[FFmpeg-cvslog] fftools/ffprobe: Avoid overflow when calculating DAR

2024-05-05 Thread Derek Buitenhuis
ffmpeg | branch: master | Derek Buitenhuis  | Fri 
May  3 17:33:58 2024 +0100| [f8a613d6a86f1f2875cbebc8f1f60cfe39256fd1] | 
committer: Derek Buitenhuis

fftools/ffprobe: Avoid overflow when calculating DAR

Both the codecpar's width and height, and the SAR num and den are
ints, which can overflow. Cast to int64_t, which is what av_reduce
takes.

Without this, occasionally, display_aspect_ratio can be negative in
ffprobe's -show_stream output.

Signed-off-by: Derek Buitenhuis 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f8a613d6a86f1f2875cbebc8f1f60cfe39256fd1
---

 fftools/ffprobe.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fftools/ffprobe.c b/fftools/ffprobe.c
index 0d4cd0b048..5b40dad527 100644
--- a/fftools/ffprobe.c
+++ b/fftools/ffprobe.c
@@ -3324,8 +3324,8 @@ static int show_stream(WriterContext *w, AVFormatContext 
*fmt_ctx, int stream_id
 if (sar.num) {
 print_q("sample_aspect_ratio", sar, ':');
 av_reduce(&dar.num, &dar.den,
-  par->width  * sar.num,
-  par->height * sar.den,
+  (int64_t) par->width  * sar.num,
+  (int64_t) par->height * sar.den,
   1024*1024);
 print_q("display_aspect_ratio", dar, ':');
 } else {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".


[FFmpeg-cvslog] avfilter/vf_scale: don't expose framesync options in vf_scale2ref

2024-05-05 Thread James Almer
ffmpeg | branch: master | James Almer  | Sun May  5 10:59:25 
2024 -0300| [eb392e41004c825551693d84db24666853950e4b] | committer: James Almer

avfilter/vf_scale: don't expose framesync options in vf_scale2ref

It doesn't use them.

Signed-off-by: James Almer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=eb392e41004c825551693d84db24666853950e4b
---

 libavfilter/vf_scale.c | 29 +++--
 1 file changed, 27 insertions(+), 2 deletions(-)

diff --git a/libavfilter/vf_scale.c b/libavfilter/vf_scale.c
index 60d301dcd8..07e9025335 100644
--- a/libavfilter/vf_scale.c
+++ b/libavfilter/vf_scale.c
@@ -1228,7 +1228,7 @@ static const AVOption scale_options[] = {
 };
 
 static const AVClass scale_class = {
-.class_name   = "scale(2ref)",
+.class_name   = "scale",
 .item_name= av_default_item_name,
 .option   = scale_options,
 .version  = LIBAVUTIL_VERSION_INT,
@@ -1268,6 +1268,31 @@ const AVFilter ff_vf_scale = {
 .flags   = AVFILTER_FLAG_DYNAMIC_INPUTS,
 };
 
+static const AVClass *scale2ref_child_class_iterate(void **iter)
+{
+const AVClass *c = *iter ? NULL : sws_get_class();
+*iter = (void*)(uintptr_t)c;
+return c;
+}
+
+static void *scale2ref_child_next(void *obj, void *prev)
+{
+ScaleContext *s = obj;
+if (!prev)
+return s->sws_opts;
+return NULL;
+}
+
+static const AVClass scale2ref_class = {
+.class_name   = "scale(2ref)",
+.item_name= av_default_item_name,
+.option   = scale_options,
+.version  = LIBAVUTIL_VERSION_INT,
+.category = AV_CLASS_CATEGORY_FILTER,
+.child_class_iterate = scale2ref_child_class_iterate,
+.child_next  = scale2ref_child_next,
+};
+
 static const AVFilterPad avfilter_vf_scale2ref_inputs[] = {
 {
 .name = "default",
@@ -1303,7 +1328,7 @@ const AVFilter ff_vf_scale2ref = {
 .init= init,
 .uninit  = uninit,
 .priv_size   = sizeof(ScaleContext),
-.priv_class  = &scale_class,
+.priv_class  = &scale2ref_class,
 FILTER_INPUTS(avfilter_vf_scale2ref_inputs),
 FILTER_OUTPUTS(avfilter_vf_scale2ref_outputs),
 FILTER_QUERY_FUNC(query_formats),

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".


