[FFmpeg-cvslog] avformat/rtspdec: add network init to listen mode

2020-11-21 Thread Andriy Gelman 
ffmpeg | branch: master | Andriy Gelman  | Mon Oct 12 
16:36:04 2020 -0400| [423d06e0e22d3c1c62124420532206542488b10f] | committer: 
Andriy Gelman

avformat/rtspdec: add network init to listen mode

As per the docs network initialization is required before ff_url_join().
Furthermore, because the ff_network_init() was skipped, this makes
one additional call to ff_network_close() if the stream exits without
errors.

The was forgotten in the origin commit of the listen mode:
a8ad6ffafe89e3a83f343f69249338e8245816f7

Reviewed-by: Martin Storsjö 
Signed-off-by: Andriy Gelman 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=423d06e0e22d3c1c62124420532206542488b10f
---

 libavformat/rtspdec.c | 15 +++
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/libavformat/rtspdec.c b/libavformat/rtspdec.c
index a4cd1f68ff..e0e8fc2e49 100644
--- a/libavformat/rtspdec.c
+++ b/libavformat/rtspdec.c
@@ -640,6 +640,9 @@ static int rtsp_listen(AVFormatContext *s)
 int ret;
 enum RTSPMethod methodcode;
 
+if (!ff_network_init())
+return AVERROR(EIO);
+
 /* extract hostname and port */
 av_url_split(proto, sizeof(proto), auth, sizeof(auth), host, sizeof(host),
  &port, path, sizeof(path), s->url);
@@ -664,19 +667,19 @@ static int rtsp_listen(AVFormatContext *s)
&s->interrupt_callback, NULL,
s->protocol_whitelist, 
s->protocol_blacklist, NULL)) {
 av_log(s, AV_LOG_ERROR, "Unable to open RTSP for listening\n");
-return ret;
+goto fail;
 }
 rt->state   = RTSP_STATE_IDLE;
 rt->rtsp_hd_out = rt->rtsp_hd;
 for (;;) { /* Wait for incoming RTSP messages */
 ret = read_line(s, rbuf, sizeof(rbuf), &rbuflen);
 if (ret < 0)
-return ret;
+goto fail;
 ret = parse_command_line(s, rbuf, rbuflen, uri, sizeof(uri), method,
  sizeof(method), &methodcode);
 if (ret) {
 av_log(s, AV_LOG_ERROR, "RTSP: Unexpected Command\n");
-return ret;
+goto fail;
 }
 
 if (methodcode == ANNOUNCE) {
@@ -692,9 +695,13 @@ static int rtsp_listen(AVFormatContext *s)
 ret = rtsp_read_setup(s, host, uri);
 if (ret) {
 ffurl_close(rt->rtsp_hd);
-return AVERROR_INVALIDDATA;
+ret = AVERROR_INVALIDDATA;
+goto fail;
 }
 }
+fail:
+ff_network_close();
+return ret;
 }
 
 static int rtsp_probe(const AVProbeData *p)

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/rtspdec: fix mem leaks in connect mode if init fails

2020-11-21 Thread Andriy Gelman 
ffmpeg | branch: master | Andriy Gelman  | Mon Oct 12 
16:36:06 2020 -0400| [122fcf1f407b60baf7a0322b73798958ca6108eb] | committer: 
Andriy Gelman

avformat/rtspdec: fix mem leaks in connect mode if init fails

Fixes #6334

Reviewed-by: Martin Storsjö 
Signed-off-by: Andriy Gelman 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=122fcf1f407b60baf7a0322b73798958ca6108eb
---

 libavformat/rtspdec.c | 14 +-
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/libavformat/rtspdec.c b/libavformat/rtspdec.c
index dfc84e71ba..8a2abc8ee9 100644
--- a/libavformat/rtspdec.c
+++ b/libavformat/rtspdec.c
@@ -735,22 +735,26 @@ static int rtsp_read_header(AVFormatContext *s)
 
