[FFmpeg-cvslog] lavc/qsvenc_hevc: add qmax/qmin support for HEVC encoding
ffmpeg | branch: master | Linjie Fu | Wed Mar 11 18:39:28
2020 +0800| [c2d000ec27af1a5cd5341a67e941e0313879ab18] | committer: Zhong Li
lavc/qsvenc_hevc: add qmax/qmin support for HEVC encoding
Add qmax/qmin support for HEVC software bitrate control(SWBRC).
Limitations:
- RateControlMethod != MFX_RATECONTROL_CQP
- with EXTBRC ON
Signed-off-by: Dmitry Rogozhkin
Signed-off-by: Linjie Fu
Signed-off-by: Zhong Li
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c2d000ec27af1a5cd5341a67e941e0313879ab18
---
libavcodec/qsvenc.c | 11 +--
libavcodec/qsvenc_hevc.c | 2 ++
2 files changed, 7 insertions(+), 6 deletions(-)
diff --git a/libavcodec/qsvenc.c b/libavcodec/qsvenc.c
index ed4539f697..1ed8f5d973 100644
--- a/libavcodec/qsvenc.c
+++ b/libavcodec/qsvenc.c
@@ -735,6 +735,11 @@ FF_ENABLE_DEPRECATION_WARNINGS
if (q->adaptive_b >= 0)
q->extco2.AdaptiveB = q->adaptive_b ? MFX_CODINGOPTION_ON :
MFX_CODINGOPTION_OFF;
#endif
+}
+
+if (avctx->codec_id == AV_CODEC_ID_H264 || avctx->codec_id ==
AV_CODEC_ID_HEVC) {
+if (q->extbrc >= 0)
+q->extco2.ExtBRC = q->extbrc ? MFX_CODINGOPTION_ON :
MFX_CODINGOPTION_OFF;
#if QSV_VERSION_ATLEAST(1, 9)
if (avctx->qmin >= 0 && avctx->qmax >= 0 && avctx->qmin >
avctx->qmax) {
@@ -750,12 +755,6 @@ FF_ENABLE_DEPRECATION_WARNINGS
q->extco2.MaxQPP = q->extco2.MaxQPB = q->extco2.MaxQPI;
}
#endif
-}
-
-if (avctx->codec_id == AV_CODEC_ID_H264 || avctx->codec_id ==
AV_CODEC_ID_HEVC) {
-if (q->extbrc >= 0)
-q->extco2.ExtBRC = q->extbrc ? MFX_CODINGOPTION_ON :
MFX_CODINGOPTION_OFF;
-
q->extco2.Header.BufferId = MFX_EXTBUFF_CODING_OPTION2;
q->extco2.Header.BufferSz = sizeof(q->extco2);
diff --git a/libavcodec/qsvenc_hevc.c b/libavcodec/qsvenc_hevc.c
index 88c78a8135..347f30655e 100644
--- a/libavcodec/qsvenc_hevc.c
+++ b/libavcodec/qsvenc_hevc.c
@@ -263,6 +263,8 @@ static const AVCodecDefault qsv_enc_defaults[] = {
// same as the x264 default
{ "g", "248" },
{ "bf","8" },
+{ "qmin", "-1"},
+{ "qmax", "-1"},
{ "trellis", "-1"},
{ "flags", "+cgop" },
#if FF_API_PRIVATE_OPT
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/vp9dsp_template: Fix integer overflows in idct32_1d()
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Tue Feb 11 22:58:08 2020 +0100| [189d849aa5fb9b3a57af02da0542040e73e7eb90] |
committer: Michael Niedermayer
avcodec/vp9dsp_template: Fix integer overflows in idct32_1d()
Fixes: signed integer overflow: -193177 * 11585 cannot be represented in type
'int'
Fixes:
20557/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5704852816789504
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit e16e3e63f0a96b4e0ec32972c975bc0e339a49d1)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=189d849aa5fb9b3a57af02da0542040e73e7eb90
---
libavcodec/vp9dsp_template.c | 132 +--
1 file changed, 66 insertions(+), 66 deletions(-)
diff --git a/libavcodec/vp9dsp_template.c b/libavcodec/vp9dsp_template.c
index 5a8578a898..95038259b4 100644
--- a/libavcodec/vp9dsp_template.c
+++ b/libavcodec/vp9dsp_template.c
@@ -1479,38 +1479,38 @@ itxfm_wrap(16, 6)
static av_always_inline void idct32_1d(const dctcoef *in, ptrdiff_t stride,
dctcoef *out, int pass)
{
-dctint t0a = ((IN(0) + IN(16)) * 11585 + (1 << 13)) >> 14;
-dctint t1a = ((IN(0) - IN(16)) * 11585 + (1 << 13)) >> 14;
-dctint t2a = (IN( 8) * 6270 - IN(24) * 15137 + (1 << 13)) >> 14;
-dctint t3a = (IN( 8) * 15137 + IN(24) * 6270 + (1 << 13)) >> 14;
-dctint t4a = (IN( 4) * 3196 - IN(28) * 16069 + (1 << 13)) >> 14;
-dctint t7a = (IN( 4) * 16069 + IN(28) * 3196 + (1 << 13)) >> 14;
-dctint t5a = (IN(20) * 13623 - IN(12) * 9102 + (1 << 13)) >> 14;
-dctint t6a = (IN(20) * 9102 + IN(12) * 13623 + (1 << 13)) >> 14;
-dctint t8a = (IN( 2) * 1606 - IN(30) * 16305 + (1 << 13)) >> 14;
-dctint t15a = (IN( 2) * 16305 + IN(30) * 1606 + (1 << 13)) >> 14;
-dctint t9a = (IN(18) * 12665 - IN(14) * 10394 + (1 << 13)) >> 14;
-dctint t14a = (IN(18) * 10394 + IN(14) * 12665 + (1 << 13)) >> 14;
-dctint t10a = (IN(10) * 7723 - IN(22) * 14449 + (1 << 13)) >> 14;
-dctint t13a = (IN(10) * 14449 + IN(22) * 7723 + (1 << 13)) >> 14;
-dctint t11a = (IN(26) * 15679 - IN( 6) * 4756 + (1 << 13)) >> 14;
-dctint t12a = (IN(26) * 4756 + IN( 6) * 15679 + (1 << 13)) >> 14;
-dctint t16a = (IN( 1) * 804 - IN(31) * 16364 + (1 << 13)) >> 14;
-dctint t31a = (IN( 1) * 16364 + IN(31) * 804 + (1 << 13)) >> 14;
-dctint t17a = (IN(17) * 12140 - IN(15) * 11003 + (1 << 13)) >> 14;
-dctint t30a = (IN(17) * 11003 + IN(15) * 12140 + (1 << 13)) >> 14;
-dctint t18a = (IN( 9) * 7005 - IN(23) * 14811 + (1 << 13)) >> 14;
-dctint t29a = (IN( 9) * 14811 + IN(23) * 7005 + (1 << 13)) >> 14;
-dctint t19a = (IN(25) * 15426 - IN( 7) * 5520 + (1 << 13)) >> 14;
-dctint t28a = (IN(25) * 5520 + IN( 7) * 15426 + (1 << 13)) >> 14;
-dctint t20a = (IN( 5) * 3981 - IN(27) * 15893 + (1 << 13)) >> 14;
-dctint t27a = (IN( 5) * 15893 + IN(27) * 3981 + (1 << 13)) >> 14;
-dctint t21a = (IN(21) * 14053 - IN(11) * 8423 + (1 << 13)) >> 14;
-dctint t26a = (IN(21) * 8423 + IN(11) * 14053 + (1 << 13)) >> 14;
-dctint t22a = (IN(13) * 9760 - IN(19) * 13160 + (1 << 13)) >> 14;
-dctint t25a = (IN(13) * 13160 + IN(19) * 9760 + (1 << 13)) >> 14;
-dctint t23a = (IN(29) * 16207 - IN( 3) * 2404 + (1 << 13)) >> 14;
-dctint t24a = (IN(29) * 2404 + IN( 3) * 16207 + (1 << 13)) >> 14;
+dctint t0a = (dctint)((IN(0) + IN(16)) * 11585U + (1 << 13)) >>
14;
+dctint t1a = (dctint)((IN(0) - IN(16)) * 11585U + (1 << 13)) >>
14;
+dctint t2a = (dctint)(IN( 8) * 6270U - IN(24) * 15137U + (1 << 13)) >>
14;
+dctint t3a = (dctint)(IN( 8) * 15137U + IN(24) * 6270U + (1 << 13)) >>
14;
+dctint t4a = (dctint)(IN( 4) * 3196U - IN(28) * 16069U + (1 << 13)) >>
14;
+dctint t7a = (dctint)(IN( 4) * 16069U + IN(28) * 3196U + (1 << 13)) >>
14;
+dctint t5a = (dctint)(IN(20) * 13623U - IN(12) * 9102U + (1 << 13)) >>
14;
+dctint t6a = (dctint)(IN(20) * 9102U + IN(12) * 13623U + (1 << 13)) >>
14;
+dctint t8a = (dctint)(IN( 2) * 1606U - IN(30) * 16305U + (1 << 13)) >>
14;
+dctint t15a = (dctint)(IN( 2) * 16305U + IN(30) * 1606U + (1 << 13)) >>
14;
+dctint t9a = (dctint)(IN(18) * 12665U - IN(14) * 10394U + (1 << 13)) >>
14;
+dctint t14a = (dctint)(IN(18) * 10394U + IN(14) * 12665U + (1 << 13)) >>
14;
+dctint t10a = (dctint)(IN(10) * 7723U - IN(22) * 14449U + (1 << 13)) >>
14;
+dctint t13a = (dctint)(IN(10) * 14449U + IN(22) * 7723U + (1 << 13)) >>
14;
+dctint t11a = (dctint)(IN(26) * 15679U - IN( 6) * 4756U + (1 << 13)) >>
14;
+dctint t12a = (dctint)(IN(26) * 4756U + IN( 6) * 15679U + (1 << 13)) >>
14;
+dctint t16a = (dctint)(IN( 1) * 804U - IN(31) * 16364U + (1 << 13)) >>
14;
+dctint t31a = (dctint)(IN( 1) * 16364U +
[FFmpeg-cvslog] avcodec/svq1dec: Check that there is data left after the header
ffmpeg | branch: release/2.8 | Michael Niedermayer | Tue Feb 18 23:28:33 2020 +0100| [54ec335e83890aee325fe17267d951e78060c0f2] | committer: Michael Niedermayer avcodec/svq1dec: Check that there is data left after the header Fixes: Timeout (21sec -> 255ms) Fixes: 20709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ1_fuzzer-5085075089915904 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 55e344ee5aa6f6e04e50bbac457e0ca53433ab75) Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=54ec335e83890aee325fe17267d951e78060c0f2 --- libavcodec/svq1dec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/svq1dec.c b/libavcodec/svq1dec.c index dca99fae4c..0485245a80 100644 --- a/libavcodec/svq1dec.c +++ b/libavcodec/svq1dec.c @@ -602,6 +602,8 @@ static int svq1_decode_frame_header(AVCodecContext *avctx, AVFrame *frame) if (skip_1stop_8data_bits(bitbuf) < 0) return AVERROR_INVALIDDATA; } +if (get_bits_left(bitbuf) <= 0) +return AVERROR_INVALIDDATA; s->width = width; s->height = height; ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/txd: Check for input size against the header size.
ffmpeg | branch: release/2.8 | Michael Niedermayer | Tue Feb 18 23:14:16 2020 +0100| [b055fa4b1c5a5e0e5365696ad63b80cf8ec1edc6] | committer: Michael Niedermayer avcodec/txd: Check for input size against the header size. Fixes: Timeout (21sec -> 80ms) Fixes: 20673/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TXD_fuzzer-5177453863763968 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit aeb4e435847e0c970bcb1a835fe5eda17a4e1ce3) Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b055fa4b1c5a5e0e5365696ad63b80cf8ec1edc6 --- libavcodec/txd.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/txd.c b/libavcodec/txd.c index 0c95faaf89..09c191a2c4 100644 --- a/libavcodec/txd.c +++ b/libavcodec/txd.c @@ -43,6 +43,9 @@ static int txd_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, int i, j; int ret; +if (avpkt->size < 88) +return AVERROR_INVALIDDATA; + ff_texturedsp_init(&dxtc); bytestream2_init(&gb, avpkt->data, avpkt->size); ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] libavcodec/wmalosslessdec: prevent sum of positive numbers from becoming negative
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Sun Feb 9 18:09:24 2020 +0100| [1c200201cd58b68586eb9ea2219f48db1050b669] |
committer: Michael Niedermayer
libavcodec/wmalosslessdec: prevent sum of positive numbers from becoming
negative
Fixes: left shift of negative value -8321365
Fixes:
20506/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-4798062906310656
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 62e4003780cad60ac1371fef892da08c27069964)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1c200201cd58b68586eb9ea2219f48db1050b669
---
libavcodec/wmalosslessdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/wmalosslessdec.c b/libavcodec/wmalosslessdec.c
index 9888ea43d6..0921c16fe5 100644
--- a/libavcodec/wmalosslessdec.c
+++ b/libavcodec/wmalosslessdec.c
@@ -163,7 +163,7 @@ typedef struct WmallDecodeCtx {
int transient_pos[WMALL_MAX_CHANNELS];
int seekable_tile;
-int ave_sum[WMALL_MAX_CHANNELS];
+unsigned ave_sum[WMALL_MAX_CHANNELS];
int channel_residues[WMALL_MAX_CHANNELS][WMALL_BLOCK_MAX_SIZE];
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/ralf: Fix integer overflow in decode_block()
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Sun May 10 20:15:11 2020 +0200| [186599c86f649e09ae0fdc5aa6000ca1b4ad8989] |
committer: Michael Niedermayer
avcodec/ralf: Fix integer overflow in decode_block()
Fixes: signed integer overflow: 289082077 - -200314 cannot be represented
in type 'int'
Fixes:
20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5196077752123392
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 0c4330847c104fcf3ef929c1acee33b5b34c20db)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=186599c86f649e09ae0fdc5aa6000ca1b4ad8989
---
libavcodec/ralf.c | 7 ---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/libavcodec/ralf.c b/libavcodec/ralf.c
index 7f81901d8f..ba86e7ba49 100644
--- a/libavcodec/ralf.c
+++ b/libavcodec/ralf.c
@@ -344,7 +344,8 @@ static int decode_block(AVCodecContext *avctx,
GetBitContext *gb,
int len, ch, ret;
int dmode, mode[2], bits[2];
int *ch0, *ch1;
-int i, t, t2;
+int i;
+unsigned int t, t2;
len = 12 - get_unary(gb, 0, 6);
@@ -409,8 +410,8 @@ static int decode_block(AVCodecContext *avctx,
GetBitContext *gb,
for (i = 0; i < len; i++) {
t = ch1[i] + ctx->bias[1];
t2 = ((ch0[i] + ctx->bias[0]) * 2) | (t & 1);
-dst0[i] = (t2 + t) / 2;
-dst1[i] = (t2 - t) / 2;
+dst0[i] = (int)(t2 + t) / 2;
+dst1[i] = (int)(t2 - t) / 2;
}
break;
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/nuv: widen buf_size type
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Sun May 10 19:09:47 2020 +0200| [24f824af860990e3f0bc747e1d6e87d20b7cfaf6] |
committer: Michael Niedermayer
avcodec/nuv: widen buf_size type
Fixes: signed integer overflow: 65312 * 65312 cannot be represented in type
'int'
Fixes:
20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-5740176118906880
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 1ac106bf5625de6aec31a34319298032e988f349)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=24f824af860990e3f0bc747e1d6e87d20b7cfaf6
---
libavcodec/nuv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/nuv.c b/libavcodec/nuv.c
index 3d394b50c6..d9f0162a6d 100644
--- a/libavcodec/nuv.c
+++ b/libavcodec/nuv.c
@@ -123,7 +123,7 @@ static int codec_reinit(AVCodecContext *avctx, int width,
int height,
get_quant_quality(c, quality);
if (width != c->width || height != c->height) {
// also reserve space for a possible additional header
-int buf_size = height * width * 3 / 2
+int64_t buf_size = height * (int64_t)width * 3 / 2
+ FFMAX(AV_LZO_OUTPUT_PADDING,
AV_INPUT_BUFFER_PADDING_SIZE)
+ RTJPEG_HEADER_SIZE;
if (buf_size > INT_MAX/8)
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/pngdec: Check length in fdAT
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Tue Apr 7 19:29:44 2020 +0200| [8a359e077f6b01add8a809239a98642f6f338df5] |
committer: Michael Niedermayer
avcodec/pngdec: Check length in fdAT
Fixes:
21089/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-5135981419429888
Fixes: out of array read
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 79e5c2ee2bbdf462cabd2113c723dfb613d735c2)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8a359e077f6b01add8a809239a98642f6f338df5
---
libavcodec/pngdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c
index 78cf274128..3fa4e4e4c0 100644
--- a/libavcodec/pngdec.c
+++ b/libavcodec/pngdec.c
@@ -1161,7 +1161,7 @@ static int decode_frame_common(AVCodecContext *avctx,
PNGDecContext *s,
case MKTAG('f', 'd', 'A', 'T'):
if (!CONFIG_APNG_DECODER || avctx->codec_id != AV_CODEC_ID_APNG)
goto skip_tag;
-if (!decode_next_dat) {
+if (!decode_next_dat || length < 4) {
ret = AVERROR_INVALIDDATA;
goto fail;
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/g2meet: Check tile_width in epic_jb_decode_tile()
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Sun Apr 5 22:58:29 2020 +0200| [e060f917f2fcf26a49e388481857167162ef1b16] |
committer: Michael Niedermayer
avcodec/g2meet: Check tile_width in epic_jb_decode_tile()
Fixes: out of array access
Fixes:
21469/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5199357982015488
Alternatively the arrays can be made bigger or the index can be clipped.
