aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec
Commit message (Collapse)AuthorAgeFilesLines
* avcodec/alsdec: Fix integer overflow in decode_var_block_data()Michael Niedermayer2019-08-211-1/+1
| | | | | | | | | Fixes: signed integer overflow: 1927975249 - -514719744 cannot be represented in type 'int' Fixes: 16413/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5651206856245248 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/internal: Bump sane_nb_chanelsMichael Niedermayer2019-08-211-1/+1
| | | | | | | | This allows decoding more als reference samples Suggested-by: Thilo Borgmann <thilo.borgmann@mail.de> Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/alsdec: Limit maximum channels to 512Michael Niedermayer2019-08-211-0/+5
| | | | | | | | | | | | | | | There seems to be no limit in the specification and upto 64k could be stored 512 is choosen as limit as thats the maximum in a conformance sample An alternative to this patch would be a max_channels variable Fixes: OOM Fixes: 16200/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5764788793114624 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Suggested-by: Thilo Borgmann <thilo.borgmann@mail.de> Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* lavc/qsvdec: Add VP9 decoder supportZhong Li2019-08-203-3/+49
| | | | | | VP9 decoder is support on Intel kabyLake+ platforms with MSDK Version 1.19+ Signed-off-by: Zhong Li <zhong.li@intel.com>
* lavc/qsvdec: Add mjpeg decoder supportZhong Li2019-08-203-1/+29
| | | | Signed-off-by: Zhong Li <zhong.li@intel.com>
* lavc/qsvdec: remove orignal parser code since not needed nowZhong Li2019-08-202-30/+1
| | | | Signed-off-by: Zhong Li <zhong.li@intel.com>
* lavc/qsvdec: Replace current parser with MFXVideoDECODE_DecodeHeader()Zhong Li2019-08-204-88/+100
| | | | | | | | | | | | | | | | | Using MSDK parser can improve qsv decoder pass rate in some cases (E.g: sps declares a wrong level_idc, smaller than it should be). And it is necessary for adding new qsv decoders such as MJPEG and VP9 since current parser can't provide enough information. Actually using MFXVideoDECODE_DecodeHeader() was disscussed at https://ffmpeg.org/pipermail/ffmpeg-devel/2015-July/175734.html and merged as commit 1acb19d, but was overwritten when merged libav patches (commit: 1f26a23) without any explain. Split decode header from decode_init, and call it for everyframe to detect format/resoultion change. It can fix some regression issues such as hevc 10bits decoding. Signed-off-by: Zhong Li <zhong.li@intel.com> Signed-off-by: Dmitry Rogozhkin <dmitry.v.rogozhkin@intel.com>
* lavc/qsv: make function qsv_map_fourcc() can be called externallyZhong Li2019-08-202-2/+4
| | | | Signed-off-by: Zhong Li <zhong.li@intel.com>
* lavc/qsvdec: add function ff_qsv_map_picstruct()Zhong Li2019-08-202-0/+20
| | | | Signed-off-by: Zhong Li <zhong.li@intel.com>
* avcodec/anm: Check input size for a frame with just a stop codeMichael Niedermayer2019-08-181-0/+3
| | | | | | | | | Fixes: Timeout (11sec -> 6sec) Fixes: 16344/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ANM_fuzzer-5673032000995328 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Peter Ross <pross@xvid.org> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* aarch64/opusdsp: do not clobber register v8Lynne2019-08-151-4/+4
| | | | A part of v8-v15 needs to be preserved across calls.