[FFmpeg-cvslog] avfilter/framesync: reset nb_in on allocation failure

2024-05-05 Thread James Almer
ffmpeg | branch: master | James Almer  | Sun May  5 11:38:28 
2024 -0300| [ccf395e8bde3e5d6b96be3e0ba25e2d162d4117e] | committer: James Almer

avfilter/framesync: reset nb_in on allocation failure

Signed-off-by: James Almer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ccf395e8bde3e5d6b96be3e0ba25e2d162d4117e
---

 libavfilter/framesync.c | 5 -
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libavfilter/framesync.c b/libavfilter/framesync.c
index a691136f34..535fbe9c7c 100644
--- a/libavfilter/framesync.c
+++ b/libavfilter/framesync.c
@@ -95,8 +95,11 @@ int ff_framesync_init(FFFrameSync *fs, AVFilterContext 
*parent, unsigned nb_in)
 fs->nb_in  = nb_in;
 
 fs->in = av_calloc(nb_in, sizeof(*fs->in));
-if (!fs->in)
+if (!fs->in) {
+fs->nb_in = 0;
 return AVERROR(ENOMEM);
+}
+
 return 0;
 }
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".


[FFmpeg-cvslog] avformat/iamf_reader: split "if ((ret = ...) < 0)" line

2024-05-05 Thread James Almer
ffmpeg | branch: master | James Almer  | Sun May  5 13:56:52 
2024 -0300| [2e16285fe833e41890db33eb39b4a69f4370a5cf] | committer: James Almer

avformat/iamf_reader: split "if ((ret = ...) < 0)" line

Cosmetic change.

Signed-off-by: James Almer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2e16285fe833e41890db33eb39b4a69f4370a5cf
---

 libavformat/iamf_reader.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavformat/iamf_reader.c b/libavformat/iamf_reader.c
index 014e8e3ecc..cdb412f637 100644
--- a/libavformat/iamf_reader.c
+++ b/libavformat/iamf_reader.c
@@ -276,7 +276,8 @@ int ff_iamf_read_packet(AVFormatContext *s, 
IAMFDemuxContext *c,
 unsigned skip_samples, discard_padding;
 int ret, len, size, start_pos;
 
-if ((ret = ffio_ensure_seekback(pb, FFMIN(MAX_IAMF_OBU_HEADER_SIZE, 
max_size))) < 0)
+ret = ffio_ensure_seekback(pb, FFMIN(MAX_IAMF_OBU_HEADER_SIZE, 
max_size));
+if (ret < 0)
 return ret;
 size = avio_read(pb, header, FFMIN(MAX_IAMF_OBU_HEADER_SIZE, 
max_size));
 if (size < 0)

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".


[FFmpeg-cvslog] avfilter/vf_scale: properly reinitialize framesync

2024-05-05 Thread James Almer
ffmpeg | branch: master | James Almer  | Sun May  5 11:39:49 
2024 -0300| [82397084a9328d3f67caa9ce519304b714a132ea] | committer: James Almer

avfilter/vf_scale: properly reinitialize framesync

Fixes leaks as reported by ASAN and Valgrind.

Signed-off-by: James Almer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=82397084a9328d3f67caa9ce519304b714a132ea
---

 libavfilter/vf_scale.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libavfilter/vf_scale.c b/libavfilter/vf_scale.c
index 07e9025335..841075193e 100644
--- a/libavfilter/vf_scale.c
+++ b/libavfilter/vf_scale.c
@@ -766,6 +766,7 @@ static int config_props(AVFilterLink *outlink)
 av_freep(&flags_val);
 
 if (ctx->filter != &ff_vf_scale2ref) {
+ff_framesync_uninit(&scale->fs);
 ret = ff_framesync_init(&scale->fs, ctx, ctx->nb_inputs);
 if (ret < 0)
 return ret;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".


