Compare commits

...

926 Commits

Author SHA1 Message Date
Andreas Rheinhardt d91b3a16b5 swscale/x86/yuv2rgb_template: Add emms to MMX(EXT) functions
Fixes issue #22333.
Note: These functions have been removed in commit
61e851381f, so the issue
only affects releases 7.0 and older.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 5e6c584b98cea9b9d78b037728b915887758666d)
2026-03-05 14:59:24 +01:00
Michael Niedermayer 257ab5a6ac swscale/output: Fix integer overflow in yuv2ya16_X_c_template()
Found-by: colod colod <colodcolod7@gmail.com>

Fixes: CVE-2025-63757

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0c6b7f9483)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ac4caa33bae5841649c61d4f8a0608dfa59c4fa1)
Signed-off-by: Carlos Henrique Lima Melara <charlesmelara@riseup.net>
2026-01-02 21:58:51 +00:00
Jiasheng Jiang 58882aa298 libavfilter/af_firequalizer: Add check for av_malloc_array()
Add check for the return value of av_malloc_array() to avoid potential NULL pointer dereference.

Fixes: CVE-2025-10256

Fixes: d3be186ed1 ("avfilter/firequalizer: add dumpfile and dumpscale option")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a25462482c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 00b5af29a4203a31574c11b3df892d78d5d862ec)
Signed-off-by: Carlos Henrique Lima Melara <charlesmelara@riseup.net>
2026-01-02 21:58:51 +00:00
Michael Niedermayer be1665dbec avcodec/jpeg2000dec: Make sure the 4 extra bytes allocated are initialized
Fixes: use of uninitialized memory
Fixes: 429130590/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_DEC_fuzzer-5736930522497024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d6fe3786cd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 39f4a60035)
Signed-off-by: Carlos Henrique Lima Melara <charlesmelara@riseup.net>
2026-01-02 21:58:51 +00:00
Michael Niedermayer a7f6ee19a8 avcodec/jpeg2000dec: implement cdef remapping during pixel format matching
Fixes: out of array access
Fixes: poc.jp2

Fixes: CVE-2025-9951

Found-by: Andy Nguyen <theflow@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 01a292c7e3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eb80096cbe)
Signed-off-by: Carlos Henrique Lima Melara <charlesmelara@riseup.net>
2026-01-02 21:58:51 +00:00
Michael Niedermayer 6dc71760d2 avcodec/jpeg2000dec: move cdef default check into get_siz()
This way cdef is at its final value earlier

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 104d6846c1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit de97cc3892)
Signed-off-by: Carlos Henrique Lima Melara <charlesmelara@riseup.net>
2026-01-02 21:58:51 +00:00
Jiasheng Jiang 01d5c40143 libavcodec/alsdec.c: Add check for av_malloc_array() and av_calloc()
Add check for the return value of av_malloc_array() and av_calloc()
to avoid potential NULL pointer dereference.

Backport comment: In v5.1 and newer, av_calloc is used, but in v4.3 we
had av_mallocz_array, but it's susceptible to ENOMEM just the same.

Fixes: CVE-2025-7700

Fixes: dcfd24b10c ("avcodec/alsdec: Implement floating point sample data decoding")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 35a6de137a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aad4b59cfee1f0a3cf02f5e2b1f291ce013bf27e)
Signed-off-by: Carlos Henrique Lima Melara <charlesmelara@riseup.net>
2026-01-02 21:58:51 +00:00
Lynne 0ef8ce13b8 aacenc_tns: clamp filter direction energy measurement
The issue is that:

float en[2];
...
tns->n_filt[w] = is8 ? 1 : order != TNS_MAX_ORDER ? 2 : 3;
for (g = 0; g < tns->n_filt[w]; g++) {
    tns->direction[w][g] = slant != 2 ? slant : en[g] < en[!g];

When using the AAC Main profile, n_filt = 3, and slant is by
default 2 (normal long frames), g can go above 1.

en is the evolution of energy in the frequency domain for every
band at the given window. E.g. whether the energy is concentrated
at the top of each band, or the bottom.

For 2-pole filters, its straightforward.
For 3-pole filters, we need more than 2 measurements.

This commit properly implements support for 3-pole filters, by measuring
the band energy across three areas.

Do note that even xHE-AAC caps n_filt to 2, and only AAC Main allows
n_filt == 3.

Fixes https://trac.ffmpeg.org/ticket/11418

Fixes: CVE-2025-1594

(cherry picked from commit ed09aa28ae3b4509f00a24a9ebdeb084ee00736a)
(cherry picked from commit f98f142da571653436596ccad2d09c7e39bfd4fb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 21fe514152)
Signed-off-by: Carlos Henrique Lima Melara <charlesmelara@riseup.net>
2026-01-02 21:58:51 +00:00
Haihao Xiang 2d32a6611a lavc/vp9: Fix regression introduced in 0ba05857
It is possible that ff_progress_frame_await() is called but
ff_progress_frame_report() isn't called when a hardware acceleration
method is used, so a thread for vp9 decoding might get stuck.

Backport comment: in 7.1 there was a switch to ProgressFrames
(7bd3b73716), so there was the need to convert the calls back to
ThreadFrames calls. In this case, it was just moving the progress
report function inside the finish label.

Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Signed-off-by: Haihao Xiang <haihao.xiang@intel.com>
(cherry picked from commit 8c62d77139)
Signed-off-by: Carlos Henrique Lima Melara <charlesmelara@riseup.net>
2026-01-02 21:58:51 +00:00
Andreas Rheinhardt 415ed8bb09 avcodec/vp9: Fix race when attaching side-data for show-existing frame
When outputting a show-existing frame, the VP9 decoder simply
created a reference to said frame and returned it immediately to
the caller, without waiting for it to have finished decoding.
In case of frame-threading it is possible for the frame to
only be decoded while it was waiting to be output.
This is normally benign.

But there is one case where it is not: If the user wants
video encoding parameters to be exported, said side data
will only be attached to the src AVFrame at the end of
decoding the frame that is actually being shown. Without
synchronisation adding said side data in the decoder thread
and the reads in av_frame_ref() in the output thread
constitute a data race. This happens e.g. when using the
venc_data_dump tool with vp90-2-10-show-existing-frame.webm
from the FATE-suite.

Fix this by actually waiting for the frame to be output.

Backport comment: in 7.1 there was a switch to ProgressFrames
(7bd3b73716), so there was the need to convert the calls back to
ThreadFrames calls.

Fixes: CVE-2024-36615

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 0ba058579f)
Signed-off-by: Carlos Henrique Lima Melara <charlesmelara@riseup.net>
2026-01-02 21:58:51 +00:00
Marton Balint a3acba8949 avformat/hls: check return value of new_init_section()
Fixes part of ticket #8931.

Fixes: CVE-2023-6603

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit 28c83584e8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e3e479d077)
Signed-off-by: Carlos Henrique Lima Melara <charlesmelara@riseup.net>
2026-01-02 21:58:51 +00:00
Andreas Rheinhardt 55774a0f19 avcodec/aarch64/idct: Add missing stddef
Fixes checkheaders on aarch64.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 52e9113695)
2026-01-02 18:03:05 +01:00
James Almer c1a2e08c73 avcodec/Makefile: add vaapi_hevc.h to the SKIPHEADERS list
Fixes make checkheaders when vaapi is disabled

Signed-off-by: James Almer <jamrial@gmail.com>
2026-01-02 18:03:05 +01:00
Timo Rothenpieler 93d70c41e3 tools/check_arm_indent: skip empty glob 2026-01-02 18:03:05 +01:00
Timo Rothenpieler a778fe8fe4 all: apply linter fixes 2026-01-02 18:03:05 +01:00
Timo Rothenpieler 37403e0aee forgejo: backport CI job names 2026-01-02 18:03:05 +01:00
Timo Rothenpieler 02e9b60b66 forgejo: apply needed CI changes for 4.3 2026-01-02 00:46:03 +01:00
Timo Rothenpieler b6bf959e12 forgejo: backport CI to release/4.3 2026-01-01 22:21:23 +01:00
James Almer e1f5d0ff91 avcodec/x86/pngdsp: add missing emms at the end of add_png_paeth_prediction
Fixes unpredictable behavior with floats.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 57a29f2e7d)
2025-09-15 23:48:35 -03:00
Michael Niedermayer fe01189b0a Update for 4.3.9
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-03-11 19:12:05 +01:00
Lynne db25eb352a configure: update copyright year
On 01/01/2025 19:05, Peter Ross wrote:
> FFmpeg turns 25 this year.

(cherry picked from commit d3aa99a4f4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-03-03 01:17:24 +01:00
softworkz 69a6974116 avformat/hls: Partially revert "reduce default max reload to 3"
(setting to 100 as a reasonable compromise)

The change has caused regressions for many users and consumers.
Playlist reloads only happen when a playlist doesn't indicate that it
has ended (via #EXT-X-ENDLIST), which means that the addition of future
segments is still expected.
It is well possible that an HLS server is temporarily unable to serve
further segments but resumes after some time, either indicating a
discontinuity or even by fully catching up.
With a segment length of 3s, a max_reload value of 1000 corresponds to
a duration of 50 minutes which appears to be a reasonable default.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ace9f03a6c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-03-01 03:22:50 +01:00
Michael Niedermayer 5a020f8690 avformat/hls: Fix twitter
Allow mp4 with all mpegts extensions

Fixes: Ticket11435
Reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cef3422b48)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:26 +01:00
Michael Niedermayer ffbb1058b7 libavformat/hls: Be more restrictive on mpegts extensions
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0113e30806)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:26 +01:00
Michael Niedermayer 71274326b1 avformat/hls: .ts is always ok even if its a mov/mp4
Maybe fixes: 11435

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9e12572933)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:26 +01:00
Michael Niedermayer 486e46719e avformat/hls: Print input format in error message
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d845533130)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:25 +01:00
Michael Niedermayer c32e89653a avformat/hls: Be more picky on extensions
This blocks disallowed extensions from probing
It also requires all available segments to have matching extensions to the format
mpegts is treated independent of the extension

It is recommended to set the whitelists correctly
instead of depending on extensions, but this should help a bit,
and this is easier to backport

Fixes: CVE-2023-6602 II. HLS Force TTY Demuxer
Fixes: CVE-2023-6602 IV. HLS XBIN Demuxer DoS Amplification

The other parts of CVE-2023-6602 have been fixed by prior commits

Found-by: Harvey Phillips of Amazon Element55 (element55)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 91d96dc8dd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:25 +01:00
Michael Niedermayer 7acd31d09a avformat: add ff_match_url_ext()
Match url against a list of extensions similar to av_match_ext()

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a7b06bfc5d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:25 +01:00
Cosmin Stejerean 23afb77b8e avfilter/bwdif: account for chroma sub-sampling in min size calculation
The current logic for detecting frames that are too small for the
algorithm does not account for chroma sub-sampling, and so a sample
where the luma plane is large enough, but the chroma planes are not
will not be rejected. In that event, a heap overflow will occur.

This change adjusts the logic to consider the chroma planes and makes
the change to all three bwdif implementations.

Fixes #10688

Signed-off-by: Cosmin Stejerean <cosmin@cosmin.at>
Reviewed-by: Thomas Mundt <tmundt75@gmail.com>
Signed-off-by: Philip Langdale <philipl@overt.org>
(cherry picked from commit 737ede405b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:24 +01:00
Michael Niedermayer 80ebfdb7ca avformat/iff: Check that we have a stream in read_dst_frame()
Fixes: null pointer dereference
Fixes: 385644864/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4551049565765632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8668957ef6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:24 +01:00
Michael Niedermayer e134cf5798 avformat/mlvdec: fix size checks
Fixes: heap-buffer-overflow
Fixes: 391962476/clusterfuzz-testcase-minimized-ffmpeg_dem_MLV_fuzzer-5746746587676672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 251d43aef0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:24 +01:00
Michael Niedermayer 3c61273c8f avformat/mxfdec: Check edit unit for overflow in mxf_set_current_edit_unit()
Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'long'
Fixes: 392672068/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6232335892152320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8a6ad9eab2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:23 +01:00
Michael Niedermayer fb358672d9 avcodec/h263dec: Check against previous dimensions instead of coded
Fixes: out of array access
Fixes: crash-a41ef3db699013f669b076f02f36942925f5a98c

Found-by: Kacper Michajlow <kasper93@gmail.com>
Reviewed-by: Kacper Michajlow <kasper93@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0fe33c99a2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:23 +01:00
Michael Niedermayer e91a7c9ca6 avformat/mxfdec: Check avio_read() success in mxf_decrypt_triplet()
Fixes: Use of uninitialized memory
Fixes: 71444/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5448597561212928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6ecc96f4d0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:23 +01:00
Michael Niedermayer d2c9b04388 avcodec/huffyuvdec: Initialize whole output for decode_gray_bitstream()
Fixes: use of uninitialized memory
Fixes: 375286238/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-6352546854141952

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ef71552cf9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:22 +01:00
Michael Niedermayer 08d94cbe2b avformat/ipmovie: Check signature_buffer read
Fixes: use of uninitilaized data
Fixes: 385167047/clusterfuzz-testcase-minimized-ffmpeg_dem_IPMOVIE_fuzzer-5941477505564672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 788abe0d25)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:22 +01:00
Michael Niedermayer af336762bd avformat/wtvdec: Initialize buf
ff_parse_mpeg2_descriptor() reads over what is initialized
Fixes: use of uninitialized memory
Fixes: 383825645/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5144130618982400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 17b019c517)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:21 +01:00
Michael Niedermayer 2f80158781 avcodec/cbs_vp9: Initialize VP9RawSuperframeIndex
Fixes: use-of-uninitialized-value
Fixes: 70907/clusterfuzz-testcase-minimized-ffmpeg_BSF_VP9_METADATA_fuzzer-6339363208757248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e81d410242)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:21 +01:00
Michael Niedermayer 3a12fc4309 avformat/vqf: Propagate errors from add_metadata()
Suggested-by: Marton Balint <cus@passwd.hu>
Reviewed-by: Alexander Strasser <eclipse7@gmx.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 49fa3f6c5b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:21 +01:00
Michael Niedermayer 48118f2fae avformat/vqf: Check avio_read() in add_metadata()
Fixes: use of uninitialized data
Fixes: 383825642/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5380168801124352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c43dbecbda)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:20 +01:00
Michael Niedermayer 9e7278e832 avformat/dashdec: Check whitelist
Fixes: CVE-2023-6602, V. DASH Playlist SSRF

Found-by: Harvey Phillips of Amazon Element55 (element55)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4c96d6bf75)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:20 +01:00
Michael Niedermayer 1ca62c1718 avutil/avstring: dont mess with NULL pointers in av_match_list()
Fixes: applying zero offset to null pointer

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c6c54943d1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:20 +01:00
Michael Niedermayer 43b8852feb avcodec/mpegvideo_enc: Check FLV1 resolution limits
Found-by: Elias Myllymäki <elias.myllymaki04p@gmail.com>
Reviewed-by: Alexander Strasser <eclipse7@gmx.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 827c073154)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:19 +01:00
Michael Niedermayer f5d8b82891 avcodec/ffv1enc: Fix handling of 32bit unsigned symbols
This may be needed for floats

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Alexander Strasser <eclipse7@gmx.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 402824e9e9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:19 +01:00
Michael Niedermayer 719ebc4adb avcodec/vc1dec: Clear block_index in vc1_decode_reset()
Fixes: 377965565/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-4504434689769472
Fixes: out of array access

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 251de1791e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:19 +01:00
Michael Niedermayer 34eb233f07 avcodec/aacsbr_template: Clear n_q on error
Fixes: index 5 out of bounds for type 'uint8_t [5]'
Fixes: 377748135/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5167109774049280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3f029bfb7f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:18 +01:00
Michael Niedermayer dda63e60a0 swscale/output: Fix undefined overflow in yuv2rgba64_full_X_c_template()
Fixes: signed integer overflow: -1082982400 + -1195645138 cannot be represented in type 'int'
Fixes: 376136843/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-4791844321427456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 56faee21c1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:18 +01:00
Michael Niedermayer 72c82bbb9f avfilter/af_pan: Fix sscanf() use
Fixes: Memory Data Leak

Found-by: Simcha Kosman <simcha.kosman@cyberark.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b5b6391d64)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:18 +01:00
Michael Niedermayer afc97bddb6 avfilter/vf_addroi: Add missing NULL termination to addroi_var_names[]()
Fixes: out of array read

Found-by: Elias Myllymäki <elias.myllymaki04p@gmail.com>
Reviewed-by: Alexander Strasser <eclipse7@gmx.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b72de49295)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:17 +01:00
Michael Niedermayer a8ea6f8465 avformat/rmdec: check that buf if completely filled
Fixes: use of uninitialized value
Fixes: 70988/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5298245077630976

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9578c135d0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:17 +01:00
Michael Niedermayer ef2e5030a9 avcodec/hapdec: Clear tex buffer
The code following makes no attempt to initialize all of the buffer

Fixes: use of uninitialized value
Fixes: 70980/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5329909059223552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7eeeda703b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:17 +01:00
Michael Niedermayer 9762ef37a5 avformat/mxfdec: Check that key was read sucessfull
Fixes: use of uninitialized value
Fixes: 70932/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4870202133643264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4c62cbcae2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:16 +01:00
Michael Niedermayer efe13fd99c avformat/rpl: Fix check for negative values
Fixes: signed integer overflow: 10 * -1923267925333400000 cannot be represented in type 'int64_t' (aka 'long')
Fixes: 378891963/clusterfuzz-testcase-minimized-fuzzer_loadfile_direct-5714338935013376
Found-by: ossfuzz
Reported-by: Kacper Michajlow <kasper93@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eab65379bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:16 +01:00
Michael Niedermayer 1c4667297c avformat/mlvdec: Check avio_read()
Fixes: use-of-uninitialized-value
Fixes: 383170476/clusterfuzz-testcase-minimized-ffmpeg_dem_MLV_fuzzer-4696002884337664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bb85423142)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:16 +01:00
Michael Niedermayer a0ec70455c avcodec/utils: Fix block align overflow for ADPCM_IMA_WAV
Fixes: signed integer overflow: 529008646 * 8 cannot be represented in type 'int'
Fixes: 383379145/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6674045107503104

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9327093079)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:15 +01:00
Michael Niedermayer 6ad3e87a87 avformat/matroskadec: Check pre_ns for overflow
Fixes: signed integer overflow: -3483479120376300096 - 7442323944145700864 cannot be represented in type 'long'
Fixes: 383187489/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4561470580391936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 361d24e6d9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:15 +01:00
Michael Niedermayer daa0d94cf9 avcodec/webp: Check ref_x/y
Fixes: 70991/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WEBP_fuzzer-5544067620995072
Fixes: use of uninintailized value

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7c1e732ad2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:15 +01:00
Michael Niedermayer 421207a390 avcodec/ilbcdec: Initialize tempbuff2
Fixes: Use of uninitialized value
Fixes: 71350/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ILBC_fuzzer-6322020827070464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4482218440)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:14 +01:00
Michael Niedermayer 3ce439f5fe avformat/dxa: check bpc
Fixes: integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 373971762/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-4880491112103936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7e020f2141)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:14 +01:00
Michael Niedermayer 9fbcecf435 swscale/slice: clear allocated memory in alloc_lines()
Fixes: use of uninitialized memory in hScale16To15_c()
Fixes: 373924007/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5841199968092160

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aeec39f3c1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:14 +01:00
Michael Niedermayer d8778cbccd avformat/icodec: fix integer overflow with nb_pal
Fixes: runtime error: signed integer overflow
Fixes: 42536949/clusterfuzz-testcase-minimized-fuzzer_loadfile-6199846684393472
Found-by: ossfuzz
Reported-by: Kacper Michajlow
Tested-by: Kacper Michajlow
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 84569b6c22)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:13 +01:00
Michael Niedermayer ac8fda6566 doc/developer: Document relationship between git accounts and MAINTAINERS
This should have been documented long ago and i thought it was

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7051825b01)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:13 +01:00
Michael Niedermayer 33a45199aa avformat/vividas: Check avio_read() for failure
Fixes: use of uninitialized value (untested)
Fixes: 42537627/clusterfuzz-testcase-minimized-fuzzer_loadfile_direct-5505802505355264

Found-by: ossfuzz
Reported-by: Kacper Michajlow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 96d45c3b21)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:13 +01:00
Michael Niedermayer 503a3e4c38 avformat/ilbc: Check avio_read() for failure
Fixes: use of uninitialized value
Fixes: 42537627/clusterfuzz-testcase-minimized-fuzzer_protocol_memory-6656646223298560-cut

Found-by: ossfuzz
Reported-by: Kacper Michajlow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e30d957a9b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:12 +01:00
Michael Niedermayer affeb1dde1 avformat/nistspheredec: Clear buffer
Fixes: use-of-uninitialized-value
Fixes: 42537627/clusterfuzz-testcase-minimized-fuzzer_protocol_memory-6515855798632448-cut

Found-by: ossfuzz
Reported-by: Kacper Michajlow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 898f6582eb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:12 +01:00
Michael Niedermayer 334d24b539 INSTALL: explain the circular dependency issue and solution
Sponsored-by: Sovereign Tech Fund
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit df00705e00)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:12 +01:00
Michael Niedermayer b612d3634c avformat/mpegts: Initialize predefined_SLConfigDescriptor_seen
Fixes: use of uninitialized variable
Fixes: 368729566/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTS_fuzzer-6044501804646400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit db7b4fc89f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:11 +01:00
Michael Niedermayer 6c14d8e338 avformat/mxfdec: Fix overflow in midpoint computation
Fixes: signed integer overflow: 4611686016549392399 + 9223372033098784800 cannot be represented in type 'long long'
Fixes: 368503277/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5928227458056192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 23088a5ff2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:11 +01:00
Michael Niedermayer 9bef02015e swscale/output: used unsigned for bit accumulation
Fixes: Integer overflow
Fixes: 368725672/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5009093023563776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3fe3014405)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:11 +01:00
Michael Niedermayer d1ea5ab824 avcodec/rangecoder: only perform renorm check/loop for callers that need it
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d147b3d7ec)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:10 +01:00
Michael Niedermayer e958e49b31 avcodec/ffv1dec: Fix end computation with ec=2
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 10e5af15bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:10 +01:00
Michael Niedermayer a24784d504 avcodec/ffv1enc: Prevent generation of files with broken slices
Fixes: Ticket5548

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b7ff66a358)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:10 +01:00
Michael Niedermayer 71885a72b6 avformat/matroskadec: Check desc_bytes so bits fit in 64bit
Likely a tighter check can be done

Fixes: signed integer overflow: 3305606804154370442 * 8 cannot be represented in type 'long'
Fixes: 70449/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4771166007918592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c4122406f6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:09 +01:00
Michael Niedermayer 736791b4e2 avcodec/ffv1enc: Correct error message about unsupported version
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 556c767786)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:09 +01:00
Michael Niedermayer c02c96b93d avcodec/ffv1enc: Slice combination is unsupported
We always write minimal slices, the size calculation is wrong in some
corner cases but as its always 1x1 (minus1) we can for now just hard-code it

This helps with ticket 5548

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7d514655bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:09 +01:00
Michael Niedermayer 50a5c2f75d avcodec/ffv1enc: 2Pass mode is not possible with golomb coding
"Fixes" Ticket7063

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 417b163c00)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:08 +01:00
Michael Niedermayer 95b2b8393d avcodec/ffv1enc: Fix >8bit context size
Fixes: Ticket5405

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a9c83e43f2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:08 +01:00
Michael Niedermayer 3c005e89b2 avcodec/xan: Add basic input size check
Fixes: Timeout
Fixes: 71739/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XAN_WC3_fuzzer-6170301405134848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpe
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 56bef2fd58)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:07 +01:00
Michael Niedermayer ab42cdfd0e avcodec/svq3: Check for minimum size input
Fixes: Timeout
Fixes: 71295/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-4999941125111808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 050b5e85cb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:07 +01:00
Michael Niedermayer 8d3f10011d avcodec/eacmv: Check input size for intra frames
Fixes: Timeout
Fixes: 71135/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EACMV_fuzzer-6251879028293632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c3a1cbbf5d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:07 +01:00
Michael Niedermayer a51d618e8b avcodec/jfdctint_template: use unsigned z* in row_fdct()
Fixes: signed integer overflow: 856827136 + 2123580416 cannot be represented in type 'int'
Fixes: 70772/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PRORES_KS_fuzzer-5180569961431040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f27c8b04d3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:06 +01:00
Michael Niedermayer 8bc1b2ee5d avformat/mxfdec: Check timecode for overflow
Fixes: signed integer overflow: 9223372036840103968 + 538976288 cannot be represented in type 'long'
Fixes: 70604/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4844090340999168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6be3786c82)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:06 +01:00
Michael Niedermayer 9912935062 avformat/mxfdec: More offset_temp checks
Fixes: signed integer overflow: 9223372036854775807 - -1927491430256034080 cannot be represented in type 'long'
Fixes: 70607/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5282235077951488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5a96aa435a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:06 +01:00
Michael Niedermayer 795cec23b2 swscale/output: Fix undefined integer overflow in yuv2rgba64_2_c_template()
Fixes: signed integer overflow: -1082982400 + -1083218484 cannot be represented in type 'int'
Fixes: 70657/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-6707819712675840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bd80c97391)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:05 +01:00
Michael Niedermayer f0442346e6 swscale/swscale: Use unsigned operation to avoid undefined behavior
I have not checked that the constant is correct, this just fixes the undefined behavior

Fixes: signed integer overflow: -646656 * 3517 cannot be represented in type 'int
Fixes: 70559/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5209368631508992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 44c5641ae8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:05 +01:00
Michael Niedermayer dfdb353fff avcodec/vc2enc: basic sanity check on slice_max_bytes
Fixes: left shift of 896021632 by 3 places cannot be represented in type 'int'
Fixes: 70544/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC2_fuzzer-6685593652756480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6df9a0292c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:05 +01:00
Michael Niedermayer d0a7da4874 avformat/mvdec: Check if name was fully read
Fixes: use of uninitialized value
Fixes: 70901/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-6341913949569024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4e39795c75)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:04 +01:00
Michael Niedermayer 5a6bfec33d avcodec/wmavoice: Do not use uninitialized pitch[0]
Fixes: use of uninitialized value
Fixes: 70850/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-4806127362048000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5338707930)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:04 +01:00
Michael Niedermayer 4c9978124d avcodec/notchlc: Check bytes left before reading
Fixes: Use of uninitialized value
Fixes: 71230/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-4624502095413248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b9c7f50c7d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:04 +01:00
Michael Niedermayer a0e85cda1d avcodec/vc1_block: propagate error codes
Fixes: use of uninitialized value
Fixes: 71228/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-6188476880453632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 01910ca603)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:03 +01:00
Michael Niedermayer c84b693703 avformat/apetag: Check APETAGEX
Fixes: Use of uninitialized value
Fixes: 71074/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5697034877730816

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 796ff2d599)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:03 +01:00
Michael Niedermayer c5b3a3f969 avcodec/avcodec: Warn about data returned from get_buffer*()
Text based on suggestion by: epirat07@gmail.com
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 93444c46fce195e378c4ebb1a20ea662e7f0123b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:03 +01:00
Michael Niedermayer 985ee23665 avcodec/aic: Clear slice_data
Fixes: use-of-uninitialized-value
Fixes: 70865/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AIC_fuzzer-4874102695854080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit de3f6c8888)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:02 +01:00
Michael Niedermayer 9b7d4ad167 avcodec/vc1dec: Clear mb_type_base and ttblk_base
Fixes: two use-of-uninitialized-value
Fixes: 70856/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5539349918187520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 50471f96c4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:02 +01:00
Michael Niedermayer a3431f279e avcodec/shorten: clear padding
Fixes: use-of-uninitialized-value
Fixes: 70854/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5533480570650624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e44349ee88)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:02 +01:00
Michael Niedermayer c9a2d48c2e avformat/mpeg: Check an avio_read() for failure
Fixes: use-of-uninitialized-value
Fixes: 70849/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGPS_fuzzer-4684401009557504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 66ee75d76c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:01 +01:00
Michael Niedermayer 4eceda7528 avcodec/mvha: Clear remaining space after inflate()
Fixes: use-of-uninitialized-value
Fixes: 70838/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MVHA_fuzzer-4878509466517504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cba4e2e40d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:01 +01:00
Michael Niedermayer 0e4eaa307f avformat/segafilm: Set keyframe
Fixes: use of uninitialized value
Fixes: 70871/clusterfuzz-testcase-minimized-ffmpeg_dem_SEGAFILM_fuzzer-5883617752973312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4dc7dfe65a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:01 +01:00
Michael Niedermayer e102dfd331 avcodec/dxva2: initialize hr in ff_dxva2_common_end_frame()
Related: CID1591924 Uninitialized scalar variable
Related: CID1591938 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1d6a2aebae)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:00 +01:00
Michael Niedermayer e6a6343976 avcodec/dxva2: initialize validate
Related: CID1591915 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2232c4cc8c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:00 +01:00
Michael Niedermayer cb57b8352d avcodec/dxva2: Initialize ConfigBitstreamRaw
Related: CID1591894 Uninitialized scalar variable
Related: CID1591906 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 489c05b9c3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:53:00 +01:00
Michael Niedermayer 5b82c7c04c avcodec/dxva2: Initialize dxva_size and check it
Related: CID1591878 Uninitialized scalar variable
Related: CID1591928 Uninitialized pointer read

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c8c59e9929)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:52:59 +01:00
Michael Niedermayer a24f1e1f7a avfilter/vf_xfade: Compute w2, h2 with float
Fixes: CID1458148 Result is not floating-point
Fixes: CID1458149 Result is not floating-point
Fixes: CID1458150 Result is not floating-point
Fixes: CID1458151 Result is not floating-point
Fixes: CID1458152 Result is not floating-point
Fixes: CID1458154 Result is not floating-point
Fixes: CID1458155 Result is not floating-point
Fixes: CID1458156 Result is not floating-point

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b98125e5a5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:52:59 +01:00
Michael Niedermayer 072d22d402 avfilter/vf_v360: Assert that vf was initialized
Maybe helps: CID1504571 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f802d65de0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:52:59 +01:00
Michael Niedermayer 156ed79d28 avfilter/vf_tonemap_opencl: Dereference after NULL check
Fixes: CID1437472 Dereference before null check

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e5c0f56ca0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:52:58 +01:00
Michael Niedermayer 418c7e221d avfilter/vf_xfade_opencl: Check ff_inlink_consume_frame() for failure
Fixes: CID1458127 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 43b62b7e0c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:52:58 +01:00
Michael Niedermayer b583dd4e44 avformat/lmlm4: Eliminate some AVERROR(EIO)
Found by code review related to CID732224 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 191a685010)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:52:58 +01:00
Michael Niedermayer aea5aadc20 avformat/wtvdec: Check length of read mpeg2_descriptor
Fixes: Use of uninitialized value
Fixes: 70900/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-6286909377150976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c390234da2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:52:57 +01:00
Michael Niedermayer 3d9afae908 avformat/wtvdec: clear sectors
The code can leave uninitialized holes in the array.
Fixes: use of uninitialized values
Fixes: 70883/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-6698694567591936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c95ea03104)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 17:52:52 +01:00
Janne Grunau 6cd0bdf3b0 vp9: recon: Use emulated edge to prevent buffer overflows
The arm/aarch64 horizontal filter reads one additional pixel beyond what
the filter uses. This can become an issue if the application does not
allocate larger buffers than what's required for the pixel data. If the
motion vector points to the bottom right edge of the picture this
becomes a read buffer overflow. This triggers segfaults in Firefox for
video resolutions which result in a page aligned picture size like
1280x640.
Prevent this by using emulated edge in this case.

Fixes: https://bugzilla.mozilla.org/show_bug.cgi?id=1881185
Signed-off-by: Janne Grunau <janne-ffmpeg@jannau.net>
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 060464105b)
2025-01-04 07:31:08 -05:00
Janne Grunau 131bd9436c arm: vp9mc: Load only 12 pixels in the 4 pixel wide horizontal filter
This reduces the amount the horizontal filters read beyond the filter
width to a consistent 1 pixel. The data is not used so this is usually
not noticeable. It becomes a problem when the application allocates
frame buffers only for the aligned picture size and the end of it is at
a page boundary. This happens for picture sizes which are a multiple of
the page size like 1280x640. The frame buffer allocation is based on
its most likely done via mmap + MAP_ANONYMOUS so start and end of the
buffer are page aligned and the previous and next page are not
necessarily mapped.
This mirrors the aarch64 change.

Signed-off-by: Janne Grunau <janne-ffmpeg@jannau.net>
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit f366256215)
2025-01-04 07:31:08 -05:00
Janne Grunau 69107495c5 aarch64: vp9mc: Load only 12 pixels in the 4 pixel wide horizontal filter
This reduces the amount the horizontal filters read beyond the filter
width to a consistent 1 pixel. The data is not used so this is usually
not noticeable. It becomes a problem when the application allocates
frame buffers only for the aligned picture size and the end of it is at
a page boundary. This happens for picture sizes which are a multiple of
the page size like 1280x640. The frame buffer allocation is based on
its most likely done via mmap + MAP_ANONYMOUS so start and end of the
buffer are page aligned and the previous and next page are not
necessarily mapped.
Under these conditions like seen by Firefox a read beyond the end of the
buffer results in a segfault.
After the over-read is reduced to a single pixel it's reasonable to use
VP9's emulated edge motion compensation for this.

Fixes: https://bugzilla.mozilla.org/show_bug.cgi?id=1881185
Signed-off-by: Janne Grunau <janne-ffmpeg@jannau.net>
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 430c38f698)
2025-01-04 07:31:08 -05:00
Marton Balint c5a083a50b avformat/libzmq: fix check for zmq protocol prefix
Fixes ticket #11134.

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit a87a96105e)
2024-09-02 23:32:05 +02:00
Ramiro Polla 4af46cabf6 configure: improve check for POSIX ioctl
Instead of relying on system #ifdefs which may or may not be correct,
detect the POSIX ioctl signature at configure time.

(cherry picked from commit 00b64fca55)
Signed-off-by: Brad Smith <brad@comstyle.com>
2024-09-01 21:16:49 -04:00
Ramiro Polla d67155005d configure: restore autodetection of v4l2 and fbdev
The detection logic for v4l2 and fbdev was accidentally modified to
depend on v4l2-m2m in 43b3412.

(cherry picked from commit 7405f1ad53)
Signed-off-by: Brad Smith <brad@comstyle.com>
2024-09-01 21:16:23 -04:00
Brad Smith 9d64371b0e configure: use just the pkg-config for sndio
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f6d8464590)
Signed-off-by: Brad Smith <brad@comstyle.com>
2024-09-01 21:15:25 -04:00
Brad Smith 7c1337ccb0 configure: enable ffnvcodec, nvenc, nvdec for FreeBSD
Signed-off-by: Brad Smith <brad@comstyle.com>
(cherry picked from commit 43b1a95678)
Signed-off-by: Brad Smith <brad@comstyle.com>
2024-09-01 21:14:45 -04:00
Brad Smith 610ca2cd52 avutil/ppc/cpu: Also use the machdep.altivec sysctl on NetBSD
Use the machdep.altivec sysctl on NetBSD for AltiVec detection
as is done with OpenBSD.

(cherry picked from commit 115c96b9bd)
Signed-off-by: Brad Smith <brad@comstyle.com>
2024-09-01 21:14:19 -04:00
Brad Smith b2294bf784 avutil/ppc/cpu: Use proper header for OpenBSD PPC CPU detection
Use the proper header for PPC CPU detection code. sys/param.h includes
sys/types, but sys/types.h is the more appropriate header to be used
here.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit beaf172d75)
Signed-off-by: Brad Smith <brad@comstyle.com>
2024-09-01 21:13:49 -04:00
Brad Smith efb211a449 lavd/v4l2: Use proper field type for second parameter of ioctl() with BSD's
The proper type was used until 73251678c8.

This covers all of the OS's that currently have V4L2 support, permutations
of Linux glibc/musl, Android bionic, FreeBSD, NetBSD, OpenBSD, Solaris.

Copied from FreeBSD ports patch.

Signed-off-by: Brad Smith <brad@comstyle.com>
Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit 9e674b3160)
Signed-off-by: Brad Smith <brad@comstyle.com>
2024-09-01 21:13:22 -04:00
Brad Smith b9a187b164 configure: use pkg-config for sndio
(cherry picked from commit bb813ccb45)
Signed-off-by: Brad Smith <brad@comstyle.com>
2024-09-01 21:12:53 -04:00
Ross Burton 5ed2358b12 libavcodec/arm/mlpdsp_armv5te: fix label format to work with binutils 2.43
binutils 2.43 has stricter validation for labels[1] and results in errors
when building ffmpeg for armv5:

src/libavcodec/arm/mlpdsp_armv5te.S:232: Error: junk at end of line, first unrecognized character is `0'

Remove the leading zero in the "01" label to resolve this error.

[1] https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=226749d5a6ff0d5c607d6428d6c81e1e7e7a994b

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 654bd47716)
2024-08-16 13:49:15 +03:00
Michael Niedermayer 2ece1f83e4 Changelog: update
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-08-05 23:48:12 +02:00
Kacper Michajłow 64426fd699 avcodec/parser: ensure input padding is zeroed
Fixes use of uninitialized value, reported by MSAN.

Found by OSS-Fuzz.

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>

Fixes: 70852/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5179190066872320
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5dfc0cc841)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-08-05 23:40:16 +02:00
Michael Niedermayer d7256bf014 avformat/img2dec: Clear padding data after EOF
Fixes: use-of-uninitialized-value
Fixes: 70852/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5179190066872320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Kacper Michajlow <kasper93@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3978e81809)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-08-05 23:20:04 +02:00
Michael Niedermayer d5a411f34f avformat/wavdec: Check if there are 16 bytes before testing them
Fixes: use-of-uninitialized-value
Fixes: 70839/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5212907590189056

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 79a1cf30d1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-08-05 23:19:20 +02:00
Michael Niedermayer 205732d468 avcodec/snow: Fix off by 1 error in run_buffer
Fixes: out of array access
Fixes: 70741/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5703668010647552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 06f5ed40f8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-08-01 00:30:04 +02:00
Michael Niedermayer 09f16093e6 avcodec/utils: apply the same alignment to YUV410 as we do to YUV420 for snow
The snow encoder uses block based motion estimation which can read out of array if
insufficient alignment is used

It may be better to only apply this for the encoder, as it would safe a few bytes of memory
for the decoder. Until then, this fixes the issue in a simple way.

Fixes: out of array access
Fixes: 68963/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-4979988435632128
Fixes: 68969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-6239933667803136.fuzz
Fixed: 70497/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5751882631413760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 58fbeb59e7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-08-01 00:27:24 +02:00
Michael Niedermayer a8975a3b0d update for 4.3.8
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-24 16:02:21 +02:00
Andreas Rheinhardt 5785193655 avcodec/diracdsp: Remove unused variable
Forgotten in ca3c6c981a.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 310d4062e7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-24 15:57:28 +02:00
Michael Niedermayer 0f75b041dc avcodec/vaapi_encode: Check hwctx
Fixes: null pointer dereference
Fixes: 70376/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_VAAPI_fuzzer-4733551250046976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3cd077e282)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-24 14:21:47 +02:00
Michael Niedermayer e346c7424b avcodec/proresdec: Consider negative bits left
Fixes: 70036/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PRORES_fuzzer-6298797647396864
Fixes: shift exponent 40 is too large for 32-bit type 'uint32_t' (aka 'unsigned int')

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 419eee6356)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-24 14:19:36 +02:00
Michael Niedermayer 999720f8fd avcodec/hevc/hevcdec: Do not allow slices to depend on failed slices
An alternative would be to leave the context unchanged on failure of hls_slice_header()

Fixes: out of array access
Fixes: NULL pointer dereference
Fixes: 69584/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5931086299856896
Fixes: 69724/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5104066422702080
Fixes: 70422/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5908731129298944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5d9544cfb0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-24 01:03:10 +02:00
Michael Niedermayer 23af4eac80 avutil/slicethread: Check pthread_*_init() for failure
Fixes: CID1604383 Unchecked return value
Fixes: CID1604439 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 23851c9ee0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 16:30:03 +02:00
Michael Niedermayer 17a8081d2f avutil/frame: Check log2_crop_align
Fixes: CID1604586 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 15540b3d28)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 16:29:01 +02:00
Michael Niedermayer fcef4eb0e7 avutil/buffer: Check ff_mutex_init() for failure
Fixes: CID1604487 Unchecked return value
Fixes: CID1604494 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 82f5b20ff5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 16:28:33 +02:00
Michael Niedermayer 3cc8b4b495 avformat/xmv: Check this_packet_size
Fixes: CID1604489 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 696685df0c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 16:27:40 +02:00
Michael Niedermayer c31d0108b1 avformat/ty: rec_size seems to only need 32bit
May help CID1604560 Overflowed integer argument

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit be30913538)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 16:27:09 +02:00
Michael Niedermayer 7c6f9c872f avformat/tty: Check avio_size()
Fixes: CID1220824 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 41745e550a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 16:26:51 +02:00
Michael Niedermayer 72bca563d5 avformat/siff: Basic pkt_size check
Fixes: half of CID1258461 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 124a97dd8b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 16:26:18 +02:00
Michael Niedermayer e3f7976c44 avformat/sauce: Check avio_size() for failure
Fixes: CID1604592 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 759aae590c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 16:25:40 +02:00
Michael Niedermayer aa3cdc085d avformat/sapdec: Check ffurl_get_file_handle() for error
Fixes: CID1604506 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3e305a0e70)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 16:24:50 +02:00
Michael Niedermayer a1524dbc93 avformat/nsvdec: Check asize for PCM
Fixes: CID1604527 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e83e246504)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 16:24:30 +02:00
Michael Niedermayer 1c1f537e06 avformat/mp3dec: Check header_filesize
Fixes: CID1608714 Division or modulo by float zero

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cea4dbc903)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 16:24:03 +02:00
Michael Niedermayer f21ba27cd6 avformat/mp3dec; Check for avio_size() failure
Fixes: CID1608710 Improper use of negative value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bb936a1a72)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 16:23:26 +02:00
Michael Niedermayer 02e6d29c33 avformat/mov: Use 64bit for str_size
We assign a 64bit variable to it before checking

Fixes: CID1604544 Overflowed integer argument

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 046d069552)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 16:23:01 +02:00
Michael Niedermayer 000b9de913 avformat/mm: Check length
Fixes: CID1220824 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 139bf41246)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 16:22:18 +02:00
Michael Niedermayer adabe1aa9e avformat/hnm: Check *chunk_size
Fixes: CID1604419 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 291356f58b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 16:21:52 +02:00
Michael Niedermayer a7c43833f2 avformat/hlsenc: Check ret
Fixes: CID1609624 Unused value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7e577165c1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 14:50:42 +02:00
Michael Niedermayer f96036e410 avformat/bintext: Check avio_size() return
Fixes: CID1604503 Overflowed constant
Fixes: CID1604566 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bf61f811e7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 14:50:23 +02:00
Michael Niedermayer 5364d0de5c avformat/asfdec_o: Check size of index object
We subtract 24 so it must be at least 24

Fixes: CID1604482 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 891bc070f0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 14:49:50 +02:00
Michael Niedermayer 8860326a1a avfilter/scale_eval: Use 64bit, check values in ff_scale_adjust_dimensions()
Found by reviewing CID1513722 Operands don't affect result

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ad9df8bcfe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 14:23:30 +02:00
Michael Niedermayer 0ca3416176 avfilter/vf_lut3d: Check av_scanf()
Fixes: CID1604398 Unchecked return value
Fixes: CID1604542 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ace2e25720)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 10:47:16 +02:00
Michael Niedermayer 75de958c0f avfilter/vf_deshake_opencl: Ensure that the first iteration initializes the best variables
Fixes: CID1452759 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9385847af4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 10:45:25 +02:00
Michael Niedermayer 3cfd197bea swscale/output: Fix integer overflows in yuv2rgba64_X_c_template
Fixes: signed integer overflow: -1082982400 + -1068681048 cannot be represented in type 'int'
Fixes: 69995/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-6285740271534080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bcab9789ef)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 10:42:24 +02:00
Michael Niedermayer 4a04c96f70 avformat/mxfdec: Reorder elements of expression in bisect loop
Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented in type 'long'
Fixes: 68578/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6032171648221184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d8d288479d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 01:18:35 +02:00
Michael Niedermayer da2240ccbe avcodec/pnmdec: Use 64bit for input size check
Fixes: out of array read
Fixes: poc3

Reported-by: VulDB CNA Team
Found-by: CookedMelon
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3faadbe2a2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 01:15:33 +02:00
Michael Niedermayer 4430a979bc avcodec/utvideoenc: Use unsigned shift to build flags
Fixes: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 69083/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_fuzzer-5608202363273216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 69e90491f1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 01:09:44 +02:00
Michael Niedermayer 2c7d846959 avcodec/vc2enc: Fix overflows with storing large values
Fixes: left shift of 1431634944 by 2 places cannot be represented in type 'int'
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int'
Fixes: 69061/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC2_fuzzer-6325700826038272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit af99358353)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 01:07:45 +02:00
Michael Niedermayer 0e2bff1a88 avcodec/mpegvideo_enc: Do not duplicate pictures on shifting
Fixes: out of array access
Fixes: 69098/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG2VIDEO_fuzzer-6107989688778752
Fixes: 69599/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4848626296225792.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9c8881cb35)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 01:07:05 +02:00
Michael Niedermayer 35be459c27 avcodec/tiff: Check value on positive signed targets
Fixes: CID1604593 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 66d6b8033b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-22 01:05:07 +02:00
Michael Niedermayer 8e35cb8c22 avfilter/vf_bm3d: Dont round MSE2SSE to an integer
Fixes: CID1439581 Result is not floating-point

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ec18ec9fc1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 22:24:14 +02:00
Michael Niedermayer 113960bb02 avdevice/dshow: Check device_filter_unique_name before use
Fixes: CID1591931 Explicit null dereferenced

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Roger Pack <rogerdpack@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 175c191668)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 22:22:36 +02:00
Michael Niedermayer 359893d829 avdevice/dshow_filter: Use wcscpy_s()
Fixes: CID1591929 Copy into fixed size buffer

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Roger Pack <rogerdpack@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit daf61dddc8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 22:21:31 +02:00
Michael Niedermayer 37cb93097a avcodec/flac_parser: Assert that we do not overrun the link_penalty array
Helps: CID1454676 Out-of-bounds read

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9af348bd1a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 22:20:28 +02:00
Michael Niedermayer 2bdb01c847 avcodec/pixlet: Simplify pfx computation
Found by reviewing code related to CID1604365 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0474614e6c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 22:19:17 +02:00
Michael Niedermayer 1c349d968c avcodec/motion_est: Fix score squaring overflow
Fixes: CID1604552 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f18b442370)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 22:18:32 +02:00
Michael Niedermayer c8b26518fc avcodec/loco: Check loco_get_rice() for failure
Fixes: CID1604495 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d553276843)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 22:16:37 +02:00
Michael Niedermayer 271b7ce6f5 avcodec/loco: check get_ur_golomb_jpegls() for failure
Fixes: CID1604400 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b989986641)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 22:16:09 +02:00
Michael Niedermayer 1736bfa088 avcodec/imm4: check cbphi for error
Fixes: CID1604356 Overflowed constant
Fixes: CID1604573 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6e4c037833)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 22:14:14 +02:00
Michael Niedermayer 2115efc337 avcodec/iff: Use signed count
This is more a style fix than a bugfix (CID1604392 Overflowed constant)

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cfe66dfebb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 22:12:47 +02:00
Michael Niedermayer 1fa6ad5474 avcodec/golomb: Assert that k is in the supported range for get_ur/sr_golomb()
Found by code review related to CID1604563 Overflowed return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b2aaeb81f6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 22:11:22 +02:00
Michael Niedermayer dff8c05a14 avcodec/golomb: Document return for get_ur_golomb_jpegls() and get_sr_golomb_flac()
Found while reviewing code related to CID1604409 Overflowed return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7cf5b83f6f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 21:45:57 +02:00
Michael Niedermayer 55f4161005 avcodec/dxv: Fix type in get_opcodes()
Found by code review related to CID1604386 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e5af1c6e91)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 21:45:39 +02:00
Michael Niedermayer 55cce2ab4a avcodec/xsubdec: Check parse_timecode()
Fixes: CID1604490 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 96fd9417e2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 21:44:55 +02:00
Michael Niedermayer cf564cb826 avutil/imgutils: av_image_check_size2() ensure width and height fit in 32bit
width and height > 32bit is not supported and its easier to check in a central place

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ba63e32957)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 21:44:09 +02:00
Michael Niedermayer ce84532589 avcodec/proresenc_kostya: use unsigned alpha for rotation
Fixes: left shift of negative value -208
Fixes: 69073/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PRORES_KS_fuzzer-4745020002336768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 93e0265e27)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 21:42:59 +02:00
Michael Niedermayer ec75ce6ede avformat/rtmppkt: Simplify and deobfuscate amf_tag_skip() slightly
Found while reviewing: CID1530313 Untrusted loop bound

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cedbef0394)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 21:41:43 +02:00
Michael Niedermayer 6f185c6ee9 avformat/rmdec: use 64bit for audio_framesize checks
It is not entirely clear what would prevent such overflow so even if it is
not possible, it is better to use 64bit

Fixes: CID1491898 Unintentional integer overflow

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 665be4fa2f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 21:40:55 +02:00
Michael Niedermayer cc5694cc02 avutil/hwcontext_d3d11va: correct sizeof IDirect3DSurface9
Fixes: CID1591944 Wrong sizeof argument

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Steve Lhomme <robux4@ycbcr.xyz>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 628ba061c8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 21:40:12 +02:00
Michael Niedermayer 9893e36786 avutil/hwcontext_d3d11va: correct sizeof AVD3D11FrameDescriptor
Fixes: CID1591909 Wrong sizeof argument

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Steve Lhomme <robux4@ycbcr.xyz>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 698ed0d5a5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 21:39:41 +02:00
Michael Niedermayer 39ba817a49 avformat/tls_schannel: Initialize ret
Fixes: CID1591881 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f022afea77)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 21:36:44 +02:00
Michael Niedermayer 3174e73cc5 avformat/subfile: Assert that whence is a known case
This may help CID1452449 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 426d8c84c3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 21:35:15 +02:00
Michael Niedermayer 20aba0c184 avformat/subfile: Merge if into switch()
Found while reviewing CID1452449 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2a0a7d964b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 21:34:45 +02:00
Michael Niedermayer b5129a08fd avformat/rtsp: Check that lower transport is handled in one of the if()
Fixes: CID1473554 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c8200d3825)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 21:12:33 +02:00
Michael Niedermayer 747a3f6999 avformat/rtsp: initialize reply1
It seems reply1 is initialized by ff_rtsp_send_cmd() in most cases but there
are code paths like "continue" which look like they could skip it but even if not
writing this so a complex loop after several layers of calls initialized a local
variable through a pointer is just bad design.
This patch simply initialized the variable.

Fixes: CID1473532 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 498ce4e8b8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 21:11:48 +02:00
Michael Niedermayer 13807f204b avformat/rtsp: use < 0 for error check
Found while reviewing CID1473532 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9bb38ba2b7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 21:11:03 +02:00
Michael Niedermayer bf071ff5f1 avformat/rtpenc_vc2hq: Check sizes
Fixes: CID1452585 Untrusted loop bound

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7a9ddb7051)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 21:10:36 +02:00
Michael Niedermayer 917c2b02c4 avfilter/af_aderivative: Free out on error
Fixes: CID1197065 Resource leak

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 382e9e79f3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 21:09:26 +02:00
Michael Niedermayer 81fbeedd1b avfilter/af_pan: check nb_output_channels before use
Fixes: CID1500281 Out-of-bounds write
Fixes: CID1500331 Out-of-bounds write

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5fe8bf4aa5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 20:06:33 +02:00
Mark Thompson 93c16626b5 cbs_av1: Reject thirty-two zero bits in uvlc code
The spec allows at least thirty-two zero bits followed by a one to mean
2^32-1, with no constraint on the number of zeroes.  The libaom
reference decoder does not match this, instead reading thirty-two zeroes
but not the following one to mean 2^32-1.  These two interpretations are
incompatible and other implementations may follow one or the other.
Therefore reject thirty-two zeroes because the intended behaviour is not
clear.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7110a36ba0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 20:05:31 +02:00
Michael Niedermayer bad037ba50 tools/coverity: Phase 1 study of anti-halicogenic for coverity av_rescale()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 380a8213b1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 20:02:28 +02:00
Michael Niedermayer 86dfa07e76 avfilter/vf_avgblur: Check plane instead of AVFrame
Fixes: CID1551694 Use after free (false positive based on assuming that out == in and one is freed and one used)

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c296d4fdec)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 20:02:02 +02:00
Michael Niedermayer 0d1f773904 avformat/rdt: Check pkt_len
Fixes: CID1473553 Untrusted loop bound

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0d0373de3b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 19:59:20 +02:00
Michael Niedermayer 58213b5970 avformat/mpeg: Check len in mpegps_probe()
Fixes: CID1473590 Untrusted loop bound

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ca237a841e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 19:58:37 +02:00
Michael Niedermayer 70fd924f31 avdevice/dshow: Check ICaptureGraphBuilder2_SetFiltergraph() for failure
Fixes: CID1591939 Logically dead code

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4c285bb278)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 19:57:21 +02:00
Michael Niedermayer d6e212d312 avcodec/mfenc: check IMFSample_ConvertToContiguousBuffer() for failure
Fixes: CID1591911 Logically dead code

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 86cd7c68bc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 19:57:04 +02:00
Michael Niedermayer 1d553fc50e avcodec/vc1_loopfilter: Factor duplicate code in vc1_b_h_intfi_loop_filter()
Fixes: CID1435168

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 63ecce9ba8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 19:56:45 +02:00
Michael Niedermayer d8eaf39a72 avformat/img2dec: assert no pipe on ts_from_file
Help coverity with CID1500302 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4824156fa0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 19:55:42 +02:00
Michael Niedermayer cc8b888905 avcodec/cbs_jpeg: Try to move the read entity to one side in a test
The checked entity should be alone on one side of the check, this avoids
complex considerations of overflows.
This fixes a issue of bad style in our code and a coverity issue.

Fixes: CID1439654 Untrusted pointer read

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 385784a148)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 19:55:14 +02:00
Michael Niedermayer c803c8ef60 avformat/mov: Check edit list for overflow
Fixes: 67492/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5778297231310848
Fixes: signed integer overflow: 2314885530818453536 + 7782220156096217088 cannot be represented in type 'long'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2882d30e3a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 18:56:11 +02:00
Michael Niedermayer 3eada55c21 fftools/ffmpeg: Check read() for failure
Fixes: CID1591932 Ignoring number of bytes read

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 34fd247c3b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 18:55:36 +02:00
Michael Niedermayer 8b56b03028 swscale/output: Avoid undefined overflow in yuv2rgb_write_full()
Fixes: signed integer overflow: -140140 * 16525 cannot be represented in type 'int'
Fixes: 68859/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-4516387130245120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c221c7422f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 17:36:39 +02:00
Michael Niedermayer 02af994743 swscale/output: alpha can become negative after scaling, use multiply
Fixes: left shift of negative value -3245
Fixes: 69047/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-6571511551950848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9e6c5b6e86)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 17:36:06 +02:00
Michael Niedermayer dfb6bd6b08 avcodec/targaenc: Allocate space for the palette
Fixes: out of array access
Fixes: 68927/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TARGA_fuzzer-5105665067515904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4a7220bd5c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 17:27:43 +02:00
Michael Niedermayer 0258d8302d avcodec/r210enc: Use av_rescale for bitrate
Fixes: signed integer overflow: 281612954574848 * 65344 cannot be represented in type 'long'
Fixes: 68956/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_R210_fuzzer-6459074458746880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d34d4b6a7c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 17:25:34 +02:00
Michael Niedermayer da915126bf avcodec/jfdctint_template: Fewer integer anomalies
Fixes: signed integer overflow: 105788 * -20995 cannot be represented in type 'int'
Fixes: signed integer overflow: 923211729 + 2073948236 cannot be represented in type 'int'
Fixes: signed integer overflow: 1281179284 + 2073948236 cannot be represented in type 'int'
Fixes: 68975/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PRORES_fuzzer-6266769177116672
Fixes: 68997/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PRORES_KS_fuzzer-6284237161431040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 228f255b5d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 17:25:14 +02:00
Michael Niedermayer 4c539a8162 avcodec/snowenc: MV limits due to mv_penalty table size
Fixes: out of array read
Fixes: 69673/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5476592894148608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3a9292aff3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 17:24:41 +02:00
Michael Niedermayer 744b0f80ac avformat/mxfdec: Check container_ul->desc before use
Fixes: CID1592939 Dereference after null check

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4cab028bd0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 17:22:26 +02:00
Michael Niedermayer bd1e6d2af3 MAINTAINERS: Update the entries for the release maintainer for FFmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 97ecfb5a19)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 17:20:28 +02:00
Lynne 41a5eae142 configure: update copyright year
(cherry picked from commit b95ee2ec5f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-15 00:38:19 +02:00
Michael Niedermayer 5dcac90c77 Update for 4.3.7
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 21:09:22 +02:00
Michael Niedermayer ef18ef4085 avfilter/vf_rotate: Check ff_draw_init2() return value
Fixes: NULL pointer dereference
Fixes: 3_343

Found-by: De3mond
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9c9f095e30)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:55 +02:00
Michael Niedermayer 316bd5787b avformat/matroskadec: Assert that num_levels is non negative
Maybe Closes: CID1452496 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 019fce18bb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:55 +02:00
Michael Niedermayer bf5ba9a170 avformat/libzmq: Check av_strstart()
Fixes: CID1453457 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0263b6a48c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:55 +02:00
Michael Niedermayer c81fd6fd6d avformat/img2dec: Move DQT after unrelated if()
Fixes: CID1494636 Missing break in switch

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7d04c6016b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:54 +02:00
Michael Niedermayer 413b07402e avdevice/xcbgrab: Check sscanf() return
Alot more input checking can be performed, this is only checking the obvious missing case

Fixes: CID1598562 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 78d6d13bab)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:54 +02:00
Michael Niedermayer 4a91134a18 fftools/cmdutils: Add protective () to FLAGS
issue found while reviewing CID1452612 Free of array-typed value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d9b9fc4be2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:54 +02:00
Michael Niedermayer 5b392f4983 avformat/sdp: Check before appending ","
Found by reviewing code related to CID1500301 String not null terminated

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5b82852519)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:53 +02:00
Michael Niedermayer b06c0e8b83 avcodec/ilbcdec: Remove dead code
Yes the same dead code is in "iLBC Speech Coder ANSI-C Source Code"

Fixes: CID1509370 Logically dead code

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8a64a003b5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:53 +02:00
Michael Niedermayer 02b37af177 avcodec/vp8: Check cond init
Fixes: CID1598563 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9b76e49061)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:53 +02:00
Michael Niedermayer ea1e12e029 avcodec/vp8: Check mutex init
Fixes: CID1598556 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4ac7405aaf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:52 +02:00
Michael Niedermayer 32fc533b2c avcodec/notchlc: Check init_get_bits8() for failure
Fixes: CID1500300 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 19db9636c5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:52 +02:00
Michael Niedermayer 9bd68c46a6 avcodec/tests/dct: Use 64bit in intermediate for error computation
Fixes: CID1500284 Unintentional integer overflow

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 161d0aa2a8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:52 +02:00
Michael Niedermayer 86a2543744 avcodec/scpr3: Check add_dec() for failure
Fixes: CID1441459 Improper use of negative value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d741638042)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:51 +02:00
Michael Niedermayer 99c8b0ac22 avcodec/wavpackenc: Use unsigned for potential 31bit shift
Fixes: CID1465481 Unintentional integer overflow

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6f976db251)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:51 +02:00
Michael Niedermayer a6502919bd avcodec/tests/jpeg2000dwt: Use 64bit in comparission
Found while reviewing: CID1500309 Unintentional integer overflow

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 12391b732f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:51 +02:00
Michael Niedermayer 36c061fe22 avcodec/tests/jpeg2000dwt: Use 64bit in err2 computation
This issue cannot happen with the current function parameters

Fixes: CID1500309 Unintentional integer overflow

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 847a53f264)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:50 +02:00
Michael Niedermayer 4546c600c6 avformat/fwse: Remove always false expression
Fixes: CID1460758 Operands don't affect result

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 348c3a7ffe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:50 +02:00
Michael Niedermayer 2cca78ee68 avformat/asfdec_f: Use 64bit for preroll computation
Fixes: CID1500342 Unintentional integer overflow

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 70b4994762)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:50 +02:00
Michael Niedermayer 2b79276114 avformat/ape: Use 64bit for final frame size
Fixes: CID1505963 Unintentional integer overflow

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a2b8d03347)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:49 +02:00
Michael Niedermayer 9c605c88a9 avcodec/tiff: Assert init_get_bits8() success in unpack_gray()
Helps: CID1441939 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a287f17db2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:49 +02:00
Michael Niedermayer 9e5d40ff9f avcodec/tiff: Assert init_get_bits8() success in horizontal_fill()
Helps: CID1441167 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8814cedb07)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:49 +02:00
Michael Niedermayer b9924b244e swscale/yuv2rgb: Use 64bit for brightness computation
This will not overflow for normal values
Fixes: CID1500280 Unintentional integer overflow

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bfc22f364d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:48 +02:00
Michael Niedermayer d180fa89cb avutil/tests/opt: Check av_set_options_string() for failure
This is test code after all so it should test things

Fixes: CID1518990 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e3481730ed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:48 +02:00
Michael Niedermayer 8d969d2778 avutil/tests/dict: Check av_dict_set() before get for failure
Failure is possible due to strdup()

Fixes: CID1516764 Dereference null return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e8a1e1899d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:48 +02:00
Michael Niedermayer 6b0671a644 avdevice/dshow: fix badly indented line
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c4004605b2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:47 +02:00
Michael Niedermayer 5cca477c51 avcodec/mscc & mwsc: Check loop counts before use
This could cause timeouts

Fixes: CID1439568 Untrusted loop bound

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e35fe3d8b9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:47 +02:00
Michael Niedermayer 25826459d9 avcodec/mpegvideo_enc: Fix potential overflow in RD
Fixes: CID1500285 Unintentional integer overflow

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b6b2b01025)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:47 +02:00
Michael Niedermayer b84b27b360 avcodec/mpeg4videodec: assert impossible wrap points
Helps: CID1473517 Uninitialized scalar variable
Helps: CID1473497 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8fc649b931)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:46 +02:00
Michael Niedermayer 590a0b5f33 avcodec/vble: Check av_image_get_buffer_size() for failure
Fixes: CID1461482 Improper use of negative value

Sponsored-by: Sovereign Tech Fund
Reviewed-.by: "Xiang, Haihao" <haihao.xiang@intel.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dd5379db5d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:46 +02:00
Michael Niedermayer 419c77c81a avcodec/vp3: Replace check by assert
Fixes: CID1452425 Logically dead code

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b991e77b9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:46 +02:00
Michael Niedermayer b7deab84be avcodec/jpeg2000dec: remove ST=3 case
Fixes: CID1460979 Logically dead code

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4ed4f9a6c0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:45 +02:00
Michael Niedermayer 52f7861420 avcodec/qsvdec: Check av_image_get_buffer_size() for failure
Fixes: CID1477406 Improper use of negative value

Sponsored-by: Sovereign Tech Fund
Reviewed-by: "Xiang, Haihao" <haihao.xiang@intel.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8789c550fa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:45 +02:00
Michael Niedermayer 749a3cdae8 avcodec/fmvc: remove dead assignment
Fixes: CID1529220 Unused value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 96c1162545)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:45 +02:00
Michael Niedermayer a06d3b96fd avcodec/h264_slice: Remove dead sps check
Fixes: CID1439574 Dereference after null check

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a68aa951b2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:44 +02:00
Michael Niedermayer 4f5ae895ce avcodec/lpc: copy levenson coeffs only when they have been computed
Fixes: CID1473514 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c2d897f356)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:44 +02:00
Michael Niedermayer a0af91c348 avutil/tests/base64: Check with too short output array
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c304784a86)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:44 +02:00
Michael Niedermayer ef80220f32 libavutil/base64: Try not to write over the array end
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2d216566f2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:43 +02:00
Michael Niedermayer 682b002d15 avcodec/cbs_av1: Avoid shift overflow
Fixes: CID1465488 Unintentional integer overflow

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d7924a4f60)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:43 +02:00
Michael Niedermayer 62ffa50af2 doc/examples/demux_decode: Simplify loop
Fixes: CID1463550 Logically dead code

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 91d27f7e02)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:43 +02:00
Michael Niedermayer 816ac9de67 avcodec/mpegvideo_enc: Fix 1 line and one column images
Fixes: Ticket10952
Fixes: poc21ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 96449cfeae)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:42 +02:00
Michael Niedermayer 27326d0e09 swscale/output: Fix integer overflow in yuv2rgba64_full_1_c_template()
Fixes: signed integer overflow: -1082982400 + -1079364728 cannot be represented in type 'int'
Fixes: 67910/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5329011971522560
The input is 9bit in 16bit, the fuzzer fills all 16bit thus generating "invalid" input
No overflow should happen with valid input.

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1330a73cca)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:42 +02:00
Michael Niedermayer 11410efb23 swscale/output: Fix integer overflow in yuv2rgba64_1_c_template
Fixes: signed integer overflow: -831176 * 9539 cannot be represented in type 'int'
Fixes: 67869/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5117342091640832

The input is 9bit in 16bit, the fuzzer fills all 16bit thus generating "invalid" input
No overflow should happen with valid input.

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a56559e688)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:42 +02:00
Michael Niedermayer 2a49bf5713 avformat/mxfdec: Check body_offset
Fixes: signed integer overflow: 538976288 - -9223372036315799520 cannot be represented in type 'long'
Fixes: 68060/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5523457266745344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 20a6bfda0f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:41 +02:00
Michael Niedermayer 98a7a5000f avformat/kvag: Check sample_rate
Fixes: Division by 0
Fixes: -copyts -start_at_zero -itsoffset 00:00:01 -itsscale 1 -ss 00:00:02  -i zgclab/ffmpeg_crash/poc1 output.mp4

Found-by: Wang Dawei and Zhou Geng, from Zhongguancun Laboratory
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c26a762ea1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:41 +02:00
Michael Niedermayer 72c789e028 avcodec/ac3_parser: Check init_get_bits8() for failure
Fixes: CID1420393 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 63415168db)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:41 +02:00
Michael Niedermayer 121fae5591 avcodec/hevcdec: Check ref frame
Fixes: NULL pointer dereferences
Fixes: 68197/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6382538823106560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5eb05f4450)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:40 +02:00
Michael Niedermayer c8a5242a54 doc/examples/vaapi_transcode: Simplify loop
Fixes: CID1428858(1/2) Logically dead code

Sponsored-by: Sovereign Tech Fund
Reviewed-by: "mypopy@gmail.com" <mypopy@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c9c11a0866)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:40 +02:00
Michael Niedermayer 473663d536 avfilter/vf_thumbnail_cuda: Set ret before checking it
Fixes: CID1418336 Logically dead code

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Timo Rothenpieler <timo@rothenpieler.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 02301017d2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:39 +02:00
Michael Niedermayer 1bff9db691 avfilter/signature_lookup: Dont copy uninitialized stuff around
Fixes: CID1403238 Uninitialized pointer read
Fixes: CID1403239 Uninitialized pointer read

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e7174e66ac)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:39 +02:00
Michael Niedermayer fe924faa2f avfilter/signature_lookup: Fix 2 differences to the refernce SW
Fixes: CID1403227 Division or modulo by float zero

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 25cb66369e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-14 11:11:39 +02:00
Andreas Rheinhardt 78cf22f399 avcodec/x86/vp3dsp_init: Set correct function pointer, fix crash
Regression since fd172185580c1ccdcfb90bbfdb59fa806fad3117;
triggered by vp4/KTkvw8dg1J8.avi in the FATE suite, but not
when running fate as this code is not used when the bitexact
flag is set.

Bisecting done by ami_stuff, patch from user Mika Fischer
in ticket #10027 (which this commit fixes).

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit c3ca90a92e)
2024-05-22 17:34:48 +02:00
Andreas Rheinhardt f0fff36b1d fate/subtitles: Ignore line endings for sub-scc test
Since 7bf1b9b357,
the test produces ordinary \n, yet this is not what the reference
file used for the most time, leading to test failures.

Reviewed-by: Martin Storsjö <martin@martin.st>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 99d33cc661)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:58 +02:00
Michael Niedermayer ed81994a14 avformat/mxfdec: Check index_edit_rate
Fixes: Assertion b >=0 failed at libavutil/mathematics.c:62
Fixes: 67811/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5108429687422976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ed49391961)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:57 +02:00
Michael Niedermayer 4bb78609a3 swscale/utils: Fix xInc overflow
Fixes: signed integer overflow: 2 * 1073741824 cannot be represented in type 'int'
Fixes: 67802/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-6249515855183872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1a9eda65d0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:57 +02:00
Michael Niedermayer 71da96b772 avformat/mxfdec: Make edit_unit_byte_count unsigned
Suggested-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f30fe5e8d0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:57 +02:00
Michael Niedermayer d04239ba7c avformat/movenc: Check that cts fits in 32bit
Fixes: Assertion av_rescale_rnd(start_dts, mov->movie_timescale, track->timescale, AV_ROUND_DOWN) <= 0 failed at libavformat/movenc.c:3694
Fixes: poc2

Found-by: Wang Dawei and Zhou Geng, from Zhongguancun Laboratory
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d88c284c18)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:57 +02:00
Michael Niedermayer cf1b7ab0ec avformat/mxfdec: Check first case of offset_temp computation for overflow
This is kind of ugly
Fixes: signed integer overflow: 255 * 1157565362826411919 cannot be represented in type 'long'
Fixes: 67313/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6250434245230592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d6ed6f6e8d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:56 +02:00
Michael Niedermayer d5877b21a2 avfilter/vf_signature: Dont crash on no frames
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3d5f03bbc8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:56 +02:00
Michael Niedermayer 251b3c3892 avformat/westwood_vqa: Fix 2g packets
Fixes: signed integer overflow: 2147483424 * 2 cannot be represented in type 'int'
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_WSVQA_fuzzer-4576211411795968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 86f73277bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:56 +02:00
Michael Niedermayer 0c7d6c4eea avformat/matroskadec: Check timescale
Fixes: 3.82046e+18 is outside the range of representable values of type 'unsigned int'
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6381436594421760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e849eb2343)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:55 +02:00
Michael Niedermayer 8f5b0e1249 avformat/wavdec: satuarte next_tag_ofs, data_end
Fixes: signed integer overflow: 5053074104798691550 + 5053074104259715104 cannot be represented in type 'long'
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-6515315309936640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 61dca9e150)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:55 +02:00
Michael Niedermayer 21b8fbf060 avformat/sbgdec: Check for negative duration
Fixes: signed integer overflow: 9223372036854775807 - -8000000 cannot be represented in type 'long'
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-5133181743136768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0bed22d597)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:55 +02:00
Michael Niedermayer a94b67bab4 avformat/rpl: Use 64bit for total_audio_size and check it
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-4677434693517312
Fixes: signed integer overflow: 5555555555555555556 * 8 cannot be represented in type 'long long'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 878625812f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:54 +02:00
Michael Niedermayer dae887cfd0 avformat/timecode: use 64bit for intermediate for rounding in fps_from_frame_rate()
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4802790784303104
Fixes: signed integer overflow: 1768972133 + 968491058 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3d8d778a68)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:54 +02:00
Michael Niedermayer ae348065a8 avformat/jacosubdec: Use 64bit for abs
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-5401294942371840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 746203af31)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:54 +02:00
Michael Niedermayer 0889e913be avformat/concatdec: Check user_duration sum
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-6434245599690752
Fixes: signed integer overflow: 9223372026773000000 + 22337000000 cannot be represented in type 'long'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 007486058c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:53 +02:00
Michael Niedermayer 2c9832bca2 avcodec/truemotion1: Height not being a multiple of 4 is unsupported
mb_change_bits is given space based on height >> 2, while more data is read

Fixes: out of array access
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION1_fuzzer-5201925062590464.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ebdcf98499)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:53 +02:00
Michael Niedermayer 4ddc5bc4bd avcodec/hcadec: do not set hfr_group_count to invalid values
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCA_fuzzer-6247136417087488
Fixes: out of array write

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit addb85ea39)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:53 +02:00
Michael Niedermayer 2e396e6ca8 avformat/concatdec: clip outpoint - inpoint overflow in get_best_effort_duration()
An alternative would be to limit all time/duration fields to below 64bit

Fixes: signed integer overflow: -93000000 - 9223372036839000000 cannot be represented in type 'long long'
Fixes: 64546/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-5110813828186112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dd733b2be4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:52 +02:00
Michael Niedermayer d633748e02 avformat/jacosubdec: clarify code
add comments, rename variables and indent things differently

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e83e8d443b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:52 +02:00
Michael Niedermayer 37306dd667 avformat/cafdec: Check that data chunk end fits within 64bit
Fixes: signed integer overflow: 64 + 9223372036854775803 cannot be represented in type 'long long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6536881135550464
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6536881135550464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b792e4d4c7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:52 +02:00
Michael Niedermayer d30403b7a7 avformat/iff: Saturate avio_tell() + 12
Fixes: signed integer overflow: 9223372036854775796 + 12 cannot be represented in type 'long long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4898373660704768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b8e754525c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:51 +02:00
Michael Niedermayer 42f495fbe1 avformat/dxa: Adjust order of operations around block align
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-5730576523198464
Fixes: signed integer overflow: 2147483566 + 82 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 50d8e4f273)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:51 +02:00
Michael Niedermayer 9557810a81 avformat/cafdec: dont seek beyond 64bit
Fixes: signed integer overflow: 64 + 9223372036854775807 cannot be represented in type 'long long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6418242730328064
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6418242730328064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d973fcbcc2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:51 +02:00
Michael Niedermayer 794eb4f536 avformat/id3v2: read_uslt() check for the amount read
Fixes: timeout
Fixes: 66783/clusterfuzz-testcase-minimized-ffmpeg_dem_GENH_fuzzer-5356884892647424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c0f4abe2aa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:50 +02:00
Michael Niedermayer 0c2fffba79 avcodec/proresenc_kostya: Remove bug similarity text
According to kostya, it is not based on Wassermans encoder

CC: Kostya Shishkov <kostya.shishkov@gmail.com>
CC: Anatoliy Wasserman <anatoliy.wasserman@yandex.ru>

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e0e30e07a1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:50 +02:00
Michael Niedermayer 8064fc02d9 avcodec/vorbisdec: Check remaining data in vorbis_residue_decode_internal()
Fixes: timeout
Fixes: 66326/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-6295291863040000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dc89cf804a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:50 +02:00
Michael Niedermayer d2e9778f98 libswscale/utils: Fix bayer to yuvj
Fixes: out of array access.