 rt->real_setup_cache = !s->nb_streams ? NULL :
 av_mallocz_array(s->nb_streams, 2 * sizeof(*rt->real_setup_cache));
-if (!rt->real_setup_cache && s->nb_streams)
-return AVERROR(ENOMEM);
+if (!rt->real_setup_cache && s->nb_streams) {
+ret = AVERROR(ENOMEM);
+goto fail;
+}
 rt->real_setup = rt->real_setup_cache + s->nb_streams;
 
 if (rt->initial_pause) {
 /* do not start immediately */
 } else {
 if ((ret = rtsp_read_play(s)) < 0) {
-ff_rtsp_close_streams(s);
-ff_rtsp_close_connections(s);
-return ret;
+goto fail;
 }
 }
 }
 
 return 0;
+
+fail:
+rtsp_read_close(s);
+return ret;
 }
 
 int ff_rtsp_tcp_read_packet(AVFormatContext *s, RTSPStream **prtsp_st,

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/rtspdec: fix mem leaks in listen mode if init fails

2020-11-21 Thread Andriy Gelman 
ffmpeg | branch: master | Andriy Gelman  | Mon Oct 12 
16:36:05 2020 -0400| [38bc4ba142b2304b2a0e2d86f271a28d51250fb9] | committer: 
Andriy Gelman

avformat/rtspdec: fix mem leaks in listen mode if init fails

Reviewed-by: Martin Storsjö 
Signed-off-by: Andriy Gelman 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=38bc4ba142b2304b2a0e2d86f271a28d51250fb9
---

 libavformat/rtspdec.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavformat/rtspdec.c b/libavformat/rtspdec.c
index e0e8fc2e49..dfc84e71ba 100644
--- a/libavformat/rtspdec.c
+++ b/libavformat/rtspdec.c
@@ -694,12 +694,13 @@ static int rtsp_listen(AVFormatContext *s)
 } else if (methodcode == SETUP)
 ret = rtsp_read_setup(s, host, uri);
 if (ret) {
-ffurl_close(rt->rtsp_hd);
 ret = AVERROR_INVALIDDATA;
 goto fail;
 }
 }
 fail:
+ff_rtsp_close_streams(s);
+ff_rtsp_close_connections(s);
 ff_network_close();
 return ret;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/rtspdec: cosmetics

2020-11-21 Thread Andriy Gelman 
ffmpeg | branch: master | Andriy Gelman  | Mon Oct 12 
16:36:07 2020 -0400| [9a70b6f5b84cf98cb7012ca3b5adc5f28f0f50bf] | committer: 
Andriy Gelman

avformat/rtspdec: cosmetics

Make error check style consistent with rest of function.

Signed-off-by: Andriy Gelman 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9a70b6f5b84cf98cb7012ca3b5adc5f28f0f50bf
---

 libavformat/rtspdec.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavformat/rtspdec.c b/libavformat/rtspdec.c
index 8a2abc8ee9..28b35d1993 100644
--- a/libavformat/rtspdec.c
+++ b/libavformat/rtspdec.c
@@ -744,9 +744,9 @@ static int rtsp_read_header(AVFormatContext *s)
 if (rt->initial_pause) {
 /* do not start immediately */
 } else {
-if ((ret = rtsp_read_play(s)) < 0) {
+ret = rtsp_read_play(s);
+if (ret < 0)
 goto fail;
-}
 }
 }
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/rtsp: set return variable in error path

2020-11-21 Thread Andriy Gelman 
ffmpeg | branch: master | Andriy Gelman  | Mon Oct 12 
16:36:08 2020 -0400| [78537aa52f03f9fcf1f278c8bb8cc30ee1a64d38] | committer: 
Andriy Gelman

avformat/rtsp: set return variable in error path

In this error path ret still stores the number of bytes read in
ffurl_read().

