date:20170610

[FFmpeg-cvslog] fate: add test for -time_base option

2017-06-10 Thread Michael Bradshaw

ffmpeg | branch: master | Michael Bradshaw  | Fri Jun  9 
15:02:27 2017 -0700| [50be8f2142509bd14a8c245266959f166eb5c5d0] | committer: 
Michael Niedermayer

fate: add test for -time_base option

Signed-off-by: Michael Bradshaw 
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=50be8f2142509bd14a8c245266959f166eb5c5d0
---

 tests/fate/ffmpeg.mak| 6 ++
 tests/ref/fate/time_base | 1 +
 2 files changed, 7 insertions(+)

diff --git a/tests/fate/ffmpeg.mak b/tests/fate/ffmpeg.mak
index 8199f81b36..0a9a4b6142 100644
--- a/tests/fate/ffmpeg.mak
+++ b/tests/fate/ffmpeg.mak
@@ -118,3 +118,9 @@ fate-ffmpeg-bsf-remove-e: CMD = transcode "mpeg" 
$(TARGET_SAMPLES)/mpeg2/matrixb
 
 
 FATE_SAMPLES_FFMPEG-yes += $(FATE_STREAMCOPY-yes)
+
+FATE_TIME_BASE-$(call ALLYES, MPEGPS_DEMUXER MXF_MUXER) += fate-time_base
+fate-time_base: $(TARGET_SAMPLES)/mpeg2/dvd_single_frame.vob
+fate-time_base: CMD = md5 -i $(TARGET_SAMPLES)/mpeg2/dvd_single_frame.vob -an 
-sn -c:v copy -r 25 -time_base 1001:3 -fflags +bitexact -f mxf
+
+FATE_SAMPLES_FFMPEG-yes += $(FATE_TIME_BASE-yes)
diff --git a/tests/ref/fate/time_base b/tests/ref/fate/time_base
new file mode 100644
index 00..eec4b21aa5
--- /dev/null
+++ b/tests/ref/fate/time_base
@@ -0,0 +1 @@
+ef9896ce045941607782e895aea930b6

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/cfhd: Check band parameters before storing them

2017-06-10 Thread Michael Niedermayer

ffmpeg | branch: master | Michael Niedermayer  | Sat 
Jun 10 18:45:08 2017 +0200| [54aaadf648073149f1ac34f56cbde4e6c5aa22ef] | 
committer: Michael Niedermayer

avcodec/cfhd: Check band parameters before storing them

Fixes out of array read
Fixes: 2169/clusterfuzz-testcase-minimized-5688641642823680

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=54aaadf648073149f1ac34f56cbde4e6c5aa22ef
---

