| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
| |
Fixes: out of array read
Fixes: 6546/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FIC_fuzzer-6317064647081984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit cb2f7ea96b4f6e03ebf0c0563677745fc65f148e)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Fixes: runtime error: shift exponent -1 is negative
Fixes: 7486/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4977380939530240
Fixes: runtime error: index 36 out of bounds for type 'const uint8_t [32]'
Fixes: 7566/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-6536620682510336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit b3a18511cc93082ebecce0861bc15d7f548492e0)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
Fixes: runtime error: left shift of 1876744317 by 16 places cannot be represented in type 'int'
Fixes: 6799/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5115274731716608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 4dd2c8b9ea46b4e008a8bfc2077834428cd5a17c)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
| |
jpeg2000_decode_packets_po_iteration() CPRL case
Fixes: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 7955/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-6016721977606144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 652ba72ed3124f201f98eea9bafb2232b535f549)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
Fixes: assertion failure
Fixes: 7949/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-4819602782552064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit a96c131eb53b00de154f4773d96a3b323ea3daed)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
Fixes: signed integer overflow: 65280 * 196032 cannot be represented in type 'int'
Fixes: 7279/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5977332473921536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 0a4745145840d97619c424961c1b5c625dbf516c)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
Fixes: crbug/827204
Reported-by: Frank Liberato <[email protected]>
Reviewed-by: Frank Liberato <[email protected]>
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 15a2e35e9e74bba5a27e39c26da5be2361f27945)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
| |
decode_studiovisualobject()
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 177133a0f4b41b3c98b9cbc7f8f45755412c537b)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
| |
branch for visual object parsing
Fixes: runtime error: shift exponent -1 is negative
Fixes: 7510/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5024523356209152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit e03bf251d8784f4d1df2c22381c902087e151e31)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
| |
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit c0aa89eeee2af2a4898258b29badea2f935a4836)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
| |
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit a47bd1cd1c714ac94cea9d3a26b58de521a7debc)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
| |
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 0f176bb8e0896f233b35054530f76c4a778b968f)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
| |
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 34dbdcfc20d69b7b67fd13112445cd05b9b5d979)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
Fixes: runtime error: signed integer overflow: 2147483637 + 128 cannot be represented in type 'int'
Fixes: 6701/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5358324934508544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 6e95d80e6fae978f8a44afc24b0c5097a062719f)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
Fixes: runtime error: signed integer overflow: 2147483531 + 16384 cannot be represented in type 'int'
Fixes: 6615/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5165715515506688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit da038c07f02dfc10380001c11b3d047eca7cb8c9)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
Fixes: runtime error: signed integer overflow: 197710 * 10923 cannot be represented in type 'int'
Fixes: 7010/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5667127596941312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 1c97035e3b1677d6f0c5b6161ebfeffcf7bb638d)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
| |
Fixes infinite loop
Fixes: 6858/clusterfuzz-testcase-ffmpeg_AV_CODEC_ID_MSMPEG4V3_fuzzer-4681563766784000
Fixes: 6890/clusterfuzz-testcase-ffmpeg_AV_CODEC_ID_WMV1_fuzzer-4756103142309888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit de841fbea7655b74a9663001e01008a86c88779a)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
| |
Fixes: 6798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5135899701542912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 0bd0401336df4e4ca7f3da6a7e226904fd7d5add)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
also fixes: runtime error: index 1456 out of bounds for type 'int16_t [16]'
Found-by: durandal_1707
Reviewed-by: Paul B Mahol <[email protected]>
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit d06b01fc2d4f5e031d45f9460d1eea610d23d6c5)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
| |
The crc flag is only stored since version 3 thus before this crcs do not
work. We increase the version as needed same as we do with pix_fmts
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit d9706f79c17a33bf97e51a7d6ab211ce83a463ee)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
| |
Fixes linking with "--disable-everything --enable-bsf=eac3_core".
(cherry picked from commit 9461e7d3a598e78811146b730db68d3a5b2532b0)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Commit 8c893aa3cd5 removed quotes that were required to detect
inline asm in clang:
check_insn armv5te qadd r0, r0, r0
.../test.c:1:34: error: expected string literal in 'asm'
void foo(void){ __asm__ volatile(qadd r0, r0, r0); }
The correct code is:
void foo(void){ __asm__ volatile("qadd r0, r0, r0"); }
Commit message written by Frank Liberato <[email protected]>
Signed-off-by: James Almer <[email protected]>
(cherry picked from commit ad94f1c8abe68a2b38536cc96a31327c6be7b105)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Yet another case of forgotten 0 =! EOF translation.
