aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/mpeg4videodec.c
Commit message (Collapse)AuthorAgeFilesLines
* avcodec: Replace get_bits_long() by get_bits() where possibleMichael Niedermayer2019-12-311-1/+1
| | | | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec: Replace show_bits_long() by show_bits() where possibleMichael Niedermayer2019-12-311-2/+2
| | | | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* repeat an even number of characters in occuredMichael Niedermayer2019-09-161-1/+1
| | | | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Fix integer overflow in mpeg4_decode_studio_block()Michael Niedermayer2019-09-111-1/+2
| | | | | | | | | Fixes: signed integer overflow: 24023040 * 112 cannot be represented in type 'int' Fixes: 16570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5173275211071488 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Kieran Kunhya <kierank@obe.tv> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Check idx in mpeg4_decode_studio_block()Michael Niedermayer2019-03-121-0/+6
| | | | | | | | | Fixes: Out of array access Fixes: 13500/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5769760178962432 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Kieran Kunhya <kierank@obe.tv> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Fix nonsense warningAndreas Rheinhardt2019-03-121-3/+7
| | | | | | | | | | | | Since db772308941a2a338c7809f90d347219a6a93074 parsing of mpeg4-extradata lead to a "Failed to parse extradata" warning, because ff_mpeg4_decode_picture_header returns AVERROR_INVALIDDATA in case that no VOP was found. This patch adds a parameter to signify whether a header (where the absence of a VOP does not raise an error) or not is parsed. The first mode is of course used for parsing headers. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@googlemail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Clear interlaced_dct for studio profileMichael Niedermayer2019-02-161-0/+1
| | | | | | | | | Fixes: Out of array access Fixes: 13090/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5408668986638336 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Kieran Kunhya <kierank@obe.tv> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Clear partitioned frame in decode_studio_vop_header()Michael Niedermayer2018-11-041-0/+1
| | | | | | | | | | partitioned_frame is also set/cleared in decode_vop_header() Fixes: out of array read Fixes: 9789/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5638681627983872 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Fix typo in sprite delta checkMichael Niedermayer2018-10-221-1/+1
| | | | | | | | Fixes: Integer overflow Fixes: 10890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5636062181851136 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Fix undefined shift in get_amv()Michael Niedermayer2018-09-191-1/+1
| | | | | | | | Fixes: runtime error: shift exponent -1 is negative Fixes: 9938/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5653783529914368 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Check rice_prefix_codeMichael Niedermayer2018-09-191-0/+4
| | | | | | | | | | Fixes: out of array read Fixes: 10064/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5766801384800256 Fixes: 10225/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5071833448054784 Fixes: 10261/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5115048024866816 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* mpeg4video: Add Studio DPCM supportKieran Kunhya2018-08-251-3/+88
|
* avcodec/mpeg4videodec: Fix slice end detection in mpeg4_decode_studio_mb()Michael Niedermayer2018-08-251-0/+8
| | | | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Check for bitstream end in read_quant_matrix_ext()Michael Niedermayer2018-07-041-1/+10
| | | | | | | | Fixes: out of array read Fixes: asff-crash-0e53d0dc491dfdd507530b66562812fbd4c36678 Found-by: Paul Ch <paulcher@icloud.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Remove use of FF_PROFILE_MPEG4_SIMPLE_STUDIO as ↵Michael Niedermayer2018-07-041-1/+0