In case a real file with such huge tiles exist we ask the user to upload it.
Signed-off-by: Michael Niedermayer
(cherry picked from commit 5501bb28ddfa6441dcbf8ea0a964a13aa33f66fe)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e060f917f2fcf26a49e388481857167162ef1b16
---
libavcodec/g2meet.c | 5 +
1 file changed, 5 insertions(+)
diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c
index 6149e3fcaf..57c99b6350 100644
--- a/libavcodec/g2meet.c
+++ b/libavcodec/g2meet.c
@@ -916,6 +916,11 @@ static int epic_jb_decode_tile(G2MContext *c, int tile_x,
int tile_y,
awidth = FFALIGN(tile_width, 16);
aheight = FFALIGN(tile_height, 16);
+if (tile_width > (1 << FF_ARRAY_ELEMS(c->ec.prev_row_rung))) {
+avpriv_request_sample(avctx, "large tile width");
+return AVERROR_INVALIDDATA;
+}
+
if (els_dsize) {
int ret, i, j, k;
uint8_t tr_r, tr_g, tr_b, *buf;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avformat/mpeg: Decrease score by 1 for files with very little valid data
ffmpeg | branch: release/2.8 | Michael Niedermayer | Tue Apr 14 00:03:30 2020 +0200| [eb9e7180782eae17a286f53e537023bf1c50c9ac] | committer: Michael Niedermayer avformat/mpeg: Decrease score by 1 for files with very little valid data Fixes: 8233/PPY6574574605_cut.mp3 Signed-off-by: Michael Niedermayer (cherry picked from commit 20f7b4dfc9640c910655bd153c6996e9edd42ff0) Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=eb9e7180782eae17a286f53e537023bf1c50c9ac --- libavformat/mpeg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/mpeg.c b/libavformat/mpeg.c index fe02af8fed..5149b3b143 100644 --- a/libavformat/mpeg.c +++ b/libavformat/mpeg.c @@ -106,7 +106,7 @@ static int mpegps_probe(AVProbeData *p) if (sys > invalid && sys * 9 <= pspack * 10) return (audio > 12 || vid > 3 || pspack > 2) ? AVPROBE_SCORE_EXTENSION + 2 - : AVPROBE_SCORE_EXTENSION / 2 + 1; // 1 more than mp3 + : AVPROBE_SCORE_EXTENSION / 2 + (audio + vid + pspack > 1); // 1 more than mp3 if (pspack > invalid && (priv1 + vid + audio) * 10 >= pspack * 9) return pspack > 2 ? AVPROBE_SCORE_EXTENSION + 2 : AVPROBE_SCORE_EXTENSION / 2; // 1 more than .mpg ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/adpcm: Fix integer overflow in ADPCM THP
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Wed Feb 12 21:30:08 2020 +0100| [40e54383a2f5c4ea64bcf2d486606e2879e53e0d] |
committer: Michael Niedermayer
avcodec/adpcm: Fix integer overflow in ADPCM THP
The reference (thp.txt) uses floats so wrap around would seem incorrect.
Fixes: signed integer overflow: 1073741824 + 1073741824 cannot be represented
in type 'int'
Fixes:
20658/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_THP_fuzzer-5646302555930624
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit b12b05374f7025167e2c43449ceb8ba3f0a6083f)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=40e54383a2f5c4ea64bcf2d486606e2879e53e0d
---
libavcodec/adpcm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c
index 75ee685b16..e91c59b033 100644
--- a/libavcodec/adpcm.c
+++ b/libavcodec/adpcm.c
@@ -1479,8 +1479,8 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void
*data,
int byte = bytestream2_get_byteu(&gb);
int index = (byte >> 4) & 7;
unsigned int exp = byte & 0x0F;
-int factor1 = table[ch][index * 2];
-int factor2 = table[ch][index * 2 + 1];
+int64_t factor1 = table[ch][index * 2];
+int64_t factor2 = table[ch][index * 2 + 1];
/* Decode 14 samples. */
for (n = 0; n < 14 && (i * 14 + n < nb_samples); n++) {
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/ralf: Check num_blocks before use
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Mon May 11 22:17:43 2020 +0200| [f8da048589640353cee66540dc3f14beaba55321] |
committer: Michael Niedermayer
avcodec/ralf: Check num_blocks before use
Fixes: out of array access
Fixes:
20659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5739471895265280
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit f0c0471075fe52ed31c46e038df4280aef5b67a1)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f8da048589640353cee66540dc3f14beaba55321
---
libavcodec/ralf.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavcodec/ralf.c b/libavcodec/ralf.c
index ba86e7ba49..c38bdabfcd 100644
--- a/libavcodec/ralf.c
+++ b/libavcodec/ralf.c
@@ -482,6 +482,8 @@ static int decode_frame(AVCodecContext *avctx, void *data,
int *got_frame_ptr,
init_get_bits(&gb, src + 2, table_size);
ctx->num_blocks = 0;
while (get_bits_left(&gb) > 0) {
+if (ctx->num_blocks >= FF_ARRAY_ELEMS(ctx->block_size))
+return AVERROR_INVALIDDATA;
ctx->block_size[ctx->num_blocks] = get_bits(&gb, 15);
if (get_bits1(&gb)) {
ctx->block_pts[ctx->num_blocks] = get_bits(&gb, 9);
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avformat/mpegenc: Fix integer overflow with AV_NOPTS_VALUE
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Sun Feb 16 18:51:52 2020 +0100| [40a039fee49d109f48dcee0b4ea7306aa4fc374d] |
committer: Michael Niedermayer
avformat/mpegenc: Fix integer overflow with AV_NOPTS_VALUE
Fixes: signed integer overflow: -9223372036854775808 - 45000 cannot be
represented in type 'long'
Fixes: ticket8187
Found-by: Suhwan
Signed-off-by: Michael Niedermayer
(cherry picked from commit 9874815b1aadadd7fd19aa6aabb7d9193f2f43d5)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=40a039fee49d109f48dcee0b4ea7306aa4fc374d
---
libavformat/mpegenc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/mpegenc.c b/libavformat/mpegenc.c
index b3ee2a09b9..9061a643aa 100644
--- a/libavformat/mpegenc.c
+++ b/libavformat/mpegenc.c
@@ -1155,7 +1155,7 @@ static int mpeg_mux_write_packet(AVFormatContext *ctx,
AVPacket *pkt)
if (s->is_dvd) {
// min VOBU length 0.4 seconds (mpucoder)
if (is_iframe &&
-(s->packet_number == 0 ||
+(s->packet_number == 0 || pts != AV_NOPTS_VALUE &&
(pts - stream->vobu_start_pts >= 36000))) {
stream->bytes_to_iframe = av_fifo_size(stream->fifo);
stream->align_iframe= 1;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avformat/mov: Don't allow negative sample sizes.
ffmpeg | branch: release/2.8 | Dale Curtis | Thu May
14 15:31:55 2020 -0700| [832ae51f9b4ce1003c2e817900b0332d1df457f7] | committer:
Michael Niedermayer
avformat/mov: Don't allow negative sample sizes.
Signed-off-by: Dale Curtis
Signed-off-by: Michael Niedermayer
(cherry picked from commit 2d8d554f15a7a27cfeca81467cc9341a86f784e2)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=832ae51f9b4ce1003c2e817900b0332d1df457f7
---
libavformat/mov.c | 4
1 file changed, 4 insertions(+)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index cc56c8792a..10b0c1d7e7 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -2417,6 +2417,10 @@ static int mov_read_stsz(MOVContext *c, AVIOContext *pb,
MOVAtom atom)
for (i = 0; i < entries && !pb->eof_reached; i++) {
sc->sample_sizes[i] = get_bits_long(&gb, field_size);
+if (sc->sample_sizes[i] < 0) {
+av_log(c->fc, AV_LOG_ERROR, "Invalid sample size %d\n",
sc->sample_sizes[i]);
+return AVERROR_INVALIDDATA;
+}
sc->data_size += sc->sample_sizes[i];
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/g729postfilter: Clip gain before scaling with AGC_FAC1
ffmpeg | branch: release/2.8 | Michael Niedermayer | Sun May 10 11:34:53 2020 +0200| [8970824856ed2b08e54e2b013d377dd72f0ef27c] | committer: Michael Niedermayer avcodec/g729postfilter: Clip gain before scaling with AGC_FAC1 The fixed point integer reference specifies the multiplication used to have 16bit input and clips so we need to clip the input The floating point implementation does not seem to do that. Fixes: signed integer overflow: 6317568 * 410 cannot be represented in type 'int' Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G729_fuzzer-5700189272932352 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 82d4c7b95ed98d38aa834ef5a8fb1d2ef3901698) Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8970824856ed2b08e54e2b013d377dd72f0ef27c --- libavcodec/g729postfilter.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/g729postfilter.c b/libavcodec/g729postfilter.c index f824cf7c7d..1167e09147 100644 --- a/libavcodec/g729postfilter.c +++ b/libavcodec/g729postfilter.c @@ -596,6 +596,7 @@ int16_t ff_g729_adaptive_gain_control(int gain_before, int gain_after, int16_t * gain = ((gain_before - gain_after) << 14) / gain_after + 0x4000; gain = bidir_sal(gain, exp_after - exp_before); } +gain = av_clip_int16(gain); gain = (gain * G729_AGC_FAC1 + 0x4000) >> 15; // gain * (1-0.9875) } else gain = 0; ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/utvideodec: Fix integer overflow in decode_plane()
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Sun May 10 21:16:59 2020 +0200| [2a9ed44fe2bb2d85cb70adaacfc816b991451758] |
committer: Michael Niedermayer
avcodec/utvideodec: Fix integer overflow in decode_plane()
Fixes: signed integer overflow: 2147483594 + 142 cannot be represented in type
'int'
Fixes:
20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_fuzzer-5658568101724160
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 876cfa67f37e944b0f42cb67b2de4e2e06f52e82)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2a9ed44fe2bb2d85cb70adaacfc816b991451758
---
libavcodec/utvideodec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/utvideodec.c b/libavcodec/utvideodec.c
index 160528e007..56aecd514e 100644
--- a/libavcodec/utvideodec.c
+++ b/libavcodec/utvideodec.c
@@ -109,7 +109,7 @@ static int decode_plane(UtvideoContext *c, int plane_no,
for (i = 0; i < width * step; i += step) {
pix = fsym;
if (use_pred) {
-prev += pix;
+prev += (unsigned)pix;
pix = prev;
}
dest[i] = pix;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/hq_hqa: Check info size
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Sat May 30 00:43:46 2020 +0200| [849affacb24ccab88ccc96e79fae06148bb25013] |
committer: Michael Niedermayer
avcodec/hq_hqa: Check info size
Fixes: assertion failure
Fixes:
21079/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-5737046523248640
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit cf28521fee22dbe2f7eeb8ab0306c0fd0802c48a)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=849affacb24ccab88ccc96e79fae06148bb25013
---
libavcodec/hq_hqa.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/hq_hqa.c b/libavcodec/hq_hqa.c
index 0a08ddef68..41bfa20f34 100644
--- a/libavcodec/hq_hqa.c
+++ b/libavcodec/hq_hqa.c
@@ -320,7 +320,7 @@ static int hq_hqa_decode_frame(AVCodecContext *avctx, void
*data,
int info_size;
bytestream2_skip(&ctx->gbc, 4);
info_size = bytestream2_get_le32(&ctx->gbc);
-if (bytestream2_get_bytes_left(&ctx->gbc) < info_size) {
+if (info_size < 0 || bytestream2_get_bytes_left(&ctx->gbc) <
info_size) {
av_log(avctx, AV_LOG_ERROR, "Invalid INFO size (%d).\n",
info_size);
return AVERROR_INVALIDDATA;
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/ivi: Clear got_p_frame before decoding a new frame using it
ffmpeg | branch: release/2.8 | Michael Niedermayer | Wed May 13 00:11:37 2020 +0200| [91610632485060575a7c8a03a58f143689627222] | committer: Michael Niedermayer avcodec/ivi: Clear got_p_frame before decoding a new frame using it Fixes: assertion failure Fixes: 21666/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-5706468994318336 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 1d633e6a0a61118c9b2d1785d96bdebaa8c38592) Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=91610632485060575a7c8a03a58f143689627222 --- libavcodec/ivi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/ivi.c b/libavcodec/ivi.c index 2a9da6411f..eaaef78a30 100644 --- a/libavcodec/ivi.c +++ b/libavcodec/ivi.c @@ -1171,6 +1171,8 @@ int ff_ivi_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPacket pkt; pkt.data = avpkt->data + (get_bits_count(&ctx->gb) >> 3); pkt.size = get_bits_left(&ctx->gb) >> 3; +ctx->got_p_frame = 0; +av_frame_unref(ctx->p_frame); ff_ivi_decode_frame(avctx, ctx->p_frame, &ctx->got_p_frame, &pkt); } } ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avformat/thp: Require a video stream
ffmpeg | branch: release/2.8 | Michael Niedermayer | Wed Apr 15 20:27:27 2020 +0200| [88803439748f5843d7e380b9b65d5401b22a4c8c] | committer: Michael Niedermayer avformat/thp: Require a video stream The demuxer code assumes the existence of a video stream Fixes: assertion failure Fixes: 21512/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5699660783288320 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 97c78caf3e8f7ec4df3d3123b5e8d0e7541319e6) Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=88803439748f5843d7e380b9b65d5401b22a4c8c --- libavformat/thp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/thp.c b/libavformat/thp.c index 727fb5095c..16fa327002 100644 --- a/libavformat/thp.c +++ b/libavformat/thp.c @@ -143,6 +143,9 @@ static int thp_read_header(AVFormatContext *s) } } +if (!thp->vst) +return AVERROR_INVALIDDATA; + return 0; } ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/wmalosslessdec: Fix integer overflows in revert_inter_ch_decorr()
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Sun Apr 26 21:19:13 2020 +0200| [d8a1e0a79efcb8faf26350060bb57dcd449cd427] |
committer: Michael Niedermayer
avcodec/wmalosslessdec: Fix integer overflows in revert_inter_ch_decorr()
Fixes: signed integer overflow: -717241856 + -1434459904 cannot be represented
in type 'int'
Fixes:
21405/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5677143666458624
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit e9a4c4fe9918220be492a4a9d74c2293fd706be3)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d8a1e0a79efcb8faf26350060bb57dcd449cd427
---
libavcodec/wmalosslessdec.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/wmalosslessdec.c b/libavcodec/wmalosslessdec.c
index 0921c16fe5..b2622ddbd3 100644
--- a/libavcodec/wmalosslessdec.c
+++ b/libavcodec/wmalosslessdec.c
@@ -784,8 +784,8 @@ static void revert_inter_ch_decorr(WmallDecodeCtx *s, int
tile_size)
else if (s->is_channel_coded[0] || s->is_channel_coded[1]) {
int icoef;
for (icoef = 0; icoef < tile_size; icoef++) {
-s->channel_residues[0][icoef] -= s->channel_residues[1][icoef] >>
1;
-s->channel_residues[1][icoef] += s->channel_residues[0][icoef];
+s->channel_residues[0][icoef] -=
(unsigned)(s->channel_residues[1][icoef] >> 1);
+s->channel_residues[1][icoef] += (unsigned)
s->channel_residues[0][icoef];
}
}
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/huffyuvdec: Test vertical coordinate more often
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Fri Jun 5 22:05:27 2020 +0200| [9b432f0e85191e5cd8dd655b1262097a357720d5] |
committer: Michael Niedermayer
avcodec/huffyuvdec: Test vertical coordinate more often
Fixes: out of array access
Fixes:
22892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-5135996772679680.fuzz
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol
Signed-off-by: Michael Niedermayer
(cherry picked from commit a1223ddc5692772198a02600ecff2545f32b37be)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9b432f0e85191e5cd8dd655b1262097a357720d5
---
libavcodec/huffyuvdec.c | 8
1 file changed, 8 insertions(+)
diff --git a/libavcodec/huffyuvdec.c b/libavcodec/huffyuvdec.c
index 7463672ffa..58b95f009f 100644
--- a/libavcodec/huffyuvdec.c
+++ b/libavcodec/huffyuvdec.c
@@ -982,12 +982,16 @@ static int decode_frame(AVCodecContext *avctx, void
*data, int *got_frame,
left= left_prediction(s, p->data[plane], s->temp[0], w, 0);
y = 1;
+if (y >= h)
+break;
/* second line is left predicted for interlaced case */
if (s->interlaced) {
decode_plane_bitstream(s, w, plane);
left = left_prediction(s, p->data[plane] +
p->linesize[plane], s->temp[0], w, left);
y++;
+if (y >= h)
+break;
}
lefttop = p->data[plane][0];
@@ -1099,6 +1103,8 @@ static int decode_frame(AVCodecContext *avctx, void
*data, int *got_frame,
}
cy = y = 1;
+if (y >= height)
+break;
/* second line is left predicted for interlaced case */
if (s->interlaced) {
@@ -,6 +1117,8 @@ static int decode_frame(AVCodecContext *avctx, void
*data, int *got_frame,
}
y++;
cy++;
+if (y >= height)
+break;
}
/* next 4 pixels are left predicted too */
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] mpeg4videoenc: Don't crash with -fsanitize=bounds
ffmpeg | branch: release/2.8 | Vitaly Buka
| Tue Apr 21 21:34:19 2020 -0700|
[72a8f82844b94a0bfc1338916fab7fe705aa2bb2] | committer: Michael Niedermayer
mpeg4videoenc: Don't crash with -fsanitize=bounds
Also the patch makes this code consistent with mpeg4videodec.c
Signed-off-by: Michael Niedermayer
(cherry picked from commit f163d30de2090a7275f1fb8ad69258576f12c1a2)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=72a8f82844b94a0bfc1338916fab7fe705aa2bb2
---
libavcodec/mpeg4videoenc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/mpeg4videoenc.c b/libavcodec/mpeg4videoenc.c
index 0cde63ba4e..c8142491e6 100644
--- a/libavcodec/mpeg4videoenc.c
+++ b/libavcodec/mpeg4videoenc.c
@@ -104,7 +104,7 @@ static inline void restore_ac_coeffs(MpegEncContext *s,
int16_t block[6][64],
memcpy(s->block_last_index, zigzag_last_index, sizeof(int) * 6);
for (n = 0; n < 6; n++) {
-int16_t *ac_val = s->ac_val[0][0] + s->block_index[n] * 16;
+int16_t *ac_val = &s->ac_val[0][0][0] + s->block_index[n] * 16;
st[n] = s->intra_scantable.permutated;
if (dir[n]) {
@@ -143,7 +143,7 @@ static inline int decide_ac_pred(MpegEncContext *s, int16_t
block[6][64],
score -= get_block_rate(s, block[n], s->block_last_index[n],
s->intra_scantable.permutated);
-ac_val = s->ac_val[0][0] + s->block_index[n] * 16;
+ac_val = &s->ac_val[0][0][0] + s->block_index[n] * 16;
ac_val1 = ac_val;
if (dir[n]) {
const int xy = s->mb_x + s->mb_y * s->mb_stride - s->mb_stride;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avformat/4xm: Cleanup on GET_LIST_HEADER() failure
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Sun Jun 7 21:35:43 2020 +0200| [13f9cfbf2b4c898e1628b55c8228a53bc9b8cd94] |
committer: Michael Niedermayer
avformat/4xm: Cleanup on GET_LIST_HEADER() failure
Fixes: memleak
Fixes:
23142/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5932860820422656
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt
Signed-off-by: Michael Niedermayer
(cherry picked from commit a5313ce6542a4ee4112acd260e59bff698f3)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=13f9cfbf2b4c898e1628b55c8228a53bc9b8cd94
---
libavformat/4xm.c | 8 +---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/libavformat/4xm.c b/libavformat/4xm.c
index 260e080962..1f1156c78a 100644
--- a/libavformat/4xm.c
+++ b/libavformat/4xm.c
@@ -58,8 +58,10 @@
#define GET_LIST_HEADER() \
fourcc_tag = avio_rl32(pb); \
size = avio_rl32(pb); \
-if (fourcc_tag != LIST_TAG) \
-return AVERROR_INVALIDDATA; \
+if (fourcc_tag != LIST_TAG) { \
+ret = AVERROR_INVALIDDATA; \
+goto fail; \
+} \
fourcc_tag = avio_rl32(pb);
typedef struct AudioTrack {
@@ -201,7 +203,7 @@ static int fourxm_read_header(AVFormatContext *s)
unsigned int size;
int header_size;
FourxmDemuxContext *fourxm = s->priv_data;
-unsigned char *header;
+unsigned char *header = NULL;
int i, ret;
fourxm->track_count = 0;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/mpeg12dec: Fix got_output
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Thu May 28 00:19:56 2020 +0200| [02361a13efb90f94d9746d7087479822827723bb] |
committer: Michael Niedermayer
avcodec/mpeg12dec: Fix got_output
This makes got_output consistent with the code in slice_end() which sets the
output
in slice_end()
if (s->pict_type == AV_PICTURE_TYPE_B || s->low_delay) {
int ret = av_frame_ref(pict, s->current_picture_ptr->f);
...