Earlier code assumes that a unscaled bayer to yuvj420 converter exists
but the later code then skips yuvj420

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e9cc9e492f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:49 +02:00
Michael Niedermayer e92cc45c14 swscale/swscale: Check srcSliceH for bayer
Fixes: Assertion srcSliceH > 1 failed at libswscale/swscale_unscaled.c:1359
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 64098d0cd8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:49 +02:00
Michael Niedermayer facfb2d25d swscale/utils: Allocate more dithererror
Fixes: out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 18f26f8a2f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:49 +02:00
Michael Niedermayer 4f8ef0c274 avcodec/indeo3: Round dimensions up in allocate_frame_buffers()
Fixes: Ticket6581

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3be80ce299)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:48 +02:00
Michael Niedermayer 8887a0df3c avutil/rational: Document what is to be expected from av_d2q() of doubles representing rational numbers
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f465badb06)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:48 +02:00
Michael Niedermayer dde3d17274 avfilter/signature_lookup: Do not dereference NULL pointers after malloc failure
Fixes: CID 1403229 Dereference after null check

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 98ae1ad7cf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:48 +02:00
Michael Niedermayer 1796dc942c avfilter/signature_lookup: dont leave uncleared pointers in sll_free()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6c50482951)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:47 +02:00
Michael Niedermayer 0845294d7c avcodec/mpegvideo_enc: Use ptrdiff_t for stride
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e063c1d079)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:47 +02:00
Romain Beauxis 294ec29bde libavformat/hlsenc.c: Populate OTI using AAC profile in write_codec_attr.
This patch populates the third entry for HLS codec attribute using the
AAC profile.

The HLS specifications[1] require this value to be the Object Type ID as
referred to in table 1.3 of ISO/IEC 14496-3:2009[2].

The numerical constants in the code refer to these OTIs minus one, as
documented in commit 372597e[3], confirmed by comparing the values in the
code with the values in the table mentioned above.

Links:
1: https://datatracker.ietf.org/doc/html/rfc6381#section-3.3
2: https://csclub.uwaterloo.ca/~ehashman/ISO14496-3-2009.pdf
3: https://github.com/FFmpeg/FFmpeg/commit/372597e5381c097455a7b73849254d56083eb056

Changes in this version:
- Default value set to "mp4a.40.2" when profile is unknown for backward
  compatibility.

Signed-off-by: Steven Liu <liuqi05@kuaishou.com>
(cherry picked from commit 797f0b27c1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:47 +02:00
Michael Niedermayer 4c80dceeb9 avcodec/mpegvideo_enc: Dont copy beyond the image
Fixes: out of array access
Fixes: tickets/10754/poc17ffmpeg

Discovered by Zeng Yunxiang.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a066b8a809)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:46 +02:00
Michael Niedermayer 22ef17004c avfilter/vf_minterpolate: Check pts before division
Fixes: FPE
Fixes: tickets/10758/poc20ffmpeg

Discovered by Zeng Yunxiang

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 68146f06f8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:46 +02:00
Michael Niedermayer 49e71a2a93 avformat/flacdec: Avoid double AVERRORS
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 029294ff54)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:46 +02:00
Michael Niedermayer fc4095e438 avfilter/vf_vidstabdetect: Avoid double AVERRORS
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bb04235d72)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:45 +02:00
Michael Niedermayer 77ad8e90c1 avfilter/vf_swaprect: round coordinates down
Fixes: out of array access:
Fixes: tickets/10745/poc12ffmpeg

Found-by: Li Zeyuan and Zeng Yunxiang.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7deaca71b3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:45 +02:00
Michael Niedermayer 651ed7555a avfilter/vf_swaprect: Use height for vertical variables
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9f4c5bd7d2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:45 +02:00
Michael Niedermayer aa26e3fce7 avfilter/vf_swaprect: assert that rectangles are within memory
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9d1ba698d2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:44 +02:00
Michael Niedermayer e6d1ed99ae avfilter/af_alimiter: Check nextpos before use
Fixes: out of array read
Fixes: tickets/10744/poc11ffmpeg

Found-by: Li Zeyuan and Zeng Yunxiang.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a88b06f9ee)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:44 +02:00
Michael Niedermayer 5715c8ed18 avfilter/af_stereowiden: Check length
Fixes: out of array access
Fixes: tickets/10746/poc13ffmpeg

Found-by: Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 50f0f8c53c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:44 +02:00
Michael Niedermayer 4d9f97ffb1 avfilter/vf_weave: Fix odd height handling
Fixes: out of array access
Fixes: tickets/10743/poc10ffmpeg

Found-by: Zeng Yunxiang and Li Zeyuan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ecc1f0e48)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:43 +02:00
Michael Niedermayer a3eb80824f avfilter/vf_gradfun: Do not overread last line
The code works in steps of 2 lines and lacks support for odd height
Implementing odd height support is better but for now this fixes the
out of array access

Fixes: out of array access
Fixes: tickets/10702/poc6ffmpe

Found-by: Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e4d2666bdc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:43 +02:00
Michael Niedermayer bb9390148c avformat/mov: do not set sign bit for chunk_offsets
Fixes: signed integer overflow: 2314885530818453536 - -7412889664301817824 cannot be represented in type 'long'
Fixes: 64296/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6304027146846208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cfc0a68d4d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:43 +02:00
Michael Niedermayer 3044269ae8 avcodec/jpeglsdec: Check Jpeg-LS LSE
Fixes: signed integer overflow: 2147478526 + 33924 cannot be represented in type 'int'
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 64243/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-5195717848989696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c72a20f01a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:42 +02:00
Brad Smith 033d431f15 configure: Enable section_data_rel_ro for FreeBSD and NetBSD aarch64 / arm
Fixes the build. It's a requirement when utilizing PIE.

Signed-off-by: Brad Smith <brad@comstyle.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6066c430e3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:42 +02:00
Michael Niedermayer 581b4c6958 avformat/mov: Ignore duplicate ftyp
Fixes: switch_1080p_720p.mp4
Found-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4cdf2c7f76)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:42 +02:00
Dale Curtis 84b928f90f avformat/mov: Fix integer overflow in mov_read_packet().
Fixes https://crbug.com/1499669:
runtime error: signed integer overflow: 9223372036853334272 + 1375731456
cannot be represented in type 'int64_t' (aka 'long')

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2182173a69)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:41 +02:00
Martin Storsjö bd7a10a2a8 seek: Fix crashes in ff_seek_frame_binary if built with latest Clang 14
Passing an uninitialized variable as argument to a function is
undefined behaviour (UB). The compiler can assume that UB does not
happen.

Hence, the compiler can assume that the variables are never
uninitialized when passed as argument, which means that the codepaths
that initializes them must be taken.

In ff_seek_frame_binary, this means that the compiler can assume
that the codepaths that initialize pos_min and pos_max are taken,
which means that the conditions "if (sti->index_entries)" and
"if (index >= 0)" can be optimized out.

Current Clang git versions (upcoming Clang 14) enabled an optimization
that does this, which broke the current version of this function
(which intentionally left the variables uninitialized, but silencing
warnings about being uninitialized). See [1] for discussion on
the matter.

[1] https://reviews.llvm.org/D105169#3069555

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit ab79263419)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:41 +02:00
Michael Niedermayer 5c66a58602 avcodec/4xm: Check for cfrm exhaustion
Fixes: index -1 out of bounds for type 'CFrameBuffer [100]'
Fixes: 63877/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5854263397711872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bb0a684d93)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:41 +02:00
Michael Niedermayer 7272c11132 avformat/mov: Disallow FTYP after streams
Fixes: Assertion !c->fc->nb_streams failed at libavformat/mov.c:7799
Fixes: 63875/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5479178702815232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 19fcf43131)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:40 +02:00
Frank Plowman d6b9852317 doc/html: fix styling issue with Texinfo 7.0
Texinfo 7.0 produces quite different HTML to Texinfo 6.8. Without
this change, enumerated option flags (i.e. Possible values of x
are...) render as white text on a white background with Texinfo 7.0
and are unreadable. This change removes a style for the selector
`.table .table` which causes the background to turn white for these
elements. As far as I can tell, it is not actually used anywhere in
files generated by Texinfo 6.8.

Signed-off-by: Frank Plowman <post@frankplowman.com>
(cherry picked from commit f16900bda2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:40 +02:00
Frank Plowman 6a9e2b4cda doc/html: support texinfo 7.0
Resolves trac ticket #10636 (http://trac.ffmpeg.org/ticket/10636).

Texinfo 7.0, released in November 2022, changed the names of various
functions. Compiling docs with Texinfo 7.0 resulted in warnings and
improperly formatted documentation. More old names appear to have
been removed in Texinfo 7.1, released October 2023, which causes docs
compilation to fail.

This commit addresses the issue by adding logic to switch between the old
and new function names depending on the Texinfo version. Texinfo 6.8
produces identical documentation before and after the patch.

CC
https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1938238.html
https://bugs.gentoo.org/916104

Signed-off-by: Frank Plowman <post@frankplowman.com>
(cherry picked from commit f01fdedb69)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:40 +02:00
Matthew White 2c49783d05 doc/t2h.pm: fix missing TOC with texinfo 6.8 and above
Since texinfo 6.8, there's no longer an INLINE_CONTENTS variable.

makeinfo: warning: set_from_init_file: unknown variable INLINE_CONTENTS

texinfo commit 62a6adfb33b006e187483779974bbd45f0f782b1 replaced
INLINE_CONTENTS with OUTPUT_CONTENTS_LOCATION.

texinfo commit 41f8ed4eb42bf6daa7df7007afd946875597452d replaced
OUTPUT_CONTENTS_LOCATION with CONTENTS_OUTPUT_LOCATION.

With texinfo 6.8 and above, the same as INLINE_CONTENTS=1 could be
achieved by CONTENTS_OUTPUT_LOCATION=inline.
https://www.gnu.org/software/texinfo/manual/texinfo/html_node/HTML-Customization-Variables.html

(cherry picked from commit bfbd5954e5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:39 +02:00
Matthew White 84ffcbd810 doc/t2h.pm: fix missing CSS with texinfo 6.8 and above
Since texinfo commit 6a5ceab6a48a4f052baad9f3474d741428409fd7, the
formatting functions, in particular begin_file, program_string and
end_file, are prefixed with format_, i.e. format_begin_file, etc.

This patch fixes building the documentation when texinfo 6.8, or
above, is used:

Unknown formatting type begin_file
 at /usr/bin/makeinfo line 415.
Unknown formatting type program_string
 at /usr/bin/makeinfo line 415.
Unknown formatting type end_file
 at /usr/bin/makeinfo line 415.

(cherry picked from commit c980dd7a97)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:39 +02:00
Andreas Rheinhardt 3d7330a39f avformat/matroskadec: Fix declaration-after-statement warnings
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 37b5f4a1f6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:39 +02:00
Michael Niedermayer 0077a817a1 avformat/rtsp: Use rtsp_st->stream_index
Fixes: out of array access
Fixes: rtpdec_h264.c149/poc

Found-by: Hardik Shah of Vehere
Reviewed-by: Martin Storsjö <martin@martin.st>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e4d5ac8d7d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:38 +02:00
Michael Niedermayer 30ee2f61ae avcodec/jpeg2000dec: Check image offset
Fixes: left shift of negative value -538967841
Fixes: 62447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-6427134337613824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 88453250db)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:38 +02:00
Michael Niedermayer 272887983c avformat/mxfdec: Check klv offset
Fixes: Assertion klv_offset >= mxf->run_in failed at libavformat/mxfdec.c:736
Fixes: 62936/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5778404366221312.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 70f5fa6325)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:38 +02:00
Sean McGovern 71843d8174 libavutil/ppc/cpu.c: check that AT_HWCAP2 is defined
It was not introduced until glibc 2.18.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d799ad2404)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:37 +02:00
Michael Niedermayer 89745c5354 avcodec/h2645_parse: Avoid EAGAIN
EAGAIN causes an assertion failure when it is returned from the decoder

Fixes: Assertion consumed != (-(11)) failed at libavcodec/decode.c:462
Fixes: assertion_IOT_instruction_decode_c_462/poc

Found-by: Hardik Shah of Vehere (Dawn Treaders team)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5ddab49d48)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:37 +02:00
Michael Niedermayer 8b9e9ba0c2 avcodec/xvididct: Make c* unsigned to avoid undefined overflows
Fixes: signed integer overflow: 1496950099 + 728014168 cannot be represented in type 'int'
Fixes: 62667/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEGB_fuzzer-6511785170305024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f7e5537dc1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:37 +02:00
Michael Niedermayer 1ccf76fd72 avformat/tmv: Check video chunk size
This check matches the audio chunk check

Fixes: Timeout
Fixes: 62681/clusterfuzz-testcase-minimized-ffmpeg_dem_TMV_fuzzer-5299107876700160

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b79fc70596)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:36 +02:00
Michael Niedermayer e449d52810 avcodec/h264_parser: saturate dts a bit
Fixes: signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-6112289464123392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7fedbc7606)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:36 +02:00
Michael Niedermayer b73688e921 avformat/asfdec_f: Saturate presentation time in marker
Fixes: signed integer overflow: -9223372036315799520 - 3873890816 cannot be represented in type 'long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5009302746431488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cedb4736f5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:36 +02:00
Michael Niedermayer 330e0a691c avformat/xwma: sanity check bits_per_coded_sample
Fixes: signed integer overflow: 65312 * 524296 cannot be represented in type 'int'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_XWMA_fuzzer-6595971445555200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fe6ce28d11)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:35 +02:00
Michael Niedermayer 6d95339161 avformat/matroskadec: Check prebuffered_ns for overflow
Fixes: signed integer overflow: 9223372036630775808 + 1000000000 cannot be represented in type 'long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-5406131992526848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2d6df3719d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:35 +02:00
Michael Niedermayer af121ad20d avformat/wavdec: Check left avio_tell for overflow
Fixes: signed integer overflow: 155 + 9223372036854775655 cannot be represented in type 'long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5364032278495232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 929ddef3f4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:35 +02:00
Michael Niedermayer 75d9ad3759 avformat/tta: Better totalframes check
Fixes: signed integer overflow: 4 * 740491135 cannot be represented in type 'int'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_TTA_fuzzer-6298893367508992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f0d00464a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:34 +02:00
Michael Niedermayer 5765e49ec3 avformat/rpl: Check for number_of_chunks overflow
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int32_t' (aka 'int')
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-6086131095830528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b3c973acbe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:34 +02:00
Michael Niedermayer 2f663c6125 avformat/mov: compute absolute dts difference without overflow in mov_find_next_sample()
Fixes: signed integer overflow: -9223372036854775808 - 9222726413022000000 cannot be represented in type 'long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5959420033761280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3508b496e1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:34 +02:00
Michael Niedermayer 8316cec3b1 avformat/jacosubdec: Check timeres
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 51f0ab8b12)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:33 +02:00
Michael Niedermayer 18743477da avformat/jacosubdec: avoid signed integer overflows in get_shift()
Fixes: signed integer overflow: 22014562800 * 934633746 cannot be represented in type 'long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-5189603246866432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 32447b149f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:33 +02:00
Michael Niedermayer 022e8c9021 avformat/jacosubdec: Factorize code in get_shift() a bit
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6490b9aed6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:33 +02:00
Michael Niedermayer ee6d5dd13b avcodec/escape124: Do not return random numbers
Fixes: out of array access
Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-6035022714634240
Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-6422176201572352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fe6d46490f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:32 +02:00
Michael Niedermayer 454eac7b87 avformat/avs: Check if return code is representable
Fixes: leak
Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS_fuzzer-6738814988320768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 52d666edec)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:32 +02:00
Michael Niedermayer 5371943592 avcodec/lcldec: Make PNG filter addressing match the code afterwards
Also update check accordingly

Fixes: tickets/10237/mszh_306_306_yuv422_nocompress.avi
Fixes: tickets/10237/mszh_306_306_yuv411_nocompress.avi

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d11b8bd0c6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:32 +02:00
Michael Niedermayer 8101135606 avformat/westwood_vqa: Check chunk size
the type is also changed to int as it is interpreted as int in av_get_packet()

Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_WSVQA_fuzzer-6593408795279360
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_WSVQA_fuzzer-4613908817903616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5c0df3da0b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:31 +02:00
Michael Niedermayer 9fd6d62eb5 avformat/sbgdec: Check for period overflow
Fixes: signed integer overflow: 4481246996173000000 - -4778576820000000000 cannot be represented in type 'long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-5063670588899328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a9137110ed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:31 +02:00
Michael Niedermayer 559b379cbd avformat/concatdec: Check in/outpoint for overflow
Fixes: signed integer overflow: 91542414454000000 - -9154241494546000000 cannot be represented in type 'long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-4739147999084544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dedc78b4b5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:31 +02:00
Michael Niedermayer 83c99e5ac1 avcodec/xvididct: Fix integer overflow in idct_row()
Fixes: signed integer overflow: 1871429831 + 343006811 cannot be represented in type 'int'
Fixes: 61784/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AIC_fuzzer-5372151001120768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b12444fe72)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:30 +02:00
Michael Niedermayer 242f410a70 avcodec/celp_math: avoid overflow in shift
by making gain unsigned we have 1 bit more available
alternatively we can clip twice as in the g729 reference

Fixes: left shift of 23404 by 17 places cannot be represented in type 'int'
Fixes: 61728/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-6280412547383296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6580a7b2b2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:30 +02:00
Michael Niedermayer 225c89f402 tools/target_dec_fuzzer: Adjust threshold for rtv1
Fixes: 60499/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RTV1_fuzzer-5020295866744832
Fixes: Timeout

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9ee87245c5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:30 +02:00
Michael Niedermayer 0318ed865b avformat/hls: reduce default max reload to 3
The 1000 did result in the appearance of a never ending reload loop

The RFC mandates that "If the client reloads a Playlist file and finds that it has not
changed, then it MUST wait for a period of one-half the target
duration before retrying." and if it has changed
"the client MUST wait for at least the target duration before attempting to reload the
Playlist file again"

Trying to reload 3 times seems a better default than 1000 given these
durations

Issue found by: Сергей Колесников
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f810435c2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:29 +02:00
Michael Niedermayer 12437cfbf0 avformat/format: Stop reading data at EOF during probing
Issue found by: Сергей Колесников
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 80f6e0378b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:29 +02:00
Michael Niedermayer 9e9a7cc4fa avcodec/huffyuvdec: avoid undefined behavior with get_vlc2() failure
Fixes: left shift of negative value -1
Fixes: 59889/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HUFFYUV_fuzzer-5472742275940352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 90647a9249)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:29 +02:00
Michael Niedermayer e93ee8f8d8 avcodec/cscd: Fix "CamStudio Lossless Codec 1.0" gzip files
Fixes: tickets/10241/cscd_1_0_306_306_gzip.avi

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ab7d38f970)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:28 +02:00
Michael Niedermayer 10212e7a0f avcodec/cscd: Check for CamStudio Lossless Codec 1.0 behavior in end check of LZO files
Alternatively the check could be simply made more tolerant
Fixes: Ticket10227

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d2a0464fc2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:28 +02:00
Michael Niedermayer 8659d16f68 avcodec/hevcdec: Fix undefined memcpy()
There is likely a better way to fix this, this is mainly to show the problem

Fixes: MC within same frame resulting in overlapping memcpy()
Fixes: 60189/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4992746590175232
Fixes: 61753/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5022150806077440
Fixes: 58062/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4717458841010176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 94bd1796ff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:28 +02:00
Michael Niedermayer cb4ffd639e avcodec/mpeg4videodec: more unsigned in amv computation
Fixes: signed integer overflow: -2147483648 + -1048576 cannot be represented in type 'int'
Fixes: 59365/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-642654923954585

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0adaa90d89)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:27 +02:00
Michael Niedermayer 98c823f60c avcodec/tta: fix signed overflow in decorrelate
Fixes: signed integer overflow: 2079654542 - -139267653 cannot be represented in type 'int'
Fixes: 60811/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5915858409750528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 283bf5c35b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:27 +02:00
Michael Niedermayer 4695759985 avcodec/apedec: Fix CRC for 24bps and bigendian
Fixes CRC for vlc.ape and APE_48K_24bit_2CH_02_01.ape

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 696e161919)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:27 +02:00
Michael Niedermayer 13d0022307 avcodec/xvididct: Fix integer overflow in idct_row()
Fixes: signed integer overflow: -1403461578 + -843974775 cannot be represented in type 'int'
Fixes: 60868/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-4599793035378688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ce322a51e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:26 +02:00
Michael Niedermayer 5a88bf8ee7 avformat/avr: Check sample rate
Fixes: 54979/clusterfuzz-testcase-minimized-ffmpeg_dem_AVR_fuzzer-6681035461230592
Fixes: Timeout

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 32556fa62b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:26 +02:00
Michael Niedermayer 53e3119d0f avcodec/jpeg2000dec: Check for reduction factor and image offset
This combination is not working (it writes out of array)

Reviewed-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9b6d191a66)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:26 +02:00
Michael Niedermayer 949636ca60 avutil/softfloat: Basic documentation for av_sincos_sf()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4aa1a42a91)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:25 +02:00
Michael Niedermayer 2c57b7c65b avutil/softfloat: fix av_sincos_sf()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d84677abd8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:25 +02:00
Michael Niedermayer 5524362efb avcodec/utils: fix 2 integer overflows in get_audio_frame_duration()
Fixes: signed integer overflow: 256 * 668003712 cannot be represented in type 'int'
Fixes: 59819/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-4674636538052608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a4bf559683)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:25 +02:00
Michael Niedermayer 99c01fa0df avcodec/hevcdec: Avoid null pointer dereferences in MC
Fixes: runtime error: pointer index expression with base 0x000000000000 overflowed to 0xfffffffffffffff8
Fixes: 58440/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5956015530311680

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a0f4d4e650)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:24 +02:00
Michael Niedermayer 9280883d98 avcodec/takdsp: Fix integer overflows
Fixes: avcodec/takdsp.c:44:23: runtime error: signed integer overflow: -2097158 - 2147012608 cannot be represented in type 'int'
Fixes: 58417/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5268919664640000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ff8a496d41)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:24 +02:00
Michael Niedermayer 72c57f8938 avcodec: Ignoring errors is only possible before the input end
Fixes: out of array read
Fixes: Ticket 10308

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fead656a7b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:24 +02:00
Michael Niedermayer 2dcc7dbba8 avcodec/noise_bsf: Check for wrapped frames
Wrapped frames contain pointers so they need specific code to
noise them, the generic code would lead to segfaults

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0889ebc577)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:23 +02:00
Michael Niedermayer 724f2b3fbd avformat/oggparsetheora: clip duration within 64bit
Fixes: signed integer overflow: 9079256848778919936 - -288230376151711746 cannot be represented in type 'long'
Fixes: 58248/clusterfuzz-testcase-minimized-ffmpeg_dem_OGG_fuzzer-6326851353313280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b1c3d81e71)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:23 +02:00
Michael Niedermayer 006ac8b4b5 avformat/wavdec: Check that smv block fits in available space
Fixes: OOM
Fixes: 56271/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-5290810045497344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a76efafdb9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:23 +02:00
Michael Niedermayer b56dc43f8f avcodec/tiff: add a zero DNG_LINEARIZATION_TABLE check
Fixes: index 4294967295 out of bounds for type 'uint16_t [65536]'
Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5950405086674944
Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-6666195176914944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6e98cf0280)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:22 +02:00
Michael Niedermayer 98310766fc avcodec/tak: Check remaining bits in ff_tak_decode_frame_header()
Fixes: out of array access
Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-6682195323650048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 19b66b89da)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:22 +02:00
Michael Niedermayer cfdd9a59ff avcodec/utils: the IFF_ILBM implementation assumes that there are a multiple of 16 allocated
Fixes: out of array access
Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5124452659888128
Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-6362836707442688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 34056a94ea)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:22 +02:00
Michael Niedermayer 8d93e90c6d avcodec/pngdec: Do not pass AVFrame into global header decode
The global header should not contain a frame, and decoding it
would result in leaks

Fixes: memleak
Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-6603443149340672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d31d4f3228)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:21 +02:00
Michael Niedermayer 941c6191fc avcodec/vorbisdec: Check codebook float values to be finite
Fixes: Timeout
Fixes: 55116/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-4572159970508800

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cadd7e7a75)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:21 +02:00
Michael Niedermayer 8b8c610821 avcodec/g2meet: Replace fake allocation avoidance for framebuf
framebuf is only allocated when the new width/height are larger than the old
but nothing sets the old so its always allocated.
Use av_fast_mallocz() instead.

Fixes: Timeout
Fixes: 55094/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5116909932904448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 38adbc6eeb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:21 +02:00
Michael Niedermayer 22106d274b avcodec/lcldec: More space for rgb24
Fixes: Ticket 10239
Fixes: zlib_306_306_rgb24.av

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e2c3aa8e2b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:20 +02:00
Michael Niedermayer d4966d6324 avcodec/lcldec: Support 4:1:1 and 4:2:2 with odd width
Fixes: Ticket10240
Fixes: zlib_306_306_yuv422.avi
Fixes: zlib_306_306_yuv411.avi

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0cf1ac905d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:20 +02:00
Michael Niedermayer 99e0f485a5 libavcodec/lcldec: width and height should not be unsigned
Computations like col < width - 3 will not work with unsigned width=1

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3eb4e28c26)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-14 21:19:20 +02:00
Rémi Denis-Courmont 93ecf08934 avcodec/x86/mathops: clip constants used with shift instructions within inline assembly
Fixes assembling with binutil as >= 2.41

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit effadce6c7)
2024-04-03 18:50:26 -03:00
Anton Khirnov 031c9601d0 lavc/pthread_frame: avoid leaving stale hwaccel state in worker threads
This state is not refcounted, so make sure it always has a well-defined
owner.

Remove the block added in 091341f2ab, as
this commit also solves that issue in a more general way.

(cherry picked from commit cc867f2c09)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 35aa7e70e7ec350319e7634a30d8d8aa1e6ecdda)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 3bc28e9d1ab33627cea3c632dd6b0c33e22e93ba)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit d4b7b3c03e)
2024-04-03 18:50:26 -03:00
Eugene Zemtsov cda5d4698c avformat/mov: Check if a key is longer than the atom containing it
Stop reading keys and return AVERROR_INVALIDDATA if key_size
is larger than the amount of space left in the atom.

Bug: https://crbug.com/41496983
Signed-off-by: Eugene Zemtsov <eugene@chromium.org>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 8a23a145d8)
2024-04-02 09:20:11 -03:00
Timo Rothenpieler fa9a0e7f3e avcodec/nvdec: reset bitstream_len/nb_slices when resetting bitstream pointer 2024-03-30 00:26:32 +01:00
James Almer 4d2cc90fa4 avformat/mov: don't abort on duplicate Mastering Display Metadata boxes
The VP9 spec defines a SmDm box for this information, and the ISOBMFF spec defines a
mdvc one. If both are present, just ignore one of them.
This is in line with clli and CoLL boxes.

Fixes ticket #10711.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 189c32f536)
2024-03-27 13:57:02 -03:00
Hendrik Leppkes f74196e146 avcodec/vdpau_mpeg4: fix order of quant matrix coefficients
The matrix coefficients are stored permutated for the IDCT,
rather then in plain raster order, and need to be un-permutated
for the hardware.
2023-05-15 18:48:57 +02:00
Hendrik Leppkes 74d424470c avcodec/vdpau_mpeg12: fix order of quant matrix coefficients
The matrix coefficients are stored permutated for the IDCT,
rather then in plain raster order, and need to be un-permutated
for the hardware.
2023-05-15 18:48:57 +02:00
Hendrik Leppkes 410ccbbe8c avcodec/nvdec_mpeg4: fix order of quant matrix coefficients
The matrix coefficients are stored permutated for the IDCT,
rather then in plain raster order, and need to be un-permutated
for the hardware.
2023-05-15 18:48:57 +02:00
Hendrik Leppkes 865eca9321 avcodec/nvdec_mpeg2: fix order of quant matrix coefficients
The matrix coefficients are stored permutated for the IDCT,
rather then in plain raster order, and need to be un-permutated
for the hardware.
2023-05-15 18:48:57 +02:00
Jiasheng Jiang d811434b5d avformat/nutdec: Add check for avformat_new_stream
Check for failure of avformat_new_stream() and propagate
the error code.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9cf652cef4)
2023-04-16 10:51:12 -03:00
Michael Niedermayer 91b54b3bba Update for FFmpeg 4.3.6
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-16 02:22:28 +02:00
Michael Niedermayer 538fe62224 avcodec/escape124: Check that blocks are allocated before use
Fixes: NULL pointer dereference
Fixes: 57819/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-5077280228769792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5366ae12b9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:13 +02:00
Michael Niedermayer 07990a8d62 avcodec/huffyuvdec: Fix undefined behavior with shift
Fixes: left shift of negative value -1
Fixes: 57554/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFVHUFF_fuzzer-4853603839115264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 27e7857bd1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:13 +02:00
Michael Niedermayer 9db48c5bc7 avcodec/j2kenc: Replace RGB24 special case by generic test
This fixes RGB48 with libavcodec as decoder

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ad4d647591)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:12 +02:00
Michael Niedermayer 40c0e965c6 avcodec/j2kenc: Fix funky bpno errors on decoding
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 816676085e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:12 +02:00
Michael Niedermayer e25d8a4228 avcodec/j2kenc: remove misleading pred value
This field is only checked for being 0 or not and not zero means 5/3

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0adb375377)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:12 +02:00
Michael Niedermayer b66b297e58 avcodec/j2kenc: fix 5/3 DWT identifer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f6955b6df4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:11 +02:00
Michael Niedermayer abddc911ff avcodec/vp3: Check width to avoid assertion failure
Fixes: Assertion failure on x86-32
       av_assert2(block_w * sizeof(pixel) <= FFABS(buf_linesize)); in ff_emulated_edge_mc()
Fixes: 39641/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-5925660741206016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dab1cd2dc0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:11 +02:00
Michael Niedermayer 8ee94724df avcodec/g729postfilter: Limit shift in long term filter
Fixes: shift exponent 34 is too large for 32-bit type 'int'
Fixes: 57389/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-6229522659016704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6d1d8609ac)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:11 +02:00
Lynne 382347055d configure: update copyright year
(cherry picked from commit 62da0b4a74)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:10 +02:00
Michael Niedermayer f6961854f6 avcodec/tests/snowenc: Fix 2nd test
(cherry picked from commit 163013c724)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:10 +02:00
Michael Niedermayer 6363556eba avcodec/tests/snowenc: return a failure if DWT/IDWT mismatches
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 771c266c0b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:10 +02:00
Michael Niedermayer f682b22cef avcodec/snowenc: Fix visual weight calculation
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5b5fcadea0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:09 +02:00
Michael Niedermayer a7eca40cb8 avcodec/tests/snowenc: unbreak DWT tests
the IDWT data type mismatched current code

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8b3351bbea)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:09 +02:00
Michael Niedermayer ebbf85def8 avcodec/escape124: Fix some return codes
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 98df605f7a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:09 +02:00
Michael Niedermayer c561d93039 avcodec/escape124: fix signdness of end of input check
Fixes: Timeout
Fixes: 56561/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-5560363635834880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 87ad0a5dd7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:08 +02:00
Michael Niedermayer 1e6706193f Use https for repository links
Reviewed-by: Stefano Sabatini <stefasab@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 011f30fc82)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:08 +02:00
Michael Niedermayer 4bd974e426 avcodec/motionpixels: Mask pixels to valid values
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOTIONPIXELS_fuzzer-6724203352555520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ac6eec1fc2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:08 +02:00
Michael Niedermayer f07f46121a avcodec/xpmdec: Check size before allocation to avoid truncation
Fixes:OOM
Fixes:out of array access (no testcase)
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XPM_fuzzer-6573323838685184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 95f0f84dae)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:07 +02:00
Michael Niedermayer 1ddfac5fad avcodec/bink: Avoid undefined out of array end pointers in binkb_decode_plane()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ea9deafd3b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:07 +02:00
Michael Niedermayer bc8b9111d3 avcodec/bink: Fix off by 1 error in ref end
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6657932926517248

Alterantivly to this it is possibly to allocate a bigger array

Note: oss-fuzz assigned this issue to a unrelated theora bug so the bug number matches that

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 49487045dd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:07 +02:00
Michael Niedermayer 7b5c345525 avcodec/utils: Ensure linesize for SVQ3
Fixes: Assertion block_w * sizeof(uint8_t) <= ((buf_linesize) >= 0 ? (buf_linesize) : (-(buf_linesize))
Fixes: 54861/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-5352418248622080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4eef658ca5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:06 +02:00
Michael Niedermayer 4abb9d14b9 avcodec/utils: allocate a line more for VC1 and WMV3
Fixes: out of array read on 32bit
Fixes: 54857/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5840588224462848

The chroma MC code reads over the currently allocated frame.
Alternative fixes would be allocating a few bytes more at the end instead of a whole
line extra or to adjust the threshold where the edge emu code is activated

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 01636a63d4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:06 +02:00
Michael Niedermayer f0ecc9b12f avcodec/videodsp_template: Adjust pointers to avoid undefined pointer things
Fixes: subtraction of unsigned offset from 0xf6602770 overflowed to 0xf6638c80
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-495074400600064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f0150cd41c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:06 +02:00
Michael Niedermayer 88069ea6c9 avcodec/pngdec: Check deloco index more exactly
Fixes: out of array access:
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PNG_fuzzer-6716193709096960

Alternatively it should be possible to limit this to 3 plane RGB 8 /16bit to ensure the size is what it should be

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d5bae70406)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:05 +02:00
Michael Niedermayer 284116d32d avcodec/ffv1dec: Check that num h/v slices is supported
Fixes: out of array access
Fixes: 55597/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-4898293416329216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8ead0ae68e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:05 +02:00
Michael Niedermayer d29a054915 avformat/mov: Check samplesize and offset to avoid integer overflow
Fixes: signed integer overflow: 9223372036854775584 + 536870912 cannot be represented in type 'long'
Fixes: 55844/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-510613920664780

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 53c1f5c2e2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:05 +02:00
Michael Niedermayer b84a46de00 avcodec/pictordec: Remove mid exit branch
This causes the RLE decoder to exit before applying the last RLE run
All images i tested with are unchanged, this makes the special case
for handling the last run unused for non truncated images.

Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 88f0e05c72)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:04 +02:00
Michael Niedermayer 8488b49faf avcodec/eac3dec: avoid float noise in fixed mode addition to overflow
Fixes: 2.28595e+09 is outside the range of representable values of type 'int'
Fixes: 54644/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AC3_FIXED_fuzzer-4816961584627712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2f48d227c1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:04 +02:00
Michael Niedermayer 4c9ba64d54 avcodec/utils: use 32pixel alignment for bink
bink supports 16x16 blocks in chroma planes thus we need to allocate enough.
Fixes: out of array access
Fixes: 55026/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6013915371012096
Reviewed-by: Peter Ross <pross@xvid.org>

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b95b2c8492)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:04 +02:00
Michael Niedermayer b353459820 avcodec/scpr3: Check bx
Fixes: Out of array access
Fixes: 55102/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-4877396618903552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cc7e984a05)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:03 +02:00
Michael Niedermayer 79d40346f5 avcodec/012v: Order operations for odd size handling
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZERO12V_fuzzer-6714182078955520.fuzz
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZERO12V_fuzzer-6698145212137472.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4d42d82563)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:03 +02:00
Michael Niedermayer 54635b3b98 avcodec/eatgq: : Check index increments in tgq_decode_block()
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATGQ_fuzzer-6743211456724992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e7755b433e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:03 +02:00
Michael Niedermayer 83ae0935ab avcodec/scpr: Test bx before use
Fixes: out of array access on 32bit
Fixes: 54850/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-5302669294305280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b59de3770)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:02 +02:00
Michael Niedermayer 76ab2538ed avformat/mxfdec: Use 64bit in remainder
Fixes: signed integer overflow: 48000 * 223587 cannot be represented in type 'int'
Fixes: 54513/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5817594836025344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 64a04fc165)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:02 +02:00
Michael Niedermayer 7b51ee2dab avcodec/sunrast: Fix maplength check
Fixes: out of bounds read

Found-by: Ibrahim Mohamed <ielsayed@meta.com>
Reviewed-by; Ibrahim Mohamed <ielsayed@meta.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f8a2a65078)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:02 +02:00
Michael Niedermayer 9667007462 avcodec/wavpack: Avoid undefined shift in get_tail()
Fixes: left shift of 1208485947 by 1 places cannot be represented in type 'int'
Fixes: 54058/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5827521084260352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8374a747af)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:01 +02:00
Michael Niedermayer 0e5ce7ac7e avcodec/wavpack: Check for end of input in wv_unpack_dsd_high()
Fixes: Timeout
Fixes: 50793/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-4980185027444736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6ad7403bce)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:01 +02:00
Michael Niedermayer 93a685accc avformat/id3v2: Check taglen in read_uslt()
Fixes: Timeout (read mostly the same data repeatly)
Fixes: 52457/clusterfuzz-testcase-minimized-ffmpeg_dem_ALP_fuzzer-6610706313379840
Fixes: 53098/clusterfuzz-testcase-minimized-ffmpeg_dem_SOL_fuzzer-6481382981632000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a798af91d7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:01 +02:00
Michael Niedermayer 6507719760 avcodec/tiff: Ignore tile_count
Fixes: out of array access
Fixes: 52427/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4849108968144896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 65ce417828)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:00 +02:00
Michael Niedermayer 1ff546c033 avcodec/ffv1dec: restructure slice coordinate reading a bit
Fixes: signed integer overflow: -1094995528 * 8224 cannot be represented in type 'int'
Fixes: 53508/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-474551033462784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 74b6ac7ebb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:00 +02:00
Michael Niedermayer 8f89df7df9 avcodec/mlpdec: Check max matrix instead of max channel in noise check
This is a regression since: adaa06581c
Before this, max_channel and  max_matrix_channel where compared for equality

Fixes: out of array access
Fixes: 53340/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-514959011885875

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aa79560de5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:38:00 +02:00
Michael Niedermayer 9ee16a0ba2 swscale/input: Use more unsigned intermediates
Same principle as previous commit, with sufficiently huge rgb2yuv table
values this produces wrong results and undefined behavior.
The unsigned produces the same incorrect results. That is probably
ok as these cases with huge values seem not to occur in any real
use case.

Fixes: signed integer overflow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ba209e3d51)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:37:59 +02:00
Michael Niedermayer 19d7bbc1f0 avcodec/alsdec: The minimal block is at least 7 bits
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5280947fb6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:37:59 +02:00
Michael Niedermayer f09a1d83da avformat/replaygain: avoid undefined / negative abs
Fixes: signed integer overflow: -2147483648 * 100000 cannot be represented in type 'int'
Fixes: 52060/clusterfuzz-testcase-minimized-ffmpeg_dem_MP3_fuzzer-5131616708329472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2532b20b17)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:37:59 +02:00
Michael Niedermayer d1c90886cc swscale/output: Bias 16bps output calculations to improve non overflowing range
Fixes: integer overflow
Fixes: ./ffmpeg   -f rawvideo -video_size 66x64 -pixel_format yuva420p10le   -i ~/videos/overflow_input_w66h64.yuva420p10le   -filter_complex "scale=flags=bicubic+full_chroma_int+full_chroma_inp+bitexact+accurate_rnd:in_color_matrix=bt2020:out_color_matrix=bt2020:in_range=full:out_range=full,format=rgba64[out]"   -pixel_format rgba64 -map '[out]'   -y overflow_w66h64.png

Found-by: Drew Dunne <asdunne@google.com>
Tested-by: Drew Dunne <asdunne@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0f0afc7fb5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:37:58 +02:00
Michael Niedermayer a321349464 avcodec/speedhq: Check buf_size to be big enough for DC
Fixes: Timeout
Fixes: 51919/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-6023716480090112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9184d3d7b6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:37:58 +02:00
Michael Niedermayer 5b23daa99f avcodec/ffv1dec: Fail earlier if prior context is corrupted
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4df91e2215)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-04-15 22:37:58 +02:00
James Almer c3981b30a8 avfilter/vf_untile: swap the chroma shift values used for plane offsets
Fixes ticket #10265

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit dc61d5cf19)
2023-03-16 17:10:43 -03:00
Jiasheng Jiang 7694a44baa avcodec/vp3: Add missing check for av_malloc
Since the av_malloc() may fail and return NULL pointer,
it is needed that the 's->edge_emu_buffer' should be checked
whether the new allocation is success.

Fixes: d14723861b ("VP3: fix decoding of videos with stride > 2048")
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
2022-12-18 07:50:02 -03:00
Timo Rothenpieler 540b9826b3 avcodec/nvenc: fix vbv buffer size in cq mode
The CQ calculation gets thrown off and behaves very nonsensical
if it isn't set to 0.
2022-12-08 12:40:24 +01:00
James Almer 3b11b5f2f3 avcodec/mjpegenc: take into account component count when writing the SOF header size
Fixes ticket #10069

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 1009396953)
2022-11-28 08:46:53 -03:00
Martin Storsjö 3993a90732 swscale: aarch64: Fix yuv2rgb with negative strides
Treat the 32 bit stride registers as signed.

Alternatively, we could make the stride arguments ptrdiff_t instead
of int, and changing all of the assembly to operate on these
registers with their full 64 bit width, but that's a much larger
and more intrusive change (and risks missing some operation, which
would clamp the intermediates to 32 bit still).

Fixes: https://trac.ffmpeg.org/ticket/9985

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit cb803a0072)
Signed-off-by: Martin Storsjö <martin@martin.st>
2022-11-04 14:32:19 +02:00
Michael Niedermayer 74b7488739 Update for 4.3.5
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-10-10 21:50:30 +02:00
Michael Niedermayer 400d2d91b3 avformat/vividas: Check packet size
Fixes: signed integer overflow: 119760682 - -2084600173 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-6745781167587328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f44489cc5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-10-10 21:49:58 +02:00
Michael Niedermayer bc246da376 avcodec/dstdec: Check for overflow in build_filter()
Fixes: signed integer overflow: 1917019860 + 265558963 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-4833165046317056

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8008940da5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:51:04 +02:00
Michael Niedermayer a411aba2c9 avformat/spdifdec: Use 64bit to compute bit rate
Fixes: signed integer overflow: 32 * 553590816 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-6564974517944320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4075f0cec1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:51:04 +02:00
Michael Niedermayer a9eaeba875 avformat/rpl: Use 64bit for duration computation
Fixes: signed integer overflow: 24709512 * 88 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6737973728641024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 529f64b2eb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:51:03 +02:00
Michael Niedermayer 48b2e91f98 avformat/xwma: Use av_rescale() for duration computation
Fixes: signed integer overflow: 34242363648 * 538976288 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6577923913547776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2c789f753c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:51:03 +02:00
Michael Niedermayer 765b73c9be avformat/sdsdec: Use av_rescale() to avoid intermediate overflow in duration calculation
Fixes: signed integer overflow: 72128794995445727 * 240 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_SDS_fuzzer-6628185583779840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aa8eb1bed0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:51:03 +02:00
Michael Niedermayer 964fb9f59f avformat/sbgdec: Check ts_int in genrate_intervals
There is probably a better place to check for this, but better
here than nowhere

Fixes: signed integer overflow: -9223372036824775808 - 86400000000 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6601162580688896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f529e9147)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:51:02 +02:00
Michael Niedermayer f24aa3a531 avformat/rmdec: check tag_size
Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6598073725353984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2cb7ee8a36)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:51:02 +02:00
Michael Niedermayer d3c80525b0 avformat/nutdec: Check fields
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6566001610719232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2c146406ea)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:51:02 +02:00
Michael Niedermayer fc0678a1fd avformat/flvdec: Use 64bit for sum_flv_tag_size
Fixes: signed integer overflow: 2138820085 + 16130322 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_LIVE_FLV_fuzzer-6704728165187584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7124f10c1d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:51:01 +02:00
Michael Niedermayer 71e8a575da avformat/jacosubdec: Fix overflow in get_shift()
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-6722544461283328
Fixes: signed integer overflow: 48214448 * 60 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b1a68127bb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:51:01 +02:00
Michael Niedermayer 78ed283608 avformat/dxa: avoid bpc overflows
Fixes: signed integer overflow: 2147483647 + 32 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-6639823726706688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 93db0f0740)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:51:01 +02:00
Michael Niedermayer 650f0f97db avformat/cafdec: Check that nb_frasmes fits within 64bit
Fixes: signed integer overflow: 1099511693312 * 538976288 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6565048815845376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d4bb4e3759)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:51:00 +02:00
Michael Niedermayer bf9ac33cff avformat/asfdec_o: Limit packet offset
avoids overflows with it

Fixes: signed integer overflow: 9223372036846866010 + 4294967047 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6538296768987136
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-657169555665715

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 736e9e69d5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:51:00 +02:00
Michael Niedermayer 080c074c25 avformat/ape: Check frames size
Fixes: signed integer overflow: 9223372036854775806 + 3 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_APE_fuzzer-6389264140599296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d0349c9929)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:51:00 +02:00
Michael Niedermayer 2cdc8254eb avformat/icodec: Check nb_pal
Fixes: signed integer overflow: 538976288 * 4 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-6690068904935424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit db73ae0dc1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:59 +02:00
Michael Niedermayer b591a55e7a avformat/aiffdec: Use 64bit for block_duration use
Fixes: signed integer overflow: 3 * -2147483648 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6668935979728896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9303ba272e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:59 +02:00
Michael Niedermayer 68d39d6a4b avformat/aiffdec: Check block_duration
Fixes: signed integer overflow: 3 * -2147483648 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6668935979728896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1c2b6265c8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:59 +02:00
Michael Niedermayer 7b7e6478d9 avformat/mxfdec: only probe max run in
Suggested-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1182bbb2c3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:58 +02:00
Michael Niedermayer 663fa835cc avformat/mxfdec: Check run_in is within 65536
Fixes: signed integer overflow: 9223372036854775807 - -2146905566 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6570996594769920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7786097825)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:58 +02:00
Michael Niedermayer 37ac298e09 avcodec/mjpegdec: Check for unsupported bayer case
Fixes: out of array access
Fixes: 51462/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-662559341582745

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dd81cc22b3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:58 +02:00
Michael Niedermayer 5aecf2c1c0 avcodec/apedec: Fix integer overflow in filter_3800()
Fixes: signed integer overflow: -2147448926 + -198321 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5739619273015296
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6744428485672960

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f05247f6a4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:57 +02:00
Michael Niedermayer 3cf9bfa0d1 avcodec/tta: Check 24bit scaling for overflow
Fixes: signed integer overflow: -8427924 * 256 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5409428670644224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3993345f91)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:57 +02:00
Michael Niedermayer 900c4ffc48 avcodec/tiff: Fix loop detection
Fixes regression with tickets/4364/L1004220.DNG

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 43a4854510)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:57 +02:00
Michael Niedermayer 25d79ebbf5 libavformat/hls: Free keys
Fixes: memleak
Fixes: 50703/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-6399058578636800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d32a9f3137)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:56 +02:00
Michael Niedermayer 787e3af5de avcodec/fmvc: Move frame allocation to a later stage
This way more things are checked before allocation

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9783749c66)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:56 +02:00
Michael Niedermayer 9f1c9e4879 avfilter/vf_showinfo: remove backspaces
They mess with storing editing and comparing the results

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 31581ae7ee)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:56 +02:00
Michael Niedermayer 51d8a691dd avcodec/speedhq: Check width
Fixes: out of array access
Fixes: 50014/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-4748914632294400

Alternatively the buffer size can be increased

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f0395f9ef6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:55 +02:00
Michael Niedermayer 6106a5c936 avcodec/bink: disallow odd positioned scaled blocks
Fixes: out of array access
Fixes: 47911/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6194020855971840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b14104a637)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:55 +02:00
Michael Niedermayer f550cdb732 avformat/asfdec_o: limit recursion depth in asf_read_unknown()
The threshold of 5 is arbitrary, both smaller and larger should work fine

Fixes: Stack overflow
Fixes: 50603/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6049302564175872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1f1a368169)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:55 +02:00
Michael Niedermayer 4f552c1906 doc/git-howto.texi: Document commit signing
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ced0dc807e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:54 +02:00
Michael Niedermayer 4d1fd5c454 libavcodec/8bps: Check that line lengths fit within the buffer
Fixes: Timeout
Fixes: undefined pointer arithmetic
Fixes: 50330/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EIGHTBPS_fuzzer-5436287485607936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2316d5ec1a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:54 +02:00
Michael Niedermayer 16d6003b32 avcodec/midivid: Perform lzss_uncompress() before ff_reget_buffer()
This would avoid regeting the frame on lzss errors

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 628fb97efb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:54 +02:00
Michael Niedermayer d9c15655f9 libavformat/iff: Check for overflow in body_end calculation
Fixes: signed integer overflow: -6322983228386819992 - 5557477266266529857 cannot be represented in type 'long'
Fixes: 50112/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6329186221948928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bcb4690304)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:53 +02:00
Michael Niedermayer 47e4bab57a avformat/avidec: Prevent entity expansion attacks
Fixes: Timeout
Fixes no testcase, this is the same idea as similar attacks against XML parsers

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f3e823c2aa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:53 +02:00
Michael Niedermayer 33a6f36c0a avcodec/h263dec: Sanity check against minimal I/P frame size
Fixes: Timeout
Fixes: 49718/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4874987894341632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ca4ff9c21c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:53 +02:00
Michael Niedermayer fd78668885 avcodec/hevcdec: Check s->ref in the md5 path similar to hwaccel
This is somewhat redundant with the is_decoded check. Maybe
there is a nicer solution

Fixes: Null pointer dereference
Fixes: 49584/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5297367351427072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3b51e19922)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:52 +02:00
Michael Niedermayer ace963dd18 avformat/subviewerdec: Make read_ts() more flexible
Fixes: signed integer overflow: -1948269928 * 10 cannot be represented in type 'int'
Fixes: 49451/clusterfuzz-testcase-minimized-ffmpeg_dem_SUBVIEWER_fuzzer-6344614822412288

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit 58a8e739ef)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:52 +02:00
Michael Niedermayer 8cafce035c avcodec/mjpegdec: bayer and rct are incompatible
Fixes: out of array read
Fixes: 49434/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5208501080686592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a44f5a5212)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:52 +02:00
Michael Niedermayer bb6316e323 MAINTAINERS: Add ED25519 key for signing my commits in the future
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 05225180be)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:51 +02:00
Michael Niedermayer 5c145953a9 avcodec/hevc_filter: copy_CTB() only within width&height
Fixes: out of array access
Fixes: 49271/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5424984922652672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 009ef35d38)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:51 +02:00
Michael Niedermayer 0edd5feafa avformat/flvdec: Check for EOF in index reading
Fixes: Timeout
Fixes: 47992/clusterfuzz-testcase-minimized-ffmpeg_dem_LIVE_FLV_fuzzer-6020443879899136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ceff5d7b74)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:51 +02:00
Michael Niedermayer b60d9730cf avformat/nutdec: Check get_packetheader() in mainheader
Fixes; Timeout
Fixes: 48794/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6524604713140224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b5de084aa6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:50 +02:00
Michael Niedermayer a17ba6b3ce avformat/asfdec_f: Use 64bit for packet start time
Fixes: signed integer overflow: 2147483647 + 32 cannot be represented in type 'int'
Fixes: 49014/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-6314973315334144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8ed78486fc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:50 +02:00
Michael Niedermayer 69a441a922 tools/target_dec_fuzzer: Adjust threshold for MMVIDEO
Fixes: Timeout
Fixes: 49003/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MMVIDEO_fuzzer-5550368423018496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3592b05c84)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:50 +02:00
Michael Niedermayer 9ea37d4849 avcodec/lagarith: Check dst/src in zero run code
Fixes: out of array access
Fixes: 48799/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LAGARITH_fuzzer-4764457825337344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9450f75974)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:49 +02:00
Michael Niedermayer 23c31ef285 avcodec/h264dec: Skip late SEI
Fixes: Race condition
Fixes: clusterfuzz-testcase-minimized-mediasource_MP2T_AVC_pipeline_integration_fuzzer-6282675434094592

Found-by: google ClusterFuzz
Tested-by: Dan Sanders <sandersd@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f7dd408d64)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:49 +02:00
Michael Niedermayer 15263eb8c2 avcodec/sbrdsp_fixed: Fix integer overflows in sbr_qmf_deint_neg_c()
Fixes: signed integer overflow: 2147483645 + 16 cannot be represented in type 'int'
Fixes: 46993/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-4759025234870272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1537f40516)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:49 +02:00
Michael Niedermayer aec94df69b avfilter/vf_signature: Fix integer overflow in filter_frame()
Fixes: CID1403233

The second of the 2 changes may be unneeded but will help coverity

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dd6040675e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:48 +02:00
Michael Niedermayer bb8e5b221f avformat/rtsp: break on unknown protocols
This function needs more cleanup and it lacks error handling

Fixes: use of uninitialized memory
Fixes: CID700776

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 73c0fd27c5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:48 +02:00
Michael Niedermayer 4b668fbf7e avcodec/hevcdsp_template: stay within tables in sao_band_filter()
Fixes: out of array read
Fixes: 47875/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5719393113341952

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9c5250a561)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:48 +02:00
Michael Niedermayer 4ae28bbb37 avcodec/tiff: Check pixel format types for dng
Fixes: out of array access
Fixes: 48271/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-6149705769287680

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 75f3d1b822)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:47 +02:00
Michael Niedermayer cc1b0a022c avcodec/qpeldsp: copy less for the mc0x cases
Fixes: out of array access
Fixes: 47936/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5745039940124672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e690d4edf5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:47 +02:00
Michael Niedermayer f2039a7ba3 avcodec/ffv1dec: Limit golomb rice coded slices to width 8M
This limit is possibly not reachable due to other restrictions on buffers but
the decoder run table is too small beyond this, so explicitly check for it.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b4431399ec)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:47 +02:00
Michael Niedermayer 6edd2ad5cc avformat/iff: simplify duration calculation
Fixes: signed integer overflow: 315680096256 * 134215943 cannot be represented in type 'long long'
Fixes: 48713/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5886272312311808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0740641e93)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:46 +02:00
Michael Niedermayer 3f3ee1489d avcodec/wnv1: Check for width =1
The decoder only outputs pixels for width >1 images, fail early

Fixes: Timeout
Fixes: 48298/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WNV1_fuzzer-6198626319204352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d98d5a436a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:46 +02:00
Michael Niedermayer 576fbcafbd avcodec/ffv1dec_template: fix indention
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eee7364c90)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:46 +02:00
Michael Niedermayer c40b7f3ceb avformat/sctp: close socket on errors
This is untested as i have no testcase

Fixes: CID1302709

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c9a2996544)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:45 +02:00
Michael Niedermayer 97aee79b97 avcodec/aasc: Fix indention
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit af2ed09220)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:45 +02:00
Michael Niedermayer 3d630709b4 avcodec/qdrw: adjust max colors to array size
Fixes: out of array access
Fixes: 48429/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDRAW_fuzzer-4608329791438848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cd847f86d3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:45 +02:00
Michael Niedermayer 080579e126 avcodec/alacdsp: Make intermediates unsigned
Fixes: signed integer overflow: -14914387 + -2147418648 cannot be represented in type 'int'
Fixes: 46464/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-474307197311385

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8709f4c10a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:44 +02:00
Michael Niedermayer c97bc2ae05 avformat/aiffdec: cleanup size handling for extreem cases
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c6f1e48b86)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:44 +02:00
Michael Niedermayer cc75815142 avcodec/jpeglsdec: fix end check for xfrm
Fixes: out of array access
Fixes: 47871/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMV_fuzzer-5646305956855808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6a82412bf3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:44 +02:00
Michael Niedermayer 9846935523 avcodec/cdgraphics: limit scrolling to the line
Fixes: out of array access
Fixes: 47877/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CDGRAPHICS_fuzzer-5690504626438144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b7e30a13d4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:43 +02:00
Michael Niedermayer 7dc0967032 avformat/aiffdec: avoid integer overflow in get_meta()
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 45891/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6159183893889024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6a02de2127)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:43 +02:00
Michael Niedermayer 9b3c804d6a avformat/ape: more bits in size for less overflows
Fixes: signed integer overflow: 2147483647 + 3 cannot be represented in type 'int'
Fixes: 46184/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-4678059519770624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e5f6707a7b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:43 +02:00
Michael Niedermayer d12d83bae9 avformat/bfi: Check offsets better
Fixes: signed integer overflow: -2145378272 - 538976288 cannot be represented in type 'int'
Fixes: 45690/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5015496544616448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 35dc93ab44)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:42 +02:00
Michael Niedermayer 2cbed362ae avformat/asfdec_f: Check packet_frag_timestamp
Fixes: signed integer overflow: -9223372036854775808 - 4607 cannot be represented in type 'long'
Fixes: 45685/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5280102802391040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ffc8772150)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:42 +02:00
Michael Niedermayer 9620d845b3 avcodec/texturedspenc: Fix indexing in color distribution determination
Fixes CID1396405

MSE and PSNR is slightly improved, and some noticable corruptions disappear as
well.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit ade36d61de)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:42 +02:00
Michael Niedermayer 207557ebe8 avformat/act: Check ff_get_wav_header() for failure
Fixes: missing error check
Fixes: CID717495

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5982da87e3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:42 +02:00
Michael Niedermayer 94805bc829 avcodec/libxavs2: Improve r redundancy in occured
Reviewed-by: "mypopy@gmail.com" <mypopy@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f3b7ba21ba)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:41 +02:00
Michael Niedermayer 40982beb03 avformat/libzmq: Improve r redundancy in occured
Reviewed-by: "mypopy@gmail.com" <mypopy@gmail.com>
(cherry picked from commit e06b1ba7d7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:41 +02:00
Michael Niedermayer 75eb7a648a avfilter/vsrc_mandelbrot: Check for malloc failure
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fbd22504c4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:41 +02:00
Michael Niedermayer 52e229f611 avfilter/vf_frei0r: Copy to frame allocated according to frei0r requirements
Fixes: issues with non trivial linesize

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d353909e77)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:40 +02:00
Michael Niedermayer 203e2e5315 avfilter/video: Add ff_default_get_video_buffer2() to set specific alignment
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d740782701)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:40 +02:00
Michael Niedermayer d7508841a4 avformat/genh: Check sample rate
Fixes: signed integer overflow: -2515507630940093440 * 4 cannot be represented in type 'long'
Fixes: 46318/clusterfuzz-testcase-minimized-ffmpeg_dem_GENH_fuzzer-5009637474172928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a3d790f197)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:40 +02:00
Paul B Mahol 50cadf8dc5 avcodec/pngenc: remove monowhite from apng formats
Monowhite pixel format is not supported, and it does not make sense
to add support for it.

Fixes #7989

(cherry picked from commit 5d9f44da46)
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit e06e89f627)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:39 +02:00
Gyan Doshi 073df4767e configure: bump year
(cherry picked from commit 2f6360ff21)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-09-26 16:50:30 +02:00
Christopher Degawa efb046ab26 configure: extend SDL check to accept all 2.x versions
sdl2 recently changed their versioning, moving the patch level to minor level
https://github.com/libsdl-org/SDL/commit/cd7c2f1de7d9e418bb554047d714dd7cacc020ff
and have said that they will instead ship sdl3.pc for 3.0.0

Fixes ticket 9768

Signed-off-by: Christopher Degawa <ccom@randomderp.com>
Signed-off-by: Gyan Doshi <ffmpeg@gyani.pro>
2022-06-10 13:58:00 +02:00
Timo Rothenpieler 6ffc0e3198 lavf/tls_mbedtls: add support for mbedtls version 3
- certs.h is gone. Only contains test data, and was not used at all.
- config.h is renamed. Was seemingly not used, so can be removed.
- MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE is gone, instead
  MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE will be thrown.
- mbedtls_pk_parse_keyfile now needs to be passed a properly seeded
  RNG. Hence, move the call to after RNG seeding.

Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org>
2022-04-27 18:47:59 +02:00
Michael Niedermayer 1d746bd00e Changelog: update
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-16 00:17:55 +02:00
James Almer d6853d17a3 fate: update reference files after the recent dash manifest muxer changes
Missed in 487b49d8f2.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit aa0829d834)
2022-04-08 16:11:31 -03:00
James Almer 497c32486c avformat/webmdashenc: fix on-demand profile string
Fixes ticket #9596

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 487b49d8f2)
2022-04-08 00:07:11 -03:00
Michael Niedermayer e681f720f8 Update for FFmpeg 4.3.4
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:40:59 +02:00
Michael Niedermayer a671e18128 avcodec/diracdec: avoid signed integer overflow in global mv
Fixes: signed integer overflow: -128275513086 * -76056576 cannot be represented in type 'long'
Fixes: 45818/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5129799149944832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7f1279684e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:06 +02:00
Michael Niedermayer 5359c1ceda avcodec/takdsp: Fix integer overflow in decorrelate_sf()
Fixes: signed integer overflow: -101 * 71041254 cannot be represented in type 'int'
Fixes: 45938/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-4687974320701440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 01d8c887f6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:06 +02:00
Michael Niedermayer d909850308 avcodec/apedec: fix a integer overflow in long_filter_high_3800()
Fixes: signed integer overflow: -2146549696 - 3923884 cannot be represented in type 'int'
Fixes: 45907/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5992380584558592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b085b400be)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:06 +02:00
Oneric f160c24f77 avfilter/vf_subtitles: pass storage size to libass
Due to a quirk of the ASS format some tags depend on the exact storage
resolution of the video, so tell libass via ass_set_storage_size.
2022-04-06 20:38:06 +02:00
Michael Niedermayer e1a5738b73 avformat/aqtitledec: Skip unrepresentable durations
Fixes: signed integer overflow: -5 - 9223372036854775807 cannot be represented in type 'long'
Fixes: 45665/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-475618463934054

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c2d1597a8a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:06 +02:00
Michael Niedermayer 4d1674cccf avformat/cafdec: Do not store empty keys in read_info_chunk()
Fixes: Timeout
Fixes: 45543/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5684953164152832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7ec28e1d4c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:06 +02:00
Michael Niedermayer a9045143da avformat/mxfdec: Do not clear array in mxf_read_strong_ref_array() before writing
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7aebdb8bf1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:06 +02:00
Michael Niedermayer 565bb5fe7b avformat/mxfdec: Check for avio_read() failure in mxf_read_strong_ref_array()
Fixes: 42827/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4900528511909888

Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8d6f49cfc3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:06 +02:00
Michael Niedermayer b88abd3ac2 avformat/mxfdec: Check count in mxf_read_strong_ref_array()
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3015c556f3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:06 +02:00
Michael Niedermayer 023b7e7979 avformat/hls: Check target_duration
Fixes: signed integer overflow: 77777777777777 * 1000000 cannot be represented in type 'long long'
Fixes: 45545/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-6438101247983616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a8fd3f7fab)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:06 +02:00
Michael Niedermayer a1baef131a avcodec/pixlet: Avoid signed integer overflow in scaling in filterfn()
Fixes: signed integer overflow: 11494 * 1073741824000000 cannot be represented in type 'long'
Fixes: 26586/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PIXLET_fuzzer-5752633970917376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0c1f20c6c8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:06 +02:00
Michael Niedermayer 90ef9b5139 avformat/matroskadec: Check pre_ns
Fixes: division by 0
Fixes: 44615/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6681108677263360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 710e51677a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:06 +02:00
Michael Niedermayer 2be7eea648 avcodec/sonic: Use unsigned for predictor_k to avoid undefined behavior
Fixes: signed integer overflow: -1094995529 * 24 cannot be represented in type 'int'
Fixes: 44436/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-4874459459223552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 28008bf95e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:06 +02:00
Michael Niedermayer b19cc796ea avcodec/mjpegbdec: Set buf_size
Fixes: Timeout
Fixes: 45170/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEGB_fuzzer-5874820431085568

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:06 +02:00
Michael Niedermayer 5032883c34 avformat/matroskadec: Use rounded down duration in get_cue_desc() check
Floating point is evil, it would be better if duration was not a double

Fixes: Infinite loop
Fixes: 45123/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6725052291219456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bd3a03db9a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:06 +02:00
Michael Niedermayer fa2e4afe8d avcodec/g729_parser: Check channels
Fixes: signed integer overflow: 10 * 808464428 cannot be represented in type 'int'
Fixes: assertion failure
Fixes: ticket9651

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 757da974b2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:06 +02:00
Michael Niedermayer 0225b8947b avformat/avidec: Check height
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: Ticket8486

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ec8ff659f5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:06 +02:00
Michael Niedermayer 7251a22f97 avformat/rmdec: Better duplicate tags check
Fixes: memleaks
Fixes: 44810/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5619494647627776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 15a646e501)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:06 +02:00
Michael Niedermayer 54a0324ad9 avformat/mov: Disallow empty sidx
It appears this is not allowed "Each Segment Index box documents how a (sub)segment is divided into one or more subsegments
(which may themselves be further subdivided using Segment Index boxes)."
Fixes: Null pointer dereference
Fixes: Ticket9517

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4419433d77)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:06 +02:00
Michael Niedermayer 69691dbb3a avformat/matroskadec: Check duration
Fixes: -nan is outside the range of representable values of type 'long'
Fixes: 44614/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6216204841254912

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 36680078ca)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:06 +02:00
Michael Niedermayer 56c8235332 avformat/mov: Corner case encryption error cleanup in mov_read_senc()
Fixes: memleak
Fixes: 42341/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4566632823914496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8ee0e4abcb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:06 +02:00
Michael Niedermayer 2dcc5ef710 avcodec/jpeglsdec: Fix if( code style
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f306b8e80a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:06 +02:00
Michael Niedermayer d06715c5c2 avcodec/jpeglsdec: Check get_ur_golomb_jpegls() for error
Fixes: Timeout
Fixes: Invalid shift
Fixes: 44548/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-556487680891289
Fixes: 44569/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMV_fuzzer-6302543246917632
Fixes: 44570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-4550196556595200
Fixes: 44592/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5651610385121280
Fixes: 44571/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5094698987945984
Fixes: 44607/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5341352013987840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 151f83584e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:06 +02:00
Michael Niedermayer ca7ee1cd26 avcodec/motion_est: fix indention of ff_get_best_fcode()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce43e1c581)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer 9a7effc78d avcodec/motion_est: Fix xy indexing on range violation in ff_get_best_fcode()
This codepath seems untested, no testcases change

Found-by: <mkver>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 634312a70f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer 228d006790 avcodec/jpeglsdec: Increase range for N in ls_get_code_runterm() by using unsigned
Fixes: left shift of 32768 by 16 places cannot be represented in type 'int'
Fixes: Timeout
Fixes: 44219/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-4679455379947520
Fixes: 44088/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-4885976600674304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6ee283d7d0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer f20e08ed58 avformat/matroskadec: Check desc_bytes
Fixes: Division by 0
Fixes: 44035/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4826721386364928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5038933977)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer a2932f6e98 avformat/utils: Fix invalid NULL pointer operation in ff_parse_key_value()
Fixes: pointer index expression with base 0x000000000000 overflowed to 0xffffffffffffffff
Fixes: 44012/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-5670607746891776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 59328aabd2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer 2564ac2764 avformat/matroskadec: Fix infinite loop with bz decompression
The same check is added to zlib too, it seems not needed there though

Fixes: Infinite loop
Fixes: 43932/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-6175167573786624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9c3d2cbb51)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer 3a718e3bbb avformat/mov: Check size before subtraction
Fixes: signed integer overflow: -9223372036854775808 - 8 cannot be represented in type 'long'
Fixes: 43542/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5237670148702208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d8d9d506a3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer 671850fe55 avcodec/apedec: Fix integer overflows in predictor_update_3930()
Fixes: signed integer overflow: 1074134419 - -1075212485 cannot be represented in type 'int'
Fixes: 43273/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-4706880883130368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0c9c9bbd01)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer 429eaaf16e avcodec/apedec: fix integer overflow in 8bit samples
Fixes: signed integer overflow: 2147483542 + 128 cannot be represented in type 'int'
Fixes: 42812/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6344057861832704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7cee3b3718)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer c45013d6c5 avformat/flvdec: timestamps cannot use the full int64 range
We do not support this as we multiply by 1000
Fixes: signed integer overflow: -45318575073853696 * 1000 cannot be represented in type 'long'
Fixes: 42804/clusterfuzz-testcase-minimized-ffmpeg_dem_LIVE_FLV_fuzzer-4630325425209344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c217ca7718)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer ddc21f54c3 avcodec/vqavideo: reset accounting on error
Fixes: Timeout (same growing chunk is decoded to failure repeatedly)
Fixes: 42582/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-6531195591065600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d8ea7a67ba)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer 80940eedf2 avcodec/alacdsp: fix integer overflow in decorrelate_stereo()
Fixes: signed integer overflow: -16777216 * 131 cannot be represented in type 'int'
Fixes: 23835/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5669943160078336
Fixes: 41101/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-4636330705944576

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 68457c1e85)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer 4a45cd806e avformat/4xm: Check for duplicate track ids
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dd94912479)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer 75befad4c0 avformat/4xm: Consider max_streams on reallocating tracks array
Fixes: OOM
Fixes: 41595/clusterfuzz-testcase-minimized-ffmpeg_dem_FOURXM_fuzzer-6355979363549184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0dcd95ef8a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer 5a2a340d64 avformat/mov: Check next offset in mov_read_dref()
Fixes: signed integer overflow: 9223372036200463215 + 1109914409 cannot be represented in type 'long'
Fixes: 41480/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6553086177443840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 562021e2fd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer 480f1a198c avformat/vivo: Favor setting fps from explicit fractions
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bf1e93bdc9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer deba3d0372 avformat/vivo: Do not use the general expression evaluator for parsing a floating point value
Fixes: Timeout
Fixes: 41564/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVO_fuzzer-6309014024093696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7b24615565)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer d80dbe6505 avformat/mxfdec: Check for duplicate mxf_read_index_entry_array()
Fixes: memleak
Fixes: 41596/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6439060204290048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4f44a218e5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer aea824467c avcodec/apedec: Change avg to uint32_t
Fixes: Integer overflow
Fixes: 40973/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6739312704618496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ec75723a4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer 58368cc528 avformat/mov: Disallow duplicate smdm
Fixes: memleak
Fixes: 39879/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5327819907923968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b5ba74053c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer 784303ca01 avformat/mov: Check for EOF in mov_read_glbl()
Fixes: Infinite loop
Fixes: 41351/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5433895854669824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 59b4e7cbd8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer a452eddfad avcodec/vp3: Check version in all cases when VP4 code is not built
Fixes: out of array read
Fixes: 40284/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP3_fuzzer-4599568176644096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 96caa01f13)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer 867b978dc9 avformat/mov: Check channels for mov_parse_stsd_audio()
Fixes: signed integer overflow: -776522110086937600 * 16 cannot be represented in type 'long'
Fixes: 40563/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6644829447127040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3a64a4c582)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer 0b0d4f141b avformat/avidec: Check read_odml_index() for failure
Fixes: Timeout
Fixes: 40950/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6478873068437504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 57adb26d05)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer 00530ff352 avformat/aiffdec: Use av_rescale() for bitrate
Fixes: integer overflow
Fixes: 40313/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-4814761406103552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 905588df97)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer b52cad186c avformat/aiffdec: sanity check block_align
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 93f7776921)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer e3a69dd7a0 avformat/aiffdec: Check sample_rate
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b04836dff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
Michael Niedermayer e8a3e30a85 avcodec/flac_parser: Consider AV_INPUT_BUFFER_PADDING_SIZE
Fixes: out if array read
Fixes: 40109/clusterfuzz-testcase-minimized-ffmpeg_dem_FLAC_fuzzer-4805686811295744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Mattias Wadman <mattias.wadman@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2022-04-06 20:38:05 +02:00
James Almer 15a0ff81c5 avcodec/libdav1d: free the Dav1dData packet on dav1d_send_data() failure
We still own it on failure, and there's no point trying to feed it again.