[FFmpeg-cvslog] avformat/mov: don't use stream duration to calculate bitrate with fragmented input

2024-05-05 Thread James Almer
ffmpeg | branch: master | James Almer  | Tue Apr 30 23:08:46 
2024 -0300| [0ec8f3c55a7786d88935205db8244a4c4419fe7f] | committer: James Almer

avformat/mov: don't use stream duration to calculate bitrate with fragmented 
input

sc->data_size may contain the size of a single fragment after probing, and
using it alongside the duration of the entire stream to calculate bitrate
will result in a bogus small value.

Before:
  Duration: 00:00:05.00, start: 0.00, bitrate: 586 kb/s
  Stream #0:0[0x1](und): Video: h264 (High) (avc1 / 0x31637661), 
yuv420p(progressive), 640x360 [SAR 1:1 DAR 16:9], 112 kb/s, 60 fps, 60 tbr, 
15360 tbn (default)

After:
  Duration: 00:00:05.00, start: 0.00, bitrate: 586 kb/s
  Stream #0:0[0x1](und): Video: h264 (High) (avc1 / 0x31637661), 
yuv420p(progressive), 640x360 [SAR 1:1 DAR 16:9], 561 kb/s, 60 fps, 60 tbr, 
15360 tbn (default)

Signed-off-by: James Almer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0ec8f3c55a7786d88935205db8244a4c4419fe7f
---

 libavformat/mov.c | 20 +---
 1 file changed, 1 insertion(+), 19 deletions(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index e8da6c2d65..b3fa748f27 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -9667,25 +9667,7 @@ static int mov_read_header(AVFormatContext *s)
 }
 }
 
-if (mov->trex_data) {
-for (i = 0; i < s->nb_streams; i++) {
-AVStream *st = s->streams[i];
-MOVStreamContext *sc = st->priv_data;
-if (st->duration > 0) {
-/* Akin to sc->data_size * 8 * sc->time_scale / st->duration 
but accounting for overflows. */
-st->codecpar->bit_rate = av_rescale(sc->data_size, ((int64_t) 
sc->time_scale) * 8, st->duration);
-if (st->codecpar->bit_rate == INT64_MIN) {
-av_log(s, AV_LOG_WARNING, "Overflow during bit rate 
calculation %"PRId64" * 8 * %d\n",
-   sc->data_size, sc->time_scale);
-st->codecpar->bit_rate = 0;
-if (s->error_recognition & AV_EF_EXPLODE)
-return AVERROR_INVALIDDATA;
-}
-}
-}
-}
-
-if (mov->use_mfra_for > 0) {
+if (mov->trex_data || mov->use_mfra_for > 0) {
 for (i = 0; i < s->nb_streams; i++) {
 AVStream *st = s->streams[i];
 MOVStreamContext *sc = st->priv_data;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".


[FFmpeg-cvslog] swscale/output: Fix integer overflow in yuv2rgba64_1_c_template

2024-05-05 Thread Michael Niedermayer
ffmpeg | branch: master | Michael Niedermayer  | Fri 
Apr 26 05:08:35 2024 +0200| [a56559e688ffde40fcda5588123ffcb978da86d7] | 
committer: Michael Niedermayer

swscale/output: Fix integer overflow in yuv2rgba64_1_c_template

Fixes: signed integer overflow: -831176 * 9539 cannot be represented in type 
'int'
Fixes: 67869/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5117342091640832

The input is 9bit in 16bit, the fuzzer fills all 16bit thus generating 
"invalid" input
No overflow should happen with valid input.