} else {
Fixes: assertion failure
Fixes:
22178/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5664234440753152
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 4f33a9803a3068ce2d52289fc1db60375dc8b7a5)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=02361a13efb90f94d9746d7087479822827723bb
---
libavcodec/mpeg12dec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/mpeg12dec.c b/libavcodec/mpeg12dec.c
index b93cbc4cf0..e7661e1a8d 100644
--- a/libavcodec/mpeg12dec.c
+++ b/libavcodec/mpeg12dec.c
@@ -2485,7 +2485,7 @@ static int decode_chunks(AVCodecContext *avctx, AVFrame
*picture,
return ret;
else if (ret) {
// FIXME: merge with the stuff in mpeg_decode_slice
-if (s2->last_picture_ptr || s2->low_delay)
+if (s2->last_picture_ptr || s2->low_delay || s2->pict_type
== AV_PICTURE_TYPE_B)
*got_output = 1;
}
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/binkaudio: Fix 2Ghz sample_rate
ffmpeg | branch: release/2.8 | Michael Niedermayer | Sun Apr 19 17:05:53 2020 +0200| [0c914ee968123687778800ac0b438130761c98d7] | committer: Michael Niedermayer avcodec/binkaudio: Fix 2Ghz sample_rate Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int' Fixes: 19950/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINKAUDIO_DCT_fuzzer-5765514337189888 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Suggested-by: Paul Signed-off-by: Michael Niedermayer (cherry picked from commit f603d10b1e6bb2fbf4d43d3ea2fb911b36ba) Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0c914ee968123687778800ac0b438130761c98d7 --- libavcodec/binkaudio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/binkaudio.c b/libavcodec/binkaudio.c index e1c96aa1b1..21e737a196 100644 --- a/libavcodec/binkaudio.c +++ b/libavcodec/binkaudio.c @@ -107,7 +107,7 @@ static av_cold int decode_init(AVCodecContext *avctx) s->frame_len = 1 << frame_len_bits; s->overlap_len = s->frame_len / 16; s->block_size= (s->frame_len - s->overlap_len) * s->channels; -sample_rate_half = (sample_rate + 1) / 2; +sample_rate_half = (sample_rate + 1LL) / 2; if (avctx->codec->id == AV_CODEC_ID_BINKAUDIO_RDFT) s->root = 2.0 / (sqrt(s->frame_len) * 32768.0); else ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/pnmdec: Use unsigned for maxval rescaling
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Sat May 16 00:31:23 2020 +0200| [a317af2debd596fd11dc2e487f7cd145a0b985da] |
committer: Michael Niedermayer
avcodec/pnmdec: Use unsigned for maxval rescaling
Fixes: signed integer overflow: 65535 * 55335 cannot be represented in type
'int'
Fixes:
21955/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-5669206981083136
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 49459aca47d4803b2188fbf12b758bd2b01e91d7)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a317af2debd596fd11dc2e487f7cd145a0b985da
---
libavcodec/pnmdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/pnmdec.c b/libavcodec/pnmdec.c
index 4e2045d2b3..836d6fd86b 100644
--- a/libavcodec/pnmdec.c
+++ b/libavcodec/pnmdec.c
@@ -132,7 +132,7 @@ static int pnm_decode_frame(AVCodecContext *avctx, void
*data,
init_put_bits(&pb, ptr, linesize);
for(j=0; jwidth * components; j++){
unsigned int c=0;
-int v=0;
+unsigned v=0;
if(s->type < 4)
while(s->bytestream < s->bytestream_end && (*s->bytestream
< '0' || *s->bytestream > '9' ))
s->bytestream++;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/wmalosslessdec: Fix integer overflow in mclms_predict()
ffmpeg | branch: release/2.8 | Michael Niedermayer | Sat May 23 22:02:56 2020 +0200| [2c44582d1fc053f3dbf2fc314666b33660a47786] | committer: Michael Niedermayer avcodec/wmalosslessdec: Fix integer overflow in mclms_predict() Fixes: signed integer overflow: 2147483636 + 2048 cannot be represented in type 'int' Fixes: 22016/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5109395618004992 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit c42ed06695848617350a94543823e850f190b3ab) Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2c44582d1fc053f3dbf2fc314666b33660a47786 --- libavcodec/wmalosslessdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/wmalosslessdec.c b/libavcodec/wmalosslessdec.c index b2622ddbd3..87a672845e 100644 --- a/libavcodec/wmalosslessdec.c +++ b/libavcodec/wmalosslessdec.c @@ -675,7 +675,7 @@ static void mclms_predict(WmallDecodeCtx *s, int icoef, int *pred) for (i = 0; i < ich; i++) pred[ich] += s->channel_residues[i][icoef] * s->mclms_coeffs_cur[i + num_channels * ich]; -pred[ich] += (1 << s->mclms_scaling) >> 1; +pred[ich] += (1U << s->mclms_scaling) >> 1; pred[ich] >>= s->mclms_scaling; s->channel_residues[ich][icoef] += (unsigned)pred[ich]; } ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/vp9dsp_template: Fix integer overflow(s) in iadst16_1d()
ffmpeg | branch: release/2.8 | Michael Niedermayer | Sun May 24 00:24:40 2020 +0200| [2383c88baa66c3f546e0b5f492aa5f7f5e08f2ca] | committer: Michael Niedermayer avcodec/vp9dsp_template: Fix integer overflow(s) in iadst16_1d() Fixes: signed integer overflow: 1080285923 - -1130879337 cannot be represented in type 'int' Fixes: 22002/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-6260237310099456 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 071e2937236945c168ab99d3e3b01539194466dd) Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2383c88baa66c3f546e0b5f492aa5f7f5e08f2ca --- libavcodec/vp9dsp_template.c | 152 +-- 1 file changed, 76 insertions(+), 76 deletions(-) diff --git a/libavcodec/vp9dsp_template.c b/libavcodec/vp9dsp_template.c index 95038259b4..f5efc16a19 100644 --- a/libavcodec/vp9dsp_template.c +++ b/libavcodec/vp9dsp_template.c @@ -1378,48 +1378,48 @@ static av_always_inline void iadst16_1d(const dctcoef *in, ptrdiff_t stride, dctint t0a, t1a, t2a, t3a, t4a, t5a, t6a, t7a; dctint t8a, t9a, t10a, t11a, t12a, t13a, t14a, t15a; -t0 = IN(15) * 16364 + IN(0) * 804; -t1 = IN(15) * 804 - IN(0) * 16364; -t2 = IN(13) * 15893 + IN(2) * 3981; -t3 = IN(13) * 3981 - IN(2) * 15893; -t4 = IN(11) * 14811 + IN(4) * 7005; -t5 = IN(11) * 7005 - IN(4) * 14811; -t6 = IN(9) * 13160 + IN(6) * 9760; -t7 = IN(9) * 9760 - IN(6) * 13160; -t8 = IN(7) * 11003 + IN(8) * 12140; -t9 = IN(7) * 12140 - IN(8) * 11003; -t10 = IN(5) * 8423 + IN(10) * 14053; -t11 = IN(5) * 14053 - IN(10) * 8423; -t12 = IN(3) * 5520 + IN(12) * 15426; -t13 = IN(3) * 15426 - IN(12) * 5520; -t14 = IN(1) * 2404 + IN(14) * 16207; -t15 = IN(1) * 16207 - IN(14) * 2404; - -t0a = (t0 + t8 + (1 << 13)) >> 14; -t1a = (t1 + t9 + (1 << 13)) >> 14; -t2a = (t2 + t10 + (1 << 13)) >> 14; -t3a = (t3 + t11 + (1 << 13)) >> 14; -t4a = (t4 + t12 + (1 << 13)) >> 14; -t5a = (t5 + t13 + (1 << 13)) >> 14; -t6a = (t6 + t14 + (1 << 13)) >> 14; -t7a = (t7 + t15 + (1 << 13)) >> 14; -t8a = (t0 - t8 + (1 << 13)) >> 14; -t9a = (t1 - t9 + (1 << 13)) >> 14; -t10a = (t2 - t10 + (1 << 13)) >> 14; -t11a = (t3 - t11 + (1 << 13)) >> 14; -t12a = (t4 - t12 + (1 << 13)) >> 14; -t13a = (t5 - t13 + (1 << 13)) >> 14; -t14a = (t6 - t14 + (1 << 13)) >> 14; -t15a = (t7 - t15 + (1 << 13)) >> 14; - -t8 = t8a * 16069 + t9a * 3196; -t9 = t8a * 3196 - t9a * 16069; -t10 = t10a * 9102 + t11a * 13623; -t11 = t10a * 13623 - t11a * 9102; -t12 = t13a * 16069 - t12a * 3196; -t13 = t13a * 3196 + t12a * 16069; -t14 = t15a * 9102 - t14a * 13623; -t15 = t15a * 13623 + t14a * 9102; +t0 = IN(15) * 16364U + IN(0) * 804U; +t1 = IN(15) * 804U - IN(0) * 16364U; +t2 = IN(13) * 15893U + IN(2) * 3981U; +t3 = IN(13) * 3981U - IN(2) * 15893U; +t4 = IN(11) * 14811U + IN(4) * 7005U; +t5 = IN(11) * 7005U - IN(4) * 14811U; +t6 = IN(9) * 13160U + IN(6) * 9760U; +t7 = IN(9) * 9760U - IN(6) * 13160U; +t8 = IN(7) * 11003U + IN(8) * 12140U; +t9 = IN(7) * 12140U - IN(8) * 11003U; +t10 = IN(5) * 8423U + IN(10) * 14053U; +t11 = IN(5) * 14053U - IN(10) * 8423U; +t12 = IN(3) * 5520U + IN(12) * 15426U; +t13 = IN(3) * 15426U - IN(12) * 5520U; +t14 = IN(1) * 2404U + IN(14) * 16207U; +t15 = IN(1) * 16207U - IN(14) * 2404U; + +t0a = (dctint)((1U << 13) + t0 + t8 ) >> 14; +t1a = (dctint)((1U << 13) + t1 + t9 ) >> 14; +t2a = (dctint)((1U << 13) + t2 + t10) >> 14; +t3a = (dctint)((1U << 13) + t3 + t11) >> 14; +t4a = (dctint)((1U << 13) + t4 + t12) >> 14; +t5a = (dctint)((1U << 13) + t5 + t13) >> 14; +t6a = (dctint)((1U << 13) + t6 + t14) >> 14; +t7a = (dctint)((1U << 13) + t7 + t15) >> 14; +t8a = (dctint)((1U << 13) + t0 - t8 ) >> 14; +t9a = (dctint)((1U << 13) + t1 - t9 ) >> 14; +t10a = (dctint)((1U << 13) + t2 - t10) >> 14; +t11a = (dctint)((1U << 13) + t3 - t11) >> 14; +t12a = (dctint)((1U << 13) + t4 - t12) >> 14; +t13a = (dctint)((1U << 13) + t5 - t13) >> 14; +t14a = (dctint)((1U << 13) + t6 - t14) >> 14; +t15a = (dctint)((1U << 13) + t7 - t15) >> 14; + +t8 = t8a * 16069U + t9a * 3196U; +t9 = t8a * 3196U - t9a * 16069U; +t10 = t10a * 9102U + t11a * 13623U; +t11 = t10a * 13623U - t11a * 9102U; +t12 = t13a * 16069U - t12a * 3196U; +t13 = t13a * 3196U + t12a * 16069U; +t14 = t15a * 9102U - t14a * 13623U; +t15 = t15a * 13623U + t14a * 9102U; t0 = t0a + t4a; t1 = t1a + t5a; @@ -1429,49 +1429,49 @@ static av_always_inline voi
[FFmpeg-cvslog] avformat/thp: Check compcount
ffmpeg | branch: release/2.8 | Michael Niedermayer | Sun May 31 14:24:04 2020 +0200| [2d29c017667ec721b886d89f2e5c6c02d647b00c] | committer: Michael Niedermayer avformat/thp: Check compcount Fixes: out of array access Fixes: 22520/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5100297658826752 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 1ba8484559661dfdbca36dbc17b203f33f62e26c) Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2d29c017667ec721b886d89f2e5c6c02d647b00c --- libavformat/thp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/thp.c b/libavformat/thp.c index 16fa327002..da2e56e14c 100644 --- a/libavformat/thp.c +++ b/libavformat/thp.c @@ -93,6 +93,9 @@ static int thp_read_header(AVFormatContext *s) avio_seek (pb, thp->compoff, SEEK_SET); thp->compcount = avio_rb32(pb); +if (thp->compcount > FF_ARRAY_ELEMS(thp->components)) +return AVERROR_INVALIDDATA; + /* Read the list of component types. */ avio_read(pb, thp->components, 16); ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/adpcm: XA: Check shift similar to filter
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Sun May 31 14:59:02 2020 +0200| [387ba3cb35280ef14f7b6cd16a1c6d602d2683ff] |
committer: Michael Niedermayer
avcodec/adpcm: XA: Check shift similar to filter
Fixes: negative shift
Fixes:
22499/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_XA_fuzzer-5765452130418688
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 6d96bae9c480e020e9f51fabd5642d7ae6020943)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=387ba3cb35280ef14f7b6cd16a1c6d602d2683ff
---
libavcodec/adpcm.c | 10 +-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c
index e91c59b033..b3d07c4a25 100644
--- a/libavcodec/adpcm.c
+++ b/libavcodec/adpcm.c
@@ -357,6 +357,10 @@ static int xa_decode(AVCodecContext *avctx, int16_t *out0,
int16_t *out1,
avpriv_request_sample(avctx, "unknown XA-ADPCM filter %d", filter);
filter=0;
}
+if (shift < 0) {
+avpriv_request_sample(avctx, "unknown XA-ADPCM shift %d", shift);
+shift = 0;
+}
f0 = xa_adpcm_table[filter][0];
f1 = xa_adpcm_table[filter][1];
@@ -382,10 +386,14 @@ static int xa_decode(AVCodecContext *avctx, int16_t
*out0, int16_t *out1,
shift = 12 - (in[5+i*2] & 15);
filter = in[5+i*2] >> 4;
-if (filter >= FF_ARRAY_ELEMS(xa_adpcm_table)) {
+if (filter >= FF_ARRAY_ELEMS(xa_adpcm_table) || shift < 0) {
avpriv_request_sample(avctx, "unknown XA-ADPCM filter %d", filter);
filter=0;
}
+if (shift < 0) {
+avpriv_request_sample(avctx, "unknown XA-ADPCM shift %d", shift);
+shift = 0;
+}
f0 = xa_adpcm_table[filter][0];
f1 = xa_adpcm_table[filter][1];
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/dsddec: Check channels
ffmpeg | branch: release/2.8 | Michael Niedermayer | Mon May 4 00:04:49 2020 +0200| [b35b3dfc251a1e832bcb79ead910e34df20cc4df] | committer: Michael Niedermayer avcodec/dsddec: Check channels Fixes: division by zero Fixes: 21677/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DSD_MSBF_fuzzer-5712547983654912 Fixes: 21751/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DSD_LSBF_fuzzer-5197097180856320 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 2570a8777e7095358b10f679d35641e114a2ab33) Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b35b3dfc251a1e832bcb79ead910e34df20cc4df --- libavcodec/dsddec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/dsddec.c b/libavcodec/dsddec.c index f1dfd4b231..c23ff0fa6d 100644 --- a/libavcodec/dsddec.c +++ b/libavcodec/dsddec.c @@ -93,6 +93,9 @@ static av_cold int decode_init(AVCodecContext *avctx) DSDContext * s; int i; +if (!avctx->channels) +return AVERROR_INVALIDDATA; + init_static_data(); s = av_malloc_array(sizeof(DSDContext), avctx->channels); ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/xvididct: Fix integer overflow in idct_row()
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Sat May 2 21:25:17 2020 +0200| [9fd634161f51ebd3244e6f03b6d60b00c75e8a27] |
committer: Michael Niedermayer
avcodec/xvididct: Fix integer overflow in idct_row()
Fixes: signed integer overflow: -1238335488 + -1003634688 cannot be represented
in type 'int'
Fixes:
21649/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5112005765890048
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 620236e4d2ac46821911b99fa4551868675d4ed9)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9fd634161f51ebd3244e6f03b6d60b00c75e8a27
---
libavcodec/xvididct.c | 36 ++--
1 file changed, 18 insertions(+), 18 deletions(-)
diff --git a/libavcodec/xvididct.c b/libavcodec/xvididct.c
index cf6963c282..54cf548b57 100644
--- a/libavcodec/xvididct.c
+++ b/libavcodec/xvididct.c
@@ -115,24 +115,24 @@ static int idct_row(short *in, const int *const tab, int
rnd)
in[6] = a1;
} else {
const int k = c4 * in[0] + rnd;
-const int a0 = k + c2 * in[2] + c4 * in[4] + c6 * in[6];
-const int a1 = k + c6 * in[2] - c4 * in[4] - c2 * in[6];
-const int a2 = k - c6 * in[2] - c4 * in[4] + c2 * in[6];
-const int a3 = k - c2 * in[2] + c4 * in[4] - c6 * in[6];
-
-const int b0 = c1 * in[1] + c3 * in[3] + c5 * in[5] + c7 * in[7];
-const int b1 = c3 * in[1] - c7 * in[3] - c1 * in[5] - c5 * in[7];
-const int b2 = c5 * in[1] - c1 * in[3] + c7 * in[5] + c3 * in[7];
-const int b3 = c7 * in[1] - c5 * in[3] + c3 * in[5] - c1 * in[7];
-
-in[0] = (a0 + b0) >> ROW_SHIFT;
-in[1] = (a1 + b1) >> ROW_SHIFT;
-in[2] = (a2 + b2) >> ROW_SHIFT;
-in[3] = (a3 + b3) >> ROW_SHIFT;
-in[4] = (a3 - b3) >> ROW_SHIFT;
-in[5] = (a2 - b2) >> ROW_SHIFT;
-in[6] = (a1 - b1) >> ROW_SHIFT;
-in[7] = (a0 - b0) >> ROW_SHIFT;
+const unsigned int a0 = k + c2 * in[2] + c4 * in[4] + c6 * in[6];
+const unsigned int a1 = k + c6 * in[2] - c4 * in[4] - c2 * in[6];
+const unsigned int a2 = k - c6 * in[2] - c4 * in[4] + c2 * in[6];
+const unsigned int a3 = k - c2 * in[2] + c4 * in[4] - c6 * in[6];
+
+const unsigned int b0 = c1 * in[1] + c3 * in[3] + c5 * in[5] + c7 *
in[7];
+const unsigned int b1 = c3 * in[1] - c7 * in[3] - c1 * in[5] - c5 *
in[7];
+const unsigned int b2 = c5 * in[1] - c1 * in[3] + c7 * in[5] + c3 *
in[7];
+const unsigned int b3 = c7 * in[1] - c5 * in[3] + c3 * in[5] - c1 *
in[7];
+
+in[0] = (int)(a0 + b0) >> ROW_SHIFT;
+in[1] = (int)(a1 + b1) >> ROW_SHIFT;
+in[2] = (int)(a2 + b2) >> ROW_SHIFT;
+in[3] = (int)(a3 + b3) >> ROW_SHIFT;
+in[4] = (int)(a3 - b3) >> ROW_SHIFT;
+in[5] = (int)(a2 - b2) >> ROW_SHIFT;