This should address the issue reported in dav1d #383 and part of VLC #26259.

Signed-off-by: James Almer <jamrial@gmail.com>
Reviewed-by: Ronald S. Bultje <rsbultje@gmail.com>
2022-02-01 13:11:11 -03:00
Andreas Rheinhardt c6fa5a8d04 configure: Add missing libshine->mpegaudioheader dependency
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit e228d7b0db)
2022-01-06 08:44:13 +01:00
Michael Niedermayer a77521cd5d Changelog: update
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-21 18:28:52 +02:00
Michael Niedermayer ee7250ec21 avcodec/ttadsp: Fix integer overflows in tta_filter_process_c()
Fixes: signed integer overflow: 822841647 + 1647055738 cannot be represented in type 'int'
Fixes: 39935/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-4592657142251520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f24028c798)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-21 15:26:15 +02:00
Michael Niedermayer d4886a928c avutil/mathematics: Document av_rescale_rnd() behavior on non int64 results
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e154353fdb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-21 15:25:55 +02:00
Michael Niedermayer 361c4ad20b Changelog: update
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-20 23:20:01 +02:00
Michael Niedermayer 13044f729d avformat/matroskadec: Reset state also on failure in matroska_reset_status()
The calling code does not handle failures and will fail with assertion failures later.
Seeking can always fail even when the position was previously read.

Fixes: Assertion failure
Fixes: 35253/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-4693059982983168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d115eec979)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-20 23:11:11 +02:00
Michael Niedermayer 4069494725 avformat/wavdec: Check smv_block_size
Fixes: Timeout
Fixes: 39554/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-4915221701984256

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 849138f476)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-20 23:11:11 +02:00
Michael Niedermayer 974799368b avformat/rmdec: Check for multiple audio_stream_info
Fixes: memleak
Fixes: 39166/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5153276690038784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8fe3566b8f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-20 23:11:11 +02:00
Michael Niedermayer 2ad2da390c avcodec/apedec: Use 64bit to avoid overflow
Fixes: runtime error: signed integer overflow: 727298502 * 3 cannot be represented in type 'int'
Fixes: 39172/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-638602483033702

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f059b56195)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-20 23:11:11 +02:00
Michael Niedermayer 134b4d85a1 avcodec/apedec: Fix undefined integer overflow in long_filter_ehigh_3830()
Fixes: signed integer overflow: -2145648640 - 3357696 cannot be represented in type 'int'
Fixes: 38899/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5358815017566208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ad517ee6e4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-20 23:11:11 +02:00
Michael Niedermayer 9d4a293b42 oavformat/avidec: Check offset in odml
Fixes: signed integer overflow: 9223372036854775807 + 8 cannot be represented in type 'long'
Fixes: 38787/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-4859845799444480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 255a7b423e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-20 23:11:11 +02:00
Michael Niedermayer bfc04caa2f avformat/mpegts: use actually read packet size in mpegts_resync special case
Fixes: infinite loop
Fixes: 37986/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5292311517462528 -

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 83b2e4c8f1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-20 23:11:11 +02:00
Timo Rothenpieler d9cb7c62b6 avfilter/scale_npp: fix non-aligned output frame dimensions 2021-10-07 18:23:18 +02:00
Michael Niedermayer 8f6b124bac Update for 4.3.3
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 15:46:14 +02:00
Michael Niedermayer 676dad0aeb swscale/alphablend: Fix slice handling
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 06d6726588)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:42 +02:00
Michael Niedermayer e0791ea1b1 avcodec/apedec: Fix integer overflow in filter_fast_3320()
Fixes: signed integer overflow: 2145649668 + 3956526 cannot be represented in type 'int'
Fixes: 38351/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-4647077926273024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0e45886e6e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:42 +02:00
Michael Niedermayer d2b1cad8b3 avcodec/mxpegdec: Check for AVDISCARD_ALL
Fixes: Fixes NULL pointer dereference
Fixes: 36610/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-6052641783283712
Fixes: 37907/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-4725170850365440
Fixes: 37904/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-6367889262247936
Fixes: 38085/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-5175270823297024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 20afd3a63a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:42 +02:00
Michael Niedermayer 568cccce00 avcodec/flicvideo: Check remaining bytes in FLI*COPY
Fixes: Timeout
Fixes: 37795/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-4846536543043584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f835efbca)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:42 +02:00
Michael Niedermayer 10f73661a2 avcodec/cbs_h265_syntax_template: Limit sps_num_palette_predictor_initializer_minus1 to 127
Fixes: index 128 out of bounds for type 'uint16_t [128]'
Fixes: 38651/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-6296416058736640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 85413a5ae6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:42 +02:00
Michael Niedermayer d9bfc347b3 avcodec/snowdec: Maintain avmv buffer
This avoids reallocating per frame

Fixes: Assertion failure
Fixes: 36359/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-6733238591684608
Fixes: 38623/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-6098656512573440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0faf04e807)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:42 +02:00
Michael Niedermayer b66384b77f avcodec/mpeg12dec: Do not put mpeg_f_code into an invalid state on error return
Fixes: invalid shift
Fixes: 37018/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG2VIDEO_fuzzer-5290280902328320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5a95abcce4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:42 +02:00
Michael Niedermayer 6238b5bab5 avcodec/mpegvideo_enc: Limit bitrate tolerance to the representable
Fixes: error: 1.66789e+11 is outside the range of representable values of type 'int'
Fixes: Ticket8201

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 245017ec8a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:42 +02:00
Michael Niedermayer b87d26675d avcodec/apedec: Fix integer overflow in intermediate
Fixes: signed integer overflow: 559334865 * 4 cannot be represented in type 'int'
Fixes: 37929/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6751932295806976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 90da43557f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:42 +02:00
Michael Niedermayer e2bba86f27 avformat/mvdec: Do not set invalid sample rate
Fixes: signed integer overflow: -682581959642593728 * 16 cannot be represented in type 'long'
Fixes: 37883/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5311691517198336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 737e6bf216)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:42 +02:00
Michael Niedermayer 1b4ab72ad6 avformat/sbgdec: Check for t0 overflow in expand_tseq()
Fixes: signed integer overflow: 4611686025627387904 + 4611686025627387904 cannot be represented in type 'long'
Fixes: 35489/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-4862678601433088

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f624c92d4c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:42 +02:00
Michael Niedermayer 70291713b0 avformat/rmdec: Use 64bit for intermediate for DEINT_ID_INT4
Fixes: runtime error: signed integer overflow: 65312 * 65535 cannot be represented in type 'int'
Fixes: 32832/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-4817710040088576

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e2c2872393)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:42 +02:00
Michael Niedermayer 953f316b1b avformat/sbgdec: Check opt_duration and start for overflow
Fixes: signed integer overflow: 2788626175500000000 + 7118941284000000000 cannot be represented in type 'long'
Fixes: 35215/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6123272247836672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2768928624)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:42 +02:00
Michael Niedermayer bd947157eb avformat/mov: Check for duplicate clli
Fixes: memleak
Fixes: 35261/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4869656287510528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9a222f140e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:42 +02:00
Michael Niedermayer b9c0ba3939 avformat/jacosubdec: Check for min in t overflow in get_shift()
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 34651/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-5157941012463616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 989febfbd0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:42 +02:00
Michael Niedermayer 84cb6b75d6 avformat/mxfdec: check channel number in mxf_get_d10_aes3_packet()
Fixes: Out of array access
Fixes: 37030/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5387719147651072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3dd5a8a135)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:42 +02:00
James Almer 76470ae27f avcodec/utils: don't return negative values in av_get_audio_frame_duration()
In some extrme cases, like with adpcm_ms samples with an extremely high channel
count, get_audio_frame_duration() may return a negative frame duration value.
Don't propagate it, and instead return 0, signaling that a duration could not
be determined.

Fixes ticket #9312

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit e01d306c64)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:42 +02:00
Michael Niedermayer 8be49a6c64 avcodec/jpeg2000dec: Check that atom header is within bytsetream
Fixes: Infinite loop
Fixes: 36666/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5912760671141888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3c659f8618)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer bdc6377bd1 avcodec/apedec: Fix 2 integer overflows in filter_3800()
Fixes: signed integer overflow: 1683879955 - -466265224 cannot be represented in type 'int'
Fixes: 37419/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6074294407921664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 33feb527ff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer cce6d86418 avcodec/xpmdec: Move allocations down after more error checks
Fixes: Timeout
Fixes: 37035/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XPM_fuzzer-5142718576721920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e58692837c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 684a8847e3 avformat/mov: Check dts for overflow in mov_read_trun()
Fixes: signed integer overflow: 9223372034248226491 + 3275247799 cannot be represented in type 'long'
Fixes: clusterfuzz-testcase-minimized-audio_decoder_fuzzer-4538729166077952

Reported-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4de4bc06fd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer d24e2c121b avformat/avidec: Use 64bit for frame number in odml index parsing
Fixes: signed integer overflow: 1179337772 + 1392508928 cannot be represented in type 'int'
Fixes: 34088/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5846945303232512

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a4c98c507e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 7db92df664 avcodec/mjpegbdec: Skip SOS on AVDISCARD_ALL as does mjpeg
Fixes: NULL pointer dereference
Fixes: 36342/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEGB_fuzzer-4579188072906752
Fixes: 36344/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEGB_fuzzer-5049579300061184
Fixes: 36345/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEGB_fuzzer-5301149845553152
Fixes: 36374/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEGB_fuzzer-6056312352931840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 104a8399ae)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 7c388310c8 avcodec/mjpegdec: Check for bits left in mjpeg_decode_scan_progressive_ac()
Fixes: Timeout
Fixes: 36262/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-4969052454912000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 909faca929)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
maryam ebrahimzadeh 9f38effa59 avformat/adtsenc: return value check for init_get_bits in adts_decode_extradata
As the second argument for init_get_bits (buf) can be crafted, a return value check for this function call is necessary.
'buf' is  part of  'AVPacket pkt'.
replace init_get_bits with init_get_bits8.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9ffa49496d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 425005f255 avcodec/webp: Check available space in loop in decode_entropy_coded_image()
Fixes: Timeout
Fixes: 35401/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WEBP_fuzzer-5714401821851648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5e00eab611)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 7edfec235c avcodec/h264dec: use picture parameters in ff_print_debug_info2()
Fixes: out of array read
Fixes: 36341/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-6737583085322240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 65892516d5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer f0c046464a avcodec/vc1dec: ff_print_debug_info() does not support WMV3 field_mode
Fixes: out of array read
Fixes: 36331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-5140494328922112.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c59b5e3d1e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer c6e7b345f5 avcodec/frame_thread_encoder: Free AVCodecContext structure on error during init
Fixes: MemLeak
Fixes: 8281
Fixes: PoC_option158.jpg
Fixes: CVE-2020-22037

Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7bba0dd638)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer b10507d155 avcodec/faxcompr: Check for end of input in cmode == 1 in decode_group3_2d_line()
Fixes: Infinite loop
Fixes: 35591/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4503764022198272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f803635c4f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 79495f4f40 avcodec/vc1dec: Disable error concealment for *IMAGE
The existing error concealment makes no sense for the image formats, they
use transformed source images which is different from keyframe + MC+difference
for which the error concealment is designed.
Of course feel free to re-enable this if you have a case where it works and
improves vissual results

Fixes: Timeout
Fixes: 36234/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-6300306743885824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 643b2d49bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 4cbc32889b avcodec/sbrdsp_fixed: Fix negation overflow in sbr_neg_odd_64_c()
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 35593/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5182217725804544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8f2856a1da)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 6cf3643195 avformat/wtvdec: Check for EOF before seeking back in parse_media_type()
Fixes: Infinite loop
Fixes: 36311/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-4889181296918528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 89505d38de)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer ac76b104c5 avformat/mpc8: Check first keyframe position for overflow
Fixes: signed integer overflow: 9223372036854775791 + 18 cannot be represented in type 'long'
Fixes: 36307/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-4917863877050368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2bbef69b0b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer b539d641b0 avformat/wavdec: Use 64bit in new_pos computation
Fixes: signed integer overflow: 129 * 16711680 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-6742285317439488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9b57d2f0a9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer b0e211ae39 avformat/sbgdec: Check for overflow in timestamp preparation
Fixes: signed integer overflow: 9223372036854775807 + 86400000000 cannot be represented in type 'long'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6731040263634944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9dbed90840)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 5b679de458 avformat/dsicin: Check packet size for overflow
Fixes: signed integer overflow: 24672 + 2147483424 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_DSICIN_fuzzer-6731325979623424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9d1c47ec03)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 9e2cc2b6ec avformat/dsfdec: Change order of operations in bitrate computation
Fixes: signed integer overflow: 538976288 * 67372036 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_DSF_fuzzer-6751696819716096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5e38eff284)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 7db392e6f8 avformat/bfi: check nframes
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_BFI_fuzzer-6737028768202752

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b4e77dfca1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 9793ebdfb4 avformat/avidec: fix position overflow in avi_load_index()
Fixes: signed integer overflow: 9223372033098784808 + 4294967072 cannot be represented in type 'long'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6732488912273408

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 527821a2dd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer da825c61f4 avformat/asfdec_f: Check sizeX against padding
Fixes: signed integer overflow: 2147483607 + 64 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-6753897878257664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f034c2e36a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer d84c0fa6f9 avformat/aiffdec: Check for size overflow in header parsing
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6723467048255488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bae2e19777)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 58700716b1 avcodec/aaccoder: Add minimal bias in search_for_ms()
Fixes: floating point division by 0
Fixes: Ticket8218

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 75a099fc73)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 8c2ba20612 avformat/mov: Avoid undefined overflow in time_offset calculation
Fixes: signed integer overflow: 8511838621821575200 - -3954125146725285889 cannot be represented in type 'long'
Fixes: 33414/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6610119325515776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7666d588ba)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 3a5dc113ef avfilter/af_drmeter: Check that there is data
Fixes: floating point division by 0
Fixes: -nan is outside the range of representable values of type 'int'
Fixes: Ticket8307

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4f49fa6abe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 2e4e045e63 avfilter/vf_fftdnoiz: Use lrintf() in export_row8()
Fixes: 1.04064e+10 is outside the range of representable values of type 'int'
Fixes: Ticket 8279

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1f21349d20)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 612d8b0202 avfilter/vf_mestimate: Check b_count
Fixes: left shift of negative value -1
Fixes: Ticket8270

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 06af6e101b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 4b00aaff68 avformat/mov: do not ignore errors in mov_metadata_hmmt()
Fixes: Timeout
Fixes: 35637/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6311060272447488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c52c99a18f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer a52577dae5 avformat/mxfdec: Check size for shrinking
av_shrink_packet() takes int size, so size must fit in int
Fixes: out of array access
Fixes: 35607/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4875541323841536

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 65b862ab59)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
maryam ebr 7c455ee86a avcodec/dnxhddec: check and propagate function return value
Similar to CVE-2013-0868, here return value check for 'init_vlc' is needed.
crafted DNxHD data can cause unspecified impact.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 7150f95756)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 149992e127 swscale/slice: Fix wrong return on error
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7874d40f10)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer aa934f92e3 avcodec/aacdec_template: Avoid some invalid values to be set by decode_audio_specific_config_gb()
Fixes: NULL pointer dereference
Fixes: decode_spectrum_and_dequant.mp4

Found-by: Rafael Dutra <rafael.dutra@cispa.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eaec4df63f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 4866d2a9ee swscale/slice: Check slice for allocation failure
Fixes: null pointer dereference
Fixes: alloc_slice.mp4

Found-by: Rafael Dutra <rafael.dutra@cispa.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 997f9cfc12)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 89c62d5cdd avformat/matroskadec: Fix handling of huge default durations
Fixes: negation of -9223372036854775808 cannot be represented in type 'int64_t' (aka 'long'); cast to an unsigned type to negate this value to itself
Fixes: 33997/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6752039691485184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 343d950a4a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 7504170334 avcodec/lpc: check for zero err in normalization in compute_lpc_coefs()
Fixes: floating point division by 0
Fixes: Ticket8213

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 70874e024a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 595954032e avformat/ftp: Check for av_strtok() failure
Fixes: CID1396258 Dereference null return value

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9d40782088)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 32982e145a tools/cws2fws: Check read() for failure
Fixes: CID1452579 Argument cannot be negative

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0b3cdd7cc2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 74c4d2bfd7 avcodec/cpia: Fix missing src_size update
Fixes: out of array read
Fixes: 35210/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CPIA_fuzzer-5669199688105984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cea05864e6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 152ad3a939 avcodec/clearvideo: Check tile_size to be not too large
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 35023/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CLEARVIDEO_fuzzer-6740166587842560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 11fac9613e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 82c530092b avcodec/utils: Use 64bit for intermediate in AV_CODEC_ID_ADPCM_THP* duration calculation
Fixes: signed integer overflow: 486539264 * 14 cannot be represented in type 'int'
Fixes: 35281/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-6068262742917120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 00ae9b77ef)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer f7303812dc avformat/rmdec: Check old_format len for overflow
Maybe such large values could be disallowed earlier and closer to where
they are set.

Fixes: signed integer overflow: 538976288 * 8224 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6704350354341888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 06d174e289)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer ec3839c6be avformat/realtextdec: Check the pts difference before using it for the duration computation
Fixes: signed integer overflow: 5404200000 - -9223372031709351616 cannot be represented in type 'long'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_REALTEXT_fuzzer-6737340551790592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fe12aa6890)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 6b1756ae40 avformat/qcp: Avoid negative nb_rates
Fixes: signed integer overflow: 2 * -1725947872 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_QCP_fuzzer-6726807632084992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b865cc703)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer e5308ce13e avformat/nutdec: Check tmp_size
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6739990530883584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1ca00b5e44)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer b53d3d5d0b avformat/msf: Check that channels doesnt overflow during extradata construction
Fixes: signed integer overflow: 2048 * 1122336 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_MSF_fuzzer-6726959600107520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a1a277926b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer ed9fe15b49 avformat/mpc8: Check for position overflow in mpc8_handle_chunk()
Fixes: signed integer overflow: 15 + 9223372036854775796 cannot be represented in type 'long'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6723520756318208
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6739833034768384

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8ef25d1182)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 433e72f7e5 avformat/iff: Use 64bit in duration computation
Fixes: signed integer overflow: 588 * 16719904 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6748331936186368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 93d964689c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer fa4f7b96f4 avformat/dxa: Check fps to be within the supported range more precissely
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: assertion failure
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-6744985740378112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6ea494befc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 4d153afd9a avcodec/iff: Only write palette to plane 1 if its PAL8
Fixes: null pointer passed as argument 1, which is declared to never be null
Fixes: 33791/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5107575256383488.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 216eb60b85)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 22f1bbf263 avformat/tta: Check for EOF in index reading loop
Fixes: OOM
Fixes: 33585/clusterfuzz-testcase-minimized-ffmpeg_dem_TTA_fuzzer-4564665830080512

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b72d657b73)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 68477b1ec0 Update missed irc links
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c067d20177)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 04e7bac763 avformat/rpl: The associative law doesnt hold for signed integers in C
Add () to avoid undefined behavior
Fixes: signed integer overflow: 9223372036854775790 + 57 cannot be represented in type 'long'
Fixes: 34983/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-5765822923538432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 480f11bdd7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 090e21faef avcodec/faxcompr: Check available bits in decode_uncompressed()
Fixes: Timeout
Fixes: 34950/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5686764151898112
Fixes: 34966/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4587409334468608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ff56c139e0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 9b66b5ccc1 avcodec/faxcompr: Check if bits are available before reading in cmode == 9 || cmode == 10
Fixes: Timeout
Fixes: 34950/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5686764151898112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7d8421e3d5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 95f02cf737 avformat/utils: check dts/duration to be representable before using them
Fixes: signed integer overflow: 6854513951393103890 + 3427256975738527712 cannot be represented in type 'long'
Fixes: 32936/clusterfuzz-testcase-minimized-ffmpeg_dem_R3D_fuzzer-5236914752978944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bf4e7ec825)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 28c8271d21 avcodec/utils: do "calc from frame_bytes, channels, and block_align" in 64bit
Fixes: signed integer overflow: 104962766 * 32 cannot be represented in type 'int'
Fixes: 33614/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-6252129036664832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3447979d08)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 31e285cca7 avcodec/ttadata: Add sentinel at the end of ff_tta_shift_1
Fixes: out of array access
Fixes: 34933/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5629322560929792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dbbcfbcc4e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 37f90a4e38 avformat/mov: Check for duplicate mdcv
Fixes: memleak
Fixes: 34932/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5456227658235904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f54d85cee6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 359e106362 avfilter/vf_dctdnoiz: Check threads
Fixes: floating point division by 0
Fixes: Ticket 8269

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4a3917c02c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer ad92dec581 avfilter/vf_ciescope: Fix undefined behavior in rgb_to_xy() with black
Fixes: floating point division by 0
Fixes: undefined behavior in handling NaN
Fixes: Ticket 8268

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3d500e62f6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 543c437bc2 avformat/rpl: Check for EOF and zero framesize
Fixes: Infinite loop
Fixes: 34751/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-5439330800762880
Fixes: 34774/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-5851571660390400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a0a4a527c3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 5c5449bfe0 avcodec/vc2enc: Check for non negative slice bounds
Fixes: invalid shifts
Fixes: Ticket 8221

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f7862e8268)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 10949da906 avformat/rpl: Use 64bit in bitrate computation and check it
Fixes: signed integer overflow: 777777776 * 4 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-6726188921913344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 29b244ffc1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer c247aae924 avcodec/svq1enc: Do not print debug RD value before it has been computed
Avoids floating point division by 0

Fixes: Ticket8191

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c297f7e57a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer e1a994fd4b avcodec/aacpsy: Check bandwidth
Fixes: Ticket8011

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 36dead4bc2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 0ee20c4a1d avcodec/aacenc: Do not divide by lambda_count if it is 0
Avoids Floating point division by 0

Fixes: Ticket8011

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c520b98691)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 9cfcbec325 avcodec/aacenc: Use FLT_EPSILON for lambda minimum
(cherry picked from commit 4b89cf7aa4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer f9b3aa07be avformat/cinedec: Fix index_entries size check
Fixes: out of array access
Fixes: 29868/clusterfuzz-testcase-minimized-ffmpeg_dem_CINE_fuzzer-5692001957445632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer bade86f679 avfilter/vf_yadif: Fix handing of tiny images
Fixes: out of array access
Fixes: Ticket8240
Fixes: CVE-2020-22021

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7971f62120)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer a6a0416767 avfilter/vf_vmafmotion: Check dimensions
Fixes: out of array access
Fixes: Ticket8241
Fixes: Ticket8246
Fixes: CVE-2020-22019
Fixes: CVE-2020-22033

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 82ad1b7675)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer e1089a581b avformat/movenc: Check pal_size before use
Fixes: assertion failure
Fixes: out of array read
Fixes: Ticket8190
Fixes: CVE-2020-22015

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4c1afa2925)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 053cece360 avcodec/lpc: Avoid floating point division by 0
Fixes: Ticket7996
Fixes: CVE-2020-20445

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 38d18fb578)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer ee5387471f avcodec/aacpsy: Avoid floating point division by 0 of norm_fac
Fixes: Ticket7995
Fixes: CVE-2020-20446

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 223b5e8ac9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer ff2159658a avcodec/aacenc: Avoid 0 lambda
Fixes: Ticket8003
Fixes: CVE-2020-20453

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a7a7f32c8a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 6de521a058 avcodec/exr: x/ymax cannot be INT_MAX
The code uses x/ymax + 1 so the maximum is INT_MAX-1

Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 33158/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5545462457303040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 48342aa075)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 701dc655da avformat/avio: Check av_opt_copy() for failure
Fixes: CID1477416 Unchecked return value

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f8611ae1ef)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 60d5fa5874 avcodec/clearvideo: Check for 0 tile_shift
Fixes: shift exponent -1 is negative
Fixes: 33401/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CLEARVIDEO_fuzzer-5908683596890112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 63e75e09ae)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 326fc42beb avcodec/vc1: Check remaining bits in ff_vc1_parse_frame_header()
Fixes: Timeout
Fixes: 33156/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-6259655027326976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 38c4761588)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 4630075b7d avformat/mov: Ignore duplicate CoLL
Fixes: memleak
Fixes: 32146/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5377612845285376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9548dc74d8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer a956699518 avformat/mov: Limit nb_chapter_tracks to input size
Fixes: Timeout (15k loop iterations instead of 400m)
Fixes: 31368/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6601583174483968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 299a56c900)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 44b0e786eb avformat/utils: Use 64bit earlier in r_frame_rate check
Fixes: signed integer overflow: 1406796319 * 2 cannot be represented in type 'int'
Fixes: 32777/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5632576913014784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 578633fc1a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer ac88b2e2ae avcodec/alsdec: Fix decoding error with mono audio files
highest_decoded_channel is modified to serve as meant.

Reported-by: Noboru Harada <noboru@ieee.org>

Regression since: a11aa5f3ed
Fixes: Sin48k16bit1ch.mp4
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f7987ce966)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 2fa9bf1f35 avformat/mvdec: Check sample rate in parse_audio_var()
Fixes: signed integer overflow: -635424002382840000 * 16 cannot be represented in type 'long'
Fixes: 33612/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5704741108711424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ff60249a5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer b4ef072dfe avcodec/faxcompr: Check for end of bitstream in decode_group3_1d_line() and decode_group3_2d_line()
Fixes: infinite loop
Fixes: 33674/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4816457818046464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 08d2df4153)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 1941a2abad avcodec/utils: treat PAL8 for jpegs similar to other colorspaces
Fixes: out of array access
Fixes: 33713/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5778775641030656
Fixes: 33717/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-4960397238075392
Fixes: 33718/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-5314270096130048.fuzz
Fixes: 33719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5352721864589312
Fixes: 33721/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-5938892055379968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f0ce023ddb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer f0713843e7 avcodec/jpeglsdec: Set alpha plane in PAL8 so image is not 100% transparent
Fixes: tickets/3933/128.jls

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 011006874c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 04abdd5154 avformat/asfdec_o: Use ff_get_extradata()
Fixes: OOM
Fixes: 27240/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-5937469859823616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 098314e1e5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer aee30a18c7 avformat/id3v2: Check end for overflow in id3v2_parse()
Fixes: signed integer overflow: 9223372036840103978 + 67637280 cannot be represented in type 'long'
Fixes: 33341/clusterfuzz-testcase-minimized-ffmpeg_dem_DSF_fuzzer-6408154041679872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit efdb564504)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 793fefb333 avformat/wtvdec: Improve size overflow checks in parse_chunks()
Fixes: signed integer overflow: 32 + 2147483647 cannot be represented in type 'int
Fixes: 32967/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5132856218222592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f8ec1da8ac)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 972e6ae39f avcodec/faxcompr: Check remaining bits on error in decode_group3_1d_line()
Fixes: Timeout
Fixes: 32886/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4779761466474496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7b3881f0da)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 906b1e1839 avcodec/utils: Check ima wav duration for overflow
Fixes: signed integer overflow: 44331634 * 65 cannot be represented in type 'int'
Fixes: 32120/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-5760221223583744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f40e9b1355)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 19adeefc16 avcodec/rv10: Execute whole size check earlier for rv20
Fixes: Timeout
Fixes: 31380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV20_fuzzer-5230899257016320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f8556b632f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 1758c2317e avformat/cafdec: Check channels
Fixes: signed integer overflow: -1184429040541376544 * 32 cannot be represented in type 'long'
Fixes: 31788/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6236746338664448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 641c1db22b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer ef02e54454 avcodec/dpx: Check bits_per_color earlier
Fixes: shift exponent 251 is too large for 32-bit type 'int'
Fixes: 32147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DPX_fuzzer-5519111675314176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c093eb3031)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 9a0a851fae avformat/mvi: Check audio_data_size to be non negative
Fixes: left shift of negative value -224
Fixes: 32144/clusterfuzz-testcase-minimized-ffmpeg_dem_MVI_fuzzer-4971479323246592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7e241a1b73)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer f08c4b72f2 avcodec/pnm_parser: Check image size addition for overflow
Fixes: assertion failure
Fixes: out of array access
Fixes: 32664/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-6533642202513408.fuzz
Fixes: 32669/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-6001928875147264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 79ac8d5546)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer af51095d9c avcodec/h265_metadata_bsf: Check nb_units before accessing the first in h265_metadata_update_fragment()
Fixes: null pointer dereference
Fixes: 32113/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-4803262287052800

Same as 0c48c332ee

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 497ea04dbd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 0729fe564b avformat/rmdec: use larger intermediate type for audio_framesize * sub_packet_h check
Fixes: signed integer overflow: 65535 * 65535 cannot be represented in type 'int'
Fixes: 31406/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5024692843970560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cf2fd9204b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer ed0134946f avcodec/h264_slice: Check input SPS in ff_h264_update_thread_context()
Fixes: crash
Fixes: check_pkt.mp4

Found-by: Rafael Dutra <rafael.dutra@cispa.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ceae92cb29)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer b5e7092c9c avformat/mpc8: check for size overflow in mpc8_get_chunk_header()
Fixes: signed integer overflow: -9223372036854775760 - 50 cannot be represented in type 'long'
Fixes: 31673/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-580134751869337

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6cc65d3d67)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer c44458dcfa avformat/mov: Do not zero memory that is written too or unused
Fixes: OOM
Fixes: 31220/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6033383962574848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c1fe1114bc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 60d304ca92 avcodec/mpegvideo: Update chroma_?_shift in ff_mpv_common_frame_size_change()
Fixes: out of array access
Fixes: 31201/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4627865612189696.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 87d87e6587)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 7aceba2349 avformat/mov: Ignore multiple STSC / STCO
Fixes: STSC / STCO inconsistency and assertion failure
Fixes: crbug1184666.mp4

Found-by: Chromium ASAN fuzzer
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2611d20d35)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer c0c53ad2de avformat/utils: Extend overflow check in dts wrap in compute_pkt_fields()
Fixes: signed integer overflow: -9223372032574480351 - 4294967296 cannot be represented in type 'long long'
Fixes: 30022/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5568610275819520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b37ff29e0e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 1ac57ed112 avfilter/vf_scale: Fix adding 0 to NULL (which is UB) in scale_slice()
Found-by: Jeremy Leconte <jleconte@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1cf96ce269)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 135b6f1e2c avutil/common: Add FF_PTR_ADD()
Suggested-by: Andreas Rheinhardt
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 522a5259e9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer ff66fe2363 avformat/wtvdec: Check size in SBE2_STREAM_DESC_EVENT / stream2_guid
Fixes: signed integer overflow: 539033600 - -1910497124 cannot be represented in type 'int'
Fixes: 30928/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5922630966312960

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1f74661543)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer e606437688 tools/target_dec_fuzzer: Adjust threshold for H264
Fixes: Timeout (too long -> 3sec)
Fixes: 28047/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-4662727980875776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 46c4f39307)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer b788b26b23 avformat/cafdec: Do not build an index if all packets are the same
Fixes: Timeout
Fixes: 28214/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6495999421579264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ea12590c8e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer a64e178277 avformat/vividas: Use equals check with n in read_sb_block()
Fixes: OOM
Fixes: 27780/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5097985075314688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e44214a824)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer f6fdd11125 avcodec/sonic: Use unsigned temporary in predictor_calc_error()
Fixes: signed integer overflow: -2147471366 - 18638 cannot be represented in type 'int'
Fixes: 30157/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5171199746506752

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 075d793ba8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 3d959551ea avformat/jacosubdec: Use 64bit intermediate for start/end timestamp shift
Fixes: signed integer overflow: -1957694447 + -1620425806 cannot be represented in type 'int'
Fixes: 30207/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-5050791771635712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2c477be08a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer c6f7b44202 avformat/flvdec: Check array entry number
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 30209/clusterfuzz-testcase-minimized-ffmpeg_dem_FLV_fuzzer-5724831658147840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b5d8fe1c87)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 6537a93008 avcodec/h264_slice: Check sps in h264_slice_header_init()
Fixes: null pointer dereference
Fixes: h264_slice_header_init.mp4

Found-by: Rafael Dutra <rafael.dutra@cispa.de>
Tested-by: Rafael Dutra <rafael.dutra@cispa.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8047243899)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 3ac8105084 avformat/movenc: Avoid loosing cluster array on failure
Fixes: crash
Fixes: check_pkt.mp4

Found-by: Rafael Dutra <rafael.dutra@cispa.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5c2ff44f91)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer d75ae8f6a7 avformat/avidec: Check for dv streams before using priv_data in parse ##dc/##wb
Fixes: null pointer dereference
Fixes: 31588/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6165716135968768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f733688d30)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 4197e4144b avformat/mov: Check sample size for overflow in mov_parse_stsd_audio()
Fixes: signed integer overflow: 2 * 1914708000 cannot be represented in type 'int'
Fixes: 31639/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6303428239294464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d35677736a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer c00ad4cc4f avformat/sbgdec: Check for overflow in last loop in expand_timestamps()
Fixes: signed integer overflow: 9223372036854775807 + 86400000000 cannot be represented in type 'long'
Fixes: 31003/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6256298771480576

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f44068db1e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 943c992745 avcodec/ffwavesynth: Avoid signed integer overflow in phi_at()
Fixes: signed integer overflow: 2314885530818453536 - -9070214327174160352 cannot be represented in type 'long'
Fixes: 31000/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-6558389742206976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit be08b84f8b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 08d5c98160 avcodec/mpeg4videoenc: Check extradata malloc()
Fixes: Null pointer dereference
Fixes: any mpeg4 testcase which fails the malloc at that exact spot

Found-by: Rafael Dutra <rafael.dutra@cispa.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 33a1687bf6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer b36399f507 avcodec/speedhq: Width < 8 is not supported
Fixes: out of array access
Fixes: 31733/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-4704307963363328
Fixes: 31736/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-6190960292790272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 462b8261aa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer ff7b000ba9 avformat/matroskadec: Check for EOF in resync loop
Fixes: Timeout (too long -> instantly)
Fixes: 29136/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4586141227548672

Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5282147d0c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer edabdfd466 avcodec/utils: Use more bits for intermediate for AV_CODEC_ID_ADPCM_MS
Fixes: signed integer overflow: 1172577312 * 2 cannot be represented in type 'int'
Fixes: 29924/clusterfuzz-testcase-minimized-ffmpeg_dem_BOA_fuzzer-4882912874594304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0f441b9063)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer dcc99bd20c avcodec/jpegls: Check A[Q] for overflow in ff_jpegls_update_state_regular()
Fixes: Timeout
Fixes: 30912/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5556235476795392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8a3fea802a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 43dd8527ed avformat/voc_packet: prevent remaining size from becoming negative in ff_voc_get_packet()
Fixes: memleak
Fixes: 30909/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS_fuzzer-4886284057313280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 337984c133)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 7abe2f9e7f avutil/timecode: Avoid fps overflow
Fixes: Integer overflow and division by 0
Fixes: poc-202102-div.mov

Found-by: 1vanChen of NSFOCUS Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c94875471e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer ff0eb21c75 avformat/mvi: Check audio size for more overflows
Fixes: left shift of negative value -352256000
Fixes: 30837/clusterfuzz-testcase-minimized-ffmpeg_dem_MVI_fuzzer-5755626262888448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 403b35e16e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer 767d4d152b avcodec/flacdec: Avoid undefined shift in error case
Fixes: flac_1040988

Reported-by: Thomas Guilbert <tguilbert@google.com>
Reviewed-by: Thomas Guilbert <tguilbert@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bd525e2876)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:41 +02:00
Michael Niedermayer a961162a90 avcodec/ffv1dec: Check if trailer is available
Fixes: out of array read
Fixes: 29750/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-4808377272238080.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 36ad2f41e3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:40 +02:00
Michael Niedermayer 031e274c93 avcodec/4xm: Check pre_gb in decode_i_block()
Fixes: Timeout
Fixes: 31257/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5150866229297152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b87781649e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:40 +02:00
Michael Niedermayer 74362a55f9 avformat/mvdec: Allocate extradata only once
Fixes: memleak
Fixes: 28686/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5822961932173312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c35e456f54)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:40 +02:00
Michael Niedermayer 4903a57670 avcodec/dcadsp: Fix integer overflow in dmix_add_c()
Fixes: signed integer overflow: 1515225320 + 759416059 cannot be represented in type 'int'
Fixes: 29256/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DCA_fuzzer-5719088561258496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b4ebf483bc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:40 +02:00
Michael Niedermayer 5adc94cf00 avformat/flvdec: Check double before cast in parse_keyframes_index()
Fixes: -2.21166e+304 is outside the range of representable values of type 'long'
Fixes: 29169/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5725452796821504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 09e5e406c7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:40 +02:00
Michael Niedermayer 0661b58141 avformat/paf: Check for EOF before allocation in read_header()
Fixes: OOM
Fixes: 26584/clusterfuzz-testcase-minimized-ffmpeg_dem_PAF_fuzzer-5172661183053824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bcb1e9d3b9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:40 +02:00
Michael Niedermayer 47edf812a8 avcodec/aacdec_template: Avoid undefined negation in imdct_and_windowing_eld()
Fixes: negation of -2147483648 cannot be represented in type 'INTFLOAT' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: 29057/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5642758933053440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 633924539a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:40 +02:00
Michael Niedermayer 27406e2286 avformat/lxfdec: Fix multiple integer overflows related to track_size
Fixes: signed integer overflow: 538976288 * 8 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_LXF_fuzzer-6634030636335104

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7819412f44)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:40 +02:00
Michael Niedermayer 33faa949ea avcodec/exr: skip bottom clearing loop when its outside the image
Fixes: signed integer overflow: 1633771809 * 32960 cannot be represented in type 'int'
Fixes: 26532/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5613925708857344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:40 +02:00
Michael Niedermayer abb141d6fd avutil/parseutils: Check sign in av_parse_time()
Fixes: signed integer overflow: -9223372053736 * 1000000 cannot be represented in type 'long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-6607924558430208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5d7f17e885)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:40 +02:00
Michael Niedermayer 9cd9529377 avformat/aiffdec: Check that SSND is at least 8 bytes
Fixes: Infinite loop
Fixes: 30874/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-5933710488764416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 460d3dc41f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:40 +02:00
Michael Niedermayer e9f3c33591 avformat/dcstr: Check sample rate
Fixes: signed integer overflow: -1300248894420254720 * 16 cannot be represented in type 'long'
Fixes: 30879/clusterfuzz-testcase-minimized-ffmpeg_dem_DCSTR_fuzzer-5094464215449600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fdcb966f4a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:40 +02:00
Michael Niedermayer 99e2e63ae2 avcodec/alsdec: Check bitstream input in read_block()
Fixes: Timeout
Fixes: 28110/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5036338973507584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 53d739db4e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:40 +02:00
Michael Niedermayer 18a716901c avformat/mov: Extend data_size check in mov_read_udta_string()
Fixes: signed integer overflow: -2147483634 - 16 cannot be represented in type 'int'
Fixes: 28322/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5711888402612224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 74c4c53953)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:40 +02:00
Michael Niedermayer 3a1d4b19b9 avformat/aadec: Check for EOF while reading chapters
Fixes: timeout
Fixes: 28199/clusterfuzz-testcase-minimized-ffmpeg_dem_AA_fuzzer-4896162657861632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bcc7d14453)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:40 +02:00
Michael Niedermayer d95e5b8d23 avformat/voc_packet: Add a basic check on max_size
Fixes: signed integer overflow: -2147483648 - 4 cannot be represented in type 'int'
Fixes: 28127/clusterfuzz-testcase-minimized-ffmpeg_dem_VOC_fuzzer-4880586455646208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 52f75181bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:40 +02:00
Michael Niedermayer 91ac3b51b7 avformat/microdvddec: use 64bit for durations
Fixes: signed integer overflow: 7 - -2147483647 cannot be represented in type 'int'
Fixes: 28036/clusterfuzz-testcase-minimized-ffmpeg_dem_MICRODVD_fuzzer-5171698751766528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f569ac4ce0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-10-06 14:41:40 +02:00
James Almer 3aba8b176f avcodec/h264_slice: clear old slice POC values on parsing failure
If a slice header fails to parse, and the next one uses different Sequence and
Picture parameter sets, certain values may not be read if they are not coded,
resulting in the previous slice values being used.

Signed-off-by: James Almer <jamrial@gmail.com>
2021-08-10 15:21:16 -03:00
Timo Rothenpieler 85713d85a7 avfilter/overlay_cuda: check av_buffer_ref result 2021-04-11 10:26:51 +02:00
Timo Rothenpieler 0fcaa97739 avfilter/overlay_cuda: hold explicit reference to hw_device_ctx 2021-04-11 10:26:47 +02:00
Marton Balint 31d249a418 avformat/url: add ff_make_absolulte_url2 to be able to test windows path cases
Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit fb4da90fec)
2021-04-08 17:49:26 +02:00
Marton Balint 51de6103e9 avformat/url: fix ff_make_absolute_url with Windows file paths
Ugly, but a lot less broken than it was.

Fixes ticket #9166.

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit 5dc5f289ce)
2021-04-08 17:49:22 +02:00
Marton Balint 6c414cf8f7 Revert "avcodec: Add FF_CODEC_CAP_INIT_CLEANUP"
This reverts commit 467d9e27e0. It is simpler
than trying to backport the upstream fix, because that depends on several
commits.

Fixes ticket #9161.

Signed-off-by: Marton Balint <cus@passwd.hu>
2021-04-03 21:35:48 +02:00
Marton Balint 4bbcaf7559 fftools/ffplay: do not write out of rdft visualization texture
If the window is resized it was possible that xpos pointed outside the
visualization texture. By rearranging the overflow check we make sure this (and
a crash) does not happen.

We also don't have to use xleft for start position, as that is 0 anyways, and
if we ever want to take into account xleft then the texture should be
positioned accordingly when rendering.

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit 573f05a753)
2021-03-28 01:14:33 +01:00
nyanmisaka 4383b9e8a3 avfilter/overlay_cuda: fix framesync with embedded PGS subtitle
Signed-off-by: nyanmisaka <nst799610810@gmail.com>
2021-03-25 04:40:54 +01:00
Andreas Rheinhardt fbb9368226 avcodec/mxpegdec: Fix memleaks upon init failure
Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 9de6688cc4)
2021-02-27 07:21:00 +01:00
Andreas Rheinhardt eda1ed6f91 avcodec/mjpegdec: Fix memleak upon init failure
This affected all decoders that used ff_mjpeg_decode_init() as init
function; and it also affected decoders that open jpeg decoders via
ff_codec_open2_recursive() as well as MxPEG.

Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit f3e645a796)
2021-02-27 07:21:00 +01:00
Andreas Rheinhardt 4ec5d6896d avfilter/af_headphone: Fix stack buffer overflow
The number of channels can be up to 64, not only 16.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 58b6594b01)
2021-02-27 07:21:00 +01:00
Andreas Rheinhardt d5992cc155 avfilter/af_headphone: Don't overrun array
The headphone filter stores the channel position of the ith HRIR stream
in the ith element of an array of 64 elements; but because there is no
check for duplicate channels, it is easy to write beyond the end of the
array by simply repeating channels.

This commit adds a check for duplicate channels to rule this out.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 14226be499)
2021-02-27 07:21:00 +01:00
Andreas Rheinhardt 9d82a7c813 avfilter/af_headphone: Fix segfault when using very short streams
When the headphone filter does its processing in the time domain,
the lengths of the buffers involved are determined by three parameters,
only two of which are relevant here: ir_len and air_len. The former is
the length (in samples) of the longest HRIR input stream and the latter
is the smallest power-of-two bigger than ir_len.

Using optimized functions to calculate the convolution places
restrictions on the alignment of the length of the vectors whose scalar
product is calculated. Therefore said length, namely ir_len, is aligned
on 32; but the number of elements of the buffers used is given by air_len
and for ir_len < 16 a buffer overflow happens.

This commit fixes this by ensuring that air_len is always >= 32 if
processing happens in the time domain.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 7b74e02ef2)
2021-02-27 07:21:00 +01:00
Andreas Rheinhardt 66e8328d04 avfilter/af_headphone: Check for the existence of samples
Not providing any samples makes no sense at all. And if no samples
were provided for one of the HRIR streams, one would either run into
an av_assert1 in ff_inlink_consume_samples() or into a segfault in
take_samples() in avfilter.c.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit dfd46e2d16)
2021-02-27 07:21:00 +01:00
Andreas Rheinhardt 33f78e278b avfilter/af_headphone: Remove always true check
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 709fca0a94)
2021-02-27 07:21:00 +01:00
Andreas Rheinhardt e212f0c000 avfilter/af_headphone: Don't use uninitialized buffer in log message
This buffer was supposed to be initialized by sscanf(input, "%7[A-Z]%n",
buf, &len), yet if the first input character is not in the A-Z range,
buf is not touched (in particular it needn't be zero-terminated if the
failure happened when parsing the first channel and it still contains
the last channel name if the failure happened when one channel name
could be successfully parsed). This is treated as error in which case
buf is used directly in the log message. This commit fixes this by
actually using the string that could not be matched in the log message
instead.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit e2d4a5807f)
2021-02-27 07:21:00 +01:00
Andreas Rheinhardt 262162883a avformat/segment: Fix error messages
Reviewed-by: Ridley Combs <rcombs@rcombs.me>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 1d090dfa91)
2021-02-27 07:21:00 +01:00
Andreas Rheinhardt 4c7718c1de avformat/segment: Free SegmentListEntries in deinit, not write_trailer
This fixes leaks when the trailer is never written.

Reviewed-by: Ridley Combs <rcombs@rcombs.me>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 848f96a2a6)
2021-02-27 07:21:00 +01:00
Andreas Rheinhardt 2b8ad98791 avformat/segment: Fix leak and invalid free of AVIOContext
seg_init() and seg_write_header() currently contain a few error paths
in which an already opened AVIOContext for the child muxer leaks (namely
if there are unrecognized options for the child muxer or if writing the
header of the child muxer fails); the reason for this is that this
AVIOContext is not closed in the deinit function. If all goes well, it
is closed when writing the trailer. From this it also follows that the
AVIOContext also leaks when the trailer is never written, even when
writing the header succeeds.

But simply freeing said AVIOContext in the deinit function is
complicated by the fact that the AVIOContext may or may not have been
opened via the io_open callback: If options are set to discard header
and trailer, said AVIOContext can also be a null context which must not
be closed via the io_close callback. This may lead to crashes, as
io_close may presume the AVIOContext's opaque to be set. It currently
works with the default io_close callback which simply calls avio_close(),
because avio_close() doesn't care about opaque being NULL since commit
6e8e8431e1. Therefore this commit records
which of the two kinds of AVIOContext is currently in use to use the
right way to close it.

Finally there was one instance (namely if initializing the child muxer
fails with no unrecognized options) where the AVIOContext was always
closed via the io_close callback. The above remark applies to this; it
has been fixed, too.

Reviewed-by: Ridley Combs <rcombs@rcombs.me>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 30de02998d)
2021-02-27 07:21:00 +01:00
Andreas Rheinhardt 021e1aa6b8 avformat/segment: Fix leak of string on error
A string containing the segment's filename that the segment muxer
allocates got only freed in its write_trailer function. This implies
that it leaks if write_trailer is never called, e.g. if initializing
the child muxer fails. This commit fixes this by freeing the string
in the deinit function instead.

Reviewed-by: Ridley Combs <rcombs@rcombs.me>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 3152a2a218)
2021-02-27 07:21:00 +01:00
Andreas Rheinhardt 2c8f99deb8 avformat/segment: Fix segfault when error happens and segment list is output
The segment muxer has an option to output a file containing a list of
the segments written. The AVIOContext used for writing this file is
opened via the main AVFormatContext's io_open callback; seg_free()
meanwhile unconditionally closes this AVIOContext by calling
ff_format_io_close() with the child muxer (the one for the actual output
format) as AVFormatContext.

The problem hereby is that the child AVFormatContext need not exist,
even when the AVIOContext does. This leads to a segfault in
ff_format_io_close() when the child muxer's io_close callback is called.

Situations in which the AVFormatContext can be NULL range from an
invalid reference stream parameter to an unavailable/bogus/unsupported
output format to inability to allocate the AVFormatContext.

The solution is to simply close the AVIOContext with the AVFormatContext
that was used to open it: The main AVFormatContext.

Reviewed-by: Ridley Combs <rcombs@rcombs.me>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 936d967871)
2021-02-27 07:21:00 +01:00
Andreas Rheinhardt 08cd00a86f avformat/segment: Fix segfault on allocation error, avoid allocation
If the user has set none of the options specifying the segments'
durations, a default value of 2s is used by duplicating a "2" string and
using av_parse_time() on it. Yet duplicating the string was unchecked
and if the allocation failed, one would get a segfault in
av_parse_time().

This commit solves this by turning said option into an option of type
AV_OPT_TYPE_DURATION (which also uses av_parse_time() internally),
avoiding duplicating the string altogether.

Reviewed-by: Ridley Combs <rcombs@rcombs.me>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 06f99cc4dd)
2021-02-27 07:21:00 +01:00
Andreas Rheinhardt 1b8c6b2666 avformat/segment: Fix leak of duration/framenumber lists upon error
The code to free them is not in the segment muxer's deinit function,
but in its write_trailer function which means that these lists leak if
write_trailer isn't called after their allocation. This happens e.g. if
the given lists are invalid (e.g. consisting only of ',' (which delimit
entries)), so that parsing them fails and so does the muxer's init
function; write_trailer is then never called.

This has been fixed by moving the code to free them to the deinit
function.

Reviewed-by: Ridley Combs <rcombs@rcombs.me>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 4b836c8613)
2021-02-27 07:21:00 +01:00
Andreas Rheinhardt a00952ea19 avformat/segment: Don't overwrite AVCodecParameters after init
The segment muxer copies the user-provided AVCodecParameters to the
newly created child streams in its init function before initializing the
child muxer; and since commit 8e6478b723,
it does this again before calling avformat_write_header() if that is
called from seg_write_header(). The reason for this is complicated:

At that time writing the header was delayed, i.e. it was not triggered
by avformat_write_header() (unless the AVFMT_FLAG_AUTO_BSF was unset),
but instead by writing the very first packet. The rationale behind this
was to allow to run bitstream filters on the packets in the interleavement
queue in order to generate missing extradata from them before the muxer's
write_header function is actually called.

The segment muxer went even further: It initialized the child muxer and
ran the child muxer's check_bitstream functions on the packets in its
own muxing queue and stole any bitstream filters that got inserted. The
reason for this is that the segment muxer has an option to write the
header to a separate file and for this it is needed to write the child
muxer's header without delay, but with correct extradata. Unsetting
AVFMT_FLAG_AUTO_BSF for the child muxer accomplished the first goal and
stealing the bitstream filters the second; and in order for the child
muxer to actually use the updated extradata, the old AVCodecParameters
(set before avformat_init_output()) were overwritten with the new ones.

Updating the extradata proceeded as follows: The bitstream filter itself
simply updated the AVBSFContext's par_out when processing a packet, in
violation of the new BSF API (where par_out may only be set in the init
function); the muxing code then simply forwarded the updated extradata,
overwriting the par_in of the next BSF in the BSF chain with the fresh
par_out of the last one and the AVStream's par with the par_out of the
last BSF. This was an API violation, too, of course, but it made
remuxing ADTS AAC into mp4/matroska work.

But this no longer serves a useful purpose since the aac_adtstoasc BSF
was updated to propagate new extradata via packet side data in commit
f63c3516577d605e51cf16358cbdfa0bc97565d8; the next commit then removed
the code in mux.c passing new extradata along the filter chain. This
alone justifies removing the code for setting the AVCodecParameters a
second time.

But there is even another reason to do so: It is harmful. The ogg muxer
parses the extradata of Theora and Vorbis in its init function and keeps
pointers to parts of it. Said pointers become dangling when the
extradata is overwritten by the segment muxer, leading to
use-after-frees as has happened in ticket #8881 which this commit fixes.

Ticket #8517 is about another issue caused by this: Immediately after
having overwritten the old AVCodecParameters the segment muxer checks
whether the codec_tag is ok (the codec_tag is set generically when
initializing the child muxer based upon muxer-specific lists). The check
used is: If the child output format has such a list and if the codec tag
of the non-child stream does not match the codec id given the list of
codec tags and if there is a match for the codec id in the codec tag
list, then set the codec tag to zero (and not to the existing match),
otherwise set the codec tag of the child stream to the codec tag
of the corresponding stream of the main AVFormatContext (which is btw
redundant given that the child AVCodecParameters have just been
overwritten with the AVCodecParameters of the corresponding stream of
the main AVFormatContext).

Reviewed-by: Ridley Combs <rcombs@rcombs.me>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 92c8b79b5a)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 69286f8cf9 avformat/dashdec: Reset pointer to NULL after freeing it
This is currently safe here, because the effective lifetime of
adaptionset_lang is parse_manifest_adaptationset() (i.e. the pointer
gets overwritten each time on entry to the function and gets freed
before exiting the function), but it is nevertheless safer to reset the
pointer.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 616eb93a40)
2021-02-27 07:20:59 +01:00
Christopher Degawa 9e950320e7 libavformat/dashdec: Fix issue with dash on Windows
Use xmlFree instead of av_freep

snip from libxml2:

 * xmlGetProp:
...
 * Returns the attribute value or NULL if not found.
 *     It's up to the caller to free the memory with xmlFree().

According to libxml2, you are supposed to use xmlFree instead of free
on the pointer returned by it, and also using av_freep on Windows will
call _aligned_free instead of normal free, causing _aligned_free to raise
SIGTRAP and crashing ffmpeg and ffplay.

Signed-off-by: Christopher Degawa <ccom@randomderp.com>
(cherry picked from commit 0117d5aa03)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt f3ee6b2a3e avformat/dashdec: Fix memleak on allocation error, avoid allocation
get_content_url() allocates two buffers for temporary strings and when
one of them couldn't be allocated, it simply returns, although one of
the two allocations could have succeeded and would leak in this
scenario. This can be fixed by avoiding one of the temporary buffers.

Reviewed-by: Steven Liu <lq@chinaffmpeg.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 0f9ade1ff3)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 3c13a44dd4 avformat/dashdec: Fix memleaks on error to add representation to dynarray
Up until now, the DASH demuxer used av_dynarray_add() to add
audio/video/subtitles representations to arrays. Yet av_dynarray_add()
frees the array upon failure, leading to leaks of its elements;
furthermore, the element to be added leaks, too.

This has been fixed by using av_dynarray_add_nofree() instead and by
freeing the elements that could not be added to the list. Furthermore,
errors from this are now checked and returned.

Reviewed-by: Steven Liu <lq@chinaffmpeg.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit d63f8c873b)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 92898d7536 avformat/dashdec: Fix leak of representation languages
These languages are normally freed after having been added as metadata
to their respective AVStreams. Yet if one never reaches said point, they
leak. This can happen as a result of an error when reading the header or
as a result of refreshing the manifests.

Reviewed-by: Steven Liu <lq@chinaffmpeg.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit f1c3c173c9)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt ee0bf1d5f8 avformat/dashdec: Fix leak of string on error when parsing representation
The DASH demuxer currently extracts several strings at once from an xml
document before processing them one by one; these strings are allocated,
stored in local variables and need to be freed by the demuxer itself.
So if an error happens when processing one of them, all strings need to
be freed before returning. This has simply not been done, leading to
leaks.

A simple fix would be to add the necessary code for freeing; yet there is
a better solution: Avoid having several strings at the same time by
extracting a string, processing it and immediately freeing it. That way
one only has to free at most one string on error.

Reviewed-by: Steven Liu <lq@chinaffmpeg.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit e7aea1fe73)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 74b97ea603 avformat/dashdec: Fix leak of representation on error
If parsing a representation fails, it is not added to the list of
representations and is therefore not freed in dash_close(); it therefore
leaked in most error paths in parse_manifest_representation() (some
error paths had (incomplete) code for freeing). This commit fixes
freeing the representation in this case.

Reviewed-by: Steven Liu <lq@chinaffmpeg.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 5c91701dc7)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 06d5472b3c avformat/dashdec: Remove unused index of representation
It is always zero. Also remove other unused elements.

Reviewed-by: Steven Liu <lq@chinaffmpeg.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 5d63f154ef)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt a42f19e211 avformat/dashdec: Fix memleaks upon read_header failure
Reviewed-by: Steven Liu <lq@chinaffmpeg.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 06e31f953e)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt ef338de23c avformat/dashdec: Check allocation of AVProgram
Reviewed-by: Steven Liu <lq@chinaffmpeg.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit aed96e13c1)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt d23b9dd9cf avformat/dashdec, hls: Update correct pointer to AVDictionary
open_url() in the DASH as well in the hls demuxer share a common bug:
They modify an AVDictionary (i.e. set a new entry) given to them as
AVDictionary *, yet if this new entry leads to reallocation and
relocation of the AVDictionary, the caller's pointer will become
dangling, leading to use-after-frees. So pass an AVDictionary **.

(With the current implementation of AVDictionary the above can only
happen if the AVDictionary was empty initially (in which case the
new AVDictionary leaks); furthermore if the I/O is ordinary (i.e. opened
by avio_open2() or ffio_open_whitelist()), the dict is never empty (it
contains an rw_timeout entry from save_avio_options()). So this issue
could only happen if the caller sets a nondefault io_open callback, but
no AVIOContext (the AVFMT_FLAG_CUSTOM_IO flag won't be set in this
case). In case of the HLS demuxer, it was also necessary that setting
the "seekable" entry failed. Yet one should simply not rely on internals
of the AVDict API.)

Reviewed-by: Steven Liu <lq@chinaffmpeg.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit ac2852d795)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 9ad4fc4369 avformat/dashdec: Fix leak of AVDictionary on error
Just postpone the allocation of the dict until it is really needed
(after the checks that can fail).

Reviewed-by: Steven Liu <lq@chinaffmpeg.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 4b8fdf70a8)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 52d18d7e88 avformat/dashdec: Free subtitle representations on exit
Reviewed-by: Steven Liu <lq@chinaffmpeg.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit eb344862e4)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt c182a2ba40 avformat/dashdec: Free strings as soon as they aren't needed anymore
Reviewed-by: Steven Liu <lq@chinaffmpeg.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 7369e95267)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 9b9fd0dd20 avformat/dashdec: Don't overwrite and leak old initialization fragments
Reviewed-by: Steven Liu <lq@chinaffmpeg.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 17963a6ad7)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 6b7172bcd4 avformat/dashdec: Don't leave representation in inconsistent state on error
This currently doesn't cause any trouble, because the only caller did
not clean up the representation upon error at all; but fixing this is
a prerequisite for doing so.

Reviewed-by: Steven Liu <lq@chinaffmpeg.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 01a4c35969)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 9ec9fc351e avformat/dashdec: Remove dead code
The code in question seems to have been copied from about 70 lines
above; yet the code here is only executed if some of the variables
(namely representation_segmenttemplate_node and fragment_template_node)
are NULL, so it makes no sense to check them for a child element.

Also remove a redundant resetting of a pointer to an AVFormatContext
after avformat_close_input() (which already sets the pointer to NULL).

Reviewed-by: Steven Liu <lq@chinaffmpeg.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 248ef276be)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt c0aa40d334 avformat/spdifenc: Fix leak upon error
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit e38cbb8d19)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt de2229421e avformat/wavenc: Fix leak and segfault on reallocation error
Up until now, the wav muxer used a reallocation of the form ptr =
av_realloc(ptr, size); that leaks upon error. Furthermore, if a
failed reallocation happened when writing the trailer, a segfault
would occur due to avio_write(NULL, size) because the muxer only
prints an error message upon allocation error, but does not return
the error.

Moreover setting the pointer to the buffer to NULL on error seems to
be done on purpose in order to record that an error has occured so that
outputting the peak values is no longer attempted. This behaviour has
been retained by simply disabling whether peak data should be written
if an error occurs.

Finally, the reallocation is now done once per peak block and not once
per peak block per channel; it is also done with av_fast_realloc and not
with a linear size increase.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 19ae873252)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 99812e2355 avformat/mpegenc: Avoid adding invalid packet to queue
Do this by moving the check before the allocation.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 4294f64d57)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt d711b56985 avformat/mpegenc: Fix leak in case trailer is never written
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 54987a37da)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 0685bd0245 avformat/mpegenc: Ensure packet queue stays valid
The MPEG-PS muxer uses a custom queue of custom packets. To keep track
of it, it has a pointer (named predecode_packet) to the head of the
queue and a pointer to where the next packet is to be added (it points
to the next-pointer of the last element of the queue); furthermore,
there is also a pointer that points into the queue (called premux_packet).

The exact behaviour was as follows: If premux_packet was NULL when a
packet is received, it is taken to mean that the old queue is empty and
a new queue is started. premux_packet will point to the head of said
queue and the next_packet-pointer points to its next pointer. If
predecode_packet is NULL, it will also made to point to the newly
allocated element.

But if premux_packet is NULL and predecode_packet is not, then there
will be two queues with head elements premux_packet and
predecode_packet. Yet only elements reachable from predecode_packet are
ever freed, so the premux_packet queue leaks.
Worse yet, when the predecode_packet queue will be eventually exhausted,
predecode_packet will be made to point into the other queue and when
predecode_packet will be freed, the next pointer of the preceding
element of the queue will still point to the element just freed. This
element might very well be still reachable from premux_packet which
leads to use-after-frees lateron. This happened in the tickets mentioned
below.

Fix this by never creating two queues in the first place by checking for
predecode_packet to know whether the queue is empty. If premux_packet is
NULL, then it is set to the newly allocated element of the queue.

Fixes tickets #6887, #8188 and #8266.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit cfce16449c)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 3865b1952e avformat/mxfenc: Never set codec_ul UID to NULL
mxf distinguishes codec profiles by different UIDs and therefore needs
to check that the input is actually compatible with mxf (i.e. if there
is a defined UID for it). If not, then sometimes the UID would be set to
NULL and writing the (video) packet would fail. Yet the following audio
packet would trigger writing the header (which has been postponed because
the UID is not known at the start) and if the UID is NULL, this can lead
to segfaults. This commit therefore stops setting the UID to NULL if the
input is incompatible with mxf (it has initially been set to a generic
value in mxf_write_header()).

Fixes #7993.

Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 5400e4a50c)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 6ab290e20a avcodec/frame_thread_encoder: Fix segfault on allocation error
Fixes a segfault from av_fifo_size(NULL) that happens in
ff_frame_thread_encoder_free if the fifo couldn't be allocted;
furthermore the mutexes and conditions that are destroyed in
ff_frame_thread_encoder_free are not even initialized at this point,
so don't call said function.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 2ccbc40eef)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 515aa63e4d avformat/utils: Add av_assert1 to preclude NULL + len, len != 0
Such a scenario is undefined behaviour and would also indicate a bug
in our code.

Suggested-by: James Almer <jamrial@gmail.com>
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit da857099e9)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 3e8771e99e avformat/utils: Fix undefined NULL + 0
This is undefined behaviour in C, so use data = len ? data + len : data
instead of data += len. GCC optimizes the branch away in this case;
Clang unfortunately doesn't.

Fixes ticket #8592.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 9c0b3eddf4)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt a86fd1c7d5 avcodec/g722enc: Validate parameters before using them
In case trellis is outside of 0..23, an invalid shift and/or a signed
integer overflow happens; furthermore, it can lead to the request to
allocate nonsense amounts of memory. So validate first.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 8d21eccd26)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt a8bd30a48e avcodec/g722enc: Cleanup generically on init failure
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 23daf8e67f)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 45d9887751 avcodec/opusdec: Return error upon error
The Opus decoder forgot to return an error when allocating an
SwrContext fails.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 794fb18369)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 6d3a064251 avcodec/wavpack: Fix leak on init failure
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit fd5d66af74)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 92d0a598ad avcodec/pthread_slice: Don't use static variable, fix race
ff_slice_thread_init() uses a static variable to hold a function
pointer, although the value of said pointer needn't be saved between
different runs of this function at all.

The reason for this being so is probably that said pointer points to
a static function (if used); but storage class specifiers like "static"
are not part of the type of an object and so including it in the pointer
declaration is wrong (anyway, "static" means different things in both
contexts: for the function declaration it affects linkage, for the
variable storage duration).

Using a static variable here can lead to races, e.g. when initializing
VP9 (for which said function pointer was added) and H.264 with slice
threading. The latter has the FF_CODEC_CAP_INIT_THREADSAFE flag set and
is therefore unaffected by the lock guarding initializations of
decoders.

Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 0639f5c294)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 85e0f7d500 avcodec/a64multienc: Fix memleak upon init failure
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 5baee59301)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt e30b61c261 avformat/flacenc: Fix memleak when writing attached pictures fails
The FLAC muxer currently stores an attached picture corresponding to an
AVStream in AVStream.priv_data. The AVPacket contained therein is
unreferenced after it has been written. The AVPacket structure itself is
then freed generically as AVStream.priv_data.

And this can lead to memleaks if an attached picture is not written:
It might be because the trailer is never written or because writing
a previous attached picture failed in case error_recognition is set
to explode.

Therefore free the packets properly (i.e. with av_packet_free())
in the muxer's deinit function.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 029cf6a91c)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt eb5c81f373 avcodec/mpeg12enc: Always initialize MPEG-2 intra VLC table lengths
The MPEG-1/2 encoders initialize several tables once during the first
time one of the encoders is initialized; the table for MPEG-2 intra VLC
lengths is only initialized if it is used for this encoder instance.
This implies that if the first MPEG-1/2 encoder to be initialized does
not use it, it will never be initialized even if a later encoder
instance makes use of them. Fix this by initializing this table
unconditionally.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit ef3c1670d4)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt b7d4a08f0d avcodec/fft_template, fft_init_table: Make ff_fft_init() thread-safe
Commit 1af615683e put initializing
the ff_fft_offsets_lut (which is typically used if FFT_FIXED_32)
behind an ff_thread_once() to make ff_fft_init() thread-safe; yet
there is a second place where said table may be initialized which
is not guarded by this AVOnce: ff_fft_init_mips(). MIPS uses this LUT
even for ordinary floating point FFTs, so that ff_fft_init() is not
thread-safe (on MIPS) for both 32bit fixed-point as well as
floating-point FFTs; e.g. ff_mdct_init() inherits this flaw and
therefore initializing e.g. the AAC decoders is not thread-safe (on
MIPS) despite them having FF_CODEC_CAP_INIT_CLEANUP set.

This commit fixes this by moving the AVOnce to fft_init_table.c and
using it to guard all initializations of ff_fft_offsets_lut.

(It is not that bad in practice, because every entry of
ff_fft_offsets_lut is never read during initialization and is only once
ever written to (namely to its final value); but even these are
conflicting actions which are (by definition) data races and lead to
undefined behaviour.)

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit b9c1ab8907)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 9475175ec0 avformat/asfdec_o: Don't segfault with lots of attached pics
The ASF file format has a limit of 127 streams and the "asf_o" demuxer
(the ASF demuxer from Libav) has an array of pointers for a structure
called ASFStream that is allocated on demand for every stream. Attached
pictures are not streams in the sense of the ASF specification, yet the
demuxer created an ASFStream for them; and in one codepath it also
forgot to check whether the array of ASFStreams is already full. The
result is a write beyond the end of the array and a segfault lateron.

Fixing this is easy: Don't create ASFStreams for attached picture
streams.

(Other results of the current state of affairs are unnecessary allocations
(of ASFStreams structures), the misparsing of valid files (there might not
be enough ASFStreams left for the valid streams if attached pictures take
up too many); furthermore, the ASFStreams created for attached pictures all
have the stream number 0, an invalid stream number (the valid range is
1-127). This means that invalid data (packets for a stream with stream
number 0) won't get rejected lateron.)

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit e83f27a21a)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 2eb76188d0 avcodec/mss4: Fix memleaks upon allocation error
During init the mts2 decoder allocates several VLCs and then several
buffers in a loop; if one of the latter allocations fails, only the VLCs
are freed, not any buffers that might already have been successfully
allocated. This commit fixes this by setting the
FF_CODEC_CAP_INIT_CLEANUP flag.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 4b4c7d6e1a)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 25a5fddbb7 avformat/apngdec: Fix size/overflow checks
apng data consists of parts containing a small header (including a
four-byte size field) and a data part; the size field does not account
for everything and is actually twelve bytes short of the actual size. In
order to make sure that the size fits into an int, the size field is
checked for being > INT_MAX; yet this does not account for the + 12 and
upon conversion to int (which happens when calling append_extradata()),
the size parameter can still wrap around. In this case the currently
used check would lead to undefined signed integer overflow.

Furthermore, append_extradata() appends the new data to the already
existing extradata and therefore needs to make sure that the combined
size of new and old data as well as padding fits into an int. The check
used for this is "if (old_size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE -
new_size)". If new_size is > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE
the right side becomes negative if the types are signed (as they are
now); yet changing this to "if (new_size > INT_MAX -
AV_INPUT_BUFFER_PADDING_SIZE - old_size)" is better as this also works
for unsigned types (where it is of course presumed that INT_MAX is
replaced by the corresponding maximum for the new type).

Both of these issues have been fixed.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 9c341c6c92)
2021-02-27 07:20:59 +01:00
Andreas Rheinhardt 8372a3b4b1 avformat/apngdec: Return error for incomplete header
If avio_read() could read anything, it returns the number of bytes read,
even if it could not read as much as the caller desired.
apng_read_header() only checked the return value of its avio_read() calls
for being negative and this meant that it was possible for an incomplete
header to not be detected. The return value of the last successfull call
has been returned instead. This commit changes this.

Fixes: OOM
Fixes: 26608/clusterfuzz-testcase-minimized-ffmpeg_dem_APNG_fuzzer-4839491644424192

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 2cf1eefae5)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt b7ad5dbb5e avformat/jacosubdec: Fix unintended fallthrough
Regression since 715ff75e5d.

Fixes Coverity issues #1468654 and #1468656.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 11ea0ed20e)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 943ce3a756 avcodec/bitstream: Consistently treat symbol as VLC_TYPE
If a static VLC table gets initialized a second time (or concurrently by
two threads) and if said VLC table uses symbols that have the sign bit
of VLC_TYPE (a typedef for int16_t) set, initializing the VLC fails. The
reason is that the type of the symbol in the temporary array is an
uint16_t and so comparing it to the symbol read from the VLC table will
fail, because only the lower 16bits coincide. Said failure triggers an
assert.

Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit df6ec7f83b)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt da5ac1563e avcodec/vp3: Check allocations of VLCs
It would lead to crashs lateron if they failed.

Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 786b1b0c44)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 4e5a97e393 avcodec/vp3: Fix memleak upon init failure
Up until now, there was no cleanup in case initializing the Theora VLC
tables failed, leading to memleaks. This commit gets rid of them by
setting the FF_CODEC_CAP_INIT_CLEANUP flag for all decoders in vp3.c;
this also allows to remove some (now redundant) cleanup code.

Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit a01ca21bbb)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 78ac14f280 avcodec/movtextenc: Fix undefined left shifts outside the range of int
Reviewed-by: Philip Langdale <philipl@overt.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 2f9fc35028)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 915e68c051 avcodec/movtextenc: Fix memleak on (re)allocation error
Up until now, the mov_text encoder used the dynamic array API for its
list of style attributes; it used the (horrible) av_dynarray_add() which
works with an array of pointers; on error it frees its array but not
the buffers referenced by the pointers said array contains. It also
returns no error code, encouraging not to check for errors.

These properties imply that this function may only be used if the buffers
referenced by the list either need not be freed at all or if they are
freed by other means (i.e. if the list contains non-ownership pointers).

In this case, the style attributes are owned by the pointers of the
dynamic list. Ergo the old style attributes leak on a subsequent
reallocation failure. But given that the (re)allocation isn't checked
for success, the style attribute intended to be added to the list also
leaks because the only pointer to it gets overwritten in the belief that
it is now owned by the list.