| | | | | | | | | | | | | | | indicator of studio profile The profile field is changed by code inside and outside the decoder, its not a reliable indicator of the internal codec state. Maintaining it consistency with studio_profile is messy. Its easier to just avoid it and use only studio_profile Fixes: assertion failure Fixes: ffmpeg_crash_9.avi Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Check read profile before setting itMichael Niedermayer2018-06-281-8/+15
| | | | | | | | Fixes: null pointer dereference Fixes: ffmpeg_crash_7.avi Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Clear bits_per_raw_sample if it has originated from a ↵Michael Niedermayer2018-06-131-0/+6
| | | | | | | | | | previous instance Fixes: assertion failure Fixes: ffmpeg_crash_5.avi Found-by: Thuan Pham <thuanpv@comp.nus.edu.sg>, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4video: Detect reference studio streams as studio streamsMichael Niedermayer2018-05-171-9/+23
| | | | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Check bps (VOL header) before VOP for studio profileMichael Niedermayer2018-05-171-2/+6
| | | | | | | | | | | Fixes: runtime error: shift exponent -1 is negative Fixes: 7486/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4977380939530240 Fixes: runtime error: index 36 out of bounds for type 'const uint8_t [32]' Fixes: 7566/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-6536620682510336 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Do not corrupt bits_per_raw_sampleMichael Niedermayer2018-05-171-3/+5
| | | | | Reviewed-by: Kieran Kunhya <kierank@obe.tv> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videode: Eliminate out of loop VOP startcode reading for studio ↵Michael Niedermayer2018-05-171-4/+0
| | | | | | profile Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Split decode_studio_vol_header() out of ↵Michael Niedermayer2018-05-031-9/+21
| | | | | | decode_studiovisualobject() Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Move decode_studiovisualobject() parsing in the ↵Michael Niedermayer2018-05-031-10/+5
| | | | | | | | | | branch for visual object parsing Fixes: runtime error: shift exponent -1 is negative Fixes: 7510/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5024523356209152 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: unbreak multithreading decodingJames Almer2018-04-041-4/+6
| | | | | | Should fix double free related crashes. Signed-off-by: James Almer <jamrial@gmail.com>
* avcodec/mpeg4videodec: free studio profile VLCs when closing the decoderJames Almer2018-04-041-1/+15
| | | | | | Fixes memleaks. Signed-off-by: James Almer <jamrial@gmail.com>
* mpeg4video: Add support for MPEG-4 Simple Studio Profile.Kieran Kunhya2018-04-021-12/+524
| | | | This is a profile supporting > 8-bit video and has a higher quality DCT
* avcodec/mpeg4videodec: Use more specific error codesMichael Niedermayer2018-03-261-49/+51
| | | | | | Forward error codes where possible. Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Ignore multiple VOL headersMichael Niedermayer2018-02-111-2/+2
| | | | | | Fixes: Ticket7005 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Avoid possibly aliasing violating castsMichael Niedermayer2018-01-291-2/+5
| | | | | | Found-by: kierank Reviewed-by: Kieran Kunhya <kieran618@googlemail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Check mb_num also against 0Michael Niedermayer2018-01-291-1/+1
| | | | | | | | The spec implies that 0 is invalid in addition to the existing checks Found-by: <kierank> Reviewed-by: Kieran Kunhya <kieran618@googlemail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* mpeg4videodec: Fix unused variable warningMark Thompson2017-12-261-3/+4
| | | | video_format is not used.
* avcodec/mpeg4videodec: Add support for parsing and exporting video_rangeMichael Niedermayer2017-12-211-0/+33
| | | | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: fix preprocessor check for the nvdec hwaccelJames Almer2017-11-261-1/+1
| | | | Signed-off-by: James Almer <jamrial@gmail.com>
* lavc: Add hardware config metadata for decoders supporting hardware outputMark Thompson2017-11-261-0/+16
| | | | | | | | | This includes a pointer to the associated hwaccel for decoders using hwaccels - these will be used later to implement the hwaccel setup without needing a global list. Also added is a new file listing all hwaccels as external declarations - this will be used later to generate the hwaccel list at configure time.