Reviewed-by: Martin Storsjö 
Signed-off-by: Andriy Gelman 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=78537aa52f03f9fcf1f278c8bb8cc30ee1a64d38
---

 libavformat/rtsp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libavformat/rtsp.c b/libavformat/rtsp.c
index d9832bbf1f..b0631c7abf 100644
--- a/libavformat/rtsp.c
+++ b/libavformat/rtsp.c
@@ -2493,6 +2493,7 @@ static int rtp_read_header(AVFormatContext *s)
 av_log(s, AV_LOG_ERROR, "Unable to receive RTP payload type %d "
 "without an SDP file describing it\n",
  payload_type);
+ret = AVERROR_INVALIDDATA;
 goto fail;
 }
 if (par->codec_type != AVMEDIA_TYPE_DATA) {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/rtsp: don't forget to call ff_network_close() on error

2020-11-21 Thread Andriy Gelman 
ffmpeg | branch: master | Andriy Gelman  | Mon Oct 12 
16:36:09 2020 -0400| [4fe9e2fc162a9d3258eb39dd16677970c657c122] | committer: 
Andriy Gelman

avformat/rtsp: don't forget to call ff_network_close() on error

In sdp_read_header() some ff_network_close() calls were missed.

Also in rtp_read_header() update comment to explain why a single
call to ff_network_close() is enough to cover all cases even if
sdp_read_header() returns an error.

Reviewed-by: Martin Storsjö 
Signed-off-by: Andriy Gelman 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4fe9e2fc162a9d3258eb39dd16677970c657c122
---

 libavformat/rtsp.c | 9 +++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/libavformat/rtsp.c b/libavformat/rtsp.c
index b0631c7abf..0be405aba1 100644
--- a/libavformat/rtsp.c
+++ b/libavformat/rtsp.c
@@ -2337,11 +2337,14 @@ static int sdp_read_header(AVFormatContext *s)
 /* read the whole sdp file */
 /* XXX: better loading */
 content = av_malloc(SDP_MAX_SIZE);
-if (!content)
+if (!content) {
+ff_network_close();
 return AVERROR(ENOMEM);
+}
 size = avio_read(s->pb, content, SDP_MAX_SIZE - 1);
 if (size <= 0) {
 av_free(content);
+ff_network_close();
 return AVERROR_INVALIDDATA;
 }
 content[size] ='\0';
@@ -2540,7 +2543,9 @@ static int rtp_read_header(AVFormatContext *s)
 ffio_init_context(&pb, sdp.str, sdp.len, 0, NULL, NULL, NULL, NULL);
 s->pb = &pb;
 
-/* sdp_read_header initializes this again */
+/* if sdp_read_header() fails then following ff_network_close() cancels 
out */
+/* ff_network_init() at the start of this function. Otherwise it cancels 
out */
+/* ff_network_init() inside sdp_read_header() */
 ff_network_close();
 
 rt->media_type_mask = (1 << (AVMEDIA_TYPE_SUBTITLE+1)) - 1;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/cuviddec: fix missing context push/pop

2020-11-21 Thread leozhang 
ffmpeg | branch: master | leozhang  | Fri Nov 20 11:23:43 
2020 +0800| [7ce7d33d1537bebe3e11b4046466d6c694f2e9c7] | committer: Timo 
Rothenpieler

avcodec/cuviddec: fix missing context push/pop

Test command like below:
cuda-memcheck ./ffmpeg -hwaccel cuvid -c:v h264_cuvid -i input_file -c:v 
h264_nvenc -f null -

Signed-off-by: leozhang 
Signed-off-by: Timo Rothenpieler 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7ce7d33d1537bebe3e11b4046466d6c694f2e9c7
---

 libavcodec/cuviddec.c | 7 +++
 1 file changed, 7 insertions(+)

diff --git a/libavcodec/cuviddec.c b/libavcodec/cuviddec.c
index 5e698d4cd0..61d7f36c79 100644
--- a/libavcodec/cuviddec.c
+++ b/libavcodec/cuviddec.c
@@ -673,15 +673,22 @@ static int cuvid_decode_frame(AVCodecContext *avctx, void 
*data, int *got_frame,
 static av_cold int cuvid_decode_end(AVCodecContext *avctx)
 {
 CuvidContext *ctx = avctx->priv_data;
+AVHWDeviceContext *device_ctx = (AVHWDeviceContext *)ctx->hwdevice->data;
+AVCUDADeviceContext *device_hwctx = device_ctx->hwctx;
+CUcontext dummy, cuda_ctx = device_hwctx->cuda_ctx;
 
 av_fifo_freep(&ctx->frame_queue);
 