This commit fixes this by switching to av_fast_realloc() and an array
containing the styles directly instead of pointers to individually
allocated style attributes. The current style attributes are now no longer
individually allocated, instead they are part of the context.

Furthermore, av_fast_realloc() allows to easily distinguish between
valid and allocated elements, thereby allowing to reuse the array
(which up until now has always been freed after processing an
AVSubtitleRect).

Reviewed-by: Philip Langdale <philipl@overt.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 9a731e9fec)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 0f70a8ae19 avcodec/movtextenc: Don't presume every style to have a font
Fixes segfaults in the absence of fonts; this can happen because the
file didn't contain any or because the allocation of the font-string
failed.

Reviewed-by: Philip Langdale <philipl@overt.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 0dd7b8232d)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt f4d7dba3ce avcodec/movtextenc: Reset array counter after freeing array
Otherwise the mov_text encoder can segfault when given subtitles with more
than one AVSubtitleRect if one of the first nb_rects - 1 rects contained
a style attribute.

Reviewed-by: Philip Langdale <philipl@overt.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 8d4431955c)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt bb8d18a39b avcodec/movtextenc: Fix potential use of uninitialized value
Background colour was never initialized if no style was available.
Use a sane default of zero (i.e. completely transparent).

Fixes Coverity issue #1461471.

Reviewed-by: Philip Langdale <philipl@overt.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 56b3726ed2)
2021-02-27 07:20:58 +01:00
Andriy Gelman 1eb8f6885e avcodec/movtextenc: fix writing to bytestream on BE arches
Fixes fate-binsub-movtextenc on PPC64

Currently tags are written in reverse order on BE arches. This is fixed
by using MKBETAG() and AV_RB32() to be arch agnostics.

Also s->font_count is of type int. On BE arches with 32bit int,
count = AV_RB16(&s->font_count) will read two most significant bytes
instead of the least significant bytes. This is fixed by assigning
s->font_count to count first.

The final change is modifying the type of len. On BE arches
the most significant byte of the int was written instead of the least
significant byte.

Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com>
(cherry picked from commit d4c46dc328)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 51faa4bd60 avcodec/movtextdec: Fix leaks on (re)allocation failure
Up until now, the 3GPP Timed Text decoder used av_dynarray_add()
for a list of style entries. Said entries are individually allocated
and owned by the pointers in the dynamic array and are therefore
unsuitable for av_dynarray_add() which simply frees the array,
but not the entries on error. In this case the intended new entry
also leaks because it has been forgotten to free it.

This commit fixes this. It is now allocated in one go and not
reallocated multiple times (and it won't be overallocated any more).
After all, the final number of elements (pending errors) is already
known in advance.

Furthermore, the style entries are now the entries of the new array,
i.e. they are no longer allocated separately. This also removes one
level of indirection.

Reviewed-by: Philip Langdale <philipl@overt.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 94ad68ee17)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt b4a96efdda avcodec/movtextdec: Simplify checking for invalid extradata
Every font entry occupies at least three bytes, so checking early
whether there is that much data available is a low-effort way to exclude
invalid extradata. Doing so leads to an overall simplification.

Reviewed-by: Philip Langdale <philipl@overt.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit a42695c072)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 59b8634411 avcodec/movtextdec: Fix leaks of strings upon reallocation failure
Up until now, the 3GPP Timed Text decoder used av_dynarray_add()
for a list of font entries, a structure which contains an allocated
string. The font entries are owned by the pointers in the dynamic array
and are therefore unsuitable for av_dynarray_add() which simply frees
the array, but not the font entries and of course not the strings. The
latter all leak if reallocating the dynamic array fails.

This commit fixes this. It stops reallocating the array altogether:
After all, the final number of elements (pending errors) is already
known in advance.

Furthermore, the font entries are now the entries of the new array,
i.e. the font entries are no longer allocated separately. This also
removes one level of indirection.

Reviewed-by: Philip Langdale <philipl@overt.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 38cdd27e9b)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 2e49daad79 avcodec/movtextdec: Reset counter of fonts when freeing them
If allocating fonts fails when reading the header, all fonts are freed,
yet the counter of fonts is not reset and no error is returned; when
subtitles are decoded lateron, the inexistent list of fonts is searched
for the matching font for this particular entry which of course leads to
a segfault.

Reviewed-by: Philip Langdale <philipl@overt.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 5758620560)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 9c6feb104d avcodec/sheervideo: Don't leave context in inconsistent state upon error
This has happened if the format changed midstream and if the new packet
is so small that it is instantaneously rejected: In this case the VLC
tables were for the new format, although the context says that they are
still the ones for the old format. It can also happen if the format
changed midstream and the allocation of the new tables fails. If the
next packet is a packet for the old format, the decoder thinks it
already has the correct VLC tables, leading to a segfault.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 8969b9aa06)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt a7d3dc5b04 avfilter/vf_minterpolate: Fix left shift of negative value
This has happened when initializing the motion estimation context if
width or height of the video was smaller than the block size used
for motion estimation and if the motion interpolation mode indicates
not to use motion estimation.

The solution is of course to only initialize the motion estimation
context if the interpolation mode uses motion estimation.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit aa262dcce8)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 8b7f2f0ec5 avfilter/vf_minterpolate: Reject too small dimensions
The latter code relies upon the dimensions to be not too small;
otherwise one will call av_clip() with min > max lateron which aborts
in case ASSERT_LEVEL is >= 2 or one will get a nonsense result that may
lead to a heap-buffer-overflow/underflow. The latter has happened in
ticket #8248 which this commit fixes.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit bb13cdbe27)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt bcf3ac039b avformat/movenc: Don't forget to free fragment buffers
The buffers used when fragmented output is enabled have up until now not
been freed in the deinit function; they leak e.g. if one errors out of
mov_write_trailer() before one reaches the point where they are normally
written out and freed. This can e.g. happen if allocating new vos_data
fails at the beginning of mov_write_trailer().

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit e3b5316bed)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 3fc8dc3589 avformat/movenc: Free old vos_data before overwriting it
Otherwise the old data leaks whenever extradata needs to be rewritten
(e.g. when encoding FLAC with our encoder that sends an updated
extradata packet at the end).

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 432f291dff)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt dc4e3b9586 avformat/movenc: Fix segfault when remuxing rtp hint stream
When remuxing an rtp hint stream (or any stream with the tag "rtp "),
the mov muxer treats this as one of the rtp hint tracks it creates
internally when ordered to do so; yet this track lacks the
AVFormatContext for the hinting rtp muxer, leading to segfaults in
mov_write_udta_sdp() if a "trak" atom is written for this stream; if not,
the stream's codecpar is freed by mov_free() as if the mov muxer owned
it (it does for the internally created "rtp " tracks), but without
resetting st->codecpar, leading to double-frees lateron. This commit
therefore ignores said tag which makes rtp hint streams unremuxable.

This fixes tickets #8181 and #8186.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 22c3cd1760)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 3f9c5f242f avcodec/dvenc: Fix undefined left shift of negative numbers
The earlier code was based on the assumption that AVFrame.linesize can
not be negative.

Fixes ticket #8280.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 6770057ac9)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 0608949fa2 avformat/movenc: Fix stack overflow when remuxing timecode tracks
There are two possible kinds of timecode tracks (with tag "tmcd") in the
mov muxer: Tracks created internally by the muxer and timecode tracks
sent by the user. If any of the latter exists, the former are
deactivated. The former all belong to another track, the source
track; the latter don't have a source track set, but the index of the
source track is initially zeroed by av_mallocz_array(). This is a
problem since 3d894db700: Said commit added
a function that calculates the duration of tracks and the duration of
timecode tracks is calculated by rescaling the duration (calculated by
the very same function) of the source track. This gives an infinite
recursion if the first track (the one that will be treated as source
track for all timecode tracks) is a timecode track itself, leading to a
stack overflow.

This commit fixes this by not using the nonexistent source track
when calculating the duration of timecode tracks not created internally
by the mov muxer.

Reviewed-by: Martin Storsjö <martin@martin.st>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 22a2386a56)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 211f23d789 avcodec/utils: Also free encoder extradata on avcodec_open2() error
It is owned by libavcodec for encoders.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit b8e0ceda11)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 39d6d7f7e8 avcodec/utils: Don't forget cleaning up when allocating priv_data fails
Allocating an AVCodecContext's priv_data used to be the first object
allocated in avcodec_open2(), so it was unnecessary to goto free_and_end
(which does the cleanup) upon error here. But this is no longer so since
f3a29b750a.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit d1dcc20126)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 3fe22f2a0d avcodec/utils: Improve check for freeing codec private options
Don't check for AVCodec.priv_data_size (which is always true if
AVCodec.priv_class is set). Instead check for AVCodecContext.priv_data
to actually exist.

(Note: av_opt_free(NULL) is a no-op.)

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit c6e54d14c5)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 9f895e984b swresample/audioconvert: Fix left shift of negative value
Fixes ticket #8219.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 9d8f9b2e40)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 62dc4c2df5 avcodec/utils: Only call codec->close if init has been called
avcodec_open2() also called the AVCodec's close function if an error
happened before init had ever been called if the AVCodec has the
FF_CODEC_CAP_INIT_CLEANUP flag set. This is against the documentation of
said flag: "The codec allows calling the close function for deallocation
even if the init function returned a failure."

E.g. the SVQ3 decoder is not ready to be closed if init has never been
called.

Fixes: NULL dereference
Fixes: 25762/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-5716279070294016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 5bc74d06da)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 89231df489 avformat/movenc: Fix segfault upon allocation error
Reviewed-by: Jan Ekström <jeebjp@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 4106013523)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 9637dc8ebd avformat/swfdec: Reorder allocations/initializations
The earlier code would first attempt to allocate two buffers, then
attempt to allocate an AVIOContext, using one of the new buffers I/O
buffer, then check the allocations. On success, a z_stream that is used
in the AVIOContext's read_packet callback is initialized afterwards.

There are two problems with this: In case the allocation of the I/O
buffer fails avio_alloc_context() will be given a NULL read buffer
with a size > 0. This works right now, but it is fragile. The second
problem is that the z_stream used in the read_packet callback is not
functional when avio_alloc_context() is allocated (it might be that
avio_alloc_context() might already fill the buffer in the future). This
commit fixes both of these problems by reordering the operations.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 3f04c30372)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 5db6f6672f avformat/swfdec: Fix memleaks on error
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 28dc0c20cc)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 753c0afe72 avformat/dashdec: Avoid double free on error
When using one of the AV_DICT_DONT_STRDUP_KEY/VAL flags, av_dict_set()
already frees the key/value on error, so that freeing it again would
lead to a double free.

Reviewed-by: Steven Liu <lq@chinaffmpeg.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit e09e2c6442)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 4e7e2e1bd3 avformat/tedcaptionsdec: Fix leak of AVBPrint upon error
The tedcaptions demuxer uses an AVBPrint whose string is not restricted
to its internal buffer; it therefore needs to be cleaned up, yet this is
not done on error, as parse_file() returned simply returned directly.
This is fixed by going to fail first in such cases.
Furthermore, there is also a second way how this string can leak: By
having more than one subtitle per subtitle block, as the new one simply
overwrites the old one in this case as the AVBPrint is initialized each
time upon encountering a subtitle line. The code has been modified to
simply append the new subtitle to the old one, so that the old one can't
leak any more.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 9f7e592df2)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt ffb0cad8f9 avformat/swfenc: Fix memleak upon write_header error
The SWF muxer accepts at most one mp3 audio and at most one VP6F, FLV1
or MJPEG stream. Upon encountering an mp3 stream, a fifo is allocated
that leaks if one of the subsequent streams is incompliant with the
restrictions mentioned above or if the framerate or samplerate are
invalid. This is fixed by adding a deinit function to free said fifo.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit d554aabdaf)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 2d91ddd2df avformat/rmdec: Fix potential crash on allocation failure
The RealMedia demuxer uses the priv_data of its streams to store a
structure containing an AVPacket. These packets are unreferenced in the
read_close function, yet said function simply presumed that the
priv_data has been successfully allocated. This implies that it mustn't
be called when an allocation of priv_data fails; but this can happen
since commit 35bbc1955a if one has a
stream with multiple substreams (also exported as AVStream) and if
allocating the priv_data for one of these substreams fails.

This has been fixed by making sure that read_close can handle the case
in which priv_data has not been successfully allocated.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 5aafdb4e5f)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 7b4ff1a19a avformat/rmdec: Actually return value < 0 on read_header failure
The RealMedia demuxer's read_header function initially initializes ret,
the variable designated for the return variable to -1. Afterwards, chunks
of the file are parsed in a loop until an error happens or until the actual
frame data is encountered. If the first function whose return
value is put into ret doesn't fail, then ret contains a value >= 0
(actually == 0) and this is what will be returned if an error is
encountered afterwards.

This is a regression since 35bbc1955a.
Before that, ret had never been overwritten with a nonnegative value.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 4cc43d30c3)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt 287a06cb1b avformat/avidec: Fix memleak when error happens after creating DV stream
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit ea45d6e61a)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt cb08668ff9 avcodec/mpegaudiodec_template: Check return value of subdecoder
After all, allocating an AVFloatDSPContext might have failed.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit dac9e88a99)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt c937f21e26 avcodec/j2kenc: Fix leaks on init failure
The JPEG2000 encoder did not clean up after itself on error.
This commit fixes this by modifying the cleanup function to be able to
handle only partially allocated structures and by setting the
FF_CODEC_CAP_INIT_CLEANUP flag.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 3d83de4187)
2021-02-27 07:20:58 +01:00
Andreas Rheinhardt f8747758bb avcodec/flashsv2enc: Check allocations for success before usage
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 319dbcf440)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 140d871e08 avcodec/flashsvenc: Avoid allocation of buffer, fix memleak
Up until now, the flashsv encoder tried to allocate two buffers in its
init function; if only one of these allocations succeeds, the other
buffer leaks. Fix this by making one of these buffers part of the
context (its size is a compile-time constant).

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit ec6f4c5158)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 5000bae830 avcodec/ac3enc_template: Don't free uninitialized pointers on error
The ac3 encoders (fixed- and floating-point AC-3 as well as the EAC-3
encoder) all allocate an array whose elements are pointers to other
buffers. The array is not zeroed initially so that if an allocation of
one of the subbuffers fails, the other pointers are uninitialized.
This causes problems when cleaning, so zero the array initially.

(Only the fixed-point AC-3 encoder was affected by this, because
the other two don't clean up at all in case of errors during init.)

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit ae36fad624)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 7cfa8e1910 avcodec/svq3: Fix segfault on allocation error, avoid allocations
The very first thing the SVQ3 decoder currently does is allocating several
SVQ3Frames, a structure which contains members that need to be freed on
their own. If one of these allocations fails, the decoder calls its own
close function to not leak the already allocated SVQ3Frames. Yet said
function presumes that the SVQ3Frames have been successfully allocated
as there is no check before freeing the members that need to be freed.

This commit fixes this by making these frames part of the SVQ3Context,
thereby avoiding the allocations altogether. Notice that the pointers
to the frames have been retained in order to allow to just swap them as
the code already does.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 96061c5a4f)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 2e05113b92 avcodec/sonic: Fix leaks upon allocation errors
The Sonic decoder and encoders allocate several buffers in their init
function and return immediately if one of these allocations fails; this
will lead to leaks if there was an earlier successfull allocation. Fix
this by setting the FF_CODEC_CAP_INIT_CLEANUP flag.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 7d91f9271e)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 0dd79193a7 avcodec/qtrleenc: Fix memleak upon allocation failure
The qtrle encoder allocates several buffers and an AVFrame in its init
function. If one of these allocations fails, but others succeed, the
successfully allocated objects leak. This is fixed by setting the
FF_CODEC_CAP_INIT_CLEANUP flag.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 2a71cbeb01)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt ce629ee216 avcodec/ffv1enc: Fix memleaks on init failure
The FFV1 encoder has so far not cleaned up after itself in this case;
but it can be done easily by setting the FF_CODEC_CAP_INIT_CLEANUP flag.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit f9215d0bb2)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 5e95dc426e avcodec/ffv1: Fix segfaults on allocation error
When allocating FFV1 slice contexts fails, ff_ffv1_init_slice_contexts()
frees everything that it has allocated, yet it does not reset the
counter for the number of allocated slice contexts. This inconsistent
state leads to segfaults lateron in ff_ffv1_close(), because said
function presumes that the slice contexts have been allocated.
Fix this by making sure that the number of slice contexts on error is
consistent (namely zero).

(This issue only affected the FFV1 decoder, because the encoder does not
clean up after itself on init failure.)

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit a0750f412a)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt e7780f1615 avcodec/mlpenc: Fix memleak upon init failure
If an error happens during init after an allocation has succeeded,
the already allocated data leaked up until now. Fix this by setting the
FF_CODEC_CAP_INIT_CLEANUP flag.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit b78031cf16)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 7b10d643a0 avcodec/indeo5: Fix memleaks upon allocation error
ff_ivi_init_planes() might error out after having allocated some arrays.
Set the FF_CODEC_CAP_INIT_CLEANUP flag in order to free these arrays in
this case.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit d8fc69bd6a)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 83cd7a29dc avcodec/ivi: Fix segfault on allocation error
If allocating the tiles array for indeo 4/5 fails, the context is in an
inconsistent state, because the counter for the number of tiles is > 0.
This will lead to a segfault when freeing the tiles' substructures.
Fix this by setting the number of tiles to zero if the allocation was
unsuccessful.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit e411a3af11)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt d0045b41a3 avcodec/magicyuvenc: Fix memleak upon init failure
If an error happens during init after an allocation has succeeded,
the already allocated data leaked up until now. Fix this by setting the
FF_CODEC_CAP_INIT_CLEANUP flag.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit a8ebb56320)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 9ce88b5b53 avcodec/gif: Fix leaks upon allocation error
If one of several allocations the gif encoder performs in its init
function fails, the successful allocations leak. Fix this by adding the
FF_CODEC_CAP_INIT_CLEANUP flag.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 8da8774d8e)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 9c6d8ae33c avcodec/avrndec: Fix memleak on error
If ff_codec_open2_recursive() fails, the already allocated
AVCodecContext leaks. Fix this by setting the FF_CODEC_CAP_INIT_CLEANUP
flag.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 3c2128df7f)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 682574e1da avcodec/avrndec: Check allocation for success
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit d8e4d26de6)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 634c4ce8b0 avcodec/atrac1: Check allocation of AVFloatDSPContext
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit e75ccc8123)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt a080af9b8c avfilter/vf_subtitles: Fix leaks on failure
init_subtitles() sometimes returned directly upon error without cleaning
up after itself. The easiest way to trigger this is by using
picture-based subtitles; it is also possible to run into this in case of
missing decoders or allocation failures.

Furthermore, return the proper error code in case of missing decoder.

Reviewed-by: Nicolas George <george@nsup.org>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 77ace1ffea)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt d0a8273efe avfilter/vf_uspp: Fix potential leak of dict on error
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 8443848dfc)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt e434e13892 avfilter/lavfutils: Fix memleak when avformat_find_stream_info() fails
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit f38926ec24)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 0d7fe1ab8f avfilter/lavfutils: Don't use uninitialized pointers for freeing
Happened on several error conditions, e.g. if there is just no decoder
for the format (like with svg images).

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 3d1a9824b8)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 88a563b27d avcodec/binkaudio: Don't use static storage for context-dependent data
Move it to the context instead.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 2777bae7f2)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 7f1f850f11 avcodec/bink: Fix memleak upon init failure
The init function first allocates an AVFrame and then some buffers; if
one of the buffers couldn't be allocated, the AVFrame leaks. Solve this
by setting the FF_CODEC_CAP_INIT_CLEANUP flag.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 4f67288948)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt c71de42131 avcodec/wnv1: Use LE bitstream reader, avoid copying packet, fix memleak
The Winnov WNV1 format is designed for a little-endian bitstream reader;
yet our decoder reversed every byte bitwise (in a buffer only
allocated for this purpose) to use a big-endian bitstream reader. This
commit stops this.

Two things needed to be done to achieve this: The codes in the table used
to initialize a VLC reader needed to be reversed bitwise (when
initializing a VLC in LE mode, it is expected that the first bit to be
read is in the least significant bit; with BE codes the first bit to be
read is the most significant bit of the code) and the following
expression needed to be adapted:

ff_reverse[get_bits(&w->gb, 8 - w->shift)]

But this is easy: When only the bits read are reversed, they coincide
with what a little-endian bitstream reader reads that reads the
original, not-reversed data. But ff_reverse always reverses the full
eight bits and this also performs a shift by (8 - (8 - w->shift)) on top
of reversing the bits read. So the above line needs to be changed to

get_bits(&w->gb, 8 - w->shift) << w->shift

and this also shows why the variable shift is named the way it is.

Finally, this also fixes a hypothetical memleak: For gigantic packets,
initializing a GetBitContext can fail and in this case, the buffer
containing the reversed data would leak.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 0166b1d1a6)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt d9da39572b avcodec/truemotion2: Avoid duplicating array, fix memleak
TrueMotion 2.0 uses Huffmann trees. To parse them, the decoder allocates
arrays for the codes, their lengths and their value; afterwards a VLC
table is initialized using these values. If everything up to this point
succeeds, a new buffer of the same size as the already allocated arrays
for the values is allocated and upon success the values are copied into
the new array; all the old arrays are then freed. Yet if allocating the
new array fails, the old arrays get freed, but the VLC table doesn't.

This leak is fixed by not allocating a new array at all; instead the old
array is simply reused, ensuring that nothing can fail after the
creation of the VLC table.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 5ff2ff6bd9)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt f722ddc234 avfilter/af_headphone: Fix leak of channel layouts list on error
In case the multichannel HRIR mode was enabled, an error could happen
between allocating a channel layouts list and attaching it to its target
destination. If an error happened, the list would leak. This is fixed by
attaching the list to its target directly after its allocation.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit ca8e5dedc7)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 42d160ac40 avfilter/af_headphone: Fix segfault upon allocation failure
The headphone filter uses a variable number of inpads and allocates them
in its init function; if all goes well, the number of inpads coincides
with a number stored in the filter's private context. Yet if allocating a
subsequent inpad fails, the uninit function nevertheless uses the number
stored in the private context to determine the number of inpads to free
and not the AVFilterContext's nb_inputs. This will lead to an access
beyond the end of the allocated AVFilterContext.input_pads array and
an invalid free.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 0960da42f5)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt b343188cd8 avfilter/vf_signature: Fix leak of string upon error
If an error happens between allocating a string intended to be used as
an inpad's name and attaching it to its input pad, the string leaks.
Fix this by inserting the inpad directly after allocating its string.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 16ea88778e)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt ed86d63a7f avfilter/vf_signature: Fix leak of inpads' names
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 37838417b8)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt dbc4b46c7a avfilter/af_aiir: Fix segfault and leak upon allocation failure
The aiir filter adds output pads in its init function. Each of these
output pads had a name which was allocated and to be freed in the uninit
function. Given that the aiir filter has between one and two outputs,
one output pad's name was freed unconditionally and a second was freed
conditionally.

Yet if adding output pads fails, there are no output pads at all and
trying to free a nonexistent pad's name will lead to a segfault.

Furthermore, if the name could be successfully allocated, yet adding the
new pad fails, the name would leak.

This commit fixes this by not allocating the pads' names at all any
more: They are constant anyway. This allows to remove the code to free
them and hence fixes the aforementioned bugs.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 97b1a2c564)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 6d81b62766 avfilter/vf_premultiply: Fix leak of names of inpads
These names leak because freeing them in the uninit function has been
forgotten. Instead of adding the freeing code, this commit stops
allocating these names. They are constants anyway.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 7e736cd38a)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 07fb367737 avfilter/af_anequalizer: Fix memleak when inserting pad fails
It has been forgotten to free the name of the second outpad if attaching
the first one to the AVFilterContext fails. Fixing this is easy: Only
prepare the second outpad after (and if) the first outpad has been
successfully attached to the AVFilterContext.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit fdbd579fd1)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 7316177a44 avfilter/af_amerge: Fix segfault upon allocation failure
The amerge filter uses a variable number of inpads and allocates them
in its init function; if all goes well, the number of inpads coincides
with a number stored in the filter's private context. Yet if allocating a
subsequent inpad fails, the uninit function nevertheless uses the number
stored in the private context to determine the number of inpads to free
and not the AVFilterContext's nb_inputs. This will lead to an access
beyond the end of the allocated AVFilterContext.input_pads array and
an invalid free.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 8f2c1f2cbe)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 9ef7237313 avfilter/af_aformat: Add uninit function
Fixes memleaks in case init fails (e.g. because of invalid parameters
like 'aformat=sample_fmts=s16:cl=wtf') or also if query_formats is never
called.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit a7bd379276)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 1f0bfdffe3 avfilter/vf_hwdownload: Fix leak of formats list upon error
If adding the list of input formats to its AVFilterLink fails, the list
of output formats (which has not been attached to permanent storage yet)
leaks. This has been fixed by not creating the lists of in- and output
formats simultaneously. Instead creating said lists is relegated to
ff_formats_pixdesc_filter() (this also avoids the reallocations implicit
in using ff_add_format()) and the second list is only created after (and
if) the first list has been permanently attached to its AVFilterLink.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 257cd5fa38)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 4516fc3e2b avfilter/formats: Fix double frees and memleaks on error
The formats API deals with lists of channel layouts, sample rates,
pixel formats and sample formats. These lists are refcounted in a way in
which the list structure itself contains pointers to all of its owners.
Furthermore, it is possible for a list to be not owned by anyone yet;
this status is temporary until the list has been attached to an owner.
Adding an owner to a list involves reallocating the list's list of
owners and can therefore fail.

In order to reduce the amount of checks and cleanup code for the users
of this API, the API is supposed to be lenient when faced with input
lists that are NULL and it is supposed to clean up if adding an owner
to a list fails, so that a simple use case like

list = ff_make_format_list(foo_fmts);
if ((ret = ff_formats_ref(list, &ctx->inputs[0]->out_formats)) < 0)
    return ret;

needn't check whether list could be successfully allocated
(ff_formats_ref() return AVERROR(ENOMEM) if it couldn't) and it also
needn't free list if ff_formats_ref() couldn't add an owner for it.

But the cleaning up after itself was broken. The root cause was that
the refcount was decremented during unreferencing whether or not the
element to be unreferenced was actually an owner of the list or not.
This means that if the above sample code is continued by

if ((ret = ff_formats_ref(list, &ctx->inputs[1]->out_formats)) < 0)
    return ret;

and that if an error happens at the second ff_formats_ref() call, the
automatic cleaning of list will decrement the refcount from 1 (the sole
owner of list at this moment is ctx->input[0]->out_formats) to 0 and so
the list will be freed; yet ctx->input[0]->out_formats still points to
the list and this will lead to a double free/use-after-free when
ctx->input[0] is freed later.

Presumably in order to work around such an issue, commit
93afb338a4 restricted unreferencing to
lists with owners. This does not solve the root cause (the above example
is not fixed by this) at all, but it solves some crashs.

This commit fixes the API: The list's refcount is only decremented if
an owner is removed from the list of owners and not if the
unref-function is called with a pointer that is not among the owners of
the list. Furtermore, the requirement for the list to have owners is
dropped.

This implies that if the first call to ff_formats_ref() in the above
example fails, the refcount which is initially zero during unreferencing
is not modified, so that the list will be freed automatically in said
call to ff_formats_ref() as every list whose refcount reaches zero is.

If on the other hand, the second call to ff_formats_ref() is the first
to fail, the refcount would stay at one during the automatic
unreferencing in ff_formats_ref(). The list would later be freed when
its last (and in this case sole) owner (namely
ctx->inputs[0]->out_formats) gets unreferenced.

The issues described here for ff_formats_ref() also affected the other
functions of this API. E.g. ff_add_format() failed to clean up after
itself if adding an entry to an already existing list failed (the case
of a freshly allocated list was handled specially and this commit also
removes said code). E.g. ff_all_formats() inherited the flaw.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 2a471af50a)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt ff0201f6e7 avfilter/af_channelmap: Fix double-free of AVFilterChannelLayouts on error
The query_formats function of the channelmap filter tries to allocate
a list of channel layouts which on success are attached to more permanent
objects (an AVFilterLink) for storage afterwards. If attaching succeeds,
the link becomes one of the common owners (in this case, the only owner)
of the list. Yet if the list has been successfully attached to the link
and an error happens lateron, the list was manually freed, which is wrong,
because it is owned by its link so that the link's pointer to the list will
become dangling and there will be a double-free/use-after-free when the link
is later cleaned up automatically.

This commit fixes this by removing the custom freeing code; this will
temporarily add a leaking codepath (if attaching the list fails, the list
will leak), but this will be fixed soon by making sure that an
AVFilterChannelLayouts without owner will be automatically freed when
attaching it to an AVFilterLink fails.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 44bcd6f749)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 65be8cdc4d avfilter/vf_alphamerge: Fix double-free of AVFilterFormats on error
The query_formats function of the alphamerge filter tries to allocate
two lists of formats which on success are attached to more permanent
objects (AVFilterLinks) for storage afterwards. If attaching a list
to an AVFilterLink succeeds, the link becomes one of the owners of
the list. Yet if attaching a list to one of its links succeeds and
an error happens lateron, both lists were manually freed, which is wrong
if the list is already owned by one or more links; these links' pointers
to their lists will become dangling and there will be a double-free/use-
after-free when these links are cleaned up automatically.

This commit fixes this by removing the custom freeing code; this will
temporarily add a leaking codepath (if attaching a list not already
owned by a link to a link fails, the list will leak), but this will
be fixed soon by making sure that an AVFilterFormats without owner will
be automatically freed when attaching it to an AVFilterLink fails.
At most one list leaks because as of this commit a new list is only
allocated after the old list has been successfully attached to a link.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit fd1a2a54a4)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 1bbcc09f2f avfilter/vf_overlay: Fix double-free of AVFilterFormats on error
The query_formats function of the overlay filter tries to allocate
two lists (only one in a special case) of formats which on success
are attached to more permanent objects (AVFilterLinks) for storage
afterwards. If attaching a list to an AVFilterLink succeeds, it is
in turn owned by the AVFilterLink (or more exactly, the AVFilterLink
becomes one of the common owners of the list). Yet if attaching a list
to one of its links succeeds and an error happens lateron, both lists
were manually freed, whic is wrong if the list is already owned by one
or more links; these links' pointers to their lists will become dangling
and there will be a double-free/use-after-free when these links are
cleaned up automatically.

This commit fixes this by removing the custom freeing code; this will
temporarily add a leaking codepath (if attaching a list not already
owned by a link to a link fails, the list will leak), but this will
be fixed soon by making sure that an AVFilterFormats without owner will
be automatically freed when attaching it to an AVFilterLink fails.
Notice that at most one list leaks because a new list is only allocated
after the old list has been successfully attached to a link.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit a86ee5fd79)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt ef0023fb90 avfilter/vf_remap: Fix double-free of AVFilterFormats on error
The query_formats function of the remap filter tries to allocate
two lists of formats which on success are attached to more permanent objects
(AVFilterLinks) for storage afterwards. If attaching a list to an
AVFilterLink succeeds, it is in turn owned by the AVFilterLink (or more
exactly, the AVFilterLink becomes one of the common owners of the list).
Yet if attaching a list to one of its links succeeds and an error happens
lateron, both lists were manually freed, which means that is wrong if the
list is already owned by one or more links; these links' pointers to
their lists will become dangling and there will be a double-free/use-after-
free when these links are cleaned up automatically.

This commit fixes this by removing the custom free code; this will
temporarily add a leaking codepath (if attaching a list not already
owned by a link to a link fails, the list will leak), but this will
be fixed soon by making sure that an AVFilterFormats without owner will
be automatically freed when attaching it to an AVFilterLink fails.
Notice at most one list leaks because a new list is only allocated
after the old list has been successfully attached to a link.

Reviewed-by: Nicolas George <george@nsup.org>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 07240c36c2)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt ac5eb3c751 avfilter/vf_showpalette: Fix double-free of AVFilterFormats on error
The query_formats function of the showpalette filter tries to allocate
two lists of formats which on success are attached to more permanent objects
(AVFilterLinks) for storage afterwards. If attaching a list to an
AVFilterLink succeeds, the link becomes one (in this case the only one)
of the owners of the list. Yet if attaching the first list to its link
succeeds and attaching the second list fails, both lists were manually
freed, which means that the first link's pointer to the first list
becomes dangling and there will be a double-free when the first link is
cleaned up automatically.

This commit fixes this by removing the custom free code; this will
temporarily add a leaking codepath (if attaching a list to a link fails,
the list will leak), but this will be fixed shortly by making sure that
an AVFilterFormats without owner will be automatically freed when
attaching it to an AVFilterLink fails. Notice at most one list leaks
because as of this commit a new list is only allocated after the old list
has been successfully attached to a link.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 76909c97c6)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 74b47138a3 avfilter/af_amix: Fix double-free of AVFilterChannelLayouts on error
The query_formats function of the amix filter tries to allocate a list
of channel layouts which are attached to more permanent objects
(an AVFilter's links) for storage afterwards on success. If attaching
a list to a link succeeds, the link becomes one of the common owners
of the list. Yet if a list has been successfully attached to links (or if
there were no links to attach it to in which case
ff_set_common_channel_layouts() already frees the list) and an error
happens lateron, the list was manually freed, which is wrong, because
the list has either already been freed or it is owned by its links in
which case these links' pointers to their list will become dangling and
there will be double-frees/uses-after-free when these links are cleaned
up automatically.

This commit fixes this by removing the custom freeing code; this is made
possible by using the list in ff_set_common_channel_layouts() directly
after its allocation (without anything that can fail in between).

Notice that ff_set_common_channel_layouts() is buggy itself which can
lead to double-frees on error. This is not fixed in this commit.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 44e376500f)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 662ef10367 avfilter/af_amix: Don't needlessly reallocate table
Replace using ff_add_format() repeatedly by a single call to
ff_make_format_list(). (Right now this also fixes a memleak: If the
first ff_add_format() succeeds and a subsequent call fails, the list
leaks.)

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 27f35fd121)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 4a95c96eb7 avfilter/vf_vpp_qsv: Fix leak of AVFilterFormats on error
The vpp_qsv's query_formats function allocated two AVFilterFormats,
before storing them permanently. If storing the first of them fails,
the function simply returns and the second leaks. This has been fixed by
only allocating the second AVFilterFormats structure after the first one
has been successfully stored.

Fixes Coverity issue #1422231.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit c4beb0783b)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 5bc83dd89d avfilter/vf_paletteuse: Fix leaks of AVFilterFormats on error
The paletteuse's query_formats function allocated three AVFilterFormats
before storing them permanently. If allocating one of them failed, the
three AVFilterFormats structures would be freed with av_freep() which
does not free separately allocated subelements (namely the formats
array) which leak.

Furthermore, if storing one of the first two fails, the function simply
returns and the ones not yet stored leak.

These leaks have been fixed by only creating a new AVFilterFormats after
the last one has already been permanently stored. Furthermore, it is
enough to check whether the elements have been properly stored as
ff_formats_ref() by design returns AVERROR(ENOMEM) if it is provided a
NULL AVFilterFormats *.

Fixes Coverity issues #1270818 and #1270819.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 6a65449954)
2021-02-27 07:20:57 +01:00
Andreas Rheinhardt 3125fae1cf avfilter/graphparser: Fix memleak when linking filters fails
Parsing labeled outputs involves a check for an already known match
(a labeled input with the same name) to pair them together. If yes,
it is attempted to create a link between the two filters; in this case
the AVFilterInOuts have fulfilled their purpose and are freed. Yet if
creating the link fails, these AVFilterInOuts have up until now not been
freed, although they had already been removed from their respective lists
(which means that they are not freed automatically). In other words:
They leak. This commit fixes this.

This fixes ticket #7084. Said ticket contains an example program to
reproduce a leak. It can also be reproduced with ffmpeg alone, e.g. with
the complex filters "[0]null[1],[2]anull[0]" or with "[0]abitscope[0]".
All of these three examples involve media type mismatches which make it
impossible to create the links. The bug could also be triggered by other
means, e.g. failure to allocate the necessary AVFilterLink.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit deb6476fd8)
2021-02-27 07:20:56 +01:00
Andreas Rheinhardt a23078a721 fftools/ffmpeg: Fix leak of AVFilterInOut in case of error
The AVFilterInOuts normally get freed in init_output_filter() when
the corresponding streams get created; yet if an error happens before
one reaches said point, they leak. Therefore this commit makes
ffmpeg_cleanup free them, too.

Fixes ticket #8267.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 426c16d61a)
2021-02-27 07:20:56 +01:00
Andreas Rheinhardt ba257f568e avfilter/graphparser: Check allocations for success
parse_filter() did not check the return value of av_get_token() for
success; in case name (the name of a filter) was NULL, one got a
segfault in av_strlcpy() (called from create_filter()).

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 95b8df687c)
2021-02-27 07:20:56 +01:00
Andreas Rheinhardt b93ccb8d59 avfilter/graphparser: Don't set pointer to one beyond '\0' of string
This happened in parse_link_name() if there was a '[' without matching
']'. While this is not undefined behaviour (pointer arithmetic one
beyond the end of an array works fine as long as there are no accesses),
it is potentially dangerous. It currently isn't (all callers of
parse_link_name() treat this as an error and don't access the string any
more), but making sure that this will never cause trouble in the future
seems nevertheless worthwhile.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit f33faa5b9b)
2021-02-27 07:20:56 +01:00
Andreas Rheinhardt 3b3d85c26e avfilter/graphparser: Fix leaks when parsing inputs fails
parse_inputs() uses a temporary linked list to parse the labeled inputs
of a filter; said linked list owns its elements (and their names). On
success, the list of unlabeled inputs is appened to the end of the list
of labeled inputs and the new list is returned; yet on failures, nothing
frees the already existing elements of the temporary linked list, leading
to a leak.

This can be triggered by e.g. using '-vf [v][' in the FFmpeg
command-line tool.

This leak seems to exist since 4e781c25b7.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit b3f6dee728)
2021-02-27 07:20:56 +01:00
Andreas Rheinhardt ad0132fab8 avfilter/af_afir: Fix leak of AVFilterChannelLayout in case of error
If an error happens between the allocation of an AVFilterChannelLayout
and its usage (which involves attaching said object to a more permanent
object), the channel layout array leaks. This can simply be fixed by
making sure that nothing is between the allocation and the
aforementioned usage.

Fixes Coverity issue #1250334.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 3a0f080ffa)
2021-02-27 07:20:56 +01:00
Andreas Rheinhardt 2617956abd avformat/mlvdec: Only store dimensions after having validated them
Otherwise it might happen that invalid dimensions are used when reading
a video packet; this might lead to undefined overflow.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit d661cfc184)
2021-02-27 07:20:56 +01:00
Andreas Rheinhardt 45c83744fd avformat/mlvdec: Don't leak open AVIOContexts on error
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 0d560873da)
2021-02-27 07:20:56 +01:00
Andreas Rheinhardt 280c6e0d1c avformat/mlvdec: Check for existence of AVIOContext before using it
The mlv demuxer supports input split into multiple files; if invalid
data is encountered when parsing one of the subsequent files, that file
is closed. But at this point some index entries belonging to this file
might already have been added. In this case, the read_packet function
might try to use the AVIOContext (which is NULL) to read data which will
of course crash. This commit fixes this.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 6e0dd41fa3)
2021-02-27 07:20:56 +01:00
Andreas Rheinhardt b03a876050 avformat/hls: Fix memleak when url is empty
Fixes Coverity ID 1465888.

Reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit dfc6a9f075)
2021-02-27 07:20:56 +01:00
Andreas Rheinhardt 4bc5de8e55 avfilter/formats: Fix heap-buffer overflow when merging channel layouts
The channel layouts accepted by ff_merge_channel_layouts() are of two
types: Ordinary channel layouts and generic channel layouts. These are
layouts that match all layouts with a certain number of channels.
Therefore parsing these channel layouts is not done in one go; instead
first the intersection of the ordinary layouts of the first input
list of channel layouts with the ordinary layouts of the second list is
determined, then the intersection of the ordinary layouts of the first
one and the generic layouts of the second one etc. In order to mark the
ordinary channel layouts that have already been matched as used they are
zeroed. The inner loop that does this is as follows:

for (j = 0; j < b->nb_channel_layouts; j++) {
    if (a->channel_layouts[i] == b->channel_layouts[j]) {
        ret->channel_layouts[ret_nb++] = a->channel_layouts[i];
        a->channel_layouts[i] = b->channel_layouts[j] = 0;
    }
}

(Here ret->channel_layouts is the array containing the intersection of
the two input arrays.)

Yet the problem with this code is that after a match has been found, the
loop continues the search with the new value a->channel_layouts[i].
The intention of zeroing these elements was to make sure that elements
already paired at this stage are ignored later. And while they are indeed
ignored when pairing ordinary and generic channel layouts later, it has
the exact opposite effect when pairing ordinary channel layouts.

To see this consider the channel layouts A B C D E and E D C B A. In the
first round, A and A will be paired and added to ret->channel_layouts.
In the second round, the input arrays are 0 B C D E and E D C B 0.
At first B and B will be matched and zeroed, but after doing so matching
continues, but this time it will search for 0, which will match with the
last entry of the second array. ret->channel_layouts now contains A B 0.
In the third round, C 0 0 will be added to ret->channel_layouts etc.
This gives a quadratic amount of elements, yet the amount of elements
allocated for said array is only the sum of the sizes of a and b.

This issue can e.g. be reproduced by
ffmpeg -f lavfi -i anullsrc=cl=7.1 \
-af 'aformat=cl=mono|stereo|2.1|3.0|4.0,aformat=cl=4.0|3.0|2.1|stereo|mono' \
-f null -

The fix is easy: break out of the inner loop after having found a match.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 4147f63d63)
2021-02-27 07:20:56 +01:00
Andreas Rheinhardt 07b52a4b70 Revert "lavfi/avfiltergraph: add check before free the format"
This reverts commit f156f4ab23.

The checks added by said commit are nonsense because they did not help
in case ff_merge_samplerates() or ff_merge_formats() returned NULL
while freeing one of its arguments: Said freeing does not change
the local variables of can_merge_formats().

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit c4c10feaa8)
2021-02-27 07:20:56 +01:00
Andreas Rheinhardt 9d82cfe3de avfilter/formats: Leave lists' ownership unchanged upon merge failure
ff_merge_formats(), ff_merge_samplerates() and ff_merge_channel_layouts()
share common semantics: If merging succeeds, a non-NULL pointer is
returned and both input lists (of type AVFilterFormats resp.
AVFilterChannelLayouts) are to be treated as if they had been freed;
the owners of the input parameters (if any) become owners of the
returned list. If merging does not succeed, NULL is returned and both
input lists are supposed to be unchanged.

The problem is that the functions did not abide by these semantics:
In case of reallocation failure, it is possible for these functions
to return NULL after having already freed one of the two input list.
This happens because sometimes the refs-array of the destined output
gets reallocated twice to its final size and if the second of these
reallocations fails, the first of the two inputs has already been freed
and its refs updated to point to the destined output which in this case
will be freed immediately so that all of the already updated pointers
are now dangling. This leads to use-after-frees and memory corruptions
lateron (when these owners get cleaned up, the lists they own get
unreferenced). Should the input lists don't have owners at all, the
caller (namely can_merge_formats() in avfiltergraph.c) thinks that both
the input lists are unchanged and need to be freed, leading to a double
free.

The solution to this is simple: Don't reallocate twice; do it just once.
This also saves a reallocation.

This commit fixes the issue behind Coverity issue #1452636. It might
also make Coverity realize that the issue has been fixed.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 195a25a7ab)
2021-02-22 22:02:50 +01:00
Andreas Rheinhardt 4cdd6cac1f avformat/mpegts: Don't leave context in inconsistent state upon error
Up until now, opening a section filter works as follows: A filter is
opened and (on success) attached to the MpegTSContext. Then a buffer for
said filter is allocated and upon success attached to the section
filter; on error, the filter is simply freed without removing it from
the MpegTSContext, leaving the latter in an inconsistent state. This
leads to use-after-frees lateron.

This commit fixes this by allocating the buffer first; the filter is
only opened if the buffer could be successfully allocated.

Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 1ead176d87)
2021-02-22 22:00:29 +01:00
Andreas Rheinhardt ea42edb933 avformat/sierravmd: Don't return packets for non-existing stream
It leads to an assert in ff_read_packet().

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit ea8f8d28d0)
2021-02-22 22:00:15 +01:00
Andreas Rheinhardt f66647daa6 avformat/vividas: Check allocation for success
Reviewed-by: Zane van Iperen <zane@zanevaniperen.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit c4a4fe938d)
2021-02-22 21:59:42 +01:00
Andreas Rheinhardt ffa5b1f116 avformat/vividas: Check return value before storing it in smaller type
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit a3dced69c8)
2021-02-22 21:59:32 +01:00
Andreas Rheinhardt 22cb13d4c5 avformat/webmdashenc: Avoid allocations, fix memleak
When using the WebM DASH Manifest muxer, every stream of each adaptation
set has to contain a metadata entry containing the filename of the
source file. In case of live stream manifests, said filename has to
conform to a pattern of
<file_description>_<representation_id>.<extension>. These pieces are
used to create the other strings that are actually output. Up until now,
these other strings would be allocated, used once and then freed
directly after usage. This commit changes this: The function that
allocated and assembled these strings now returns pointers to the '_'
and '.' delimiters and so that the caller can easily pick substrings
from it without needing to copy the string.

Avoiding allocations also fixes a memleak: One of the allocated strings
would leak upon a subsequent allocation failure.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit f163b2eb27)
2021-02-22 21:57:27 +01:00
Andreas Rheinhardt 9d5c7e0675 avformat/webmdashenc: Fix segfault when no filename is given when live
by checking a bit earlier.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit c1fab8637e)
2021-02-22 21:57:08 +01:00
Andreas Rheinhardt e114a337be avformat/matroskadec: Avoid undefined pointer arithmetic
The Matroska demuxer currently always opens a GetByteContext to read the
content of the projection's private data buffer; it does this even if
there is no private data buffer in which case opening the GetByteContext
will lead to a NULL + 0 which is undefined behaviour.
Furthermore, in this case the code relied both on the implicit checks
of the bytestream2 API as well as on the fact that it returns zero
if there is not enough data available.

Both of these issues have been addressed by not using the bytestream API
any more; instead the data is simply read directly by using AV_RB. This
is possible because the offsets are constants.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 880519c1de)
2021-02-22 21:56:57 +01:00
Andreas Rheinhardt f25caec87f avformat/mxfdec: Fix memleak upon repeating tags
When parsing MXF encountering some tags leads to allocations. And when
these tags were encountered repeatedly, this could lead to memleaks,
because the pointer to the old data got simply overwritten with a
pointer to the new data (or to NULL on allocation failure). This has
been fixed.

Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 28ce651c6d)
2021-02-22 21:55:42 +01:00
Andreas Rheinhardt 6918d1281c avformat/mxfdec: Fix memleak when parsing tag fails
The MXF demuxer uses an array of pointers to different structures of
metadata (all containing a common initial sequence containing a type
field to distinguish them) and some of these structures contain pointers
to separately allocated subelements. If an error happens while reading
and creating the tags, the semi-finished new tag is freed using the
function to free these tags. But this function doesn't free the already
allocated subelements, because the type has not been set yet. This commit
changes this.

Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 78f21cab18)
2021-02-22 21:54:57 +01:00
Andreas Rheinhardt 8e7eedf294 avformat/mxfdec: Fix memleak when adding element to array fails
Said array contains pointers to other structs and both the designated
new element as well as other stuff contained in it (e.g. strings) leak
if the new element can't be added to the array.

Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 49e78548c3)
2021-02-22 21:54:11 +01:00
533 changed files with 7755 additions and 4802 deletions
+23
View File
@@ -0,0 +1,23 @@
exclude: ^tests/ref/
repos:
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v5.0.0
hooks:
- id: check-case-conflict
- id: check-executables-have-shebangs
- id: check-illegal-windows-names
- id: check-shebang-scripts-are-executable
- id: check-yaml
- id: end-of-file-fixer
- id: fix-byte-order-marker
- id: mixed-line-ending
- id: trailing-whitespace
- repo: local
hooks:
- id: aarch64-asm-indent
name: fix aarch64 assembly indentation
files: ^.*/aarch64/.*\.S$
language: script
entry: ./tools/check_arm_indent.sh --apply
pass_filenames: false
+29
View File
@@ -0,0 +1,29 @@
name: Lint
on:
push:
branches:
- release/4.3
pull_request:
jobs:
lint:
name: Pre-Commit
runs-on: utilities
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Install pre-commit CI
id: install
run: |
python3 -m venv ~/pre-commit
~/pre-commit/bin/pip install --upgrade pip setuptools
~/pre-commit/bin/pip install pre-commit
echo "envhash=$({ python3 --version && cat .forgejo/pre-commit/config.yaml; } | sha256sum | cut -d' ' -f1)" >> $FORGEJO_OUTPUT
- name: Cache
uses: actions/cache@v4
with:
path: ~/.cache/pre-commit
key: pre-commit-${{ steps.install.outputs.envhash }}
- name: Run pre-commit CI
run: ~/pre-commit/bin/pre-commit run -c .forgejo/pre-commit/config.yaml --show-diff-on-failure --color=always --all-files
+80
View File
@@ -0,0 +1,80 @@
name: Test
on:
push:
branches:
- release/4.3
pull_request:
jobs:
run_fate:
name: Fate (${{ matrix.runner }}, ${{ matrix.shared }}, ${{ matrix.bits }} bit)
strategy:
fail-fast: false
matrix:
runner: [linux-aarch64]
shared: ['static']
bits: ['64']
include:
- runner: linux-amd64
shared: 'static'
bits: '32'
- runner: linux-amd64
shared: 'shared'
bits: '64'
runs-on: ${{ matrix.runner }}
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Configure
run: |
./configure --enable-gpl --enable-nonfree --enable-memory-poisoning --assert-level=2 \
$([ "${{ matrix.bits }}" != "32" ] || echo --arch=x86_32 --extra-cflags=-m32 --extra-cxxflags=-m32 --extra-ldflags=-m32) \
$([ "${{ matrix.shared }}" != "shared" ] || echo --enable-shared --disable-static) \
|| CFGRES=$? && CFGRES=$?
cat ffbuild/config.log
exit $CFGRES
- name: Build
run: make -j$(nproc)
- name: Restore Cached Fate-Suite
id: cache
uses: actions/cache/restore@v4
with:
path: fate-suite
key: fate-suite
restore-keys: |
fate-suite-
- name: Sync Fate-Suite
id: fate
run: |
make fate-rsync SAMPLES=$PWD/fate-suite
echo "hash=$(find fate-suite -type f -printf "%P %s %T@\n" | sort | sha256sum | cut -d' ' -f1)" >> $FORGEJO_OUTPUT
- name: Cache Fate-Suite
uses: actions/cache/save@v4
if: ${{ format('fate-suite-{0}', steps.fate.outputs.hash) != steps.cache.outputs.cache-matched-key }}
with:
path: fate-suite
key: fate-suite-${{ steps.fate.outputs.hash }}
- name: Run Fate
run: LD_LIBRARY_PATH="$(printf "%s:" "$PWD"/lib*)$PWD" make fate fate-build SAMPLES=$PWD/fate-suite -j$(nproc)
compile_only:
name: Fate (Win64, Build-Only)
strategy:
fail-fast: false
matrix:
image: ["ghcr.io/btbn/ffmpeg-builds/win64-gpl-4.3:latest"]
runs-on: linux-amd64
container: ${{ matrix.image }}
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Configure
run: |
./configure --pkg-config-flags="--static" $FFBUILD_TARGET_FLAGS $FF_CONFIGURE \
--cc="$CC" --cxx="$CXX" --ar="$AR" --ranlib="$RANLIB" --nm="$NM" \
--extra-cflags="$FF_CFLAGS" --extra-cxxflags="$FF_CXXFLAGS" \
--extra-libs="$FF_LIBS" --extra-ldflags="$FF_LDFLAGS" --extra-ldexeflags="$FF_LDEXEFLAGS"
- name: Build
run: make -j$(nproc)
- name: Run Fate
run: make -j$(nproc) fate-build
+9 -9
View File
@@ -55,7 +55,7 @@ modified by someone else and passed on, the recipients should know
that what they have is not the original version, so that the original
author's reputation will not be affected by problems that might be
introduced by others.
Finally, software patents pose a constant threat to the existence of
any free program. We wish to make sure that a company cannot
effectively restrict the users of a free program by obtaining a
@@ -111,7 +111,7 @@ modification follow. Pay close attention to the difference between a
"work based on the library" and a "work that uses the library". The
former contains code derived from the library, whereas the latter must
be combined with the library in order to run.
GNU LESSER GENERAL PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
@@ -158,7 +158,7 @@ Library.
You may charge a fee for the physical act of transferring a copy,
and you may at your option offer warranty protection in exchange for a
fee.
2. You may modify your copy or copies of the Library or any portion
of it, thus forming a work based on the Library, and copy and
distribute such modifications or work under the terms of Section 1
@@ -216,7 +216,7 @@ instead of to this License. (If a newer version than version 2 of the
ordinary GNU General Public License has appeared, then you can specify
that version instead if you wish.) Do not make any other change in
these notices.
Once this change is made in a given copy, it is irreversible for
that copy, so the ordinary GNU General Public License applies to all
subsequent copies and derivative works made from that copy.
@@ -267,7 +267,7 @@ Library will still fall under Section 6.)
distribute the object code for the work under the terms of Section 6.
Any executables containing that work also fall under Section 6,
whether or not they are linked directly with the Library itself.
6. As an exception to the Sections above, you may also combine or
link a "work that uses the Library" with the Library to produce a
work containing portions of the Library, and distribute that work
@@ -329,7 +329,7 @@ restrictions of other proprietary libraries that do not normally
accompany the operating system. Such a contradiction means you cannot
use both them and the Library together in an executable that you
distribute.
7. You may place library facilities that are a work based on the
Library side-by-side in a single library together with other library
facilities not covered by this License, and distribute such a combined
@@ -370,7 +370,7 @@ subject to these terms and conditions. You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties with
this License.
11. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
@@ -422,7 +422,7 @@ conditions either of that version or of any later version published by
the Free Software Foundation. If the Library does not specify a
license version number, you may choose any version ever published by
the Free Software Foundation.
14. If you wish to incorporate parts of the Library into other free
programs whose distribution conditions are incompatible with these,
write to the author to ask for permission. For software which is
@@ -456,7 +456,7 @@ SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Libraries
If you develop a new library, and you want it to be of the greatest
+2 -2
View File
@@ -1,6 +1,6 @@
See the Git history of the project (git://source.ffmpeg.org/ffmpeg) to
See the Git history of the project (https://git.ffmpeg.org/ffmpeg) to
get the names of people who have contributed to FFmpeg.
To check the log, you can type the command "git log" in the FFmpeg
source directory, or browse the online repository at
http://source.ffmpeg.org.
https://git.ffmpeg.org/ffmpeg
+916
View File
@@ -1,6 +1,922 @@
Entries are sorted chronologically from oldest to youngest within each release,
releases are sorted from youngest to oldest.
version 4.3.9:
configure: update copyright year
avformat/hls: Partially revert "reduce default max reload to 3"
avformat/hls: Fix twitter
libavformat/hls: Be more restrictive on mpegts extensions
avformat/hls: .ts is always ok even if its a mov/mp4
avformat/hls: Print input format in error message
avformat/hls: Be more picky on extensions
avformat: add ff_match_url_ext()
avfilter/bwdif: account for chroma sub-sampling in min size calculation
avformat/iff: Check that we have a stream in read_dst_frame()
avformat/mlvdec: fix size checks
avformat/mxfdec: Check edit unit for overflow in mxf_set_current_edit_unit()
avcodec/h263dec: Check against previous dimensions instead of coded
avformat/mxfdec: Check avio_read() success in mxf_decrypt_triplet()
avcodec/huffyuvdec: Initialize whole output for decode_gray_bitstream()
avformat/ipmovie: Check signature_buffer read
avformat/wtvdec: Initialize buf
avcodec/cbs_vp9: Initialize VP9RawSuperframeIndex
avformat/vqf: Propagate errors from add_metadata()
avformat/vqf: Check avio_read() in add_metadata()
avformat/dashdec: Check whitelist
avutil/avstring: dont mess with NULL pointers in av_match_list()
avcodec/mpegvideo_enc: Check FLV1 resolution limits
avcodec/ffv1enc: Fix handling of 32bit unsigned symbols
avcodec/vc1dec: Clear block_index in vc1_decode_reset()
avcodec/aacsbr_template: Clear n_q on error
swscale/output: Fix undefined overflow in yuv2rgba64_full_X_c_template()
avfilter/af_pan: Fix sscanf() use
avfilter/vf_addroi: Add missing NULL termination to addroi_var_names[]()
avformat/rmdec: check that buf if completely filled
avcodec/hapdec: Clear tex buffer
avformat/mxfdec: Check that key was read sucessfull
avformat/rpl: Fix check for negative values
avformat/mlvdec: Check avio_read()
avcodec/utils: Fix block align overflow for ADPCM_IMA_WAV
avformat/matroskadec: Check pre_ns for overflow
avcodec/webp: Check ref_x/y
avcodec/ilbcdec: Initialize tempbuff2
avformat/dxa: check bpc
swscale/slice: clear allocated memory in alloc_lines()
avformat/icodec: fix integer overflow with nb_pal
doc/developer: Document relationship between git accounts and MAINTAINERS
avformat/vividas: Check avio_read() for failure
avformat/ilbc: Check avio_read() for failure
avformat/nistspheredec: Clear buffer
INSTALL: explain the circular dependency issue and solution
avformat/mpegts: Initialize predefined_SLConfigDescriptor_seen
avformat/mxfdec: Fix overflow in midpoint computation
swscale/output: used unsigned for bit accumulation
avcodec/rangecoder: only perform renorm check/loop for callers that need it
avcodec/ffv1dec: Fix end computation with ec=2
avcodec/ffv1enc: Prevent generation of files with broken slices
avformat/matroskadec: Check desc_bytes so bits fit in 64bit
avcodec/ffv1enc: Correct error message about unsupported version
avcodec/ffv1enc: Slice combination is unsupported
avcodec/ffv1enc: 2Pass mode is not possible with golomb coding
avcodec/ffv1enc: Fix >8bit context size
avcodec/xan: Add basic input size check
avcodec/svq3: Check for minimum size input
avcodec/eacmv: Check input size for intra frames
avcodec/jfdctint_template: use unsigned z* in row_fdct()
avformat/mxfdec: Check timecode for overflow
avformat/mxfdec: More offset_temp checks
swscale/output: Fix undefined integer overflow in yuv2rgba64_2_c_template()
swscale/swscale: Use unsigned operation to avoid undefined behavior
avcodec/vc2enc: basic sanity check on slice_max_bytes
avformat/mvdec: Check if name was fully read
avcodec/wmavoice: Do not use uninitialized pitch[0]
avcodec/notchlc: Check bytes left before reading
avcodec/vc1_block: propagate error codes
avformat/apetag: Check APETAGEX
avcodec/avcodec: Warn about data returned from get_buffer*()
avcodec/aic: Clear slice_data
avcodec/vc1dec: Clear mb_type_base and ttblk_base
avcodec/shorten: clear padding
avformat/mpeg: Check an avio_read() for failure
avcodec/mvha: Clear remaining space after inflate()
avformat/segafilm: Set keyframe
avcodec/dxva2: initialize hr in ff_dxva2_common_end_frame()
avcodec/dxva2: initialize validate
avcodec/dxva2: Initialize ConfigBitstreamRaw
avcodec/dxva2: Initialize dxva_size and check it
avfilter/vf_xfade: Compute w2, h2 with float
avfilter/vf_v360: Assert that vf was initialized
avfilter/vf_tonemap_opencl: Dereference after NULL check
avfilter/vf_xfade_opencl: Check ff_inlink_consume_frame() for failure
avformat/lmlm4: Eliminate some AVERROR(EIO)
avformat/wtvdec: Check length of read mpeg2_descriptor
avformat/wtvdec: clear sectors
vp9: recon: Use emulated edge to prevent buffer overflows
arm: vp9mc: Load only 12 pixels in the 4 pixel wide horizontal filter
aarch64: vp9mc: Load only 12 pixels in the 4 pixel wide horizontal filter
avformat/libzmq: fix check for zmq protocol prefix
configure: improve check for POSIX ioctl
configure: restore autodetection of v4l2 and fbdev
configure: use just the pkg-config for sndio
configure: enable ffnvcodec, nvenc, nvdec for FreeBSD
avutil/ppc/cpu: Also use the machdep.altivec sysctl on NetBSD
avutil/ppc/cpu: Use proper header for OpenBSD PPC CPU detection
lavd/v4l2: Use proper field type for second parameter of ioctl() with BSD's
configure: use pkg-config for sndio
libavcodec/arm/mlpdsp_armv5te: fix label format to work with binutils 2.43
version 4.3.8:
avcodec/parser: ensure input padding is zeroed
avformat/img2dec: Clear padding data after EOF
avformat/wavdec: Check if there are 16 bytes before testing them
avcodec/snow: Fix off by 1 error in run_buffer
avcodec/utils: apply the same alignment to YUV410 as we do to YUV420 for snow
update for 4.3.8
avcodec/diracdsp: Remove unused variable
avcodec/vaapi_encode: Check hwctx
avcodec/proresdec: Consider negative bits left
avcodec/hevc/hevcdec: Do not allow slices to depend on failed slices
avutil/slicethread: Check pthread_*_init() for failure
avutil/frame: Check log2_crop_align
avutil/buffer: Check ff_mutex_init() for failure
avformat/xmv: Check this_packet_size
avformat/ty: rec_size seems to only need 32bit
avformat/tty: Check avio_size()
avformat/siff: Basic pkt_size check
avformat/sauce: Check avio_size() for failure
avformat/sapdec: Check ffurl_get_file_handle() for error
avformat/nsvdec: Check asize for PCM
avformat/mp3dec: Check header_filesize
avformat/mp3dec; Check for avio_size() failure
avformat/mov: Use 64bit for str_size
avformat/mm: Check length
avformat/hnm: Check *chunk_size
avformat/hlsenc: Check ret
avformat/bintext: Check avio_size() return
avformat/asfdec_o: Check size of index object
avfilter/scale_eval: Use 64bit, check values in ff_scale_adjust_dimensions()
avfilter/vf_lut3d: Check av_scanf()
avfilter/vf_deshake_opencl: Ensure that the first iteration initializes the best variables
swscale/output: Fix integer overflows in yuv2rgba64_X_c_template
avformat/mxfdec: Reorder elements of expression in bisect loop
avcodec/pnmdec: Use 64bit for input size check
avcodec/utvideoenc: Use unsigned shift to build flags
avcodec/vc2enc: Fix overflows with storing large values
avcodec/mpegvideo_enc: Do not duplicate pictures on shifting
avcodec/tiff: Check value on positive signed targets
avfilter/vf_bm3d: Dont round MSE2SSE to an integer
avdevice/dshow: Check device_filter_unique_name before use
avdevice/dshow_filter: Use wcscpy_s()
avcodec/flac_parser: Assert that we do not overrun the link_penalty array
avcodec/pixlet: Simplify pfx computation
avcodec/motion_est: Fix score squaring overflow
avcodec/loco: Check loco_get_rice() for failure
avcodec/loco: check get_ur_golomb_jpegls() for failure
avcodec/imm4: check cbphi for error
avcodec/iff: Use signed count
avcodec/golomb: Assert that k is in the supported range for get_ur/sr_golomb()
avcodec/golomb: Document return for get_ur_golomb_jpegls() and get_sr_golomb_flac()
avcodec/dxv: Fix type in get_opcodes()
avcodec/xsubdec: Check parse_timecode()
avutil/imgutils: av_image_check_size2() ensure width and height fit in 32bit
avcodec/proresenc_kostya: use unsigned alpha for rotation
avformat/rtmppkt: Simplify and deobfuscate amf_tag_skip() slightly
avformat/rmdec: use 64bit for audio_framesize checks
avutil/hwcontext_d3d11va: correct sizeof IDirect3DSurface9
avutil/hwcontext_d3d11va: correct sizeof AVD3D11FrameDescriptor
avformat/tls_schannel: Initialize ret
avformat/subfile: Assert that whence is a known case
avformat/subfile: Merge if into switch()
avformat/rtsp: Check that lower transport is handled in one of the if()
avformat/rtsp: initialize reply1
avformat/rtsp: use < 0 for error check
avformat/rtpenc_vc2hq: Check sizes
avfilter/af_aderivative: Free out on error
avfilter/af_pan: check nb_output_channels before use
cbs_av1: Reject thirty-two zero bits in uvlc code
tools/coverity: Phase 1 study of anti-halicogenic for coverity av_rescale()
avfilter/vf_avgblur: Check plane instead of AVFrame
avformat/rdt: Check pkt_len
avformat/mpeg: Check len in mpegps_probe()
avdevice/dshow: Check ICaptureGraphBuilder2_SetFiltergraph() for failure
avcodec/mfenc: check IMFSample_ConvertToContiguousBuffer() for failure
avcodec/vc1_loopfilter: Factor duplicate code in vc1_b_h_intfi_loop_filter()
avformat/img2dec: assert no pipe on ts_from_file
avcodec/cbs_jpeg: Try to move the read entity to one side in a test
avformat/mov: Check edit list for overflow
fftools/ffmpeg: Check read() for failure
swscale/output: Avoid undefined overflow in yuv2rgb_write_full()
swscale/output: alpha can become negative after scaling, use multiply
avcodec/targaenc: Allocate space for the palette
avcodec/r210enc: Use av_rescale for bitrate
avcodec/jfdctint_template: Fewer integer anomalies
avcodec/snowenc: MV limits due to mv_penalty table size
avformat/mxfdec: Check container_ul->desc before use
MAINTAINERS: Update the entries for the release maintainer for FFmpeg
version 4.3.7:
avfilter/vf_rotate: Check ff_draw_init2() return value
avformat/matroskadec: Assert that num_levels is non negative
avformat/libzmq: Check av_strstart()
avformat/img2dec: Move DQT after unrelated if()
avdevice/xcbgrab: Check sscanf() return
fftools/cmdutils: Add protective () to FLAGS
avformat/sdp: Check before appending ","
avcodec/ilbcdec: Remove dead code
avcodec/vp8: Check cond init
avcodec/vp8: Check mutex init
avcodec/notchlc: Check init_get_bits8() for failure
avcodec/tests/dct: Use 64bit in intermediate for error computation
avcodec/scpr3: Check add_dec() for failure
avcodec/wavpackenc: Use unsigned for potential 31bit shift
avcodec/tests/jpeg2000dwt: Use 64bit in comparission
avcodec/tests/jpeg2000dwt: Use 64bit in err2 computation
avformat/fwse: Remove always false expression
avformat/asfdec_f: Use 64bit for preroll computation
avformat/ape: Use 64bit for final frame size
avcodec/tiff: Assert init_get_bits8() success in unpack_gray()
avcodec/tiff: Assert init_get_bits8() success in horizontal_fill()
swscale/yuv2rgb: Use 64bit for brightness computation
avutil/tests/opt: Check av_set_options_string() for failure
avutil/tests/dict: Check av_dict_set() before get for failure
avdevice/dshow: fix badly indented line
avcodec/mscc & mwsc: Check loop counts before use
avcodec/mpegvideo_enc: Fix potential overflow in RD
avcodec/mpeg4videodec: assert impossible wrap points
avcodec/vble: Check av_image_get_buffer_size() for failure
avcodec/vp3: Replace check by assert
avcodec/jpeg2000dec: remove ST=3 case
avcodec/qsvdec: Check av_image_get_buffer_size() for failure
avcodec/fmvc: remove dead assignment
avcodec/h264_slice: Remove dead sps check
avcodec/lpc: copy levenson coeffs only when they have been computed
avutil/tests/base64: Check with too short output array
libavutil/base64: Try not to write over the array end
avcodec/cbs_av1: Avoid shift overflow
doc/examples/demux_decode: Simplify loop
avcodec/mpegvideo_enc: Fix 1 line and one column images
swscale/output: Fix integer overflow in yuv2rgba64_full_1_c_template()
swscale/output: Fix integer overflow in yuv2rgba64_1_c_template
avformat/mxfdec: Check body_offset
avformat/kvag: Check sample_rate
avcodec/ac3_parser: Check init_get_bits8() for failure
avcodec/hevcdec: Check ref frame
doc/examples/vaapi_transcode: Simplify loop
avfilter/vf_thumbnail_cuda: Set ret before checking it
avfilter/signature_lookup: Dont copy uninitialized stuff around
avfilter/signature_lookup: Fix 2 differences to the refernce SW
avcodec/x86/vp3dsp_init: Set correct function pointer, fix crash
fate/subtitles: Ignore line endings for sub-scc test
avformat/mxfdec: Check index_edit_rate
swscale/utils: Fix xInc overflow
avformat/mxfdec: Make edit_unit_byte_count unsigned
avformat/movenc: Check that cts fits in 32bit
avformat/mxfdec: Check first case of offset_temp computation for overflow
avfilter/vf_signature: Dont crash on no frames
avformat/westwood_vqa: Fix 2g packets
avformat/matroskadec: Check timescale
avformat/wavdec: satuarte next_tag_ofs, data_end
avformat/sbgdec: Check for negative duration
avformat/rpl: Use 64bit for total_audio_size and check it
avformat/timecode: use 64bit for intermediate for rounding in fps_from_frame_rate()
avformat/jacosubdec: Use 64bit for abs
avformat/concatdec: Check user_duration sum
avcodec/truemotion1: Height not being a multiple of 4 is unsupported
avcodec/hcadec: do not set hfr_group_count to invalid values
avformat/concatdec: clip outpoint - inpoint overflow in get_best_effort_duration()
avformat/jacosubdec: clarify code
avformat/cafdec: Check that data chunk end fits within 64bit
avformat/iff: Saturate avio_tell() + 12
avformat/dxa: Adjust order of operations around block align
avformat/cafdec: dont seek beyond 64bit
avformat/id3v2: read_uslt() check for the amount read
avcodec/proresenc_kostya: Remove bug similarity text
avcodec/vorbisdec: Check remaining data in vorbis_residue_decode_internal()
libswscale/utils: Fix bayer to yuvj
swscale/swscale: Check srcSliceH for bayer
swscale/utils: Allocate more dithererror
avcodec/indeo3: Round dimensions up in allocate_frame_buffers()
avutil/rational: Document what is to be expected from av_d2q() of doubles representing rational numbers
avfilter/signature_lookup: Do not dereference NULL pointers after malloc failure
avfilter/signature_lookup: dont leave uncleared pointers in sll_free()
avcodec/mpegvideo_enc: Use ptrdiff_t for stride
libavformat/hlsenc.c: Populate OTI using AAC profile in write_codec_attr.
avcodec/mpegvideo_enc: Dont copy beyond the image
avfilter/vf_minterpolate: Check pts before division
avformat/flacdec: Avoid double AVERRORS
avfilter/vf_vidstabdetect: Avoid double AVERRORS
avfilter/vf_swaprect: round coordinates down
avfilter/vf_swaprect: Use height for vertical variables
avfilter/vf_swaprect: assert that rectangles are within memory
avfilter/af_alimiter: Check nextpos before use
avfilter/af_stereowiden: Check length
avfilter/vf_weave: Fix odd height handling
avfilter/vf_gradfun: Do not overread last line
avformat/mov: do not set sign bit for chunk_offsets
avcodec/jpeglsdec: Check Jpeg-LS LSE
configure: Enable section_data_rel_ro for FreeBSD and NetBSD aarch64 / arm
avformat/mov: Ignore duplicate ftyp
avformat/mov: Fix integer overflow in mov_read_packet().
seek: Fix crashes in ff_seek_frame_binary if built with latest Clang 14
avcodec/4xm: Check for cfrm exhaustion
avformat/mov: Disallow FTYP after streams
doc/html: fix styling issue with Texinfo 7.0
doc/html: support texinfo 7.0
doc/t2h.pm: fix missing TOC with texinfo 6.8 and above
doc/t2h.pm: fix missing CSS with texinfo 6.8 and above
avformat/matroskadec: Fix declaration-after-statement warnings
avformat/rtsp: Use rtsp_st->stream_index
avcodec/jpeg2000dec: Check image offset
avformat/mxfdec: Check klv offset
libavutil/ppc/cpu.c: check that AT_HWCAP2 is defined
avcodec/h2645_parse: Avoid EAGAIN
avcodec/xvididct: Make c* unsigned to avoid undefined overflows
avformat/tmv: Check video chunk size
avcodec/h264_parser: saturate dts a bit
avformat/asfdec_f: Saturate presentation time in marker
avformat/xwma: sanity check bits_per_coded_sample
avformat/matroskadec: Check prebuffered_ns for overflow
avformat/wavdec: Check left avio_tell for overflow
avformat/tta: Better totalframes check
avformat/rpl: Check for number_of_chunks overflow
avformat/mov: compute absolute dts difference without overflow in mov_find_next_sample()
avformat/jacosubdec: Check timeres
avformat/jacosubdec: avoid signed integer overflows in get_shift()
avformat/jacosubdec: Factorize code in get_shift() a bit
avcodec/escape124: Do not return random numbers
avformat/avs: Check if return code is representable
avcodec/lcldec: Make PNG filter addressing match the code afterwards
avformat/westwood_vqa: Check chunk size
avformat/sbgdec: Check for period overflow
avformat/concatdec: Check in/outpoint for overflow
avcodec/xvididct: Fix integer overflow in idct_row()
avcodec/celp_math: avoid overflow in shift
tools/target_dec_fuzzer: Adjust threshold for rtv1
avformat/hls: reduce default max reload to 3
avformat/format: Stop reading data at EOF during probing
avcodec/huffyuvdec: avoid undefined behavior with get_vlc2() failure
avcodec/cscd: Fix "CamStudio Lossless Codec 1.0" gzip files
avcodec/cscd: Check for CamStudio Lossless Codec 1.0 behavior in end check of LZO files
avcodec/hevcdec: Fix undefined memcpy()
avcodec/mpeg4videodec: more unsigned in amv computation
avcodec/tta: fix signed overflow in decorrelate
avcodec/apedec: Fix CRC for 24bps and bigendian
avcodec/xvididct: Fix integer overflow in idct_row()
avformat/avr: Check sample rate
avcodec/jpeg2000dec: Check for reduction factor and image offset
avutil/softfloat: Basic documentation for av_sincos_sf()
avutil/softfloat: fix av_sincos_sf()
avcodec/utils: fix 2 integer overflows in get_audio_frame_duration()
avcodec/hevcdec: Avoid null pointer dereferences in MC
avcodec/takdsp: Fix integer overflows
avcodec: Ignoring errors is only possible before the input end
avcodec/noise_bsf: Check for wrapped frames
avformat/oggparsetheora: clip duration within 64bit
avformat/wavdec: Check that smv block fits in available space
avcodec/tiff: add a zero DNG_LINEARIZATION_TABLE check
avcodec/tak: Check remaining bits in ff_tak_decode_frame_header()
avcodec/utils: the IFF_ILBM implementation assumes that there are a multiple of 16 allocated
avcodec/pngdec: Do not pass AVFrame into global header decode
avcodec/vorbisdec: Check codebook float values to be finite
avcodec/g2meet: Replace fake allocation avoidance for framebuf
avcodec/lcldec: More space for rgb24
avcodec/lcldec: Support 4:1:1 and 4:2:2 with odd width
libavcodec/lcldec: width and height should not be unsigned
avcodec/x86/mathops: clip constants used with shift instructions within inline assembly
lavc/pthread_frame: avoid leaving stale hwaccel state in worker threads
avformat/mov: Check if a key is longer than the atom containing it
avcodec/nvdec: reset bitstream_len/nb_slices when resetting bitstream pointer
avformat/mov: don't abort on duplicate Mastering Display Metadata boxes
avcodec/vdpau_mpeg4: fix order of quant matrix coefficients
avcodec/vdpau_mpeg12: fix order of quant matrix coefficients
avcodec/nvdec_mpeg4: fix order of quant matrix coefficients
avcodec/nvdec_mpeg2: fix order of quant matrix coefficients
avformat/nutdec: Add check for avformat_new_stream
version 4.3.6:
- avcodec/escape124: Check that blocks are allocated before use
- avcodec/huffyuvdec: Fix undefined behavior with shift
- avcodec/j2kenc: Replace RGB24 special case by generic test
- avcodec/j2kenc: Fix funky bpno errors on decoding
- avcodec/j2kenc: remove misleading pred value
- avcodec/j2kenc: fix 5/3 DWT identifer
- avcodec/vp3: Check width to avoid assertion failure
- avcodec/g729postfilter: Limit shift in long term filter
- configure: update copyright year
- avcodec/tests/snowenc: Fix 2nd test
- avcodec/tests/snowenc: return a failure if DWT/IDWT mismatches
- avcodec/snowenc: Fix visual weight calculation
- avcodec/tests/snowenc: unbreak DWT tests
- avcodec/escape124: Fix some return codes
- avcodec/escape124: fix signdness of end of input check
- Use https for repository links
- avcodec/motionpixels: Mask pixels to valid values
- avcodec/xpmdec: Check size before allocation to avoid truncation
- avcodec/bink: Avoid undefined out of array end pointers in binkb_decode_plane()
- avcodec/bink: Fix off by 1 error in ref end
- avcodec/utils: Ensure linesize for SVQ3
- avcodec/utils: allocate a line more for VC1 and WMV3
- avcodec/videodsp_template: Adjust pointers to avoid undefined pointer things
- avcodec/pngdec: Check deloco index more exactly
- avcodec/ffv1dec: Check that num h/v slices is supported
- avformat/mov: Check samplesize and offset to avoid integer overflow
- avcodec/pictordec: Remove mid exit branch
- avcodec/eac3dec: avoid float noise in fixed mode addition to overflow
- avcodec/utils: use 32pixel alignment for bink
- avcodec/scpr3: Check bx
- avcodec/012v: Order operations for odd size handling
- avcodec/eatgq: : Check index increments in tgq_decode_block()
- avcodec/scpr: Test bx before use
- avformat/mxfdec: Use 64bit in remainder
- avcodec/sunrast: Fix maplength check
- avcodec/wavpack: Avoid undefined shift in get_tail()
- avcodec/wavpack: Check for end of input in wv_unpack_dsd_high()
- avformat/id3v2: Check taglen in read_uslt()
- avcodec/tiff: Ignore tile_count
- avcodec/ffv1dec: restructure slice coordinate reading a bit
- avcodec/mlpdec: Check max matrix instead of max channel in noise check
- swscale/input: Use more unsigned intermediates
- avcodec/alsdec: The minimal block is at least 7 bits
- avformat/replaygain: avoid undefined / negative abs
- swscale/output: Bias 16bps output calculations to improve non overflowing range
- avcodec/speedhq: Check buf_size to be big enough for DC
- avcodec/ffv1dec: Fail earlier if prior context is corrupted
- avfilter/vf_untile: swap the chroma shift values used for plane offsets
- avcodec/vp3: Add missing check for av_malloc
- avcodec/nvenc: fix vbv buffer size in cq mode
- avcodec/mjpegenc: take into account component count when writing the SOF header size
- swscale: aarch64: Fix yuv2rgb with negative strides
version 4.3.5:
avformat/vividas: Check packet size
avcodec/dstdec: Check for overflow in build_filter()
avformat/spdifdec: Use 64bit to compute bit rate
avformat/rpl: Use 64bit for duration computation
avformat/xwma: Use av_rescale() for duration computation
avformat/sdsdec: Use av_rescale() to avoid intermediate overflow in duration calculation
avformat/sbgdec: Check ts_int in genrate_intervals
avformat/rmdec: check tag_size
avformat/nutdec: Check fields
avformat/flvdec: Use 64bit for sum_flv_tag_size
avformat/jacosubdec: Fix overflow in get_shift()
avformat/dxa: avoid bpc overflows
avformat/cafdec: Check that nb_frasmes fits within 64bit
avformat/asfdec_o: Limit packet offset
avformat/ape: Check frames size
avformat/icodec: Check nb_pal
avformat/aiffdec: Use 64bit for block_duration use
avformat/aiffdec: Check block_duration
avformat/mxfdec: only probe max run in
avformat/mxfdec: Check run_in is within 65536
avcodec/mjpegdec: Check for unsupported bayer case
avcodec/apedec: Fix integer overflow in filter_3800()
avcodec/tta: Check 24bit scaling for overflow
avcodec/tiff: Fix loop detection
libavformat/hls: Free keys
avcodec/fmvc: Move frame allocation to a later stage
avfilter/vf_showinfo: remove backspaces
avcodec/speedhq: Check width
avcodec/bink: disallow odd positioned scaled blocks
avformat/asfdec_o: limit recursion depth in asf_read_unknown()
doc/git-howto.texi: Document commit signing
libavcodec/8bps: Check that line lengths fit within the buffer
avcodec/midivid: Perform lzss_uncompress() before ff_reget_buffer()
libavformat/iff: Check for overflow in body_end calculation
avformat/avidec: Prevent entity expansion attacks
avcodec/h263dec: Sanity check against minimal I/P frame size
avcodec/hevcdec: Check s->ref in the md5 path similar to hwaccel
avformat/subviewerdec: Make read_ts() more flexible
avcodec/mjpegdec: bayer and rct are incompatible
MAINTAINERS: Add ED25519 key for signing my commits in the future
avcodec/hevc_filter: copy_CTB() only within width&height
avformat/flvdec: Check for EOF in index reading
avformat/nutdec: Check get_packetheader() in mainheader
avformat/asfdec_f: Use 64bit for packet start time
tools/target_dec_fuzzer: Adjust threshold for MMVIDEO
avcodec/lagarith: Check dst/src in zero run code
avcodec/h264dec: Skip late SEI
avcodec/sbrdsp_fixed: Fix integer overflows in sbr_qmf_deint_neg_c()
avfilter/vf_signature: Fix integer overflow in filter_frame()
avformat/rtsp: break on unknown protocols
avcodec/hevcdsp_template: stay within tables in sao_band_filter()
avcodec/tiff: Check pixel format types for dng
avcodec/qpeldsp: copy less for the mc0x cases
avcodec/ffv1dec: Limit golomb rice coded slices to width 8M
avformat/iff: simplify duration calculation
avcodec/wnv1: Check for width =1
avcodec/ffv1dec_template: fix indention
avformat/sctp: close socket on errors
avcodec/aasc: Fix indention
avcodec/qdrw: adjust max colors to array size
avcodec/alacdsp: Make intermediates unsigned
avformat/aiffdec: cleanup size handling for extreem cases
avcodec/jpeglsdec: fix end check for xfrm
avcodec/cdgraphics: limit scrolling to the line
avformat/aiffdec: avoid integer overflow in get_meta()
avformat/ape: more bits in size for less overflows
avformat/bfi: Check offsets better
avformat/asfdec_f: Check packet_frag_timestamp
avcodec/texturedspenc: Fix indexing in color distribution determination
avformat/act: Check ff_get_wav_header() for failure
avcodec/libxavs2: Improve r redundancy in occured
avformat/libzmq: Improve r redundancy in occured
avfilter/vsrc_mandelbrot: Check for malloc failure
avfilter/vf_frei0r: Copy to frame allocated according to frei0r requirements
avfilter/video: Add ff_default_get_video_buffer2() to set specific alignment
avformat/genh: Check sample rate
avcodec/pngenc: remove monowhite from apng formats
configure: bump year
configure: extend SDL check to accept all 2.x versions
lavf/tls_mbedtls: add support for mbedtls version 3
version 4.3.4:
fate: update reference files after the recent dash manifest muxer changes
avformat/webmdashenc: fix on-demand profile string
Update for FFmpeg 4.3.4
avcodec/diracdec: avoid signed integer overflow in global mv
avcodec/takdsp: Fix integer overflow in decorrelate_sf()
avcodec/apedec: fix a integer overflow in long_filter_high_3800()
avfilter/vf_subtitles: pass storage size to libass
avformat/aqtitledec: Skip unrepresentable durations
avformat/cafdec: Do not store empty keys in read_info_chunk()
avformat/mxfdec: Do not clear array in mxf_read_strong_ref_array() before writing
avformat/mxfdec: Check for avio_read() failure in mxf_read_strong_ref_array()
avformat/mxfdec: Check count in mxf_read_strong_ref_array()
avformat/hls: Check target_duration
avcodec/pixlet: Avoid signed integer overflow in scaling in filterfn()
avformat/matroskadec: Check pre_ns
avcodec/sonic: Use unsigned for predictor_k to avoid undefined behavior
avcodec/mjpegbdec: Set buf_size
avformat/matroskadec: Use rounded down duration in get_cue_desc() check
avcodec/g729_parser: Check channels
avformat/avidec: Check height
avformat/rmdec: Better duplicate tags check
avformat/mov: Disallow empty sidx
avformat/matroskadec: Check duration
avformat/mov: Corner case encryption error cleanup in mov_read_senc()
avcodec/jpeglsdec: Fix if( code style
avcodec/jpeglsdec: Check get_ur_golomb_jpegls() for error
avcodec/motion_est: fix indention of ff_get_best_fcode()
avcodec/motion_est: Fix xy indexing on range violation in ff_get_best_fcode()
avcodec/jpeglsdec: Increase range for N in ls_get_code_runterm() by using unsigned
avformat/matroskadec: Check desc_bytes
avformat/utils: Fix invalid NULL pointer operation in ff_parse_key_value()
avformat/matroskadec: Fix infinite loop with bz decompression
avformat/mov: Check size before subtraction
avcodec/apedec: Fix integer overflows in predictor_update_3930()
avcodec/apedec: fix integer overflow in 8bit samples
avformat/flvdec: timestamps cannot use the full int64 range
avcodec/vqavideo: reset accounting on error
avcodec/alacdsp: fix integer overflow in decorrelate_stereo()
avformat/4xm: Check for duplicate track ids
avformat/4xm: Consider max_streams on reallocating tracks array
avformat/mov: Check next offset in mov_read_dref()
avformat/vivo: Favor setting fps from explicit fractions
avformat/vivo: Do not use the general expression evaluator for parsing a floating point value
avformat/mxfdec: Check for duplicate mxf_read_index_entry_array()
avcodec/apedec: Change avg to uint32_t
avformat/mov: Disallow duplicate smdm
avformat/mov: Check for EOF in mov_read_glbl()
avcodec/vp3: Check version in all cases when VP4 code is not built
avformat/mov: Check channels for mov_parse_stsd_audio()
avformat/avidec: Check read_odml_index() for failure
avformat/aiffdec: Use av_rescale() for bitrate
avformat/aiffdec: sanity check block_align
avformat/aiffdec: Check sample_rate
avcodec/flac_parser: Consider AV_INPUT_BUFFER_PADDING_SIZE
avcodec/libdav1d: free the Dav1dData packet on dav1d_send_data() failure
configure: Add missing libshine->mpegaudioheader dependency
version 4.3.3:
avcodec/ttadsp: Fix integer overflows in tta_filter_process_c()
avutil/mathematics: Document av_rescale_rnd() behavior on non int64 results
avformat/matroskadec: Reset state also on failure in matroska_reset_status()
avformat/wavdec: Check smv_block_size
avformat/rmdec: Check for multiple audio_stream_info
avcodec/apedec: Use 64bit to avoid overflow
avcodec/apedec: Fix undefined integer overflow in long_filter_ehigh_3830()
oavformat/avidec: Check offset in odml
avformat/mpegts: use actually read packet size in mpegts_resync special case
avfilter/scale_npp: fix non-aligned output frame dimensions
Update for 4.3.3
swscale/alphablend: Fix slice handling
avcodec/apedec: Fix integer overflow in filter_fast_3320()
avcodec/mxpegdec: Check for AVDISCARD_ALL
avcodec/flicvideo: Check remaining bytes in FLI*COPY
avcodec/cbs_h265_syntax_template: Limit sps_num_palette_predictor_initializer_minus1 to 127
avcodec/snowdec: Maintain avmv buffer
avcodec/mpeg12dec: Do not put mpeg_f_code into an invalid state on error return
avcodec/mpegvideo_enc: Limit bitrate tolerance to the representable
avcodec/apedec: Fix integer overflow in intermediate
avformat/mvdec: Do not set invalid sample rate
avformat/sbgdec: Check for t0 overflow in expand_tseq()
avformat/rmdec: Use 64bit for intermediate for DEINT_ID_INT4
avformat/sbgdec: Check opt_duration and start for overflow
avformat/mov: Check for duplicate clli
avformat/jacosubdec: Check for min in t overflow in get_shift()
avformat/mxfdec: check channel number in mxf_get_d10_aes3_packet()
avcodec/utils: don't return negative values in av_get_audio_frame_duration()
avcodec/jpeg2000dec: Check that atom header is within bytsetream
avcodec/apedec: Fix 2 integer overflows in filter_3800()
avcodec/xpmdec: Move allocations down after more error checks
avformat/mov: Check dts for overflow in mov_read_trun()
avformat/avidec: Use 64bit for frame number in odml index parsing
avcodec/mjpegbdec: Skip SOS on AVDISCARD_ALL as does mjpeg
avcodec/mjpegdec: Check for bits left in mjpeg_decode_scan_progressive_ac()
avformat/adtsenc: return value check for init_get_bits in adts_decode_extradata
avcodec/webp: Check available space in loop in decode_entropy_coded_image()
avcodec/h264dec: use picture parameters in ff_print_debug_info2()
avcodec/vc1dec: ff_print_debug_info() does not support WMV3 field_mode
avcodec/frame_thread_encoder: Free AVCodecContext structure on error during init
avcodec/faxcompr: Check for end of input in cmode == 1 in decode_group3_2d_line()
avcodec/vc1dec: Disable error concealment for *IMAGE
avcodec/sbrdsp_fixed: Fix negation overflow in sbr_neg_odd_64_c()
avformat/wtvdec: Check for EOF before seeking back in parse_media_type()
avformat/mpc8: Check first keyframe position for overflow
avformat/wavdec: Use 64bit in new_pos computation
avformat/sbgdec: Check for overflow in timestamp preparation
avformat/dsicin: Check packet size for overflow
avformat/dsfdec: Change order of operations in bitrate computation
avformat/bfi: check nframes
avformat/avidec: fix position overflow in avi_load_index()
avformat/asfdec_f: Check sizeX against padding
avformat/aiffdec: Check for size overflow in header parsing
avcodec/aaccoder: Add minimal bias in search_for_ms()
avformat/mov: Avoid undefined overflow in time_offset calculation
avfilter/af_drmeter: Check that there is data
avfilter/vf_fftdnoiz: Use lrintf() in export_row8()
avfilter/vf_mestimate: Check b_count
avformat/mov: do not ignore errors in mov_metadata_hmmt()
avformat/mxfdec: Check size for shrinking
avcodec/dnxhddec: check and propagate function return value
swscale/slice: Fix wrong return on error
avcodec/aacdec_template: Avoid some invalid values to be set by decode_audio_specific_config_gb()
swscale/slice: Check slice for allocation failure
avformat/matroskadec: Fix handling of huge default durations
avcodec/lpc: check for zero err in normalization in compute_lpc_coefs()
avformat/ftp: Check for av_strtok() failure
tools/cws2fws: Check read() for failure
avcodec/cpia: Fix missing src_size update
avcodec/clearvideo: Check tile_size to be not too large
avcodec/utils: Use 64bit for intermediate in AV_CODEC_ID_ADPCM_THP* duration calculation
avformat/rmdec: Check old_format len for overflow
avformat/realtextdec: Check the pts difference before using it for the duration computation
avformat/qcp: Avoid negative nb_rates
avformat/nutdec: Check tmp_size
avformat/msf: Check that channels doesnt overflow during extradata construction
avformat/mpc8: Check for position overflow in mpc8_handle_chunk()
avformat/iff: Use 64bit in duration computation
avformat/dxa: Check fps to be within the supported range more precissely
avcodec/iff: Only write palette to plane 1 if its PAL8
avformat/tta: Check for EOF in index reading loop
Update missed irc links
avformat/rpl: The associative law doesnt hold for signed integers in C
avcodec/faxcompr: Check available bits in decode_uncompressed()
avcodec/faxcompr: Check if bits are available before reading in cmode == 9 || cmode == 10
avformat/utils: check dts/duration to be representable before using them
avcodec/utils: do "calc from frame_bytes, channels, and block_align" in 64bit
avcodec/ttadata: Add sentinel at the end of ff_tta_shift_1
avformat/mov: Check for duplicate mdcv
avfilter/vf_dctdnoiz: Check threads
avfilter/vf_ciescope: Fix undefined behavior in rgb_to_xy() with black
avformat/rpl: Check for EOF and zero framesize
avcodec/vc2enc: Check for non negative slice bounds
avformat/rpl: Use 64bit in bitrate computation and check it
avcodec/svq1enc: Do not print debug RD value before it has been computed
avcodec/aacpsy: Check bandwidth
avcodec/aacenc: Do not divide by lambda_count if it is 0
avcodec/aacenc: Use FLT_EPSILON for lambda minimum
avformat/cinedec: Fix index_entries size check
avfilter/vf_yadif: Fix handing of tiny images
avfilter/vf_vmafmotion: Check dimensions
avformat/movenc: Check pal_size before use
avcodec/lpc: Avoid floating point division by 0
avcodec/aacpsy: Avoid floating point division by 0 of norm_fac
avcodec/aacenc: Avoid 0 lambda
avcodec/exr: x/ymax cannot be INT_MAX
avformat/avio: Check av_opt_copy() for failure
avcodec/clearvideo: Check for 0 tile_shift
avcodec/vc1: Check remaining bits in ff_vc1_parse_frame_header()
avformat/mov: Ignore duplicate CoLL
avformat/mov: Limit nb_chapter_tracks to input size
avformat/utils: Use 64bit earlier in r_frame_rate check
avcodec/alsdec: Fix decoding error with mono audio files
avformat/mvdec: Check sample rate in parse_audio_var()
avcodec/faxcompr: Check for end of bitstream in decode_group3_1d_line() and decode_group3_2d_line()
avcodec/utils: treat PAL8 for jpegs similar to other colorspaces
avcodec/jpeglsdec: Set alpha plane in PAL8 so image is not 100% transparent
avformat/asfdec_o: Use ff_get_extradata()
avformat/id3v2: Check end for overflow in id3v2_parse()
avformat/wtvdec: Improve size overflow checks in parse_chunks()
avcodec/faxcompr: Check remaining bits on error in decode_group3_1d_line()
avcodec/utils: Check ima wav duration for overflow
avcodec/rv10: Execute whole size check earlier for rv20
avformat/cafdec: Check channels
avcodec/dpx: Check bits_per_color earlier
avformat/mvi: Check audio_data_size to be non negative
avcodec/pnm_parser: Check image size addition for overflow
avcodec/h265_metadata_bsf: Check nb_units before accessing the first in h265_metadata_update_fragment()
avformat/rmdec: use larger intermediate type for audio_framesize * sub_packet_h check
avcodec/h264_slice: Check input SPS in ff_h264_update_thread_context()
avformat/mpc8: check for size overflow in mpc8_get_chunk_header()
avformat/mov: Do not zero memory that is written too or unused
avcodec/mpegvideo: Update chroma_?_shift in ff_mpv_common_frame_size_change()
avformat/mov: Ignore multiple STSC / STCO
avformat/utils: Extend overflow check in dts wrap in compute_pkt_fields()
avfilter/vf_scale: Fix adding 0 to NULL (which is UB) in scale_slice()
avutil/common: Add FF_PTR_ADD()
avformat/wtvdec: Check size in SBE2_STREAM_DESC_EVENT / stream2_guid
tools/target_dec_fuzzer: Adjust threshold for H264
avformat/cafdec: Do not build an index if all packets are the same
avformat/vividas: Use equals check with n in read_sb_block()
avcodec/sonic: Use unsigned temporary in predictor_calc_error()
avformat/jacosubdec: Use 64bit intermediate for start/end timestamp shift
avformat/flvdec: Check array entry number
avcodec/h264_slice: Check sps in h264_slice_header_init()
avformat/movenc: Avoid loosing cluster array on failure
avformat/avidec: Check for dv streams before using priv_data in parse ##dc/##wb
avformat/mov: Check sample size for overflow in mov_parse_stsd_audio()
avformat/sbgdec: Check for overflow in last loop in expand_timestamps()
avcodec/ffwavesynth: Avoid signed integer overflow in phi_at()
avcodec/mpeg4videoenc: Check extradata malloc()
avcodec/speedhq: Width < 8 is not supported
avformat/matroskadec: Check for EOF in resync loop
avcodec/utils: Use more bits for intermediate for AV_CODEC_ID_ADPCM_MS
avcodec/jpegls: Check A[Q] for overflow in ff_jpegls_update_state_regular()
avformat/voc_packet: prevent remaining size from becoming negative in ff_voc_get_packet()
avutil/timecode: Avoid fps overflow
avformat/mvi: Check audio size for more overflows
avcodec/flacdec: Avoid undefined shift in error case
avcodec/ffv1dec: Check if trailer is available
avcodec/4xm: Check pre_gb in decode_i_block()
avformat/mvdec: Allocate extradata only once
avcodec/dcadsp: Fix integer overflow in dmix_add_c()
avformat/flvdec: Check double before cast in parse_keyframes_index()
avformat/paf: Check for EOF before allocation in read_header()
avcodec/aacdec_template: Avoid undefined negation in imdct_and_windowing_eld()
avformat/lxfdec: Fix multiple integer overflows related to track_size
avcodec/exr: skip bottom clearing loop when its outside the image
avutil/parseutils: Check sign in av_parse_time()
avformat/aiffdec: Check that SSND is at least 8 bytes
avformat/dcstr: Check sample rate
avcodec/alsdec: Check bitstream input in read_block()
avformat/mov: Extend data_size check in mov_read_udta_string()
avformat/aadec: Check for EOF while reading chapters
avformat/voc_packet: Add a basic check on max_size
avformat/microdvddec: use 64bit for durations
avcodec/h264_slice: clear old slice POC values on parsing failure
avfilter/overlay_cuda: check av_buffer_ref result
avfilter/overlay_cuda: hold explicit reference to hw_device_ctx
avformat/url: add ff_make_absolulte_url2 to be able to test windows path cases
avformat/url: fix ff_make_absolute_url with Windows file paths
Revert "avcodec: Add FF_CODEC_CAP_INIT_CLEANUP"
fftools/ffplay: do not write out of rdft visualization texture
avfilter/overlay_cuda: fix framesync with embedded PGS subtitle
avcodec/mxpegdec: Fix memleaks upon init failure
avcodec/mjpegdec: Fix memleak upon init failure
avfilter/af_headphone: Fix stack buffer overflow
avfilter/af_headphone: Don't overrun array
avfilter/af_headphone: Fix segfault when using very short streams
avfilter/af_headphone: Check for the existence of samples
avfilter/af_headphone: Remove always true check
avfilter/af_headphone: Don't use uninitialized buffer in log message
avformat/segment: Fix error messages
avformat/segment: Free SegmentListEntries in deinit, not write_trailer
avformat/segment: Fix leak and invalid free of AVIOContext
avformat/segment: Fix leak of string on error
avformat/segment: Fix segfault when error happens and segment list is output
avformat/segment: Fix segfault on allocation error, avoid allocation
avformat/segment: Fix leak of duration/framenumber lists upon error
avformat/segment: Don't overwrite AVCodecParameters after init
avformat/dashdec: Reset pointer to NULL after freeing it
libavformat/dashdec: Fix issue with dash on Windows
avformat/dashdec: Fix memleak on allocation error, avoid allocation
avformat/dashdec: Fix memleaks on error to add representation to dynarray
avformat/dashdec: Fix leak of representation languages
avformat/dashdec: Fix leak of string on error when parsing representation
avformat/dashdec: Fix leak of representation on error
avformat/dashdec: Remove unused index of representation
avformat/dashdec: Fix memleaks upon read_header failure
avformat/dashdec: Check allocation of AVProgram
avformat/dashdec, hls: Update correct pointer to AVDictionary
avformat/dashdec: Fix leak of AVDictionary on error
avformat/dashdec: Free subtitle representations on exit
avformat/dashdec: Free strings as soon as they aren't needed anymore
avformat/dashdec: Don't overwrite and leak old initialization fragments
avformat/dashdec: Don't leave representation in inconsistent state on error
avformat/dashdec: Remove dead code
avformat/spdifenc: Fix leak upon error
avformat/wavenc: Fix leak and segfault on reallocation error
avformat/mpegenc: Avoid adding invalid packet to queue
avformat/mpegenc: Fix leak in case trailer is never written
avformat/mpegenc: Ensure packet queue stays valid
avformat/mxfenc: Never set codec_ul UID to NULL
avcodec/frame_thread_encoder: Fix segfault on allocation error
avformat/utils: Add av_assert1 to preclude NULL + len, len != 0
avformat/utils: Fix undefined NULL + 0
avcodec/g722enc: Validate parameters before using them
avcodec/g722enc: Cleanup generically on init failure
avcodec/opusdec: Return error upon error
avcodec/wavpack: Fix leak on init failure
avcodec/pthread_slice: Don't use static variable, fix race
avcodec/a64multienc: Fix memleak upon init failure
avformat/flacenc: Fix memleak when writing attached pictures fails
avcodec/mpeg12enc: Always initialize MPEG-2 intra VLC table lengths
avcodec/fft_template, fft_init_table: Make ff_fft_init() thread-safe
avformat/asfdec_o: Don't segfault with lots of attached pics
avcodec/mss4: Fix memleaks upon allocation error
avformat/apngdec: Fix size/overflow checks
avformat/apngdec: Return error for incomplete header
avformat/jacosubdec: Fix unintended fallthrough
avcodec/bitstream: Consistently treat symbol as VLC_TYPE
avcodec/vp3: Check allocations of VLCs
avcodec/vp3: Fix memleak upon init failure
avcodec/movtextenc: Fix undefined left shifts outside the range of int
avcodec/movtextenc: Fix memleak on (re)allocation error
avcodec/movtextenc: Don't presume every style to have a font
avcodec/movtextenc: Reset array counter after freeing array
avcodec/movtextenc: Fix potential use of uninitialized value
avcodec/movtextenc: fix writing to bytestream on BE arches
avcodec/movtextdec: Fix leaks on (re)allocation failure
avcodec/movtextdec: Simplify checking for invalid extradata
avcodec/movtextdec: Fix leaks of strings upon reallocation failure
avcodec/movtextdec: Reset counter of fonts when freeing them
avcodec/sheervideo: Don't leave context in inconsistent state upon error
avfilter/vf_minterpolate: Fix left shift of negative value
avfilter/vf_minterpolate: Reject too small dimensions
avformat/movenc: Don't forget to free fragment buffers
avformat/movenc: Free old vos_data before overwriting it
avformat/movenc: Fix segfault when remuxing rtp hint stream
avcodec/dvenc: Fix undefined left shift of negative numbers
avformat/movenc: Fix stack overflow when remuxing timecode tracks
avcodec/utils: Also free encoder extradata on avcodec_open2() error
avcodec/utils: Don't forget cleaning up when allocating priv_data fails
avcodec/utils: Improve check for freeing codec private options
swresample/audioconvert: Fix left shift of negative value
avcodec/utils: Only call codec->close if init has been called
avformat/movenc: Fix segfault upon allocation error
avformat/swfdec: Reorder allocations/initializations
avformat/swfdec: Fix memleaks on error
avformat/dashdec: Avoid double free on error
avformat/tedcaptionsdec: Fix leak of AVBPrint upon error
avformat/swfenc: Fix memleak upon write_header error
avformat/rmdec: Fix potential crash on allocation failure
avformat/rmdec: Actually return value < 0 on read_header failure
avformat/avidec: Fix memleak when error happens after creating DV stream
avcodec/mpegaudiodec_template: Check return value of subdecoder
avcodec/j2kenc: Fix leaks on init failure
avcodec/flashsv2enc: Check allocations for success before usage
avcodec/flashsvenc: Avoid allocation of buffer, fix memleak
avcodec/ac3enc_template: Don't free uninitialized pointers on error
avcodec/svq3: Fix segfault on allocation error, avoid allocations
avcodec/sonic: Fix leaks upon allocation errors
avcodec/qtrleenc: Fix memleak upon allocation failure
avcodec/ffv1enc: Fix memleaks on init failure
avcodec/ffv1: Fix segfaults on allocation error
avcodec/mlpenc: Fix memleak upon init failure
avcodec/indeo5: Fix memleaks upon allocation error
avcodec/ivi: Fix segfault on allocation error
avcodec/magicyuvenc: Fix memleak upon init failure
avcodec/gif: Fix leaks upon allocation error
avcodec/avrndec: Fix memleak on error
avcodec/avrndec: Check allocation for success
avcodec/atrac1: Check allocation of AVFloatDSPContext
avfilter/vf_subtitles: Fix leaks on failure
avfilter/vf_uspp: Fix potential leak of dict on error
avfilter/lavfutils: Fix memleak when avformat_find_stream_info() fails
avfilter/lavfutils: Don't use uninitialized pointers for freeing
avcodec/binkaudio: Don't use static storage for context-dependent data
avcodec/bink: Fix memleak upon init failure
avcodec/wnv1: Use LE bitstream reader, avoid copying packet, fix memleak
avcodec/truemotion2: Avoid duplicating array, fix memleak