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a56559e688ffde40fcda5588123ffcb978da86d7
---

 libswscale/output.c | 44 ++--
 1 file changed, 22 insertions(+), 22 deletions(-)

diff --git a/libswscale/output.c b/libswscale/output.c
index 8849a3201a..0b6c77e167 100644
--- a/libswscale/output.c
+++ b/libswscale/output.c
@@ -1207,8 +1207,8 @@ yuv2rgba64_1_c_template(SwsContext *c, const int32_t 
*buf0,
 
 if (uvalpha < 2048) {
 for (i = 0; i < ((dstW + 1) >> 1); i++) {
-int Y1 = (buf0[i * 2]) >> 2;
-int Y2 = (buf0[i * 2 + 1]) >> 2;
+SUINT Y1 = (buf0[i * 2]) >> 2;
+SUINT Y2 = (buf0[i * 2 + 1]) >> 2;
 int U  = (ubuf0[i] - (128 << 11)) >> 2;
 int V  = (vbuf0[i] - (128 << 11)) >> 2;
 int R, G, B;
@@ -1232,20 +1232,20 @@ yuv2rgba64_1_c_template(SwsContext *c, const int32_t 
*buf0,
 G = V * c->yuv2rgb_v2g_coeff + U * c->yuv2rgb_u2g_coeff;
 B =U * c->yuv2rgb_u2b_coeff;
 
-output_pixel(&dest[0], av_clip_uintp2(((R_B + Y1) >> 14) + 
(1<<15), 16));
-output_pixel(&dest[1], av_clip_uintp2(((  G + Y1) >> 14) + 
(1<<15), 16));
-output_pixel(&dest[2], av_clip_uintp2(((B_R + Y1) >> 14) + 
(1<<15), 16));
+output_pixel(&dest[0], av_clip_uintp2(((int)(R_B + Y1) >> 14) + 
(1<<15), 16));
+output_pixel(&dest[1], av_clip_uintp2(((int)(  G + Y1) >> 14) + 
(1<<15), 16));
+output_pixel(&dest[2], av_clip_uintp2(((int)(B_R + Y1) >> 14) + 
(1<<15), 16));
 if (eightbytes) {
 output_pixel(&dest[3], av_clip_uintp2(A1  , 30) >> 14);
-output_pixel(&dest[4], av_clip_uintp2(((R_B + Y2) >> 14) + 
(1<<15), 16));
-output_pixel(&dest[5], av_clip_uintp2(((  G + Y2) >> 14) + 
(1<<15), 16));
-output_pixel(&dest[6], av_clip_uintp2(((B_R + Y2) >> 14) + 
(1<<15), 16));
+output_pixel(&dest[4], av_clip_uintp2(((int)(R_B + Y2) >> 14) 
+ (1<<15), 16));
+output_pixel(&dest[5], av_clip_uintp2(((int)(  G + Y2) >> 14) 
+ (1<<15), 16));
+output_pixel(&dest[6], av_clip_uintp2(((int)(B_R + Y2) >> 14) 
+ (1<<15), 16));
 output_pixel(&dest[7], av_clip_uintp2(A2  , 30) >> 14);
 dest += 8;
 } else {
-output_pixel(&dest[3], av_clip_uintp2(((R_B + Y2) >> 14) + 
(1<<15), 16));
-output_pixel(&dest[4], av_clip_uintp2(((  G + Y2) >> 14) + 
(1<<15), 16));
-output_pixel(&dest[5], av_clip_uintp2(((B_R + Y2) >> 14) + 
(1<<15), 16));
+output_pixel(&dest[3], av_clip_uintp2(((int)(R_B + Y2) >> 14) 
+ (1<<15), 16));
+output_pixel(&dest[4], av_clip_uintp2(((int)(  G + Y2) >> 14) 
+ (1<<15), 16));
+output_pixel(&dest[5], av_clip_uintp2(((int)(B_R + Y2) >> 14) 
+ (1<<15), 16));
 dest += 6;
 }
 }
@@ -1253,8 +1253,8 @@ yuv2rgba64_1_c_template(SwsContext *c, const int32_t 
*buf0,
 const int32_t *ubuf1 = ubuf[1], *vbuf1 = vbuf[1];
 int A1 = 0x<<14, A2 = 0x<<14;
 for (i = 0; i < ((dstW + 1) >> 1); i++) {
-int Y1 = (buf0[i * 2]) >> 2;
-int Y2 = (buf0[i * 2 + 1]) >> 2;
+SUINT Y1 = (buf0[i * 2]) >> 2;
+SUINT Y2 = (buf0[i * 2 + 1]) >> 2;
 int U  = (ubuf0[i] + ubuf1[i] - (128 << 12)) >> 3;
 int V  = (vbuf0[i] + vbuf1[i] - (128 << 12)) >> 3;
 int R, G, B;
@@ -1278,20 +1278,20 @@ yuv2rgba64_1_c_template(SwsContext *c, const int32_t 
*buf0,
 G = V * c->yuv2rgb_v2g_coeff + U * c->yuv2rgb_u2g_coeff;
 B =U * c->yuv2rgb_u2b_coeff;
 
