffed4f6700 (LWP 28640)] [New Thread 0x7fffeccf5700 (LWP 28641)] [New Thread 0x7fffec4f4700 (LWP 28642)] [New Thread 0x7fffebcf3700 (LWP 28643)] [New Thread 0x7fffeb4f2700 (LWP 28644)] [New Thread 0x7fffeacf1700 (LWP 28645)] [New Thread 0x7fffea4f0700 (LWP 28646)] [New Thread 0x7fffe9cef700 (LWP 28647)] [New Thread 0x7fffe94ee700 (LWP 28648)] [New Thread 0x7fffe8ced700 (LWP 28649)] [New Thread 0x7fffe84ec700 (LWP 28650)] [New Thread 0x7fffe7ceb700 (LWP 28651)] [New Thread 0x7fffe74ea700 (LWP 28652)] [mpeg1video @ 0x619000003780] too many threads/slices (7), reducing to 6 [mpeg @ 0x617000000b00] VBV buffer size not set, using default size of 230KB If you want the mpeg file to be compliant to some specification Like DVD, VCD or others, make sure you set the correct buffer size Output #0, mpeg, to '.mpG': Metadata: encoder : Lavf60.4.101 Stream #0:0: Video: mpeg1video, yuv420p(progressive), 128x96 [SAR 12:11 DAR 16:11], q=2-31, 200 kb/s, 29.97 fps, 90k tbn Metadata: encoder : Lavc60.9.100 mpeg1video Side data: cpb: bitrate max/min/avg: 0/0/200000 buffer size: 0 vbv_delay: N/A [New Thread 0x7fffe6ce9700 (LWP 28653)] [h263 @ 0x619000002380] Reverting picture dimensions change due to header decoding failured=N/A [h263 @ 0x619000002380] header damaged Error while decoding stream #0:0: Invalid data found when processing input [Thread 0x7ffff1cff700 (LWP 28631) exited] [h263 @ 0x619000002380] warning: first frame is no keyframe [h263 @ 0x619000002380] run overflow at 3x0 i:0 [h263 @ 0x619000002380] Error at MB: 3 [h263 @ 0x619000002380] concealing 99 DC, 99 AC, 99 MV errors in P frame /home/youngseok/data/230327/asan_inter_30_30_shrink5_1_230308/ffmpeg/1_id:000014/poc_file: corrupt decoded frame in stream 0 [Thread 0x7fffec4f4700 (LWP 28642) exited] [Thread 0x7fffea4f0700 (LWP 28646) exited] [Thread 0x7fffeacf1700 (LWP 28645) exited] [Thread 0x7fffeb4f2700 (LWP 28644) exited] [Thread 0x7fffeccf5700 (LWP 28641) exited] [Thread 0x7fffed4f6700 (LWP 28640) exited] [Thread 0x7fffebcf3700 (LWP 28643) exited] [Thread 0x7fffedcf7700 (LWP 28639) exited] [Thread 0x7fffee4f8700 (LWP 28638) exited] [Thread 0x7fffeecf9700 (LWP 28637) exited] [Thread 0x7fffef4fa700 (LWP 28636) exited] [Thread 0x7fffefcfb700 (LWP 28635) exited] [Thread 0x7ffff04fc700 (LWP 28634) exited] [Thread 0x7ffff0cfd700 (LWP 28633) exited] [Thread 0x7ffff14fe700 (LWP 28632) exited] [New Thread 0x7fffea4f0700 (LWP 28654)] [New Thread 0x7fffeacf1700 (LWP 28655)] [New Thread 0x7fffeb4f2700 (LWP 28656)] [New Thread 0x7fffebcf3700 (LWP 28657)] [New Thread 0x7ffff14fe700 (LWP 28658)] [New Thread 0x7ffff0cfd700 (LWP 28659)] [New Thread 0x7ffff04fc700 (LWP 28660)] [New Thread 0x7fffefcfb700 (LWP 28661)] [New Thread 0x7fffef4fa700 (LWP 28662)] [New Thread 0x7fffeecf9700 (LWP 28663)] [New Thread 0x7fffee4f8700 (LWP 28664)] [New Thread 0x7fffedcf7700 (LWP 28665)] [New Thread 0x7fffed4f6700 (LWP 28666)] [New Thread 0x7fffeccf5700 (LWP 28667)] [New Thread 0x7fffec4f4700 (LWP 28668)] [New Thread 0x7fffe64e8700 (LWP 28669)] [New Thread 0x7fffe5ce7700 (LWP 28670)] [New Thread 0x7fffe54e6700 (LWP 28671)] [New Thread 0x7fffe4ce5700 (LWP 28672)] [New Thread 0x7fffe44e4700 (LWP 28673)] [New Thread 0x7fffe3ce3700 (LWP 28674)] [New Thread 0x7fffe34e2700 (LWP 28675)] [New Thread 0x7fffe2ce1700 (LWP 28676)] [New Thread 0x7fffe24e0700 (LWP 28677)] [New Thread 0x7fffe1cdf700 (LWP 28678)] [New Thread 0x7fffe14de700 (LWP 28679)] [New Thread 0x7fffe0cdd700 (LWP 28680)] [New Thread 0x7fffe04dc700 (LWP 28681)] [New Thread 0x7fffdfcdb700 (LWP 28682)] [New Thread 0x7fffdf4da700 (LWP 28683)] internal error in cmp function selection Last message repeated 11 times Thread 1 "ffmpeg_g" received signal SIGSEGV, Segmentation fault. 