Re: [FFmpeg-devel] [PATCH 1/2] avformat/mov: fix track handling when mixing IAMF and video tracks
On 8/1/2024 12:10 PM, James Almer wrote: Fixes crashes when muxing the two together. Signed-off-by: James Almer --- libavformat/movenc.c | 37 - 1 file changed, 28 insertions(+), 9 deletions(-) Will apply. ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH] avformat/iamf: use aligned intreadwrite macros where possible
Signed-off-by: James Almer --- libavformat/iamf_parse.c | 12 ++-- libavformat/iamf_reader.c | 4 ++-- libavformat/iamf_writer.c | 12 ++-- 3 files changed, 14 insertions(+), 14 deletions(-) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index e007d6a7af..296e49157b 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -45,8 +45,8 @@ static int opus_decoder_config(IAMFCodecConfig *codec_config, if (!codec_config->extradata) return AVERROR(ENOMEM); -AV_WB32(codec_config->extradata, MKBETAG('O','p','u','s')); -AV_WB32(codec_config->extradata + 4, MKBETAG('H','e','a','d')); +AV_WB32A(codec_config->extradata, MKBETAG('O','p','u','s')); +AV_WB32A(codec_config->extradata + 4, MKBETAG('H','e','a','d')); codec_config->extradata_size = avio_read(pb, codec_config->extradata + 8, left); if (codec_config->extradata_size < left) return AVERROR_INVALIDDATA; @@ -283,10 +283,10 @@ static int update_extradata(AVCodecParameters *codecpar) switch(codecpar->codec_id) { case AV_CODEC_ID_OPUS: -AV_WB8(codecpar->extradata + 9, codecpar->ch_layout.nb_channels); -AV_WL16(codecpar->extradata + 10, AV_RB16(codecpar->extradata + 10)); // Byte swap pre-skip -AV_WL32(codecpar->extradata + 12, AV_RB32(codecpar->extradata + 12)); // Byte swap sample rate -AV_WL16(codecpar->extradata + 16, AV_RB16(codecpar->extradata + 16)); // Byte swap Output Gain +AV_WB8(codecpar->extradata + 9, codecpar->ch_layout.nb_channels); +AV_WL16A(codecpar->extradata + 10, AV_RB16A(codecpar->extradata + 10)); // Byte swap pre-skip +AV_WL32A(codecpar->extradata + 12, AV_RB32A(codecpar->extradata + 12)); // Byte swap sample rate +AV_WL16A(codecpar->extradata + 16, AV_RB16A(codecpar->extradata + 16)); // Byte swap Output Gain break; case AV_CODEC_ID_AAC: { uint8_t buf[5]; diff --git a/libavformat/iamf_reader.c b/libavformat/iamf_reader.c index cdb412f637..b00bb997ca 100644 --- a/libavformat/iamf_reader.c +++ b/libavformat/iamf_reader.c @@ -73,8 +73,8 @@ static int audio_frame_obu(AVFormatContext *s, const IAMFDemuxContext *c, uint8_t *side_data = av_packet_new_side_data(pkt, AV_PKT_DATA_SKIP_SAMPLES, 10); if (!side_data) return AVERROR(ENOMEM); -AV_WL32(side_data, skip_samples); -AV_WL32(side_data + 4, discard_padding); +AV_WL32A(side_data, skip_samples); +AV_WL32A(side_data + 4, discard_padding); } if (c->mix) { uint8_t *side_data = av_packet_new_side_data(pkt, AV_PKT_DATA_IAMF_MIX_GAIN_PARAM, c->mix_size); diff --git a/libavformat/iamf_writer.c b/libavformat/iamf_writer.c index 5e8d8f768b..1b620c38ee 100644 --- a/libavformat/iamf_writer.c +++ b/libavformat/iamf_writer.c @@ -42,12 +42,12 @@ static int update_extradata(IAMFCodecConfig *codec_config) if (codec_config->extradata_size != 19) return AVERROR_INVALIDDATA; codec_config->extradata_size -= 8; -AV_WB8(codec_config->extradata + 0, AV_RL8(codec_config->extradata + 8)); // version -AV_WB8(codec_config->extradata + 1, 2); // set channels to stereo -AV_WB16(codec_config->extradata + 2, AV_RL16(codec_config->extradata + 10)); // Byte swap pre-skip -AV_WB32(codec_config->extradata + 4, AV_RL32(codec_config->extradata + 12)); // Byte swap sample rate -AV_WB16(codec_config->extradata + 8, 0); // set Output Gain to 0 -AV_WB8(codec_config->extradata + 10, AV_RL8(codec_config->extradata + 18)); // Mapping family +AV_WB8(codec_config->extradata + 0, AV_RL8(codec_config->extradata + 8)); // version +AV_WB8(codec_config->extradata + 1, 2); // set channels to stereo +AV_WB16A(codec_config->extradata + 2, AV_RL16A(codec_config->extradata + 10)); // Byte swap pre-skip +AV_WB32A(codec_config->extradata + 4, AV_RL32A(codec_config->extradata + 12)); // Byte swap sample rate +AV_WB16A(codec_config->extradata + 8, 0); // set Output Gain to 0 +AV_WB8(codec_config->extradata + 10, AV_RL8(codec_config->extradata + 18)); // Mapping family break; case AV_CODEC_ID_FLAC: { uint8_t buf[13]; -- 2.46.0 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 1/4] bsf/media100_to_mjpegb: Clear output buffer padding