 libavcodec/cfhd.c | 18 +-
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/libavcodec/cfhd.c b/libavcodec/cfhd.c
index 57a8d2b76e..ed127de29e 100644
--- a/libavcodec/cfhd.c
+++ b/libavcodec/cfhd.c
@@ -317,22 +317,22 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, 
int *got_frame,
 s->prescale_shift[2] = (data >> 6) & 0x7;
 av_log(avctx, AV_LOG_DEBUG, "Prescale shift (VC-5): %x\n", data);
 } else if (tag == 27) {
-s->plane[s->channel_num].band[0][0].width  = data;
-s->plane[s->channel_num].band[0][0].stride = data;
 av_log(avctx, AV_LOG_DEBUG, "Lowpass width %"PRIu16"\n", data);
 if (data < 3 || data > 
s->plane[s->channel_num].band[0][0].a_width) {
 av_log(avctx, AV_LOG_ERROR, "Invalid lowpass width\n");
 ret = AVERROR(EINVAL);
 break;
 }
+s->plane[s->channel_num].band[0][0].width  = data;
+s->plane[s->channel_num].band[0][0].stride = data;
 } else if (tag == 28) {
-s->plane[s->channel_num].band[0][0].height = data;
 av_log(avctx, AV_LOG_DEBUG, "Lowpass height %"PRIu16"\n", data);
 if (data < 3 || data > s->plane[s->channel_num].band[0][0].height) 
{
 av_log(avctx, AV_LOG_ERROR, "Invalid lowpass height\n");
 ret = AVERROR(EINVAL);
 break;
 }
+s->plane[s->channel_num].band[0][0].height = data;
 } else if (tag == 1)
 av_log(avctx, AV_LOG_DEBUG, "Sample type? %"PRIu16"\n", data);
 else if (tag == 10) {
@@ -363,39 +363,39 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, 
int *got_frame,
 av_log(avctx, AV_LOG_DEBUG, "Tag/Value = %x %x\n", tag2, val2);
 }
 } else if (tag == 41) {
-s->plane[s->channel_num].band[s->level][s->subband_num].width  = 
data;
-s->plane[s->channel_num].band[s->level][s->subband_num].stride = 
FFALIGN(data, 8);
 av_log(avctx, AV_LOG_DEBUG, "Highpass width %i channel %i level %i 
subband %i\n", data, s->channel_num, s->level, s->subband_num);
 if (data < 3) {
 av_log(avctx, AV_LOG_ERROR, "Invalid highpass width\n");
 ret = AVERROR(EINVAL);
 break;
 }
+s->plane[s->channel_num].band[s->level][s->subband_num].width  = 
data;
+s->plane[s->channel_num].band[s->level][s->subband_num].stride = 
FFALIGN(data, 8);
 } else if (tag == 42) {
-s->plane[s->channel_num].band[s->level][s->subband_num].height = 
data;
 av_log(avctx, AV_LOG_DEBUG, "Highpass height %i\n", data);
 if (data < 3) {
 av_log(avctx, AV_LOG_ERROR, "Invalid highpass height\n");
 ret = AVERROR(EINVAL);
 break;
 }
+s->plane[s->channel_num].band[s->level][s->subband_num].height = 
data;
 } else if (tag == 49) {
-s->plane[s->channel_num].band[s->level][s->subband_num].width  = 
data;
-s->plane[s->channel_num].band[s->level][s->subband_num].stride = 
FFALIGN(data, 8);
 av_log(avctx, AV_LOG_DEBUG, "Highpass width2 %i\n", data);
 if (data < 3) {
 av_log(avctx, AV_LOG_ERROR, "Invalid highpass width2\n");
 ret = AVERROR(EINVAL);
 break;
 }
+s->plane[s->channel_num].band[s->level][s->subband_num].width  = 
data;
+s->plane[s->channel_num].band[s->level][s->subband_num].stride = 
FFALIGN(data, 8);
 } else if (tag == 50) {
-s->plane[s->channel_num].band[s->level][s->subband_num].height = 
data;
 av_log(avctx, AV_LOG_DEBUG, "Highpass height2 %i\n", data);
 if (data < 3) {
 av_log(avctx, AV_LOG_ERROR, "Invalid highpass height2\n");
 ret = AVERROR(EINVAL);
 break;
 }
+s->plane[s->channel_num].band[s->level][s->subband_num].height = 
data;
 } else if (tag == 71) {
 s->codebook = data;
 av_log(avctx, AV_LOG_DEBUG, "Codebook %i\n", s->codebook);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/flicvideo: Fix runtime error: signed integer overflow: 4864 * 459296 cannot be represented in type 'int'

2017-06-10 Thread Michael Niedermayer

ffmpeg | branch: master | Michael Niedermayer  | Sat 
Jun 10 19:43:25 2017 +0200| [90e8317b3b33dcb54ae01e419d85cbbfbd874963] | 
committer: Michael Niedermayer

avcodec/flicvideo: Fix runtime error: signed integer overflow: 4864 * 459296 
cannot be represented in type 'int'

Fixes: 2174/clusterfuzz-testcase-minimized-5739234533048320

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=90e8317b3b33dcb54ae01e419d85cbbfbd874963
---

 libavcodec/flicvideo.c | 14 ++
 1 file changed, 14 insertions(+)