+in[6] = (int)(a1 - b1) >> ROW_SHIFT;
+in[7] = (int)(a0 - b0) >> ROW_SHIFT;
}
return 1;
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avformat/aadec: Check toc_size to contain the minimum to demuxer uses
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Tue Apr 7 12:04:25 2020 +0200| [104e38464bffb9e0a329fd399b08e7e13f79ff6e] |
committer: Michael Niedermayer
avformat/aadec: Check toc_size to contain the minimum to demuxer uses
Fixes: out of array access
Fixes: stack-buffer-overflow-READ-0x0831fff1
Found-by: GalyCannon
Signed-off-by: Michael Niedermayer
(cherry picked from commit daa2482871dffa9af12fa6d874a3d2dedd73f42e)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=104e38464bffb9e0a329fd399b08e7e13f79ff6e
---
libavformat/aadec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/aadec.c b/libavformat/aadec.c
index 16c47950e4..654fabbf33 100644
--- a/libavformat/aadec.c
+++ b/libavformat/aadec.c
@@ -85,7 +85,7 @@ static int aa_read_header(AVFormatContext *s)
avio_skip(pb, 4); // magic string
toc_size = avio_rb32(pb); // TOC size
avio_skip(pb, 4); // unidentified integer
-if (toc_size > MAX_TOC_ENTRIES)
+if (toc_size > MAX_TOC_ENTRIES || toc_size < 2)
return AVERROR_INVALIDDATA;
for (i = 0; i < toc_size; i++) { // read TOC
avio_skip(pb, 4); // TOC entry index
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/h264dec: Disable forced small_padding on flag2 fast
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Thu May 28 14:33:58 2020 +0200| [6b58eaac4ddc36d46bb4611efede18f0a9a530d1] |
committer: Michael Niedermayer
avcodec/h264dec: Disable forced small_padding on flag2 fast
Fixes:
20978/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5746381832847360
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6b58eaac4ddc36d46bb4611efede18f0a9a530d1
---
libavcodec/h264.c | 9 +++--
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/libavcodec/h264.c b/libavcodec/h264.c
index 4fc2aed302..1f399ab838 100644
--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@ -293,12 +293,9 @@ const uint8_t *ff_h264_decode_nal(H264Context *h,
H264SliceContext *sl,
if(i>=length-1){ //no escaped 0
*dst_length= length;
*consumed= length+1; //+1 for the header
-if(h->avctx->flags2 & AV_CODEC_FLAG2_FAST){
-return src;
-}else{
-memcpy(dst, src, length);
-return dst;
-}
+
+memcpy(dst, src, length);
+return dst;
}
memcpy(dst, src, i);
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avformat/thp: Check fps
ffmpeg | branch: release/2.8 | Michael Niedermayer | Mon Jun 8 09:28:55 2020 +0200| [f46d3383413e004977c46032bd6e2295b8d2fa61] | committer: Michael Niedermayer avformat/thp: Check fps Fixes: division by zero Fixes: 23162/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4856420817436672 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 0e15b01b4e463d12128db2c15de7741637548347) Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f46d3383413e004977c46032bd6e2295b8d2fa61 --- libavformat/thp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/thp.c b/libavformat/thp.c index da2e56e14c..efe88b6f42 100644 --- a/libavformat/thp.c +++ b/libavformat/thp.c @@ -75,6 +75,8 @@ static int thp_read_header(AVFormatContext *s) avio_rb32(pb); /* Max samples. */ thp->fps = av_d2q(av_int2float(avio_rb32(pb)), INT_MAX); +if (thp->fps.den <= 0 || thp->fps.num < 0) +return AVERROR_INVALIDDATA; thp->framecnt= avio_rb32(pb); thp->first_framesz = avio_rb32(pb); pb->maxsize = avio_rb32(pb); ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/ffwavesynth: Avoid undefined operation on ts overflow
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Sat Jun 13 21:47:03 2020 +0200| [30242bcb005157a0cd3c32750b1bee999452027f] |
committer: Michael Niedermayer
avcodec/ffwavesynth: Avoid undefined operation on ts overflow
Alternatively these conditions could be treated as errors
Fixes:
23147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5639254549200896
Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented
in type 'int64_t' (aka 'long')
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 584d334afd59714ed04637a9227a4f1368c26166)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=30242bcb005157a0cd3c32750b1bee999452027f
---
libavcodec/ffwavesynth.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/ffwavesynth.c b/libavcodec/ffwavesynth.c
index a446aa2fdf..8d3ac81aef 100644
--- a/libavcodec/ffwavesynth.c
+++ b/libavcodec/ffwavesynth.c
@@ -444,7 +444,7 @@ static int wavesynth_decode(AVCodecContext *avc, void
*rframe, int *rgot_frame,
if (r < 0)
return r;
pcm = (int16_t *)frame->data[0];
-for (s = 0; s < duration; s++, ts++) {
+for (s = 0; s < duration; s++, ts+=(uint64_t)1) {
memset(channels, 0, avc->channels * sizeof(*channels));
if (ts >= ws->next_ts)
wavesynth_enter_intervals(ws, ts);
@@ -452,7 +452,7 @@ static int wavesynth_decode(AVCodecContext *avc, void
*rframe, int *rgot_frame,
for (c = 0; c < avc->channels; c++)
*(pcm++) = channels[c] >> 16;
}
-ws->cur_ts += duration;
+ws->cur_ts += (uint64_t)duration;
*rgot_frame = 1;
return packet->size;
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avformat/microdvddec: skip malformed lines without frame number.
ffmpeg | branch: release/2.8 | Michael Niedermayer | Tue Jun 23 01:43:14 2020 +0200| [204a7255fa61b89b2a2a00688a81d59972512e18] | committer: Michael Niedermayer avformat/microdvddec: skip malformed lines without frame number. Fixes: signed integer overflow: 1 - -9223372036854775808 cannot be represented in type 'long' Fixes: 23490/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5133490093031424 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Nicolas George Signed-off-by: Michael Niedermayer (cherry picked from commit a8fb7612a97530bdd0b2549dacf91dcf71a3187a) Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=204a7255fa61b89b2a2a00688a81d59972512e18 --- libavformat/microdvddec.c | 6 +- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavformat/microdvddec.c b/libavformat/microdvddec.c index a3839051a4..e8740a2cc2 100644 --- a/libavformat/microdvddec.c +++ b/libavformat/microdvddec.c @@ -94,6 +94,7 @@ static int microdvd_read_header(AVFormatContext *s) int64_t pos = avio_tell(s->pb); int len = ff_get_line(s->pb, line_buf, sizeof(line_buf)); char *line = line_buf; +int64_t pts; if (!strncmp(line, bom, 3)) line += 3; @@ -134,11 +135,14 @@ static int microdvd_read_header(AVFormatContext *s) SKIP_FRAME_ID; if (!*p) continue; +pts = get_pts(line); +if (pts == AV_NOPTS_VALUE) +continue; sub = ff_subtitles_queue_insert(µdvd->q, p, strlen(p), 0); if (!sub) return AVERROR(ENOMEM); sub->pos = pos; -sub->pts = get_pts(line); +sub->pts = pts; sub->duration = get_duration(line); } ff_subtitles_queue_finalize(µdvd->q); ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/lossless_audiodsp: Fix undefined overflows in scalarproduct_and_madd_int16_c()
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Sun Jun 7 19:24:10 2020 +0200| [c11634ad7599d13e71c6e9053267051b4f14a3e6] |
committer: Michael Niedermayer
avcodec/lossless_audiodsp: Fix undefined overflows in
scalarproduct_and_madd_int16_c()
Fixes: signed integer overflow: 2142077091 + 6881070 cannot be represented in
type 'int'
Fixes:
22737/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-595839681920
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit c0dfe134beefde4070d43910518b1f4a58f01794)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c11634ad7599d13e71c6e9053267051b4f14a3e6
---
libavcodec/lossless_audiodsp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/lossless_audiodsp.c b/libavcodec/lossless_audiodsp.c
index 32f4c9e856..74838415fe 100644
--- a/libavcodec/lossless_audiodsp.c
+++ b/libavcodec/lossless_audiodsp.c
@@ -27,7 +27,7 @@ static int32_t scalarproduct_and_madd_int16_c(int16_t *v1,
const int16_t *v2,
const int16_t *v3,
int order, int mul)
{
-int res = 0;
+unsigned res = 0;
while (order--) {
res += *v1 * *v2++;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/iff: Fix off by x error
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Sat Jun 13 10:48:14 2020 +0200| [c837abe0a9d81f042f35f278a321f9acfa6cd742] |
committer: Michael Niedermayer
avcodec/iff: Fix off by x error
Fixes: out of array access
Fixes:
23245/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5723121327013888.fuzz
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 51225dee0a6266780d26d43bd6802bbcf736327e)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c837abe0a9d81f042f35f278a321f9acfa6cd742
---
libavcodec/iff.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/iff.c b/libavcodec/iff.c
index 3fe27f25ab..e7048299b5 100644
--- a/libavcodec/iff.c
+++ b/libavcodec/iff.c
@@ -596,7 +596,7 @@ static void decode_deep_rle32(uint8_t *dst, const uint8_t
*src, int src_size, in
if (opcode >= 0) {
int size = opcode + 1;
for (i = 0; i < size; i++) {
-int length = FFMIN(size - i, width);
+int length = FFMIN(size - i, width - x);
if (src_end - src < length * 4)
return;
memcpy(dst + y*linesize + x * 4, src, length * 4);
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/pngdec: Check for fctl after idat
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Thu Jun 25 19:22:01 2020 +0200| [8cae3778ea21388be0bcbe747826e8cd63832b7b] |
committer: Michael Niedermayer
avcodec/pngdec: Check for fctl after idat
Fixes: out of array access
Fixes:
23554/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-4796622520451072.fuzz
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 65b1ba680fb67902a9c876a49d0146eaae5a1c3d)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8cae3778ea21388be0bcbe747826e8cd63832b7b
---
libavcodec/pngdec.c | 5 +
1 file changed, 5 insertions(+)
diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c
index bfc7c9da0b..4cace3d5af 100644
--- a/libavcodec/pngdec.c
+++ b/libavcodec/pngdec.c
@@ -925,6 +925,11 @@ static int decode_fctl_chunk(AVCodecContext *avctx,
PNGDecContext *s,
return AVERROR_INVALIDDATA;
}
+if (s->pic_state & PNG_IDAT) {
+av_log(avctx, AV_LOG_ERROR, "fctl after IDAT\n");
+return AVERROR_INVALIDDATA;
+}
+
s->last_w = s->cur_w;
s->last_h = s->cur_h;
s->last_x_offset = s->x_offset;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/sonic: Fix several integer overflows
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Thu Feb 20 19:56:39 2020 +0100| [bb5e4743d9c5b860236318701552bd6ae9945478] |
committer: Michael Niedermayer
avcodec/sonic: Fix several integer overflows
Fixes: signed integer overflow: 2129689466 + 2129689466 cannot be represented
in type 'int'
Fixes:
20715/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5155263109922816
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 75d520e33704447f1b29ac47fd9e40994a6bc659)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bb5e4743d9c5b860236318701552bd6ae9945478
---
libavcodec/sonic.c | 7 ---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/libavcodec/sonic.c b/libavcodec/sonic.c
index 1b16825403..f1bc3409bf 100644
--- a/libavcodec/sonic.c
+++ b/libavcodec/sonic.c
@@ -140,7 +140,8 @@ static inline av_flatten int get_symbol(RangeCoder *c,
uint8_t *state, int is_si
if(get_rac(c, state+0))
return 0;
else{
-int i, e, a;
+int i, e;
+unsigned a;
e= 0;
while(get_rac(c, state+1 + FFMIN(e,9))){ //1..10
e++;
@@ -474,7 +475,7 @@ static int predictor_calc_error(int *k, int *state, int
order, int error)
for (i = order-2; i >= 0; i--, k_ptr--, state_ptr--)
{
int k_value = *k_ptr, state_value = *state_ptr;
-x -= shift_down(k_value * state_value, LATTICE_SHIFT);
+x -= shift_down(k_value * (unsigned)state_value, LATTICE_SHIFT);
state_ptr[1] = state_value + shift_down(k_value * (unsigned)x,
LATTICE_SHIFT);
}
#else
@@ -1044,7 +1045,7 @@ static int sonic_decode_frame(AVCodecContext *avctx,
x += s->channels;
}
-s->int_samples[x] = predictor_calc_error(s->predictor_k,
s->predictor_state[ch], s->num_taps, s->coded_samples[ch][i] * quant);
+s->int_samples[x] = predictor_calc_error(s->predictor_k,
s->predictor_state[ch], s->num_taps, s->coded_samples[ch][i] * (unsigned)quant);
x += s->channels;
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] Update for 2.8.17
ffmpeg | branch: release/2.8 | Michael Niedermayer | Sun Jul 5 12:46:07 2020 +0200| [98ce6fd8e73bd8cfe891a0c2ed9579f143672901] | committer: Michael Niedermayer Update for 2.8.17 > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=98ce6fd8e73bd8cfe891a0c2ed9579f143672901 --- Changelog| 59 +++ RELEASE | 2 +- doc/Doxyfile | 2 +- 3 files changed, 61 insertions(+), 2 deletions(-) diff --git a/Changelog b/Changelog index ee576b1ad6..de8f782b12 100644 --- a/Changelog +++ b/Changelog @@ -1,6 +1,65 @@ Entries are sorted chronologically from oldest to youngest within each release, releases are sorted from youngest to oldest. +version 2.8.17: + avformat/utils: reorder duration computation to avoid overflow + avcodec/pngdec: Check for fctl after idat + png: split header state and data state in two separate variables. + avformat/hls: Pass a copy of the URL for probing + avformat/hls: check segment duration value of EXTINF + avutil/common: Fix integer overflow in av_ceil_log2_c() + avformat/microdvddec: skip malformed lines without frame number. + avformat/4xm: Check that a video stream was created before returning packets for it + avcodec/ffwavesynth: Avoid undefined operation on ts overflow + avcodec/mpeg4videodec: Fix 2 integer overflows in get_amv() + avcodec/lossless_audiodsp: Fix undefined overflows in scalarproduct_and_madd_int16_c() + avcodec/sonic: Fix several integer overflows + avcodec/iff: Fix off by x error + avcodec/wmalosslessdec: Check block_align maximum + avcodec/loco: Fix signed integer overflow in loco_get_rice() + avformat/thp: Check fps + avformat/mpl2dec: Fix integer overflow with duration + avcodec/mpeg12dec: remove outdated comments + avcodec/snowdec: Avoid integer overflow with huge qlog + avcodec/mpeg12dec: Fix got_output + avformat/4xm: Cleanup on GET_LIST_HEADER() failure + avformat/mlvdec: fail reading a packet with 0 streams + avformat/thp: Check compcount + avcodec/adpcm: XA: Check shift similar to filter + avcodec/huffyuvdec: Test vertical coordinate more often + avcodec/hq_hqa: Check info size + avcodec/wmalosslessdec: Fix integer overflow in mclms_predict() + avcodec/vp9dsp_template: Fix integer overflow(s) in iadst16_1d() + avcodec/h264dec: Disable forced small_padding on flag2 fast + avcodec/pnmdec: Use unsigned for maxval rescaling + avcodec/ivi: Clear got_p_frame before decoding a new frame using it + avcodec/dsddec: Check channels + avcodec/xvididct: Fix integer overflow in idct_row() + avcodec/wmalosslessdec: Fix integer overflows in revert_inter_ch_decorr() + avformat/mpegenc: Fix integer overflow with AV_NOPTS_VALUE + avformat/aadec: Check toc_size to contain the minimum to demuxer uses + avformat/mov: Don't allow negative sample sizes. + mpeg4videoenc: Don't crash with -fsanitize=bounds + avcodec/binkaudio: Fix 2Ghz sample_rate + avcodec/adpcm: Fix integer overflow in ADPCM THP + avcodec/ralf: Check num_blocks before use + avcodec/utvideodec: Fix integer overflow in decode_plane() + avcodec/ralf: Fix integer overflow in decode_block() + avcodec/nuv: widen buf_size type + avcodec/g729postfilter: Clip gain before scaling with AGC_FAC1 + avformat/thp: Require a video stream + avformat/mpeg: Decrease score by 1 for files with very little valid data + avcodec/pngdec: Check length in fdAT + avcodec/g2meet: Check tile_width in epic_jb_decode_tile() + avcodec/vp9dsp_template: Fix integer overflows in idct32_1d() + libavcodec/wmalosslessdec: prevent sum of positive numbers from becoming negative + avcodec/txd: Check for input size against the header size. + avcodec/svq1dec: Check that there is data left after the header + avformat/mov: fix memleaks + libavformat/mov: Fix memleaks when demuxing DV audio + libavcodec/libvpxenc: Don't free user-provided AVPacket + avcodec/libopusenc: Don't free user-provided AVPacket + version 2.8.16: - avcodec/hevc_mp4toannexb_bsf: Check nalu_size - avcodec/iff: Check length before memcpy() in decode_deep_rle32() diff --git a/RELEASE b/RELEASE index 85c0a6a965..6ece8e7d51 100644 --- a/RELEASE +++ b/RELEASE @@ -1 +1 @@ -2.8.16 +2.8.17 diff --git a/doc/Doxyfile b/doc/Doxyfile index c47d2b44c7..60dc3ff6cc 100644 --- a/doc/Doxyfile +++ b/doc/Doxyfile @@ -31,7 +31,7 @@ PROJECT_NAME = FFmpeg # This could be handy for archiving the generated documentation or # if some version control system is used. -PROJECT_NUMBER = 2.8.16 +PROJECT_NUMBER = 2.8.17 # With the PROJECT_LOGO tag one can specify a logo or icon that is included # in the documentation. The maximum height of the logo should not exceed 55 ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/mpeg12dec: remove outdated comments
