summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* lavc/pngdec: use a separate bytestream reader for each chunkAnton Khirnov2021-04-081-94/+72
| | | | | | This makes sure that reading a truncated chunk will never overflow into the following chunk. It also allows to remove many repeated lines skipping over the trailing crc checksum.
* lavc/pngdec: improve chunk length checkAnton Khirnov2021-04-081-1/+1
| | | | The length does not cover the chunk type or CRC.
* tests/fate: add tests for PNG side/meta dataAnton Khirnov2021-04-083-0/+58
|
* lavc/pngdec: restructure exporting frame meta/side dataAnton Khirnov2021-04-081-43/+119
| | | | | | | | | | | | | | | This data cannot be stored in PNGDecContext.picture, because the corresponding chunks may be read after the call to ff_thread_finish_setup(), at which point modifying shared context data is a race. Store intermediate state in the context and then write it directly to the output frame. Fixes exporting frame metadata after 5663301560 Fixes #8972 Found-by: Andreas Rheinhardt <[email protected]>
* lavc/pngdec: remove unnecessary context variablesAnton Khirnov2021-04-081-19/+17
| | | | | | Do not store the image buffer pointer/linesize in the context, just access them directly from the frame. Stop assuming that linesize is the same for the current and last frame.
* lavc/pngdec: perform APNG blending in-placeAnton Khirnov2021-04-081-23/+28
| | | | Saves an allocation+free and two frame copies per each frame.
* avcodec/vc1dec: Fix memleak upon allocation errorAndreas Rheinhardt2021-04-081-1/+1
| | | | | | | | | | ff_vc1_decode_init_alloc_tables() had one error path that forgot to free already allocated buffers; these would then be overwritten on the next allocation attempt (or they would just not be freed in case this happened during init, as the decoders for which it is used do not have the FF_CODEC_CAP_INIT_CLEANUP set). Signed-off-by: Andreas Rheinhardt <[email protected]>
* lavfi/dnn: add post process for detectionGuo, Yejun2021-04-084-7/+33
|
* lavfi/dnn: refine code for frame pre/proc processingGuo, Yejun2021-04-086-14/+24
|
* lavfi/dnn_backend_openvino.c: only allow DFT_PROCESS_FRAME to get output dimGuo, Yejun2021-04-081-0/+5
|
* avcodec/h261dec: Initialize IDCT context during initAndreas Rheinhardt2021-04-081-4/+1
| | | | | | | | | | | | | Before 998c9f15d1ca8c7489775ebcca51623b915988f1, initializing an MpegEncContext's IDCT parts occured in ff_mpv_common_init() and this has been called in h261_decode_frame(), not h261_decode_init(). Yet said commit factored this out of ff_mpv_common_init() and therefore there is no reason any more not to set this during init as this commit does. Reviewed-by: Michael Niedermayer <[email protected]> Signed-off-by: Andreas Rheinhardt <[email protected]>
* avcodec/rv34, mpegvideo: Fix segfault upon frame size change errorAndreas Rheinhardt2021-04-082-6/+13
| | | | | | | | | | | | | | | | | | | | | The RealVideo 3.0 and 4.0 decoders call ff_mpv_common_init() only during their init function and not during decode_frame(); when the size of the frame changes, they call ff_mpv_common_frame_size_change(). Yet upon error, said function calls ff_mpv_common_end() which frees the whole MpegEncContext and not only those parts that ff_mpv_common_frame_size_change() reinits. As a result, the context will never be usable again; worse, because decode_frame() contains no check for whether the context is initialized or not, it is presumed that it is initialized, leading to segfaults. Basically the same happens if rv34_decoder_realloc() fails. This commit fixes this by only resetting the parts that ff_mpv_common_frame_size_change() changes upon error and by actually checking whether the context is in need of reinitialization in ff_rv34_decode_frame(). Reviewed-by: Michael Niedermayer <[email protected]> Signed-off-by: Andreas Rheinhardt <[email protected]>
* avcodec/rv10: Don't presume context to be initializedAndreas Rheinhardt2021-04-081-1/+1