avfilter/af_headphone: Fix leak of channel layouts list on error
avfilter/af_headphone: Fix segfault upon allocation failure
avfilter/vf_signature: Fix leak of string upon error
avfilter/vf_signature: Fix leak of inpads' names
avfilter/af_aiir: Fix segfault and leak upon allocation failure
avfilter/vf_premultiply: Fix leak of names of inpads
avfilter/af_anequalizer: Fix memleak when inserting pad fails
avfilter/af_amerge: Fix segfault upon allocation failure
avfilter/af_aformat: Add uninit function
avfilter/vf_hwdownload: Fix leak of formats list upon error
avfilter/formats: Fix double frees and memleaks on error
avfilter/af_channelmap: Fix double-free of AVFilterChannelLayouts on error
avfilter/vf_alphamerge: Fix double-free of AVFilterFormats on error
avfilter/vf_overlay: Fix double-free of AVFilterFormats on error
avfilter/vf_remap: Fix double-free of AVFilterFormats on error
avfilter/vf_showpalette: Fix double-free of AVFilterFormats on error
avfilter/af_amix: Fix double-free of AVFilterChannelLayouts on error
avfilter/af_amix: Don't needlessly reallocate table
avfilter/vf_vpp_qsv: Fix leak of AVFilterFormats on error
avfilter/vf_paletteuse: Fix leaks of AVFilterFormats on error
avfilter/graphparser: Fix memleak when linking filters fails
fftools/ffmpeg: Fix leak of AVFilterInOut in case of error
avfilter/graphparser: Check allocations for success
avfilter/graphparser: Don't set pointer to one beyond '\0' of string
avfilter/graphparser: Fix leaks when parsing inputs fails
avfilter/af_afir: Fix leak of AVFilterChannelLayout in case of error
avformat/mlvdec: Only store dimensions after having validated them
avformat/mlvdec: Don't leak open AVIOContexts on error
avformat/mlvdec: Check for existence of AVIOContext before using it
avformat/hls: Fix memleak when url is empty
avfilter/formats: Fix heap-buffer overflow when merging channel layouts
Revert "lavfi/avfiltergraph: add check before free the format"
avfilter/formats: Leave lists' ownership unchanged upon merge failure
avformat/mpegts: Don't leave context in inconsistent state upon error
avformat/sierravmd: Don't return packets for non-existing stream
avformat/vividas: Check allocation for success
avformat/vividas: Check return value before storing it in smaller type
avformat/webmdashenc: Avoid allocations, fix memleak
avformat/webmdashenc: Fix segfault when no filename is given when live
avformat/matroskadec: Avoid undefined pointer arithmetic
avformat/mxfdec: Fix memleak upon repeating tags
avformat/mxfdec: Fix memleak when parsing tag fails
avformat/mxfdec: Fix memleak when adding element to array fails
version 4.3.2:
avcodec/hapdec: Change compressed_offset to unsigned 32bit
avformat/rmdec: Check codec_length without overflow
+8
View File
@@ -15,3 +15,11 @@ NOTICE
------
- Non system dependencies (e.g. libx264, libvpx) are disabled by default.
NOTICE for Package Maintainers
------------------------------
- It is recommended to build FFmpeg twice, first with minimal external dependencies so
that 3rd party packages, which depend on FFmpegs libavutil/libavfilter/libavcodec/libavformat
can then be built. And last build FFmpeg with full dependancies (which may in turn depend on
some of these 3rd party packages). This avoids circular dependencies during build.
+6 -3
View File
@@ -577,10 +577,12 @@ wm4
Releases
========
7.0 Michael Niedermayer
6.1 Michael Niedermayer
5.1 Michael Niedermayer
4.4 Michael Niedermayer
3.4 Michael Niedermayer
2.8 Michael Niedermayer
2.7 Michael Niedermayer
2.6 Michael Niedermayer
2.5 Michael Niedermayer
If you want to maintain an older release, please contact us
@@ -610,6 +612,7 @@ Loren Merritt ABD9 08F4 C920 3F65 D8BE 35D7 1540 DAA7 060F 56DE
Lou Logan (llogan) 7D68 DC73 CBEF EABB 671A B6CF 621C 2E28 82F8 DC3A
Lynne FE50 139C 6805 72CA FD52 1F8D A2FE A5F0 3F03 4464
Michael Niedermayer 9FF2 128B 147E F673 0BAD F133 611E C787 040B 0FAB
DD1E C9E8 DE08 5C62 9B3E 1846 B18E 8928 B394 8D64
Nicolas George 24CE 01CE 9ACC 5CEB 74D8 8D9D B063 D997 36E5 4C93
Nikolay Aleksandrov 8978 1D8C FB71 588E 4B27 EAA8 C4F0 B5FC E011 13B1
Panagiotis Issaris 6571 13A3 33D9 3726 F728 AA98 F643 B12E ECF3 E029
+1 -1
View File
@@ -1 +1 @@
4.3.2
4.3.9
+1 -1
View File
@@ -11,5 +11,5 @@
We hope you will like this release as much as we enjoyed working on it, and
as usual, if you have any questions about it, or any FFmpeg related topic,
feel free to join us on the #ffmpeg IRC channel (on irc.freenode.net) or ask
feel free to join us on the #ffmpeg IRC channel (on irc.libera.chat) or ask
on the mailing-lists.
Vendored
+14 -9
View File
@@ -532,7 +532,7 @@ die(){
If you think configure made a mistake, make sure you are using the latest
version from Git. If the latest version fails, report the problem to the
ffmpeg-user@ffmpeg.org mailing list or IRC #ffmpeg on irc.freenode.net.
ffmpeg-user@ffmpeg.org mailing list or IRC #ffmpeg on irc.libera.chat.
EOF
if disabled logging; then
cat <<EOF
@@ -2330,6 +2330,7 @@ HAVE_LIST="
opencl_vaapi_intel_media
perl
pod2man
posix_ioctl
texi2html
"
@@ -3236,7 +3237,7 @@ librav1e_encoder_deps="librav1e"
librav1e_encoder_select="extract_extradata_bsf"
librsvg_decoder_deps="librsvg"
libshine_encoder_deps="libshine"
libshine_encoder_select="audio_frame_queue"
libshine_encoder_select="audio_frame_queue mpegaudioheader"
libspeex_decoder_deps="libspeex"
libspeex_encoder_deps="libspeex"
libspeex_encoder_select="audio_frame_queue"
@@ -5330,6 +5331,7 @@ case $target_os in
;;
netbsd)
disable symver
enable section_data_rel_ro
oss_indev_extralibs="-lossaudio"
oss_outdev_extralibs="-lossaudio"
enabled gcc || check_ldflags -Wl,-zmuldefs
@@ -5348,6 +5350,7 @@ case $target_os in
disable symver
;;
freebsd)
enable section_data_rel_ro
;;
bsd/os)
add_extralibs -lpoll -lgnugetopt
@@ -6493,7 +6496,7 @@ fi
if enabled sdl2; then
SDL2_CONFIG="${cross_prefix}sdl2-config"
test_pkg_config sdl2 "sdl2 >= 2.0.1 sdl2 < 2.1.0" SDL_events.h SDL_PollEvent
test_pkg_config sdl2 "sdl2 >= 2.0.1 sdl2 < 3.0.0" SDL_events.h SDL_PollEvent
if disabled sdl2 && "${SDL2_CONFIG}" --version > /dev/null 2>&1; then
sdl2_cflags=$("${SDL2_CONFIG}" --cflags)
sdl2_extralibs=$("${SDL2_CONFIG}" --libs)
@@ -6539,11 +6542,13 @@ perl -v > /dev/null 2>&1 && enable perl || disable perl
pod2man --help > /dev/null 2>&1 && enable pod2man || disable pod2man
rsync --help 2> /dev/null | grep -q 'contimeout' && enable rsync_contimeout || disable rsync_contimeout
check_headers linux/fb.h
check_headers linux/videodev2.h
test_code cc linux/videodev2.h "struct v4l2_frmsizeenum vfse; vfse.discrete.width = 0;" && enable_sanitized struct_v4l2_frmivalenum_discrete
test_code cc sys/ioctl.h "int ioctl(int, int, ...)" && enable posix_ioctl
# check V4L2 codecs available in the API
if enabled v4l2_m2m; then
check_headers linux/fb.h
check_headers linux/videodev2.h
test_code cc linux/videodev2.h "struct v4l2_frmsizeenum vfse; vfse.discrete.width = 0;" && enable_sanitized struct_v4l2_frmivalenum_discrete
check_cc v4l2_m2m linux/videodev2.h "int i = V4L2_CAP_VIDEO_M2M_MPLANE | V4L2_CAP_VIDEO_M2M | V4L2_BUF_FLAG_LAST;"
check_cc vc1_v4l2_m2m linux/videodev2.h "int i = V4L2_PIX_FMT_VC1_ANNEX_G;"
check_cc mpeg1_v4l2_m2m linux/videodev2.h "int i = V4L2_PIX_FMT_MPEG1;"
@@ -6588,7 +6593,7 @@ enabled alsa && { check_pkg_config alsa alsa "alsa/asoundlib.h" snd_pcm_htimesta
enabled libjack &&
require_pkg_config libjack jack jack/jack.h jack_port_get_latency_range
enabled sndio && check_lib sndio sndio.h sio_open -lsndio
enabled sndio && check_pkg_config sndio sndio sndio.h sio_open
if enabled libcdio; then
check_pkg_config libcdio libcdio_paranoia "cdio/cdda.h cdio/paranoia.h" cdio_cddap_open ||
@@ -6685,7 +6690,7 @@ enabled vulkan &&
if enabled x86; then
case $target_os in
mingw32*|mingw64*|win32|win64|linux|cygwin*)
freebsd|mingw32*|mingw64*|win32|win64|linux|cygwin*)
;;
*)
disable ffnvcodec cuvid nvdec nvenc
@@ -7513,7 +7518,7 @@ cat > $TMPH <<EOF
#define FFMPEG_CONFIG_H
#define FFMPEG_CONFIGURATION "$(c_escape $FFMPEG_CONFIGURATION)"
#define FFMPEG_LICENSE "$(c_escape $license)"
#define CONFIG_THIS_YEAR 2021
#define CONFIG_THIS_YEAR 2025
#define FFMPEG_DATADIR "$(eval c_escape $datadir)"
#define AVCONV_DATADIR "$(eval c_escape $datadir)"
#define CC_IDENT "$(c_escape ${cc_ident:-Unknown compiler})"
+1 -1
View File
@@ -38,7 +38,7 @@ PROJECT_NAME = FFmpeg
# could be handy for archiving the generated documentation or if some version
# control system is used.
PROJECT_NUMBER = 4.3.2
PROJECT_NUMBER = 4.3.9
# Using the PROJECT_BRIEF tag one can provide an optional one line description
# for a project that appears at the top of each page and should give viewer a
+2 -2
View File
@@ -3,9 +3,9 @@
The FFmpeg developers.
For details about the authorship, see the Git history of the project
(git://source.ffmpeg.org/ffmpeg), e.g. by typing the command
(https://git.ffmpeg.org/ffmpeg), e.g. by typing the command
@command{git log} in the FFmpeg source directory, or browsing the
online repository at @url{http://source.ffmpeg.org}.
online repository at @url{https://git.ffmpeg.org/ffmpeg}.
Maintainers for the specific components are listed in the file
@file{MAINTAINERS} in the source code tree.
+1 -1
View File
File diff suppressed because one or more lines are too long
-1
View File
@@ -63,4 +63,3 @@ make -j<num>
make -k
Continue build in case of errors, this is useful for the regression tests
sometimes but note that it will still not run all reg tests.
+7
View File
@@ -327,6 +327,13 @@ segment index to start live streams at (negative values are from the end).
@item allowed_extensions
',' separated list of file extensions that hls is allowed to access.
@item extension_picky
This blocks disallowed extensions from probing
It also requires all available segments to have matching extensions to the format
except mpegts, which is always allowed.
It is recommended to set the whitelists correctly instead of depending on extensions
Enabled by default.
@item max_reload
Maximum number of times a insufficient list is attempted to be reloaded.
Default value is 1000.
+19
View File
@@ -762,6 +762,25 @@ In case you need finer control over how valgrind is invoked, use the
@code{--target-exec='valgrind <your_custom_valgrind_options>} option in
your configure line instead.
@anchor{Maintenance}
@chapter Maintenance process
@anchor{MAINTAINERS}
@section MAINTAINERS
The developers maintaining each part of the codebase are listed in @file{MAINTAINERS}.
Being listed in @file{MAINTAINERS}, gives one the right to have git write access to
the specific repository.
@anchor{Becoming a maintainer}
@section Becoming a maintainer
People add themselves to @file{MAINTAINERS} by sending a patch like any other code
change. These get reviewed by the community like any other patch. It is expected
that, if someone has an objection to a new maintainer, she is willing to object
in public with her full name and is willing to take over maintainership for the area.
@anchor{Release process}
@chapter Release process
+1 -3
View File
@@ -137,11 +137,9 @@ static int decode_packet(AVCodecContext *dec, const AVPacket *pkt)
ret = output_audio_frame(frame);
av_frame_unref(frame);
if (ret < 0)
return ret;
}
return 0;
return ret;
}
static int open_codec_context(int *stream_idx,
+1 -3
View File
@@ -221,10 +221,8 @@ static int dec_enc(AVPacket *pkt, AVCodec *enc_codec)
fail:
av_frame_free(&frame);
if (ret < 0)
return ret;
}
return 0;
return ret;
}
int main(int argc, char **argv)
+22 -2
View File
@@ -53,7 +53,7 @@ Most distribution and operating system provide a package for it.
@section Cloning the source tree
@example
git clone git://source.ffmpeg.org/ffmpeg <target>
git clone https://git.ffmpeg.org/ffmpeg.git <target>
@end example
This will put the FFmpeg sources into the directory @var{<target>}.
@@ -187,11 +187,18 @@ to make sure you don't have untracked files or deletions.
git add [-i|-p|-A] <filenames/dirnames>
@end example
Make sure you have told Git your name and email address
Make sure you have told Git your name, email address and GPG key
@example
git config --global user.name "My Name"
git config --global user.email my@@email.invalid
git config --global user.signingkey ABCDEF0123245
@end example
Enable signing all commits or use -S
@example
git config --global commit.gpgsign true
@end example
Use @option{--global} to set the global configuration for all your Git checkouts.
@@ -393,6 +400,19 @@ git checkout -b svn_23456 $SHA1
where @var{$SHA1} is the commit hash from the @command{git log} output.
@chapter gpg key generation
If you have no gpg key yet, we recommend that you create a ed25519 based key as it
is small, fast and secure. Especially it results in small signatures in git.
@example
gpg --default-new-key-algo "ed25519/cert,sign+cv25519/encr" --quick-generate-key "human@@server.com"
@end example
When generating a key, make sure the email specified matches the email used in git as some sites like
github consider mismatches a reason to declare such commits unverified. After generating a key you
can add it to the MAINTAINER file and upload it to a keyserver.
@chapter Pre-push checklist
Once you have a set of commits that you feel are ready for pushing,
-1
View File
@@ -157,4 +157,3 @@ PFD[32] would for example be signed 32 bit little-endian IEEE float
@item XVID @tab non-compliant MPEG-4 generated by old Xvid
@item XVIX @tab non-compliant MPEG-4 generated by old Xvid with interlacing bug
@end multitable
+103 -19
View File
@@ -20,8 +20,45 @@
# License along with FFmpeg; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
# Texinfo 7.0 changed the syntax of various functions.
# Provide a shim for older versions.
sub ff_set_from_init_file($$) {
my $key = shift;
my $value = shift;
if (exists &{'texinfo_set_from_init_file'}) {
texinfo_set_from_init_file($key, $value);
} else {
set_from_init_file($key, $value);
}
}
sub ff_get_conf($) {
my $key = shift;
if (exists &{'texinfo_get_conf'}) {
texinfo_get_conf($key);
} else {
get_conf($key);
}
}
sub get_formatting_function($$) {
my $obj = shift;
my $func = shift;
my $sub = $obj->can('formatting_function');
if ($sub) {
return $obj->formatting_function($func);
} else {
return $obj->{$func};
}
}
# determine texinfo version
my $program_version_num = version->declare(ff_get_conf('PACKAGE_VERSION'))->numify;
my $program_version_6_8 = $program_version_num >= 6.008000;
# no navigation elements
set_from_init_file('HEADERS', 0);
ff_set_from_init_file('HEADERS', 0);
sub ffmpeg_heading_command($$$$$)
{
@@ -55,7 +92,7 @@ sub ffmpeg_heading_command($$$$$)
$element = $command->{'parent'};
}
if ($element) {
$result .= &{$self->{'format_element_header'}}($self, $cmdname,
$result .= &{get_formatting_function($self, 'format_element_header')}($self, $cmdname,
$command, $element);
}
@@ -112,7 +149,11 @@ sub ffmpeg_heading_command($$$$$)
$cmdname
= $Texinfo::Common::level_to_structuring_command{$cmdname}->[$heading_level];
}
$result .= &{$self->{'format_heading_text'}}(
# format_heading_text expects an array of headings for texinfo >= 7.0
if ($program_version_num >= 7.000000) {
$heading = [$heading];
}
$result .= &{get_formatting_function($self,'format_heading_text')}(
$self, $cmdname, $heading,
$heading_level +
$self->get_conf('CHAPTER_HEADER_LEVEL') - 1, $command);
@@ -127,14 +168,18 @@ foreach my $command (keys(%Texinfo::Common::sectioning_commands), 'node') {
}
# print the TOC where @contents is used
set_from_init_file('INLINE_CONTENTS', 1);
if ($program_version_6_8) {
ff_set_from_init_file('CONTENTS_OUTPUT_LOCATION', 'inline');
} else {
ff_set_from_init_file('INLINE_CONTENTS', 1);
}
# make chapters <h2>
set_from_init_file('CHAPTER_HEADER_LEVEL', 2);
ff_set_from_init_file('CHAPTER_HEADER_LEVEL', 2);
# Do not add <hr>
set_from_init_file('DEFAULT_RULE', '');
set_from_init_file('BIG_RULE', '');
ff_set_from_init_file('DEFAULT_RULE', '');
ff_set_from_init_file('BIG_RULE', '');
# Customized file beginning
sub ffmpeg_begin_file($$$)
@@ -151,7 +196,18 @@ sub ffmpeg_begin_file($$$)
my ($title, $description, $encoding, $date, $css_lines,
$doctype, $bodytext, $copying_comment, $after_body_open,
$extra_head, $program_and_version, $program_homepage,
$program, $generator) = $self->_file_header_informations($command);
$program, $generator);
if ($program_version_num >= 7.000000) {
($title, $description, $encoding, $date, $css_lines,
$doctype, $bodytext, $copying_comment, $after_body_open,
$extra_head, $program_and_version, $program_homepage,
$program, $generator) = $self->_file_header_information($command);
} else {
($title, $description, $encoding, $date, $css_lines,
$doctype, $bodytext, $copying_comment, $after_body_open,
$extra_head, $program_and_version, $program_homepage,
$program, $generator) = $self->_file_header_informations($command);
}
my $links = $self->_get_links ($filename, $element);
@@ -184,7 +240,11 @@ EOT
return $head1 . $head_title . $head2 . $head_title . $head3;
}
texinfo_register_formatting_function('begin_file', \&ffmpeg_begin_file);
if ($program_version_6_8) {
texinfo_register_formatting_function('format_begin_file', \&ffmpeg_begin_file);
} else {
texinfo_register_formatting_function('begin_file', \&ffmpeg_begin_file);
}
sub ffmpeg_program_string($)
{
@@ -201,13 +261,17 @@ sub ffmpeg_program_string($)
$self->gdt('This document was generated automatically.'));
}
}
texinfo_register_formatting_function('program_string', \&ffmpeg_program_string);
if ($program_version_6_8) {
texinfo_register_formatting_function('format_program_string', \&ffmpeg_program_string);
} else {
texinfo_register_formatting_function('program_string', \&ffmpeg_program_string);
}
# Customized file ending
sub ffmpeg_end_file($)
{
my $self = shift;
my $program_string = &{$self->{'format_program_string'}}($self);
my $program_string = &{get_formatting_function($self,'format_program_string')}($self);
my $program_text = <<EOT;
<p style="font-size: small;">
$program_string
@@ -220,11 +284,15 @@ EOT
EOT
return $program_text . $footer;
}
texinfo_register_formatting_function('end_file', \&ffmpeg_end_file);
if ($program_version_6_8) {
texinfo_register_formatting_function('format_end_file', \&ffmpeg_end_file);
} else {
texinfo_register_formatting_function('end_file', \&ffmpeg_end_file);
}
# Dummy title command
# Ignore title. Title is handled through ffmpeg_begin_file().
set_from_init_file('USE_TITLEPAGE_FOR_TITLE', 1);
ff_set_from_init_file('USE_TITLEPAGE_FOR_TITLE', 1);
sub ffmpeg_title($$$$)
{
return '';
@@ -242,8 +310,14 @@ sub ffmpeg_float($$$$$)
my $args = shift;
my $content = shift;
my ($caption, $prepended) = Texinfo::Common::float_name_caption($self,
$command);
my ($caption, $prepended);
if ($program_version_num >= 7.000000) {
($caption, $prepended) = Texinfo::Convert::Converter::float_name_caption($self,
$command);
} else {
($caption, $prepended) = Texinfo::Common::float_name_caption($self,
$command);
}
my $caption_text = '';
my $prepended_text;
my $prepended_save = '';
@@ -315,8 +389,13 @@ sub ffmpeg_float($$$$$)
$caption->{'args'}->[0], 'float caption');
}
if ($prepended_text.$caption_text ne '') {
$prepended_text = $self->_attribute_class('div','float-caption'). '>'
. $prepended_text;
if ($program_version_num >= 7.000000) {
$prepended_text = $self->html_attribute_class('div',['float-caption']). '>'
. $prepended_text;
} else {
$prepended_text = $self->_attribute_class('div','float-caption'). '>'
. $prepended_text;
}
$caption_text .= '</div>';
}
my $html_class = '';
@@ -329,8 +408,13 @@ sub ffmpeg_float($$$$$)
$prepended_text = '';
$caption_text = '';
}
return $self->_attribute_class('div', $html_class). '>' . "\n" .
$prepended_text . $caption_text . $content . '</div>';
if ($program_version_num >= 7.000000) {
return $self->html_attribute_class('div', [$html_class]). '>' . "\n" .
$prepended_text . $caption_text . $content . '</div>';
} else {
return $self->_attribute_class('div', $html_class). '>' . "\n" .
$prepended_text . $caption_text . $content . '</div>';
}
}
texinfo_register_command_formatting('float',
Regular → Executable
View File
Regular → Executable
View File
-1
View File
@@ -44,4 +44,3 @@ a+b*c;
here the reader knows that a,b,c are meant to be signed integers but for C
standard compliance / to avoid undefined behavior they are stored in unsigned
ints.
+1 -1
View File
@@ -418,4 +418,4 @@ done:
When all of this is done, you can submit your patch to the ffmpeg-devel
mailing-list for review. If you need any help, feel free to come on our IRC
channel, #ffmpeg-devel on irc.freenode.net.
channel, #ffmpeg-devel on irc.libera.chat.
+2
View File
@@ -1,3 +1,5 @@
#!/bin/sh
toupper(){
echo "$@" | tr abcdefghijklmnopqrstuvwxyz ABCDEFGHIJKLMNOPQRSTUVWXYZ
}
+1 -1
View File
@@ -538,7 +538,7 @@ static const AVOption *opt_find(void *obj, const char *name, const char *unit,
return o;
}
#define FLAGS (o->type == AV_OPT_TYPE_FLAGS && (arg[0]=='-' || arg[0]=='+')) ? AV_DICT_APPEND : 0
#define FLAGS ((o->type == AV_OPT_TYPE_FLAGS && (arg[0]=='-' || arg[0]=='+')) ? AV_DICT_APPEND : 0)
int opt_default(void *optctx, const char *opt, const char *arg)
{
const AVOption *o;
+4 -2
View File
@@ -468,8 +468,9 @@ static int read_key(void)
}
//Read it
if(nchars != 0) {
read(0, &ch, 1);
return ch;
if (read(0, &ch, 1) == 1)
return ch;
return 0;
}else{
return -1;
}
@@ -528,6 +529,7 @@ static void ffmpeg_cleanup(int ret)
for (j = 0; j < fg->nb_outputs; j++) {
OutputFilter *ofilter = fg->outputs[j];
avfilter_inout_free(&ofilter->out_tmp);
av_freep(&ofilter->name);
av_freep(&ofilter->formats);
av_freep(&ofilter->channel_layouts);
+2 -2
View File
@@ -1151,6 +1151,8 @@ static void video_audio_display(VideoState *s)
if (realloc_texture(&s->vis_texture, SDL_PIXELFORMAT_ARGB8888, s->width, s->height, SDL_BLENDMODE_NONE, 1) < 0)
return;
if (s->xpos >= s->width)
s->xpos = 0;
nb_display_channels= FFMIN(nb_display_channels, 2);
if (rdft_bits != s->rdft_bits) {
av_rdft_end(s->rdft);
@@ -1200,8 +1202,6 @@ static void video_audio_display(VideoState *s)
}
if (!s->paused)
s->xpos++;
if (s->xpos >= s->width)
s->xpos= s->xleft;
}
}
+2 -2
View File
@@ -131,8 +131,8 @@ static int zero12v_decode_frame(AVCodecContext *avctx, void *data,
u = x/2 + (uint16_t *)(pic->data[1] + line * pic->linesize[1]);
v = x/2 + (uint16_t *)(pic->data[2] + line * pic->linesize[2]);
memcpy(y, y_temp, sizeof(*y) * (width - x));
memcpy(u, u_temp, sizeof(*u) * (width - x + 1) / 2);
memcpy(v, v_temp, sizeof(*v) * (width - x + 1) / 2);
memcpy(u, u_temp, sizeof(*u) * ((width - x + 1) / 2));
memcpy(v, v_temp, sizeof(*v) * ((width - x + 1) / 2));
}
line_end += stride;
+4 -2
View File
@@ -498,8 +498,8 @@ static int decode_i_block(FourXContext *f, int16_t *block)
{
int code, i, j, level, val;
if (get_bits_left(&f->gb) < 2){
av_log(f->avctx, AV_LOG_ERROR, "%d bits left before decode_i_block()\n", get_bits_left(&f->gb));
if (get_bits_left(&f->pre_gb) < 2) {
av_log(f->avctx, AV_LOG_ERROR, "%d bits left before decode_i_block()\n", get_bits_left(&f->pre_gb));
return AVERROR_INVALIDDATA;
}
@@ -885,6 +885,8 @@ static int decode_frame(AVCodecContext *avctx, void *data,
}
if (i >= CFRAME_BUFFER_COUNT) {
if (free_index < 0)
return AVERROR_INVALIDDATA;
i = free_index;
f->cfrm[i].id = id;
}
+3
View File
@@ -70,6 +70,9 @@ static int decode_frame(AVCodecContext *avctx, void *data,
unsigned char *planemap = c->planemap;
int ret;
if (buf_size < planes * height *2)
return AVERROR_INVALIDDATA;
if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
return ret;
+1 -1
View File
@@ -1174,7 +1174,7 @@ SKIPHEADERS-$(CONFIG_QSV) += qsv.h qsv_internal.h
SKIPHEADERS-$(CONFIG_QSVDEC) += qsvdec.h
SKIPHEADERS-$(CONFIG_QSVENC) += qsvenc.h
SKIPHEADERS-$(CONFIG_XVMC) += xvmc.h
SKIPHEADERS-$(CONFIG_VAAPI) += vaapi_decode.h vaapi_encode.h
SKIPHEADERS-$(CONFIG_VAAPI) += vaapi_decode.h vaapi_hevc.h vaapi_encode.h
SKIPHEADERS-$(CONFIG_VDPAU) += vdpau.h vdpau_internal.h
SKIPHEADERS-$(CONFIG_VIDEOTOOLBOX) += videotoolbox.h vt_internal.h
SKIPHEADERS-$(CONFIG_V4L2_M2M) += v4l2_buffers.h v4l2_context.h v4l2_m2m.h
+2
View File
@@ -407,6 +407,7 @@ AVCodec ff_a64multi_encoder = {
.close = a64multi_close_encoder,
.pix_fmts = (const enum AVPixelFormat[]) {AV_PIX_FMT_GRAY8, AV_PIX_FMT_NONE},
.capabilities = AV_CODEC_CAP_DELAY,
.caps_internal = FF_CODEC_CAP_INIT_CLEANUP,
};
#endif
#if CONFIG_A64MULTI5_ENCODER
@@ -421,5 +422,6 @@ AVCodec ff_a64multi5_encoder = {
.close = a64multi_close_encoder,
.pix_fmts = (const enum AVPixelFormat[]) {AV_PIX_FMT_GRAY8, AV_PIX_FMT_NONE},
.capabilities = AV_CODEC_CAP_DELAY,
.caps_internal = FF_CODEC_CAP_INIT_CLEANUP,
};
#endif
+4 -4
View File
@@ -843,25 +843,25 @@ static void search_for_ms(AACEncContext *s, ChannelElement *cpe)
sce0->ics.swb_sizes[g],
sce0->sf_idx[w*16+g],
sce0->band_type[w*16+g],
lambda / band0->threshold, INFINITY, &b1, NULL, 0);
lambda / (band0->threshold + FLT_MIN), INFINITY, &b1, NULL, 0);
dist1 += quantize_band_cost(s, &sce1->coeffs[start + (w+w2)*128],
R34,
sce1->ics.swb_sizes[g],
sce1->sf_idx[w*16+g],
sce1->band_type[w*16+g],
lambda / band1->threshold, INFINITY, &b2, NULL, 0);
lambda / (band1->threshold + FLT_MIN), INFINITY, &b2, NULL, 0);
dist2 += quantize_band_cost(s, M,
M34,
sce0->ics.swb_sizes[g],
mididx,
midcb,
lambda / minthr, INFINITY, &b3, NULL, 0);
lambda / (minthr + FLT_MIN), INFINITY, &b3, NULL, 0);
dist2 += quantize_band_cost(s, S,
S34,
sce1->ics.swb_sizes[g],
sididx,
sidcb,
mslambda / (minthr * bmax), INFINITY, &b4, NULL, 0);
mslambda / (minthr * bmax + FLT_MIN), INFINITY, &b4, NULL, 0);
B0 += b1+b2;
B1 += b3+b4;
dist1 -= b1+b2;
+7 -2
View File
@@ -974,14 +974,18 @@ static int decode_audio_specific_config_gb(AACContext *ac,
{
int i, ret;
GetBitContext gbc = *gb;
MPEG4AudioConfig m4ac_bak = *m4ac;
if ((i = ff_mpeg4audio_get_config_gb(m4ac, &gbc, sync_extension, avctx)) < 0)
if ((i = ff_mpeg4audio_get_config_gb(m4ac, &gbc, sync_extension, avctx)) < 0) {
*m4ac = m4ac_bak;
return AVERROR_INVALIDDATA;
}
if (m4ac->sampling_index > 12) {
av_log(avctx, AV_LOG_ERROR,
"invalid sampling rate index %d\n",
m4ac->sampling_index);
*m4ac = m4ac_bak;
return AVERROR_INVALIDDATA;
}
if (m4ac->object_type == AOT_ER_AAC_LD &&
@@ -989,6 +993,7 @@ static int decode_audio_specific_config_gb(AACContext *ac,
av_log(avctx, AV_LOG_ERROR,
"invalid low delay sampling rate index %d\n",
m4ac->sampling_index);
*m4ac = m4ac_bak;
return AVERROR_INVALIDDATA;
}
@@ -2807,7 +2812,7 @@ static void imdct_and_windowing_ld(AACContext *ac, SingleChannelElement *sce)
static void imdct_and_windowing_eld(AACContext *ac, SingleChannelElement *sce)
{
INTFLOAT *in = sce->coeffs;
UINTFLOAT *in = sce->coeffs;
INTFLOAT *out = sce->ret;
INTFLOAT *saved = sce->saved;
INTFLOAT *buf = ac->buf_mdct;
+3 -2
View File
@@ -28,6 +28,7 @@
* TODOs:
* add sane pulse detection
***********************************/
#include <float.h>
#include "libavutil/libm.h"
#include "libavutil/thread.h"
@@ -856,7 +857,7 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
/* Not so fast though */
ratio = sqrtf(ratio);
}
s->lambda = FFMIN(s->lambda * ratio, 65536.f);
s->lambda = av_clipf(s->lambda * ratio, FLT_EPSILON, 65536.f);
/* Keep iterating if we must reduce and lambda is in the sky */
if (ratio > 0.9f && ratio < 1.1f) {
@@ -901,7 +902,7 @@ static av_cold int aac_encode_end(AVCodecContext *avctx)
{
AACEncContext *s = avctx->priv_data;
av_log(avctx, AV_LOG_INFO, "Qavg: %.3f\n", s->lambda_sum / s->lambda_count);
av_log(avctx, AV_LOG_INFO, "Qavg: %.3f\n", s->lambda_count ? s->lambda_sum / s->lambda_count : NAN);
ff_mdct_end(&s->mdct1024);
ff_mdct_end(&s->mdct128);
+27 -13
View File
@@ -173,6 +173,7 @@ void ff_aac_search_for_tns(AACEncContext *s, SingleChannelElement *sce)
sce->ics.window_sequence[0] == LONG_START_SEQUENCE ? 0 : 2;
const int sfb_len = sfb_end - sfb_start;
const int coef_len = sce->ics.swb_offset[sfb_end] - sce->ics.swb_offset[sfb_start];
const int n_filt = is8 ? 1 : order != TNS_MAX_ORDER ? 2 : 3;
if (coef_len <= 0 || sfb_len <= 0) {
sce->tns.present = 0;
@@ -180,16 +181,30 @@ void ff_aac_search_for_tns(AACEncContext *s, SingleChannelElement *sce)
}
for (w = 0; w < sce->ics.num_windows; w++) {
float en[2] = {0.0f, 0.0f};
int oc_start = 0, os_start = 0;
float en[4] = {0.0f, 0.0f, 0.0f, 0.0f};
int oc_start = 0;
int coef_start = sce->ics.swb_offset[sfb_start];
for (g = sfb_start; g < sce->ics.num_swb && g <= sfb_end; g++) {
FFPsyBand *band = &s->psy.ch[s->cur_channel].psy_bands[w*16+g];
if (g > sfb_start + (sfb_len/2))
en[1] += band->energy;
else
en[0] += band->energy;
if (n_filt == 2) {
for (g = sfb_start; g < sce->ics.num_swb && g <= sfb_end; g++) {
FFPsyBand *band = &s->psy.ch[s->cur_channel].psy_bands[w*16+g];
if (g > sfb_start + (sfb_len/2))
en[1] += band->energy; /* End */
else
en[0] += band->energy; /* Start */
}
en[2] = en[0];
} else {
for (g = sfb_start; g < sce->ics.num_swb && g <= sfb_end; g++) {
FFPsyBand *band = &s->psy.ch[s->cur_channel].psy_bands[w*16+g];
if (g > sfb_start + (sfb_len/2) + (sfb_len/4))
en[2] += band->energy; /* End */
else if (g > sfb_start + (sfb_len/2) - (sfb_len/4))
en[1] += band->energy; /* Middle */
else
en[0] += band->energy; /* Start */
}
en[3] = en[0];
}
/* LPC */
@@ -199,15 +214,14 @@ void ff_aac_search_for_tns(AACEncContext *s, SingleChannelElement *sce)
if (!order || !isfinite(gain) || gain < TNS_GAIN_THRESHOLD_LOW || gain > TNS_GAIN_THRESHOLD_HIGH)
continue;
tns->n_filt[w] = is8 ? 1 : order != TNS_MAX_ORDER ? 2 : 3;
tns->n_filt[w] = n_filt;
for (g = 0; g < tns->n_filt[w]; g++) {
tns->direction[w][g] = slant != 2 ? slant : en[g] < en[!g];
tns->order[w][g] = g < tns->n_filt[w] ? order/tns->n_filt[w] : order - oc_start;
tns->length[w][g] = g < tns->n_filt[w] ? sfb_len/tns->n_filt[w] : sfb_len - os_start;
tns->direction[w][g] = slant != 2 ? slant : en[g] < en[g + 1];
tns->order[w][g] = order/tns->n_filt[w];
tns->length[w][g] = sfb_len/tns->n_filt[w];
quantize_coefs(&coefs[oc_start], tns->coef_idx[w][g], tns->coef[w][g],
tns->order[w][g], c_bits);
oc_start += tns->order[w][g];
os_start += tns->length[w][g];
}
count++;
}
+4 -1
View File
@@ -308,6 +308,9 @@ static av_cold int psy_3gpp_init(FFPsyContext *ctx) {
const int bandwidth = ctx->cutoff ? ctx->cutoff : AAC_CUTOFF(ctx->avctx);
const float num_bark = calc_bark((float)bandwidth);
if (bandwidth <= 0)
return AVERROR(EINVAL);
ctx->model_priv_data = av_mallocz(sizeof(AacPsyContext));
if (!ctx->model_priv_data)
return AVERROR(ENOMEM);
@@ -794,7 +797,7 @@ static void psy_3gpp_analyze_channel(FFPsyContext *ctx, int channel,
if (pe < 1.15f * desired_pe) {
/* 6.6.1.3.6 "Final threshold modification by linearization" */
norm_fac = 1.0f / norm_fac;
norm_fac = norm_fac ? 1.0f / norm_fac : 0;
for (w = 0; w < wi->num_windows*16; w += 16) {
for (g = 0; g < num_bands; g++) {
AacPsyBand *band = &pch->band[w+g];
+1
View File
@@ -592,6 +592,7 @@ static int sbr_make_f_derived(AACContext *ac, SpectralBandReplication *sbr)
if (sbr->n_q > 5) {
av_log(ac->avctx, AV_LOG_ERROR, "Too many noise floor scale factors: %d\n", sbr->n_q);
sbr->n_q = 1;
return -1;
}
+109 -109
View File
@@ -19,130 +19,130 @@
#include "libavutil/aarch64/asm.S"
function ff_ps_add_squares_neon, export=1
1: ld1 {v0.4S,v1.4S}, [x1], #32
fmul v0.4S, v0.4S, v0.4S
fmul v1.4S, v1.4S, v1.4S
faddp v2.4S, v0.4S, v1.4S
ld1 {v3.4S}, [x0]
fadd v3.4S, v3.4S, v2.4S
st1 {v3.4S}, [x0], #16
subs w2, w2, #4
b.gt 1b
1: ld1 {v0.4s,v1.4s}, [x1], #32
fmul v0.4s, v0.4s, v0.4s
fmul v1.4s, v1.4s, v1.4s
faddp v2.4s, v0.4s, v1.4s
ld1 {v3.4s}, [x0]
fadd v3.4s, v3.4s, v2.4s
st1 {v3.4s}, [x0], #16
subs w2, w2, #4
b.gt 1b
ret
endfunc
function ff_ps_mul_pair_single_neon, export=1
1: ld1 {v0.4S,v1.4S}, [x1], #32
ld1 {v2.4S}, [x2], #16
zip1 v3.4S, v2.4S, v2.4S
zip2 v4.4S, v2.4S, v2.4S
fmul v0.4S, v0.4S, v3.4S
fmul v1.4S, v1.4S, v4.4S
st1 {v0.4S,v1.4S}, [x0], #32
subs w3, w3, #4
b.gt 1b
1: ld1 {v0.4s,v1.4s}, [x1], #32
ld1 {v2.4s}, [x2], #16
zip1 v3.4s, v2.4s, v2.4s
zip2 v4.4s, v2.4s, v2.4s
fmul v0.4s, v0.4s, v3.4s
fmul v1.4s, v1.4s, v4.4s
st1 {v0.4s,v1.4s}, [x0], #32
subs w3, w3, #4
b.gt 1b
ret
endfunc
function ff_ps_stereo_interpolate_neon, export=1
ld1 {v0.4S}, [x2]
ld1 {v1.4S}, [x3]
zip1 v4.4S, v0.4S, v0.4S
zip2 v5.4S, v0.4S, v0.4S
zip1 v6.4S, v1.4S, v1.4S
zip2 v7.4S, v1.4S, v1.4S
1: ld1 {v2.2S}, [x0]
ld1 {v3.2S}, [x1]
fadd v4.4S, v4.4S, v6.4S
fadd v5.4S, v5.4S, v7.4S
mov v2.D[1], v2.D[0]
mov v3.D[1], v3.D[0]
fmul v2.4S, v2.4S, v4.4S
fmla v2.4S, v3.4S, v5.4S
st1 {v2.D}[0], [x0], #8
st1 {v2.D}[1], [x1], #8
subs w4, w4, #1
b.gt 1b
ld1 {v0.4s}, [x2]
ld1 {v1.4s}, [x3]
zip1 v4.4s, v0.4s, v0.4s
zip2 v5.4s, v0.4s, v0.4s
zip1 v6.4s, v1.4s, v1.4s
zip2 v7.4s, v1.4s, v1.4s
1: ld1 {v2.2s}, [x0]
ld1 {v3.2s}, [x1]
fadd v4.4s, v4.4s, v6.4s
fadd v5.4s, v5.4s, v7.4s
mov v2.d[1], v2.d[0]
mov v3.d[1], v3.d[0]
fmul v2.4s, v2.4s, v4.4s
fmla v2.4s, v3.4s, v5.4s
st1 {v2.d}[0], [x0], #8
st1 {v2.d}[1], [x1], #8
subs w4, w4, #1
b.gt 1b
ret
endfunc
function ff_ps_stereo_interpolate_ipdopd_neon, export=1
ld1 {v0.4S,v1.4S}, [x2]
ld1 {v6.4S,v7.4S}, [x3]
fneg v2.4S, v1.4S
fneg v3.4S, v7.4S
zip1 v16.4S, v0.4S, v0.4S
zip2 v17.4S, v0.4S, v0.4S
zip1 v18.4S, v2.4S, v1.4S
zip2 v19.4S, v2.4S, v1.4S
zip1 v20.4S, v6.4S, v6.4S
zip2 v21.4S, v6.4S, v6.4S
zip1 v22.4S, v3.4S, v7.4S
zip2 v23.4S, v3.4S, v7.4S
1: ld1 {v2.2S}, [x0]
ld1 {v3.2S}, [x1]
fadd v16.4S, v16.4S, v20.4S
fadd v17.4S, v17.4S, v21.4S
mov v2.D[1], v2.D[0]
mov v3.D[1], v3.D[0]
fmul v4.4S, v2.4S, v16.4S
fmla v4.4S, v3.4S, v17.4S
fadd v18.4S, v18.4S, v22.4S
fadd v19.4S, v19.4S, v23.4S
ext v2.16B, v2.16B, v2.16B, #4
ext v3.16B, v3.16B, v3.16B, #4
fmla v4.4S, v2.4S, v18.4S
fmla v4.4S, v3.4S, v19.4S
st1 {v4.D}[0], [x0], #8
st1 {v4.D}[1], [x1], #8
subs w4, w4, #1
b.gt 1b
ld1 {v0.4s,v1.4s}, [x2]
ld1 {v6.4s,v7.4s}, [x3]
fneg v2.4s, v1.4s
fneg v3.4s, v7.4s
zip1 v16.4s, v0.4s, v0.4s
zip2 v17.4s, v0.4s, v0.4s
zip1 v18.4s, v2.4s, v1.4s
zip2 v19.4s, v2.4s, v1.4s
zip1 v20.4s, v6.4s, v6.4s
zip2 v21.4s, v6.4s, v6.4s
zip1 v22.4s, v3.4s, v7.4s
zip2 v23.4s, v3.4s, v7.4s
1: ld1 {v2.2s}, [x0]
ld1 {v3.2s}, [x1]
fadd v16.4s, v16.4s, v20.4s
fadd v17.4s, v17.4s, v21.4s
mov v2.d[1], v2.d[0]
mov v3.d[1], v3.d[0]
fmul v4.4s, v2.4s, v16.4s
fmla v4.4s, v3.4s, v17.4s
fadd v18.4s, v18.4s, v22.4s
fadd v19.4s, v19.4s, v23.4s
ext v2.16b, v2.16b, v2.16b, #4
ext v3.16b, v3.16b, v3.16b, #4
fmla v4.4s, v2.4s, v18.4s
fmla v4.4s, v3.4s, v19.4s
st1 {v4.d}[0], [x0], #8
st1 {v4.d}[1], [x1], #8
subs w4, w4, #1
b.gt 1b
ret
endfunc
function ff_ps_hybrid_analysis_neon, export=1
lsl x3, x3, #3
ld2 {v0.4S,v1.4S}, [x1], #32
ld2 {v2.2S,v3.2S}, [x1], #16
ld1 {v24.2S}, [x1], #8
ld2 {v4.2S,v5.2S}, [x1], #16
ld2 {v6.4S,v7.4S}, [x1]
rev64 v6.4S, v6.4S
rev64 v7.4S, v7.4S
ext v6.16B, v6.16B, v6.16B, #8
ext v7.16B, v7.16B, v7.16B, #8
rev64 v4.2S, v4.2S
rev64 v5.2S, v5.2S
mov v2.D[1], v3.D[0]
mov v4.D[1], v5.D[0]
mov v5.D[1], v2.D[0]
mov v3.D[1], v4.D[0]
fadd v16.4S, v0.4S, v6.4S
fadd v17.4S, v1.4S, v7.4S
fsub v18.4S, v1.4S, v7.4S
fsub v19.4S, v0.4S, v6.4S
fadd v22.4S, v2.4S, v4.4S
fsub v23.4S, v5.4S, v3.4S
trn1 v20.2D, v22.2D, v23.2D // {re4+re8, re5+re7, im8-im4, im7-im5}
trn2 v21.2D, v22.2D, v23.2D // {im4+im8, im5+im7, re4-re8, re5-re7}
1: ld2 {v2.4S,v3.4S}, [x2], #32
ld2 {v4.2S,v5.2S}, [x2], #16
ld1 {v6.2S}, [x2], #8
add x2, x2, #8
mov v4.D[1], v5.D[0]
mov v6.S[1], v6.S[0]
fmul v6.2S, v6.2S, v24.2S
fmul v0.4S, v2.4S, v16.4S
fmul v1.4S, v2.4S, v17.4S
fmls v0.4S, v3.4S, v18.4S
fmla v1.4S, v3.4S, v19.4S
fmla v0.4S, v4.4S, v20.4S
fmla v1.4S, v4.4S, v21.4S
faddp v0.4S, v0.4S, v1.4S
faddp v0.4S, v0.4S, v0.4S
fadd v0.2S, v0.2S, v6.2S
st1 {v0.2S}, [x0], x3
subs w4, w4, #1
b.gt 1b
lsl x3, x3, #3
ld2 {v0.4s,v1.4s}, [x1], #32
ld2 {v2.2s,v3.2s}, [x1], #16
ld1 {v24.2s}, [x1], #8
ld2 {v4.2s,v5.2s}, [x1], #16
ld2 {v6.4s,v7.4s}, [x1]
rev64 v6.4s, v6.4s
rev64 v7.4s, v7.4s
ext v6.16b, v6.16b, v6.16b, #8
ext v7.16b, v7.16b, v7.16b, #8
rev64 v4.2s, v4.2s
rev64 v5.2s, v5.2s
mov v2.d[1], v3.d[0]
mov v4.d[1], v5.d[0]
mov v5.d[1], v2.d[0]
mov v3.d[1], v4.d[0]
fadd v16.4s, v0.4s, v6.4s
fadd v17.4s, v1.4s, v7.4s
fsub v18.4s, v1.4s, v7.4s
fsub v19.4s, v0.4s, v6.4s
fadd v22.4s, v2.4s, v4.4s
fsub v23.4s, v5.4s, v3.4s
trn1 v20.2d, v22.2d, v23.2d // {re4+re8, re5+re7, im8-im4, im7-im5}
trn2 v21.2d, v22.2d, v23.2d // {im4+im8, im5+im7, re4-re8, re5-re7}
1: ld2 {v2.4s,v3.4s}, [x2], #32
ld2 {v4.2s,v5.2s}, [x2], #16
ld1 {v6.2s}, [x2], #8
add x2, x2, #8
mov v4.d[1], v5.d[0]
mov v6.s[1], v6.s[0]
fmul v6.2s, v6.2s, v24.2s
fmul v0.4s, v2.4s, v16.4s
fmul v1.4s, v2.4s, v17.4s
fmls v0.4s, v3.4s, v18.4s
fmla v1.4s, v3.4s, v19.4s
fmla v0.4s, v4.4s, v20.4s
fmla v1.4s, v4.4s, v21.4s
faddp v0.4s, v0.4s, v1.4s
faddp v0.4s, v0.4s, v0.4s
fadd v0.2s, v0.2s, v6.2s
st1 {v0.2s}, [x0], x3
subs w4, w4, #1
b.gt 1b
ret
endfunc
+12 -12
View File
@@ -353,18 +353,18 @@ function fft\n\()_neon, align=6
endfunc
.endm
def_fft 32, 16, 8
def_fft 64, 32, 16
def_fft 128, 64, 32
def_fft 256, 128, 64
def_fft 512, 256, 128
def_fft 1024, 512, 256
def_fft 2048, 1024, 512
def_fft 4096, 2048, 1024
def_fft 8192, 4096, 2048
def_fft 16384, 8192, 4096
def_fft 32768, 16384, 8192
def_fft 65536, 32768, 16384
def_fft 32, 16, 8
def_fft 64, 32, 16
def_fft 128, 64, 32
def_fft 256, 128, 64
def_fft 512, 256, 128
def_fft 1024, 512, 256
def_fft 2048, 1024, 512
def_fft 4096, 2048, 1024
def_fft 8192, 4096, 2048
def_fft 16384, 8192, 4096
def_fft 32768, 16384, 8192
def_fft 65536, 32768, 16384
function ff_fft_calc_neon, export=1
prfm pldl1keep, [x1]
+205 -205
View File
@@ -36,11 +36,11 @@ function ff_\type\()_\codec\()_chroma_mc8_neon, export=1
lsl w9, w9, #3
lsl w10, w10, #1
add w9, w9, w10
add x6, x6, w9, UXTW
ld1r {v22.8H}, [x6]
add x6, x6, w9, uxtw
ld1r {v22.8h}, [x6]
.endif
.ifc \codec,vc1
movi v22.8H, #28
movi v22.8h, #28
.endif
mul w7, w4, w5
lsl w14, w5, #3
@@ -53,139 +53,139 @@ function ff_\type\()_\codec\()_chroma_mc8_neon, export=1
add w4, w4, #64
b.eq 2f
dup v0.8B, w4
dup v1.8B, w12
ld1 {v4.8B, v5.8B}, [x1], x2
dup v2.8B, w6
dup v3.8B, w7
ext v5.8B, v4.8B, v5.8B, #1
1: ld1 {v6.8B, v7.8B}, [x1], x2
umull v16.8H, v4.8B, v0.8B
umlal v16.8H, v5.8B, v1.8B
ext v7.8B, v6.8B, v7.8B, #1
ld1 {v4.8B, v5.8B}, [x1], x2
umlal v16.8H, v6.8B, v2.8B
dup v0.8b, w4
dup v1.8b, w12
ld1 {v4.8b, v5.8b}, [x1], x2
dup v2.8b, w6
dup v3.8b, w7
ext v5.8b, v4.8b, v5.8b, #1
1: ld1 {v6.8b, v7.8b}, [x1], x2
umull v16.8h, v4.8b, v0.8b
umlal v16.8h, v5.8b, v1.8b
ext v7.8b, v6.8b, v7.8b, #1
ld1 {v4.8b, v5.8b}, [x1], x2
umlal v16.8h, v6.8b, v2.8b
prfm pldl1strm, [x1]
ext v5.8B, v4.8B, v5.8B, #1
umlal v16.8H, v7.8B, v3.8B
umull v17.8H, v6.8B, v0.8B
ext v5.8b, v4.8b, v5.8b, #1
umlal v16.8h, v7.8b, v3.8b
umull v17.8h, v6.8b, v0.8b
subs w3, w3, #2
umlal v17.8H, v7.8B, v1.8B
umlal v17.8H, v4.8B, v2.8B
umlal v17.8H, v5.8B, v3.8B
umlal v17.8h, v7.8b, v1.8b
umlal v17.8h, v4.8b, v2.8b
umlal v17.8h, v5.8b, v3.8b
prfm pldl1strm, [x1, x2]
.ifc \codec,h264
rshrn v16.8B, v16.8H, #6
rshrn v17.8B, v17.8H, #6
rshrn v16.8b, v16.8h, #6
rshrn v17.8b, v17.8h, #6
.else
add v16.8H, v16.8H, v22.8H
add v17.8H, v17.8H, v22.8H
shrn v16.8B, v16.8H, #6
shrn v17.8B, v17.8H, #6
add v16.8h, v16.8h, v22.8h
add v17.8h, v17.8h, v22.8h
shrn v16.8b, v16.8h, #6
shrn v17.8b, v17.8h, #6
.endif
.ifc \type,avg
ld1 {v20.8B}, [x8], x2
ld1 {v21.8B}, [x8], x2
urhadd v16.8B, v16.8B, v20.8B
urhadd v17.8B, v17.8B, v21.8B
ld1 {v20.8b}, [x8], x2
ld1 {v21.8b}, [x8], x2
urhadd v16.8b, v16.8b, v20.8b
urhadd v17.8b, v17.8b, v21.8b
.endif
st1 {v16.8B}, [x0], x2
st1 {v17.8B}, [x0], x2
st1 {v16.8b}, [x0], x2
st1 {v17.8b}, [x0], x2
b.gt 1b
ret
2: adds w12, w12, w6
dup v0.8B, w4
dup v0.8b, w4
b.eq 5f
tst w6, w6
dup v1.8B, w12
dup v1.8b, w12
b.eq 4f
ld1 {v4.8B}, [x1], x2
3: ld1 {v6.8B}, [x1], x2
umull v16.8H, v4.8B, v0.8B
umlal v16.8H, v6.8B, v1.8B
ld1 {v4.8B}, [x1], x2
umull v17.8H, v6.8B, v0.8B
umlal v17.8H, v4.8B, v1.8B
ld1 {v4.8b}, [x1], x2
3: ld1 {v6.8b}, [x1], x2
umull v16.8h, v4.8b, v0.8b
umlal v16.8h, v6.8b, v1.8b
ld1 {v4.8b}, [x1], x2
umull v17.8h, v6.8b, v0.8b
umlal v17.8h, v4.8b, v1.8b
prfm pldl1strm, [x1]
.ifc \codec,h264
rshrn v16.8B, v16.8H, #6
rshrn v17.8B, v17.8H, #6
rshrn v16.8b, v16.8h, #6
rshrn v17.8b, v17.8h, #6
.else
add v16.8H, v16.8H, v22.8H
add v17.8H, v17.8H, v22.8H
shrn v16.8B, v16.8H, #6
shrn v17.8B, v17.8H, #6
add v16.8h, v16.8h, v22.8h
add v17.8h, v17.8h, v22.8h
shrn v16.8b, v16.8h, #6
shrn v17.8b, v17.8h, #6
.endif
prfm pldl1strm, [x1, x2]
.ifc \type,avg
ld1 {v20.8B}, [x8], x2
ld1 {v21.8B}, [x8], x2
urhadd v16.8B, v16.8B, v20.8B
urhadd v17.8B, v17.8B, v21.8B
ld1 {v20.8b}, [x8], x2
ld1 {v21.8b}, [x8], x2
urhadd v16.8b, v16.8b, v20.8b
urhadd v17.8b, v17.8b, v21.8b
.endif
subs w3, w3, #2
st1 {v16.8B}, [x0], x2
st1 {v17.8B}, [x0], x2
st1 {v16.8b}, [x0], x2
st1 {v17.8b}, [x0], x2
b.gt 3b
ret
4: ld1 {v4.8B, v5.8B}, [x1], x2
ld1 {v6.8B, v7.8B}, [x1], x2
ext v5.8B, v4.8B, v5.8B, #1
ext v7.8B, v6.8B, v7.8B, #1
4: ld1 {v4.8b, v5.8b}, [x1], x2
ld1 {v6.8b, v7.8b}, [x1], x2
ext v5.8b, v4.8b, v5.8b, #1
ext v7.8b, v6.8b, v7.8b, #1
prfm pldl1strm, [x1]
subs w3, w3, #2
umull v16.8H, v4.8B, v0.8B
umlal v16.8H, v5.8B, v1.8B
umull v17.8H, v6.8B, v0.8B
umlal v17.8H, v7.8B, v1.8B
umull v16.8h, v4.8b, v0.8b
umlal v16.8h, v5.8b, v1.8b
umull v17.8h, v6.8b, v0.8b
umlal v17.8h, v7.8b, v1.8b
prfm pldl1strm, [x1, x2]
.ifc \codec,h264
rshrn v16.8B, v16.8H, #6
rshrn v17.8B, v17.8H, #6
rshrn v16.8b, v16.8h, #6
rshrn v17.8b, v17.8h, #6
.else
add v16.8H, v16.8H, v22.8H
add v17.8H, v17.8H, v22.8H
shrn v16.8B, v16.8H, #6
shrn v17.8B, v17.8H, #6
add v16.8h, v16.8h, v22.8h
add v17.8h, v17.8h, v22.8h
shrn v16.8b, v16.8h, #6
shrn v17.8b, v17.8h, #6
.endif
.ifc \type,avg
ld1 {v20.8B}, [x8], x2
ld1 {v21.8B}, [x8], x2
urhadd v16.8B, v16.8B, v20.8B
urhadd v17.8B, v17.8B, v21.8B
ld1 {v20.8b}, [x8], x2
ld1 {v21.8b}, [x8], x2
urhadd v16.8b, v16.8b, v20.8b
urhadd v17.8b, v17.8b, v21.8b
.endif
st1 {v16.8B}, [x0], x2
st1 {v17.8B}, [x0], x2
st1 {v16.8b}, [x0], x2
st1 {v17.8b}, [x0], x2
b.gt 4b
ret
5: ld1 {v4.8B}, [x1], x2
ld1 {v5.8B}, [x1], x2
5: ld1 {v4.8b}, [x1], x2
ld1 {v5.8b}, [x1], x2
prfm pldl1strm, [x1]
subs w3, w3, #2
umull v16.8H, v4.8B, v0.8B
umull v17.8H, v5.8B, v0.8B
umull v16.8h, v4.8b, v0.8b
umull v17.8h, v5.8b, v0.8b
prfm pldl1strm, [x1, x2]
.ifc \codec,h264
rshrn v16.8B, v16.8H, #6
rshrn v17.8B, v17.8H, #6
rshrn v16.8b, v16.8h, #6
rshrn v17.8b, v17.8h, #6
.else
add v16.8H, v16.8H, v22.8H
add v17.8H, v17.8H, v22.8H
shrn v16.8B, v16.8H, #6
shrn v17.8B, v17.8H, #6
add v16.8h, v16.8h, v22.8h
add v17.8h, v17.8h, v22.8h
shrn v16.8b, v16.8h, #6
shrn v17.8b, v17.8h, #6
.endif
.ifc \type,avg
ld1 {v20.8B}, [x8], x2
ld1 {v21.8B}, [x8], x2
urhadd v16.8B, v16.8B, v20.8B
urhadd v17.8B, v17.8B, v21.8B
ld1 {v20.8b}, [x8], x2
ld1 {v21.8b}, [x8], x2
urhadd v16.8b, v16.8b, v20.8b
urhadd v17.8b, v17.8b, v21.8b
.endif
st1 {v16.8B}, [x0], x2
st1 {v17.8B}, [x0], x2
st1 {v16.8b}, [x0], x2
st1 {v17.8b}, [x0], x2
b.gt 5b
ret
endfunc
@@ -206,11 +206,11 @@ function ff_\type\()_\codec\()_chroma_mc4_neon, export=1
lsl w9, w9, #3
lsl w10, w10, #1
add w9, w9, w10
add x6, x6, w9, UXTW
ld1r {v22.8H}, [x6]
add x6, x6, w9, uxtw
ld1r {v22.8h}, [x6]
.endif
.ifc \codec,vc1
movi v22.8H, #28
movi v22.8h, #28
.endif
mul w7, w4, w5
lsl w14, w5, #3
@@ -223,133 +223,133 @@ function ff_\type\()_\codec\()_chroma_mc4_neon, export=1
add w4, w4, #64
b.eq 2f
dup v24.8B, w4
dup v25.8B, w12
ld1 {v4.8B}, [x1], x2
dup v26.8B, w6
dup v27.8B, w7
ext v5.8B, v4.8B, v5.8B, #1
trn1 v0.2S, v24.2S, v25.2S
trn1 v2.2S, v26.2S, v27.2S
trn1 v4.2S, v4.2S, v5.2S
1: ld1 {v6.8B}, [x1], x2
ext v7.8B, v6.8B, v7.8B, #1
trn1 v6.2S, v6.2S, v7.2S
umull v18.8H, v4.8B, v0.8B
umlal v18.8H, v6.8B, v2.8B
ld1 {v4.8B}, [x1], x2
ext v5.8B, v4.8B, v5.8B, #1
trn1 v4.2S, v4.2S, v5.2S
dup v24.8b, w4
dup v25.8b, w12
ld1 {v4.8b}, [x1], x2
dup v26.8b, w6
dup v27.8b, w7
ext v5.8b, v4.8b, v5.8b, #1
trn1 v0.2s, v24.2s, v25.2s
trn1 v2.2s, v26.2s, v27.2s
trn1 v4.2s, v4.2s, v5.2s
1: ld1 {v6.8b}, [x1], x2
ext v7.8b, v6.8b, v7.8b, #1
trn1 v6.2s, v6.2s, v7.2s
umull v18.8h, v4.8b, v0.8b
umlal v18.8h, v6.8b, v2.8b
ld1 {v4.8b}, [x1], x2
ext v5.8b, v4.8b, v5.8b, #1
trn1 v4.2s, v4.2s, v5.2s
prfm pldl1strm, [x1]
umull v19.8H, v6.8B, v0.8B
umlal v19.8H, v4.8B, v2.8B
trn1 v30.2D, v18.2D, v19.2D
trn2 v31.2D, v18.2D, v19.2D
add v18.8H, v30.8H, v31.8H
umull v19.8h, v6.8b, v0.8b
umlal v19.8h, v4.8b, v2.8b
trn1 v30.2d, v18.2d, v19.2d
trn2 v31.2d, v18.2d, v19.2d
add v18.8h, v30.8h, v31.8h
.ifc \codec,h264
rshrn v16.8B, v18.8H, #6
rshrn v16.8b, v18.8h, #6
.else
add v18.8H, v18.8H, v22.8H
shrn v16.8B, v18.8H, #6
add v18.8h, v18.8h, v22.8h
shrn v16.8b, v18.8h, #6
.endif
subs w3, w3, #2
prfm pldl1strm, [x1, x2]
.ifc \type,avg
ld1 {v20.S}[0], [x8], x2
ld1 {v20.S}[1], [x8], x2
urhadd v16.8B, v16.8B, v20.8B
ld1 {v20.s}[0], [x8], x2
ld1 {v20.s}[1], [x8], x2
urhadd v16.8b, v16.8b, v20.8b
.endif
st1 {v16.S}[0], [x0], x2
st1 {v16.S}[1], [x0], x2
st1 {v16.s}[0], [x0], x2
st1 {v16.s}[1], [x0], x2
b.gt 1b
ret
2: adds w12, w12, w6
dup v30.8B, w4
dup v30.8b, w4
b.eq 5f
tst w6, w6
dup v31.8B, w12
trn1 v0.2S, v30.2S, v31.2S
trn2 v1.2S, v30.2S, v31.2S
dup v31.8b, w12
trn1 v0.2s, v30.2s, v31.2s
trn2 v1.2s, v30.2s, v31.2s
b.eq 4f
ext v1.8B, v0.8B, v1.8B, #4
ld1 {v4.S}[0], [x1], x2
3: ld1 {v4.S}[1], [x1], x2
umull v18.8H, v4.8B, v0.8B
ld1 {v4.S}[0], [x1], x2
umull v19.8H, v4.8B, v1.8B
trn1 v30.2D, v18.2D, v19.2D
trn2 v31.2D, v18.2D, v19.2D
add v18.8H, v30.8H, v31.8H
ext v1.8b, v0.8b, v1.8b, #4
ld1 {v4.s}[0], [x1], x2
3: ld1 {v4.s}[1], [x1], x2
umull v18.8h, v4.8b, v0.8b
ld1 {v4.s}[0], [x1], x2
umull v19.8h, v4.8b, v1.8b
trn1 v30.2d, v18.2d, v19.2d
trn2 v31.2d, v18.2d, v19.2d
add v18.8h, v30.8h, v31.8h
prfm pldl1strm, [x1]
.ifc \codec,h264
rshrn v16.8B, v18.8H, #6
rshrn v16.8b, v18.8h, #6
.else
add v18.8H, v18.8H, v22.8H
shrn v16.8B, v18.8H, #6
add v18.8h, v18.8h, v22.8h
shrn v16.8b, v18.8h, #6
.endif
.ifc \type,avg
ld1 {v20.S}[0], [x8], x2
ld1 {v20.S}[1], [x8], x2
urhadd v16.8B, v16.8B, v20.8B
ld1 {v20.s}[0], [x8], x2
ld1 {v20.s}[1], [x8], x2
urhadd v16.8b, v16.8b, v20.8b
.endif
subs w3, w3, #2
prfm pldl1strm, [x1, x2]
st1 {v16.S}[0], [x0], x2
st1 {v16.S}[1], [x0], x2
st1 {v16.s}[0], [x0], x2
st1 {v16.s}[1], [x0], x2
b.gt 3b
ret
4: ld1 {v4.8B}, [x1], x2
ld1 {v6.8B}, [x1], x2
ext v5.8B, v4.8B, v5.8B, #1
ext v7.8B, v6.8B, v7.8B, #1
trn1 v4.2S, v4.2S, v5.2S
trn1 v6.2S, v6.2S, v7.2S
umull v18.8H, v4.8B, v0.8B
umull v19.8H, v6.8B, v0.8B
4: ld1 {v4.8b}, [x1], x2
ld1 {v6.8b}, [x1], x2
ext v5.8b, v4.8b, v5.8b, #1
ext v7.8b, v6.8b, v7.8b, #1
trn1 v4.2s, v4.2s, v5.2s
trn1 v6.2s, v6.2s, v7.2s
umull v18.8h, v4.8b, v0.8b
umull v19.8h, v6.8b, v0.8b
subs w3, w3, #2
trn1 v30.2D, v18.2D, v19.2D
trn2 v31.2D, v18.2D, v19.2D
add v18.8H, v30.8H, v31.8H
trn1 v30.2d, v18.2d, v19.2d
trn2 v31.2d, v18.2d, v19.2d
add v18.8h, v30.8h, v31.8h
prfm pldl1strm, [x1]
.ifc \codec,h264
rshrn v16.8B, v18.8H, #6
rshrn v16.8b, v18.8h, #6
.else
add v18.8H, v18.8H, v22.8H
shrn v16.8B, v18.8H, #6
add v18.8h, v18.8h, v22.8h
shrn v16.8b, v18.8h, #6
.endif
.ifc \type,avg
ld1 {v20.S}[0], [x8], x2
ld1 {v20.S}[1], [x8], x2
urhadd v16.8B, v16.8B, v20.8B
ld1 {v20.s}[0], [x8], x2
ld1 {v20.s}[1], [x8], x2
urhadd v16.8b, v16.8b, v20.8b
.endif
prfm pldl1strm, [x1]
st1 {v16.S}[0], [x0], x2
st1 {v16.S}[1], [x0], x2
st1 {v16.s}[0], [x0], x2
st1 {v16.s}[1], [x0], x2
b.gt 4b
ret
5: ld1 {v4.S}[0], [x1], x2
ld1 {v4.S}[1], [x1], x2
umull v18.8H, v4.8B, v30.8B
5: ld1 {v4.s}[0], [x1], x2
ld1 {v4.s}[1], [x1], x2
umull v18.8h, v4.8b, v30.8b
subs w3, w3, #2
prfm pldl1strm, [x1]
.ifc \codec,h264
rshrn v16.8B, v18.8H, #6
rshrn v16.8b, v18.8h, #6
.else
add v18.8H, v18.8H, v22.8H
shrn v16.8B, v18.8H, #6
add v18.8h, v18.8h, v22.8h
shrn v16.8b, v18.8h, #6
.endif
.ifc \type,avg
ld1 {v20.S}[0], [x8], x2
ld1 {v20.S}[1], [x8], x2
urhadd v16.8B, v16.8B, v20.8B
ld1 {v20.s}[0], [x8], x2
ld1 {v20.s}[1], [x8], x2
urhadd v16.8b, v16.8b, v20.8b
.endif
prfm pldl1strm, [x1]
st1 {v16.S}[0], [x0], x2
st1 {v16.S}[1], [x0], x2
st1 {v16.s}[0], [x0], x2
st1 {v16.s}[1], [x0], x2
b.gt 5b
ret
endfunc
@@ -370,51 +370,51 @@ function ff_\type\()_h264_chroma_mc2_neon, export=1
sub w4, w7, w13
sub w4, w4, w14
add w4, w4, #64
dup v0.8B, w4
dup v2.8B, w12
dup v1.8B, w6
dup v3.8B, w7
trn1 v0.4H, v0.4H, v2.4H
trn1 v1.4H, v1.4H, v3.4H
dup v0.8b, w4
dup v2.8b, w12
dup v1.8b, w6
dup v3.8b, w7
trn1 v0.4h, v0.4h, v2.4h
trn1 v1.4h, v1.4h, v3.4h
1:
ld1 {v4.S}[0], [x1], x2
ld1 {v4.S}[1], [x1], x2
rev64 v5.2S, v4.2S
ld1 {v5.S}[1], [x1]
ext v6.8B, v4.8B, v5.8B, #1
ext v7.8B, v5.8B, v4.8B, #1
trn1 v4.4H, v4.4H, v6.4H
trn1 v5.4H, v5.4H, v7.4H
umull v16.8H, v4.8B, v0.8B
umlal v16.8H, v5.8B, v1.8B
ld1 {v4.s}[0], [x1], x2
ld1 {v4.s}[1], [x1], x2
rev64 v5.2s, v4.2s
ld1 {v5.s}[1], [x1]
ext v6.8b, v4.8b, v5.8b, #1
ext v7.8b, v5.8b, v4.8b, #1
trn1 v4.4h, v4.4h, v6.4h
trn1 v5.4h, v5.4h, v7.4h
umull v16.8h, v4.8b, v0.8b
umlal v16.8h, v5.8b, v1.8b
.ifc \type,avg
ld1 {v18.H}[0], [x0], x2
ld1 {v18.H}[2], [x0]
ld1 {v18.h}[0], [x0], x2
ld1 {v18.h}[2], [x0]
sub x0, x0, x2
.endif
rev64 v17.4S, v16.4S
add v16.8H, v16.8H, v17.8H
rshrn v16.8B, v16.8H, #6
rev64 v17.4s, v16.4s
add v16.8h, v16.8h, v17.8h
rshrn v16.8b, v16.8h, #6
.ifc \type,avg
urhadd v16.8B, v16.8B, v18.8B
urhadd v16.8b, v16.8b, v18.8b
.endif
st1 {v16.H}[0], [x0], x2
st1 {v16.H}[2], [x0], x2
st1 {v16.h}[0], [x0], x2
st1 {v16.h}[2], [x0], x2
subs w3, w3, #2
b.gt 1b
ret
2:
ld1 {v16.H}[0], [x1], x2
ld1 {v16.H}[1], [x1], x2
ld1 {v16.h}[0], [x1], x2
ld1 {v16.h}[1], [x1], x2
.ifc \type,avg
ld1 {v18.H}[0], [x0], x2
ld1 {v18.H}[1], [x0]
ld1 {v18.h}[0], [x0], x2
ld1 {v18.h}[1], [x0]
sub x0, x0, x2
urhadd v16.8B, v16.8B, v18.8B
urhadd v16.8b, v16.8b, v18.8b
.endif
st1 {v16.H}[0], [x0], x2
st1 {v16.H}[1], [x0], x2
st1 {v16.h}[0], [x0], x2
st1 {v16.h}[1], [x0], x2
subs w3, w3, #2
b.gt 2b
ret
File diff suppressed because it is too large Load Diff
+272 -272
View File
@@ -27,114 +27,114 @@
.macro lowpass_const r
movz \r, #20, lsl #16
movk \r, #5
mov v6.S[0], \r
mov v6.s[0], \r
.endm
//trashes v0-v5
.macro lowpass_8 r0, r1, r2, r3, d0, d1, narrow=1
ext v2.8B, \r0\().8B, \r1\().8B, #2
ext v3.8B, \r0\().8B, \r1\().8B, #3
uaddl v2.8H, v2.8B, v3.8B
ext v4.8B, \r0\().8B, \r1\().8B, #1
ext v5.8B, \r0\().8B, \r1\().8B, #4
uaddl v4.8H, v4.8B, v5.8B
ext v1.8B, \r0\().8B, \r1\().8B, #5
uaddl \d0\().8H, \r0\().8B, v1.8B
ext v0.8B, \r2\().8B, \r3\().8B, #2
mla \d0\().8H, v2.8H, v6.H[1]
ext v1.8B, \r2\().8B, \r3\().8B, #3
uaddl v0.8H, v0.8B, v1.8B
ext v1.8B, \r2\().8B, \r3\().8B, #1
mls \d0\().8H, v4.8H, v6.H[0]
ext v3.8B, \r2\().8B, \r3\().8B, #4
uaddl v1.8H, v1.8B, v3.8B
ext v2.8B, \r2\().8B, \r3\().8B, #5
uaddl \d1\().8H, \r2\().8B, v2.8B
mla \d1\().8H, v0.8H, v6.H[1]
mls \d1\().8H, v1.8H, v6.H[0]
ext v2.8b, \r0\().8b, \r1\().8b, #2
ext v3.8b, \r0\().8b, \r1\().8b, #3
uaddl v2.8h, v2.8b, v3.8b
ext v4.8b, \r0\().8b, \r1\().8b, #1
ext v5.8b, \r0\().8b, \r1\().8b, #4
uaddl v4.8h, v4.8b, v5.8b
ext v1.8b, \r0\().8b, \r1\().8b, #5
uaddl \d0\().8h, \r0\().8b, v1.8b
ext v0.8b, \r2\().8b, \r3\().8b, #2
mla \d0\().8h, v2.8h, v6.h[1]
ext v1.8b, \r2\().8b, \r3\().8b, #3
uaddl v0.8h, v0.8b, v1.8b
ext v1.8b, \r2\().8b, \r3\().8b, #1
mls \d0\().8h, v4.8h, v6.h[0]
ext v3.8b, \r2\().8b, \r3\().8b, #4
uaddl v1.8h, v1.8b, v3.8b
ext v2.8b, \r2\().8b, \r3\().8b, #5
uaddl \d1\().8h, \r2\().8b, v2.8b
mla \d1\().8h, v0.8h, v6.h[1]
mls \d1\().8h, v1.8h, v6.h[0]
.if \narrow
sqrshrun \d0\().8B, \d0\().8H, #5
sqrshrun \d1\().8B, \d1\().8H, #5
sqrshrun \d0\().8b, \d0\().8h, #5
sqrshrun \d1\().8b, \d1\().8h, #5
.endif
.endm
//trashes v0-v5, v7, v30-v31
.macro lowpass_8H r0, r1
ext v0.16B, \r0\().16B, \r0\().16B, #2
ext v1.16B, \r0\().16B, \r0\().16B, #3
uaddl v0.8H, v0.8B, v1.8B
ext v2.16B, \r0\().16B, \r0\().16B, #1
ext v3.16B, \r0\().16B, \r0\().16B, #4
uaddl v2.8H, v2.8B, v3.8B
ext v30.16B, \r0\().16B, \r0\().16B, #5
uaddl \r0\().8H, \r0\().8B, v30.8B
ext v4.16B, \r1\().16B, \r1\().16B, #2
mla \r0\().8H, v0.8H, v6.H[1]
ext v5.16B, \r1\().16B, \r1\().16B, #3
uaddl v4.8H, v4.8B, v5.8B
ext v7.16B, \r1\().16B, \r1\().16B, #1
mls \r0\().8H, v2.8H, v6.H[0]
ext v0.16B, \r1\().16B, \r1\().16B, #4
uaddl v7.8H, v7.8B, v0.8B
ext v31.16B, \r1\().16B, \r1\().16B, #5
uaddl \r1\().8H, \r1\().8B, v31.8B
mla \r1\().8H, v4.8H, v6.H[1]
mls \r1\().8H, v7.8H, v6.H[0]
ext v0.16b, \r0\().16b, \r0\().16b, #2
ext v1.16b, \r0\().16b, \r0\().16b, #3
uaddl v0.8h, v0.8b, v1.8b
ext v2.16b, \r0\().16b, \r0\().16b, #1
ext v3.16b, \r0\().16b, \r0\().16b, #4
uaddl v2.8h, v2.8b, v3.8b
ext v30.16b, \r0\().16b, \r0\().16b, #5
uaddl \r0\().8h, \r0\().8b, v30.8b
ext v4.16b, \r1\().16b, \r1\().16b, #2
mla \r0\().8h, v0.8h, v6.h[1]
ext v5.16b, \r1\().16b, \r1\().16b, #3
uaddl v4.8h, v4.8b, v5.8b
ext v7.16b, \r1\().16b, \r1\().16b, #1
mls \r0\().8h, v2.8h, v6.h[0]
ext v0.16b, \r1\().16b, \r1\().16b, #4
uaddl v7.8h, v7.8b, v0.8b
ext v31.16b, \r1\().16b, \r1\().16b, #5
uaddl \r1\().8h, \r1\().8b, v31.8b
mla \r1\().8h, v4.8h, v6.h[1]
mls \r1\().8h, v7.8h, v6.h[0]
.endm
// trashes v2-v5, v30
.macro lowpass_8_1 r0, r1, d0, narrow=1
ext v2.8B, \r0\().8B, \r1\().8B, #2
ext v3.8B, \r0\().8B, \r1\().8B, #3
uaddl v2.8H, v2.8B, v3.8B
ext v4.8B, \r0\().8B, \r1\().8B, #1
ext v5.8B, \r0\().8B, \r1\().8B, #4
uaddl v4.8H, v4.8B, v5.8B
ext v30.8B, \r0\().8B, \r1\().8B, #5
uaddl \d0\().8H, \r0\().8B, v30.8B
mla \d0\().8H, v2.8H, v6.H[1]
mls \d0\().8H, v4.8H, v6.H[0]
ext v2.8b, \r0\().8b, \r1\().8b, #2
ext v3.8b, \r0\().8b, \r1\().8b, #3
uaddl v2.8h, v2.8b, v3.8b
ext v4.8b, \r0\().8b, \r1\().8b, #1
ext v5.8b, \r0\().8b, \r1\().8b, #4
uaddl v4.8h, v4.8b, v5.8b
ext v30.8b, \r0\().8b, \r1\().8b, #5
uaddl \d0\().8h, \r0\().8b, v30.8b
mla \d0\().8h, v2.8h, v6.h[1]
mls \d0\().8h, v4.8h, v6.h[0]
.if \narrow
sqrshrun \d0\().8B, \d0\().8H, #5
sqrshrun \d0\().8b, \d0\().8h, #5
.endif
.endm
// trashed v0-v7
.macro lowpass_8.16 r0, r1, r2
ext v1.16B, \r0\().16B, \r1\().16B, #4
ext v0.16B, \r0\().16B, \r1\().16B, #6
saddl v5.4S, v1.4H, v0.4H
ext v2.16B, \r0\().16B, \r1\().16B, #2
saddl2 v1.4S, v1.8H, v0.8H
ext v3.16B, \r0\().16B, \r1\().16B, #8
saddl v6.4S, v2.4H, v3.4H
ext \r1\().16B, \r0\().16B, \r1\().16B, #10
saddl2 v2.4S, v2.8H, v3.8H
saddl v0.4S, \r0\().4H, \r1\().4H
saddl2 v4.4S, \r0\().8H, \r1\().8H
ext v1.16b, \r0\().16b, \r1\().16b, #4
ext v0.16b, \r0\().16b, \r1\().16b, #6
saddl v5.4s, v1.4h, v0.4h
ext v2.16b, \r0\().16b, \r1\().16b, #2
saddl2 v1.4s, v1.8h, v0.8h
ext v3.16b, \r0\().16b, \r1\().16b, #8
saddl v6.4s, v2.4h, v3.4h
ext \r1\().16b, \r0\().16b, \r1\().16b, #10
saddl2 v2.4s, v2.8h, v3.8h
saddl v0.4s, \r0\().4h, \r1\().4h