ffmpeg | branch: release/2.8 | Michael Niedermayer | Sat Jun 6 19:42:07 2020 +0200| [a1cfe7baede40a61fee8c0e6021e6e7283586f77] | committer: Michael Niedermayer avcodec/mpeg12dec: remove outdated comments Found-by: Kieran Signed-off-by: Michael Niedermayer (cherry picked from commit 48de8f5816aa54dc584aeb2dbbf63a0e880279e2) Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a1cfe7baede40a61fee8c0e6021e6e7283586f77 --- libavcodec/mpeg12dec.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/libavcodec/mpeg12dec.c b/libavcodec/mpeg12dec.c index e7661e1a8d..fc26473cff 100644 --- a/libavcodec/mpeg12dec.c +++ b/libavcodec/mpeg12dec.c @@ -308,7 +308,6 @@ end: } /** - * Note: this function can read out of range and crash for corrupt streams. * Changing this would eat up any speed benefits it has. * Do not use "fast" flag if you need the code to be robust. */ @@ -475,7 +474,6 @@ end: } /** - * Note: this function can read out of range and crash for corrupt streams. * Changing this would eat up any speed benefits it has. * Do not use "fast" flag if you need the code to be robust. */ @@ -626,7 +624,6 @@ static inline int mpeg2_decode_block_intra(MpegEncContext *s, } /** - * Note: this function can read out of range and crash for corrupt streams. * Changing this would eat up any speed benefits it has. * Do not use "fast" flag if you need the code to be robust. */ ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avformat/mpl2dec: Fix integer overflow with duration
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Mon Jun 8 09:47:41 2020 +0200| [60568d284161c1e666d73d5462aaa8e4de1fa40d] |
committer: Michael Niedermayer
avformat/mpl2dec: Fix integer overflow with duration
Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented
in type 'long'
Fixes:
23167/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6425051741290496
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 9a42a67c5ca198a3879b7f3663cc44ccbcaf0bd3)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=60568d284161c1e666d73d5462aaa8e4de1fa40d
---
libavformat/mpl2dec.c | 9 ++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/libavformat/mpl2dec.c b/libavformat/mpl2dec.c
index 260b7be0ec..8805e1e692 100644
--- a/libavformat/mpl2dec.c
+++ b/libavformat/mpl2dec.c
@@ -50,7 +50,7 @@ static int mpl2_probe(AVProbeData *p)
return AVPROBE_SCORE_MAX;
}
-static int read_ts(char **line, int64_t *pts_start, int *duration)
+static int read_ts(char **line, int64_t *pts_start, int64_t *duration)
{
char c;
int len;
@@ -64,7 +64,10 @@ static int read_ts(char **line, int64_t *pts_start, int
*duration)
}
if (sscanf(*line, "[%"SCNd64"][%"SCNd64"]%c%n",
pts_start, &end, &c, &len) >= 3) {
-*duration = end - *pts_start;
+if (end < *pts_start || end - (uint64_t)*pts_start > INT64_MAX) {
+*duration = -1;
+} else
+*duration = end - *pts_start;
*line += len - 1;
return 0;
}
@@ -89,7 +92,7 @@ static int mpl2_read_header(AVFormatContext *s)
const int64_t pos = avio_tell(s->pb);
int len = ff_get_line(s->pb, line, sizeof(line));
int64_t pts_start;
-int duration;
+int64_t duration;
if (!len)
break;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avformat/hls: check segment duration value of EXTINF
ffmpeg | branch: release/2.8 | Steven Liu | Fri May 29
11:39:05 2020 +0800| [6959358683c7533f586c07a766acc5fe9544d8b2] | committer:
Michael Niedermayer
avformat/hls: check segment duration value of EXTINF
fix ticket: 8673
set the default EXTINF duration to 1ms if duration is smaller than 1ms
Signed-off-by: Steven Liu
(cherry picked from commit 9dfb19baeb86a8bb02c53a441682c6e9a6e104cc)
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6959358683c7533f586c07a766acc5fe9544d8b2
---
libavformat/hls.c | 7 +--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/libavformat/hls.c b/libavformat/hls.c
index bccaf67fa1..77d7aeba17 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -806,8 +806,6 @@ static int parse_playlist(HLSContext *c, const char *url,
ret = AVERROR(ENOMEM);
goto fail;
}
-seg->duration = duration;
-seg->key_type = key_type;
if (has_iv) {
memcpy(seg->iv, iv, sizeof(iv));
} else {
@@ -837,6 +835,11 @@ static int parse_playlist(HLSContext *c, const char *url,
goto fail;
}
+if (duration < 0.001 * AV_TIME_BASE) {
+duration = 0.001 * AV_TIME_BASE;
+}
+seg->duration = duration;
+seg->key_type = key_type;
dynarray_add(&pls->segments, &pls->n_segments, seg);
is_segment = 0;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avformat/mlvdec: fail reading a packet with 0 streams
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Sun May 31 14:30:43 2020 +0200| [39806a275eb287c39fba7283d1b40dd0e72018bd] |
committer: Michael Niedermayer
avformat/mlvdec: fail reading a packet with 0 streams
Fixes: NULL pointer dereference
Fixes:
22604/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5667739074297856.fuzz
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 5bd5c3108786bf69f108c55c375f1956f67ca7a4)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=39806a275eb287c39fba7283d1b40dd0e72018bd
---
libavformat/mlvdec.c | 6 +-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/libavformat/mlvdec.c b/libavformat/mlvdec.c
index 84b916844c..0ed0cb11a2 100644
--- a/libavformat/mlvdec.c
+++ b/libavformat/mlvdec.c
@@ -384,10 +384,14 @@ static int read_packet(AVFormatContext *avctx, AVPacket
*pkt)
{
MlvContext *mlv = avctx->priv_data;
AVIOContext *pb;
-AVStream *st = avctx->streams[mlv->stream_index];
+AVStream *st;
int index, ret;
unsigned int size, space;
+if (!avctx->nb_streams)
+return AVERROR_EOF;
+
+st = avctx->streams[mlv->stream_index];
if (mlv->pts >= st->duration)
return AVERROR_EOF;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/wmalosslessdec: Check block_align maximum
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Tue Jun 9 22:11:23 2020 +0200| [08f49d5085f123f1c6f15c77252a24d5e7eaa797] |
committer: Michael Niedermayer
avcodec/wmalosslessdec: Check block_align maximum
Fixes: Assertion failure
Fixes:
22737/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-595839681920
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 314d10f7a60f1786c85da30a569be61e2b906fef)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=08f49d5085f123f1c6f15c77252a24d5e7eaa797
---
libavcodec/wmalosslessdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/wmalosslessdec.c b/libavcodec/wmalosslessdec.c
index 87a672845e..02e1e8dfa1 100644
--- a/libavcodec/wmalosslessdec.c
+++ b/libavcodec/wmalosslessdec.c
@@ -185,7 +185,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
unsigned int channel_mask;
int i, log2_max_num_subframes;
-if (avctx->block_align <= 0) {
+if (avctx->block_align <= 0 || avctx->block_align > (1<<21)) {
av_log(avctx, AV_LOG_ERROR, "block_align is not set or invalid\n");
return AVERROR(EINVAL);
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/snowdec: Avoid integer overflow with huge qlog
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Sat Jun 6 17:45:39 2020 +0200| [0d9270743785b61b49296717b2c01f70aa74d969] |
committer: Michael Niedermayer
avcodec/snowdec: Avoid integer overflow with huge qlog
Fixes: integer overflow
Fixes:
22285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5682428762128384
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 38fbf33c7255b503453052c32ab5ae4fb151b29e)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0d9270743785b61b49296717b2c01f70aa74d969
---
libavcodec/snowdec.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/snowdec.c b/libavcodec/snowdec.c
index 84e98afe4c..5c82309301 100644
--- a/libavcodec/snowdec.c
+++ b/libavcodec/snowdec.c
@@ -114,7 +114,7 @@ static av_always_inline void
predict_slice_buffered(SnowContext *s, slice_buffer
static inline void decode_subband_slice_buffered(SnowContext *s, SubBand *b,
slice_buffer * sb, int start_y, int h, int save_state[1]){
const int w= b->width;
int y;
-const int qlog= av_clip(s->qlog + b->qlog, 0, QROOT*16);
+const int qlog= av_clip(s->qlog + (int64_t)b->qlog, 0, QROOT*16);
int qmul= ff_qexp[qlog&(QROOT-1)]<<(qlog>>QSHIFT);
int qadd= (s->qbias*qmul)>>QBIAS_SHIFT;
int new_index = 0;
@@ -221,7 +221,7 @@ static int decode_q_branch(SnowContext *s, int level, int
x, int y){
static void dequantize_slice_buffered(SnowContext *s, slice_buffer * sb,
SubBand *b, IDWTELEM *src, int stride, int start_y, int end_y){
const int w= b->width;
-const int qlog= av_clip(s->qlog + b->qlog, 0, QROOT*16);
+const int qlog= av_clip(s->qlog + (int64_t)b->qlog, 0, QROOT*16);
const int qmul= ff_qexp[qlog&(QROOT-1)]<<(qlog>>QSHIFT);
const int qadd= (s->qbias*qmul)>>QBIAS_SHIFT;
int x,y;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avformat/4xm: Check that a video stream was created before returning packets for it
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Sun Jun 14 19:51:23 2020 +0200| [22669e38e4500b8845c3a2b0bc0854e4c91369c3] |
committer: Michael Niedermayer
avformat/4xm: Check that a video stream was created before returning packets
for it
Fixes: assertion failure
Fixes:
23434/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5227750851084288.fuzz
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit c517c3f4741b6897ea952d1fba199c93c5217cfe)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=22669e38e4500b8845c3a2b0bc0854e4c91369c3
---
libavformat/4xm.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavformat/4xm.c b/libavformat/4xm.c
index 1f1156c78a..9f40fff346 100644
--- a/libavformat/4xm.c
+++ b/libavformat/4xm.c
@@ -209,6 +209,7 @@ static int fourxm_read_header(AVFormatContext *s)
fourxm->track_count = 0;
fourxm->tracks = NULL;
fourxm->fps = (AVRational){1,1};
+fourxm->video_stream_index = -1;
/* skip the first 3 32-bit numbers */
avio_skip(pb, 12);
@@ -314,6 +315,8 @@ static int fourxm_read_packet(AVFormatContext *s,
case cfr2_TAG:
/* allocate 8 more bytes than 'size' to account for fourcc
* and size */
+if (fourxm->video_stream_index < 0)
+return AVERROR_INVALIDDATA;
if (size + 8 < size || av_new_packet(pkt, size + 8))
return AVERROR(EIO);
pkt->stream_index = fourxm->video_stream_index;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avformat/hls: Pass a copy of the URL for probing
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Mon Jun 29 19:49:41 2020 +0200| [0f6fa27b241676624bab91fc6ecdf8ac01121d29] |
committer: Michael Niedermayer
avformat/hls: Pass a copy of the URL for probing
The segments / url can be modified by the io read when reloading
This may be an alternative or additional fix for Ticket8673
as a further alternative the reload stuff could be disabled during
probing
Signed-off-by: Michael Niedermayer
(cherry picked from commit b5e39880fb7269b1b3577cee288e06aa3dc1dfa2)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0f6fa27b241676624bab91fc6ecdf8ac01121d29
---
libavformat/hls.c | 6 --
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/libavformat/hls.c b/libavformat/hls.c
index 77d7aeba17..803331eaba 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -1606,6 +1606,7 @@ static int hls_read_header(AVFormatContext *s)
for (i = 0; i < c->n_playlists; i++) {
struct playlist *pls = c->playlists[i];
AVInputFormat *in_fmt = NULL;
+char *url;
if (!(pls->ctx = avformat_alloc_context())) {
ret = AVERROR(ENOMEM);
@@ -1630,8 +1631,9 @@ static int hls_read_header(AVFormatContext *s)
ffio_init_context(&pls->pb, pls->read_buffer, INITIAL_BUFFER_SIZE, 0,
pls,
read_data, NULL, NULL);
pls->pb.seekable = 0;
-ret = av_probe_input_buffer(&pls->pb, &in_fmt, pls->segments[0]->url,
-NULL, 0, 0);
+url = av_strdup(pls->segments[0]->url);
+ret = av_probe_input_buffer(&pls->pb, &in_fmt, url, NULL, 0, 0);
+av_free(url);
if (ret < 0) {
/* Free the ctx - it isn't initialized properly at this point,
* so avformat_close_input shouldn't be called. If
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/loco: Fix signed integer overflow in loco_get_rice()
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Tue Jun 9 22:14:59 2020 +0200| [5663dd666233ffc8b2b28a992433694196f2d46d] |
committer: Michael Niedermayer
avcodec/loco: Fix signed integer overflow in loco_get_rice()
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type
'int'
Fixes:
22975/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5658160970072064
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit aa88cdfd90f5da0683cd6556c75a5ba5740a1c27)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5663dd666233ffc8b2b28a992433694196f2d46d
---
libavcodec/loco.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/loco.c b/libavcodec/loco.c
index e3746c8317..e22d280b96 100644
--- a/libavcodec/loco.c
+++ b/libavcodec/loco.c
@@ -82,7 +82,7 @@ static inline void loco_update_rice_param(RICEContext *r, int
val)
static inline int loco_get_rice(RICEContext *r)
{
-int v;
+unsigned v;
if (r->run > 0) { /* we have zero run */
r->run--;
loco_update_rice_param(r, 0);
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/mpeg4videodec: Fix 2 integer overflows in get_amv()
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Thu Jun 11 22:22:57 2020 +0200| [425c0eafaef85270af0d7474b12e127e97d6289c] |
committer: Michael Niedermayer
avcodec/mpeg4videodec: Fix 2 integer overflows in get_amv()
Fixes: signed integer overflow: -144876608 * 16 cannot be represented in type
'int'
Fixes:
22782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-6039584977977344
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit e361785ee05cc75d3caacf2f254160b0336f5358)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=425c0eafaef85270af0d7474b12e127e97d6289c
---
libavcodec/mpeg4videodec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c
index d2340d15ae..2129c44490 100644
--- a/libavcodec/mpeg4videodec.c
+++ b/libavcodec/mpeg4videodec.c
@@ -549,7 +549,7 @@ static inline int get_amv(Mpeg4DecContext *ctx, int n)
dy -= 1 << (shift + a + 1);
else
dx -= 1 << (shift + a + 1);
-mb_v = s->sprite_offset[0][n] + dx * s->mb_x * 16 + dy * s->mb_y * 16;
+mb_v = s->sprite_offset[0][n] + dx * s->mb_x * 16U + dy * s->mb_y *
16U;
sum = 0;
for (y = 0; y < 16; y++) {
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] png: split header state and data state in two separate variables.