0x0000000000000000 in ?? () }}} **Stack Trace** {{{ #0 0x0000000000000000 in ?? () #1 0x00005555586b70f1 in cmp_inline (chroma=0, qpel=0, chroma_cmp_func=0x0, cmp_func=0x0, src_index=0, ref_index=0, h=16, size=0, suby=0, subx=0, y=0, x=0, s=0x62500000c900) at libavcodec/motion_est.c:219 #2 cmp_internal (s=0x62500000c900, x=0, y=0, subx=0, suby=0, size=0, h=16, ref_index=0, src_index=0, cmp_func=0x0, chroma_cmp_func=0x0, flags=0) at libavcodec/motion_est.c:255 #3 0x00005555586bc096 in cmp (flags=0, chroma_cmp_func=0x0, cmp_func=0x0, src_index=0, ref_index=0, h=16, size=0, suby=<optimized out>, subx=<optimized out>, y=0, x=0, s=0x62500000c900) at libavcodec/motion_est.c:273 #4 hpel_motion_search (s=0x62500000c900, mx_ptr=0x7fffffffcc70, my_ptr=0x7fffffffccb0, dmin=0, src_index=0, ref_index=0, size=0, h=16) at libavcodec/motion_est_template.c:77 #5 0x00005555586f1c51 in ff_estimate_p_frame_motion (s=0x62500000c900, mb_x=0, mb_y=3) at libavcodec/motion_est.c:1005 #6 0x00005555574a5fe7 in estimate_motion_thread (c=0x619000003780, arg=0x6250000053f0) at libavcodec/mpegvideo_enc.c:2721 #7 0x0000555557629a3d in worker_func (priv=0x619000003780, jobnr=3, threadnr=3, nb_jobs=6, nb_threads=6) at libavcodec/pthread_slice.c:77 #8 0x0000555558d98052 in run_jobs (ctx=0x611000001800) at libavutil/slicethread.c:65 #9 0x0000555558d99142 in avpriv_slicethread_execute (ctx=0x611000001800, nb_jobs=6, execute_main=0) at libavutil/slicethread.c:192 #10 0x0000555557629f40 in thread_execute (avctx=0x619000003780, func=0x5555574a5ac7 <estimate_motion_thread>, arg=0x6250000053d8, ret=0x0, job_count=6, job_size=8) at libavcodec/pthread_slice.c:115 #11 0x00005555574c3382 in encode_picture (s=0x625000005100) at libavcodec/mpegvideo_enc.c:3640 #12 0x0000555557490be9 in ff_mpv_encode_picture (avctx=0x619000003780, pkt=0x610000001d40, pic_arg=0x616000011480, got_packet=0x7fffffffd2e0) at libavcodec/mpegvideo_enc.c:1801 #13 0x0000555556e51a6f in ff_encode_encode_cb (avctx=0x619000003780, avpkt=0x610000001d40, frame=0x616000011480, got_packet=0x7fffffffd2e0) at libavcodec/encode.c:223 #14 0x0000555556e525ec in encode_simple_internal (avctx=0x619000003780, avpkt=0x610000001d40) at libavcodec/encode.c:309 #15 0x0000555556e52735 in encode_simple_receive_packet (avctx=0x619000003780, avpkt=0x610000001d40) at libavcodec/encode.c:323 #16 0x0000555556e52c72 in encode_receive_packet_internal (avctx=0x619000003780, avpkt=0x610000001d40) at libavcodec/encode.c:357 #17 0x0000555556e537e9 in avcodec_send_frame (avctx=0x619000003780, frame=0x616000008d80) at libavcodec/encode.c:506 #18 0x0000555555af7261 in encode_frame (of=0x611000000900, ost=0x618000000080, frame=0x616000008d80) at fftools/ffmpeg.c:904 #19 0x0000555555af871e in submit_encode_frame (of=0x611000000900, ost=0x618000000080, frame=0x616000008d80) at fftools/ffmpeg.c:985 #20 0x0000555555afbd7c in do_video_out (of=0x611000000900, ost=0x618000000080, next_picture=0x616000008d80) at fftools/ffmpeg.c:1345 #21 0x0000555555afc9d7 in reap_filters (flush=0) at fftools/ffmpeg.c:1431 #22 0x0000555555b1887d in transcode_step () at fftools/ffmpeg.c:4007 #23 0x0000555555b18a9f in transcode () at fftools/ffmpeg.c:4044 #24 0x0000555555b196f9 in main (argc=6, argv=0x7fffffffe008) at fftools/ffmpeg.c:4182 }}} **Assembler code around pc** gdb didn't produced it. I think PC is located in wrong position. {{{ Dump of assembler code from 0xffffffffffffffe0 to 0x20: End of assembler dump. }}} **Register Info** {{{ rax 0x0 0 rbx 0x7fffffffcd70 140737488342384 rcx 0x100 256 rdx 0x62d000018410 108645492818960 rsi 0x62d000022420 108645492859936 rdi 0x62500000c900 108095736957184 rbp 0x7fffffffca00 0x7fffffffca00 rsp 0x7fffffffc8a8 0x7fffffffc8a8 r8 0x10 16 r9 0x62d000018410 108645492818960 r10 0x616000018680 107064944854656 r11 0x246 582 r12 0xffffffff98a 17592186042762 r13 0x7fffffffcc50 140737488342096 r14 0x7fffffffd2c0 140737488343744 r15 0x7fffffffcc50 140737488342096 rip 0x0 0x0 eflags 0x10246 [ PF ZF IF RF ] cs 0x33 51 ss 0x2b 43 ds 0x0 0 es 0x0 0 fs 0x0 0 gs 0x0 0 st0 -nan(0xffffffffffff00ff) (raw 0xffffffffffffffff00ff) st1 -nan(0xffffffffffffffff) (raw 0xffffffffffffffffffff) st2 <invalid float value> (raw 0xffff0000000000000000) st3 <invalid float value> (raw 0xffff0000000000000000) st4 <invalid float value> (raw 0xffff00000000000000ff) st5 <invalid float value> (raw 0xffff0000000000000000) st6 <invalid float value> (raw 0xffff0002000200020002) st7 <invalid float value> (raw 0xffff0001000100010001) fctrl 0x37f 895 fstat 0x0 0 ftag 0xffff 65535 fiseg 0x0 0 fioff 0x0 0 foseg 0x0 0 fooff 0x0 0 fop 0x0 0 mxcsr 0x1fa8 [ OE PE IM DM ZM OM UM PM ] ymm0 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}} ymm1 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}} ymm2 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}} ymm3 