-output_pixel(&dest[0], av_clip_uintp2(((R_B + Y1) >> 14) + 
(1<<15), 16));
-output_pixel(&dest[1], av_clip_uintp2(((  G + Y1) >> 14) + 
(1<<15), 16));
-output_pixel(&dest[2], av_clip_uintp2(((B_R + Y1) >> 14) + 
(1<<15), 16));
+output_pixel(&dest[0], av_clip_uintp2(((int)(R_B + Y1) >> 14) + 
(1<<15), 16));
+output_pixel(&dest[1], av_clip_uintp2(((int)(  G + Y1) >> 14) + 
(1<<15), 16));
+output_pixel(&dest[

[FFmpeg-cvslog] avcodec/dovi_rpuenc: Initialize bl_compat_id

2024-05-05 Thread Michael Niedermayer
ffmpeg | branch: master | Michael Niedermayer  | Fri 
May  3 22:43:22 2024 +0200| [c7075cdb676e217331d400bf2fb2c4a62268f649] | 
committer: Michael Niedermayer

avcodec/dovi_rpuenc: Initialize bl_compat_id

Fixes: CID1596607 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c7075cdb676e217331d400bf2fb2c4a62268f649
---

 libavcodec/dovi_rpuenc.c | 8 +---
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/libavcodec/dovi_rpuenc.c b/libavcodec/dovi_rpuenc.c
index 3feaa04b9e..ad03e143ee 100644
--- a/libavcodec/dovi_rpuenc.c
+++ b/libavcodec/dovi_rpuenc.c
@@ -57,7 +57,7 @@ int ff_dovi_configure(DOVIContext *s, AVCodecContext *avctx)
 AVDOVIDecoderConfigurationRecord *cfg;
 const AVDOVIRpuDataHeader *hdr = NULL;
 const AVFrameSideData *sd;
-int dv_profile, dv_level, bl_compat_id;
+int dv_profile, dv_level, bl_compat_id = -1;
 size_t cfg_size;
 uint64_t pps;
 
@@ -94,9 +94,6 @@ int ff_dovi_configure(DOVIContext *s, AVCodecContext *avctx)
 }
 
 switch (dv_profile) {
-case 0: /* None */
-bl_compat_id = -1;
-break;
 case 4: /* HEVC with enhancement layer */
 case 7:
 if (s->enable > 0) {
@@ -130,9 +127,6 @@ int ff_dovi_configure(DOVIContext *s, AVCodecContext *avctx)
avctx->color_primaries == AVCOL_PRI_BT709 &&
avctx->color_trc == AVCOL_TRC_BT709) {
 bl_compat_id = 2;
-} else {
-/* Not a valid colorspace combination */
-bl_compat_id = -1;
 }
 }
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".


[FFmpeg-cvslog] avcodec/wavarc: fix integer overflow in decode_5elp() block type 2

2024-05-05 Thread Michael Niedermayer
ffmpeg | branch: master | Michael Niedermayer  | Fri 
Apr 26 05:08:38 2024 +0200| [a2ec2bd49317ab16a3c30c0824efc580ea9a8aef] | 
committer: Michael Niedermayer

avcodec/wavarc: fix integer overflow in decode_5elp() block type 2

Fixes: signed integer overflow: 2097152000 + 107142979 cannot be represented in 
type 'int'
Fixes: 
67919/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-5955101769400320

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a2ec2bd49317ab16a3c30c0824efc580ea9a8aef
---

 libavcodec/wavarc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/wavarc.c b/libavcodec/wavarc.c
index b4b26958e6..93b76c43e8 100644
--- a/libavcodec/wavarc.c
+++ b/libavcodec/wavarc.c
@@ -689,7 +689,7 @@ static int decode_5elp(AVCodecContext *avctx,
 for (int o = 0; o < order; o++)
 sum += s->filter[ch][o] * (unsigned)samples[n + 70 - o - 
1];
 
-samples[n + 70] += ac_out[n] + (sum >> 4);
+samples[n + 70] += ac_out[n] + (unsigned)(sum >> 4);
 }
 
 for (int n = 0; n < 70; n++)

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".