ffmpeg | branch: release/2.8 | Ronald S. Bultje | Mon Apr
3 10:08:29 2017 -0400| [453519af0d4a50bbc62999b312de9692e429bf22] | committer:
Michael Niedermayer
png: split header state and data state in two separate variables.
Fixes a reported (but false) race condition in tsan for fate-apng:
WARNING: ThreadSanitizer: data race (pid=6274)
Read of size 4 at 0x7d680001ec78 by main thread (mutexes: write M1338):
#0 update_thread_context src/libavcodec/pngdec.c:1456
(ffmpeg+0x00dacf0c)
[..]
Previous write of size 4 at 0x7d680001ec78 by thread T1 (mutexes: write
M1335):
#0 decode_idat_chunk src/libavcodec/pngdec.c:737 (ffmpeg+0x00dae951)
(cherry picked from commit 478f1c3d5e5463a284ea7efecfc62d47ba3be11a)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=453519af0d4a50bbc62999b312de9692e429bf22
---
libavcodec/png.h| 5 -
libavcodec/pngdec.c | 65 -
2 files changed, 39 insertions(+), 31 deletions(-)
diff --git a/libavcodec/png.h b/libavcodec/png.h
index 948c2f714f..e967fcf38f 100644
--- a/libavcodec/png.h
+++ b/libavcodec/png.h
@@ -42,11 +42,6 @@
#define PNG_FILTER_VALUE_PAETH 4
#define PNG_FILTER_VALUE_MIXED 5
-#define PNG_IHDR 0x0001
-#define PNG_IDAT 0x0002
-#define PNG_ALLIMAGE 0x0004
-#define PNG_PLTE 0x0008
-
#define NB_PASSES 7
#define PNGSIG 0x89504e470d0a1a0a
diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c
index 3fa4e4e4c0..bfc7c9da0b 100644
--- a/libavcodec/pngdec.c
+++ b/libavcodec/pngdec.c
@@ -34,6 +34,16 @@
#include
+enum PNGHeaderState {
+PNG_IHDR = 1 << 0,
+PNG_PLTE = 1 << 1,
+};
+
+enum PNGImageState {
+PNG_IDAT = 1 << 0,
+PNG_ALLIMAGE = 1 << 1,
+};
+
typedef struct PNGDecContext {
PNGDSPContext dsp;
AVCodecContext *avctx;
@@ -43,7 +53,8 @@ typedef struct PNGDecContext {
ThreadFrame last_picture;
ThreadFrame picture;
-int state;
+enum PNGHeaderState hdr_state;
+enum PNGImageState pic_state;
int width, height;
int cur_w, cur_h;
int last_w, last_h;
@@ -332,7 +343,7 @@ static void png_handle_row(PNGDecContext *s)
}
s->y++;
if (s->y == s->cur_h) {
-s->state |= PNG_ALLIMAGE;
+s->pic_state |= PNG_ALLIMAGE;
if (s->filter_type == PNG_FILTER_TYPE_LOCO) {
if (s->bit_depth == 16) {
deloco_rgb16((uint16_t *)ptr, s->row_size / 2,
@@ -367,7 +378,7 @@ static void png_handle_row(PNGDecContext *s)
memset(s->last_row, 0, s->row_size);
for (;;) {
if (s->pass == NB_PASSES - 1) {
-s->state |= PNG_ALLIMAGE;
+s->pic_state |= PNG_ALLIMAGE;
goto the_end;
} else {
s->pass++;
@@ -402,7 +413,7 @@ static int png_decode_idat(PNGDecContext *s, int length)
return AVERROR_EXTERNAL;
}
if (s->zstream.avail_out == 0) {
-if (!(s->state & PNG_ALLIMAGE)) {
+if (!(s->pic_state & PNG_ALLIMAGE)) {
png_handle_row(s);
}
s->zstream.avail_out = s->crow_size;
@@ -539,12 +550,12 @@ static int decode_ihdr_chunk(AVCodecContext *avctx,
PNGDecContext *s,
if (length != 13)
return AVERROR_INVALIDDATA;
-if (s->state & PNG_IDAT) {
+if (s->pic_state & PNG_IDAT) {
av_log(avctx, AV_LOG_ERROR, "IHDR after IDAT\n");
return AVERROR_INVALIDDATA;
}
-if (s->state & PNG_IHDR) {
+if (s->hdr_state & PNG_IHDR) {
av_log(avctx, AV_LOG_ERROR, "Multiple IHDR\n");
return AVERROR_INVALIDDATA;
}
@@ -571,7 +582,7 @@ static int decode_ihdr_chunk(AVCodecContext *avctx,
PNGDecContext *s,
s->filter_type = bytestream2_get_byte(&s->gb);
s->interlace_type = bytestream2_get_byte(&s->gb);
bytestream2_skip(&s->gb, 4); /* crc */
-s->state |= PNG_IHDR;
+s->hdr_state |= PNG_IHDR;
if (avctx->debug & FF_DEBUG_PICT_INFO)
av_log(avctx, AV_LOG_DEBUG, "width=%d height=%d depth=%d color_type=%d
"
"compression_type=%d filter_type=%d interlace_type=%d\n",
@@ -587,7 +598,7 @@ error:
static int decode_phys_chunk(AVCodecContext *avctx, PNGDecContext *s)
{
-if (s->state & PNG_IDAT) {
+if (s->pic_state & PNG_IDAT) {
av_log(avctx, AV_LOG_ERROR, "pHYs after IDAT\n");
return AVERROR_INVALIDDATA;
}
@@ -607,11 +618,11 @@ static int decode_idat_chunk(AVCodecContext *avctx,
PNGDecContext *s,
int ret;
size_t byte_depth = s->bit_depth > 8 ? 2 : 1;
-if (!(s->state & PNG_IHDR)) {
+if (!(s->hdr_state & PNG_IHDR)) {
av_log(avctx, AV_LOG_ERROR, "IDAT without IHDR\n");
return AVERROR_INVALIDDATA;
}
-if (!(s->state & PNG_IDAT)) {
+if (!(s->pic_state & PNG_IDAT)) {
/* init
[FFmpeg-cvslog] avutil/common: Fix integer overflow in av_ceil_log2_c()
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Sun Jun 28 00:21:09 2020 +0200| [449bdf05f8843c675e96daa04ecf08f1a013fbd9] |
committer: Michael Niedermayer
avutil/common: Fix integer overflow in av_ceil_log2_c()
Fixes: left shift of 1913647649 by 1 places cannot be represented in type 'int'
Fixes:
23572/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5082619795734528
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit e409262837712016097c187e97bf99aadf6a4cdf)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=449bdf05f8843c675e96daa04ecf08f1a013fbd9
---
libavutil/common.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavutil/common.h b/libavutil/common.h
index ee7028e1fb..ed2710681a 100644
--- a/libavutil/common.h
+++ b/libavutil/common.h
@@ -311,7 +311,7 @@ static av_always_inline av_const double av_clipd_c(double
a, double amin, double
*/
static av_always_inline av_const int av_ceil_log2_c(int x)
{
-return av_log2((x - 1) << 1);
+return av_log2((x - 1U) << 1);
}
/**
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avformat/utils: reorder duration computation to avoid overflow
ffmpeg | branch: release/2.8 | Michael Niedermayer |
Sun Jun 21 12:24:04 2020 +0200| [542bfa483c19be2adf63e750c6ad074e581e45af] |
committer: Michael Niedermayer
avformat/utils: reorder duration computation to avoid overflow
Fixes: signed integer overflow: 8 * 9223372036854774783 cannot be represented
in type 'long'
Fixes:
23381/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4818340509122560
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 10cc82c35baabbb07ffec3faccb04d8928c39e4c)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=542bfa483c19be2adf63e750c6ad074e581e45af
---
libavformat/utils.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/utils.c b/libavformat/utils.c
index 084a3e7537..209dcb75ae 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -2446,7 +2446,7 @@ static void
estimate_timings_from_bit_rate(AVFormatContext *ic)
st = ic->streams[i];
if ( st->time_base.num <= INT64_MAX / ic->bit_rate
&& st->duration == AV_NOPTS_VALUE) {
-duration = av_rescale(8 * filesize, st->time_base.den,
+duration = av_rescale(filesize, 8LL * st->time_base.den,
ic->bit_rate *
(int64_t) st->time_base.num);
st->duration = duration;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/tiff: Check frame parameters before blit for DNG
ffmpeg | branch: master | Michael Niedermayer | Sat
Jul 4 14:17:05 2020 +0200| [4091f4f78012d1a7eb1e04b69cf65d5ef3afee3a] |
committer: Michael Niedermayer
avcodec/tiff: Check frame parameters before blit for DNG
Fixes: out of array access
Fixes:
23888/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-6021365974171648.fuzz
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4091f4f78012d1a7eb1e04b69cf65d5ef3afee3a
---
libavcodec/tiff.c | 15 +--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index d93a02b07e..6a3ec3ef95 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -911,12 +911,23 @@ static int dng_decode_jpeg(AVCodecContext *avctx, AVFrame
*frame,
return 0;
}
+is_u16 = (s->bpp > 8);
+
/* Copy the outputted tile's pixels from 'jpgframe' to 'frame' (final
buffer) */
/* See dng_blit for explanation */
-is_single_comp = (s->avctx_mjpeg->width == w * 2 && s->avctx_mjpeg->height
== h / 2);
+if (s->avctx_mjpeg->width == w * 2 &&
+s->avctx_mjpeg->height == h / 2 &&
+s->avctx_mjpeg->pix_fmt == AV_PIX_FMT_GRAY16LE) {
+is_single_comp = 1;
+} else if (s->avctx_mjpeg->width == w &&
+ s->avctx_mjpeg->height == h &&
+ s->avctx_mjpeg->pix_fmt == (is_u16 ? AV_PIX_FMT_GRAY16 :
AV_PIX_FMT_GRAY8)
+ ) {
+is_single_comp = 0;
+} else
+return AVERROR_INVALIDDATA;
-is_u16 = (s->bpp > 8);
pixel_size = (is_u16 ? sizeof(uint16_t) : sizeof(uint8_t));
if (is_single_comp && !is_u16) {
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/mjpegdec: Limit bayer to single plane outputting format
ffmpeg | branch: master | Michael Niedermayer | Sat
Jul 4 14:15:01 2020 +0200| [865a34970e73b9c23e33fd6dc6ba046d4e821519] |
committer: Michael Niedermayer
avcodec/mjpegdec: Limit bayer to single plane outputting format
This reduces the number of paths reachable with DNG and should
improve security
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=865a34970e73b9c23e33fd6dc6ba046d4e821519
---
libavcodec/mjpegdec.c | 5 +
1 file changed, 5 insertions(+)
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index cb5e2a9b9b..e7a4e08c1c 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -499,6 +499,11 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
}
}
+if (s->bayer) {
+if (pix_fmt_id != 0x && pix_fmt_id != 0x1100)
+goto unk_pixfmt;
+}
+
switch (pix_fmt_id) {
case 0x: /* for bayer-encoded huffman lossless JPEGs embedded
in DNGs */
if (!s->bayer)
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] libavcodec/jpeg2000dec.c: Enable image offsets
ffmpeg | branch: master | Gautam Ramakrishnan | Sun Jul
5 00:51:09 2020 +0530| [2c21955f52496b73b42d10169db4a79e81788bf9] | committer:
Michael Niedermayer
libavcodec/jpeg2000dec.c: Enable image offsets
This patch enables support for image offsets.