While the documentation for this specific synchronous read
function does not mention it, the documentation for
`sftp_async_read` documents it, as well as looking at the
implementation of this function leads one to find
`if (handle->eof) { return 0; }`.
Reported by stnutt on IRC.
(cherry picked from commit 26892c7615395f331f6143535f03a2957973e2e0)
|
|
|
|
|
| |
Signed-off-by: Aman Gupta <[email protected]>
(cherry picked from commit 12ceaf0fbacb20b86bdc343ba2bbc71d2fff72e0)
|
|
|
|
|
| |
Signed-off-by: Aman Gupta <[email protected]>
(cherry picked from commit 64bf915cd851ab604cb87cd463725fd1c6460a1c)
|
|
|
|
|
|
|
| |
http://fate.ffmpeg.org/report.cgi?slot=x86_64-archlinux-gcc-valgrind&time=20180513001958
Signed-off-by: Aman Gupta <[email protected]>
(cherry picked from commit 42a03e77000692ad6de032b8cf684e1d6ec73790)
|
|
|
|
|
| |
Signed-off-by: Aman Gupta <[email protected]>
(cherry picked from commit 7db022e67bab568a560c8bd55f5840e71a34dc15)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Fixes PMT parsing in some mpegts streams which contain
multiple tables within the PMT pid. Previously, the parser
assumed only one table was present in each packet, and discarded
the rest of the section data after attempting to parse the first
table.
A similar issue was documented in the BeyondTV software[1], which
helped me diagnose the same bug in the ffmpeg mpegts demuxer. I also
tried DVBInspector, libdvbpsi's dvbinfo, and tstools' tsinfo to
help debug. The former two properly read PMTs with multiple tables,
whereas the last has the same bug as ffmpeg.
I've created a minimal sample[2] which contains the combined PMT.
Here's what ffmpeg probe shows before and after this patch:
Before:
Input #0, mpegts, from 'combined-pmt-tids.ts':
Duration: 00:00:01.08, start: 4932.966167, bitrate: 741 kb/s
Program 1
No Program
Stream #0:0[0xf9d]: Audio: ac3, 48000 Hz, mono, fltp, 96 kb/s
Stream #0:1[0xf9b]: Audio: mp3, 0 channels, fltp
Stream #0:2[0xf9c]: Unknown: none
After:
Input #0, mpegts, from 'combined-pmt-tids.ts':
Duration: 00:00:01.11, start: 4932.966167, bitrate: 718 kb/s
Program 1
Stream #0:0[0xf9b]: Video: mpeg2video ([2][0][0][0] / 0x0002), none(tv, top first), 29.97 fps, 29.97 tbr, 90k tbn, 90k tbc
Stream #0:1[0xf9c](eng): Audio: ac3 (AC-3 / 0x332D4341), 48000 Hz, 5.1(side), fltp, 384 kb/s
Stream #0:2[0xf9d](spa): Audio: ac3 (AC-3 / 0x332D4341), 48000 Hz, mono, fltp, 96 kb/s
With the patch, the PMT is parsed correctly so the streams are
created in the correct order, are associated with "Program 1",
and their codecs are set correctly.
[1] http://forums.snapstream.com/vb/showpost.php?p=343816&postcount=201
[2] https://s3.amazonaws.com/tmm1/combined-pmt-tids.ts
Signed-off-by: Aman Gupta <[email protected]>
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 9152c1e495551535886cfd7a8d7c0a206691443e)
|
|
|
|
|
| |
Signed-off-by: Aman Gupta <[email protected]>
(cherry picked from commit 07d9c31055e6e07629506246d68d93b84bec1507)
|
|
|
|
|
| |
Signed-off-by: Aman Gupta <[email protected]>
(cherry picked from commit 1a14e39145816597b97db46dbb30e37feddf246c)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This mimics the logic flow in all the other callbacks
(pat_cb, sdt_cb, m4sl_cb), and avoids calling skip_identical()
for non PMT_TID packets.