[FFmpeg-cvslog] swscale/output: Fix integer overflow in yuv2rgba64_full_1_c_template()

2024-05-05 Thread Michael Niedermayer
ffmpeg | branch: master | Michael Niedermayer  | Fri 
Apr 26 05:08:36 2024 +0200| [1330a73ccadd855542ac4386f75fd72ff0ab5ea1] | 
committer: Michael Niedermayer

swscale/output: Fix integer overflow in yuv2rgba64_full_1_c_template()

Fixes: signed integer overflow: -1082982400 + -1079364728 cannot be represented 
in type 'int'
Fixes: 67910/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5329011971522560
The input is 9bit in 16bit, the fuzzer fills all 16bit thus generating 
"invalid" input
No overflow should happen with valid input.

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1330a73ccadd855542ac4386f75fd72ff0ab5ea1
---

 libswscale/output.c | 16 
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/libswscale/output.c b/libswscale/output.c
index 0b6c77e167..b234f9c6b9 100644
--- a/libswscale/output.c
+++ b/libswscale/output.c
@@ -1429,7 +1429,7 @@ yuv2rgba64_full_1_c_template(SwsContext *c, const int32_t 
*buf0,
 
 if (uvalpha < 2048) {
 for (i = 0; i < dstW; i++) {
-int Y  = (buf0[i]) >> 2;
+SUINT Y  = (buf0[i]) >> 2;
 int U  = (ubuf0[i] - (128 << 11)) >> 2;
 int V  = (vbuf0[i] - (128 << 11)) >> 2;
 int R, G, B;
@@ -1448,9 +1448,9 @@ yuv2rgba64_full_1_c_template(SwsContext *c, const int32_t 
*buf0,
 G = V * c->yuv2rgb_v2g_coeff + U * c->yuv2rgb_u2g_coeff;
 B =U * c->yuv2rgb_u2b_coeff;
 
-output_pixel(&dest[0], av_clip_uintp2(((R_B + Y) >> 14) + (1<<15), 
16));
-output_pixel(&dest[1], av_clip_uintp2(((  G + Y) >> 14) + (1<<15), 
16));
-output_pixel(&dest[2], av_clip_uintp2(((B_R + Y) >> 14) + (1<<15), 
16));
+output_pixel(&dest[0], av_clip_uintp2(((int)(R_B + Y) >> 14) + 
(1<<15), 16));
+output_pixel(&dest[1], av_clip_uintp2(((int)(  G + Y) >> 14) + 
(1<<15), 16));
+output_pixel(&dest[2], av_clip_uintp2(((int)(B_R + Y) >> 14) + 
(1<<15), 16));
 if (eightbytes) {
 output_pixel(&dest[3], av_clip_uintp2(A, 30) >> 14);
 dest += 4;
@@ -1462,7 +1462,7 @@ yuv2rgba64_full_1_c_template(SwsContext *c, const int32_t 
*buf0,
 const int32_t *ubuf1 = ubuf[1], *vbuf1 = vbuf[1];
 int A = 0x<<14;
 for (i = 0; i < dstW; i++) {
-int Y  = (buf0[i]) >> 2;
+SUINT Y  = (buf0[i]) >> 2;
 int U  = (ubuf0[i] + ubuf1[i] - (128 << 12)) >> 3;
 int V  = (vbuf0[i] + vbuf1[i] - (128 << 12)) >> 3;
 int R, G, B;
@@ -1481,9 +1481,9 @@ yuv2rgba64_full_1_c_template(SwsContext *c, const int32_t 
*buf0,
 G = V * c->yuv2rgb_v2g_coeff + U * c->yuv2rgb_u2g_coeff;
 B =U * c->yuv2rgb_u2b_coeff;
 