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2c21955f52496b73b42d10169db4a79e81788bf9
---
libavcodec/jpeg2000dec.c | 4
1 file changed, 4 deletions(-)
diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
index f62553c874..18a933077e 100644
--- a/libavcodec/jpeg2000dec.c
+++ b/libavcodec/jpeg2000dec.c
@@ -288,10 +288,6 @@ static int get_siz(Jpeg2000DecoderContext *s)
s->tile_offset_y = bytestream2_get_be32u(&s->g); // YT0Siz
ncomponents = bytestream2_get_be16u(&s->g); // CSiz
-if (s->image_offset_x || s->image_offset_y) {
-avpriv_request_sample(s->avctx, "Support for image offsets");
-return AVERROR_PATCHWELCOME;
-}
if (av_image_check_size2(s->width, s->height, s->avctx->max_pixels,
AV_PIX_FMT_NONE, 0, s->avctx)) {
avpriv_request_sample(s->avctx, "Large Dimensions");
return AVERROR_PATCHWELCOME;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/pnmdec: Fix misaligned reads
ffmpeg | branch: master | Michael Niedermayer | Fri
Jul 3 23:55:50 2020 +0200| [ea28ce9bc13803ccef97850388ddc9a73998a23e] |
committer: Michael Niedermayer
avcodec/pnmdec: Fix misaligned reads
Found-by: "Steinar H. Gunderson"
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ea28ce9bc13803ccef97850388ddc9a73998a23e
---
libavcodec/pnmdec.c | 20 ++--
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/libavcodec/pnmdec.c b/libavcodec/pnmdec.c
index 05bd11b147..9add5cfc84 100644
--- a/libavcodec/pnmdec.c
+++ b/libavcodec/pnmdec.c
@@ -173,7 +173,7 @@ static int pnm_decode_frame(AVCodecContext *avctx, void
*data,
} else if (upgrade == 2) {
unsigned int j, v, f = (65535 * 32768 + s->maxval / 2) /
s->maxval;
for (j = 0; j < n / 2; j++) {
-v = av_be2ne16(((uint16_t *)s->bytestream)[j]);
+v = AV_RB16(s->bytestream + 2*j);
((uint16_t *)ptr)[j] = (v * f + 16384) >> 15;
}
}
@@ -227,7 +227,7 @@ static int pnm_decode_frame(AVCodecContext *avctx, void
*data,
return AVERROR_INVALIDDATA;
for (i = 0; i < avctx->height; i++) {
for (j = 0; j < n / 2; j++) {
-v = av_be2ne16(((uint16_t *)s->bytestream)[j]);
+v = AV_RB16(s->bytestream + 2*j);
((uint16_t *)ptr)[j] = (v * f + 16384) >> 15;
}
s->bytestream += n;
@@ -239,13 +239,13 @@ static int pnm_decode_frame(AVCodecContext *avctx, void
*data,
h = avctx->height >> 1;
for (i = 0; i < h; i++) {
for (j = 0; j < n / 2; j++) {
-v = av_be2ne16(((uint16_t *)s->bytestream)[j]);
+v = AV_RB16(s->bytestream + 2*j);
ptr1[j] = (v * f + 16384) >> 15;
}
s->bytestream += n;
for (j = 0; j < n / 2; j++) {
-v = av_be2ne16(((uint16_t *)s->bytestream)[j]);
+v = AV_RB16(s->bytestream + 2*j);
ptr2[j] = (v * f + 16384) >> 15;
}
s->bytestream += n;
@@ -267,9 +267,9 @@ static int pnm_decode_frame(AVCodecContext *avctx, void
*data,
b = (float *)p->data[1];
for (int i = 0; i < avctx->height; i++) {
for (int j = 0; j < avctx->width; j++) {
-r[j] = av_int2float(av_le2ne32(((uint32_t
*)s->bytestream)[0])) * scale;
-g[j] = av_int2float(av_le2ne32(((uint32_t
*)s->bytestream)[4])) * scale;
-b[j] = av_int2float(av_le2ne32(((uint32_t
*)s->bytestream)[8])) * scale;
+r[j] = av_int2float(AV_RL32(s->bytestream+0)) * scale;
+g[j] = av_int2float(AV_RL32(s->bytestream+4)) * scale;
+b[j] = av_int2float(AV_RL32(s->bytestream+8)) * scale;
s->bytestream += 12;
}
@@ -285,9 +285,9 @@ static int pnm_decode_frame(AVCodecContext *avctx, void
*data,
b = (float *)p->data[1];
for (int i = 0; i < avctx->height; i++) {
for (int j = 0; j < avctx->width; j++) {
-r[j] = av_int2float(av_be2ne32(((uint32_t
*)s->bytestream)[0])) * scale;
-g[j] = av_int2float(av_be2ne32(((uint32_t
*)s->bytestream)[4])) * scale;
-b[j] = av_int2float(av_be2ne32(((uint32_t
*)s->bytestream)[8])) * scale;
+r[j] = av_int2float(AV_RB32(s->bytestream+0)) * scale;
+g[j] = av_int2float(AV_RB32(s->bytestream+4)) * scale;
+b[j] = av_int2float(AV_RB32(s->bytestream+8)) * scale;
s->bytestream += 12;
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] libavcodec/jpeg2000dec: Enhance pix fmt selection
ffmpeg | branch: master | Gautam Ramakrishnan | Sun Jul
5 00:51:08 2020 +0530| [69522e04001f9dad710a420a6d46aa138659244e] | committer:
Michael Niedermayer
libavcodec/jpeg2000dec: Enhance pix fmt selection
This patch assigns default pix format values when
a match does not take place.
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=69522e04001f9dad710a420a6d46aa138659244e
---
libavcodec/jpeg2000dec.c | 12
1 file changed, 12 insertions(+)
diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
index 3f4a9ef96c..f62553c874 100644
--- a/libavcodec/jpeg2000dec.c
+++ b/libavcodec/jpeg2000dec.c
@@ -436,6 +436,18 @@ static int get_siz(Jpeg2000DecoderContext *s)
s->cdef[3] = 3;
i = 0;
}
+} else if (ncomponents == 3 && s->precision == 8 &&
+ s->cdx[0] == s->cdx[1] && s->cdx[0] == s->cdx[2] &&
+ s->cdy[0] == s->cdy[1] && s->cdy[0] == s->cdy[2]) {
+s->avctx->pix_fmt = AV_PIX_FMT_RGB24;
+i = 0;
+} else if (ncomponents == 2 && s->precision == 8 &&
+ s->cdx[0] == s->cdx[1] && s->cdy[0] == s->cdy[1]) {
+s->avctx->pix_fmt = AV_PIX_FMT_YA8;
+i = 0;
+} else if (ncomponents == 1 && s->precision == 8) {
+s->avctx->pix_fmt = AV_PIX_FMT_GRAY8;
+i = 0;
}
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] dnn-layer-math-unary-test: add unit test for cosh
ffmpeg | branch: master | Ting Fu | Mon Jun 29 22:54:03 2020 +0800| [c5de77e33c9b573d27f5ba70a13caca12c32f4a8] | committer: Guo, Yejun dnn-layer-math-unary-test: add unit test for cosh Signed-off-by: Ting Fu > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c5de77e33c9b573d27f5ba70a13caca12c32f4a8 --- tests/dnn/dnn-layer-mathunary-test.c | 4 1 file changed, 4 insertions(+) diff --git a/tests/dnn/dnn-layer-mathunary-test.c b/tests/dnn/dnn-layer-mathunary-test.c index a1ff05e5fb..0280debc0b 100644 --- a/tests/dnn/dnn-layer-mathunary-test.c +++ b/tests/dnn/dnn-layer-mathunary-test.c @@ -46,6 +46,8 @@ static float get_expected(float f, DNNMathUnaryOperation op) return atan(f); case DMUO_SINH: return sinh(f); +case DMUO_COSH: +return cosh(f); default: av_assert0(!"not supported yet"); return 0.f; @@ -105,5 +107,7 @@ int main(int agrc, char **argv) return 1; if (test(DMUO_SINH)) return 1; +if (test(DMUO_COSH)) +return 1; return 0; } ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] dnn_backend_native_layer_mathunary: add cosh support
ffmpeg | branch: master | Ting Fu | Mon Jun 29 22:54:02
2020 +0800| [62fc7e30357ca994eb8e2568bc7566274de70c27] | committer: Guo, Yejun
dnn_backend_native_layer_mathunary: add cosh support
Signed-off-by: Ting Fu
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=62fc7e30357ca994eb8e2568bc7566274de70c27
---
libavfilter/dnn/dnn_backend_native_layer_mathunary.c | 4
libavfilter/dnn/dnn_backend_native_layer_mathunary.h | 1 +
tools/python/convert_from_tensorflow.py | 2 +-
tools/python/convert_header.py | 2 +-
4 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
b/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
index 2630fe07e2..ddb70996e7 100644
--- a/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
+++ b/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
@@ -108,6 +108,10 @@ int dnn_execute_layer_math_unary(DnnOperand *operands,
const int32_t *input_oper
for (int i = 0; i < dims_count; ++i)
dst[i] = sinh(src[i]);
return 0;
+case DMUO_COSH:
+for (int i = 0; i < dims_count; ++i)
+dst[i] = cosh(src[i]);
+return 0;
default:
return -1;
}
diff --git a/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
b/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
index 760930c60e..5a486b4f5f 100644
--- a/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
+++ b/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
@@ -38,6 +38,7 @@ typedef enum {
DMUO_ACOS = 5,
DMUO_ATAN = 6,
DMUO_SINH = 7,
+DMUO_COSH = 8,
DMUO_COUNT
} DNNMathUnaryOperation;
diff --git a/tools/python/convert_from_tensorflow.py
b/tools/python/convert_from_tensorflow.py
index 6f34a71ab4..96da44c4a8 100644
--- a/tools/python/convert_from_tensorflow.py
+++ b/tools/python/convert_from_tensorflow.py
@@ -72,7 +72,7 @@ class TFConverter:
self.conv2d_scopename_inputname_dict = {}
self.op2code = {'Conv2D':1, 'DepthToSpace':2, 'MirrorPad':3,
'Maximum':4, 'MathBinary':5, 'MathUnary':6}
self.mathbin2code = {'Sub':0, 'Add':1, 'Mul':2, 'RealDiv':3,
'Minimum':4}
-self.mathun2code = {'Abs':0, 'Sin':1, 'Cos':2, 'Tan':3, 'Asin':4,
'Acos':5, 'Atan':6, 'Sinh':7}
+self.mathun2code = {'Abs':0, 'Sin':1, 'Cos':2, 'Tan':3, 'Asin':4,
'Acos':5, 'Atan':6, 'Sinh':7, 'Cosh':8}
self.mirrorpad_mode = {'CONSTANT':0, 'REFLECT':1, 'SYMMETRIC':2}
self.name_operand_dict = {}
diff --git a/tools/python/convert_header.py b/tools/python/convert_header.py
index 4747f41395..a73f51ba48 100644
--- a/tools/python/convert_header.py
+++ b/tools/python/convert_header.py
@@ -23,4 +23,4 @@ str = 'FFMPEGDNNNATIVE'
major = 1
# increase minor when we don't have to re-convert the model file
-minor = 13
+minor = 14
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] dnn-layer-math-unary-test: add unit test for sinh
ffmpeg | branch: master | Ting Fu | Mon Jun 29 22:54:01 2020 +0800| [85c0608c6b5b420ea1b2b4d4cc354ec54b5db1a0] | committer: Guo, Yejun dnn-layer-math-unary-test: add unit test for sinh Signed-off-by: Ting Fu > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=85c0608c6b5b420ea1b2b4d4cc354ec54b5db1a0 --- tests/dnn/dnn-layer-mathunary-test.c | 4 1 file changed, 4 insertions(+) diff --git a/tests/dnn/dnn-layer-mathunary-test.c b/tests/dnn/dnn-layer-mathunary-test.c index bf77c44bbe..a1ff05e5fb 100644 --- a/tests/dnn/dnn-layer-mathunary-test.c +++ b/tests/dnn/dnn-layer-mathunary-test.c @@ -44,6 +44,8 @@ static float get_expected(float f, DNNMathUnaryOperation op) return acos(f); case DMUO_ATAN: return atan(f); +case DMUO_SINH: +return sinh(f); default: av_assert0(!"not supported yet"); return 0.f; @@ -101,5 +103,7 @@ int main(int agrc, char **argv) return 1; if (test(DMUO_ATAN)) return 1; +if (test(DMUO_SINH)) +return 1; return 0; } ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] dnn-layer-math-unary-test: add unit test for atanh
ffmpeg | branch: master | Ting Fu | Mon Jun 29 22:54:11
2020 +0800| [57ea0483af8e09ab812713fff6f89060a24b7a75] | committer: Guo, Yejun
dnn-layer-math-unary-test: add unit test for atanh
Signed-off-by: Ting Fu
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=57ea0483af8e09ab812713fff6f89060a24b7a75
---
tests/dnn/dnn-layer-mathunary-test.c | 10 +++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/tests/dnn/dnn-layer-mathunary-test.c
b/tests/dnn/dnn-layer-mathunary-test.c
index 5587e47ad5..683e623d95 100644
--- a/tests/dnn/dnn-layer-mathunary-test.c
+++ b/tests/dnn/dnn-layer-mathunary-test.c
@@ -54,6 +54,8 @@ static float get_expected(float f, DNNMathUnaryOperation op)
return asinh(f);
case DMUO_ACOSH:
return acosh(f);
+case DMUO_ATANH:
+return atanh(f);
default:
av_assert0(!"not supported yet");
return 0.f;
@@ -65,8 +67,8 @@ static int test(DNNMathUnaryOperation op)
DnnLayerMathUnaryParams params;
DnnOperand operands[2];
int32_t input_indexes[1];
-float input[1*1*2*3] = {
--3, 2.5, 2, -2.1, 7.8, 100};
+float input[1*1*3*3] = {
+0.1, 0.5, 0.75, -3, 2.5, 2, -2.1, 7.8, 100};
float *output;
params.un_op = op;
@@ -74,7 +76,7 @@ static int test(DNNMathUnaryOperation op)
operands[0].data = input;
operands[0].dims[0] = 1;
operands[0].dims[1] = 1;
-operands[0].dims[2] = 2;
+operands[0].dims[2] = 3;
operands[0].dims[3] = 3;
operands[1].data = NULL;
@@ -121,5 +123,7 @@ int main(int agrc, char **argv)
return 1;
if (test(DMUO_ACOSH))
return 1;
+if (test(DMUO_ATANH))
+return 1;
return 0;
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] dnn-layer-math-unary-test: add unit test for acosh
ffmpeg | branch: master | Ting Fu | Mon Jun 29 22:54:09 2020 +0800| [52d2e1666546d47799e1d2aeb6d70f9d5edb9369] | committer: Guo, Yejun dnn-layer-math-unary-test: add unit test for acosh Signed-off-by: Ting Fu > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=52d2e1666546d47799e1d2aeb6d70f9d5edb9369 --- tests/dnn/dnn-layer-mathunary-test.c | 4 1 file changed, 4 insertions(+) diff --git a/tests/dnn/dnn-layer-mathunary-test.c b/tests/dnn/dnn-layer-mathunary-test.c index 90fce71a0c..5587e47ad5 100644 --- a/tests/dnn/dnn-layer-mathunary-test.c +++ b/tests/dnn/dnn-layer-mathunary-test.c @@ -52,6 +52,8 @@ static float get_expected(float f, DNNMathUnaryOperation op) return tanh(f); case DMUO_ASINH: return asinh(f); +case DMUO_ACOSH: +return acosh(f); default: av_assert0(!"not supported yet"); return 0.f; @@ -117,5 +119,7 @@ int main(int agrc, char **argv) return 1; if (test(DMUO_ASINH)) return 1; +if (test(DMUO_ACOSH)) +return 1; return 0; } ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] dnn_backend_native_layer_mathunary: add sinh support
ffmpeg | branch: master | Ting Fu | Mon Jun 29 22:54:00
2020 +0800| [91b40371016047db19e311549154a9217d8c9090] | committer: Guo, Yejun
dnn_backend_native_layer_mathunary: add sinh support
Signed-off-by: Ting Fu
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=91b40371016047db19e311549154a9217d8c9090
---
libavfilter/dnn/dnn_backend_native_layer_mathunary.c | 4
libavfilter/dnn/dnn_backend_native_layer_mathunary.h | 1 +
tools/python/convert_from_tensorflow.py | 2 +-
tools/python/convert_header.py | 2 +-
4 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
b/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
index 42615c43d5..2630fe07e2 100644
--- a/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
+++ b/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
@@ -104,6 +104,10 @@ int dnn_execute_layer_math_unary(DnnOperand *operands,
const int32_t *input_oper
for (int i = 0; i < dims_count; ++i)
dst[i] = atan(src[i]);
return 0;
+case DMUO_SINH:
+for (int i = 0; i < dims_count; ++i)
+dst[i] = sinh(src[i]);
+return 0;
default:
return -1;
}
diff --git a/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
b/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
index 13fa33178a..760930c60e 100644
--- a/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
+++ b/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
@@ -37,6 +37,7 @@ typedef enum {
DMUO_ASIN = 4,
DMUO_ACOS = 5,
DMUO_ATAN = 6,
+DMUO_SINH = 7,
DMUO_COUNT
} DNNMathUnaryOperation;
diff --git a/tools/python/convert_from_tensorflow.py
b/tools/python/convert_from_tensorflow.py
index b90c31c495..6f34a71ab4 100644
--- a/tools/python/convert_from_tensorflow.py
+++ b/tools/python/convert_from_tensorflow.py
@@ -72,7 +72,7 @@ class TFConverter:
self.conv2d_scopename_inputname_dict = {}
self.op2code = {'Conv2D':1, 'DepthToSpace':2, 'MirrorPad':3,
'Maximum':4, 'MathBinary':5, 'MathUnary':6}
self.mathbin2code = {'Sub':0, 'Add':1, 'Mul':2, 'RealDiv':3,
'Minimum':4}
-self.mathun2code = {'Abs':0, 'Sin':1, 'Cos':2, 'Tan':3, 'Asin':4,
'Acos':5, 'Atan':6}
+self.mathun2code = {'Abs':0, 'Sin':1, 'Cos':2, 'Tan':3, 'Asin':4,
'Acos':5, 'Atan':6, 'Sinh':7}
self.mirrorpad_mode = {'CONSTANT':0, 'REFLECT':1, 'SYMMETRIC':2}
self.name_operand_dict = {}