Fixes: use-of-uninitialized-value Fixes: 70855/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MEDIA100_fuzzer-5537446610141184 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/bsf/media100_to_mjpegb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/bsf/media100_to_mjpegb.c b/libavcodec/bsf/media100_to_mjpegb.c index 6e117ae20fb..4b2dc1a35ac 100644 --- a/libavcodec/bsf/media100_to_mjpegb.c +++ b/libavcodec/bsf/media100_to_mjpegb.c @@ -148,6 +148,7 @@ second_field: AV_WB32(out->data + second_field_offset + 36, sod_offset[1] - second_field_offset); out->size = bytestream2_tell_p(&pb); +memset(out->data + out->size, 0, AV_INPUT_BUFFER_PADDING_SIZE); ret = av_packet_copy_props(out, in); if (ret < 0) -- 2.45.2 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 2/4] avformat/jpegxl_anim_dec: initialize bit buffer
Fixes: use-of-uninitialized-value Fixes: 70837/clusterfuzz-testcase-minimized-ffmpeg_dem_JPEGXL_ANIM_fuzzer-5089407768526848 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/jpegxl_anim_dec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/jpegxl_anim_dec.c b/libavformat/jpegxl_anim_dec.c index ac95d3b9617..3045167e1f9 100644 --- a/libavformat/jpegxl_anim_dec.c +++ b/libavformat/jpegxl_anim_dec.c @@ -77,7 +77,7 @@ static int jpegxl_anim_read_header(AVFormatContext *s) JXLAnimDemuxContext *ctx = s->priv_data; AVIOContext *pb = s->pb; AVStream *st; -uint8_t head[256 + AV_INPUT_BUFFER_PADDING_SIZE]; +uint8_t head[256 + AV_INPUT_BUFFER_PADDING_SIZE] = {0}; const int sizeofhead = sizeof(head) - AV_INPUT_BUFFER_PADDING_SIZE; int headsize = 0, ret; FFJXLMetadata meta = { 0 }; -- 2.45.2 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 3/4] avcodec/mvha: Clear remaining space after inflate()
Fixes: use-of-uninitialized-value Fixes: 70838/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MVHA_fuzzer-4878509466517504 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/mvha.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/mvha.c b/libavcodec/mvha.c index 24dd88e8542..4aad56640ee 100644 --- a/libavcodec/mvha.c +++ b/libavcodec/mvha.c @@ -183,6 +183,8 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame, av_log(avctx, AV_LOG_ERROR, "Inflate error: %d\n", ret); return AVERROR_EXTERNAL; } +if (zstream->avail_out > 0) +memset(zstream->next_out, 0, zstream->avail_out); } } } else if (type == MKTAG('H','U','F','Y')) { -- 2.45.2 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 4/4] avformat/wavdec: Check if there are 16 bytes before testing them
Fixes: use-of-uninitialized-value Fixes: 70839/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5212907590189056 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/wavdec.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c index 00856a5eca2..78e37b88d75 100644 --- a/libavformat/wavdec.c +++ b/libavformat/wavdec.c @@ -874,8 +874,7 @@ static int w64_read_header(AVFormatContext *s) uint8_t guid[16]; int ret; -avio_read(pb, guid, 16); -if (memcmp(guid, ff_w64_guid_riff, 16)) +if (avio_read(pb, guid, 16) != 16 || memcmp(guid, ff_w64_guid_riff, 16)) return AVERROR_INVALIDDATA; /* riff + wave + fmt + sizes */ -- 2.45.2 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH 21/22] avcodec/libsvtav1: raise strictness of missing DV error