+ctx->cudl->cuCtxPushCurrent(cuda_ctx);
+
 if (ctx->cuparser)
 ctx->cvdl->cuvidDestroyVideoParser(ctx->cuparser);
 
 if (ctx->cudecoder)
 ctx->cvdl->cuvidDestroyDecoder(ctx->cudecoder);
 
+ctx->cudl->cuCtxPopCurrent(&dummy);
+
 ctx->cudl = NULL;
 
 av_buffer_unref(&ctx->hwframe);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/rmdec: Check for EOF in index packet reading

2020-11-21 Thread Michael Niedermayer 
ffmpeg | branch: master | Michael Niedermayer  | Fri 
Nov 13 23:30:47 2020 +0100| [ebf4bc629e6d0dbb4bb6725849bdd06456e4c8af] | 
committer: Michael Niedermayer

avformat/rmdec: Check for EOF in index packet reading

Fixes: Timeout(>10sec -> 1ms)
Fixes: 
27284/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-630420985728

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ebf4bc629e6d0dbb4bb6725849bdd06456e4c8af
---

 libavformat/rmdec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index 0c3ac4e47f..004c62086d 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -458,6 +458,8 @@ static int rm_read_index(AVFormatContext *s)
 }
 
 for (n = 0; n < n_pkts; n++) {
+if (avio_feof(pb))
+return AVERROR_INVALIDDATA;
 avio_skip(pb, 2);
 pts = avio_rb32(pb);
 pos = avio_rb32(pb);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/iff: Check size before skip

2020-11-21 Thread Michael Niedermayer 
ffmpeg | branch: master | Michael Niedermayer  | Sat 
Nov 14 20:59:01 2020 +0100| [8b50e8bc2975fad85e0713e05940ee9ecb5e8a18] | 
committer: Michael Niedermayer

avformat/iff: Check size before skip

Fixes: Infinite loop
Fixes: 
27292/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5731168991051776

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8b50e8bc2975fad85e0713e05940ee9ecb5e8a18
---

 libavformat/iff.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/iff.c b/libavformat/iff.c
index a70184f105..f017684620 100644
--- a/libavformat/iff.c
+++ b/libavformat/iff.c
@@ -259,6 +259,9 @@ static int parse_dsd_prop(AVFormatContext *s, AVStream *st, 
uint64_t eof)
 uint64_t size = avio_rb64(pb);
 uint64_t orig_pos = avio_tell(pb);
 
+if (size >= INT64_MAX)
+return AVERROR_INVALIDDATA;
+
 switch(tag) {
 case MKTAG('A','B','S','S'):
 if (size < 8)

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/mv30: Use unsigned in idct_1d()

2020-11-21 Thread Michael Niedermayer 
ffmpeg | branch: master | Michael Niedermayer  | Sat 
Nov 14 21:10:18 2020 +0100| [2eb641741766e98401f2a9d9a91c7afbdcb67d4b] | 
committer: Michael Niedermayer

avcodec/mv30: Use unsigned in idct_1d()

Fixes: signed integer overflow: 2110302399 + 39074947 cannot be represented in 
type 'int'
Fixes: 
27330/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MV30_fuzzer-5664923153334272

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2eb641741766e98401f2a9d9a91c7afbdcb67d4b
---

 libavcodec/mv30.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/mv30.c b/libavcodec/mv30.c
index 9f28199478..59088d84f8 100644
--- a/libavcodec/mv30.c
+++ b/libavcodec/mv30.c
@@ -102,7 +102,7 @@ static void get_qtable(int16_t *table, int quant, const 
uint8_t *quant_tab)
 }
 }
 