diff --git a/tools/python/convert_header.py b/tools/python/convert_header.py
index 73cf23bf53..4747f41395 100644
--- a/tools/python/convert_header.py
+++ b/tools/python/convert_header.py
@@ -23,4 +23,4 @@ str = 'FFMPEGDNNNATIVE'
major = 1
# increase minor when we don't have to re-convert the model file
-minor = 12
+minor = 13
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] dnn-layer-math-unary-test: add unit test for tanh
ffmpeg | branch: master | Ting Fu | Mon Jun 29 22:54:05 2020 +0800| [0de50430609147248b8ecacaa06bf957328f7f8e] | committer: Guo, Yejun dnn-layer-math-unary-test: add unit test for tanh Signed-off-by: Ting Fu > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0de50430609147248b8ecacaa06bf957328f7f8e --- tests/dnn/dnn-layer-mathunary-test.c | 4 1 file changed, 4 insertions(+) diff --git a/tests/dnn/dnn-layer-mathunary-test.c b/tests/dnn/dnn-layer-mathunary-test.c index 0280debc0b..6885b4d318 100644 --- a/tests/dnn/dnn-layer-mathunary-test.c +++ b/tests/dnn/dnn-layer-mathunary-test.c @@ -48,6 +48,8 @@ static float get_expected(float f, DNNMathUnaryOperation op) return sinh(f); case DMUO_COSH: return cosh(f); +case DMUO_TANH: +return tanh(f); default: av_assert0(!"not supported yet"); return 0.f; @@ -109,5 +111,7 @@ int main(int agrc, char **argv) return 1; if (test(DMUO_COSH)) return 1; +if (test(DMUO_TANH)) +return 1; return 0; } ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] dnn-layer-math-unary-test: add unit test for asinh
ffmpeg | branch: master | Ting Fu | Mon Jun 29 22:54:07 2020 +0800| [33374bdbd88197512eccb7cdf5fceca340b3e49f] | committer: Guo, Yejun dnn-layer-math-unary-test: add unit test for asinh Signed-off-by: Ting Fu > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=33374bdbd88197512eccb7cdf5fceca340b3e49f --- tests/dnn/dnn-layer-mathunary-test.c | 4 1 file changed, 4 insertions(+) diff --git a/tests/dnn/dnn-layer-mathunary-test.c b/tests/dnn/dnn-layer-mathunary-test.c index 6885b4d318..90fce71a0c 100644 --- a/tests/dnn/dnn-layer-mathunary-test.c +++ b/tests/dnn/dnn-layer-mathunary-test.c @@ -50,6 +50,8 @@ static float get_expected(float f, DNNMathUnaryOperation op) return cosh(f); case DMUO_TANH: return tanh(f); +case DMUO_ASINH: +return asinh(f); default: av_assert0(!"not supported yet"); return 0.f; @@ -113,5 +115,7 @@ int main(int agrc, char **argv) return 1; if (test(DMUO_TANH)) return 1; +if (test(DMUO_ASINH)) +return 1; return 0; } ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] dnn_backend_native_layer_mathunary: add tanh support
ffmpeg | branch: master | Ting Fu | Mon Jun 29 22:54:04
2020 +0800| [ea71e731f413bc581c20c0f963b13e8410dd3b6f] | committer: Guo, Yejun
dnn_backend_native_layer_mathunary: add tanh support
Signed-off-by: Ting Fu
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ea71e731f413bc581c20c0f963b13e8410dd3b6f
---
libavfilter/dnn/dnn_backend_native_layer_mathunary.c | 4
libavfilter/dnn/dnn_backend_native_layer_mathunary.h | 1 +
tools/python/convert_from_tensorflow.py | 2 +-
tools/python/convert_header.py | 2 +-
4 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
b/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
index ddb70996e7..ccdbcc21e0 100644
--- a/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
+++ b/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
@@ -112,6 +112,10 @@ int dnn_execute_layer_math_unary(DnnOperand *operands,
const int32_t *input_oper
for (int i = 0; i < dims_count; ++i)
dst[i] = cosh(src[i]);
return 0;
+case DMUO_TANH:
+for (int i = 0; i < dims_count; ++i)
+dst[i] = tanh(src[i]);
+return 0;
default:
return -1;
}
diff --git a/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
b/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
index 5a486b4f5f..ae0c1e1cdd 100644
--- a/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
+++ b/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
@@ -39,6 +39,7 @@ typedef enum {
DMUO_ATAN = 6,
DMUO_SINH = 7,
DMUO_COSH = 8,
+DMUO_TANH = 9,
DMUO_COUNT
} DNNMathUnaryOperation;
diff --git a/tools/python/convert_from_tensorflow.py
b/tools/python/convert_from_tensorflow.py
index 96da44c4a8..f98a3cae3d 100644
--- a/tools/python/convert_from_tensorflow.py
+++ b/tools/python/convert_from_tensorflow.py
@@ -72,7 +72,7 @@ class TFConverter:
self.conv2d_scopename_inputname_dict = {}
self.op2code = {'Conv2D':1, 'DepthToSpace':2, 'MirrorPad':3,
'Maximum':4, 'MathBinary':5, 'MathUnary':6}
self.mathbin2code = {'Sub':0, 'Add':1, 'Mul':2, 'RealDiv':3,
'Minimum':4}
-self.mathun2code = {'Abs':0, 'Sin':1, 'Cos':2, 'Tan':3, 'Asin':4,
'Acos':5, 'Atan':6, 'Sinh':7, 'Cosh':8}
+self.mathun2code = {'Abs':0, 'Sin':1, 'Cos':2, 'Tan':3, 'Asin':4,
'Acos':5, 'Atan':6, 'Sinh':7, 'Cosh':8, 'Tanh':9}
self.mirrorpad_mode = {'CONSTANT':0, 'REFLECT':1, 'SYMMETRIC':2}
self.name_operand_dict = {}
diff --git a/tools/python/convert_header.py b/tools/python/convert_header.py
index a73f51ba48..d2753f0af0 100644
--- a/tools/python/convert_header.py
+++ b/tools/python/convert_header.py
@@ -23,4 +23,4 @@ str = 'FFMPEGDNNNATIVE'
major = 1
# increase minor when we don't have to re-convert the model file
-minor = 14
+minor = 15
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] dnn_backend_native_layer_mathunary: add asinh support
ffmpeg | branch: master | Ting Fu | Mon Jun 29 22:54:06
2020 +0800| [9d14b38d9db272585ab2219805ec62c88e02708b] | committer: Guo, Yejun
dnn_backend_native_layer_mathunary: add asinh support
Signed-off-by: Ting Fu
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9d14b38d9db272585ab2219805ec62c88e02708b
---
libavfilter/dnn/dnn_backend_native_layer_mathunary.c | 4
libavfilter/dnn/dnn_backend_native_layer_mathunary.h | 1 +
tools/python/convert_from_tensorflow.py | 2 +-
tools/python/convert_header.py | 2 +-
4 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
b/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
index ccdbcc21e0..83df98d0f8 100644
--- a/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
+++ b/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
@@ -116,6 +116,10 @@ int dnn_execute_layer_math_unary(DnnOperand *operands,
const int32_t *input_oper
for (int i = 0; i < dims_count; ++i)
dst[i] = tanh(src[i]);
return 0;
+case DMUO_ASINH:
+for (int i = 0; i < dims_count; ++i)
+dst[i] = asinh(src[i]);
+return 0;
default:
return -1;
}
diff --git a/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
b/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
index ae0c1e1cdd..fbe9af5c7d 100644
--- a/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
+++ b/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
@@ -40,6 +40,7 @@ typedef enum {
DMUO_SINH = 7,
DMUO_COSH = 8,
DMUO_TANH = 9,
+DMUO_ASINH = 10,
DMUO_COUNT
} DNNMathUnaryOperation;
diff --git a/tools/python/convert_from_tensorflow.py
b/tools/python/convert_from_tensorflow.py
index f98a3cae3d..0d756c8109 100644
--- a/tools/python/convert_from_tensorflow.py
+++ b/tools/python/convert_from_tensorflow.py
@@ -72,7 +72,7 @@ class TFConverter:
self.conv2d_scopename_inputname_dict = {}
self.op2code = {'Conv2D':1, 'DepthToSpace':2, 'MirrorPad':3,
'Maximum':4, 'MathBinary':5, 'MathUnary':6}
self.mathbin2code = {'Sub':0, 'Add':1, 'Mul':2, 'RealDiv':3,
'Minimum':4}
-self.mathun2code = {'Abs':0, 'Sin':1, 'Cos':2, 'Tan':3, 'Asin':4,
'Acos':5, 'Atan':6, 'Sinh':7, 'Cosh':8, 'Tanh':9}
+self.mathun2code = {'Abs':0, 'Sin':1, 'Cos':2, 'Tan':3, 'Asin':4,
'Acos':5, 'Atan':6, 'Sinh':7, 'Cosh':8, 'Tanh':9, 'Asinh':10}
self.mirrorpad_mode = {'CONSTANT':0, 'REFLECT':1, 'SYMMETRIC':2}
self.name_operand_dict = {}
diff --git a/tools/python/convert_header.py b/tools/python/convert_header.py
index d2753f0af0..3211c13f6d 100644
--- a/tools/python/convert_header.py
+++ b/tools/python/convert_header.py
@@ -23,4 +23,4 @@ str = 'FFMPEGDNNNATIVE'
major = 1
# increase minor when we don't have to re-convert the model file
-minor = 15
+minor = 16
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] dnn_backend_native_layer_mathunary: add atanh support
ffmpeg | branch: master | Ting Fu | Mon Jun 29 22:54:10
2020 +0800| [c0cdeea0ee2c4af9fb4948fe3e33b857cf6d2771] | committer: Guo, Yejun
dnn_backend_native_layer_mathunary: add atanh support
It can be tested with the model generated with below python script:
import tensorflow as tf
import numpy as np
import imageio
in_img = imageio.imread('input.jpeg')
in_img = in_img.astype(np.float32)/255.0
in_data = in_img[np.newaxis, :]
x = tf.placeholder(tf.float32, shape=[1, None, None, 3], name='dnn_in')
please uncomment the part you want to test
x_sinh_1 = tf.sinh(x)
x_out = tf.divide(x_sinh_1, 1.176) # sinh(1.0)
x_cosh_1 = tf.cosh(x)
x_out = tf.divide(x_cosh_1, 1.55) # cosh(1.0)
x_tanh_1 = tf.tanh(x)
x__out = tf.divide(x_tanh_1, 0.77) # tanh(1.0)
x_asinh_1 = tf.asinh(x)
x_out = tf.divide(x_asinh_1, 0.89) # asinh(1.0/1.1)
x_acosh_1 = tf.add(x, 1.1)
x_acosh_2 = tf.acosh(x_acosh_1) # accept (1, inf)
x_out = tf.divide(x_acosh_2, 1.4) # acosh(2.1)
x_atanh_1 = tf.divide(x, 1.1)
x_atanh_2 = tf.atanh(x_atanh_1) # accept (-1, 1)
x_out = tf.divide(x_atanh_2, 1.55) # atanhh(1.0/1.1)
y = tf.identity(x_out, name='dnn_out') #please only preserve the x_out you want
to test
sess=tf.Session()
sess.run(tf.global_variables_initializer())
graph_def = tf.graph_util.convert_variables_to_constants(sess, sess.graph_def,
['dnn_out'])
tf.train.write_graph(graph_def, '.', 'image_process.pb', as_text=False)
print("image_process.pb generated, please use \
path_to_ffmpeg/tools/python/convert.py to generate image_process.model\n")
output = sess.run(y, feed_dict={x: in_data})
imageio.imsave("out.jpg", np.squeeze(output))
Signed-off-by: Ting Fu
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c0cdeea0ee2c4af9fb4948fe3e33b857cf6d2771
---
libavfilter/dnn/dnn_backend_native_layer_mathunary.c | 4
libavfilter/dnn/dnn_backend_native_layer_mathunary.h | 1 +
tools/python/convert_from_tensorflow.py | 2 +-
tools/python/convert_header.py | 2 +-
4 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
b/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
index b77b84a794..c83d50db64 100644
--- a/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
+++ b/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
@@ -124,6 +124,10 @@ int dnn_execute_layer_math_unary(DnnOperand *operands,
const int32_t *input_oper
for (int i = 0; i < dims_count; ++i)
dst[i] = acosh(src[i]);
return 0;
+case DMUO_ATANH:
+for (int i = 0; i < dims_count; ++i)
+dst[i] = atanh(src[i]);
+return 0;
default:
return -1;
}
diff --git a/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
b/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
index eb30231549..8076356ba4 100644
--- a/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
+++ b/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
@@ -42,6 +42,7 @@ typedef enum {
DMUO_TANH = 9,
DMUO_ASINH = 10,
DMUO_ACOSH = 11,
+DMUO_ATANH = 12,
DMUO_COUNT
} DNNMathUnaryOperation;
diff --git a/tools/python/convert_from_tensorflow.py
b/tools/python/convert_from_tensorflow.py
index 1e73e3aefe..85db7bf710 100644
--- a/tools/python/convert_from_tensorflow.py
+++ b/tools/python/convert_from_tensorflow.py
@@ -72,7 +72,7 @@ class TFConverter:
self.conv2d_scopename_inputname_dict = {}
self.op2code = {'Conv2D':1, 'DepthToSpace':2, 'MirrorPad':3,
'Maximum':4, 'MathBinary':5, 'MathUnary':6}
self.mathbin2code = {'Sub':0, 'Add':1, 'Mul':2, 'RealDiv':3,
'Minimum':4}
-self.mathun2code = {'Abs':0, 'Sin':1, 'Cos':2, 'Tan':3, 'Asin':4,
'Acos':5, 'Atan':6, 'Sinh':7, 'Cosh':8, 'Tanh':9, 'Asinh':10, 'Acosh':11}
+self.mathun2code = {'Abs':0, 'Sin':1, 'Cos':2, 'Tan':3, 'Asin':4,
'Acos':5, 'Atan':6, 'Sinh':7, 'Cosh':8, 'Tanh':9, 'Asinh':10, 'Acosh':11,
'Atanh':12}
self.mirrorpad_mode = {'CONSTANT':0, 'REFLECT':1, 'SYMMETRIC':2}
self.name_operand_dict = {}
diff --git a/tools/python/convert_header.py b/tools/python/convert_header.py
index 8fc3438552..9851d84144 100644
--- a/tools/python/convert_header.py
+++ b/tools/python/convert_header.py
@@ -23,4 +23,4 @@ str = 'FFMPEGDNNNATIVE'
major = 1
# increase minor when we don't have to re-convert the model file
-minor = 17
+minor = 18
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] dnn_backend_native_layer_mathunary: add acosh support
ffmpeg | branch: master | Ting Fu | Mon Jun 29 22:54:08
2020 +0800| [cd2e3a864d167be32e119ac44fd65a322121bf3b] | committer: Guo, Yejun
dnn_backend_native_layer_mathunary: add acosh support
Signed-off-by: Ting Fu
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cd2e3a864d167be32e119ac44fd65a322121bf3b
---
libavfilter/dnn/dnn_backend_native_layer_mathunary.c | 4
libavfilter/dnn/dnn_backend_native_layer_mathunary.h | 1 +
tools/python/convert_from_tensorflow.py | 2 +-
tools/python/convert_header.py | 2 +-
4 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
b/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
index 83df98d0f8..b77b84a794 100644
--- a/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
+++ b/libavfilter/dnn/dnn_backend_native_layer_mathunary.c
@@ -120,6 +120,10 @@ int dnn_execute_layer_math_unary(DnnOperand *operands,
const int32_t *input_oper
for (int i = 0; i < dims_count; ++i)
dst[i] = asinh(src[i]);
return 0;
+case DMUO_ACOSH:
+for (int i = 0; i < dims_count; ++i)
+dst[i] = acosh(src[i]);
+return 0;
default:
return -1;
}
diff --git a/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
b/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
index fbe9af5c7d..eb30231549 100644
--- a/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
+++ b/libavfilter/dnn/dnn_backend_native_layer_mathunary.h
@@ -41,6 +41,7 @@ typedef enum {
DMUO_COSH = 8,
DMUO_TANH = 9,
DMUO_ASINH = 10,
+DMUO_ACOSH = 11,
DMUO_COUNT
} DNNMathUnaryOperation;
diff --git a/tools/python/convert_from_tensorflow.py
b/tools/python/convert_from_tensorflow.py
index 0d756c8109..1e73e3aefe 100644
--- a/tools/python/convert_from_tensorflow.py
+++ b/tools/python/convert_from_tensorflow.py
@@ -72,7 +72,7 @@ class TFConverter:
self.conv2d_scopename_inputname_dict = {}
self.op2code = {'Conv2D':1, 'DepthToSpace':2, 'MirrorPad':3,
'Maximum':4, 'MathBinary':5, 'MathUnary':6}
self.mathbin2code = {'Sub':0, 'Add':1, 'Mul':2, 'RealDiv':3,
'Minimum':4}
-self.mathun2code = {'Abs':0, 'Sin':1, 'Cos':2, 'Tan':3, 'Asin':4,
'Acos':5, 'Atan':6, 'Sinh':7, 'Cosh':8, 'Tanh':9, 'Asinh':10}
+self.mathun2code = {'Abs':0, 'Sin':1, 'Cos':2, 'Tan':3, 'Asin':4,
'Acos':5, 'Atan':6, 'Sinh':7, 'Cosh':8, 'Tanh':9, 'Asinh':10, 'Acosh':11}
self.mirrorpad_mode = {'CONSTANT':0, 'REFLECT':1, 'SYMMETRIC':2}
self.name_operand_dict = {}
diff --git a/tools/python/convert_header.py b/tools/python/convert_header.py
index 3211c13f6d..8fc3438552 100644
--- a/tools/python/convert_header.py
+++ b/tools/python/convert_header.py
@@ -23,4 +23,4 @@ str = 'FFMPEGDNNNATIVE'
major = 1
# increase minor when we don't have to re-convert the model file
-minor = 16
+minor = 17
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