| | | | | | | | | | | | | | In case of resolution changes rv20_decode_picture_header() closes and reopens its MpegEncContext; it checks the latter for errors, yet when an error happens, it might happen that no new attempt at reinitialization is performed when decoding the next frame; this leads to crashes lateron. This commit fixes this by making sure that initialization will always be attempted if the context is currently not initialized. Reviewed-by: Michael Niedermayer <[email protected]> Signed-off-by: Andreas Rheinhardt <[email protected]>
* avcodec/mpegvideo: Factor common freeing code outAndreas Rheinhardt2021-04-081-21/+15
| | | | | Reviewed-by: Michael Niedermayer <[email protected]> Signed-off-by: Andreas Rheinhardt <[email protected]>
* avcodec/mpegvideo: Fix memleak upon allocation errorAndreas Rheinhardt2021-04-081-53/+36
| | | | | | | | | | | | | | | | | | | | | | | | | When slice-threading is used, ff_mpv_common_init() duplicates the first MpegEncContext and allocates some buffers for each MpegEncContext (the first as well as the copies). But the count of allocated MpegEncContexts is not updated until after everything has been allocated and if an error happens after the first one has been allocated, only the first one is freed; the others leak. This commit fixes this: The count is now set before the copies are allocated. Furthermore, the copies are now created and initialized before the first MpegEncContext, so that the buffers exclusively owned by each MpegEncContext are still NULL in the src MpegEncContext so that no double-free happens upon allocation failure. Given that this effectively touches every line of the init code, it has also been factored out in a function of its own in order to remove code duplication with the same code in ff_mpv_common_frame_size_change() (which was never called when using more than one slice (and if it were, there would be potential double-frees)). Reviewed-by: Michael Niedermayer <[email protected]> Signed-off-by: Andreas Rheinhardt <[email protected]>
* Revert "avcodec: add FF_CODEC_CAP_INIT_CLEANUP for all codecs which use ↵Andreas Rheinhardt2021-04-087-27/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ff_mpv_common_init()" This mostly reverts commit 4b2863ff01b1fe93d9a518523c9098d17a9d8c6f. Said commit removed the freeing code from ff_mpv_common_init(), ff_mpv_common_frame_size_change() and ff_mpeg_framesize_alloc() and instead added the FF_CODEC_CAP_INIT_CLEANUP to several codecs that use ff_mpv_common_init(). This introduced several bugs: a) Several decoders using ff_mpv_common_init() in their init function were forgotten: This affected FLV, Intel H.263, RealVideo 3.0 and V4.0 as well as VC-1/WMV3. b) ff_mpv_common_init() is not only called from the init function of codecs, it is also called from AVCodec.decode functions. If an error happens after an allocation has succeeded, it can lead to memleaks; furthermore, it is now possible for the MpegEncContext to be marked as initialized even when ff_mpv_common_init() returns an error and this can lead to segfaults because decoders that call ff_mpv_common_init() when decoding a frame can mistakenly think that the MpegEncContext has been properly initialized. This can e.g. happen with H.261 or MPEG-4. c) Removing code for freeing from ff_mpeg_framesize_alloc() (which can't be called from any init function) can lead to segfaults because the check for whether it needs to allocate consists of checking whether the first of the buffers allocated there has been allocated. This part has already been fixed in 76cea1d2ce3f23e8131c8664086a1daf873ed694. d) ff_mpv_common_frame_size_change() can also not be reached from any AVCodec.init function; yet the changes can e.g. lead to segfaults with decoders using ff_h263_decode_frame() upon allocation failure, because the MpegEncContext will upon return be flagged as both initialized and not in need of reinitialization (granted, the fact that ff_h263_decode_frame() clears context_reinit before the context has been reinited is a bug in itself). With the earlier version, the context would be cleaned upon failure and it would be attempted to initialize the context again in the next call to ff_h263_decode_frame(). While a) could be fixed by adding the missing FF_CODEC_CAP_INIT_CLEANUP, keeping the current approach would entail adding cleanup code to several other places because of b). Therefore ff_mpv_common_init() is again made to clean up after itself; the changes to the wmv2 decoder and the SVQ1 encoder have not been reverted: The former fixed a memleak, the latter allowed to remove cleanup code. Fixes: double free Fixes: ff_free_picture_tables.mp4 Fixes: ff_mpeg_update_thread_context.mp4 Fixes: decode_colskip.mp4 Fixes: memset.mp4 Reviewed-by: Michael Niedermayer <[email protected]> Signed-off-by: Andreas Rheinhardt <[email protected]>