saddl2 v4.4s, \r0\().8h, \r1\().8h
shl v3.4S, v5.4S, #4
shl v5.4S, v5.4S, #2
shl v7.4S, v6.4S, #2
add v5.4S, v5.4S, v3.4S
add v6.4S, v6.4S, v7.4S
shl v3.4s, v5.4s, #4
shl v5.4s, v5.4s, #2
shl v7.4s, v6.4s, #2
add v5.4s, v5.4s, v3.4s
add v6.4s, v6.4s, v7.4s
shl v3.4S, v1.4S, #4
shl v1.4S, v1.4S, #2
shl v7.4S, v2.4S, #2
add v1.4S, v1.4S, v3.4S
add v2.4S, v2.4S, v7.4S
shl v3.4s, v1.4s, #4
shl v1.4s, v1.4s, #2
shl v7.4s, v2.4s, #2
add v1.4s, v1.4s, v3.4s
add v2.4s, v2.4s, v7.4s
add v5.4S, v5.4S, v0.4S
sub v5.4S, v5.4S, v6.4S
add v5.4s, v5.4s, v0.4s
sub v5.4s, v5.4s, v6.4s
add v1.4S, v1.4S, v4.4S
sub v1.4S, v1.4S, v2.4S
add v1.4s, v1.4s, v4.4s
sub v1.4s, v1.4s, v2.4s
rshrn v5.4H, v5.4S, #10
rshrn2 v5.8H, v1.4S, #10
rshrn v5.4h, v5.4s, #10
rshrn2 v5.8h, v1.4s, #10
sqxtun \r2\().8B, v5.8H
sqxtun \r2\().8b, v5.8h
.endm
function put_h264_qpel16_h_lowpass_neon_packed
@@ -163,19 +163,19 @@ function \type\()_h264_qpel16_h_lowpass_neon
endfunc
function \type\()_h264_qpel8_h_lowpass_neon
1: ld1 {v28.8B, v29.8B}, [x1], x2
ld1 {v16.8B, v17.8B}, [x1], x2
1: ld1 {v28.8b, v29.8b}, [x1], x2
ld1 {v16.8b, v17.8b}, [x1], x2
subs x12, x12, #2
lowpass_8 v28, v29, v16, v17, v28, v16
.ifc \type,avg
ld1 {v2.8B}, [x0], x3
urhadd v28.8B, v28.8B, v2.8B
ld1 {v3.8B}, [x0]
urhadd v16.8B, v16.8B, v3.8B
ld1 {v2.8b}, [x0], x3
urhadd v28.8b, v28.8b, v2.8b
ld1 {v3.8b}, [x0]
urhadd v16.8b, v16.8b, v3.8b
sub x0, x0, x3
.endif
st1 {v28.8B}, [x0], x3
st1 {v16.8B}, [x0], x3
st1 {v28.8b}, [x0], x3
st1 {v16.8b}, [x0], x3
b.ne 1b
ret
endfunc
@@ -200,23 +200,23 @@ function \type\()_h264_qpel16_h_lowpass_l2_neon
endfunc
function \type\()_h264_qpel8_h_lowpass_l2_neon
1: ld1 {v26.8B, v27.8B}, [x1], x2
ld1 {v16.8B, v17.8B}, [x1], x2
ld1 {v28.8B}, [x3], x2
ld1 {v29.8B}, [x3], x2
1: ld1 {v26.8b, v27.8b}, [x1], x2
ld1 {v16.8b, v17.8b}, [x1], x2
ld1 {v28.8b}, [x3], x2
ld1 {v29.8b}, [x3], x2
subs x12, x12, #2
lowpass_8 v26, v27, v16, v17, v26, v27
urhadd v26.8B, v26.8B, v28.8B
urhadd v27.8B, v27.8B, v29.8B
urhadd v26.8b, v26.8b, v28.8b
urhadd v27.8b, v27.8b, v29.8b
.ifc \type,avg
ld1 {v2.8B}, [x0], x2
urhadd v26.8B, v26.8B, v2.8B
ld1 {v3.8B}, [x0]
urhadd v27.8B, v27.8B, v3.8B
ld1 {v2.8b}, [x0], x2
urhadd v26.8b, v26.8b, v2.8b
ld1 {v3.8b}, [x0]
urhadd v27.8b, v27.8b, v3.8b
sub x0, x0, x2
.endif
st1 {v26.8B}, [x0], x2
st1 {v27.8B}, [x0], x2
st1 {v26.8b}, [x0], x2
st1 {v27.8b}, [x0], x2
b.ne 1b
ret
endfunc
@@ -257,19 +257,19 @@ function \type\()_h264_qpel16_v_lowpass_neon
endfunc
function \type\()_h264_qpel8_v_lowpass_neon
ld1 {v16.8B}, [x1], x3
ld1 {v18.8B}, [x1], x3
ld1 {v20.8B}, [x1], x3
ld1 {v22.8B}, [x1], x3
ld1 {v24.8B}, [x1], x3
ld1 {v26.8B}, [x1], x3
ld1 {v28.8B}, [x1], x3
ld1 {v30.8B}, [x1], x3
ld1 {v17.8B}, [x1], x3
ld1 {v19.8B}, [x1], x3
ld1 {v21.8B}, [x1], x3
ld1 {v23.8B}, [x1], x3
ld1 {v25.8B}, [x1]
ld1 {v16.8b}, [x1], x3
ld1 {v18.8b}, [x1], x3
ld1 {v20.8b}, [x1], x3
ld1 {v22.8b}, [x1], x3
ld1 {v24.8b}, [x1], x3
ld1 {v26.8b}, [x1], x3
ld1 {v28.8b}, [x1], x3
ld1 {v30.8b}, [x1], x3
ld1 {v17.8b}, [x1], x3
ld1 {v19.8b}, [x1], x3
ld1 {v21.8b}, [x1], x3
ld1 {v23.8b}, [x1], x3
ld1 {v25.8b}, [x1]
transpose_8x8B v16, v18, v20, v22, v24, v26, v28, v30, v0, v1
transpose_8x8B v17, v19, v21, v23, v25, v27, v29, v31, v0, v1
@@ -280,33 +280,33 @@ function \type\()_h264_qpel8_v_lowpass_neon
transpose_8x8B v16, v17, v18, v19, v20, v21, v22, v23, v0, v1
.ifc \type,avg
ld1 {v24.8B}, [x0], x2
urhadd v16.8B, v16.8B, v24.8B
ld1 {v25.8B}, [x0], x2
urhadd v17.8B, v17.8B, v25.8B
ld1 {v26.8B}, [x0], x2
urhadd v18.8B, v18.8B, v26.8B
ld1 {v27.8B}, [x0], x2
urhadd v19.8B, v19.8B, v27.8B
ld1 {v28.8B}, [x0], x2
urhadd v20.8B, v20.8B, v28.8B
ld1 {v29.8B}, [x0], x2
urhadd v21.8B, v21.8B, v29.8B
ld1 {v30.8B}, [x0], x2
urhadd v22.8B, v22.8B, v30.8B
ld1 {v31.8B}, [x0], x2
urhadd v23.8B, v23.8B, v31.8B
ld1 {v24.8b}, [x0], x2
urhadd v16.8b, v16.8b, v24.8b
ld1 {v25.8b}, [x0], x2
urhadd v17.8b, v17.8b, v25.8b
ld1 {v26.8b}, [x0], x2
urhadd v18.8b, v18.8b, v26.8b
ld1 {v27.8b}, [x0], x2
urhadd v19.8b, v19.8b, v27.8b
ld1 {v28.8b}, [x0], x2
urhadd v20.8b, v20.8b, v28.8b
ld1 {v29.8b}, [x0], x2
urhadd v21.8b, v21.8b, v29.8b
ld1 {v30.8b}, [x0], x2
urhadd v22.8b, v22.8b, v30.8b
ld1 {v31.8b}, [x0], x2
urhadd v23.8b, v23.8b, v31.8b
sub x0, x0, x2, lsl #3
.endif
st1 {v16.8B}, [x0], x2
st1 {v17.8B}, [x0], x2
st1 {v18.8B}, [x0], x2
st1 {v19.8B}, [x0], x2
st1 {v20.8B}, [x0], x2
st1 {v21.8B}, [x0], x2
st1 {v22.8B}, [x0], x2
st1 {v23.8B}, [x0], x2
st1 {v16.8b}, [x0], x2
st1 {v17.8b}, [x0], x2
st1 {v18.8b}, [x0], x2
st1 {v19.8b}, [x0], x2
st1 {v20.8b}, [x0], x2
st1 {v21.8b}, [x0], x2
st1 {v22.8b}, [x0], x2
st1 {v23.8b}, [x0], x2
ret
endfunc
@@ -334,19 +334,19 @@ function \type\()_h264_qpel16_v_lowpass_l2_neon
endfunc
function \type\()_h264_qpel8_v_lowpass_l2_neon
ld1 {v16.8B}, [x1], x3
ld1 {v18.8B}, [x1], x3
ld1 {v20.8B}, [x1], x3
ld1 {v22.8B}, [x1], x3
ld1 {v24.8B}, [x1], x3
ld1 {v26.8B}, [x1], x3
ld1 {v28.8B}, [x1], x3
ld1 {v30.8B}, [x1], x3
ld1 {v17.8B}, [x1], x3
ld1 {v19.8B}, [x1], x3
ld1 {v21.8B}, [x1], x3
ld1 {v23.8B}, [x1], x3
ld1 {v25.8B}, [x1]
ld1 {v16.8b}, [x1], x3
ld1 {v18.8b}, [x1], x3
ld1 {v20.8b}, [x1], x3
ld1 {v22.8b}, [x1], x3
ld1 {v24.8b}, [x1], x3
ld1 {v26.8b}, [x1], x3
ld1 {v28.8b}, [x1], x3
ld1 {v30.8b}, [x1], x3
ld1 {v17.8b}, [x1], x3
ld1 {v19.8b}, [x1], x3
ld1 {v21.8b}, [x1], x3
ld1 {v23.8b}, [x1], x3
ld1 {v25.8b}, [x1]
transpose_8x8B v16, v18, v20, v22, v24, v26, v28, v30, v0, v1
transpose_8x8B v17, v19, v21, v23, v25, v27, v29, v31, v0, v1
@@ -356,51 +356,51 @@ function \type\()_h264_qpel8_v_lowpass_l2_neon
lowpass_8 v28, v29, v30, v31, v22, v23
transpose_8x8B v16, v17, v18, v19, v20, v21, v22, v23, v0, v1
ld1 {v24.8B}, [x12], x2
ld1 {v25.8B}, [x12], x2
ld1 {v26.8B}, [x12], x2
ld1 {v27.8B}, [x12], x2
ld1 {v28.8B}, [x12], x2
urhadd v16.8B, v24.8B, v16.8B
urhadd v17.8B, v25.8B, v17.8B
ld1 {v29.8B}, [x12], x2
urhadd v18.8B, v26.8B, v18.8B
urhadd v19.8B, v27.8B, v19.8B
ld1 {v30.8B}, [x12], x2
urhadd v20.8B, v28.8B, v20.8B
urhadd v21.8B, v29.8B, v21.8B
ld1 {v31.8B}, [x12], x2
urhadd v22.8B, v30.8B, v22.8B
urhadd v23.8B, v31.8B, v23.8B
ld1 {v24.8b}, [x12], x2
ld1 {v25.8b}, [x12], x2
ld1 {v26.8b}, [x12], x2
ld1 {v27.8b}, [x12], x2
ld1 {v28.8b}, [x12], x2
urhadd v16.8b, v24.8b, v16.8b
urhadd v17.8b, v25.8b, v17.8b
ld1 {v29.8b}, [x12], x2
urhadd v18.8b, v26.8b, v18.8b
urhadd v19.8b, v27.8b, v19.8b
ld1 {v30.8b}, [x12], x2
urhadd v20.8b, v28.8b, v20.8b
urhadd v21.8b, v29.8b, v21.8b
ld1 {v31.8b}, [x12], x2
urhadd v22.8b, v30.8b, v22.8b
urhadd v23.8b, v31.8b, v23.8b
.ifc \type,avg
ld1 {v24.8B}, [x0], x3
urhadd v16.8B, v16.8B, v24.8B
ld1 {v25.8B}, [x0], x3
urhadd v17.8B, v17.8B, v25.8B
ld1 {v26.8B}, [x0], x3
urhadd v18.8B, v18.8B, v26.8B
ld1 {v27.8B}, [x0], x3
urhadd v19.8B, v19.8B, v27.8B
ld1 {v28.8B}, [x0], x3
urhadd v20.8B, v20.8B, v28.8B
ld1 {v29.8B}, [x0], x3
urhadd v21.8B, v21.8B, v29.8B
ld1 {v30.8B}, [x0], x3
urhadd v22.8B, v22.8B, v30.8B
ld1 {v31.8B}, [x0], x3
urhadd v23.8B, v23.8B, v31.8B
ld1 {v24.8b}, [x0], x3
urhadd v16.8b, v16.8b, v24.8b
ld1 {v25.8b}, [x0], x3
urhadd v17.8b, v17.8b, v25.8b
ld1 {v26.8b}, [x0], x3
urhadd v18.8b, v18.8b, v26.8b
ld1 {v27.8b}, [x0], x3
urhadd v19.8b, v19.8b, v27.8b
ld1 {v28.8b}, [x0], x3
urhadd v20.8b, v20.8b, v28.8b
ld1 {v29.8b}, [x0], x3
urhadd v21.8b, v21.8b, v29.8b
ld1 {v30.8b}, [x0], x3
urhadd v22.8b, v22.8b, v30.8b
ld1 {v31.8b}, [x0], x3
urhadd v23.8b, v23.8b, v31.8b
sub x0, x0, x3, lsl #3
.endif
st1 {v16.8B}, [x0], x3
st1 {v17.8B}, [x0], x3
st1 {v18.8B}, [x0], x3
st1 {v19.8B}, [x0], x3
st1 {v20.8B}, [x0], x3
st1 {v21.8B}, [x0], x3
st1 {v22.8B}, [x0], x3
st1 {v23.8B}, [x0], x3
st1 {v16.8b}, [x0], x3
st1 {v17.8b}, [x0], x3
st1 {v18.8b}, [x0], x3
st1 {v19.8b}, [x0], x3
st1 {v20.8b}, [x0], x3
st1 {v21.8b}, [x0], x3
st1 {v22.8b}, [x0], x3
st1 {v23.8b}, [x0], x3
ret
endfunc
@@ -411,19 +411,19 @@ endfunc
function put_h264_qpel8_hv_lowpass_neon_top
lowpass_const w12
ld1 {v16.8H}, [x1], x3
ld1 {v17.8H}, [x1], x3
ld1 {v18.8H}, [x1], x3
ld1 {v19.8H}, [x1], x3
ld1 {v20.8H}, [x1], x3
ld1 {v21.8H}, [x1], x3
ld1 {v22.8H}, [x1], x3
ld1 {v23.8H}, [x1], x3
ld1 {v24.8H}, [x1], x3
ld1 {v25.8H}, [x1], x3
ld1 {v26.8H}, [x1], x3
ld1 {v27.8H}, [x1], x3
ld1 {v28.8H}, [x1]
ld1 {v16.8h}, [x1], x3
ld1 {v17.8h}, [x1], x3
ld1 {v18.8h}, [x1], x3
ld1 {v19.8h}, [x1], x3
ld1 {v20.8h}, [x1], x3
ld1 {v21.8h}, [x1], x3
ld1 {v22.8h}, [x1], x3
ld1 {v23.8h}, [x1], x3
ld1 {v24.8h}, [x1], x3
ld1 {v25.8h}, [x1], x3
ld1 {v26.8h}, [x1], x3
ld1 {v27.8h}, [x1], x3
ld1 {v28.8h}, [x1]
lowpass_8H v16, v17
lowpass_8H v18, v19
lowpass_8H v20, v21
@@ -447,7 +447,7 @@ function put_h264_qpel8_hv_lowpass_neon_top
lowpass_8.16 v22, v30, v22
lowpass_8.16 v23, v31, v23
transpose_8x8B v16, v17, v18, v19, v20, v21, v22, v23, v0, v1
transpose_8x8B v16, v17, v18, v19, v20, v21, v22, v23, v0, v1
ret
endfunc
@@ -457,33 +457,33 @@ function \type\()_h264_qpel8_hv_lowpass_neon
mov x10, x30
bl put_h264_qpel8_hv_lowpass_neon_top
.ifc \type,avg
ld1 {v0.8B}, [x0], x2
urhadd v16.8B, v16.8B, v0.8B
ld1 {v1.8B}, [x0], x2
urhadd v17.8B, v17.8B, v1.8B
ld1 {v2.8B}, [x0], x2
urhadd v18.8B, v18.8B, v2.8B
ld1 {v3.8B}, [x0], x2
urhadd v19.8B, v19.8B, v3.8B
ld1 {v4.8B}, [x0], x2
urhadd v20.8B, v20.8B, v4.8B
ld1 {v5.8B}, [x0], x2
urhadd v21.8B, v21.8B, v5.8B
ld1 {v6.8B}, [x0], x2
urhadd v22.8B, v22.8B, v6.8B
ld1 {v7.8B}, [x0], x2
urhadd v23.8B, v23.8B, v7.8B
ld1 {v0.8b}, [x0], x2
urhadd v16.8b, v16.8b, v0.8b
ld1 {v1.8b}, [x0], x2
urhadd v17.8b, v17.8b, v1.8b
ld1 {v2.8b}, [x0], x2
urhadd v18.8b, v18.8b, v2.8b
ld1 {v3.8b}, [x0], x2
urhadd v19.8b, v19.8b, v3.8b
ld1 {v4.8b}, [x0], x2
urhadd v20.8b, v20.8b, v4.8b
ld1 {v5.8b}, [x0], x2
urhadd v21.8b, v21.8b, v5.8b
ld1 {v6.8b}, [x0], x2
urhadd v22.8b, v22.8b, v6.8b
ld1 {v7.8b}, [x0], x2
urhadd v23.8b, v23.8b, v7.8b
sub x0, x0, x2, lsl #3
.endif
st1 {v16.8B}, [x0], x2
st1 {v17.8B}, [x0], x2
st1 {v18.8B}, [x0], x2
st1 {v19.8B}, [x0], x2
st1 {v20.8B}, [x0], x2
st1 {v21.8B}, [x0], x2
st1 {v22.8B}, [x0], x2
st1 {v23.8B}, [x0], x2
st1 {v16.8b}, [x0], x2
st1 {v17.8b}, [x0], x2
st1 {v18.8b}, [x0], x2
st1 {v19.8b}, [x0], x2
st1 {v20.8b}, [x0], x2
st1 {v21.8b}, [x0], x2
st1 {v22.8b}, [x0], x2
st1 {v23.8b}, [x0], x2
ret x10
endfunc
@@ -497,45 +497,45 @@ function \type\()_h264_qpel8_hv_lowpass_l2_neon
mov x10, x30
bl put_h264_qpel8_hv_lowpass_neon_top
ld1 {v0.8B, v1.8B}, [x2], #16
ld1 {v2.8B, v3.8B}, [x2], #16
urhadd v0.8B, v0.8B, v16.8B
urhadd v1.8B, v1.8B, v17.8B
ld1 {v4.8B, v5.8B}, [x2], #16
urhadd v2.8B, v2.8B, v18.8B
urhadd v3.8B, v3.8B, v19.8B
ld1 {v6.8B, v7.8B}, [x2], #16
urhadd v4.8B, v4.8B, v20.8B
urhadd v5.8B, v5.8B, v21.8B
urhadd v6.8B, v6.8B, v22.8B
urhadd v7.8B, v7.8B, v23.8B
ld1 {v0.8b, v1.8b}, [x2], #16
ld1 {v2.8b, v3.8b}, [x2], #16
urhadd v0.8b, v0.8b, v16.8b
urhadd v1.8b, v1.8b, v17.8b
ld1 {v4.8b, v5.8b}, [x2], #16
urhadd v2.8b, v2.8b, v18.8b
urhadd v3.8b, v3.8b, v19.8b
ld1 {v6.8b, v7.8b}, [x2], #16
urhadd v4.8b, v4.8b, v20.8b
urhadd v5.8b, v5.8b, v21.8b
urhadd v6.8b, v6.8b, v22.8b
urhadd v7.8b, v7.8b, v23.8b
.ifc \type,avg
ld1 {v16.8B}, [x0], x3
urhadd v0.8B, v0.8B, v16.8B
ld1 {v17.8B}, [x0], x3
urhadd v1.8B, v1.8B, v17.8B
ld1 {v18.8B}, [x0], x3
urhadd v2.8B, v2.8B, v18.8B
ld1 {v19.8B}, [x0], x3
urhadd v3.8B, v3.8B, v19.8B
ld1 {v20.8B}, [x0], x3
urhadd v4.8B, v4.8B, v20.8B
ld1 {v21.8B}, [x0], x3
urhadd v5.8B, v5.8B, v21.8B
ld1 {v22.8B}, [x0], x3
urhadd v6.8B, v6.8B, v22.8B
ld1 {v23.8B}, [x0], x3
urhadd v7.8B, v7.8B, v23.8B
ld1 {v16.8b}, [x0], x3
urhadd v0.8b, v0.8b, v16.8b
ld1 {v17.8b}, [x0], x3
urhadd v1.8b, v1.8b, v17.8b
ld1 {v18.8b}, [x0], x3
urhadd v2.8b, v2.8b, v18.8b
ld1 {v19.8b}, [x0], x3
urhadd v3.8b, v3.8b, v19.8b
ld1 {v20.8b}, [x0], x3
urhadd v4.8b, v4.8b, v20.8b
ld1 {v21.8b}, [x0], x3
urhadd v5.8b, v5.8b, v21.8b
ld1 {v22.8b}, [x0], x3
urhadd v6.8b, v6.8b, v22.8b
ld1 {v23.8b}, [x0], x3
urhadd v7.8b, v7.8b, v23.8b
sub x0, x0, x3, lsl #3
.endif
st1 {v0.8B}, [x0], x3
st1 {v1.8B}, [x0], x3
st1 {v2.8B}, [x0], x3
st1 {v3.8B}, [x0], x3
st1 {v4.8B}, [x0], x3
st1 {v5.8B}, [x0], x3
st1 {v6.8B}, [x0], x3
st1 {v7.8B}, [x0], x3
st1 {v0.8b}, [x0], x3
st1 {v1.8b}, [x0], x3
st1 {v2.8b}, [x0], x3
st1 {v3.8b}, [x0], x3
st1 {v4.8b}, [x0], x3
st1 {v5.8b}, [x0], x3
st1 {v6.8b}, [x0], x3
st1 {v7.8b}, [x0], x3
ret x10
endfunc
@@ -579,8 +579,8 @@ function \type\()_h264_qpel16_hv_lowpass_l2_neon
endfunc
.endm
h264_qpel16_hv put
h264_qpel16_hv avg
h264_qpel16_hv put
h264_qpel16_hv avg
.macro h264_qpel8 type
function ff_\type\()_h264_qpel8_mc10_neon, export=1
@@ -758,8 +758,8 @@ function ff_\type\()_h264_qpel8_mc33_neon, export=1
endfunc
.endm
h264_qpel8 put
h264_qpel8 avg
h264_qpel8 put
h264_qpel8 avg
.macro h264_qpel16 type
function ff_\type\()_h264_qpel16_mc10_neon, export=1
@@ -930,5 +930,5 @@ function ff_\type\()_h264_qpel16_mc33_neon, export=1
endfunc
.endm
h264_qpel16 put
h264_qpel16 avg
h264_qpel16 put
h264_qpel16 avg
+181 -181
View File
@@ -26,295 +26,295 @@
.if \avg
mov x12, x0
.endif
1: ld1 {v0.16B}, [x1], x2
ld1 {v1.16B}, [x1], x2
ld1 {v2.16B}, [x1], x2
ld1 {v3.16B}, [x1], x2
1: ld1 {v0.16b}, [x1], x2
ld1 {v1.16b}, [x1], x2
ld1 {v2.16b}, [x1], x2
ld1 {v3.16b}, [x1], x2
.if \avg
ld1 {v4.16B}, [x12], x2
urhadd v0.16B, v0.16B, v4.16B
ld1 {v5.16B}, [x12], x2
urhadd v1.16B, v1.16B, v5.16B
ld1 {v6.16B}, [x12], x2
urhadd v2.16B, v2.16B, v6.16B
ld1 {v7.16B}, [x12], x2
urhadd v3.16B, v3.16B, v7.16B
ld1 {v4.16b}, [x12], x2
urhadd v0.16b, v0.16b, v4.16b
ld1 {v5.16b}, [x12], x2
urhadd v1.16b, v1.16b, v5.16b
ld1 {v6.16b}, [x12], x2
urhadd v2.16b, v2.16b, v6.16b
ld1 {v7.16b}, [x12], x2
urhadd v3.16b, v3.16b, v7.16b
.endif
subs w3, w3, #4
st1 {v0.16B}, [x0], x2
st1 {v1.16B}, [x0], x2
st1 {v2.16B}, [x0], x2
st1 {v3.16B}, [x0], x2
st1 {v0.16b}, [x0], x2
st1 {v1.16b}, [x0], x2
st1 {v2.16b}, [x0], x2
st1 {v3.16b}, [x0], x2
b.ne 1b
ret
.endm
.macro pixels16_x2 rnd=1, avg=0
1: ld1 {v0.16B, v1.16B}, [x1], x2
ld1 {v2.16B, v3.16B}, [x1], x2
1: ld1 {v0.16b, v1.16b}, [x1], x2
ld1 {v2.16b, v3.16b}, [x1], x2
subs w3, w3, #2
ext v1.16B, v0.16B, v1.16B, #1
avg v0.16B, v0.16B, v1.16B
ext v3.16B, v2.16B, v3.16B, #1
avg v2.16B, v2.16B, v3.16B
ext v1.16b, v0.16b, v1.16b, #1
avg v0.16b, v0.16b, v1.16b
ext v3.16b, v2.16b, v3.16b, #1
avg v2.16b, v2.16b, v3.16b
.if \avg
ld1 {v1.16B}, [x0], x2
ld1 {v3.16B}, [x0]
urhadd v0.16B, v0.16B, v1.16B
urhadd v2.16B, v2.16B, v3.16B
ld1 {v1.16b}, [x0], x2
ld1 {v3.16b}, [x0]
urhadd v0.16b, v0.16b, v1.16b
urhadd v2.16b, v2.16b, v3.16b
sub x0, x0, x2
.endif
st1 {v0.16B}, [x0], x2
st1 {v2.16B}, [x0], x2
st1 {v0.16b}, [x0], x2
st1 {v2.16b}, [x0], x2
b.ne 1b
ret
.endm
.macro pixels16_y2 rnd=1, avg=0
sub w3, w3, #2
ld1 {v0.16B}, [x1], x2
ld1 {v1.16B}, [x1], x2
ld1 {v0.16b}, [x1], x2
ld1 {v1.16b}, [x1], x2
1: subs w3, w3, #2
avg v2.16B, v0.16B, v1.16B
ld1 {v0.16B}, [x1], x2
avg v3.16B, v0.16B, v1.16B
ld1 {v1.16B}, [x1], x2
avg v2.16b, v0.16b, v1.16b
ld1 {v0.16b}, [x1], x2
avg v3.16b, v0.16b, v1.16b
ld1 {v1.16b}, [x1], x2
.if \avg
ld1 {v4.16B}, [x0], x2
ld1 {v5.16B}, [x0]
urhadd v2.16B, v2.16B, v4.16B
urhadd v3.16B, v3.16B, v5.16B
ld1 {v4.16b}, [x0], x2
ld1 {v5.16b}, [x0]
urhadd v2.16b, v2.16b, v4.16b
urhadd v3.16b, v3.16b, v5.16b
sub x0, x0, x2
.endif
st1 {v2.16B}, [x0], x2
st1 {v3.16B}, [x0], x2
st1 {v2.16b}, [x0], x2
st1 {v3.16b}, [x0], x2
b.ne 1b
avg v2.16B, v0.16B, v1.16B
ld1 {v0.16B}, [x1], x2
avg v3.16B, v0.16B, v1.16B
avg v2.16b, v0.16b, v1.16b
ld1 {v0.16b}, [x1], x2
avg v3.16b, v0.16b, v1.16b
.if \avg
ld1 {v4.16B}, [x0], x2
ld1 {v5.16B}, [x0]
urhadd v2.16B, v2.16B, v4.16B
urhadd v3.16B, v3.16B, v5.16B
ld1 {v4.16b}, [x0], x2
ld1 {v5.16b}, [x0]
urhadd v2.16b, v2.16b, v4.16b
urhadd v3.16b, v3.16b, v5.16b
sub x0, x0, x2
.endif
st1 {v2.16B}, [x0], x2
st1 {v3.16B}, [x0], x2
st1 {v2.16b}, [x0], x2
st1 {v3.16b}, [x0], x2
ret
.endm
.macro pixels16_xy2 rnd=1, avg=0
sub w3, w3, #2
ld1 {v0.16B, v1.16B}, [x1], x2
ld1 {v4.16B, v5.16B}, [x1], x2
ld1 {v0.16b, v1.16b}, [x1], x2
ld1 {v4.16b, v5.16b}, [x1], x2
NRND movi v26.8H, #1
ext v1.16B, v0.16B, v1.16B, #1
ext v5.16B, v4.16B, v5.16B, #1
uaddl v16.8H, v0.8B, v1.8B
uaddl2 v20.8H, v0.16B, v1.16B
uaddl v18.8H, v4.8B, v5.8B
uaddl2 v22.8H, v4.16B, v5.16B
ext v1.16b, v0.16b, v1.16b, #1
ext v5.16b, v4.16b, v5.16b, #1
uaddl v16.8h, v0.8b, v1.8b
uaddl2 v20.8h, v0.16b, v1.16b
uaddl v18.8h, v4.8b, v5.8b
uaddl2 v22.8h, v4.16b, v5.16b
1: subs w3, w3, #2
ld1 {v0.16B, v1.16B}, [x1], x2
add v24.8H, v16.8H, v18.8H
ld1 {v0.16b, v1.16b}, [x1], x2
add v24.8h, v16.8h, v18.8h
NRND add v24.8H, v24.8H, v26.8H
ext v30.16B, v0.16B, v1.16B, #1
add v1.8H, v20.8H, v22.8H
mshrn v28.8B, v24.8H, #2
ext v30.16b, v0.16b, v1.16b, #1
add v1.8h, v20.8h, v22.8h
mshrn v28.8b, v24.8h, #2
NRND add v1.8H, v1.8H, v26.8H
mshrn2 v28.16B, v1.8H, #2
mshrn2 v28.16b, v1.8h, #2
.if \avg
ld1 {v16.16B}, [x0]
urhadd v28.16B, v28.16B, v16.16B
ld1 {v16.16b}, [x0]
urhadd v28.16b, v28.16b, v16.16b
.endif
uaddl v16.8H, v0.8B, v30.8B
ld1 {v2.16B, v3.16B}, [x1], x2
uaddl2 v20.8H, v0.16B, v30.16B
st1 {v28.16B}, [x0], x2
add v24.8H, v16.8H, v18.8H
uaddl v16.8h, v0.8b, v30.8b
ld1 {v2.16b, v3.16b}, [x1], x2
uaddl2 v20.8h, v0.16b, v30.16b
st1 {v28.16b}, [x0], x2
add v24.8h, v16.8h, v18.8h
NRND add v24.8H, v24.8H, v26.8H
ext v3.16B, v2.16B, v3.16B, #1
add v0.8H, v20.8H, v22.8H
mshrn v30.8B, v24.8H, #2
ext v3.16b, v2.16b, v3.16b, #1
add v0.8h, v20.8h, v22.8h
mshrn v30.8b, v24.8h, #2
NRND add v0.8H, v0.8H, v26.8H
mshrn2 v30.16B, v0.8H, #2
mshrn2 v30.16b, v0.8h, #2
.if \avg
ld1 {v18.16B}, [x0]
urhadd v30.16B, v30.16B, v18.16B
ld1 {v18.16b}, [x0]
urhadd v30.16b, v30.16b, v18.16b
.endif
uaddl v18.8H, v2.8B, v3.8B
uaddl2 v22.8H, v2.16B, v3.16B
st1 {v30.16B}, [x0], x2
uaddl v18.8h, v2.8b, v3.8b
uaddl2 v22.8h, v2.16b, v3.16b
st1 {v30.16b}, [x0], x2
b.gt 1b
ld1 {v0.16B, v1.16B}, [x1], x2
add v24.8H, v16.8H, v18.8H
ld1 {v0.16b, v1.16b}, [x1], x2
add v24.8h, v16.8h, v18.8h
NRND add v24.8H, v24.8H, v26.8H
ext v30.16B, v0.16B, v1.16B, #1
add v1.8H, v20.8H, v22.8H
mshrn v28.8B, v24.8H, #2
ext v30.16b, v0.16b, v1.16b, #1
add v1.8h, v20.8h, v22.8h
mshrn v28.8b, v24.8h, #2
NRND add v1.8H, v1.8H, v26.8H
mshrn2 v28.16B, v1.8H, #2
mshrn2 v28.16b, v1.8h, #2
.if \avg
ld1 {v16.16B}, [x0]
urhadd v28.16B, v28.16B, v16.16B
ld1 {v16.16b}, [x0]
urhadd v28.16b, v28.16b, v16.16b
.endif
uaddl v16.8H, v0.8B, v30.8B
uaddl2 v20.8H, v0.16B, v30.16B
st1 {v28.16B}, [x0], x2
add v24.8H, v16.8H, v18.8H
uaddl v16.8h, v0.8b, v30.8b
uaddl2 v20.8h, v0.16b, v30.16b
st1 {v28.16b}, [x0], x2
add v24.8h, v16.8h, v18.8h
NRND add v24.8H, v24.8H, v26.8H
add v0.8H, v20.8H, v22.8H
mshrn v30.8B, v24.8H, #2
add v0.8h, v20.8h, v22.8h
mshrn v30.8b, v24.8h, #2
NRND add v0.8H, v0.8H, v26.8H
mshrn2 v30.16B, v0.8H, #2
mshrn2 v30.16b, v0.8h, #2
.if \avg
ld1 {v18.16B}, [x0]
urhadd v30.16B, v30.16B, v18.16B
ld1 {v18.16b}, [x0]
urhadd v30.16b, v30.16b, v18.16b
.endif
st1 {v30.16B}, [x0], x2
st1 {v30.16b}, [x0], x2
ret
.endm
.macro pixels8 rnd=1, avg=0
1: ld1 {v0.8B}, [x1], x2
ld1 {v1.8B}, [x1], x2
ld1 {v2.8B}, [x1], x2
ld1 {v3.8B}, [x1], x2
1: ld1 {v0.8b}, [x1], x2
ld1 {v1.8b}, [x1], x2
ld1 {v2.8b}, [x1], x2
ld1 {v3.8b}, [x1], x2
.if \avg
ld1 {v4.8B}, [x0], x2
urhadd v0.8B, v0.8B, v4.8B
ld1 {v5.8B}, [x0], x2
urhadd v1.8B, v1.8B, v5.8B
ld1 {v6.8B}, [x0], x2
urhadd v2.8B, v2.8B, v6.8B
ld1 {v7.8B}, [x0], x2
urhadd v3.8B, v3.8B, v7.8B
ld1 {v4.8b}, [x0], x2
urhadd v0.8b, v0.8b, v4.8b
ld1 {v5.8b}, [x0], x2
urhadd v1.8b, v1.8b, v5.8b
ld1 {v6.8b}, [x0], x2
urhadd v2.8b, v2.8b, v6.8b
ld1 {v7.8b}, [x0], x2
urhadd v3.8b, v3.8b, v7.8b
sub x0, x0, x2, lsl #2
.endif
subs w3, w3, #4
st1 {v0.8B}, [x0], x2
st1 {v1.8B}, [x0], x2
st1 {v2.8B}, [x0], x2
st1 {v3.8B}, [x0], x2
st1 {v0.8b}, [x0], x2
st1 {v1.8b}, [x0], x2
st1 {v2.8b}, [x0], x2
st1 {v3.8b}, [x0], x2
b.ne 1b
ret
.endm
.macro pixels8_x2 rnd=1, avg=0
1: ld1 {v0.8B, v1.8B}, [x1], x2
ext v1.8B, v0.8B, v1.8B, #1
ld1 {v2.8B, v3.8B}, [x1], x2
ext v3.8B, v2.8B, v3.8B, #1
1: ld1 {v0.8b, v1.8b}, [x1], x2
ext v1.8b, v0.8b, v1.8b, #1
ld1 {v2.8b, v3.8b}, [x1], x2
ext v3.8b, v2.8b, v3.8b, #1
subs w3, w3, #2
avg v0.8B, v0.8B, v1.8B
avg v2.8B, v2.8B, v3.8B
avg v0.8b, v0.8b, v1.8b
avg v2.8b, v2.8b, v3.8b
.if \avg
ld1 {v4.8B}, [x0], x2
ld1 {v5.8B}, [x0]
urhadd v0.8B, v0.8B, v4.8B
urhadd v2.8B, v2.8B, v5.8B
ld1 {v4.8b}, [x0], x2
ld1 {v5.8b}, [x0]
urhadd v0.8b, v0.8b, v4.8b
urhadd v2.8b, v2.8b, v5.8b
sub x0, x0, x2
.endif
st1 {v0.8B}, [x0], x2
st1 {v2.8B}, [x0], x2
st1 {v0.8b}, [x0], x2
st1 {v2.8b}, [x0], x2
b.ne 1b
ret
.endm
.macro pixels8_y2 rnd=1, avg=0
sub w3, w3, #2
ld1 {v0.8B}, [x1], x2
ld1 {v1.8B}, [x1], x2
ld1 {v0.8b}, [x1], x2
ld1 {v1.8b}, [x1], x2
1: subs w3, w3, #2
avg v4.8B, v0.8B, v1.8B
ld1 {v0.8B}, [x1], x2
avg v5.8B, v0.8B, v1.8B
ld1 {v1.8B}, [x1], x2
avg v4.8b, v0.8b, v1.8b
ld1 {v0.8b}, [x1], x2
avg v5.8b, v0.8b, v1.8b
ld1 {v1.8b}, [x1], x2
.if \avg
ld1 {v2.8B}, [x0], x2
ld1 {v3.8B}, [x0]
urhadd v4.8B, v4.8B, v2.8B
urhadd v5.8B, v5.8B, v3.8B
ld1 {v2.8b}, [x0], x2
ld1 {v3.8b}, [x0]
urhadd v4.8b, v4.8b, v2.8b
urhadd v5.8b, v5.8b, v3.8b
sub x0, x0, x2
.endif
st1 {v4.8B}, [x0], x2
st1 {v5.8B}, [x0], x2
st1 {v4.8b}, [x0], x2
st1 {v5.8b}, [x0], x2
b.ne 1b
avg v4.8B, v0.8B, v1.8B
ld1 {v0.8B}, [x1], x2
avg v5.8B, v0.8B, v1.8B
avg v4.8b, v0.8b, v1.8b
ld1 {v0.8b}, [x1], x2
avg v5.8b, v0.8b, v1.8b
.if \avg
ld1 {v2.8B}, [x0], x2
ld1 {v3.8B}, [x0]
urhadd v4.8B, v4.8B, v2.8B
urhadd v5.8B, v5.8B, v3.8B
ld1 {v2.8b}, [x0], x2
ld1 {v3.8b}, [x0]
urhadd v4.8b, v4.8b, v2.8b
urhadd v5.8b, v5.8b, v3.8b
sub x0, x0, x2
.endif
st1 {v4.8B}, [x0], x2
st1 {v5.8B}, [x0], x2
st1 {v4.8b}, [x0], x2
st1 {v5.8b}, [x0], x2
ret
.endm
.macro pixels8_xy2 rnd=1, avg=0
sub w3, w3, #2
ld1 {v0.16B}, [x1], x2
ld1 {v1.16B}, [x1], x2
ld1 {v0.16b}, [x1], x2
ld1 {v1.16b}, [x1], x2
NRND movi v19.8H, #1
ext v4.16B, v0.16B, v4.16B, #1
ext v6.16B, v1.16B, v6.16B, #1
uaddl v16.8H, v0.8B, v4.8B
uaddl v17.8H, v1.8B, v6.8B
ext v4.16b, v0.16b, v4.16b, #1
ext v6.16b, v1.16b, v6.16b, #1
uaddl v16.8h, v0.8b, v4.8b
uaddl v17.8h, v1.8b, v6.8b
1: subs w3, w3, #2
ld1 {v0.16B}, [x1], x2
add v18.8H, v16.8H, v17.8H
ext v4.16B, v0.16B, v4.16B, #1
ld1 {v0.16b}, [x1], x2
add v18.8h, v16.8h, v17.8h
ext v4.16b, v0.16b, v4.16b, #1
NRND add v18.8H, v18.8H, v19.8H
uaddl v16.8H, v0.8B, v4.8B
mshrn v5.8B, v18.8H, #2
ld1 {v1.16B}, [x1], x2
add v18.8H, v16.8H, v17.8H
uaddl v16.8h, v0.8b, v4.8b
mshrn v5.8b, v18.8h, #2
ld1 {v1.16b}, [x1], x2
add v18.8h, v16.8h, v17.8h
.if \avg
ld1 {v7.8B}, [x0]
urhadd v5.8B, v5.8B, v7.8B
ld1 {v7.8b}, [x0]
urhadd v5.8b, v5.8b, v7.8b
.endif
NRND add v18.8H, v18.8H, v19.8H
st1 {v5.8B}, [x0], x2
mshrn v7.8B, v18.8H, #2
st1 {v5.8b}, [x0], x2
mshrn v7.8b, v18.8h, #2
.if \avg
ld1 {v5.8B}, [x0]
urhadd v7.8B, v7.8B, v5.8B
ld1 {v5.8b}, [x0]
urhadd v7.8b, v7.8b, v5.8b
.endif
ext v6.16B, v1.16B, v6.16B, #1
uaddl v17.8H, v1.8B, v6.8B
st1 {v7.8B}, [x0], x2
ext v6.16b, v1.16b, v6.16b, #1
uaddl v17.8h, v1.8b, v6.8b
st1 {v7.8b}, [x0], x2
b.gt 1b
ld1 {v0.16B}, [x1], x2
add v18.8H, v16.8H, v17.8H
ext v4.16B, v0.16B, v4.16B, #1
ld1 {v0.16b}, [x1], x2
add v18.8h, v16.8h, v17.8h
ext v4.16b, v0.16b, v4.16b, #1
NRND add v18.8H, v18.8H, v19.8H
uaddl v16.8H, v0.8B, v4.8B
mshrn v5.8B, v18.8H, #2
add v18.8H, v16.8H, v17.8H
uaddl v16.8h, v0.8b, v4.8b
mshrn v5.8b, v18.8h, #2
add v18.8h, v16.8h, v17.8h
.if \avg
ld1 {v7.8B}, [x0]
urhadd v5.8B, v5.8B, v7.8B
ld1 {v7.8b}, [x0]
urhadd v5.8b, v5.8b, v7.8b
.endif
NRND add v18.8H, v18.8H, v19.8H
st1 {v5.8B}, [x0], x2
mshrn v7.8B, v18.8H, #2
st1 {v5.8b}, [x0], x2
mshrn v7.8b, v18.8h, #2
.if \avg
ld1 {v5.8B}, [x0]
urhadd v7.8B, v7.8B, v5.8B
ld1 {v5.8b}, [x0]
urhadd v7.8b, v7.8b, v5.8b
.endif
st1 {v7.8B}, [x0], x2
st1 {v7.8b}, [x0], x2
ret
.endm
+1
View File
@@ -19,6 +19,7 @@
#ifndef AVCODEC_AARCH64_IDCT_H
#define AVCODEC_AARCH64_IDCT_H
#include <stddef.h>
#include <stdint.h>
void ff_simple_idct_neon(int16_t *data);
+96 -96
View File
@@ -17,133 +17,133 @@
*/
.macro transpose_8x8B r0, r1, r2, r3, r4, r5, r6, r7, r8, r9
trn1 \r8\().8B, \r0\().8B, \r1\().8B
trn2 \r9\().8B, \r0\().8B, \r1\().8B
trn1 \r1\().8B, \r2\().8B, \r3\().8B
trn2 \r3\().8B, \r2\().8B, \r3\().8B
trn1 \r0\().8B, \r4\().8B, \r5\().8B
trn2 \r5\().8B, \r4\().8B, \r5\().8B
trn1 \r2\().8B, \r6\().8B, \r7\().8B
trn2 \r7\().8B, \r6\().8B, \r7\().8B
trn1 \r8\().8b, \r0\().8b, \r1\().8b
trn2 \r9\().8b, \r0\().8b, \r1\().8b
trn1 \r1\().8b, \r2\().8b, \r3\().8b
trn2 \r3\().8b, \r2\().8b, \r3\().8b
trn1 \r0\().8b, \r4\().8b, \r5\().8b
trn2 \r5\().8b, \r4\().8b, \r5\().8b
trn1 \r2\().8b, \r6\().8b, \r7\().8b
trn2 \r7\().8b, \r6\().8b, \r7\().8b
trn1 \r4\().4H, \r0\().4H, \r2\().4H
trn2 \r2\().4H, \r0\().4H, \r2\().4H
trn1 \r6\().4H, \r5\().4H, \r7\().4H
trn2 \r7\().4H, \r5\().4H, \r7\().4H
trn1 \r5\().4H, \r9\().4H, \r3\().4H
trn2 \r9\().4H, \r9\().4H, \r3\().4H
trn1 \r3\().4H, \r8\().4H, \r1\().4H
trn2 \r8\().4H, \r8\().4H, \r1\().4H
trn1 \r4\().4h, \r0\().4h, \r2\().4h
trn2 \r2\().4h, \r0\().4h, \r2\().4h
trn1 \r6\().4h, \r5\().4h, \r7\().4h
trn2 \r7\().4h, \r5\().4h, \r7\().4h
trn1 \r5\().4h, \r9\().4h, \r3\().4h
trn2 \r9\().4h, \r9\().4h, \r3\().4h
trn1 \r3\().4h, \r8\().4h, \r1\().4h
trn2 \r8\().4h, \r8\().4h, \r1\().4h
trn1 \r0\().2S, \r3\().2S, \r4\().2S
trn2 \r4\().2S, \r3\().2S, \r4\().2S
trn1 \r0\().2s, \r3\().2s, \r4\().2s
trn2 \r4\().2s, \r3\().2s, \r4\().2s
trn1 \r1\().2S, \r5\().2S, \r6\().2S
trn2 \r5\().2S, \r5\().2S, \r6\().2S
trn1 \r1\().2s, \r5\().2s, \r6\().2s
trn2 \r5\().2s, \r5\().2s, \r6\().2s
trn2 \r6\().2S, \r8\().2S, \r2\().2S
trn1 \r2\().2S, \r8\().2S, \r2\().2S
trn2 \r6\().2s, \r8\().2s, \r2\().2s
trn1 \r2\().2s, \r8\().2s, \r2\().2s
trn1 \r3\().2S, \r9\().2S, \r7\().2S
trn2 \r7\().2S, \r9\().2S, \r7\().2S
trn1 \r3\().2s, \r9\().2s, \r7\().2s
trn2 \r7\().2s, \r9\().2s, \r7\().2s
.endm
.macro transpose_8x16B r0, r1, r2, r3, r4, r5, r6, r7, t0, t1
trn1 \t0\().16B, \r0\().16B, \r1\().16B
trn2 \t1\().16B, \r0\().16B, \r1\().16B
trn1 \r1\().16B, \r2\().16B, \r3\().16B
trn2 \r3\().16B, \r2\().16B, \r3\().16B
trn1 \r0\().16B, \r4\().16B, \r5\().16B
trn2 \r5\().16B, \r4\().16B, \r5\().16B
trn1 \r2\().16B, \r6\().16B, \r7\().16B
trn2 \r7\().16B, \r6\().16B, \r7\().16B
trn1 \t0\().16b, \r0\().16b, \r1\().16b
trn2 \t1\().16b, \r0\().16b, \r1\().16b
trn1 \r1\().16b, \r2\().16b, \r3\().16b
trn2 \r3\().16b, \r2\().16b, \r3\().16b
trn1 \r0\().16b, \r4\().16b, \r5\().16b
trn2 \r5\().16b, \r4\().16b, \r5\().16b
trn1 \r2\().16b, \r6\().16b, \r7\().16b
trn2 \r7\().16b, \r6\().16b, \r7\().16b
trn1 \r4\().8H, \r0\().8H, \r2\().8H
trn2 \r2\().8H, \r0\().8H, \r2\().8H
trn1 \r6\().8H, \r5\().8H, \r7\().8H
trn2 \r7\().8H, \r5\().8H, \r7\().8H
trn1 \r5\().8H, \t1\().8H, \r3\().8H
trn2 \t1\().8H, \t1\().8H, \r3\().8H
trn1 \r3\().8H, \t0\().8H, \r1\().8H
trn2 \t0\().8H, \t0\().8H, \r1\().8H
trn1 \r4\().8h, \r0\().8h, \r2\().8h
trn2 \r2\().8h, \r0\().8h, \r2\().8h
trn1 \r6\().8h, \r5\().8h, \r7\().8h
trn2 \r7\().8h, \r5\().8h, \r7\().8h
trn1 \r5\().8h, \t1\().8h, \r3\().8h
trn2 \t1\().8h, \t1\().8h, \r3\().8h
trn1 \r3\().8h, \t0\().8h, \r1\().8h
trn2 \t0\().8h, \t0\().8h, \r1\().8h
trn1 \r0\().4S, \r3\().4S, \r4\().4S
trn2 \r4\().4S, \r3\().4S, \r4\().4S
trn1 \r0\().4s, \r3\().4s, \r4\().4s
trn2 \r4\().4s, \r3\().4s, \r4\().4s
trn1 \r1\().4S, \r5\().4S, \r6\().4S
trn2 \r5\().4S, \r5\().4S, \r6\().4S
trn1 \r1\().4s, \r5\().4s, \r6\().4s
trn2 \r5\().4s, \r5\().4s, \r6\().4s
trn2 \r6\().4S, \t0\().4S, \r2\().4S
trn1 \r2\().4S, \t0\().4S, \r2\().4S
trn2 \r6\().4s, \t0\().4s, \r2\().4s
trn1 \r2\().4s, \t0\().4s, \r2\().4s
trn1 \r3\().4S, \t1\().4S, \r7\().4S
trn2 \r7\().4S, \t1\().4S, \r7\().4S
trn1 \r3\().4s, \t1\().4s, \r7\().4s
trn2 \r7\().4s, \t1\().4s, \r7\().4s
.endm
.macro transpose_4x16B r0, r1, r2, r3, t4, t5, t6, t7
trn1 \t4\().16B, \r0\().16B, \r1\().16B
trn2 \t5\().16B, \r0\().16B, \r1\().16B
trn1 \t6\().16B, \r2\().16B, \r3\().16B
trn2 \t7\().16B, \r2\().16B, \r3\().16B
trn1 \t4\().16b, \r0\().16b, \r1\().16b
trn2 \t5\().16b, \r0\().16b, \r1\().16b
trn1 \t6\().16b, \r2\().16b, \r3\().16b
trn2 \t7\().16b, \r2\().16b, \r3\().16b
trn1 \r0\().8H, \t4\().8H, \t6\().8H
trn2 \r2\().8H, \t4\().8H, \t6\().8H
trn1 \r1\().8H, \t5\().8H, \t7\().8H
trn2 \r3\().8H, \t5\().8H, \t7\().8H
trn1 \r0\().8h, \t4\().8h, \t6\().8h
trn2 \r2\().8h, \t4\().8h, \t6\().8h
trn1 \r1\().8h, \t5\().8h, \t7\().8h
trn2 \r3\().8h, \t5\().8h, \t7\().8h
.endm
.macro transpose_4x8B r0, r1, r2, r3, t4, t5, t6, t7
trn1 \t4\().8B, \r0\().8B, \r1\().8B
trn2 \t5\().8B, \r0\().8B, \r1\().8B
trn1 \t6\().8B, \r2\().8B, \r3\().8B
trn2 \t7\().8B, \r2\().8B, \r3\().8B
trn1 \t4\().8b, \r0\().8b, \r1\().8b
trn2 \t5\().8b, \r0\().8b, \r1\().8b
trn1 \t6\().8b, \r2\().8b, \r3\().8b
trn2 \t7\().8b, \r2\().8b, \r3\().8b
trn1 \r0\().4H, \t4\().4H, \t6\().4H
trn2 \r2\().4H, \t4\().4H, \t6\().4H
trn1 \r1\().4H, \t5\().4H, \t7\().4H
trn2 \r3\().4H, \t5\().4H, \t7\().4H
trn1 \r0\().4h, \t4\().4h, \t6\().4h
trn2 \r2\().4h, \t4\().4h, \t6\().4h
trn1 \r1\().4h, \t5\().4h, \t7\().4h
trn2 \r3\().4h, \t5\().4h, \t7\().4h
.endm
.macro transpose_4x4H r0, r1, r2, r3, r4, r5, r6, r7
trn1 \r4\().4H, \r0\().4H, \r1\().4H
trn2 \r5\().4H, \r0\().4H, \r1\().4H
trn1 \r6\().4H, \r2\().4H, \r3\().4H
trn2 \r7\().4H, \r2\().4H, \r3\().4H
trn1 \r0\().2S, \r4\().2S, \r6\().2S
trn2 \r2\().2S, \r4\().2S, \r6\().2S
trn1 \r1\().2S, \r5\().2S, \r7\().2S
trn2 \r3\().2S, \r5\().2S, \r7\().2S
trn1 \r4\().4h, \r0\().4h, \r1\().4h
trn2 \r5\().4h, \r0\().4h, \r1\().4h
trn1 \r6\().4h, \r2\().4h, \r3\().4h
trn2 \r7\().4h, \r2\().4h, \r3\().4h
trn1 \r0\().2s, \r4\().2s, \r6\().2s
trn2 \r2\().2s, \r4\().2s, \r6\().2s
trn1 \r1\().2s, \r5\().2s, \r7\().2s
trn2 \r3\().2s, \r5\().2s, \r7\().2s
.endm
.macro transpose_8x8H r0, r1, r2, r3, r4, r5, r6, r7, r8, r9
trn1 \r8\().8H, \r0\().8H, \r1\().8H
trn2 \r9\().8H, \r0\().8H, \r1\().8H
trn1 \r1\().8H, \r2\().8H, \r3\().8H
trn2 \r3\().8H, \r2\().8H, \r3\().8H
trn1 \r0\().8H, \r4\().8H, \r5\().8H
trn2 \r5\().8H, \r4\().8H, \r5\().8H
trn1 \r2\().8H, \r6\().8H, \r7\().8H
trn2 \r7\().8H, \r6\().8H, \r7\().8H
trn1 \r8\().8h, \r0\().8h, \r1\().8h
trn2 \r9\().8h, \r0\().8h, \r1\().8h
trn1 \r1\().8h, \r2\().8h, \r3\().8h
trn2 \r3\().8h, \r2\().8h, \r3\().8h
trn1 \r0\().8h, \r4\().8h, \r5\().8h
trn2 \r5\().8h, \r4\().8h, \r5\().8h
trn1 \r2\().8h, \r6\().8h, \r7\().8h
trn2 \r7\().8h, \r6\().8h, \r7\().8h
trn1 \r4\().4S, \r0\().4S, \r2\().4S
trn2 \r2\().4S, \r0\().4S, \r2\().4S
trn1 \r6\().4S, \r5\().4S, \r7\().4S
trn2 \r7\().4S, \r5\().4S, \r7\().4S
trn1 \r5\().4S, \r9\().4S, \r3\().4S
trn2 \r9\().4S, \r9\().4S, \r3\().4S
trn1 \r3\().4S, \r8\().4S, \r1\().4S
trn2 \r8\().4S, \r8\().4S, \r1\().4S
trn1 \r4\().4s, \r0\().4s, \r2\().4s
trn2 \r2\().4s, \r0\().4s, \r2\().4s
trn1 \r6\().4s, \r5\().4s, \r7\().4s
trn2 \r7\().4s, \r5\().4s, \r7\().4s
trn1 \r5\().4s, \r9\().4s, \r3\().4s
trn2 \r9\().4s, \r9\().4s, \r3\().4s
trn1 \r3\().4s, \r8\().4s, \r1\().4s
trn2 \r8\().4s, \r8\().4s, \r1\().4s
trn1 \r0\().2D, \r3\().2D, \r4\().2D
trn2 \r4\().2D, \r3\().2D, \r4\().2D
trn1 \r0\().2d, \r3\().2d, \r4\().2d
trn2 \r4\().2d, \r3\().2d, \r4\().2d
trn1 \r1\().2D, \r5\().2D, \r6\().2D
trn2 \r5\().2D, \r5\().2D, \r6\().2D
trn1 \r1\().2d, \r5\().2d, \r6\().2d
trn2 \r5\().2d, \r5\().2d, \r6\().2d
trn2 \r6\().2D, \r8\().2D, \r2\().2D
trn1 \r2\().2D, \r8\().2D, \r2\().2D
trn2 \r6\().2d, \r8\().2d, \r2\().2d
trn1 \r2\().2d, \r8\().2d, \r2\().2d
trn1 \r3\().2D, \r9\().2D, \r7\().2D
trn2 \r7\().2D, \r9\().2D, \r7\().2D
trn1 \r3\().2d, \r9\().2d, \r7\().2d
trn2 \r7\().2d, \r9\().2d, \r7\().2d
.endm
+51 -51
View File
@@ -33,81 +33,81 @@ const tab_x2, align=4
endconst
function ff_opus_deemphasis_neon, export=1
movrel x4, tab_st
ld1 {v4.4s}, [x4]
movrel x4, tab_x0
ld1 {v5.4s}, [x4]
movrel x4, tab_x1
ld1 {v6.4s}, [x4]
movrel x4, tab_x2
ld1 {v7.4s}, [x4]
movrel x4, tab_st
ld1 {v4.4s}, [x4]
movrel x4, tab_x0
ld1 {v5.4s}, [x4]
movrel x4, tab_x1
ld1 {v6.4s}, [x4]
movrel x4, tab_x2
ld1 {v7.4s}, [x4]
fmul v0.4s, v4.4s, v0.s[0]
fmul v0.4s, v4.4s, v0.s[0]
1: ld1 {v1.4s, v2.4s}, [x1], #32
1: ld1 {v1.4s, v2.4s}, [x1], #32
fmla v0.4s, v5.4s, v1.s[0]
fmul v3.4s, v7.4s, v2.s[2]
fmla v0.4s, v5.4s, v1.s[0]
fmul v3.4s, v7.4s, v2.s[2]
fmla v0.4s, v6.4s, v1.s[1]
fmla v3.4s, v6.4s, v2.s[1]
fmla v0.4s, v6.4s, v1.s[1]
fmla v3.4s, v6.4s, v2.s[1]
fmla v0.4s, v7.4s, v1.s[2]
fmla v3.4s, v5.4s, v2.s[0]
fmla v0.4s, v7.4s, v1.s[2]
fmla v3.4s, v5.4s, v2.s[0]
fadd v1.4s, v1.4s, v0.4s
fadd v2.4s, v2.4s, v3.4s
fadd v1.4s, v1.4s, v0.4s
fadd v2.4s, v2.4s, v3.4s
fmla v2.4s, v4.4s, v1.s[3]
fmla v2.4s, v4.4s, v1.s[3]
st1 {v1.4s, v2.4s}, [x0], #32
fmul v0.4s, v4.4s, v2.s[3]
st1 {v1.4s, v2.4s}, [x0], #32
fmul v0.4s, v4.4s, v2.s[3]
subs w2, w2, #8
b.gt 1b
subs w2, w2, #8
b.gt 1b
mov s0, v2.s[3]
mov s0, v2.s[3]
ret
endfunc
function ff_opus_postfilter_neon, export=1
ld1 {v0.4s}, [x2]
dup v1.4s, v0.s[1]
dup v2.4s, v0.s[2]
dup v0.4s, v0.s[0]
ld1 {v0.4s}, [x2]
dup v1.4s, v0.s[1]
dup v2.4s, v0.s[2]
dup v0.4s, v0.s[0]
add w1, w1, #2
sub x1, x0, x1, lsl #2
add w1, w1, #2
sub x1, x0, x1, lsl #2
ld1 {v3.4s}, [x1]
fmul v3.4s, v3.4s, v2.4s
ld1 {v3.4s}, [x1]
fmul v3.4s, v3.4s, v2.4s
1: add x1, x1, #4
ld1 {v4.4s}, [x1]
add x1, x1, #4
ld1 {v5.4s}, [x1]
add x1, x1, #4
ld1 {v6.4s}, [x1]
add x1, x1, #4
ld1 {v7.4s}, [x1]
1: add x1, x1, #4
ld1 {v4.4s}, [x1]
add x1, x1, #4
ld1 {v5.4s}, [x1]
add x1, x1, #4
ld1 {v6.4s}, [x1]
add x1, x1, #4
ld1 {v7.4s}, [x1]
fmla v3.4s, v7.4s, v2.4s
fadd v6.4s, v6.4s, v4.4s
fmla v3.4s, v7.4s, v2.4s
fadd v6.4s, v6.4s, v4.4s
ld1 {v4.4s}, [x0]
fmla v4.4s, v5.4s, v0.4s
ld1 {v4.4s}, [x0]
fmla v4.4s, v5.4s, v0.4s
fmul v6.4s, v6.4s, v1.4s
fadd v6.4s, v6.4s, v3.4s
fmul v6.4s, v6.4s, v1.4s
fadd v6.4s, v6.4s, v3.4s
fadd v4.4s, v4.4s, v6.4s
fmul v3.4s, v7.4s, v2.4s
fadd v4.4s, v4.4s, v6.4s
fmul v3.4s, v7.4s, v2.4s
st1 {v4.4s}, [x0], #16
st1 {v4.4s}, [x0], #16
subs w3, w3, #4
b.gt 1b
subs w3, w3, #4
b.gt 1b
ret
endfunc
+147 -147
View File
@@ -46,49 +46,49 @@ function ff_sbr_sum64x5_neon, export=1
add x3, x0, #192*4
add x4, x0, #256*4
mov x5, #64
1: ld1 {v0.4S}, [x0]
ld1 {v1.4S}, [x1], #16
fadd v0.4S, v0.4S, v1.4S
ld1 {v2.4S}, [x2], #16
fadd v0.4S, v0.4S, v2.4S
ld1 {v3.4S}, [x3], #16
fadd v0.4S, v0.4S, v3.4S
ld1 {v4.4S}, [x4], #16
fadd v0.4S, v0.4S, v4.4S
st1 {v0.4S}, [x0], #16
1: ld1 {v0.4s}, [x0]
ld1 {v1.4s}, [x1], #16
fadd v0.4s, v0.4s, v1.4s
ld1 {v2.4s}, [x2], #16
fadd v0.4s, v0.4s, v2.4s
ld1 {v3.4s}, [x3], #16
fadd v0.4s, v0.4s, v3.4s
ld1 {v4.4s}, [x4], #16
fadd v0.4s, v0.4s, v4.4s
st1 {v0.4s}, [x0], #16
subs x5, x5, #4
b.gt 1b
ret
endfunc
function ff_sbr_sum_square_neon, export=1
movi v0.4S, #0
1: ld1 {v1.4S}, [x0], #16
fmla v0.4S, v1.4S, v1.4S
movi v0.4s, #0
1: ld1 {v1.4s}, [x0], #16
fmla v0.4s, v1.4s, v1.4s
subs w1, w1, #2
b.gt 1b
faddp v0.4S, v0.4S, v0.4S
faddp v0.4S, v0.4S, v0.4S
faddp v0.4s, v0.4s, v0.4s
faddp v0.4s, v0.4s, v0.4s
ret
endfunc
function ff_sbr_neg_odd_64_neon, export=1
mov x1, x0
movi v5.4S, #1<<7, lsl #24
ld2 {v0.4S, v1.4S}, [x0], #32
eor v1.16B, v1.16B, v5.16B
ld2 {v2.4S, v3.4S}, [x0], #32
movi v5.4s, #1<<7, lsl #24
ld2 {v0.4s, v1.4s}, [x0], #32
eor v1.16b, v1.16b, v5.16b
ld2 {v2.4s, v3.4s}, [x0], #32
.rept 3
st2 {v0.4S, v1.4S}, [x1], #32
eor v3.16B, v3.16B, v5.16B
ld2 {v0.4S, v1.4S}, [x0], #32
st2 {v2.4S, v3.4S}, [x1], #32
eor v1.16B, v1.16B, v5.16B
ld2 {v2.4S, v3.4S}, [x0], #32
st2 {v0.4s, v1.4s}, [x1], #32
eor v3.16b, v3.16b, v5.16b
ld2 {v0.4s, v1.4s}, [x0], #32
st2 {v2.4s, v3.4s}, [x1], #32
eor v1.16b, v1.16b, v5.16b
ld2 {v2.4s, v3.4s}, [x0], #32
.endr
eor v3.16B, v3.16B, v5.16B
st2 {v0.4S, v1.4S}, [x1], #32
st2 {v2.4S, v3.4S}, [x1], #32
eor v3.16b, v3.16b, v5.16b
st2 {v0.4s, v1.4s}, [x1], #32
st2 {v2.4s, v3.4s}, [x1], #32
ret
endfunc
@@ -97,26 +97,26 @@ function ff_sbr_qmf_pre_shuffle_neon, export=1
add x2, x0, #64*4
mov x3, #-16
mov x4, #-4
movi v6.4S, #1<<7, lsl #24
ld1 {v0.2S}, [x0], #8
st1 {v0.2S}, [x2], #8
movi v6.4s, #1<<7, lsl #24
ld1 {v0.2s}, [x0], #8
st1 {v0.2s}, [x2], #8
.rept 7
ld1 {v1.4S}, [x1], x3
ld1 {v2.4S}, [x0], #16
eor v1.16B, v1.16B, v6.16B
rev64 v1.4S, v1.4S
ext v1.16B, v1.16B, v1.16B, #8
st2 {v1.4S, v2.4S}, [x2], #32
ld1 {v1.4s}, [x1], x3
ld1 {v2.4s}, [x0], #16
eor v1.16b, v1.16b, v6.16b
rev64 v1.4s, v1.4s
ext v1.16b, v1.16b, v1.16b, #8
st2 {v1.4s, v2.4s}, [x2], #32
.endr
add x1, x1, #8
ld1 {v1.2S}, [x1], x4
ld1 {v2.2S}, [x0], #8
ld1 {v1.S}[3], [x1]
ld1 {v2.S}[2], [x0]
eor v1.16B, v1.16B, v6.16B
rev64 v1.4S, v1.4S
st2 {v1.2S, v2.2S}, [x2], #16
st2 {v1.S, v2.S}[2], [x2]
ld1 {v1.2s}, [x1], x4
ld1 {v2.2s}, [x0], #8
ld1 {v1.s}[3], [x1]
ld1 {v2.s}[2], [x0]
eor v1.16b, v1.16b, v6.16b
rev64 v1.4s, v1.4s
st2 {v1.2s, v2.2s}, [x2], #16
st2 {v1.s, v2.s}[2], [x2]
ret
endfunc
@@ -124,13 +124,13 @@ function ff_sbr_qmf_post_shuffle_neon, export=1
add x2, x1, #60*4
mov x3, #-16
mov x4, #32
movi v6.4S, #1<<7, lsl #24
1: ld1 {v0.4S}, [x2], x3
ld1 {v1.4S}, [x1], #16
eor v0.16B, v0.16B, v6.16B
rev64 v0.4S, v0.4S
ext v0.16B, v0.16B, v0.16B, #8
st2 {v0.4S, v1.4S}, [x0], #32
movi v6.4s, #1<<7, lsl #24
1: ld1 {v0.4s}, [x2], x3
ld1 {v1.4s}, [x1], #16
eor v0.16b, v0.16b, v6.16b
rev64 v0.4s, v0.4s
ext v0.16b, v0.16b, v0.16b, #8
st2 {v0.4s, v1.4s}, [x0], #32
subs x4, x4, #4
b.gt 1b
ret
@@ -141,13 +141,13 @@ function ff_sbr_qmf_deint_neg_neon, export=1
add x2, x0, #60*4
mov x3, #-32
mov x4, #32
movi v2.4S, #1<<7, lsl #24
1: ld2 {v0.4S, v1.4S}, [x1], x3
eor v0.16B, v0.16B, v2.16B
rev64 v1.4S, v1.4S
ext v1.16B, v1.16B, v1.16B, #8
st1 {v0.4S}, [x2]
st1 {v1.4S}, [x0], #16
movi v2.4s, #1<<7, lsl #24
1: ld2 {v0.4s, v1.4s}, [x1], x3
eor v0.16b, v0.16b, v2.16b
rev64 v1.4s, v1.4s
ext v1.16b, v1.16b, v1.16b, #8
st1 {v0.4s}, [x2]
st1 {v1.4s}, [x0], #16
sub x2, x2, #16
subs x4, x4, #4
b.gt 1b
@@ -159,16 +159,16 @@ function ff_sbr_qmf_deint_bfly_neon, export=1
add x3, x0, #124*4
mov x4, #64
mov x5, #-16
1: ld1 {v0.4S}, [x1], #16
ld1 {v1.4S}, [x2], x5
rev64 v2.4S, v0.4S
ext v2.16B, v2.16B, v2.16B, #8
rev64 v3.4S, v1.4S
ext v3.16B, v3.16B, v3.16B, #8
fadd v1.4S, v1.4S, v2.4S
fsub v0.4S, v0.4S, v3.4S
st1 {v0.4S}, [x0], #16
st1 {v1.4S}, [x3], x5
1: ld1 {v0.4s}, [x1], #16
ld1 {v1.4s}, [x2], x5
rev64 v2.4s, v0.4s
ext v2.16b, v2.16b, v2.16b, #8
rev64 v3.4s, v1.4s
ext v3.16b, v3.16b, v3.16b, #8
fadd v1.4s, v1.4s, v2.4s
fsub v0.4s, v0.4s, v3.4s
st1 {v0.4s}, [x0], #16
st1 {v1.4s}, [x3], x5
subs x4, x4, #4
b.gt 1b
ret
@@ -178,32 +178,32 @@ function ff_sbr_hf_gen_neon, export=1
sxtw x4, w4
sxtw x5, w5
movrel x6, factors
ld1 {v7.4S}, [x6]
dup v1.4S, v0.S[0]
mov v2.8B, v1.8B
mov v2.S[2], v7.S[0]
mov v2.S[3], v7.S[0]
fmul v1.4S, v1.4S, v2.4S
ld1 {v0.D}[0], [x3]
ld1 {v0.D}[1], [x2]
fmul v0.4S, v0.4S, v1.4S
fmul v1.4S, v0.4S, v7.4S
rev64 v0.4S, v0.4S
ld1 {v7.4s}, [x6]
dup v1.4s, v0.s[0]
mov v2.8b, v1.8b
mov v2.s[2], v7.s[0]
mov v2.s[3], v7.s[0]
fmul v1.4s, v1.4s, v2.4s
ld1 {v0.d}[0], [x3]
ld1 {v0.d}[1], [x2]
fmul v0.4s, v0.4s, v1.4s
fmul v1.4s, v0.4s, v7.4s
rev64 v0.4s, v0.4s
sub x7, x5, x4
add x0, x0, x4, lsl #3
add x1, x1, x4, lsl #3
sub x1, x1, #16
1: ld1 {v2.4S}, [x1], #16
ld1 {v3.2S}, [x1]
fmul v4.4S, v2.4S, v1.4S
fmul v5.4S, v2.4S, v0.4S
faddp v4.4S, v4.4S, v4.4S
faddp v5.4S, v5.4S, v5.4S
faddp v4.4S, v4.4S, v4.4S
faddp v5.4S, v5.4S, v5.4S
mov v4.S[1], v5.S[0]
fadd v4.2S, v4.2S, v3.2S
st1 {v4.2S}, [x0], #8
1: ld1 {v2.4s}, [x1], #16
ld1 {v3.2s}, [x1]
fmul v4.4s, v2.4s, v1.4s
fmul v5.4s, v2.4s, v0.4s
faddp v4.4s, v4.4s, v4.4s
faddp v5.4s, v5.4s, v5.4s
faddp v4.4s, v4.4s, v4.4s
faddp v5.4s, v5.4s, v5.4s
mov v4.s[1], v5.s[0]
fadd v4.2s, v4.2s, v3.2s
st1 {v4.2s}, [x0], #8
sub x1, x1, #8
subs x7, x7, #1
b.gt 1b
@@ -215,10 +215,10 @@ function ff_sbr_hf_g_filt_neon, export=1
sxtw x4, w4
mov x5, #40*2*4
add x1, x1, x4, lsl #3
1: ld1 {v0.2S}, [x1], x5
ld1 {v1.S}[0], [x2], #4
fmul v2.4S, v0.4S, v1.S[0]
st1 {v2.2S}, [x0], #8
1: ld1 {v0.2s}, [x1], x5
ld1 {v1.s}[0], [x2], #4
fmul v2.4s, v0.4s, v1.s[0]
st1 {v2.2s}, [x0], #8
subs x3, x3, #1
b.gt 1b
ret
@@ -227,46 +227,46 @@ endfunc
function ff_sbr_autocorrelate_neon, export=1
mov x2, #38
movrel x3, factors
ld1 {v0.4S}, [x3]
movi v1.4S, #0
movi v2.4S, #0
movi v3.4S, #0
ld1 {v4.2S}, [x0], #8
ld1 {v5.2S}, [x0], #8
fmul v16.2S, v4.2S, v4.2S
fmul v17.2S, v5.2S, v4.S[0]
fmul v18.2S, v5.2S, v4.S[1]
1: ld1 {v5.D}[1], [x0], #8
fmla v1.2S, v4.2S, v4.2S
fmla v2.4S, v5.4S, v4.S[0]
fmla v3.4S, v5.4S, v4.S[1]
mov v4.D[0], v5.D[0]
mov v5.D[0], v5.D[1]
ld1 {v0.4s}, [x3]
movi v1.4s, #0
movi v2.4s, #0
movi v3.4s, #0
ld1 {v4.2s}, [x0], #8
ld1 {v5.2s}, [x0], #8
fmul v16.2s, v4.2s, v4.2s
fmul v17.2s, v5.2s, v4.s[0]
fmul v18.2s, v5.2s, v4.s[1]
1: ld1 {v5.d}[1], [x0], #8
fmla v1.2s, v4.2s, v4.2s
fmla v2.4s, v5.4s, v4.s[0]
fmla v3.4s, v5.4s, v4.s[1]
mov v4.d[0], v5.d[0]
mov v5.d[0], v5.d[1]
subs x2, x2, #1
b.gt 1b
fmul v19.2S, v4.2S, v4.2S
fmul v20.2S, v5.2S, v4.S[0]
fmul v21.2S, v5.2S, v4.S[1]
fadd v22.4S, v2.4S, v20.4S
fsub v22.4S, v22.4S, v17.4S
fadd v23.4S, v3.4S, v21.4S
fsub v23.4S, v23.4S, v18.4S
rev64 v23.4S, v23.4S
fmul v23.4S, v23.4S, v0.4S
fadd v22.4S, v22.4S, v23.4S
st1 {v22.4S}, [x1], #16
fadd v23.2S, v1.2S, v19.2S
fsub v23.2S, v23.2S, v16.2S
faddp v23.2S, v23.2S, v23.2S
st1 {v23.S}[0], [x1]
fmul v19.2s, v4.2s, v4.2s
fmul v20.2s, v5.2s, v4.s[0]
fmul v21.2s, v5.2s, v4.s[1]
fadd v22.4s, v2.4s, v20.4s
fsub v22.4s, v22.4s, v17.4s
fadd v23.4s, v3.4s, v21.4s
fsub v23.4s, v23.4s, v18.4s
rev64 v23.4s, v23.4s
fmul v23.4s, v23.4s, v0.4s
fadd v22.4s, v22.4s, v23.4s
st1 {v22.4s}, [x1], #16
fadd v23.2s, v1.2s, v19.2s
fsub v23.2s, v23.2s, v16.2s
faddp v23.2s, v23.2s, v23.2s
st1 {v23.s}[0], [x1]
add x1, x1, #8
rev64 v3.2S, v3.2S
fmul v3.2S, v3.2S, v0.2S
fadd v2.2S, v2.2S, v3.2S
st1 {v2.2S}, [x1]
rev64 v3.2s, v3.2s
fmul v3.2s, v3.2s, v0.2s
fadd v2.2s, v2.2s, v3.2s
st1 {v2.2s}, [x1]
add x1, x1, #16
faddp v1.2S, v1.2S, v1.2S
st1 {v1.S}[0], [x1]
faddp v1.2s, v1.2s, v1.2s
st1 {v1.s}[0], [x1]
ret
endfunc
@@ -278,25 +278,25 @@ endfunc
1: and x3, x3, #0x1ff
add x8, x7, x3, lsl #3
add x3, x3, #2
ld1 {v2.4S}, [x0]
ld1 {v3.2S}, [x1], #8
ld1 {v4.2S}, [x2], #8
ld1 {v5.4S}, [x8]
mov v6.16B, v2.16B
zip1 v3.4S, v3.4S, v3.4S
zip1 v4.4S, v4.4S, v4.4S
fmla v6.4S, v1.4S, v3.4S
fmla v2.4S, v5.4S, v4.4S
fcmeq v7.4S, v3.4S, #0
bif v2.16B, v6.16B, v7.16B
st1 {v2.4S}, [x0], #16
ld1 {v2.4s}, [x0]
ld1 {v3.2s}, [x1], #8
ld1 {v4.2s}, [x2], #8
ld1 {v5.4s}, [x8]
mov v6.16b, v2.16b
zip1 v3.4s, v3.4s, v3.4s
zip1 v4.4s, v4.4s, v4.4s
fmla v6.4s, v1.4s, v3.4s
fmla v2.4s, v5.4s, v4.4s
fcmeq v7.4s, v3.4s, #0
bif v2.16b, v6.16b, v7.16b
st1 {v2.4s}, [x0], #16
subs x5, x5, #2
b.gt 1b
.endm
function ff_sbr_hf_apply_noise_0_neon, export=1
movrel x9, phi_noise_0
ld1 {v1.4S}, [x9]
ld1 {v1.4s}, [x9]
apply_noise_common
ret
endfunc
@@ -305,14 +305,14 @@ function ff_sbr_hf_apply_noise_1_neon, export=1
movrel x9, phi_noise_1
and x4, x4, #1
add x9, x9, x4, lsl #4
ld1 {v1.4S}, [x9]
ld1 {v1.4s}, [x9]
apply_noise_common
ret
endfunc
function ff_sbr_hf_apply_noise_2_neon, export=1
movrel x9, phi_noise_2
ld1 {v1.4S}, [x9]
ld1 {v1.4s}, [x9]
apply_noise_common
ret
endfunc
@@ -321,7 +321,7 @@ function ff_sbr_hf_apply_noise_3_neon, export=1
movrel x9, phi_noise_3
and x4, x4, #1
add x9, x9, x4, lsl #4
ld1 {v1.4S}, [x9]
ld1 {v1.4s}, [x9]
apply_noise_common
ret
endfunc
+190 -190
View File
@@ -54,7 +54,7 @@ endconst
prfm pldl1keep, [\data]
mov x10, x30
movrel x3, idct_coeff_neon
ld1 {v0.2D}, [x3]
ld1 {v0.2d}, [x3]
.endm
.macro idct_end
@@ -74,146 +74,146 @@ endconst
.endm
.macro idct_col4_top y1, y2, y3, y4, i, l
smull\i v7.4S, \y3\l, z2
smull\i v16.4S, \y3\l, z6
smull\i v17.4S, \y2\l, z1
add v19.4S, v23.4S, v7.4S
smull\i v18.4S, \y2\l, z3
add v20.4S, v23.4S, v16.4S
smull\i v5.4S, \y2\l, z5
sub v21.4S, v23.4S, v16.4S
smull\i v6.4S, \y2\l, z7
sub v22.4S, v23.4S, v7.4S
smull\i v7.4s, \y3\l, z2
smull\i v16.4s, \y3\l, z6
smull\i v17.4s, \y2\l, z1
add v19.4s, v23.4s, v7.4s
smull\i v18.4s, \y2\l, z3
add v20.4s, v23.4s, v16.4s
smull\i v5.4s, \y2\l, z5
sub v21.4s, v23.4s, v16.4s
smull\i v6.4s, \y2\l, z7
sub v22.4s, v23.4s, v7.4s
smlal\i v17.4S, \y4\l, z3
smlsl\i v18.4S, \y4\l, z7
smlsl\i v5.4S, \y4\l, z1
smlsl\i v6.4S, \y4\l, z5
smlal\i v17.4s, \y4\l, z3
smlsl\i v18.4s, \y4\l, z7
smlsl\i v5.4s, \y4\l, z1
smlsl\i v6.4s, \y4\l, z5
.endm
.macro idct_row4_neon y1, y2, y3, y4, pass
ld1 {\y1\().2D,\y2\().2D}, [x2], #32
movi v23.4S, #1<<2, lsl #8
orr v5.16B, \y1\().16B, \y2\().16B
ld1 {\y3\().2D,\y4\().2D}, [x2], #32
orr v6.16B, \y3\().16B, \y4\().16B
orr v5.16B, v5.16B, v6.16B
mov x3, v5.D[1]
smlal v23.4S, \y1\().4H, z4
ld1 {\y1\().2d,\y2\().2d}, [x2], #32
movi v23.4s, #1<<2, lsl #8
orr v5.16b, \y1\().16b, \y2\().16b
ld1 {\y3\().2d,\y4\().2d}, [x2], #32
orr v6.16b, \y3\().16b, \y4\().16b
orr v5.16b, v5.16b, v6.16b
mov x3, v5.d[1]
smlal v23.4s, \y1\().4h, z4
idct_col4_top \y1, \y2, \y3, \y4, 1, .4H
idct_col4_top \y1, \y2, \y3, \y4, 1, .4h
cmp x3, #0
b.eq \pass\()f
smull2 v7.4S, \y1\().8H, z4
smlal2 v17.4S, \y2\().8H, z5
smlsl2 v18.4S, \y2\().8H, z1
smull2 v16.4S, \y3\().8H, z2
smlal2 v5.4S, \y2\().8H, z7
add v19.4S, v19.4S, v7.4S
sub v20.4S, v20.4S, v7.4S
sub v21.4S, v21.4S, v7.4S
add v22.4S, v22.4S, v7.4S
smlal2 v6.4S, \y2\().8H, z3
smull2 v7.4S, \y3\().8H, z6
smlal2 v17.4S, \y4\().8H, z7
smlsl2 v18.4S, \y4\().8H, z5
smlal2 v5.4S, \y4\().8H, z3
smlsl2 v6.4S, \y4\().8H, z1
add v19.4S, v19.4S, v7.4S
sub v20.4S, v20.4S, v16.4S
add v21.4S, v21.4S, v16.4S
sub v22.4S, v22.4S, v7.4S
smull2 v7.4s, \y1\().8h, z4
smlal2 v17.4s, \y2\().8h, z5
smlsl2 v18.4s, \y2\().8h, z1
smull2 v16.4s, \y3\().8h, z2
smlal2 v5.4s, \y2\().8h, z7
add v19.4s, v19.4s, v7.4s
sub v20.4s, v20.4s, v7.4s
sub v21.4s, v21.4s, v7.4s
add v22.4s, v22.4s, v7.4s
smlal2 v6.4s, \y2\().8h, z3
smull2 v7.4s, \y3\().8h, z6
smlal2 v17.4s, \y4\().8h, z7
smlsl2 v18.4s, \y4\().8h, z5
smlal2 v5.4s, \y4\().8h, z3
smlsl2 v6.4s, \y4\().8h, z1
add v19.4s, v19.4s, v7.4s
sub v20.4s, v20.4s, v16.4s
add v21.4s, v21.4s, v16.4s
sub v22.4s, v22.4s, v7.4s
\pass: add \y3\().4S, v19.4S, v17.4S
add \y4\().4S, v20.4S, v18.4S
shrn \y1\().4H, \y3\().4S, #ROW_SHIFT
shrn \y2\().4H, \y4\().4S, #ROW_SHIFT
add v7.4S, v21.4S, v5.4S
add v16.4S, v22.4S, v6.4S
shrn \y3\().4H, v7.4S, #ROW_SHIFT
shrn \y4\().4H, v16.4S, #ROW_SHIFT
sub v22.4S, v22.4S, v6.4S
sub v19.4S, v19.4S, v17.4S
sub v21.4S, v21.4S, v5.4S
shrn2 \y1\().8H, v22.4S, #ROW_SHIFT
sub v20.4S, v20.4S, v18.4S
shrn2 \y2\().8H, v21.4S, #ROW_SHIFT
shrn2 \y3\().8H, v20.4S, #ROW_SHIFT
shrn2 \y4\().8H, v19.4S, #ROW_SHIFT
add \y4\().4s, v20.4s, v18.4s
shrn \y1\().4h, \y3\().4s, #ROW_SHIFT
shrn \y2\().4h, \y4\().4s, #ROW_SHIFT
add v7.4s, v21.4s, v5.4s
add v16.4s, v22.4s, v6.4s
shrn \y3\().4h, v7.4s, #ROW_SHIFT
shrn \y4\().4h, v16.4s, #ROW_SHIFT
sub v22.4s, v22.4s, v6.4s
sub v19.4s, v19.4s, v17.4s
sub v21.4s, v21.4s, v5.4s
shrn2 \y1\().8h, v22.4s, #ROW_SHIFT
sub v20.4s, v20.4s, v18.4s
shrn2 \y2\().8h, v21.4s, #ROW_SHIFT
shrn2 \y3\().8h, v20.4s, #ROW_SHIFT
shrn2 \y4\().8h, v19.4s, #ROW_SHIFT
trn1 v16.8H, \y1\().8H, \y2\().8H
trn2 v17.8H, \y1\().8H, \y2\().8H
trn1 v18.8H, \y3\().8H, \y4\().8H
trn2 v19.8H, \y3\().8H, \y4\().8H
trn1 \y1\().4S, v16.4S, v18.4S
trn1 \y2\().4S, v17.4S, v19.4S
trn2 \y3\().4S, v16.4S, v18.4S
trn2 \y4\().4S, v17.4S, v19.4S
trn1 v16.8h, \y1\().8h, \y2\().8h
trn2 v17.8h, \y1\().8h, \y2\().8h
trn1 v18.8h, \y3\().8h, \y4\().8h
trn2 v19.8h, \y3\().8h, \y4\().8h
trn1 \y1\().4s, v16.4s, v18.4s
trn1 \y2\().4s, v17.4s, v19.4s
trn2 \y3\().4s, v16.4s, v18.4s
trn2 \y4\().4s, v17.4s, v19.4s
.endm
.macro declare_idct_col4_neon i, l
function idct_col4_neon\i
dup v23.4H, z4c
dup v23.4h, z4c
.if \i == 1
add v23.4H, v23.4H, v24.4H
add v23.4h, v23.4h, v24.4h
.else
mov v5.D[0], v24.D[1]
add v23.4H, v23.4H, v5.4H
mov v5.d[0], v24.d[1]
add v23.4h, v23.4h, v5.4h
.endif
smull v23.4S, v23.4H, z4
smull v23.4s, v23.4h, z4
idct_col4_top v24, v25, v26, v27, \i, \l
mov x4, v28.D[\i - 1]
mov x5, v29.D[\i - 1]
mov x4, v28.d[\i - 1]
mov x5, v29.d[\i - 1]
cmp x4, #0
b.eq 1f
smull\i v7.4S, v28\l, z4
add v19.4S, v19.4S, v7.4S
sub v20.4S, v20.4S, v7.4S
sub v21.4S, v21.4S, v7.4S
add v22.4S, v22.4S, v7.4S
smull\i v7.4s, v28\l, z4
add v19.4s, v19.4s, v7.4s
sub v20.4s, v20.4s, v7.4s
sub v21.4s, v21.4s, v7.4s
add v22.4s, v22.4s, v7.4s
1: mov x4, v30.D[\i - 1]
1: mov x4, v30.d[\i - 1]
cmp x5, #0
b.eq 2f
smlal\i v17.4S, v29\l, z5
smlsl\i v18.4S, v29\l, z1
smlal\i v5.4S, v29\l, z7
smlal\i v6.4S, v29\l, z3
smlal\i v17.4s, v29\l, z5
smlsl\i v18.4s, v29\l, z1
smlal\i v5.4s, v29\l, z7
smlal\i v6.4s, v29\l, z3
2: mov x5, v31.D[\i - 1]
2: mov x5, v31.d[\i - 1]
cmp x4, #0
b.eq 3f
smull\i v7.4S, v30\l, z6
smull\i v16.4S, v30\l, z2
add v19.4S, v19.4S, v7.4S
sub v22.4S, v22.4S, v7.4S
sub v20.4S, v20.4S, v16.4S
add v21.4S, v21.4S, v16.4S
smull\i v7.4s, v30\l, z6
smull\i v16.4s, v30\l, z2
add v19.4s, v19.4s, v7.4s
sub v22.4s, v22.4s, v7.4s
sub v20.4s, v20.4s, v16.4s
add v21.4s, v21.4s, v16.4s
3: cmp x5, #0
b.eq 4f
smlal\i v17.4S, v31\l, z7
smlsl\i v18.4S, v31\l, z5
smlal\i v5.4S, v31\l, z3
smlsl\i v6.4S, v31\l, z1
smlal\i v17.4s, v31\l, z7
smlsl\i v18.4s, v31\l, z5
smlal\i v5.4s, v31\l, z3
smlsl\i v6.4s, v31\l, z1
4: addhn v7.4H, v19.4S, v17.4S
addhn2 v7.8H, v20.4S, v18.4S
subhn v18.4H, v20.4S, v18.4S
subhn2 v18.8H, v19.4S, v17.4S
4: addhn v7.4h, v19.4s, v17.4s
addhn2 v7.8h, v20.4s, v18.4s
subhn v18.4h, v20.4s, v18.4s
subhn2 v18.8h, v19.4s, v17.4s
addhn v16.4H, v21.4S, v5.4S
addhn2 v16.8H, v22.4S, v6.4S
subhn v17.4H, v22.4S, v6.4S
subhn2 v17.8H, v21.4S, v5.4S
addhn v16.4h, v21.4s, v5.4s
addhn2 v16.8h, v22.4s, v6.4s
subhn v17.4h, v22.4s, v6.4s
subhn2 v17.8h, v21.4s, v5.4s
ret
endfunc
@@ -229,33 +229,33 @@ function ff_simple_idct_put_neon, export=1
idct_row4_neon v28, v29, v30, v31, 2
bl idct_col4_neon1
sqshrun v1.8B, v7.8H, #COL_SHIFT-16
sqshrun2 v1.16B, v16.8H, #COL_SHIFT-16
sqshrun v3.8B, v17.8H, #COL_SHIFT-16
sqshrun2 v3.16B, v18.8H, #COL_SHIFT-16
sqshrun v1.8b, v7.8h, #COL_SHIFT-16
sqshrun2 v1.16b, v16.8h, #COL_SHIFT-16
sqshrun v3.8b, v17.8h, #COL_SHIFT-16
sqshrun2 v3.16b, v18.8h, #COL_SHIFT-16
bl idct_col4_neon2
sqshrun v2.8B, v7.8H, #COL_SHIFT-16
sqshrun2 v2.16B, v16.8H, #COL_SHIFT-16
sqshrun v4.8B, v17.8H, #COL_SHIFT-16
sqshrun2 v4.16B, v18.8H, #COL_SHIFT-16
sqshrun v2.8b, v7.8h, #COL_SHIFT-16
sqshrun2 v2.16b, v16.8h, #COL_SHIFT-16
sqshrun v4.8b, v17.8h, #COL_SHIFT-16
sqshrun2 v4.16b, v18.8h, #COL_SHIFT-16
zip1 v16.4S, v1.4S, v2.4S
zip2 v17.4S, v1.4S, v2.4S
zip1 v16.4s, v1.4s, v2.4s
zip2 v17.4s, v1.4s, v2.4s
st1 {v16.D}[0], [x0], x1
st1 {v16.D}[1], [x0], x1
st1 {v16.d}[0], [x0], x1
st1 {v16.d}[1], [x0], x1
zip1 v18.4S, v3.4S, v4.4S
zip2 v19.4S, v3.4S, v4.4S
zip1 v18.4s, v3.4s, v4.4s
zip2 v19.4s, v3.4s, v4.4s
st1 {v17.D}[0], [x0], x1
st1 {v17.D}[1], [x0], x1
st1 {v18.D}[0], [x0], x1
st1 {v18.D}[1], [x0], x1
st1 {v19.D}[0], [x0], x1
st1 {v19.D}[1], [x0], x1
st1 {v17.d}[0], [x0], x1
st1 {v17.d}[1], [x0], x1
st1 {v18.d}[0], [x0], x1
st1 {v18.d}[1], [x0], x1
st1 {v19.d}[0], [x0], x1
st1 {v19.d}[1], [x0], x1
idct_end
endfunc
@@ -267,59 +267,59 @@ function ff_simple_idct_add_neon, export=1
idct_row4_neon v28, v29, v30, v31, 2
bl idct_col4_neon1
sshr v1.8H, v7.8H, #COL_SHIFT-16
sshr v2.8H, v16.8H, #COL_SHIFT-16
sshr v3.8H, v17.8H, #COL_SHIFT-16
sshr v4.8H, v18.8H, #COL_SHIFT-16
sshr v1.8h, v7.8h, #COL_SHIFT-16
sshr v2.8h, v16.8h, #COL_SHIFT-16
sshr v3.8h, v17.8h, #COL_SHIFT-16
sshr v4.8h, v18.8h, #COL_SHIFT-16
bl idct_col4_neon2
sshr v7.8H, v7.8H, #COL_SHIFT-16
sshr v16.8H, v16.8H, #COL_SHIFT-16
sshr v17.8H, v17.8H, #COL_SHIFT-16
sshr v18.8H, v18.8H, #COL_SHIFT-16
sshr v7.8h, v7.8h, #COL_SHIFT-16
sshr v16.8h, v16.8h, #COL_SHIFT-16
sshr v17.8h, v17.8h, #COL_SHIFT-16
sshr v18.8h, v18.8h, #COL_SHIFT-16
mov x9, x0
ld1 {v19.D}[0], [x0], x1
zip1 v23.2D, v1.2D, v7.2D
zip2 v24.2D, v1.2D, v7.2D
ld1 {v19.D}[1], [x0], x1
zip1 v25.2D, v2.2D, v16.2D
zip2 v26.2D, v2.2D, v16.2D
ld1 {v20.D}[0], [x0], x1
zip1 v27.2D, v3.2D, v17.2D
zip2 v28.2D, v3.2D, v17.2D
ld1 {v20.D}[1], [x0], x1
zip1 v29.2D, v4.2D, v18.2D
zip2 v30.2D, v4.2D, v18.2D
ld1 {v21.D}[0], [x0], x1
uaddw v23.8H, v23.8H, v19.8B
uaddw2 v24.8H, v24.8H, v19.16B
ld1 {v21.D}[1], [x0], x1
sqxtun v23.8B, v23.8H
sqxtun2 v23.16B, v24.8H
ld1 {v22.D}[0], [x0], x1
uaddw v24.8H, v25.8H, v20.8B
uaddw2 v25.8H, v26.8H, v20.16B
ld1 {v22.D}[1], [x0], x1
sqxtun v24.8B, v24.8H
sqxtun2 v24.16B, v25.8H
st1 {v23.D}[0], [x9], x1
uaddw v25.8H, v27.8H, v21.8B
uaddw2 v26.8H, v28.8H, v21.16B
st1 {v23.D}[1], [x9], x1
sqxtun v25.8B, v25.8H
sqxtun2 v25.16B, v26.8H
st1 {v24.D}[0], [x9], x1
uaddw v26.8H, v29.8H, v22.8B
uaddw2 v27.8H, v30.8H, v22.16B
st1 {v24.D}[1], [x9], x1
sqxtun v26.8B, v26.8H
sqxtun2 v26.16B, v27.8H
st1 {v25.D}[0], [x9], x1
st1 {v25.D}[1], [x9], x1
st1 {v26.D}[0], [x9], x1
st1 {v26.D}[1], [x9], x1
ld1 {v19.d}[0], [x0], x1
zip1 v23.2d, v1.2d, v7.2d
zip2 v24.2d, v1.2d, v7.2d
ld1 {v19.d}[1], [x0], x1
zip1 v25.2d, v2.2d, v16.2d
zip2 v26.2d, v2.2d, v16.2d
ld1 {v20.d}[0], [x0], x1
zip1 v27.2d, v3.2d, v17.2d
zip2 v28.2d, v3.2d, v17.2d
ld1 {v20.d}[1], [x0], x1
zip1 v29.2d, v4.2d, v18.2d
zip2 v30.2d, v4.2d, v18.2d
ld1 {v21.d}[0], [x0], x1
uaddw v23.8h, v23.8h, v19.8b
uaddw2 v24.8h, v24.8h, v19.16b
ld1 {v21.d}[1], [x0], x1
sqxtun v23.8b, v23.8h
sqxtun2 v23.16b, v24.8h
ld1 {v22.d}[0], [x0], x1
uaddw v24.8h, v25.8h, v20.8b
uaddw2 v25.8h, v26.8h, v20.16b
ld1 {v22.d}[1], [x0], x1
sqxtun v24.8b, v24.8h
sqxtun2 v24.16b, v25.8h
st1 {v23.d}[0], [x9], x1
uaddw v25.8h, v27.8h, v21.8b
uaddw2 v26.8h, v28.8h, v21.16b
st1 {v23.d}[1], [x9], x1
sqxtun v25.8b, v25.8h
sqxtun2 v25.16b, v26.8h
st1 {v24.d}[0], [x9], x1
uaddw v26.8h, v29.8h, v22.8b
uaddw2 v27.8h, v30.8h, v22.16b
st1 {v24.d}[1], [x9], x1
sqxtun v26.8b, v26.8h
sqxtun2 v26.16b, v27.8h
st1 {v25.d}[0], [x9], x1
st1 {v25.d}[1], [x9], x1
st1 {v26.d}[0], [x9], x1
st1 {v26.d}[1], [x9], x1
idct_end
endfunc
@@ -333,30 +333,30 @@ function ff_simple_idct_neon, export=1
sub x2, x2, #128
bl idct_col4_neon1
sshr v1.8H, v7.8H, #COL_SHIFT-16
sshr v2.8H, v16.8H, #COL_SHIFT-16
sshr v3.8H, v17.8H, #COL_SHIFT-16
sshr v4.8H, v18.8H, #COL_SHIFT-16
sshr v1.8h, v7.8h, #COL_SHIFT-16
sshr v2.8h, v16.8h, #COL_SHIFT-16
sshr v3.8h, v17.8h, #COL_SHIFT-16
sshr v4.8h, v18.8h, #COL_SHIFT-16
bl idct_col4_neon2
sshr v7.8H, v7.8H, #COL_SHIFT-16
sshr v16.8H, v16.8H, #COL_SHIFT-16
sshr v17.8H, v17.8H, #COL_SHIFT-16
sshr v18.8H, v18.8H, #COL_SHIFT-16
sshr v7.8h, v7.8h, #COL_SHIFT-16
sshr v16.8h, v16.8h, #COL_SHIFT-16
sshr v17.8h, v17.8h, #COL_SHIFT-16
sshr v18.8h, v18.8h, #COL_SHIFT-16
zip1 v23.2D, v1.2D, v7.2D
zip2 v24.2D, v1.2D, v7.2D
st1 {v23.2D,v24.2D}, [x2], #32
zip1 v25.2D, v2.2D, v16.2D
zip2 v26.2D, v2.2D, v16.2D
st1 {v25.2D,v26.2D}, [x2], #32
zip1 v27.2D, v3.2D, v17.2D
zip2 v28.2D, v3.2D, v17.2D
st1 {v27.2D,v28.2D}, [x2], #32