diff --git a/libavcodec/flicvideo.c b/libavcodec/flicvideo.c
index ccc6cb25b3..ba5bda48c4 100644
--- a/libavcodec/flicvideo.c
+++ b/libavcodec/flicvideo.c
@@ -272,10 +272,14 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
 while (compressed_lines > 0) {
 if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
 break;
+if (y_ptr > pixel_limit)
+return AVERROR_INVALIDDATA;
 line_packets = bytestream2_get_le16(&g2);
 if ((line_packets & 0xC000) == 0xC000) {
 // line skip opcode
 line_packets = -line_packets;
+if (line_packets > s->avctx->height)
+return AVERROR_INVALIDDATA;
 y_ptr += line_packets * s->frame->linesize[0];
 } else if ((line_packets & 0xC000) == 0x4000) {
 av_log(avctx, AV_LOG_ERROR, "Undefined opcode (%x) in 
DELTA_FLI\n", line_packets);
@@ -324,6 +328,8 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx,
 case FLI_LC:
 /* line compressed */
 starting_line = bytestream2_get_le16(&g2);
+if (starting_line >= s->avctx->height)
+return AVERROR_INVALIDDATA;
 y_ptr = 0;
 y_ptr += starting_line * s->frame->linesize[0];
 
@@ -564,9 +570,13 @@ static int flic_decode_frame_15_16BPP(AVCodecContext 
*avctx,
 while (compressed_lines > 0) {
 if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
 break;
+if (y_ptr > pixel_limit)
+return AVERROR_INVALIDDATA;
 line_packets = bytestream2_get_le16(&g2);
 if (line_packets < 0) {
 line_packets = -line_packets;
+if (line_packets > s->avctx->height)
+return AVERROR_INVALIDDATA;
 y_ptr += line_packets * s->frame->linesize[0];
 } else {
 compressed_lines--;
@@ -858,9 +868,13 @@ static int flic_decode_frame_24BPP(AVCodecContext *avctx,
 while (compressed_lines > 0) {
 if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
 break;
+if (y_ptr > pixel_limit)
+return AVERROR_INVALIDDATA;
 line_packets = bytestream2_get_le16(&g2);
 if (line_packets < 0) {
 line_packets = -line_packets;
+if (line_packets > s->avctx->height)
+return AVERROR_INVALIDDATA;
 y_ptr += line_packets * s->frame->linesize[0];
 } else {
 compressed_lines--;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/fft_template: Fix multiple runtime error: signed integer overflow: -1943918714 - 1935113003 cannot be represented in type 'int'

2017-06-10 Thread Michael Niedermayer

ffmpeg | branch: master | Michael Niedermayer  | Sat 
May 27 12:21:25 2017 +0200| [1197c04896423c6c7db65f69da8bc3865b26bb50] | 
committer: Michael Niedermayer

avcodec/fft_template: Fix multiple runtime error: signed integer overflow: 
-1943918714 - 1935113003 cannot be represented in type 'int'

Fixes: 1735/clusterfuzz-testcase-minimized-5350472347025408

This uses unsigned instead of SUINT because the later was rejected by multiple 
developers
See: [FFmpeg-devel] [PATCH] avcodec/fft_template: Fix multiple runtime error: 
signed integer overflow: -1943918714 - 1935113003 cannot be represented in type 
'int'

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1197c04896423c6c7db65f69da8bc3865b26bb50
---

 libavcodec/fft_template.c | 50 +++
 1 file changed, 25 insertions(+), 25 deletions(-)

diff --git a/libavcodec/fft_template.c b/libavcodec/fft_template.c
index 480557f49f..6477372274 100644
--- a/libavcodec/fft_template.c
+++ b/libavcodec/fft_template.c
@@ -249,7 +249,7 @@ static void fft_calc_c(FFTContext *s, FFTComplex *z) {
 
 int nbits, i, n, num_transforms, offset, step;
 int n4, n2, n34;
-FFTSample tmp1, tmp2, tmp3, tmp4, tmp5, tmp6, tmp7, tmp8;
+unsigned tmp1, tmp2, tmp3, tmp4, tmp5, tmp6, tmp7, tmp8;
 FFTComplex *tmpz;
 const int fft_size = (1 << s->nbits);
 int64_t accu;
@@ -260,14 +260,14 @@ static void fft_calc_c(FFTContext *s, FFTComplex *z) {
 offset = ff_fft_offsets_lut[n] << 2;
 tmpz = z + offset;
 