* avcodec/libdav1d: allow setting frame size limit in pixelsJames Almer2019-08-141-0/+1
| | | | Signed-off-by: James Almer <jamrial@gmail.com>
* avcodec/flicvideo: Optimize and Simplify FLI_COPY in ↵Michael Niedermayer2019-08-151-8/+1
| | | | | | | | | | | flic_decode_frame_24BPP() by using bytestream2_get_buffer() Fixes: Timeout (31sec -> 22sec) Fixes: 16217/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-5658084189405184 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/loco: Check left column valueMichael Niedermayer2019-08-151-0/+2
| | | | | | | | | Fixes: Timeout (42sec -> 379 ms) Fixes: 16323/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5679178099195904 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/ffwavesynth: Fixes invalid shift with pink noise seekingMichael Niedermayer2019-08-151-1/+1
| | | | | | | | | Fixes: left shift of negative value -961533698048 Fixes: 16242/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5738550670131200 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Nicolas George <george@nsup.org> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/ffwavesynth: Fix integer overflow for some corner case valuesMichael Niedermayer2019-08-151-2/+2
| | | | | | | | Fixes: left shift of negative value -14671840 Fixes: 16000/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5145977817661440 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/indeo2: Check remaining input more oftenMichael Niedermayer2019-08-131-5/+6
| | | | | | | | Fixes: Timeout (95sec -> 30ms) Fixes: 14765/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO2_fuzzer-5692455527120896 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpe Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/diracdec: Check that slices are fewer than pixelsMichael Niedermayer2019-08-131-1/+3
| | | | | | | | Fixes: Timeout (197sec ->144ms) Fixes: 15034/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5733549405110272 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/vp56: Consider the alpha start as end of the prior headerMichael Niedermayer2019-08-131-2/+2
| | | | | | | | | Fixes: Timeout (23sec -> 71ms) Fixes: 15661/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP6A_fuzzer-6257865947348992 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Peter Ross <pross@xvid.org> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avutil/mips: refine msa macros CLIP_*.gxw2019-08-1314-310/+231
| | | | | | | | | | | | | | | Changing details as following: 1. Remove the local variable 'out_m' in 'CLIP_SH' and store the result in source vector. 2. Refine the implementation of macro 'CLIP_SH_0_255' and 'CLIP_SW_0_255'. Performance of VP8 decoding has speed up about 1.1%(from 7.03x to 7.11x). Performance of H264 decoding has speed up about 0.5%(from 4.35x to 4.37x). Performance of Theora decoding has speed up about 0.7%(from 5.79x to 5.83x). 3. Remove redundant macro 'CLIP_SH/Wn_0_255_MAX_SATU' and use 'CLIP_SH/Wn_0_255' instead, because there are no difference in the effect of this two macros. Reviewed-by: Shiyou Yin <yinshiyou-hf@loongson.cn> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/4xm: Check for end of input in decode_p_block()Michael Niedermayer2019-08-131-0/+2
| | | | | | | | | Fixes: Timeout (81sec -> 0.2sec) Fixes: 16169/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5662570416963584 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/hevcdec: Check delta_luma_weight_l0/1Michael Niedermayer2019-08-131-0/+4
| | | | | | | | | Fixes: signed integer overflow: 1 + 2147483647 cannot be represented in type 'int' Fixes: 16041/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5685680656613376 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: James Almer <jamrial@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/hnm4video: Optimize postprocess_current_frame()Michael Niedermayer2019-08-121-5/+8
| | | | | | | | | Improves: Timeout (220sec -> 108sec) Improves: 15570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HNM4_VIDEO_fuzzer-5085482213441536 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* lavc/zmbvenc: Do not left-shift negative values.Carl Eugen Hoyos2019-08-111-2/+2