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}} ymm4 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}} ymm5 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x10 <repeats 16 times>, 0x0 <repeats 16 times>}, v16_int16 = {0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v8_int32 = {0x10101010, 0x10101010, 0x10101010, 0x10101010, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x1010101010101010, 0x1010101010101010, 0x0, 0x0}, v2_int128 = {0x10101010101010101010101010101010, 0x0}} ymm6 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x10 <repeats 16 times>, 0x0 <repeats 16 times>}, v16_int16 = {0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v8_int32 = {0x10101010, 0x10101010, 0x10101010, 0x10101010, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x1010101010101010, 0x1010101010101010, 0x0, 0x0}, v2_int128 = {0x10101010101010101010101010101010, 0x0}} ymm7 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}} ymm8 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}} ymm9 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x80, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x80, 0x0 <repeats 19 times>}, v16_int16 = {0x80, 0x0, 0x80, 0x0, 0x80, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v8_int32 = {0x80, 0x80, 0x80, 0x80, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x8000000080, 0x8000000080, 0x0, 0x0}, v2_int128 = { 0x80000000800000008000000080, 0x0}} ymm10 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x80 <repeats 16 times>, 0x0 <repeats 16 times>}, v16_int16 = {0x8080, 0x8080, 0x8080, 0x8080, 0x8080, 0x8080, 0x8080, 0x8080, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v8_int32 = {0x80808080, 0x80808080, 0x80808080, 0x80808080, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x8080808080808080, 0x8080808080808080, 0x0, 0x0}, v2_int128 = {0x80808080808080808080808080808080, 0x0}} ymm11 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x80, 0x0, 0x80, 0x0, 0x80, 0x0, 0x80, 0x0, 0x80, 0x0, 0x80, 0x0, 0x80, 0x0, 0x80, 0x0 <repeats 17 times>}, v16_int16 = {0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v8_int32 = {0x800080, 0x800080, 0x800080, 0x800080, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x80008000800080, 0x80008000800080, 0x0, 0x0}, v2_int128 = {0x800080008000800080008000800080, 0x0}} ymm12 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x80 <repeats 16 times>, 0x0 <repeats 16 times>}, v16_int16 = {0x8080, 0x8080, 0x8080, 0x8080, 0x8080, 0x8080, 0x8080, 0x8080, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v8_int32 = {0x80808080, 0x80808080, 0x80808080, 0x80808080, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x8080808080808080, 0x8080808080808080, 0x0, 0x0}, v2_int128 = {0x80808080808080808080808080808080, 0x0}} ymm13 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x80 <repeats 16 times>, 0x0 <repeats 16 times>}, v16_int16 = {0x8080, 0x8080, 0x8080, 0x8080, 0x8080, 0x8080, 0x8080, 0x8080, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v8_int32 = {0x80808080, 0x80808080, 0x80808080, 0x80808080, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x8080808080808080, 0x8080808080808080, 0x0, 0x0}, v2_int128 = {0x80808080808080808080808080808080, 0x0}} ymm14 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}} ymm15 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0, 0x4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x4, 0x0 <repeats 18 times>}, v16_int16 = {0x400, 0x0, 0x400, 0x0, 0x400, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v8_int32 = {0x400, 0x400, 0x400, 0x400, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x40000000400, 0x40000000400, 0x0, 0x0}, v2_int128 = { 0x400000004000000040000000400, 0x0}} }}} **Environment** Built with address sanitizer. {{{ ffmpeg version N-110167-g97c95961f0 Copyright (c) 2000-2023 the FFmpeg developers built with gcc 7 (Ubuntu 7.5.0-3ubuntu1~18.04) configuration: --prefix=/home/youngseok/subjects/latest_asan_install/ffmpeg --extra- cflags='-fsanitize=address -g -O0' --extra-cxxflags='-fsanitize=address -g -O0' --extra-ldflags='-fsanitize=address -g -O0' --disable-optimizations --disable-stripping }}} -- Ticket URL: <https://trac.ffmpeg.org/ticket/10306> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 2