-tmp1 = tmpz[0].re + tmpz[1].re;
-tmp5 = tmpz[2].re + tmpz[3].re;
-tmp2 = tmpz[0].im + tmpz[1].im;
-tmp6 = tmpz[2].im + tmpz[3].im;
-tmp3 = tmpz[0].re - tmpz[1].re;
-tmp8 = tmpz[2].im - tmpz[3].im;
-tmp4 = tmpz[0].im - tmpz[1].im;
-tmp7 = tmpz[2].re - tmpz[3].re;
+tmp1 = tmpz[0].re + (unsigned)tmpz[1].re;
+tmp5 = tmpz[2].re + (unsigned)tmpz[3].re;
+tmp2 = tmpz[0].im + (unsigned)tmpz[1].im;
+tmp6 = tmpz[2].im + (unsigned)tmpz[3].im;
+tmp3 = tmpz[0].re - (unsigned)tmpz[1].re;
+tmp8 = tmpz[2].im - (unsigned)tmpz[3].im;
+tmp4 = tmpz[0].im - (unsigned)tmpz[1].im;
+tmp7 = tmpz[2].re - (unsigned)tmpz[3].re;
 
 tmpz[0].re = tmp1 + tmp5;
 tmpz[2].re = tmp1 - tmp5;
@@ -288,19 +288,19 @@ static void fft_calc_c(FFTContext *s, FFTComplex *z) {
 offset = ff_fft_offsets_lut[n] << 3;
 tmpz = z + offset;
 
-tmp1 = tmpz[4].re + tmpz[5].re;
-tmp3 = tmpz[6].re + tmpz[7].re;
-tmp2 = tmpz[4].im + tmpz[5].im;
-tmp4 = tmpz[6].im + tmpz[7].im;
+tmp1 = tmpz[4].re + (unsigned)tmpz[5].re;
+tmp3 = tmpz[6].re + (unsigned)tmpz[7].re;
+tmp2 = tmpz[4].im + (unsigned)tmpz[5].im;
+tmp4 = tmpz[6].im + (unsigned)tmpz[7].im;
 tmp5 = tmp1 + tmp3;
 tmp7 = tmp1 - tmp3;
 tmp6 = tmp2 + tmp4;
 tmp8 = tmp2 - tmp4;
 
-tmp1 = tmpz[4].re - tmpz[5].re;
-tmp2 = tmpz[4].im - tmpz[5].im;
-tmp3 = tmpz[6].re - tmpz[7].re;
-tmp4 = tmpz[6].im - tmpz[7].im;
+tmp1 = tmpz[4].re - (unsigned)tmpz[5].re;
+tmp2 = tmpz[4].im - (unsigned)tmpz[5].im;
+tmp3 = tmpz[6].re - (unsigned)tmpz[7].re;
+tmp4 = tmpz[6].im - (unsigned)tmpz[7].im;
 
 tmpz[4].re = tmpz[0].re - tmp5;
 tmpz[0].re = tmpz[0].re + tmp5;
@@ -311,13 +311,13 @@ static void fft_calc_c(FFTContext *s, FFTComplex *z) {
 tmpz[6].im = tmpz[2].im + tmp7;
 tmpz[2].im = tmpz[2].im - tmp7;
 
-accu = (int64_t)Q31(M_SQRT1_2)*(tmp1 + tmp2);
+accu = (int64_t)Q31(M_SQRT1_2)*(int)(tmp1 + tmp2);
 tmp5 = (int32_t)((accu + 0x4000) >> 31);
-accu = (int64_t)Q31(M_SQRT1_2)*(tmp3 - tmp4);
+accu = (int64_t)Q31(M_SQRT1_2)*(int)(tmp3 - tmp4);
 tmp7 = (int32_t)((accu + 0x4000) >> 31);
-accu = (int64_t)Q31(M_SQRT1_2)*(tmp2 - tmp1);
+accu = (int64_t)Q31(M_SQRT1_2)*(int)(tmp2 - tmp1);
 tmp6 = (int32_t)((accu + 0x4000) >> 31);
-accu = (int64_t)Q31(M_SQRT1_2)*(tmp3 + tmp4);
+accu = (int64_t)Q31(M_SQRT1_2)*(int)(tmp3 + tmp4);
 tmp8 = (int32_t)((accu + 0x4000) >> 31);
 tmp1 = tmp5 + tmp7;
 tmp3 = tmp5 - tmp7;
@@ -348,10 +348,10 @@ static void fft_calc_c(FFTContext *s, FFTComplex *z) {
 offset = ff_fft_offsets_lut[n] << nbits;
 tmpz = z + offset;
 