* avcodec/mpeg4videodec: Check also for negative versions in the validity checkMichael Niedermayer2017-11-211-1/+1
| | | | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* Fix undefined shift on assumed 8-bit input.Dale Curtis2017-11-211-2/+9
| | | | | | | | | | | | | decode_user_data() attempts to create an integer |build| value with 8 bits of spacing for 3 components. However each component is an int32_t, so shifting each component is undefined for values outside of the 8 bit range. This patch simply clamps input to 8-bits per component and prints out a warning that the values were clamped. Signed-off-by: Dale Curtis <dalecurtis@chromium.org> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* Merge commit '97cfe1d8bd1968143e2ba9aa46ebe9504a835e24'James Almer2017-11-011-4/+4
|\ | | | | | | | | | | | | * commit '97cfe1d8bd1968143e2ba9aa46ebe9504a835e24': Convert all AVClass struct declarations to designated initializers. Merged-by: James Almer <jamrial@gmail.com>
* | Merge commit '6ac0e7818399a57e4684202bac79f35b3561ad1e'James Almer2017-10-261-0/+4
|\| | | | | | | | | | | | | * commit '6ac0e7818399a57e4684202bac79f35b3561ad1e': mpeg4videodec: raise an error if sprite_trajectory.table is NULL Merged-by: James Almer <jamrial@gmail.com>
| * mpeg4videodec: raise an error if sprite_trajectory.table is NULLSean McGovern2017-04-051-0/+4
| | | | | | | | | | CC: libav-stable@libav.org Bug-Id: 1012
* | Merge commit 'dd343fd986459f467a2d1d70c26101dff1d47d68'James Almer2017-10-231-26/+0
|\| | | | | | | | | | | | | * commit 'dd343fd986459f467a2d1d70c26101dff1d47d68': lavu: Drop deprecated VDPAU pixel formats Merged-by: James Almer <jamrial@gmail.com>
| * Mark some arrays that never change as const.Anton Khirnov2017-02-011-1/+1
| |
| * mpeg4videodec: Call av_log() in check_marker() with AVCodecContext instead ↵Alexandra Hájková2016-05-161-10/+10
| | | | | | | | | | | | of NULL Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * Move check_marker() from get_bits to mpeg4videodecAlexandra Hájková2016-05-161-0/+9
| | | | | | | | | | | | MPEG-4 is the only decoder which uses check_marker(). Signed-off-by: Anton Khirnov <anton@khirnov.net>
* | avcodec/mpeg4videodec: Use 64 bit intermediates for sprite deltaMichael Niedermayer2017-10-101-39/+40
| | | | | | | | | | | | | | | | | | Fixes: runtime error: signed integer overflow: -104713 * 65536 cannot be represented in type 'int' Fixes: 3453/clusterfuzz-testcase-minimized-5555554657239040 Fixes: 3528/clusterfuzz-testcase-minimized-6283628420005888 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | avcodec/mpeg4videodec: Clear mcsel before decoding an imageMichael Niedermayer2017-08-111-0/+1
| | | | | | | | | | | | | | | | Fixes: runtime error: signed integer overflow: 2146467840 + 1032192 cannot be represented in type 'int' Fixes: 2826/clusterfuzz-testcase-minimized-5901511613743104 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | avcodec/mpeg4videodec: Fix GMC with videos of dimension 1Michael Niedermayer2017-06-241-1/+1
| | | | | | | | | | | | | | | | Fixes: runtime error: shift exponent -1 is negative Fixes: 2338/clusterfuzz-testcase-minimized-5153426541379584 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | avcodec/mpeg4videodec: Fix overflow in virtual_ref computationMichael Niedermayer2017-06-211-8/+8
| | | | | | | | | | | | | | | | Fixes: runtime error: signed integer overflow: 262144 * -16120 cannot be represented in type 'int' Fixes: 2292/clusterfuzz-testcase-minimized-6156080415506432 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | avcodec/mpeg4videodec: Check sprite delta upshift against overflowing.Michael Niedermayer2017-06-151-8/+10
| | | | | | | | | | | | | | | | Fixes: runtime error: signed integer overflow: -268386304 * 16 cannot be represented in type 'int' Fixes: 2204/clusterfuzz-testcase-minimized-5616756909408256 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | avcodec/mpeg4videodec: Fix integer overflow in num_sprite_warping_points=2 caseMichael Niedermayer2017-06-151-20/+20
| | | | | | | | | | | | | | | | Fixes: runtime error: signed integer overflow: 131072 + 2147352576 cannot be represented in type 'int' Fixes: 2192/clusterfuzz-testcase-minimized-5370387988742144 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: 53098 * ↵Michael Niedermayer2017-06-061-2/+2
| | | | | | | | | | | | | | | | | | 40448 cannot be represented in type 'int' Fixes: 2106/clusterfuzz-testcase-minimized-6136503639998464 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-04 07:34:13 +0000