#10317(ffmpeg:new): Segmentation violation in ffmpeg (lame_window_init libavcodec/aacpsy.c:270)
by FFmpeg 14 Apr '23

14 Apr '23

#10317: Segmentation violation in ffmpeg (lame_window_init libavcodec/aacpsy.c:270) -------------------------------------+------------------------------------- Reporter: Youngseok | Type: defect Choi | Status: new | Priority: normal Component: ffmpeg | Version: git- Keywords: fuzzing, | master SIGSEGV | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- Hi, our fuzzer found a new SEGV bug in ffmpeg. **Command Input** {{{ ffmpeg -i poc_file -q 8M .mpd }}} poc_file is attached! **Command Output** {{{ ffmpeg version N-110167-g97c95961f0 Copyright (c) 2000-2023 the FFmpeg developers built with gcc 7 (Ubuntu 7.5.0-3ubuntu1~18.04) configuration: --prefix=/home/youngseok/subjects/latest_asan_install/ffmpeg --extra- cflags='-fsanitize=address -g -O0' --extra-cxxflags='-fsanitize=address -g -O0' --extra-ldflags='-fsanitize=address -g -O0' --disable-optimizations --disable-stripping libavutil 58. 5.100 / 58. 5.100 libavcodec 60. 9.100 / 60. 9.100 libavformat 60. 4.101 / 60. 4.101 libavdevice 60. 2.100 / 60. 2.100 libavfilter 9. 5.100 / 9. 5.100 libswscale 7. 2.100 / 7. 2.100 libswresample 4. 11.100 / 4. 11.100 [ea_cdata @ 0x617000000080] Format ea_cdata detected only with low score of 12, misdetection possible! [aist#0:0/adpcm_ea_xas @ 0x616000000980] Guessed Channel Layout: stereo Input #0, ea_cdata, from '/home/youngseok/data/230411/asan_inter_30_30_shrink5_1_230308/ffmpeg/1_id:000033/poc_file': Duration: N/A, start: 0.000000, bitrate: N/A Stream #0:0: Audio: adpcm_ea_xas, 108 Hz, 2 channels, s16p Stream mapping: Stream #0:0 -> #0:0 (adpcm_ea_xas (native) -> aac (native)) Press [q] to stop, [?] for help [ea_cdata @ 0x617000000080] Packet corrupt (stream = 0, dts = NOPTS). [in#0/ea_cdata @ 0x612000000040] corrupt input packet in stream 0 [aac @ 0x619000001e80] Too many bits 17832.925170 > 12288 per frame requested, clamping to max }}} **Stack Trace** (Asan) {{{ ==14366==ERROR: AddressSanitizer: SEGV on unknown address 0x55555d125164 (pc 0x55555883bf4a bp 0x7fffffffd150 sp 0x7fffffffd130 T0) ==14366==The signal is caused by a READ memory access. #0 0x55555883bf49 in lame_window_init libavcodec/aacpsy.c:270 #1 0x55555883db76 in psy_3gpp_init libavcodec/aacpsy.c:379 #2 0x555558731ce5 in ff_psy_init libavcodec/psymodel.c:69 #3 0x555558183116 in aac_encode_init libavcodec/aacenc.c:1365 #4 0x555556b4b313 in avcodec_open2 libavcodec/avcodec.c:322 #5 0x555555b10810 in init_output_stream fftools/ffmpeg.c:3238 #6 0x555555af527c in init_output_stream_wrapper fftools/ffmpeg.c:739 #7 0x555555afc26f in reap_filters fftools/ffmpeg.c:1391 #8 0x555555b1887c in transcode_step fftools/ffmpeg.c:4007 #9 0x555555b18a9e in transcode fftools/ffmpeg.c:4044 #10 0x555555b196f8 in main fftools/ffmpeg.c:4182 #11 0x7ffff5601c86 in __libc_start_main (/lib/x86_64-linux- gnu/libc.so.6+0x21c86) #12 0x555555a84499 in _start (/home/youngseok/subjects/latest_asan_install/ffmpeg/bin/ffmpeg+0x530499) }}} **Environment** Built with address sanitizer. {{{ ffmpeg version N-110167-g97c95961f0 Copyright (c) 2000-2023 the FFmpeg developers built with gcc 7 (Ubuntu 7.5.0-3ubuntu1~18.04) configuration: --prefix=/home/youngseok/subjects/latest_asan_install/ffmpeg --extra- cflags='-fsanitize=address -g -O0' --extra-cxxflags='-fsanitize=address -g -O0' --extra-ldflags='-fsanitize=address -g -O0' --disable-optimizations --disable-stripping }}} -- Ticket URL: <https://trac.ffmpeg.org/ticket/10317> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 2