| | | | | | Fixes the following ubsan errors with the sample from ticket #7980: libavcodec/zmbvenc.c:243:29: runtime error: left shift of negative value -4 libavcodec/zmbvenc.c:244:28: runtime error: left shift of negative value -2
* avcodec/encode: only allow undersized audio frames if they are the lastMarton Balint2019-08-111-2/+8
| | | | | | | | | | | | | | | Otherwise the user might get a silence padded frame in the beginning or in the middle of the encoding. Some other bug uncovered this: ./ffmpeg -loglevel verbose -y -f data -i /dev/zero \ -filter_complex "nullsrc=s=60x60:d=10[v0];sine=d=10[a]" \ -map '[v0]' -c:v:0 rawvideo \ -map '[a]' -c:a:0 mp2 \ -f mpegts out.ts Signed-off-by: Marton Balint <cus@passwd.hu>
* avcodec/hevc_refs: Optimize 16bit generate_missing_ref()Michael Niedermayer2019-08-111-6/+6
| | | | | | | | Fixes: Timeout (86sec -> 8sec) [these numbers assume also "[FFmpeg-devel] [PATCH 2/5] [RFC] avcodec/hevcdec: Check for overread in hls_decode_entry()"] Fixes: 15702/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5657764929470464 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/scpr: Use av_memcpy_backptr() in type 17 and 33Michael Niedermayer2019-08-111-4/+3
| | | | | | | | | | | | This makes the changed code-path faster. Change not tested except with the fuzzer testcase as I found no other testcase. Improves: Timeout (136sec -> 74sec) Improves: 16040/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-5705876062601216 Reviewed-by: Paul B Mahol <onemda@gmail.com> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
* avcodec/tiff: Enforce increasing offsetsMichael Niedermayer2019-08-111-1/+10
| | | | | | | | | | | | | | | | | | This may break some valid tiff files, it appears the specification does not require the offsets to be increasing. They increase in the 2 test files i have though except the last offset which is 0 (an end marker) and for which a special case is added to avoid asking for a sample for that end marker. See: [FFmpeg-devel] [PATCH 2/2] avcodec/tiff: Detect infinite retry loop for an alternative implementation Fixes: Timeout (Infinite -> Finite) Fixes: 15706/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5114674904825856 This variant was requested by paul on IRC Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/dds: Use ff_set_dimensions()Michael Niedermayer2019-08-111-3/+4
| | | | | | | | | Fixes: signed integer overflow: 2082471995 * 36 cannot be represented in type 'int' Fixes: 16025/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DDS_fuzzer-5136663778426880 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpc8: Fix 32bit mask/enumMichael Niedermayer2019-08-111-1/+1
| | | | | | | | | Fixes: left shift of 1 by 31 places cannot be represented in type 'int' Fixes: 15817/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC8_fuzzer-5636626409062400 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/alsdec: Fix integer overflows of raw_samples in decode_var_block_data()Michael Niedermayer2019-08-111-2/+2
| | | | | | | | | | | This also makes the code consistent with the existing similar MUL64() in decode_var_block_data() Fixes: signed integer overflow: -7277630735906765035 + -3272193951413647896 cannot be represented in type 'long' Fixes: 16015/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5666552818434048 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/alsdec: Fix integer overflow of raw_samples in decode_blocks()Michael Niedermayer2019-08-111-2/+2
| | | | | | | | Fixes: signed integer overflow: 2147483424 - -1772303236 cannot be represented in type 'int' Fixes: 15708/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5067890362941440 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/alsdec: fix mantisse shiftMichael Niedermayer2019-08-111-1/+5
| | | | | | | | Fixes: shift exponent -1 is negative Fixes: 16039/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5656825657032704 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/pngdec: consider chunk size in minimal size checkMichael Niedermayer2019-08-111-1/+1
| | | | | | | | | | assuming each block contains an empty chunk there has to be at least 8 bytes extra. Fixes: 15327/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LSCR_fuzzer-5676669303521280 Fixes: Timeout (11->5sec) Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/vc1_block: Fix invalid shifts in vc1_decode_i_blocks()Michael Niedermayer2019-08-111-2/+2