zip1 v29.2D, v4.2D, v18.2D
zip2 v30.2D, v4.2D, v18.2D
st1 {v29.2D,v30.2D}, [x2], #32
zip1 v23.2d, v1.2d, v7.2d
zip2 v24.2d, v1.2d, v7.2d
st1 {v23.2d,v24.2d}, [x2], #32
zip1 v25.2d, v2.2d, v16.2d
zip2 v26.2d, v2.2d, v16.2d
st1 {v25.2d,v26.2d}, [x2], #32
zip1 v27.2d, v3.2d, v17.2d
zip2 v28.2d, v3.2d, v17.2d
st1 {v27.2d,v28.2d}, [x2], #32
zip1 v29.2d, v4.2d, v18.2d
zip2 v30.2d, v4.2d, v18.2d
st1 {v29.2d,v30.2d}, [x2], #32
idct_end
endfunc
+151 -151
View File
@@ -330,32 +330,32 @@ endfunc
// v17: hev
// convert to signed value:
eor v3.16b, v3.16b, v21.16b // PS0 = P0 ^ 0x80
eor v4.16b, v4.16b, v21.16b // QS0 = Q0 ^ 0x80
eor v3.16b, v3.16b, v21.16b // PS0 = P0 ^ 0x80
eor v4.16b, v4.16b, v21.16b // QS0 = Q0 ^ 0x80
movi v20.8h, #3
ssubl v18.8h, v4.8b, v3.8b // QS0 - PS0
ssubl2 v19.8h, v4.16b, v3.16b // (widened to 16bit)
eor v2.16b, v2.16b, v21.16b // PS1 = P1 ^ 0x80
eor v5.16b, v5.16b, v21.16b // QS1 = Q1 ^ 0x80
mul v18.8h, v18.8h, v20.8h // w = 3 * (QS0 - PS0)
mul v19.8h, v19.8h, v20.8h
movi v20.8h, #3
ssubl v18.8h, v4.8b, v3.8b // QS0 - PS0
ssubl2 v19.8h, v4.16b, v3.16b // (widened to 16bit)
eor v2.16b, v2.16b, v21.16b // PS1 = P1 ^ 0x80
eor v5.16b, v5.16b, v21.16b // QS1 = Q1 ^ 0x80
mul v18.8h, v18.8h, v20.8h // w = 3 * (QS0 - PS0)
mul v19.8h, v19.8h, v20.8h
sqsub v20.16b, v2.16b, v5.16b // clamp(PS1-QS1)
movi v22.16b, #4
movi v23.16b, #3
sqsub v20.16b, v2.16b, v5.16b // clamp(PS1-QS1)
movi v22.16b, #4
movi v23.16b, #3
.if \inner
and v20.16b, v20.16b, v17.16b // if(hev) w += clamp(PS1-QS1)
and v20.16b, v20.16b, v17.16b // if(hev) w += clamp(PS1-QS1)
.endif
saddw v18.8h, v18.8h, v20.8b // w += clamp(PS1-QS1)
saddw2 v19.8h, v19.8h, v20.16b
sqxtn v18.8b, v18.8h // narrow result back into v18
sqxtn2 v18.16b, v19.8h
saddw v18.8h, v18.8h, v20.8b // w += clamp(PS1-QS1)
saddw2 v19.8h, v19.8h, v20.16b
sqxtn v18.8b, v18.8h // narrow result back into v18
sqxtn2 v18.16b, v19.8h
.if !\inner && !\simple
eor v1.16b, v1.16b, v21.16b // PS2 = P2 ^ 0x80
eor v6.16b, v6.16b, v21.16b // QS2 = Q2 ^ 0x80
eor v1.16b, v1.16b, v21.16b // PS2 = P2 ^ 0x80
eor v6.16b, v6.16b, v21.16b // QS2 = Q2 ^ 0x80
.endif
and v18.16b, v18.16b, v16.16b // w &= normal_limit
and v18.16b, v18.16b, v16.16b // w &= normal_limit
// registers used at this point..
// v0 -> P3 (don't corrupt)
@@ -375,44 +375,44 @@ endfunc
// P0 = s2u(PS0 + c2);
.if \simple
sqadd v19.16b, v18.16b, v22.16b // c1 = clamp((w&hev)+4)
sqadd v20.16b, v18.16b, v23.16b // c2 = clamp((w&hev)+3)
sshr v19.16b, v19.16b, #3 // c1 >>= 3
sshr v20.16b, v20.16b, #3 // c2 >>= 3
sqsub v4.16b, v4.16b, v19.16b // QS0 = clamp(QS0-c1)
sqadd v3.16b, v3.16b, v20.16b // PS0 = clamp(PS0+c2)
eor v4.16b, v4.16b, v21.16b // Q0 = QS0 ^ 0x80
eor v3.16b, v3.16b, v21.16b // P0 = PS0 ^ 0x80
eor v5.16b, v5.16b, v21.16b // Q1 = QS1 ^ 0x80
eor v2.16b, v2.16b, v21.16b // P1 = PS1 ^ 0x80
sqadd v19.16b, v18.16b, v22.16b // c1 = clamp((w&hev)+4)
sqadd v20.16b, v18.16b, v23.16b // c2 = clamp((w&hev)+3)
sshr v19.16b, v19.16b, #3 // c1 >>= 3
sshr v20.16b, v20.16b, #3 // c2 >>= 3
sqsub v4.16b, v4.16b, v19.16b // QS0 = clamp(QS0-c1)
sqadd v3.16b, v3.16b, v20.16b // PS0 = clamp(PS0+c2)
eor v4.16b, v4.16b, v21.16b // Q0 = QS0 ^ 0x80
eor v3.16b, v3.16b, v21.16b // P0 = PS0 ^ 0x80
eor v5.16b, v5.16b, v21.16b // Q1 = QS1 ^ 0x80
eor v2.16b, v2.16b, v21.16b // P1 = PS1 ^ 0x80
.elseif \inner
// the !is4tap case of filter_common, only used for inner blocks
// c3 = ((c1&~hev) + 1) >> 1;
// Q1 = s2u(QS1 - c3);
// P1 = s2u(PS1 + c3);
sqadd v19.16b, v18.16b, v22.16b // c1 = clamp((w&hev)+4)
sqadd v20.16b, v18.16b, v23.16b // c2 = clamp((w&hev)+3)
sshr v19.16b, v19.16b, #3 // c1 >>= 3
sshr v20.16b, v20.16b, #3 // c2 >>= 3
sqsub v4.16b, v4.16b, v19.16b // QS0 = clamp(QS0-c1)
sqadd v3.16b, v3.16b, v20.16b // PS0 = clamp(PS0+c2)
bic v19.16b, v19.16b, v17.16b // c1 & ~hev
eor v4.16b, v4.16b, v21.16b // Q0 = QS0 ^ 0x80
srshr v19.16b, v19.16b, #1 // c3 >>= 1
eor v3.16b, v3.16b, v21.16b // P0 = PS0 ^ 0x80
sqsub v5.16b, v5.16b, v19.16b // QS1 = clamp(QS1-c3)
sqadd v2.16b, v2.16b, v19.16b // PS1 = clamp(PS1+c3)
eor v5.16b, v5.16b, v21.16b // Q1 = QS1 ^ 0x80
eor v2.16b, v2.16b, v21.16b // P1 = PS1 ^ 0x80
sqadd v19.16b, v18.16b, v22.16b // c1 = clamp((w&hev)+4)
sqadd v20.16b, v18.16b, v23.16b // c2 = clamp((w&hev)+3)
sshr v19.16b, v19.16b, #3 // c1 >>= 3
sshr v20.16b, v20.16b, #3 // c2 >>= 3
sqsub v4.16b, v4.16b, v19.16b // QS0 = clamp(QS0-c1)
sqadd v3.16b, v3.16b, v20.16b // PS0 = clamp(PS0+c2)
bic v19.16b, v19.16b, v17.16b // c1 & ~hev
eor v4.16b, v4.16b, v21.16b // Q0 = QS0 ^ 0x80
srshr v19.16b, v19.16b, #1 // c3 >>= 1
eor v3.16b, v3.16b, v21.16b // P0 = PS0 ^ 0x80
sqsub v5.16b, v5.16b, v19.16b // QS1 = clamp(QS1-c3)
sqadd v2.16b, v2.16b, v19.16b // PS1 = clamp(PS1+c3)
eor v5.16b, v5.16b, v21.16b // Q1 = QS1 ^ 0x80
eor v2.16b, v2.16b, v21.16b // P1 = PS1 ^ 0x80
.else
and v20.16b, v18.16b, v17.16b // w & hev
sqadd v19.16b, v20.16b, v22.16b // c1 = clamp((w&hev)+4)
sqadd v20.16b, v20.16b, v23.16b // c2 = clamp((w&hev)+3)
sshr v19.16b, v19.16b, #3 // c1 >>= 3
sshr v20.16b, v20.16b, #3 // c2 >>= 3
bic v18.16b, v18.16b, v17.16b // w &= ~hev
sqsub v4.16b, v4.16b, v19.16b // QS0 = clamp(QS0-c1)
sqadd v3.16b, v3.16b, v20.16b // PS0 = clamp(PS0+c2)
and v20.16b, v18.16b, v17.16b // w & hev
sqadd v19.16b, v20.16b, v22.16b // c1 = clamp((w&hev)+4)
sqadd v20.16b, v20.16b, v23.16b // c2 = clamp((w&hev)+3)
sshr v19.16b, v19.16b, #3 // c1 >>= 3
sshr v20.16b, v20.16b, #3 // c2 >>= 3
bic v18.16b, v18.16b, v17.16b // w &= ~hev
sqsub v4.16b, v4.16b, v19.16b // QS0 = clamp(QS0-c1)
sqadd v3.16b, v3.16b, v20.16b // PS0 = clamp(PS0+c2)
// filter_mbedge:
// a = clamp((27*w + 63) >> 7);
@@ -424,35 +424,35 @@ endfunc
// a = clamp((9*w + 63) >> 7);
// Q2 = s2u(QS2 - a);
// P2 = s2u(PS2 + a);
movi v17.8h, #63
sshll v22.8h, v18.8b, #3
sshll2 v23.8h, v18.16b, #3
saddw v22.8h, v22.8h, v18.8b
saddw2 v23.8h, v23.8h, v18.16b
add v16.8h, v17.8h, v22.8h
add v17.8h, v17.8h, v23.8h // 9*w + 63
add v19.8h, v16.8h, v22.8h
add v20.8h, v17.8h, v23.8h // 18*w + 63
add v22.8h, v19.8h, v22.8h
add v23.8h, v20.8h, v23.8h // 27*w + 63
sqshrn v16.8b, v16.8h, #7
sqshrn2 v16.16b, v17.8h, #7 // clamp(( 9*w + 63)>>7)
sqshrn v19.8b, v19.8h, #7
sqshrn2 v19.16b, v20.8h, #7 // clamp((18*w + 63)>>7)
sqshrn v22.8b, v22.8h, #7
sqshrn2 v22.16b, v23.8h, #7 // clamp((27*w + 63)>>7)
sqadd v1.16b, v1.16b, v16.16b // PS2 = clamp(PS2+a)
sqsub v6.16b, v6.16b, v16.16b // QS2 = clamp(QS2-a)
sqadd v2.16b, v2.16b, v19.16b // PS1 = clamp(PS1+a)
sqsub v5.16b, v5.16b, v19.16b // QS1 = clamp(QS1-a)
sqadd v3.16b, v3.16b, v22.16b // PS0 = clamp(PS0+a)
sqsub v4.16b, v4.16b, v22.16b // QS0 = clamp(QS0-a)
eor v3.16b, v3.16b, v21.16b // P0 = PS0 ^ 0x80
eor v4.16b, v4.16b, v21.16b // Q0 = QS0 ^ 0x80
eor v2.16b, v2.16b, v21.16b // P1 = PS1 ^ 0x80
eor v5.16b, v5.16b, v21.16b // Q1 = QS1 ^ 0x80
eor v1.16b, v1.16b, v21.16b // P2 = PS2 ^ 0x80
eor v6.16b, v6.16b, v21.16b // Q2 = QS2 ^ 0x80
movi v17.8h, #63
sshll v22.8h, v18.8b, #3
sshll2 v23.8h, v18.16b, #3
saddw v22.8h, v22.8h, v18.8b
saddw2 v23.8h, v23.8h, v18.16b
add v16.8h, v17.8h, v22.8h
add v17.8h, v17.8h, v23.8h // 9*w + 63
add v19.8h, v16.8h, v22.8h
add v20.8h, v17.8h, v23.8h // 18*w + 63
add v22.8h, v19.8h, v22.8h
add v23.8h, v20.8h, v23.8h // 27*w + 63
sqshrn v16.8b, v16.8h, #7
sqshrn2 v16.16b, v17.8h, #7 // clamp(( 9*w + 63)>>7)
sqshrn v19.8b, v19.8h, #7
sqshrn2 v19.16b, v20.8h, #7 // clamp((18*w + 63)>>7)
sqshrn v22.8b, v22.8h, #7
sqshrn2 v22.16b, v23.8h, #7 // clamp((27*w + 63)>>7)
sqadd v1.16b, v1.16b, v16.16b // PS2 = clamp(PS2+a)
sqsub v6.16b, v6.16b, v16.16b // QS2 = clamp(QS2-a)
sqadd v2.16b, v2.16b, v19.16b // PS1 = clamp(PS1+a)
sqsub v5.16b, v5.16b, v19.16b // QS1 = clamp(QS1-a)
sqadd v3.16b, v3.16b, v22.16b // PS0 = clamp(PS0+a)
sqsub v4.16b, v4.16b, v22.16b // QS0 = clamp(QS0-a)
eor v3.16b, v3.16b, v21.16b // P0 = PS0 ^ 0x80
eor v4.16b, v4.16b, v21.16b // Q0 = QS0 ^ 0x80
eor v2.16b, v2.16b, v21.16b // P1 = PS1 ^ 0x80
eor v5.16b, v5.16b, v21.16b // Q1 = QS1 ^ 0x80
eor v1.16b, v1.16b, v21.16b // P2 = PS2 ^ 0x80
eor v6.16b, v6.16b, v21.16b // Q2 = QS2 ^ 0x80
.endif
.endm
@@ -507,48 +507,48 @@ function ff_vp8_v_loop_filter8uv\name\()_neon, export=1
sub x0, x0, x2, lsl #2
sub x1, x1, x2, lsl #2
// Load pixels:
ld1 {v0.d}[0], [x0], x2 // P3
ld1 {v0.d}[1], [x1], x2 // P3
ld1 {v1.d}[0], [x0], x2 // P2
ld1 {v1.d}[1], [x1], x2 // P2
ld1 {v2.d}[0], [x0], x2 // P1
ld1 {v2.d}[1], [x1], x2 // P1
ld1 {v3.d}[0], [x0], x2 // P0
ld1 {v3.d}[1], [x1], x2 // P0
ld1 {v4.d}[0], [x0], x2 // Q0
ld1 {v4.d}[1], [x1], x2 // Q0
ld1 {v5.d}[0], [x0], x2 // Q1
ld1 {v5.d}[1], [x1], x2 // Q1
ld1 {v6.d}[0], [x0], x2 // Q2
ld1 {v6.d}[1], [x1], x2 // Q2
ld1 {v7.d}[0], [x0] // Q3
ld1 {v7.d}[1], [x1] // Q3
ld1 {v0.d}[0], [x0], x2 // P3
ld1 {v0.d}[1], [x1], x2 // P3
ld1 {v1.d}[0], [x0], x2 // P2
ld1 {v1.d}[1], [x1], x2 // P2
ld1 {v2.d}[0], [x0], x2 // P1
ld1 {v2.d}[1], [x1], x2 // P1
ld1 {v3.d}[0], [x0], x2 // P0
ld1 {v3.d}[1], [x1], x2 // P0
ld1 {v4.d}[0], [x0], x2 // Q0
ld1 {v4.d}[1], [x1], x2 // Q0
ld1 {v5.d}[0], [x0], x2 // Q1
ld1 {v5.d}[1], [x1], x2 // Q1
ld1 {v6.d}[0], [x0], x2 // Q2
ld1 {v6.d}[1], [x1], x2 // Q2
ld1 {v7.d}[0], [x0] // Q3
ld1 {v7.d}[1], [x1] // Q3
dup v22.16b, w3 // flim_E
dup v23.16b, w4 // flim_I
dup v22.16b, w3 // flim_E
dup v23.16b, w4 // flim_I
vp8_loop_filter inner=\inner, hev_thresh=w5
// back up to P2: u,v -= stride * 6
sub x0, x0, x2, lsl #2
sub x1, x1, x2, lsl #2
sub x0, x0, x2, lsl #1
sub x1, x1, x2, lsl #1
sub x0, x0, x2, lsl #2
sub x1, x1, x2, lsl #2
sub x0, x0, x2, lsl #1
sub x1, x1, x2, lsl #1
// Store pixels:
st1 {v1.d}[0], [x0], x2 // P2
st1 {v1.d}[1], [x1], x2 // P2
st1 {v2.d}[0], [x0], x2 // P1
st1 {v2.d}[1], [x1], x2 // P1
st1 {v3.d}[0], [x0], x2 // P0
st1 {v3.d}[1], [x1], x2 // P0
st1 {v4.d}[0], [x0], x2 // Q0
st1 {v4.d}[1], [x1], x2 // Q0
st1 {v5.d}[0], [x0], x2 // Q1
st1 {v5.d}[1], [x1], x2 // Q1
st1 {v6.d}[0], [x0] // Q2
st1 {v6.d}[1], [x1] // Q2
st1 {v1.d}[0], [x0], x2 // P2
st1 {v1.d}[1], [x1], x2 // P2
st1 {v2.d}[0], [x0], x2 // P1
st1 {v2.d}[1], [x1], x2 // P1
st1 {v3.d}[0], [x0], x2 // P0
st1 {v3.d}[1], [x1], x2 // P0
st1 {v4.d}[0], [x0], x2 // Q0
st1 {v4.d}[1], [x1], x2 // Q0
st1 {v5.d}[0], [x0], x2 // Q1
st1 {v5.d}[1], [x1], x2 // Q1
st1 {v6.d}[0], [x0] // Q2
st1 {v6.d}[1], [x1] // Q2
ret
endfunc
@@ -579,7 +579,7 @@ function ff_vp8_h_loop_filter16\name\()_neon, export=1
ld1 {v6.d}[1], [x0], x1
ld1 {v7.d}[1], [x0], x1
transpose_8x16B v0, v1, v2, v3, v4, v5, v6, v7, v30, v31
transpose_8x16B v0, v1, v2, v3, v4, v5, v6, v7, v30, v31
dup v22.16b, w2 // flim_E
.if !\simple
@@ -590,7 +590,7 @@ function ff_vp8_h_loop_filter16\name\()_neon, export=1
sub x0, x0, x1, lsl #4 // backup 16 rows
transpose_8x16B v0, v1, v2, v3, v4, v5, v6, v7, v30, v31
transpose_8x16B v0, v1, v2, v3, v4, v5, v6, v7, v30, v31
// Store pixels:
st1 {v0.d}[0], [x0], x1
@@ -624,24 +624,24 @@ function ff_vp8_h_loop_filter8uv\name\()_neon, export=1
sub x1, x1, #4
// Load pixels:
ld1 {v0.d}[0], [x0], x2 // load u
ld1 {v0.d}[1], [x1], x2 // load v
ld1 {v1.d}[0], [x0], x2
ld1 {v1.d}[1], [x1], x2
ld1 {v2.d}[0], [x0], x2
ld1 {v2.d}[1], [x1], x2
ld1 {v3.d}[0], [x0], x2
ld1 {v3.d}[1], [x1], x2
ld1 {v4.d}[0], [x0], x2
ld1 {v4.d}[1], [x1], x2
ld1 {v5.d}[0], [x0], x2
ld1 {v5.d}[1], [x1], x2
ld1 {v6.d}[0], [x0], x2
ld1 {v6.d}[1], [x1], x2
ld1 {v7.d}[0], [x0], x2
ld1 {v7.d}[1], [x1], x2
ld1 {v0.d}[0], [x0], x2 // load u
ld1 {v0.d}[1], [x1], x2 // load v
ld1 {v1.d}[0], [x0], x2
ld1 {v1.d}[1], [x1], x2
ld1 {v2.d}[0], [x0], x2
ld1 {v2.d}[1], [x1], x2
ld1 {v3.d}[0], [x0], x2
ld1 {v3.d}[1], [x1], x2
ld1 {v4.d}[0], [x0], x2
ld1 {v4.d}[1], [x1], x2
ld1 {v5.d}[0], [x0], x2
ld1 {v5.d}[1], [x1], x2
ld1 {v6.d}[0], [x0], x2
ld1 {v6.d}[1], [x1], x2
ld1 {v7.d}[0], [x0], x2
ld1 {v7.d}[1], [x1], x2
transpose_8x16B v0, v1, v2, v3, v4, v5, v6, v7, v30, v31
transpose_8x16B v0, v1, v2, v3, v4, v5, v6, v7, v30, v31
dup v22.16b, w3 // flim_E
dup v23.16b, w4 // flim_I
@@ -651,25 +651,25 @@ function ff_vp8_h_loop_filter8uv\name\()_neon, export=1
sub x0, x0, x2, lsl #3 // backup u 8 rows
sub x1, x1, x2, lsl #3 // backup v 8 rows
transpose_8x16B v0, v1, v2, v3, v4, v5, v6, v7, v30, v31
transpose_8x16B v0, v1, v2, v3, v4, v5, v6, v7, v30, v31
// Store pixels:
st1 {v0.d}[0], [x0], x2 // load u
st1 {v0.d}[1], [x1], x2 // load v
st1 {v1.d}[0], [x0], x2
st1 {v1.d}[1], [x1], x2
st1 {v2.d}[0], [x0], x2
st1 {v2.d}[1], [x1], x2
st1 {v3.d}[0], [x0], x2
st1 {v3.d}[1], [x1], x2
st1 {v4.d}[0], [x0], x2
st1 {v4.d}[1], [x1], x2
st1 {v5.d}[0], [x0], x2
st1 {v5.d}[1], [x1], x2
st1 {v6.d}[0], [x0], x2
st1 {v6.d}[1], [x1], x2
st1 {v7.d}[0], [x0]
st1 {v7.d}[1], [x1]
st1 {v0.d}[0], [x0], x2 // load u
st1 {v0.d}[1], [x1], x2 // load v
st1 {v1.d}[0], [x0], x2
st1 {v1.d}[1], [x1], x2
st1 {v2.d}[0], [x0], x2
st1 {v2.d}[1], [x1], x2
st1 {v3.d}[0], [x0], x2
st1 {v3.d}[1], [x1], x2
st1 {v4.d}[0], [x0], x2
st1 {v4.d}[1], [x1], x2
st1 {v5.d}[0], [x0], x2
st1 {v5.d}[1], [x1], x2
st1 {v6.d}[0], [x0], x2
st1 {v6.d}[1], [x1], x2
st1 {v7.d}[0], [x0]
st1 {v7.d}[1], [x1]
ret
+9 -1
View File
@@ -230,6 +230,9 @@ function \type\()_8tap_\size\()h_\idx1\idx2
// reduced dst stride
.if \size >= 16
sub x1, x1, x5
.elseif \size == 4
add x12, x2, #8
add x13, x7, #8
.endif
// size >= 16 loads two qwords and increments x2,
// for size 4/8 it's enough with one qword and no
@@ -248,9 +251,14 @@ function \type\()_8tap_\size\()h_\idx1\idx2
.if \size >= 16
ld1 {v4.8b, v5.8b, v6.8b}, [x2], #24
ld1 {v16.8b, v17.8b, v18.8b}, [x7], #24
.else
.elseif \size == 8
ld1 {v4.8b, v5.8b}, [x2]
ld1 {v16.8b, v17.8b}, [x7]
.else // \size == 4
ld1 {v4.8b}, [x2]
ld1 {v16.8b}, [x7]
ld1 {v5.s}[0], [x12], x3
ld1 {v17.s}[0], [x13], x3
.endif
uxtl v4.8h, v4.8b
uxtl v5.8h, v5.8b
+17 -17
View File
@@ -104,26 +104,26 @@ static int aasc_decode_frame(AVCodecContext *avctx,
ff_msrle_decode(avctx, s->frame, 8, &s->gb);
break;
case MKTAG('A', 'A', 'S', 'C'):
switch (compr) {
case 0:
stride = (avctx->width * psize + psize) & ~psize;
if (buf_size < stride * avctx->height)
switch (compr) {
case 0:
stride = (avctx->width * psize + psize) & ~psize;
if (buf_size < stride * avctx->height)
return AVERROR_INVALIDDATA;
for (i = avctx->height - 1; i >= 0; i--) {
memcpy(s->frame->data[0] + i * s->frame->linesize[0], buf, avctx->width * psize);
buf += stride;
buf_size -= stride;
}
break;
case 1:
bytestream2_init(&s->gb, buf, buf_size);
ff_msrle_decode(avctx, s->frame, 8, &s->gb);
break;
default:
av_log(avctx, AV_LOG_ERROR, "Unknown compression type %d\n", compr);
return AVERROR_INVALIDDATA;
for (i = avctx->height - 1; i >= 0; i--) {
memcpy(s->frame->data[0] + i * s->frame->linesize[0], buf, avctx->width * psize);
buf += stride;
buf_size -= stride;
}
break;
case 1:
bytestream2_init(&s->gb, buf, buf_size);
ff_msrle_decode(avctx, s->frame, 8, &s->gb);
break;
default:
av_log(avctx, AV_LOG_ERROR, "Unknown compression type %d\n", compr);
return AVERROR_INVALIDDATA;
}
break;
default:
av_log(avctx, AV_LOG_ERROR, "Unknown FourCC: %X\n", avctx->codec_tag);
return -1;
+2
View File
@@ -75,6 +75,7 @@
#define AC3_DYNAMIC_RANGE1 0
typedef int INTFLOAT;
typedef unsigned int UINTFLOAT;
typedef int16_t SHORTFLOAT;
#else /* USE_FIXED */
@@ -94,6 +95,7 @@ typedef int16_t SHORTFLOAT;
#define AC3_DYNAMIC_RANGE1 1.0f
typedef float INTFLOAT;
typedef float UINTFLOAT;
typedef float SHORTFLOAT;
#endif /* USE_FIXED */
+3 -1
View File
@@ -179,7 +179,9 @@ int av_ac3_parse_header(const uint8_t *buf, size_t size,
AC3HeaderInfo hdr;
int err;
init_get_bits8(&gb, buf, size);
err = init_get_bits8(&gb, buf, size);
if (err < 0)
return AVERROR_INVALIDDATA;
err = ff_ac3_parse_header(&gb, &hdr);
if (err < 0)
return AVERROR_INVALIDDATA;
+1 -1
View File
@@ -43,7 +43,7 @@ int AC3_NAME(allocate_sample_buffers)(AC3EncodeContext *s)
FF_ALLOC_OR_GOTO(s->avctx, s->windowed_samples, AC3_WINDOW_SIZE *
sizeof(*s->windowed_samples), alloc_fail);
FF_ALLOC_ARRAY_OR_GOTO(s->avctx, s->planar_samples, s->channels, sizeof(*s->planar_samples),
FF_ALLOCZ_ARRAY_OR_GOTO(s->avctx, s->planar_samples, s->channels, sizeof(*s->planar_samples),
alloc_fail);
for (ch = 0; ch < s->channels; ch++) {
FF_ALLOCZ_OR_GOTO(s->avctx, s->planar_samples[ch],
+1 -2
View File
@@ -470,8 +470,7 @@ static av_cold int aic_decode_init(AVCodecContext *avctx)
}
}
ctx->slice_data = av_malloc_array(ctx->slice_width, AIC_BAND_COEFFS
* sizeof(*ctx->slice_data));
ctx->slice_data = av_calloc(ctx->slice_width, AIC_BAND_COEFFS * sizeof(*ctx->slice_data));
if (!ctx->slice_data) {
av_log(avctx, AV_LOG_ERROR, "Error allocating slice buffer\n");
+2 -2
View File
@@ -29,12 +29,12 @@ static void decorrelate_stereo(int32_t *buffer[2], int nb_samples,
int i;
for (i = 0; i < nb_samples; i++) {
int32_t a, b;
uint32_t a, b;
a = buffer[0][i];
b = buffer[1][i];
a -= (b * decorr_left_weight) >> decorr_shift;
a -= (int)(b * decorr_left_weight) >> decorr_shift;
b += a;
buffer[0][i] = b;
+16 -5
View File
@@ -1016,6 +1016,10 @@ static int read_block(ALSDecContext *ctx, ALSBlockData *bd)
ALSSpecificConfig *sconf = &ctx->sconf;
*bd->shift_lsbs = 0;
if (get_bits_left(gb) < 7)
return AVERROR_INVALIDDATA;
// read block type flag and read the samples accordingly
if (get_bits1(gb)) {
ret = read_var_block_data(ctx, bd);
@@ -1628,7 +1632,7 @@ static int read_frame_data(ALSDecContext *ctx, unsigned int ra_frame)
AVCodecContext *avctx = ctx->avctx;
GetBitContext *gb = &ctx->gb;
unsigned int div_blocks[32]; ///< block sizes.
unsigned int c;
int c;
unsigned int js_blocks[2];
uint32_t bs_info = 0;
int ret;
@@ -1806,14 +1810,17 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame_ptr,
else
ctx->cur_frame_length = sconf->frame_length;
ctx->highest_decoded_channel = 0;
ctx->highest_decoded_channel = -1;
// decode the frame data
if ((invalid_frame = read_frame_data(ctx, ra_frame)) < 0)
av_log(ctx->avctx, AV_LOG_WARNING,
"Reading frame data failed. Skipping RA unit.\n");
if (ctx->highest_decoded_channel == 0)
if (ctx->highest_decoded_channel == -1) {
av_log(ctx->avctx, AV_LOG_WARNING,
"No channel data decoded.\n");
return AVERROR_INVALIDDATA;
}
ctx->frame_id++;
@@ -2109,8 +2116,8 @@ static av_cold int decode_init(AVCodecContext *avctx)
ctx->nbits = av_malloc_array(ctx->cur_frame_length, sizeof(*ctx->nbits));
ctx->mlz = av_mallocz(sizeof(*ctx->mlz));
if (!ctx->mlz || !ctx->acf || !ctx->shift_value || !ctx->last_shift_value
|| !ctx->last_acf_mantissa || !ctx->raw_mantissa) {
if (!ctx->larray || !ctx->nbits || !ctx->mlz || !ctx->acf || !ctx->shift_value
|| !ctx->last_shift_value || !ctx->last_acf_mantissa || !ctx->raw_mantissa) {
av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed.\n");
ret = AVERROR(ENOMEM);
goto fail;
@@ -2121,6 +2128,10 @@ static av_cold int decode_init(AVCodecContext *avctx)
for (c = 0; c < avctx->channels; ++c) {
ctx->raw_mantissa[c] = av_mallocz_array(ctx->cur_frame_length, sizeof(**ctx->raw_mantissa));
if (!ctx->raw_mantissa[c]) {
av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed.\n");
return AVERROR(ENOMEM);
}
}
}
+31 -20
View File
@@ -102,7 +102,7 @@ typedef struct APEFilter {
int16_t *historybuffer; ///< filter memory
int16_t *delay; ///< filtered values
int avg;
uint32_t avg;
} APEFilter;
typedef struct APERice {
@@ -852,7 +852,7 @@ static av_always_inline int filter_fast_3320(APEPredictor *p,
}
predictionA = p->buf[delayA] * 2U - p->buf[delayA - 1];
p->lastA[filter] = decoded + ((int32_t)(predictionA * p->coeffsA[filter][0]) >> 9);
p->lastA[filter] = decoded + (unsigned)((int32_t)(predictionA * p->coeffsA[filter][0]) >> 9);
if ((decoded ^ predictionA) > 0)
p->coeffsA[filter][0]++;
@@ -882,8 +882,8 @@ static av_always_inline int filter_3800(APEPredictor *p,
return predictionA;
}
d2 = p->buf[delayA];
d1 = (p->buf[delayA] - p->buf[delayA - 1]) * 2U;
d0 = p->buf[delayA] + ((p->buf[delayA - 2] - p->buf[delayA - 1]) * 8U);
d1 = (p->buf[delayA] - (unsigned)p->buf[delayA - 1]) * 2;
d0 = p->buf[delayA] + ((p->buf[delayA - 2] - (unsigned)p->buf[delayA - 1]) * 8);
d3 = p->buf[delayB] * 2U - p->buf[delayB - 1];
d4 = p->buf[delayB];
@@ -903,7 +903,7 @@ static av_always_inline int filter_3800(APEPredictor *p,
p->coeffsB[filter][0] += (((d3 >> 29) & 4) - 2) * sign;
p->coeffsB[filter][1] -= (((d4 >> 30) & 2) - 1) * sign;
p->filterB[filter] = p->lastA[filter] + (predictionB >> shift);
p->filterB[filter] = p->lastA[filter] + (unsigned)(predictionB >> shift);
p->filterA[filter] = p->filterB[filter] + (unsigned)((int)(p->filterA[filter] * 31U) >> 5);
return p->filterA[filter];
@@ -928,7 +928,7 @@ static void long_filter_high_3800(int32_t *buffer, int order, int shift, int len
dotprod += delay[j] * (unsigned)coeffs[j];
coeffs[j] += ((delay[j] >> 31) | 1) * sign;
}
buffer[i] -= dotprod >> shift;
buffer[i] -= (unsigned)(dotprod >> shift);
for (j = 0; j < order - 1; j++)
delay[j] = delay[j + 1];
delay[order - 1] = buffer[i];
@@ -952,7 +952,7 @@ static void long_filter_ehigh_3830(int32_t *buffer, int length)
for (j = 7; j > 0; j--)
delay[j] = delay[j - 1];
delay[0] = buffer[i];
buffer[i] -= dotprod >> 9;
buffer[i] -= (unsigned)(dotprod >> 9);
}
}
@@ -1061,13 +1061,13 @@ static av_always_inline int predictor_update_3930(APEPredictor *p,
const int delayA)
{
int32_t predictionA, sign;
int32_t d0, d1, d2, d3;
uint32_t d0, d1, d2, d3;
p->buf[delayA] = p->lastA[filter];
d0 = p->buf[delayA ];
d1 = p->buf[delayA ] - p->buf[delayA - 1];
d2 = p->buf[delayA - 1] - p->buf[delayA - 2];
d3 = p->buf[delayA - 2] - p->buf[delayA - 3];
d1 = p->buf[delayA ] - (unsigned)p->buf[delayA - 1];
d2 = p->buf[delayA - 1] - (unsigned)p->buf[delayA - 2];
d3 = p->buf[delayA - 2] - (unsigned)p->buf[delayA - 3];
predictionA = d0 * p->coeffsA[filter][0] +
d1 * p->coeffsA[filter][1] +
@@ -1078,10 +1078,10 @@ static av_always_inline int predictor_update_3930(APEPredictor *p,
p->filterA[filter] = p->lastA[filter] + ((int)(p->filterA[filter] * 31U) >> 5);
sign = APESIGN(decoded);
p->coeffsA[filter][0] += ((d0 < 0) * 2 - 1) * sign;
p->coeffsA[filter][1] += ((d1 < 0) * 2 - 1) * sign;
p->coeffsA[filter][2] += ((d2 < 0) * 2 - 1) * sign;
p->coeffsA[filter][3] += ((d3 < 0) * 2 - 1) * sign;
p->coeffsA[filter][0] += (((int32_t)d0 < 0) * 2 - 1) * sign;
p->coeffsA[filter][1] += (((int32_t)d1 < 0) * 2 - 1) * sign;
p->coeffsA[filter][2] += (((int32_t)d2 < 0) * 2 - 1) * sign;
p->coeffsA[filter][3] += (((int32_t)d3 < 0) * 2 - 1) * sign;
return p->filterA[filter];
}
@@ -1309,7 +1309,7 @@ static void do_apply_filter(APEContext *ctx, int version, APEFilter *f,
absres = res < 0 ? -(unsigned)res : res;
if (absres)
*f->adaptcoeffs = APESIGN(res) *
(8 << ((absres > f->avg * 3) + (absres > f->avg * 4 / 3)));
(8 << ((absres > f->avg * 3LL) + (absres > (f->avg + f->avg / 3))));
/* equivalent to the following code
if (absres <= f->avg * 4 / 3)
*f->adaptcoeffs = APESIGN(res) * 8;
@@ -1559,7 +1559,7 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data,
for (ch = 0; ch < s->channels; ch++) {
sample8 = (uint8_t *)frame->data[ch];
for (i = 0; i < blockstodecode; i++)
*sample8++ = (s->decoded[ch][i] + 0x80) & 0xff;
*sample8++ = (s->decoded[ch][i] + 0x80U) & 0xff;
}
break;
case 16:
@@ -1581,13 +1581,24 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data,
s->samples -= blockstodecode;
if (avctx->err_recognition & AV_EF_CRCCHECK &&
s->fileversion >= 3900 && s->bps < 24) {
s->fileversion >= 3900) {
uint32_t crc = s->CRC_state;
const AVCRC *crc_tab = av_crc_get_table(AV_CRC_32_IEEE_LE);
int stride = s->bps == 24 ? 4 : (s->bps>>3);
int offset = s->bps == 24;
int bytes = s->bps >> 3;
for (i = 0; i < blockstodecode; i++) {
for (ch = 0; ch < s->channels; ch++) {
uint8_t *smp = frame->data[ch] + (i*(s->bps >> 3));
crc = av_crc(crc_tab, crc, smp, s->bps >> 3);
#if HAVE_BIGENDIAN
uint8_t *smp_native = frame->data[ch] + i*stride;
uint8_t smp[4];
for(int j = 0; j<stride; j++)
smp[j] = smp_native[stride-j-1];
#else
uint8_t *smp = frame->data[ch] + i*stride;
#endif
crc = av_crc(crc_tab, crc, smp+offset, bytes);
}
}
-1
View File
@@ -48,4 +48,3 @@ function ff_scalarproduct_int16_neon, export=1
vmov.32 r0, d3[0]
bx lr
endfunc
+3 -3
View File
@@ -229,7 +229,7 @@ A .endif
.endif
// Begin loop
01:
1:
.if TOTAL_TAPS == 0
// Things simplify a lot in this case
// In fact this could be pipelined further if it's worth it...
@@ -241,7 +241,7 @@ A .endif
str ST0, [PST, #-4]!
str ST0, [PST, #4 * (MAX_BLOCKSIZE + MAX_FIR_ORDER)]
str ST0, [PSAMP], #4 * MAX_CHANNELS
bne 01b
bne 1b
.else
.if \fir_taps & 1
.set LOAD_REG, 1
@@ -333,7 +333,7 @@ T orr AC0, AC0, AC1
str ST3, [PST, #-4]!
str ST2, [PST, #4 * (MAX_BLOCKSIZE + MAX_FIR_ORDER)]
str ST3, [PSAMP], #4 * MAX_CHANNELS
bne 01b
bne 1b
.endif
b 99f
+10 -3
View File
@@ -279,11 +279,13 @@ function \type\()_8tap_\size\()h_\idx1\idx2
sub r1, r1, r5
.endif
@ size >= 16 loads two qwords and increments r2,
@ for size 4/8 it's enough with one qword and no
@ postincrement
@ size 4 loads 1 d word, increments r2 and loads 1 32-bit lane
@ for size 8 it's enough with one qword and no postincrement
.if \size >= 16
sub r3, r3, r5
sub r3, r3, #8
.elseif \size == 4
sub r3, r3, #8
.endif
@ Load the filter vector
vld1.16 {q0}, [r12,:128]
@@ -295,9 +297,14 @@ function \type\()_8tap_\size\()h_\idx1\idx2
.if \size >= 16
vld1.8 {d18, d19, d20}, [r2]!
vld1.8 {d24, d25, d26}, [r7]!
.else
.elseif \size == 8
vld1.8 {q9}, [r2]
vld1.8 {q12}, [r7]
.else @ size == 4
vld1.8 {d18}, [r2]!
vld1.8 {d24}, [r7]!
vld1.32 {d19[0]}, [r2]
vld1.32 {d25[0]}, [r7]
.endif
vmovl.u8 q8, d18
vmovl.u8 q9, d19
+4
View File
@@ -362,6 +362,10 @@ static av_cold int atrac1_decode_init(AVCodecContext *avctx)
ff_atrac_generate_tables();
q->fdsp = avpriv_float_dsp_alloc(avctx->flags & AV_CODEC_FLAG_BITEXACT);
if (!q->fdsp) {
atrac1_decode_end(avctx);
return AVERROR(ENOMEM);
}
q->bands[0] = q->low;
q->bands[1] = q->mid;
+4
View File
@@ -1294,6 +1294,10 @@ typedef struct AVCodecContext {
* this callback and filled with the extra buffers if there are more
* buffers than buf[] can hold. extended_buf will be freed in
* av_frame_unref().
* Decoders will generally initialize the whole buffer before it is output
* but it can in rare error conditions happen that uninitialized data is passed
* through. \important The buffers returned by get_buffer* should thus not contain sensitive
* data.
*
* If AV_CODEC_CAP_DR1 is not set then get_buffer2() must call
* avcodec_default_get_buffer2() instead of providing buffers allocated by
+3 -1
View File
@@ -54,6 +54,8 @@ static av_cold int init(AVCodecContext *avctx)
}
a->mjpeg_avctx = avcodec_alloc_context3(codec);
if (!a->mjpeg_avctx)
return AVERROR(ENOMEM);
av_dict_set(&thread_opt, "threads", "1", 0); // Is this needed ?
a->mjpeg_avctx->refcounted_frames = 1;
@@ -169,5 +171,5 @@ AVCodec ff_avrn_decoder = {
.close = end,
.decode = decode_frame,
.max_lowres = 3,
.caps_internal = FF_CODEC_CAP_INIT_THREADSAFE,
.caps_internal = FF_CODEC_CAP_INIT_THREADSAFE | FF_CODEC_CAP_INIT_CLEANUP,
};
+7 -8
View File
@@ -867,7 +867,7 @@ static int binkb_decode_plane(BinkContext *c, AVFrame *frame, GetBitContext *gb,
binkb_init_bundles(c);
ref_start = frame->data[plane_idx];
ref_end = frame->data[plane_idx] + (bh * frame->linesize[plane_idx] + bw) * 8;
ref_end = frame->data[plane_idx] + ((bh - 1) * frame->linesize[plane_idx] + bw - 1) * 8;
for (i = 0; i < 64; i++)
coordmap[i] = (i & 7) + (i >> 3) * stride;
@@ -923,7 +923,7 @@ static int binkb_decode_plane(BinkContext *c, AVFrame *frame, GetBitContext *gb,
xoff = binkb_get_value(c, BINKB_SRC_X_OFF);
yoff = binkb_get_value(c, BINKB_SRC_Y_OFF) + ybias;
ref = dst + xoff + yoff * stride;
if (ref < ref_start || ref + 8*stride > ref_end) {
if (ref < ref_start || ref > ref_end) {
av_log(c->avctx, AV_LOG_WARNING, "Reference block is out of bounds\n");
} else if (ref + 8*stride < dst || ref >= dst + 8*stride) {
c->hdsp.put_pixels_tab[1][0](dst, ref, stride, 8);
@@ -939,7 +939,7 @@ static int binkb_decode_plane(BinkContext *c, AVFrame *frame, GetBitContext *gb,
xoff = binkb_get_value(c, BINKB_SRC_X_OFF);
yoff = binkb_get_value(c, BINKB_SRC_Y_OFF) + ybias;
ref = dst + xoff + yoff * stride;
if (ref < ref_start || ref + 8 * stride > ref_end) {
if (ref < ref_start || ref > ref_end) {
av_log(c->avctx, AV_LOG_WARNING, "Reference block is out of bounds\n");
} else if (ref + 8*stride < dst || ref >= dst + 8*stride) {
c->hdsp.put_pixels_tab[1][0](dst, ref, stride, 8);
@@ -971,7 +971,7 @@ static int binkb_decode_plane(BinkContext *c, AVFrame *frame, GetBitContext *gb,
xoff = binkb_get_value(c, BINKB_SRC_X_OFF);
yoff = binkb_get_value(c, BINKB_SRC_Y_OFF) + ybias;
ref = dst + xoff + yoff * stride;
if (ref < ref_start || ref + 8 * stride > ref_end) {
if (ref < ref_start || ref > ref_end) {
av_log(c->avctx, AV_LOG_WARNING, "Reference block is out of bounds\n");
} else if (ref + 8*stride < dst || ref >= dst + 8*stride) {
c->hdsp.put_pixels_tab[1][0](dst, ref, stride, 8);
@@ -1084,7 +1084,7 @@ static int bink_decode_plane(BinkContext *c, AVFrame *frame, GetBitContext *gb,
for (bx = 0; bx < bw; bx++, dst += 8, prev += 8) {
blk = get_value(c, BINK_SRC_BLOCK_TYPES);
// 16x16 block type on odd line means part of the already decoded block, so skip it
if ((by & 1) && blk == SCALED_BLOCK) {
if (((by & 1) || (bx & 1)) && blk == SCALED_BLOCK) {
bx++;
dst += 8;
prev += 8;
@@ -1381,10 +1381,8 @@ static av_cold int decode_init(AVCodecContext *avctx)
ff_hpeldsp_init(&c->hdsp, avctx->flags);
ff_binkdsp_init(&c->binkdsp);
if ((ret = init_bundles(c)) < 0) {
free_bundles(c);
if ((ret = init_bundles(c)) < 0)
return ret;
}
if (c->version == 'b') {
if (!binkb_initialised) {
@@ -1424,4 +1422,5 @@ AVCodec ff_bink_decoder = {
.decode = decode_frame,
.flush = flush,
.capabilities = AV_CODEC_CAP_DR1,
.caps_internal = FF_CODEC_CAP_INIT_CLEANUP,
};
+3 -4
View File
@@ -40,8 +40,6 @@
#include "rdft.h"
#include "wma_freqs.h"
static float quant_table[96];
#define MAX_CHANNELS 2
#define BINK_BLOCK_MAX_SIZE (MAX_CHANNELS << 11)
@@ -58,6 +56,7 @@ typedef struct BinkAudioContext {
float root;
DECLARE_ALIGNED(32, FFTSample, coeffs)[BINK_BLOCK_MAX_SIZE];
float previous[MAX_CHANNELS][BINK_BLOCK_MAX_SIZE / 16]; ///< coeffs from previous audio block
float quant_table[96];
AVPacket *pkt;
union {
RDFTContext rdft;
@@ -116,7 +115,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
s->root = s->frame_len / (sqrt(s->frame_len) * 32768.0);
for (i = 0; i < 96; i++) {
/* constant is result of 0.066399999/log10(M_E) */
quant_table[i] = expf(i * 0.15289164787221953823f) * s->root;
s->quant_table[i] = expf(i * 0.15289164787221953823f) * s->root;
}
/* calculate number of bands */
@@ -197,7 +196,7 @@ static int decode_block(BinkAudioContext *s, float **out, int use_dct)
return AVERROR_INVALIDDATA;
for (i = 0; i < s->num_bands; i++) {
int value = get_bits(gb, 8);
quant[i] = quant_table[FFMIN(value, 95)];
quant[i] = s->quant_table[FFMIN(value, 95)];
}
k = 0;
+1 -1
View File
@@ -129,7 +129,7 @@ static int alloc_table(VLC *vlc, int size, int use_static)
typedef struct VLCcode {
uint8_t bits;
uint16_t symbol;
VLC_TYPE symbol;
/** codeword, with the first bit-to-be-read in the msb
* (even if intended for a little-endian bitstream reader) */
uint32_t code;
+14 -3
View File
@@ -36,7 +36,7 @@ static int cbs_av1_read_uvlc(CodedBitstreamContext *ctx, GetBitContext *gbc,
position = get_bits_count(gbc);
zeroes = 0;
while (1) {
while (zeroes < 32) {
if (get_bits_left(gbc) < 1) {
av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid uvlc code at "
"%s: bitstream ended.\n", name);
@@ -49,7 +49,18 @@ static int cbs_av1_read_uvlc(CodedBitstreamContext *ctx, GetBitContext *gbc,
}
if (zeroes >= 32) {
value = MAX_UINT_BITS(32);
// The spec allows at least thirty-two zero bits followed by a
// one to mean 2^32-1, with no constraint on the number of
// zeroes. The libaom reference decoder does not match this,
// instead reading thirty-two zeroes but not the following one
// to mean 2^32-1. These two interpretations are incompatible
// and other implementations may follow one or the other.
// Therefore we reject thirty-two zeroes because the intended
// behaviour is not clear.
av_log(ctx->log_ctx, AV_LOG_ERROR, "Thirty-two zero bits in "
"%s uvlc code: considered invalid due to conflicting "
"standard and reference decoder behaviour.\n", name);
return AVERROR_INVALIDDATA;
} else {
if (get_bits_left(gbc) < zeroes) {
av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid uvlc code at "
@@ -383,7 +394,7 @@ static int cbs_av1_write_increment(CodedBitstreamContext *ctx, PutBitContext *pb
}
if (len > 0)
put_bits(pbc, len, (1 << len) - 1 - (value != range_max));
put_bits(pbc, len, (1U << len) - 1 - (value != range_max));
return 0;
}
+1 -1
View File
@@ -728,7 +728,7 @@ static int FUNC(sps_scc_extension)(CodedBitstreamContext *ctx, RWContext *rw,
flag(sps_palette_predictor_initializer_present_flag);
if (current->sps_palette_predictor_initializer_present_flag) {
ue(sps_num_palette_predictor_initializer_minus1, 0, 128);
ue(sps_num_palette_predictor_initializer_minus1, 0, 127);
for (comp = 0; comp < (current->chroma_format_idc ? 3 : 1); comp++) {
int bit_depth = comp == 0 ? current->bit_depth_luma_minus8 + 8
: current->bit_depth_chroma_minus8 + 8;
+2 -2
View File
@@ -166,13 +166,13 @@ static int cbs_jpeg_split_fragment(CodedBitstreamContext *ctx,
}
} else {
i = start;
if (i + 2 > frag->data_size) {
if (i > frag->data_size - 2) {
av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid JPEG image: "
"truncated at %02x marker.\n", marker);
return AVERROR_INVALIDDATA;
}
length = AV_RB16(frag->data + i);
if (i + length > frag->data_size) {
if (length > frag->data_size - i) {
av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid JPEG image: "
"truncated at %02x marker segment.\n", marker);
return AVERROR_INVALIDDATA;
+1 -1
View File
@@ -422,7 +422,7 @@ static int cbs_vp9_split_fragment(CodedBitstreamContext *ctx,
superframe_header = frag->data[frag->data_size - 1];
if ((superframe_header & 0xe0) == 0xc0) {
VP9RawSuperframeIndex sfi;
VP9RawSuperframeIndex sfi = {0};
GetBitContext gbc;
size_t index_size, pos;
int i;
+1 -1
View File
@@ -239,7 +239,7 @@ static void cdg_scroll(CDGraphicsContext *cc, uint8_t *data,
for (y = FFMAX(0, vinc); y < FFMIN(CDG_FULL_HEIGHT + vinc, CDG_FULL_HEIGHT); y++)
memcpy(out + FFMAX(0, hinc) + stride * y,
in + FFMAX(0, hinc) - hinc + (y - vinc) * stride,
FFMIN(stride + hinc, stride));
FFABS(stride) - FFABS(hinc));
if (vinc > 0)
cdg_fill_wrapper(0, 0, out,
+1 -1
View File
@@ -78,7 +78,7 @@ int64_t ff_dot_product(const int16_t *a, const int16_t *b, int length);
*
* @return value << offset, if offset>=0; value >> -offset - otherwise
*/
static inline int bidir_sal(int value, int offset)
static inline unsigned bidir_sal(unsigned value, int offset)
{
if(offset < 0) return value >> -offset;
else return value << offset;
+2 -2
View File
@@ -665,8 +665,8 @@ static av_cold int clv_decode_init(AVCodecContext *avctx)
}
c->tile_shift = av_log2(c->tile_size);
if (1U << c->tile_shift != c->tile_size) {
av_log(avctx, AV_LOG_ERROR, "Tile size: %d, is not power of 2.\n", c->tile_size);
if (1U << c->tile_shift != c->tile_size || c->tile_shift < 1 || c->tile_shift > 30) {
av_log(avctx, AV_LOG_ERROR, "Tile size: %d, is not power of 2 > 1 and < 2^31\n", c->tile_size);
return AVERROR_INVALIDDATA;
}
-1
View File
@@ -91,4 +91,3 @@ AVCodec ff_cljr_decoder = {
.decode = decode_frame,
.capabilities = AV_CODEC_CAP_DR1,
};
+1
View File
@@ -111,6 +111,7 @@ static int cpia_decode_frame(AVCodecContext *avctx,
// Read line length, two byte little endian
linelength = AV_RL16(src);
src += 2;
src_size -= 2;
if (src_size < linelength) {
frame->decode_error_flags = FF_DECODE_ERROR_INVALID_BITSTREAM;
+5 -2
View File
@@ -71,6 +71,9 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
int buf_size = avpkt->size;
CamStudioContext *c = avctx->priv_data;
int ret;
int bpp = avctx->bits_per_coded_sample / 8;
int bugdelta = FFALIGN(avctx->width * bpp, 4) * avctx->height
- (avctx->width & ~3) * bpp * avctx->height;
if (buf_size < 2) {
av_log(avctx, AV_LOG_ERROR, "coded frame too small\n");
@@ -84,7 +87,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
switch ((buf[0] >> 1) & 7) {
case 0: { // lzo compression
int outlen = c->decomp_size, inlen = buf_size - 2;
if (av_lzo1x_decode(c->decomp_buf, &outlen, &buf[2], &inlen) || outlen) {
if (av_lzo1x_decode(c->decomp_buf, &outlen, &buf[2], &inlen) || (outlen && outlen != bugdelta)) {
av_log(avctx, AV_LOG_ERROR, "error during lzo decompression\n");
return AVERROR_INVALIDDATA;
}
@@ -93,7 +96,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
case 1: { // zlib compression
#if CONFIG_ZLIB
unsigned long dlen = c->decomp_size;
if (uncompress(c->decomp_buf, &dlen, &buf[2], buf_size - 2) != Z_OK || dlen != c->decomp_size) {
if (uncompress(c->decomp_buf, &dlen, &buf[2], buf_size - 2) != Z_OK || (dlen != c->decomp_size && dlen != c->decomp_size - bugdelta)) {
av_log(avctx, AV_LOG_ERROR, "error during zlib decompression\n");
return AVERROR_INVALIDDATA;
}
+1 -1
View File
@@ -328,7 +328,7 @@ static void dmix_add_c(int32_t *dst, const int32_t *src, int coeff, ptrdiff_t le
int i;
for (i = 0; i < len; i++)
dst[i] += mul15(src[i], coeff);
dst[i] += (unsigned)mul15(src[i], coeff);
}
static void dmix_scale_c(int32_t *dst, int scale, ptrdiff_t len)
+2 -2
View File
@@ -1431,8 +1431,8 @@ static void global_mv(DiracContext *s, DiracBlock *block, int x, int y, int ref)
int *c = s->globalmc[ref].perspective;
int64_t m = (1<<ep) - (c[0]*(int64_t)x + c[1]*(int64_t)y);
int64_t mx = m * (int64_t)((A[0][0] * (int64_t)x + A[0][1]*(int64_t)y) + (1LL<<ez) * b[0]);
int64_t my = m * (int64_t)((A[1][0] * (int64_t)x + A[1][1]*(int64_t)y) + (1LL<<ez) * b[1]);
int64_t mx = m * (uint64_t)((A[0][0] * (int64_t)x + A[0][1]*(int64_t)y) + (1LL<<ez) * b[0]);
int64_t my = m * (uint64_t)((A[1][0] * (int64_t)x + A[1][1]*(int64_t)y) + (1LL<<ez) * b[1]);
block->u.mv[ref][0] = (mx + (1<<(ez+ep))) >> (ez+ep);
block->u.mv[ref][1] = (my + (1<<(ez+ep))) >> (ez+ep);
+1 -1
View File
@@ -195,7 +195,7 @@ static void dequant_subband_ ## PX ## _c(uint8_t *src, uint8_t *dst, ptrdiff_t s
{ \
int i, y; \
for (y = 0; y < tot_v; y++) { \
PX c, sign, *src_r = (PX *)src, *dst_r = (PX *)dst; \
PX c, *src_r = (PX *)src, *dst_r = (PX *)dst; \
for (i = 0; i < tot_h; i++) { \
c = *src_r++; \
if (c < 0) c = -((-(unsigned)c*qf + qs) >> 2); \
+15 -7
View File
@@ -110,6 +110,7 @@ static av_cold int dnxhd_decode_init(AVCodecContext *avctx)
static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid, int bitdepth)
{
int ret;
if (cid != ctx->cid) {
int index;
@@ -129,19 +130,26 @@ static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid, int bitdepth)
ff_free_vlc(&ctx->dc_vlc);
ff_free_vlc(&ctx->run_vlc);
init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257,
if ((ret = init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257,
ctx->cid_table->ac_bits, 1, 1,
ctx->cid_table->ac_codes, 2, 2, 0);
init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12,
ctx->cid_table->ac_codes, 2, 2, 0)) < 0)
goto out;
if ((ret = init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12,
ctx->cid_table->dc_bits, 1, 1,
ctx->cid_table->dc_codes, 1, 1, 0);
init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62,
ctx->cid_table->dc_codes, 1, 1, 0)) < 0)
goto out;
if ((ret = init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62,
ctx->cid_table->run_bits, 1, 1,
ctx->cid_table->run_codes, 2, 2, 0);
ctx->cid_table->run_codes, 2, 2, 0)) < 0)
goto out;
ctx->cid = cid;
}
return 0;
ret = 0;
out:
if (ret < 0)
av_log(ctx->avctx, AV_LOG_ERROR, "init_vlc failed\n");
return ret;
}
static int dnxhd_get_profile(int cid)
+3
View File
@@ -206,6 +206,9 @@ static int decode_frame(AVCodecContext *avctx,
return AVERROR_PATCHWELCOME;
}
if (bits_per_color > 32)
return AVERROR_INVALIDDATA;
buf += 820;
avctx->sample_aspect_ratio.num = read32(&buf, endian);
avctx->sample_aspect_ratio.den = read32(&buf, endian);
+8 -3
View File
@@ -214,7 +214,7 @@ static uint8_t prob_dst_x_bit(int c)
return (ff_reverse[c & 127] >> 1) + 1;
}
static void build_filter(int16_t table[DST_MAX_ELEMENTS][16][256], const Table *fsets)
static int build_filter(int16_t table[DST_MAX_ELEMENTS][16][256], const Table *fsets)
{
int i, j, k, l;
@@ -225,14 +225,17 @@ static void build_filter(int16_t table[DST_MAX_ELEMENTS][16][256], const Table *
int total = av_clip(length - j * 8, 0, 8);
for (k = 0; k < 256; k++) {
int v = 0;
int64_t v = 0;
for (l = 0; l < total; l++)
v += (((k >> l) & 1) * 2 - 1) * fsets->coeff[i][j * 8 + l];
if ((int16_t)v != v)
return AVERROR_INVALIDDATA;
table[i][j][k] = v;
}
}
}
return 0;
}
static int decode_frame(AVCodecContext *avctx, void *data,
@@ -328,7 +331,9 @@ static int decode_frame(AVCodecContext *avctx, void *data,
return AVERROR_INVALIDDATA;
ac_init(ac, gb);
build_filter(s->filter, &s->fsets);
ret = build_filter(s->filter, &s->fsets);
if (ret < 0)
return ret;
memset(s->status, 0xAA, sizeof(s->status));
memset(dsd, 0, frame->nb_samples * 4 * channels);
-1
View File
@@ -259,4 +259,3 @@ av_cold int ff_dvvideo_init(AVCodecContext *avctx)
return 0;
}
-1
View File
@@ -338,4 +338,3 @@ const AVDVProfile *av_dv_codec_profile2(int width, int height,
return p;
}
+10 -10
View File
@@ -215,8 +215,8 @@ static av_always_inline int dv_guess_dct_mode(DVVideoContext *s, uint8_t *data,
if (s->avctx->flags & AV_CODEC_FLAG_INTERLACED_DCT) {
int ps = s->ildct_cmp(NULL, data, NULL, linesize, 8) - 400;
if (ps > 0) {
int is = s->ildct_cmp(NULL, data, NULL, linesize << 1, 4) +
s->ildct_cmp(NULL, data + linesize, NULL, linesize << 1, 4);
int is = s->ildct_cmp(NULL, data, NULL, linesize * 2, 4) +
s->ildct_cmp(NULL, data + linesize, NULL, linesize * 2, 4);
return ps > is;
}
}
@@ -511,7 +511,7 @@ static av_always_inline int dv_init_enc_block(EncBlockInfo* bi, uint8_t *data, i
if (data) {
if (DV_PROFILE_IS_HD(s->sys)) {
s->get_pixels(blk, data, linesize << bi->dct_mode);
s->get_pixels(blk, data, linesize * (1 << bi->dct_mode));
s->fdct[0](blk);
} else {
bi->dct_mode = dv_guess_dct_mode(s, data, linesize);
@@ -860,7 +860,7 @@ static int dv_encode_video_segment(AVCodecContext *avctx, void *arg)
qnos[mb_index] = DV_PROFILE_IS_HD(s->sys) ? 1 : 15;
y_ptr = s->frame->data[0] + ((mb_y * s->frame->linesize[0] + mb_x) << 3);
y_ptr = s->frame->data[0] + (mb_y * s->frame->linesize[0] + mb_x) * 8;
linesize = s->frame->linesize[0];
if (s->sys->height == 1080 && mb_y < 134)
@@ -874,12 +874,12 @@ static int dv_encode_video_segment(AVCodecContext *avctx, void *arg)
if ((s->sys->pix_fmt == AV_PIX_FMT_YUV420P) ||
(s->sys->pix_fmt == AV_PIX_FMT_YUV411P && mb_x >= (704 / 8)) ||
(s->sys->height >= 720 && mb_y != 134)) {
y_stride = s->frame->linesize[0] << (3*!enc_blk->dct_mode);
y_stride = s->frame->linesize[0] * (1 << (3*!enc_blk->dct_mode));
} else {
y_stride = 16;
}
y_ptr = s->frame->data[0] +
((mb_y * s->frame->linesize[0] + mb_x) << 3);
(mb_y * s->frame->linesize[0] + mb_x) * 8;
linesize = s->frame->linesize[0];
if (s->sys->video_stype == 4) { /* SD 422 */
@@ -898,17 +898,17 @@ static int dv_encode_video_segment(AVCodecContext *avctx, void *arg)
enc_blk += 4;
/* initializing chrominance blocks */
c_offset = (((mb_y >> (s->sys->pix_fmt == AV_PIX_FMT_YUV420P)) * s->frame->linesize[1] +
(mb_x >> ((s->sys->pix_fmt == AV_PIX_FMT_YUV411P) ? 2 : 1))) << 3);
c_offset = ((mb_y >> (s->sys->pix_fmt == AV_PIX_FMT_YUV420P)) * s->frame->linesize[1] +
(mb_x >> ((s->sys->pix_fmt == AV_PIX_FMT_YUV411P) ? 2 : 1))) * 8;
for (j = 2; j; j--) {
uint8_t *c_ptr = s->frame->data[j] + c_offset;
linesize = s->frame->linesize[j];
y_stride = (mb_y == 134) ? 8 : (s->frame->linesize[j] << (3*!enc_blk->dct_mode));
y_stride = (mb_y == 134) ? 8 : (s->frame->linesize[j] * (1 << (3*!enc_blk->dct_mode)));
if (s->sys->pix_fmt == AV_PIX_FMT_YUV411P && mb_x >= (704 / 8)) {
uint8_t *d;
uint8_t *b = scratch;
for (i = 0; i < 8; i++) {
d = c_ptr + (linesize << 3);
d = c_ptr + linesize * 8;
b[0] = c_ptr[0];
b[1] = c_ptr[1];
b[2] = c_ptr[2];
+1 -1
View File
@@ -440,7 +440,7 @@ static int get_opcodes(GetByteContext *gb, uint32_t *table, uint8_t *dst, int op
size_in_bits = bytestream2_get_le32(gb);
endoffset = ((size_in_bits + 7) >> 3) - 4;
if (endoffset <= 0 || bytestream2_get_bytes_left(gb) < endoffset)
if ((int)endoffset <= 0 || bytestream2_get_bytes_left(gb) < endoffset)
return AVERROR_INVALIDDATA;
offset = endoffset;
+5 -5
View File
@@ -111,7 +111,7 @@ static int dxva_get_decoder_configuration(AVCodecContext *avctx,
for (i = 0; i < cfg_count; i++) {
unsigned score;
UINT ConfigBitstreamRaw;
UINT ConfigBitstreamRaw = 0;
GUID guidConfigBitstreamEncryption;
#if CONFIG_D3D11VA
@@ -262,7 +262,7 @@ static int dxva_get_decoder_guid(AVCodecContext *avctx, void *service, void *sur
*decoder_guid = ff_GUID_NULL;
for (i = 0; dxva_modes[i].guid; i++) {
const dxva_mode *mode = &dxva_modes[i];
int validate;
int validate = 0;
if (!dxva_check_codec_compatibility(avctx, mode))
continue;
@@ -794,7 +794,7 @@ int ff_dxva2_commit_buffer(AVCodecContext *avctx,
unsigned type, const void *data, unsigned size,
unsigned mb_count)
{
void *dxva_data;
void *dxva_data = NULL;
unsigned dxva_size;
int result;
HRESULT hr = 0;
@@ -816,7 +816,7 @@ int ff_dxva2_commit_buffer(AVCodecContext *avctx,
type, (unsigned)hr);
return -1;
}
if (size <= dxva_size) {
if (dxva_data && size <= dxva_size) {
memcpy(dxva_data, data, size);
#if CONFIG_D3D11VA
@@ -894,7 +894,7 @@ int ff_dxva2_common_end_frame(AVCodecContext *avctx, AVFrame *frame,
#endif
DECODER_BUFFER_DESC *buffer = NULL, *buffer_slice = NULL;
int result, runs = 0;
HRESULT hr;
HRESULT hr = -1;
unsigned type;
FFDXVASharedContext *sctx = DXVA_SHARED_CONTEXT(avctx);
+3 -1
View File
@@ -139,9 +139,11 @@ static void ff_eac3_apply_spectral_extension(AC3DecodeContext *s)
// spx_noise_blend and spx_signal_blend are both FP.23
nscale *= 1.0 / (1<<23);
sscale *= 1.0 / (1<<23);
if (nscale < -1.0)
nscale = -1.0;
#endif
for (i = 0; i < s->spx_band_sizes[bnd]; i++) {
float noise = nscale * (int32_t)av_lfg_get(&s->dith_state);
UINTFLOAT noise = (INTFLOAT)(nscale * (int32_t)av_lfg_get(&s->dith_state));
s->transform_coeffs[ch][bin] *= sscale;
s->transform_coeffs[ch][bin++] += noise;
}
+4 -1
View File
@@ -198,12 +198,15 @@ static int cmv_decode_frame(AVCodecContext *avctx,
if ((ret = av_image_check_size(s->width, s->height, 0, s->avctx)) < 0)
return ret;
buf += EA_PREAMBLE_SIZE;
if (!(buf[0]&1) && buf_end - buf < s->width * s->height * (int64_t)(100 - s->avctx->discard_damaged_percentage) / 100)
return AVERROR_INVALIDDATA;
if ((ret = ff_get_buffer(avctx, frame, AV_GET_BUFFER_FLAG_REF)) < 0)
return ret;
memcpy(frame->data[1], s->palette, AVPALETTE_SIZE);
buf += EA_PREAMBLE_SIZE;
if ((buf[0]&1)) { // subtype
cmv_decode_inter(s, frame, buf+2, buf_end);
frame->key_frame = 0;
+11 -3
View File
@@ -58,7 +58,7 @@ static av_cold int tgq_decode_init(AVCodecContext *avctx)
return 0;
}
static void tgq_decode_block(TgqContext *s, int16_t block[64], GetBitContext *gb)
static int tgq_decode_block(TgqContext *s, int16_t block[64], GetBitContext *gb)
{
uint8_t *perm = s->scantable.permutated;
int i, j, value;
@@ -66,6 +66,8 @@ static void tgq_decode_block(TgqContext *s, int16_t block[64], GetBitContext *gb
for (i = 1; i < 64;) {
switch (show_bits(gb, 3)) {
case 4:
if (i >= 63)
return AVERROR_INVALIDDATA;
block[perm[i++]] = 0;
case 0:
block[perm[i++]] = 0;
@@ -75,6 +77,8 @@ static void tgq_decode_block(TgqContext *s, int16_t block[64], GetBitContext *gb
case 1:
skip_bits(gb, 2);
value = get_bits(gb, 6);
if (value > 64 - i)
return AVERROR_INVALIDDATA;
for (j = 0; j < value; j++)
block[perm[i++]] = 0;
break;
@@ -102,6 +106,7 @@ static void tgq_decode_block(TgqContext *s, int16_t block[64], GetBitContext *gb
}
}
block[0] += 128 << 4;
return 0;
}
static void tgq_idct_put_mb(TgqContext *s, int16_t (*block)[64], AVFrame *frame,
@@ -161,8 +166,11 @@ static int tgq_decode_mb(TgqContext *s, AVFrame *frame, int mb_y, int mb_x)
if (ret < 0)
return ret;
for (i = 0; i < 6; i++)
tgq_decode_block(s, s->block[i], &gb);
for (i = 0; i < 6; i++) {
int ret = tgq_decode_block(s, s->block[i], &gb);
if (ret < 0)
return ret;
}
tgq_idct_put_mb(s, s->block, frame, mb_x, mb_y);
bytestream2_skip(&s->gb, mode);
} else {
+10 -10
View File
@@ -88,11 +88,6 @@ static CodeBook unpack_codebook(GetBitContext* gb, unsigned depth,
unsigned i, j;
CodeBook cb = { 0 };
if (size >= INT_MAX / 34 || get_bits_left(gb) < size * 34)
return cb;
if (size >= INT_MAX / sizeof(MacroBlock))
return cb;
cb.blocks = av_malloc(size ? size * sizeof(MacroBlock) : 1);
if (!cb.blocks)
return cb;
@@ -162,7 +157,7 @@ static MacroBlock decode_macroblock(Escape124Context* s, GetBitContext* gb,
// This condition can occur with invalid bitstreams and
// *codebook_index == 2
if (block_index >= s->codebooks[*codebook_index].size)
if (block_index >= s->codebooks[*codebook_index].size || !s->codebooks[*codebook_index].blocks)
return (MacroBlock) { { 0 } };
return s->codebooks[*codebook_index].blocks[block_index];
@@ -226,7 +221,7 @@ static int escape124_decode_frame(AVCodecContext *avctx,
// represent a lower bound of the space needed for skipped superblocks. Non
// skipped SBs need more space.
if (get_bits_left(&gb) < 64 + s->num_superblocks * 23LL / 4320)
return -1;
return AVERROR_INVALIDDATA;
frame_flags = get_bits_long(&gb, 32);
frame_size = get_bits_long(&gb, 32);
@@ -243,7 +238,7 @@ static int escape124_decode_frame(AVCodecContext *avctx,
if ((ret = av_frame_ref(frame, s->frame)) < 0)
return ret;
return frame_size;
return 0;
}
for (i = 0; i < 3; i++) {
@@ -277,9 +272,14 @@ static int escape124_decode_frame(AVCodecContext *avctx,
}
av_freep(&s->codebooks[i].blocks);
if (cb_size >= INT_MAX / 34 || get_bits_left(&gb) < (int)cb_size * 34)
return AVERROR_INVALIDDATA;
if (cb_size >= INT_MAX / sizeof(MacroBlock))
return AVERROR_INVALIDDATA;
s->codebooks[i] = unpack_codebook(&gb, cb_depth, cb_size);
if (!s->codebooks[i].blocks)
return -1;
return AVERROR(ENOMEM);
}
}
@@ -372,7 +372,7 @@ static int escape124_decode_frame(AVCodecContext *avctx,
*got_frame = 1;
return frame_size;
return 0;
}
+8 -6
View File
@@ -1511,6 +1511,7 @@ static int decode_header(EXRContext *s, AVFrame *frame)
ymax = bytestream2_get_le32(&s->gb);
if (xmin > xmax || ymin > ymax ||
ymax == INT_MAX || xmax == INT_MAX ||
(unsigned)xmax - xmin >= INT_MAX ||
(unsigned)ymax - ymin >= INT_MAX) {
ret = AVERROR_INVALIDDATA;
@@ -1825,13 +1826,14 @@ static int decode_frame(AVCodecContext *avctx, void *data,
avctx->execute2(avctx, decode_block, s->thread_data, NULL, nb_blocks);
// Zero out the end if ymax+1 is not h
for (i = 0; i < planes; i++) {
ptr = picture->data[i] + ((s->ymax+1) * picture->linesize[i]);
for (y = s->ymax + 1; y < avctx->height; y++) {
memset(ptr, 0, out_line_size);
ptr += picture->linesize[i];
if ((s->ymax+1) < avctx->height)
for (i = 0; i < planes; i++) {
ptr = picture->data[i] + ((s->ymax+1) * picture->linesize[i]);
for (y = s->ymax + 1; y < avctx->height; y++) {
memset(ptr, 0, out_line_size);
ptr += picture->linesize[i];
}
}
}
picture->pict_type = AV_PICTURE_TYPE_I;
*got_frame = 1;
+15 -3
View File
@@ -141,6 +141,8 @@ static int decode_uncompressed(AVCodecContext *avctx, GetBitContext *gb,
return AVERROR_INVALIDDATA;
}
cwi = 10 - av_log2(cwi);
if (get_bits_left(gb) < cwi + 1)
return AVERROR_INVALIDDATA;
skip_bits(gb, cwi + 1);
if (cwi > 5) {
newmode = get_bits1(gb);
@@ -206,6 +208,8 @@ static int decode_group3_1d_line(AVCodecContext *avctx, GetBitContext *gb,
unsigned int run = 0;
unsigned int t;
for (;;) {
if (get_bits_left(gb) <= 0)
return AVERROR_INVALIDDATA;
t = get_vlc2(gb, ccitt_vlc[mode].table, 9, 2);
run += t;
if (t < 64) {
@@ -224,7 +228,7 @@ static int decode_group3_1d_line(AVCodecContext *avctx, GetBitContext *gb,
run = 0;
mode = !mode;
} else if ((int)t == -1) {
if (show_bits(gb, 12) == 15) {
if (get_bits_left(gb) > 12 && show_bits(gb, 12) == 15) {
int ret;
skip_bits(gb, 12);
ret = decode_uncompressed(avctx, gb, &pix_left, &runs, runend, &mode);
@@ -251,7 +255,10 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb,
unsigned int offs = 0, run = 0;
while (offs < width) {
int cmode = get_vlc2(gb, ccitt_group3_2d_vlc.table, 9, 1);
int cmode;
if (get_bits_left(gb) <= 0)
return AVERROR_INVALIDDATA;
cmode = get_vlc2(gb, ccitt_group3_2d_vlc.table, 9, 1);
if (cmode == -1) {
av_log(avctx, AV_LOG_ERROR, "Incorrect mode VLC\n");
return AVERROR_INVALIDDATA;
@@ -273,6 +280,8 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb,
for (k = 0; k < 2; k++) {
run = 0;
for (;;) {
if (get_bits_left(gb) <= 0)
return AVERROR_INVALIDDATA;
t = get_vlc2(gb, ccitt_vlc[mode].table, 9, 2);
if (t == -1) {
av_log(avctx, AV_LOG_ERROR, "Incorrect code\n");
@@ -296,7 +305,10 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb,
mode = !mode;
}
} else if (cmode == 9 || cmode == 10) {
int xxx = get_bits(gb, 3);
int xxx;
if (get_bits_left(gb) < 3)
return AVERROR_INVALIDDATA;
xxx = get_bits(gb, 3);
if (cmode == 9 && xxx == 7) {
int ret;
int pix_left = width - offs;
+20 -4
View File
@@ -51,6 +51,8 @@
* @file
* definitions and initialization of LUT table for FFT
*/
#include "libavutil/thread.h"
#include "libavcodec/fft_table.h"
const int32_t ff_w_tab_sr[MAX_FFT_SIZE/(4*16)] = {
@@ -314,15 +316,29 @@ const int32_t ff_w_tab_sr[MAX_FFT_SIZE/(4*16)] = {
uint16_t ff_fft_offsets_lut[21845];
void ff_fft_lut_init(uint16_t *table, int off, int size, int *index)
static void fft_lut_init(uint16_t *table, int off, int size, int *index)
{
if (size < 16) {
table[*index] = off >> 2;
(*index)++;
}
else {
ff_fft_lut_init(table, off, size>>1, index);
ff_fft_lut_init(table, off+(size>>1), size>>2, index);
ff_fft_lut_init(table, off+3*(size>>2), size>>2, index);
fft_lut_init(table, off, size >> 1, index);
fft_lut_init(table, off + (size >> 1), size >> 2, index);
fft_lut_init(table, off + 3 * (size >> 2), size >> 2, index);
}
}
static void fft_lut_init_start(void)
{
int n = 0;
fft_lut_init(ff_fft_offsets_lut, 0, 1 << 17, &n);
}
void ff_fft_lut_init(void)
{
static AVOnce init_once = AV_ONCE_INIT;
ff_thread_once(&init_once, fft_lut_init_start);
}
+1 -1
View File
@@ -61,6 +61,6 @@
extern const int32_t ff_w_tab_sr[];
extern uint16_t ff_fft_offsets_lut[];
void ff_fft_lut_init(uint16_t *table, int off, int size, int *index);
void ff_fft_lut_init(void);
#endif /* AVCODEC_FFT_TABLE_H */

Some files were not shown because too many files have changed in this diff Show More