| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
| |
It's helpful for developers and the same as the hevcdec.
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
|
|
| |
This commit fixed decoding the DUAL_TREE_CHROMA palette coding unit
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
|
|
|
|
|
|
|
| |
ff_vvc_palette_escape_val() can return AVERROR in which case the
coeff*scale will overflow.
Fixes: runtime error: signed integer overflow: -1094995529 * 6528 cannot
be represented in type 'int'
Fixes: 435225406/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-5118570024730624
Found-by: OSS-Fuzz
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Consider the following sequence of NALUs (with some PPSs etc. omitted
for brevity):
1. SPS (ID=0, content=A)
2. IDR (SPS=0)
3. IDR (SPS=0)
4. SPS (ID=0, content=B)
5. TRAIL (SPS=0)
When decode_sps is called for NALU 3., ps->sps_id_used is cleared as
IDRs are one way of forming a CLVSS. Then, old_sps is non-NULL
containing the result of calling decode_sps for NALU 2. We haven't
received any SPSs between NALUs 2. and 3., therefore old_sps and rsps
are identical and the function returns. The issue is that, at this
point, ps->sps_id_used is still zero despite the SPS being used for IDR
3. This results in the check for conflicting SPSs not working properly
when decode_sps is called for NALU 5., allowing prediction between
pictures with different SPSs and probably all sorts of other
shenanigans.
Patch addresses the problem outlined above by also setting
ps->sps_id_used in the early return case.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Prior to this patch, kth_order_egk_decode could read arbitrarily
large values which then overflowed and caused various issues.
Patch fixes this by making kth_order_egk_decode falliable,
requiring the caller to specify an upper bound and returning an
error if the read value would exceed that bound.
This patch resolves the same issue as
eb52251c0ab025b6b40b28994bc9dc616813b190, but I think this is the proper
fix as it also addresses issues with syntax elements besides
ff_vvc_num_signalled_palette_entries.
Signed-off-by: Frank Plowman <post@frankplowman.com>
|
|
|
|
| |
Signed-off-by: Frank Plowman <post@frankplowman.com>
|
|
|
|
| |
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
|
|
|
|
|
|
|
|
| |
Fixes: index 107 out of bounds for type 'uint16_t const[63]'
Fixes: 421336912/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-6436225806565376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
|
|
|
|
|
|
|
|
| |
Fixes: integer overflow
Fixes: 418314174/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-4871731867353088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The ret value is checked later on again, so this check
is redundant and would cause the frame to not be unrefd on
failure as well.
So remove this check and add one before av_frame_remove_side_data
to ensure it is not called with an invalid frame.
Fix CID 1648350
Reviewed-by: Frank Plowman <post@frankplowman.com>
|
|
|
|
|
|
|
|
|
|
|
| |
Add handling here for
sps_scaling_matrix_for_alternative_colour_space_disabled_flag.
Also add parentheses to make behaviour a little more explicit,
where &&'s precedence over || was relied on previously.
Reported-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Frank Plowman <post@frankplowman.com>
|
|
|
|
|
|
|
|
|
| |
While the current code iterated over the messages, it always returned
in the first iteration. Instead keep iterating and warn for failure to
parse. At time of writing, none of the parsing functions seems to
actually return an error, ever.
Fix CID 1648348
|
|
|
|
|
|
|
|
|
| |
When checking for filmgrain here, needs_fg can be true even when
film_grain_characteristics is NULL (when aom_film_grain.enable is true),
therefore this check could end up dereferencing film_grain_characteristics
even though it is NULL.
Fix CID 1648347
|
|
|
|
| |
Signed-off-by: Frank Plowman <post@frankplowman.com>
|
|
|
|
| |
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
| |
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
|
|
|
|
| |
passed files:
FIELD_A_Panasonic_4.bit
FIELD_B_Panasonic_2.bit
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
| |
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
| |
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
| |
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
| |
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
| |
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
| |
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
| |
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
| |
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
| |
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
| |
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
|
|
|
| |
Add three missing requirements on bitstream conformance from 7.4.3.19 of
H.266 (V3). Issue found using fuzzing.
Signed-off-by: Frank Plowman <post@frankplowman.com>
|
|
|
|
|
|
|
|
|
|
| |
When called for palette-predicted CUs, boundary_strength could cause
undefined behaviour due to accessing uninitialised motion information.
The spec doesn't include this, but in the reference software it seems
the deblock strength is always set to 0 for palette CUs due to some
implementation details: perhaps this is a spec issue?
Signed-off-by: Frank Plowman <post@frankplowman.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
In d5dbcc00d889fb17948b025a468b00ddbea9e058, it was hoped that detection
of subpicture overlaps could be performed at the tile level, so as to
avoid introducing per-CTU checks. Unfortunately since that patch,
fuzzing has indicated there are some structures involving
pps_subpic_one_or_more_tiles_slice where tile-level checking is not
sufficient. Performing the check at the CTU level should (touch wood)
be the be-all and and-all of this, as CTUs are the lowest common
denominator of the picture partitioning.
Signed-off-by: Frank Plowman <post@frankplowman.com>
|
|
|
|
|
|
|
|
| |
Fixes a crash triggered by a fuzzed clip:
https://github.com/ffvvc/tests/tree/main/fuzz/passed/000256.bit
Reproduce with:
ffmpeg -i 000256.bit -f null -
|
|
|
|
|
|
|
|
| |
passed files:
ACT_A_Kwai_3.bit
ACT_B_Kwai_3.bit
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
|
|
| |
prepare for adaptive color transform
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
|
|
| |
prepare for adaptive color transform
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
|
|
| |
prepare for adaptive color transform
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
|
|
| |
See 8.7.3 Scaling process for transform coefficients
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
|
|
| |
See 8.7.4.6 Residual modification process for blocks using colour space conversion
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
|
|
| |
residual functionality
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
|
|
| |
See 8.4.3 Derivation process for chroma intra prediction mode
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
| |
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
| |
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Introduction at https://ieeexplore.ieee.org/document/9408666
passed files:
10b422_G_Sony_5.bit
10b422_H_Sony_5.bit
10b422_I_Sony_5.bit
10b422_J_Sony_5.bit
10b422_K_Sony_5.bit
10b422_L_Sony_5.bit
8b422_G_Sony_5.bit
8b422_H_Sony_5.bit
8b422_I_Sony_5.bit
8b422_J_Sony_5.bit
8b422_K_Sony_5.bit
8b422_L_Sony_5.bit
8b444_A_Kwai_2.bit
8b444_B_Kwai_2.bit
PALETTE_A_Alibaba_2.bit
PALETTE_B_Alibaba_2.bit
PALETTE_C_Alibaba_2.bit
PALETTE_D_Alibaba_2.bit
PALETTE_E_Alibaba_2.bit
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
| |
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
| |
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
| |
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
| |
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
| |
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|
|
|
|
| |
Signed-off-by: Wu Jianhua <toqsxw@outlook.com>
|