Since skip_identical modifies internal state like
MpegTSSectionFilter.last_ver, this change prevents unnecessary
reprocessing on some streams which contain multiple tables in
the PMT pid. This can be observed with streams from certain US
cable providers, which include both tid=0x2 and another unspecified
tid=0xc0.
Signed-off-by: Aman Gupta <[email protected]>
(cherry picked from commit 2c500f50972c19f25ebca783ba9374d6a0c23efb)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
I tested the previous mediacodec changes on seven different Android
TV devices, with both mpeg2 and h264 content. All except one worked
as expected. The exception was the MiBox3 running Android 6.0.1,
where playback would freeze on a frame every few seconds. I tested
two other AMLogic devices with newer Android versions that did not
show the same problem. H264 decoding on the MiBox3 was also not affected,
so this workaround applies only to OMX.amlogic.mpeg2.decoder.awesome
on Android API22.
There is a rumor that Xiaomi is planning to release Android Oreo for
the MiBox3, so I will revisit in a few months to confirm whether this
is specific to os/driver version or the chipset used in that device.
Signed-off-by: Aman Gupta <[email protected]>
Signed-off-by: Matthieu Bouron <[email protected]>
(cherry picked from commit 9b563f6584b5ba2292975f0917268ac7b37497eb)
|
|
|
|
|
|
|
|
|
|
|
|
| |
The output_buffer_count==0 special case is no longer required, and
can cause spurious EAGAIN to surface to the user when input buffers
are filled up. Since the caller now knows if the decoder is accepting
new input (via current_input_buffer>=0), let the wait parameter
control whether we block or not.
Signed-off-by: Aman Gupta <[email protected]>
Signed-off-by: Matthieu Bouron <[email protected]>
(cherry picked from commit a75bb5496ac6e7e194f1c6fd3b87f02a52e74adb)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The new logic follows a recommendation by @rcombs to use
dequeueInputBuffer with a timeout of 0 as a way to detect
whether the codec wants more data. The dequeued buffer index is
kept in MediaCodecDecContext until it can be used next.
A similar technique is also used by the Google's official media
player Exoplayer: see MediaCodecRenderer.feedInputBuffer().
Signed-off-by: Aman Gupta <[email protected]>
Signed-off-by: Matthieu Bouron <[email protected]>
(cherry picked from commit f6681feda641c026d84f6d207f661bf9b87d9d70)
|
|
|
|
|
|
| |
Signed-off-by: Matthieu Bouron <[email protected]>
Signed-off-by: Aman Gupta <[email protected]>
(cherry picked from commit fe0a6bcbda0f51d0613dbbd42a7635c22530ce95)
|
|
|
|
|
|
|
|
|
| |
Also fixes a bug where EOS buffer was sent with incorrect
pts when not using surface generation.
Signed-off-by: Matthieu Bouron <[email protected]>
Signed-off-by: Aman Gupta <[email protected]>
(cherry picked from commit d8e92a89edd8e73cdc7f125f078c576df10b66f2)
|
|
|
|
|
|
|
| |
Signed-off-by: Matthieu Bouron <[email protected]>
Signed-off-by: Jan Ekström <[email protected]>
Signed-off-by: Aman Gupta <[email protected]>
(cherry picked from commit 7a4639b1eba31f88490c85663c75fb1414307680)
|
|
|
|
|
|
|
|
|
|
| |
As of 2a0eb8685, ff_mediacodec_dec_is_flushing() only returns
true in delay_flush mode. Make this more obvious by adding
delay_flush to the if statement.
Signed-off-by: Matthieu Bouron <[email protected]>
Signed-off-by: Aman Gupta <[email protected]>
(cherry picked from commit 6a7a84b2d11e6c5e2ca2023a6886ca75b8b10030)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
In a normal hwaccel, the AVHWFramesContext sets AVFrame.hw_frames_ctx
when it initializes a new AVFrame in av_hwframe_get_buffer().
But the VT hwaccel doesn't know what hw_frames_ctx to assign when
the AVFrame is first created, because it depends on the format of
the pixbuf that the decoder eventually decides to return. Thus
newly created AVFrames always have a NULL hw_frames_ctx, and the
hwaccel would only assign the ctx once a frame was done decoding.