| | | | | | | | | Fixes: left shift of negative value -9 Fixes: 15299/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSS2_fuzzer-5660922678345728 Fixes: 15557/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5673351911047168 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/vc1_block: fix invalid shift in vc1_decode_p_mb()Michael Niedermayer2019-08-111-1/+1
| | | | | | | | Fixes: left shift of negative value -5 Fixes: 15294/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5733921754447872 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/aacdec_template: fix integer overflow in imdct_and_windowing()Michael Niedermayer2019-08-111-1/+1
| | | | | | | | Fixes: signed integer overflow: 2147483645 + 4 cannot be represented in type 'int' Fixes: 15418/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5685269069561856 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* lavc/videotoolboxenc: make transfer_fnc initialized for unsupport functionLimin Wang2019-08-111-0/+1
| | | | | | | | The current function will report one error message, but the caller func haven't check it, so change the default to process as AVCOL_TRC_UNSPECIFIED. Signed-off-by: Limin Wang <lance.lmwang@gmail.com> Signed-off-by: Rick Kern <kernrj@gmail.com>
* lavc/videotoolboxenc: add hdr10, linear, hlg color transfer function for ↵Limin Wang2019-08-111-0/+16
| | | | | | | | | | | | videotoolboxenc Below is the testing ffmpeg command for the setting: ./ffmpeg -i input.ts -c:v hevc_videotoolbox -color_primaries bt2020 -colorspace bt2020_ncl -color_trc smpte2084 smpte2048.ts ./ffmpeg -i input.ts -c:v hevc_videotoolbox -color_primaries bt2020 -colorspace bt2020_ncl -color_trc linear linear.ts ./ffmpeg -i input.ts -c:v hevc_videotoolbox -color_primaries bt2020 -colorspace bt2020_ncl -color_trc arib-std-b67 hlg.ts Signed-off-by: Limin Wang <lance.lmwang@gmail.com> Signed-off-by: Rick Kern <kernrj@gmail.com>
* lavc/r210enc: Fix undefined behaviour encoding r10k.Carl Eugen Hoyos2019-08-111-3/+3
| | | | | | | Fixes the following ubsan error: libavcodec/r210enc.c:69:28: runtime error: left shift of 522 by 22 places cannot be represented in type 'int' Fixes ticket #7982.
* lavc/vc2enc_dwt: Avoid left-shifting a negative value.Carl Eugen Hoyos2019-08-111-1/+1
| | | | Fixes ticket #7985.
* lavc/frame_thread_encoder: Do not memcpy() from NULL.Carl Eugen Hoyos2019-08-111-1/+2
| | | | Fixes ticket #7981.
* lavc/libx264: Cast cpb bit_rates to int64_t to avoid an integer overflow.Carl Eugen Hoyos2019-08-101-2/+2
| | | | Fixes remaining part of ticket #8071 on next version bump.
* lavc/libx264: Cast bit_rate to int64_t to avoid an integer overflow.Carl Eugen Hoyos2019-08-101-1/+1
| | | | Fixes ticket #8071.
* lavc/libx264: bit_rates > INT_MAX are not supported.Carl Eugen Hoyos2019-08-101-0/+4
|
* avcodec/alsdec: Check for block_length <= 0 in read_var_block_data()Michael Niedermayer2019-08-051-1/+1
| | | | | | | | Fixes: left shift of negative value -1 Fixes: 15719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5685731105701888 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/vqavideo: Set video sizeMichael Niedermayer2019-08-051-1/+1
| | | | | | | | Fixes: out of array access Fixes: 15919/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-5657368257363968 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/sanm: Check extradata_size before allocationsMichael Niedermayer2019-08-051-5/+5
| | | | | | | | Fixes: Leaks Fixes: 15349/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5102530557640704 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* libavcodec/iff: Use unsigned to avoid undefined behaviourAndreas Rheinhardt2019-08-051-17/+17
| | | | | | | | | | | The initialization of the uint32_t plane32_lut matrix uses left shifts of the form 1 << plane; plane can be as big as 31 which means that this is undefined behaviour as 1 will be simply an int. So make it unsigned to avoid this. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mss1: check for overread and forward errorsMichael Niedermayer2019-08-054-0/+18
| | | | | | | | | Fixes: Timeout (106sec -> 14ms) Fixes: 15576/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSS1_fuzzer-5688080461201408 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>