#10304(ffmpeg:new): Segmentation Violation in ffmpeg (libavformat/concat.c:142 in concat_read)
by FFmpeg 14 Apr '23

14 Apr '23

#10304: Segmentation Violation in ffmpeg (libavformat/concat.c:142 in concat_read) -------------------------------------+------------------------------------- Reporter: Youngseok | Type: defect Choi | Status: new | Priority: normal Component: ffmpeg | Version: git- | master Keywords: fuzzing | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- Hi, our fuzzer found a new SEGV in ffmpeg. **Command to Reproduce** {{{ ffmpeg -i concatf:concatf:poc_file }}} poc_file is attached. **Backtrace** (Address Sanitizer) {{{ ==5776==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x555556a5ba8f bp 0x7fffffffc300 sp 0x7fffffffc2c0 T0) ==5776==The signal is caused by a READ memory access. ==5776==Hint: address points to the zero page. #0 0x555556a5ba8e in concat_read libavformat/concat.c:142 #1 0x555556554f31 in retry_transfer_wrapper libavformat/avio.c:370 #2 0x555556555163 in ffurl_read libavformat/avio.c:405 #3 0x55555655a09f in read_packet_wrapper libavformat/aviobuf.c:525 #4 0x55555655a785 in fill_buffer libavformat/aviobuf.c:569 #5 0x55555655b25a in avio_read libavformat/aviobuf.c:664 #6 0x55555655fbba in avio_read_to_bprint libavformat/aviobuf.c:1352 #7 0x555556a5c340 in concatf_open libavformat/concat.c:236 #8 0x555556553dc0 in ffurl_connect libavformat/avio.c:209 #9 0x555556554e2d in ffurl_open_whitelist libavformat/avio.c:347 #10 0x55555655ef0a in ffio_open_whitelist libavformat/aviobuf.c:1230 #11 0x5555568b6280 in io_open_default libavformat/options.c:151 #12 0x5555565aae95 in init_input libavformat/demux.c:174 #13 0x5555565ab937 in avformat_open_input libavformat/demux.c:254 #14 0x555555a95532 in ifile_open fftools/ffmpeg_demux.c:1051 #15 0x555555adb403 in open_files fftools/ffmpeg_opt.c:1244 #16 0x555555adb778 in ffmpeg_parse_options fftools/ffmpeg_opt.c:1283 #17 0x555555b195ba in main fftools/ffmpeg.c:4165 #18 0x7ffff5601c86 in __libc_start_main (/lib/x86_64-linux- gnu/libc.so.6+0x21c86) #19 0x555555a84499 in _start (/home/youngseok/subjects/latest_asan_sources/ffmpeg/ffmpeg_g+0x530499) }}} **Assembler code around pc** (gdb) {{{ Dump of assembler code from 0x555556a5ba6f to 0x555556a5baaf: 0x0000555556a5ba6f <concat_read+191>: mov %rax,%rdx 0x0000555556a5ba72 <concat_read+194>: mov %rdx,%rcx 0x0000555556a5ba75 <concat_read+197>: shr $0x3,%rcx 0x0000555556a5ba79 <concat_read+201>: add $0x7fff8000,%rcx 0x0000555556a5ba80 <concat_read+208>: movzbl (%rcx),%ecx 0x0000555556a5ba83 <concat_read+211>: test %cl,%cl 0x0000555556a5ba85 <concat_read+213>: je 0x555556a5ba8f <concat_read+223> 0x0000555556a5ba87 <concat_read+215>: mov %rdx,%rdi 0x0000555556a5ba8a <concat_read+218>: callq 0x555555a83ea0 <__asan_report_load8@plt> => 0x0000555556a5ba8f <concat_read+223>: mov (%rax),%rax 0x0000555556a5ba92 <concat_read+226>: mov -0x34(%rbp),%edx 0x0000555556a5ba95 <concat_read+229>: mov -0x30(%rbp),%rcx 0x0000555556a5ba99 <concat_read+233>: mov %rcx,%rsi 0x0000555556a5ba9c <concat_read+236>: mov %rax,%rdi 0x0000555556a5ba9f <concat_read+239>: callq 0x55555655509c <ffurl_read> 0x0000555556a5baa4 <concat_read+244>: mov %eax,-0x20(%rbp) 0x0000555556a5baa7 <concat_read+247>: cmpl $0xdfb9b0bb,-0x20(%rbp) 0x0000555556a5baae <concat_read+254>: jne 0x555556a5bb4a <concat_read+410> }}} **Registers Info** {{{ rax 0x0 0 rbx 0x7fffffffc3f0 140737488339952 rcx 0x0 0 rdx 0x0 0 rsi 0x62d00000a400 108645492761600 rdi 0x612000000640 106790066849344 rbp 0x7fffffffc250 0x7fffffffc250 rsp 0x7fffffffc210 0x7fffffffc210 r8 0x0 0 r9 0x0 0 r10 0x7fffffffbe38 140737488338488 r11 0x0 0 r12 0xffffffff87e 17592186042494 r13 0x7fffffffc850 140737488341072 r14 0x7fffffffc3f0 140737488339952 r15 0x7fffffffd490 140737488344208 rip 0x555556a5ba8f 0x555556a5ba8f <concat_read+223> eflags 0x10246 [ PF ZF IF RF ] cs 0x33 51 ss 0x2b 43 ds 0x0 0 es 0x0 0 fs 0x0 0 gs 0x0 0 st0 0 (raw 0x00000000000000000000) st1 0 (raw 0x00000000000000000000) st2 0 (raw 0x00000000000000000000) st3 0 (raw 0x00000000000000000000) st4 0 (raw 0x00000000000000000000) st5 