-output_pixel(&dest[0], av_clip_uintp2(((R_B + Y) >> 14) + (1<<15), 
16));
-output_pixel(&dest[1], av_clip_uintp2(((  G + Y) >> 14) + (1<<15), 
16));
-output_pixel(&dest[2], av_clip_uintp2(((B_R + Y) >> 14) + (1<<15), 
16));
+output_pixel(&dest[0], av_clip_uintp2(((int)(R_B + Y) >> 14) + 
(1<<15), 16));
+output_pixel(&dest[1], av_clip_uintp2(((int)(  G + Y) >> 14) + 
(1<<15), 16));
+output_pixel(&dest[2], av_clip_uintp2(((int)(B_R + Y) >> 14) + 
(1<<15), 16));
 if (eightbytes) {
 output_pixel(&dest[3], av_clip_uintp2(A, 30) >> 14);
 dest += 4;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".


[FFmpeg-cvslog] avcodec/amrwbdec: assert mode to be valid in decode_fixed_vector()

2024-05-05 Thread Michael Niedermayer
ffmpeg | branch: master | Michael Niedermayer  | Sun 
Apr 28 23:30:51 2024 +0200| [a3bb269db92601e2dc0e99352468d02f7b26c7c2] | 
committer: Michael Niedermayer

avcodec/amrwbdec: assert mode to be valid in decode_fixed_vector()

Inspired-by: CID1473499 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a3bb269db92601e2dc0e99352468d02f7b26c7c2
---

 libavcodec/amrwbdec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavcodec/amrwbdec.c b/libavcodec/amrwbdec.c
index 9d75b972fa..21a730b835 100644
--- a/libavcodec/amrwbdec.c
+++ b/libavcodec/amrwbdec.c
@@ -26,6 +26,7 @@
 
 #include "config.h"
 
+#include "libavutil/avassert.h"
 #include "libavutil/channel_layout.h"
 #include "libavutil/common.h"
 #include "libavutil/lfg.h"
@@ -554,6 +555,8 @@ static void decode_fixed_vector(float *fixed_vector, const 
uint16_t *pulse_hi,
 decode_6p_track(sig_pos[i], (int) pulse_lo[i] +
((int) pulse_hi[i] << 11), 4, 1);
 break;
+default:
+av_assert2(0);
 }
 
 memset(fixed_vector, 0, sizeof(float) * AMRWB_SFR_SIZE);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".


[FFmpeg-cvslog] avcodec/mpegvideo_enc: Fix 1 line and one column images

2024-05-05 Thread Michael Niedermayer
ffmpeg | branch: master | Michael Niedermayer  | Mon 
Apr  8 18:38:42 2024 +0200| [96449cfeaeb95fcfd7a2b8d9ccf7719e97471ed1] | 
committer: Michael Niedermayer

avcodec/mpegvideo_enc: Fix 1 line and one column images

Fixes: Ticket10952
Fixes: poc21ffmpeg
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=96449cfeaeb95fcfd7a2b8d9ccf7719e97471ed1
---

 libavcodec/mpegvideo_enc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/mpegvideo_enc.c b/libavcodec/mpegvideo_enc.c
index 0e3255c0fb..2a75973ac4 100644
--- a/libavcodec/mpegvideo_enc.c
+++ b/libavcodec/mpegvideo_enc.c
@@ -1198,8 +1198,8 @@ static int load_input_picture(MpegEncContext *s, const 
AVFrame *pic_arg)
 ptrdiff_t dst_stride = i ? s->uvlinesize : s->linesize;
 int h_shift = i ? s->chroma_x_shift : 0;
 int v_shift = i ? s->chroma_y_shift : 0;
-int w = s->width  >> h_shift;
-int h = s->height >> v_shift;
+int w = AV_CEIL_RSHIFT(s->width , h_shift);
+int h = AV_CEIL_RSHIFT(s->height, v_shift);
 const uint8_t *src = pic_arg->data[i];
 uint8_t *dst = pic->f->data[i];
 int vpad = 16;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".