This worked fine with the H264 decoder, but with the HEVC decoder
the frame's data may be moved to another empty AVFrame. Since the
empty AVFrame never had hw_frames_ctx set, a frame with a NULL
ctx could be returned to the API user.
This patch works around the issue by moving the derived
hw_frames_ctx from the AVFrame to a new VTHWFrame which now holds
both the CVPixelBufferRef and the AVBuffer. The hw_frames_ctx
is only copied to the AVFrame right before it is about to be
returned to the user in videotoolbox_postproc_frame() (since
in the case of VT, the hw_frames_ctx is only there for the API
user anyway).
Fixes playback on macOS and iOS of some hevc videos like
https://s3.amazonaws.com/tmm1/videotoolbox/germany-hevc-zdf.ts
Signed-off-by: Aman Gupta <[email protected]>
(cherry picked from commit 8f146b526ff8d63adc02e1c5db15850f4589230b)
|
|
|
|
|
|
|
|
| |
No longer required since 63d875772d. The equivalent hack
for h264 was removed in that commit, but this one was missed.
Signed-off-by: Aman Gupta <[email protected]>
(cherry picked from commit a19bac8fc8b6a8df4030f79a6192b20492b02cef)
|
|
|
|
|
|
|
|
| |
Previously the shared callbacks were trying to interpret
avctx->priv_data as H264Context*
Signed-off-by: Aman Gupta <[email protected]>
(cherry picked from commit 07d175d0b0b22912784f35d29e139cf025a03221)
|
|
|
|
|
|
|
| |
No functional changes.
Signed-off-by: Aman Gupta <[email protected]>
(cherry picked from commit dd77cca1c4b45ec499435f4c484838f6b0b045fe)
|
|
|
|
|
|
|
|
|
|
|
| |
HEVC on iOS
Older iOS devices don't have a hardware HEVC decoder, but the
software decoder offered by VideoToolbox is well-optimized and
performs much better than the ffmpeg decoder.
Signed-off-by: Aman Gupta <[email protected]>
(cherry picked from commit bcff983dc340e76518935111146c0e1daf4cb37b)
|
|
|
|
|
| |
Signed-off-by: Aman Gupta <[email protected]>
(cherry picked from commit 84e03db9a334611d261cb09c534a56bf57a49cd9)
|
|
|
|
|
| |
Signed-off-by: Marton Balint <[email protected]>
(cherry picked from commit 50d6b7bd830eddd403c50f1be3e57f1b4a98ed69)
|
|
|
|
|
|
|
|
|
|
|
| |
My conversation from AVFormatContext->filename to AVFormatContext->url was
wrong in this case because get_chunk_filename uses filename as an output
buffer, and not as an input buffer.
Fixes ticket #7188.
Signed-off-by: Marton Balint <[email protected]>
(cherry picked from commit 2dbe936bf7f9e0fe7e8f05e5c3b78fb1afbff164)
|
|
|
|
|
|
|
|
|
|
|
|
| |
This should be included as `<lilv/lilv.h>`, same as is done in af_lv2.c.
Forcing the extra lilv-0 breaks platforms where the include dir is
`/usr/include/lilv/lilv.h` rather than
`/usr/include/lilv-0/lilv/lilv.h`.
The new include path works for both, because the `pkg-config --cflags`
includes `-I/usr/include/lilv-0`.
(cherry picked from commit 32234e03a792e3ceca58359d6f2b7244ceb6b77f)
|
|
|
|
|
|
|
|
|
|
|
|
| |
The main issue here was the use of [i] instead of [i * 3] for the 32x32
matrix. As part of fixing this, I changed the code to match that used
in vdpau_hevc, which I spent a lot of time verifying.
I also changed to calculating NumPocTotalCurr using the existing helper,
which is what vdpau does.
Signed-off-by: Timo Rothenpieler <[email protected]>
(cherry picked from commit 1261003700322789d62a892e3325f8b58349d051)
|
|
|
|
| |
(cherry picked from commit 46c1ee19171c4704ad7dec65b1c716a727238486)
|
|
|
|
|
|
|
|
|
| |
Yet another case of forgotten 0 =! EOF translation. The libbluray
documentation specifically mentions that a read of 0 is EOF.
Reported by Fyr on IRC.
(cherry picked from commit b995ec078f42bac95eda18fbd1b4387477b55d0d)
|