-tmp5 = tmpz[ n2].re + tmpz[n34].re;
-tmp1 = tmpz[ n2].re - tmpz[n34].re;
-tmp6 = tmpz[ n2].im + tmpz[n34].im;
-tmp2 = tmpz[ n2].im - tmpz[n34].im;
+tmp5 = tmpz[ n2].re + (unsigned)tmpz[n34].re;
+tmp1 = tmpz[ n2].re - (unsigned)tmpz[n34].re;
+tmp6 = tmpz[ n2].im + (unsigned)tmpz[n3

[FFmpeg-cvslog] avcodec/ra144: Fix runtime error: signed integer overflow: -2200 * 1033073 cannot be represented in type 'int'

2017-06-10 Thread Michael Niedermayer

ffmpeg | branch: master | Michael Niedermayer  | Sun 
Jun 11 00:45:20 2017 +0200| [71da0a5c9750e9fd0c9609470f610d32952923eb] | 
committer: Michael Niedermayer

avcodec/ra144: Fix runtime error: signed integer overflow: -2200 * 1033073 
cannot be represented in type 'int'

Fixes: 2175/clusterfuzz-testcase-minimized-5809657849315328

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=71da0a5c9750e9fd0c9609470f610d32952923eb
---

 libavcodec/ra144.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/ra144.c b/libavcodec/ra144.c
index 2ed7361e38..c077b7b327 100644
--- a/libavcodec/ra144.c
+++ b/libavcodec/ra144.c
@@ -1601,7 +1601,7 @@ void ff_eval_coefs(int *coefs, const int *refl)
 b1[i] = refl[i] * 16;
 
 for (j=0; j < i; j++)
-b1[j] = ((refl[i] * b2[i-j-1]) >> 12) + b2[j];
+b1[j] = ((int)(refl[i] * (unsigned)b2[i-j-1]) >> 12) + b2[j];
 
 FFSWAP(int *, b1, b2);
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/tiff: Fix leak of geotags[].val

2017-06-10 Thread Michael Niedermayer

ffmpeg | branch: master | Michael Niedermayer  | Sun 
Jun 11 01:05:26 2017 +0200| [22a25ab3896cbb8dceebdba4d439e8b2b398ff0e] | 
committer: Michael Niedermayer

avcodec/tiff: Fix leak of geotags[].val

Fixes: 2176/clusterfuzz-testcase-minimized-5908197216878592

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=22a25ab3896cbb8dceebdba4d439e8b2b398ff0e
---

 libavcodec/tiff.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index 90d16b1723..4612c78ee9 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -1114,6 +1114,8 @@ static int tiff_decode_tag(TiffContext *s, AVFrame *frame)
 if (s->geotags[i].count == 0
 || s->geotags[i].offset + s->geotags[i].count > count) {
 av_log(s->avctx, AV_LOG_WARNING, "Invalid GeoTIFF key 
%d\n", s->geotags[i].key);
+} else if (s->geotags[i].val) {
+av_log(s->avctx, AV_LOG_WARNING, "Duplicate GeoTIFF key 
%d\n", s->geotags[i].key);
 } else {
 char *ap = doubles2str(&dp[s->geotags[i].offset], 
s->geotags[i].count, ", ");
 if (!ap) {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] fate: add test for -time_base option

[FFmpeg-cvslog] avcodec/cfhd: Check band parameters before storing them

[FFmpeg-cvslog] avcodec/flicvideo: Fix runtime error: signed integer overflow: 4864 * 459296 cannot be represented in type 'int'

[FFmpeg-cvslog] avcodec/fft_template: Fix multiple runtime error: signed integer overflow: -1943918714 - 1935113003 cannot be represented in type 'int'

[FFmpeg-cvslog] avcodec/ra144: Fix runtime error: signed integer overflow: -2200 * 1033073 cannot be represented in type 'int'

[FFmpeg-cvslog] avcodec/tiff: Fix leak of geotags[].val

6 matches

Site Navigation

Mail list logo

Footer information