0 (raw 0x00000000000000000000) st6 0 (raw 0x00000000000000000000) st7 0 (raw 0x00000000000000000000) fctrl 0xffff 65535 fstat 0xffff 65535 ftag 0xaaaa 43690 fiseg 0x1 1 fioff 0x0 0 foseg 0x5555 21845 fooff 0xa 10 fop 0x7ff 2047 mxcsr 0x1f80 [ IM DM ZM OM UM PM ] ymm0 {v8_float = {0xffffffff, 0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x7fffffffffffffff, 0x0, 0x0}, v32_int8 = { 0x63, 0x6f, 0x6e, 0x63, 0x61, 0x74, 0x66, 0x2c, 0x63, 0x6f, 0x6e, 0x63, 0x61, 0x74, 0x2c, 0x66, 0x0 <repeats 16 times>}, v16_int16 = {0x6f63, 0x636e, 0x7461, 0x2c66, 0x6f63, 0x636e, 0x7461, 0x662c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v8_int32 = {0x636e6f63, 0x2c667461, 0x636e6f63, 0x662c7461, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x2c667461636e6f63, 0x662c7461636e6f63, 0x0, 0x0}, v2_int128 = {0x662c7461636e6f632c667461636e6f63, 0x0}} ymm1 {v8_float = {0xffffffff, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x61, 0x74, 0x2c, 0x66, 0x69, 0x6c, 0x65, 0x2c, 0x73, 0x75, 0x62, 0x66, 0x69, 0x6c, 0x65, 0x0 <repeats 17 times>}, v16_int16 = {0x7461, 0x662c, 0x6c69, 0x2c65, 0x7573, 0x6662, 0x6c69, 0x65, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v8_int32 = {0x662c7461, 0x2c656c69, 0x66627573, 0x656c69, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x2c656c69662c7461, 0x656c6966627573, 0x0, 0x0}, v2_int128 = {0x656c69666275732c656c69662c7461, 0x0}} ymm2 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x0, 0x0, 0xff, 0xff, 0xff, 0x0, 0xff, 0xff, 0x0 <repeats 17 times>}, v16_int16 = {0xff00, 0xffff, 0xffff, 0xff, 0xff00, 0xffff, 0xff00, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v8_int32 = {0xffffff00, 0xffffff, 0xffffff00, 0xffff00, 0x0, 0x0, 0x0, 0x0}, v4_int64 = { 0xffffffffffff00, 0xffff00ffffff00, 0x0, 0x0}, v2_int128 = {0xffff00ffffff0000ffffffffffff00, 0x0}} ---Type <return> to continue, or q <return> to quit--- ymm3 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0, 0xff, 0x0 <repeats 30 times>}, v16_int16 = {0xff00, 0x0 <repeats 15 times>}, v8_int32 = {0xff00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0xff00, 0x0, 0x0, 0x0}, v2_int128 = {0xff00, 0x0}} ymm4 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}} ymm5 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}} ymm6 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}} ymm7 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}} ymm8 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0xd0, 0x23, 0xfd, 0xf7, 0xff, 0x7f, 0x0, 0x0, 0xc0, 0x28, 0xfd, 0xf7, 0xff, 0x7f, 0x0 <repeats 18 times>}, v16_int16 = {0x23d0, 0xf7fd, 0x7fff, 0x0, 0x28c0, 0xf7fd, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v8_int32 = {0xf7fd23d0, 0x7fff, 0xf7fd28c0, 0x7fff, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x7ffff7fd23d0, 0x7ffff7fd28c0, 0x0, 0x0}, v2_int128 = {0x7ffff7fd28c000007ffff7fd23d0, 0x0}} ymm9 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}} ymm10 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}} ymm11 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}} ymm12 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}} ymm13 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}} ymm14 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}} ymm15 {v8_float = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_double = {0x0, 0x0, 0x0, 0x0}, v32_int8 = {0x0 <repeats 32 times>}, v16_int16 = {0x0 <repeats 16 times>}, v8_int32 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, v4_int64 = {0x0, 0x0, 0x0, 0x0}, v2_int128 = {0x0, 0x0}} }}} **Environment** Built with address sanitizer. {{{ ffmpeg version N-110167-g97c95961f0 Copyright (c) 2000-2023 the FFmpeg developers built with gcc 7 (Ubuntu 7.5.0-3ubuntu1~18.04) configuration: --prefix=/home/youngseok/subjects/latest_asan_install/ffmpeg --extra- cflags='-fsanitize=address -g -O0' --extra-cxxflags='-fsanitize=address -g -O0' --extra-ldflags='-fsanitize=address -g -O0' --disable-optimizations --disable-stripping }}} -- Ticket URL: <https://trac.ffmpeg.org/ticket/10304> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 3