* avformat/url: add ff_make_absolulte_url2 to be able to test windows path casesMarton Balint2021-04-074-6/+69
| | | | Signed-off-by: Marton Balint <[email protected]>
* avformat/url: fix ff_make_absolute_url with Windows file pathsMarton Balint2021-04-071-1/+23
| | | | | | | | Ugly, but a lot less broken than it was. Fixes ticket #9166. Signed-off-by: Marton Balint <[email protected]>
* avformat/utils: add helper functions to retrieve index entries from an AVStreamJames Almer2021-04-074-1/+71
| | | | Signed-off-by: James Almer <[email protected]>
* doc/muxers: fix alphabetical sorting of entriesGyan Doshi2021-04-071-174/+174
|
* mov: Skip computing SAR from invalid display matrix elementsVittorio Giovara2021-04-061-1/+1
|
* avcodec/bsf: Simplify getting codec nameAndreas Rheinhardt2021-04-061-2/+2
| | | | | | | | All codec ids on BSF whitelists have a codec descriptor, so one can just use avcodec_get_name() without worrying about the case of what happens when no codec descriptor is found. Signed-off-by: Andreas Rheinhardt <[email protected]>
* avformat/mov: check offset for overflow in mov_probe()Michael Niedermayer2021-04-051-1/+3
| | | | | | | | Fixes: Invalid read of size 4 Fixes: ASAN_Deadlysignal.zip Found-by: Hardik Shah <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]>
* avcodec/options: Remove always-true checkAndreas Rheinhardt2021-04-051-1/+1
| | | | | | Every codec has a name. Signed-off-by: Andreas Rheinhardt <[email protected]>
* avutil/frame: Return 0 on success in av_frame_ref()Andreas Rheinhardt2021-04-051-1/+1
| | | | | | | | av_frame_copy() is allowed to return values >= 0 on success, whereas the documentation of av_frame_ref() states that the return value is 0 on success. Ergo the latter must not just return the former's return value. Signed-off-by: Andreas Rheinhardt <[email protected]>
* avformat/dss: Return 0 on successAndreas Rheinhardt2021-04-051-2/+2
| | | | Signed-off-by: Andreas Rheinhardt <[email protected]>
* avformat/dss: Avoid using intermediate bufferAndreas Rheinhardt2021-04-051-14/+11
| | | | | | | All one needs is one byte beyond the end of the normal data; and because the packet is padded, one already has it. Signed-off-by: Andreas Rheinhardt <[email protected]>
* avformat/dss: Set values known during read_header in read_headerAndreas Rheinhardt2021-04-051-4/+2
| | | | Signed-off-by: Andreas Rheinhardt <[email protected]>
* avformat/mpegtsenc: Preserve disposition in the absence of languageAndreas Rheinhardt2021-04-051-9/+8
| | | | | | | Implements ticket #9113. Reviewed-by: Marton Balint <[email protected]> Signed-off-by: Andreas Rheinhardt <[email protected]>
* avfilter/vf_find_rect: Use correct format specifierAndreas Rheinhardt2021-04-041-1/+1
| | | | | | | | | Fixes the following GCC warning: warning: format ‘%lld’ expects argument of type ‘long long int’, but argument 4 has type ‘int64_t’ {aka ‘long int’} [-Wformat=] Reviewed-by: Gyan Doshi <[email protected]> Signed-off-by: Andreas Rheinhardt <[email protected]>
* atomics: Fix the win32 atomic_exchange functionMartin Storsjö2021-04-041-1/+1
| | | | | | | | | | This fixes building with MSVC after a2a38b160620d91bc3f895dadc4501c589998b9c. Remove the stray semicolon, and add casts for the input argument (which is an intptr_t*) to the right type (PVOID volatile *). Signed-off-by: Martin Storsjö <[email protected]>
* avfilter/find_rect: write score to metadataGyan Doshi2021-04-041-0/+4
|
* avfilter/find_rect: add option to discard non-matching framesGyan Doshi2021-04-042-1/+11
| | | | Default is disabled.
* avfilter/find_rect: improve loggingGyan Doshi2021-04-041-1/+3
| | | | | Log now indicates timestamps of frames where a match is made. Loglevel is changed to INFO since the user specifically wants this info.