-static inline void idct_1d(int *blk, int step)
+static inline void idct_1d(unsigned *blk, int step)
 {
 const unsigned t0 = blk[0 * step] + blk[4 * step];
 const unsigned t1 = blk[0 * step] - blk[4 * step];

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/wavdec: More complete size check in find_guid()

2020-11-21 Thread Michael Niedermayer 
ffmpeg | branch: master | Michael Niedermayer  | Sat 
Nov 14 22:13:52 2020 +0100| [a207df2acb92d6366ab2f0f18ba35709066b8eec] | 
committer: Michael Niedermayer

avformat/wavdec: More complete size check in find_guid()

Fixes: signed integer overflow: 9223372036854775807 + 8 cannot be represented 
in type 'long'
Fixes: 
27341/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5442833206738944

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a207df2acb92d6366ab2f0f18ba35709066b8eec
---

 libavformat/wavdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c
index a81f2c7a67..df6030a42d 100644
--- a/libavformat/wavdec.c
+++ b/libavformat/wavdec.c
@@ -666,7 +666,7 @@ static int64_t find_guid(AVIOContext *pb, const uint8_t 
guid1[16])
 while (!avio_feof(pb)) {
 avio_read(pb, guid, 16);
 size = avio_rl64(pb);
-if (size <= 24)
+if (size <= 24 || size > INT64_MAX - 8)
 return AVERROR_INVALIDDATA;
 if (!memcmp(guid, guid1, 16))
 return size;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/mobiclip: Check mv against INT_MAX

2020-11-21 Thread Michael Niedermayer 
ffmpeg | branch: master | Michael Niedermayer  | Sat 
Nov 14 22:27:00 2020 +0100| [a108a4d809f8345303e1aa7578d608a726c53686] | 
committer: Michael Niedermayer

avcodec/mobiclip: Check mv against INT_MAX

Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 
'int'
Fixes: 
27369/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-5083469356728320

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a108a4d809f8345303e1aa7578d608a726c53686
---

 libavcodec/mobiclip.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/mobiclip.c b/libavcodec/mobiclip.c
index 42d33cf6a5..3c2df80896 100644
--- a/libavcodec/mobiclip.c
+++ b/libavcodec/mobiclip.c
@@ -1146,6 +1146,8 @@ static int predict_motion(AVCodecContext *avctx,
 mv.x = mv.x + get_se_golomb(gb);
 mv.y = mv.y + get_se_golomb(gb);
 }
+if (mv.x >= INT_MAX || mv.y >= INT_MAX)
+return AVERROR_INVALIDDATA;
 
 motion[offsetm].x = mv.x;
 motion[offsetm].y = mv.y;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/atrac3: increase max block align size

2020-11-21 Thread Paul B Mahol 
ffmpeg | branch: master | Paul B Mahol  | Sat Nov 21 22:09:17 
2020 +0100| [d29a9b8891d30d22a27c8e0ac84f0339797cb1f9] | committer: Paul B Mahol

avcodec/atrac3: increase max block align size

Fixes decoding of lossy part of advanced lossless atrac3.
Regression since f09151fff9c754fbc1d2560adf18b14957f8b181

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d29a9b8891d30d22a27c8e0ac84f0339797cb1f9
---

 libavcodec/atrac3.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/atrac3.c b/libavcodec/atrac3.c
index 1e884a56b6..46b98d2f78 100644
--- a/libavcodec/atrac3.c
+++ b/libavcodec/atrac3.c
@@ -968,7 +968,7 @@ static av_cold int atrac3_decode_init(AVCodecContext *avctx)
 return AVERROR_INVALIDDATA;
 }
 
-if (avctx->block_align > 1024 || avctx->block_align <= 0)
+if (avctx->block_align > 4096 || avctx->block_align <= 0)
 return AVERROR(EINVAL);
 
 q->decoded_bytes_buffer = av_mallocz(FFALIGN(avctx->block_align, 4) +

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".