Re: [FFmpeg-trac] #2776(avformat:closed): MXF DV from AAF (Avid) not demuxable
by FFmpeg 12 Apr '23

12 Apr '23

#2776: MXF DV from AAF (Avid) not demuxable -------------------------------------+------------------------------------- Reporter: Ignasi Rius | Owner: (none) Type: defect | Status: closed Priority: important | Component: avformat Version: git-master | Resolution: fixed Keywords: mxf dvvideo | Blocked By: regression | Blocking: | Reproduced by developer: 1 Analyzed by developer: 0 | -------------------------------------+------------------------------------- Comment (by Manwol moon): Thanks for uploading the samples. Cheers, Manwol - [https://www.nanaimoretainingwalls.com/ Retaining Wall Project] -- Ticket URL: <https://trac.ffmpeg.org/ticket/2776#comment:8> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 0

#10316(undetermined:new): FFV1 seems badly broken
by FFmpeg 12 Apr '23

12 Apr '23

#10316: FFV1 seems badly broken -------------------------------------+------------------------------------- Reporter: Andrew | Type: defect Status: new | Priority: normal Component: | Version: undetermined | unspecified Keywords: ffv1, | Blocked By: lossless | Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- Summary of the bug: Trying to use FFV1 as a lossless codec for no-recoding stream-copy work, or any other purpose, seems pointless. Blues and reds are getting mulched. How to reproduce: I've created a simple color bars diagnostic image. By doing quick encodes to four different "lossless" codecs it is very obvious that ffv1 is not working correctly. {{{ ffmpeg -framerate 60 -loop 1 -i colorbar.png -t 10.0 -c:v ffv1 -pix_fmt yuv444p test-ffv1.mkv ffmpeg -framerate 60 -loop 1 -i colorbar.png -t 10.0 -c:v h264 -crf 0 -pix_fmt yuv444p test-h264-lossless.mkv ffmpeg -framerate 60 -loop 1 -i colorbar.png -t 10.0 -c:v hevc -x265-params lossless=1 -pix_fmt yuv444p test-h265-lossless.mkv ffmpeg -framerate 60 -loop 1 -i colorbar.png -t 10.0 -c:v vp9 -lossless 1 -row-mt 1 -pix_fmt yuv444p test-vp9-lossless.mkv ffmpeg version 2023-04-10-git-b18a9c2971-full_build-www.gyan.dev Copyright (c) 2000-2023 the FFmpeg developers built with gcc 12.2.0 (Rev10, Built by MSYS2 project) configuration: --enable-gpl --enable-version3 --enable-static --disable- w32threads --disable-autodetect --enable-fontconfig --enable-iconv --enable-gnutls --enable-libxml2 --enable-gmp --enable-bzlib --enable-lzma --enable-libsnappy --enable-zlib --enable-librist --enable-libsrt --enable-libssh --enable-libzmq --enable-avisynth --enable-libbluray --enable-libcaca --enable-sdl2 --enable-libaribb24 --enable-libdav1d --enable-libdavs2 --enable-libuavs3d --enable-libzvbi --enable-librav1e --enable-libsvtav1 --enable-libwebp --enable-libx264 --enable-libx265 --enable-libxavs2 --enable-libxvid --enable-libaom --enable-libjxl --enable-libopenjpeg --enable-libvpx --enable-mediafoundation --enable- libass --enable-frei0r --enable-libfreetype --enable-libfribidi --enable- liblensfun --enable-libvidstab --enable-libvmaf --enable-libzimg --enable- amf --enable-cuda-llvm --enable-cuvid --enable-ffnvcodec --enable-nvdec --enable-nvenc --enable-d3d11va --enable-dxva2 --enable-libvpl --enable- libshaderc --enable-vulkan --enable-libplacebo --enable-opencl --enable- libcdio --enable-libgme --enable-libmodplug --enable-libopenmpt --enable- libopencore-amrwb --enable-libmp3lame --enable-libshine --enable-libtheora --enable-libtwolame --enable-libvo-amrwbenc --enable-libcodec2 --enable- libilbc --enable-libgsm --enable-libopencore-amrnb --enable-libopus --enable-libspeex --enable-libvorbis --enable-ladspa --enable-libbs2b --enable-libflite --enable-libmysofa --enable-librubberband --enable- libsoxr --enable-chromaprint libavutil 58. 6.100 / 58. 6.100 libavcodec 60. 9.100 / 60. 9.100 libavformat 60. 4.101 / 60. 4.101 libavdevice 60. 2.100 / 60. 2.100 libavfilter 9. 5.100 / 9. 5.100 libswscale 7. 2.100 / 7. 2.100 libswresample 4. 11.100 / 4. 11.100 libpostproc 57. 2.100 / 57. 2.100 }}} -- Ticket URL: <https://trac.ffmpeg.org/ticket/10316> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 6