* avcodec/wmavoice: Check operations that can failAndreas Rheinhardt2021-04-031-5/+6
| | | | | | There might be segfaults on failure. Signed-off-by: Andreas Rheinhardt <[email protected]>
* avcodec/mjpegdec: Fix leak in case ICC array allocations fail partiallyAndreas Rheinhardt2021-04-032-17/+19
| | | | | | | | | If only one of the two arrays used for the ICC profile could be successfully allocated, it might be overwritten and leak when the next ICC entry is encountered. Fix this by using a common struct, so that one has only one array to allocate. Signed-off-by: Andreas Rheinhardt <[email protected]>
* avcodec/cfhd: Keep track of which subbands have been readMichael Niedermayer2021-04-032-0/+27
| | | | | | | | | | | | | | This avoids use of uninitialized data also several checks are inside the band reading code so it is important that it is run at least once Fixes: out of array accesses Fixes: 28209/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-5684714694377472 Fixes: 32124/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-5425980681355264 Fixes: 30519/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-4558757155700736 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]>
* avcodec/cfhd: Require valid setup before Lowpass coefficients, BandHeader ↵Michael Niedermayer2021-04-031-12/+27
| | | | | | | | | and BandSecondPass Previously the code skipped all security checks when these where encountered but prior data was incorrect. Also replace an always true condition by an assert Signed-off-by: Michael Niedermayer <[email protected]>
* avcodec/cfhd: Check transform_type consistentlyMichael Niedermayer2021-04-032-2/+10
| | | | | | | | | | Fixes: out of array accesses Fixes: 29754/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-6333598414274560 Fixes: 30519/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-6298424511168512 Fixes: 30739/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-5011292836462592 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]>
* avcodec/mjpegdec: Check initializing Huffman tablesAndreas Rheinhardt2021-04-031-1/+2
| | | | | Reviewed-by: Michael Niedermayer <[email protected]> Signed-off-by: Andreas Rheinhardt <[email protected]>
* avcodec/mjpegdec: Fix leak in case of invalid external Huffman tablesAndreas Rheinhardt2021-04-031-0/+1
| | | | | | | | | | | | | When using external Huffman tables fails during init, the decoder reverts back to using the default Huffman tables; and when doing so, the current VLC tables leak because init_default_huffman_tables() doesn't free them before overwriting them. Sample: samples.ffmpeg.org/archive/all/avi+mjpeg+pcm_s16le++mjpeg-interlace.avi Reviewed-by: Michael Niedermayer <[email protected]> Signed-off-by: Andreas Rheinhardt <[email protected]>
* avcodec/a64multienc: Don't use static buffers, fix potential racesAndreas Rheinhardt2021-04-031-4/+7
| | | | | | | | | | | | render_charset() used static buffers that are always completely initialized before every use, so that it is unnecessary for the values in these arrays to be kept after leaving the function. Given that this is not only unnecessary, but harmful due to the possibility of data races if several instances of a64multi/a64multi5 run simultaneously these buffers have been replaced by ordinary buffers on the stack (they are small enough for this). Signed-off-by: Andreas Rheinhardt <[email protected]>
* avcodec/rawdec: Free bitstream_bufAndreas Rheinhardt2021-04-031-0/+1
| | | | Signed-off-by: Andreas Rheinhardt <[email protected]>
* doc/ffmpeg: clarify what -hwaccels list indicatesGyan Doshi2021-04-031-1/+3
| | | | Fixes #8204
* avformat/vividas: Fix crash when seeking without audio streamAndreas Rheinhardt2021-04-021-7/+12
| | | | | | | The current code tries the access the codecpar of a nonexistent audio stream when seeking. Stop that. Fixes ticket #9121. Signed-off-by: Andreas Rheinhardt <[email protected]>
* avutil/cpu: Fix race condition in av_cpu_count()Andreas Rheinhardt2021-04-021-4/+2
| | | | | | | | | | av_cpu_count() intends to emit a debug message containing the number of logical cores when called the first time. The check currently works with a static volatile int; yet this does not help at all in case of concurrent accesses by multiple threads. So replace this with an atomic_int. Signed-off-by: Andreas Rheinhardt <[email protected]>
* avcodec/ass_split: Don't presume strlen to be >= 2Andreas Rheinhardt2021-04-021-1/+1
| | | | | | Fixes potential heap-buffer-overflow. Signed-off-by: Andreas Rheinhardt <[email protected]>
* avcodec/binkaudio: Check return value of functions that can failAndreas Rheinhardt2021-04-021-3/+5
| | | | Signed-off-by: Andreas Rheinhardt <[email protected]>
* avcodec/binkaudio: Fix memleak upon init failureAndreas Rheinhardt2021-04-021-0/+2
| | | | Signed-off-by: Andreas Rheinhardt <[email protected]>
* avcodec/flacenc: Fix memleak upon init errorAndreas Rheinhardt2021-04-021-0/+1
| | | | | | An AVMD5 struct would leak if an error happened after its allocation. Signed-off-by: Andreas Rheinhardt <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-09-13 22:05:36 +0000