#10299(avutil:new): avutil should link with libandroid.so when mediacodec enabled on android
by FFmpeg 11 Apr '23

11 Apr '23

#10299: avutil should link with libandroid.so when mediacodec enabled on android ----------------------------------+-------------------------------------- Reporter: chinshou | Type: defect Status: new | Priority: normal Component: avutil | Version: git-master Keywords: | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | ----------------------------------+-------------------------------------- Summary of the Bug: The issue was caused by a specific commit with SHA-1 value 2697f23f4e866a81ddcfca0c99a56ed14f93dc07. * avutil/hwcontext_mediacodec: add ANativeWindow support In this commit, avutil was modified to include support for ANativeWindow, but the configure script did not include the necessary link option (-landroid) to locate the ANativeWindow_release API that exists in libandroid.so. As a result, when attempting to dlopen libavutil.so on Android, dlerror reported an error indicating that the ANativeWindow_release symbol could not be located. To fix the problem, the link option -landroid was hardcoded into the Makefile under the libavutil folder. However, a more appropriate solution would be to fix the configure script, although this may require expertise with autotools scripting that I am not familiar with. -- Ticket URL: <https://trac.ffmpeg.org/ticket/10299> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 5

#10259(avcodec:new): Some Scanity 10-bit monochrome DPX are rejected
by FFmpeg 08 Apr '23

08 Apr '23

#10259: Some Scanity 10-bit monochrome DPX are rejected -------------------------------------+------------------------------------- Reporter: Jérôme | Type: defect Martinez | Status: new | Priority: normal Component: avcodec | Version: git- | master Keywords: dpx scanity | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- The DPX related code has a check which does not compute correctly the minimum file size in case of (out ouf specs) Scanity 10-bit monochrome DPX. {{{ ./ffmpeg -i y10bit_scanity_realsize_zeroed.dpx a%06d.png ffmpeg version N-110014-ga6e9d01f88 Copyright (c) 2000-2023 the FFmpeg developers built with gcc 9 (Ubuntu 9.4.0-1ubuntu1~20.04.1) configuration: libavutil 58. 3.100 / 58. 3.100 libavcodec 60. 6.101 / 60. 6.101 libavformat 60. 4.100 / 60. 4.100 libavdevice 60. 2.100 / 60. 2.100 libavfilter 9. 4.100 / 9. 4.100 libswscale 7. 2.100 / 7. 2.100 libswresample 4. 11.100 / 4. 11.100 [dpx @ 0x7fffce94ce80] Cannot map DPX color specification 1 to colorspace. [dpx @ 0x7fffce94ce80] Overread buffer. Invalid header? [dpx_pipe @ 0x7fffce94b5c0] Could not find codec parameters for stream 0 (Video: dpx, none, 2150x1820 [SAR 1:1 DAR 215:182]): unspecified pixel format Consider increasing the value for the 'analyzeduration' (0) and 'probesize' (5000000) options Input #0, dpx_pipe, from 'y10bit_scanity_realsize_zeroed.dpx': Duration: N/A, bitrate: N/A Stream #0:0: Video: dpx, none, 2150x1820 [SAR 1:1 DAR 215:182], 25 fps, 25 tbr, 25 tbn Stream mapping: Stream #0:0 -> #0:0 (dpx (native) -> png (native)) Press [q] to stop, [?] for help [dpx @ 0x7fffce952500] Cannot map DPX color specification 1 to colorspace. [dpx @ 0x7fffce952500] Overread buffer. Invalid header? Error while decoding stream #0:0: Invalid data found when processing input Cannot determine format of input stream 0:0 after EOF Error marking filters as finished Conversion failed! ls -l y10bit_scanity_realsize_zeroed.dpx -rwxrwxrwx 1 jerome jerome 5283840 Mar 14 10:58 y10bit_scanity_realsize_zeroed.dpx }}} zeroed file attached (the file size is the one from the hardware, not modified). -- Ticket URL: <https://trac.ffmpeg.org/ticket/10259> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker

1 3