On Sat, 03 Aug 2024 20:08:26 +0200 Andreas Rheinhardt wrote: > Niklas Haas: > > From: Niklas Haas > > > > While this is technically a spec violation, the result is still > > decodable (and will look perfectly fine to clients ignoring Dolby Vision > > metadata). It will also only happen in garbage in, garbage out scenarios. > > --- > > libavcodec/libsvtav1.c | 4 ++-- > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > diff --git a/libavcodec/libsvtav1.c b/libavcodec/libsvtav1.c > > index e7b12fb488..4c91750fbe 100644 > > --- a/libavcodec/libsvtav1.c > > +++ b/libavcodec/libsvtav1.c > > @@ -551,10 +551,10 @@ static int eb_send_frame(AVCodecContext *avctx, const > > AVFrame *frame) > > } else if (svt_enc->dovi.cfg.dv_profile) { > > av_log(avctx, AV_LOG_ERROR, "Dolby Vision enabled, but received > > frame " > > "without AV_FRAME_DATA_DOVI_METADATA\n"); > > -return AVERROR_INVALIDDATA; > > +if (avctx->strict_std_compliance >= FF_COMPLIANCE_STRICT) > > +return AVERROR_INVALIDDATA; > > } > > > > - > > svt_ret = svt_av1_enc_send_picture(svt_enc->svt_handle, headerPtr); > > if (svt_ret != EB_ErrorNone) > > return svt_print_error(avctx, svt_ret, "Error sending a frame to > > encoder"); > > Encoders are supposed to be picky and only produce spec-compliant output. Okay, I could either drop this commit or raise it to UNOFFICIAL. But it probably makes more sense to drop it, such files should be phased out if they exist anyway. > > - Andreas > > ___ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe". ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [REFUND-REQUEST] BananaPi BPI-F3 SpacemiT K1 RISC-V Devboard
On date Thursday 2024-08-01 17:14:52 +0200, Niklas Haas wrote: > Hi all, > > I would like to request reimbursement on the named RISC-V development board. > It will be used to develop and test H.264 RVV routines, and probably more in > the future (e.g. swscale). > > The total cost including tax and shipping to Germany is 153.41 EUR. Approved on my side. To get the refund, follow instructions here to generate a refund request: https://www.spi-inc.org/treasurer/reimbursement-form/ Then email it to: treasu...@rt.spi-inc.org putting me and Michael in CC:, and adding the thread link from: http://ffmpeg.org/pipermail/ffmpeg-devel/ ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH v2] libavfilter: add PipeWire-based grab
> The patch already supports passing a file descriptor and a PipeWire node ID > directly via the "fd" and "node" options. The portal is only used if these > values are not provided by the user. > > The original motivation for adding these options was to allow communication > with the portal to be handled outside of FFmpeg, but I imagine they could also > be used on e.g. Weston to bypass the portal entirely. I see, I tried to pull the patch and test it. How does invocation with node work? I'm a bit confused with the invocation. For testing I tried using "gamescope --headless -- glxgears" to generate a raw pipewire stream. (cameras will automatically create one with pipewire) used "pw-dump | jq '.[] | select(.info.props["node.name"] == "gamescope") | .id'" to get the node id and tried to use it but it still seemed to trigger the portal. If you have a camera installed I use the below command to dump all of the video sources, gamescope and cameras included pw-dump | jq '.[] | select(.info.props["media.class"] == "Video/Source") | .info.props."node.name" + " | " + .info.props."node.description" + " | " + (.id|tostring)' does the current patch have a hard requirement on file descriptors to not use xdg? I did also test xdg capture on cosmic, it seems to only sporadically work, usually spitting out the below error. I can spam it to keep retrying it until it works [Parsed_hwmap_0 @ 0x79fabc003600] Mapping requires a hardware context (a device, or frames on input). [Parsed_hwmap_0 @ 0x79fabc003600] Failed to configure output pad on Parsed_hwmap_0 [vf#0:0 @ 0x55cf4daff480] Error reinitializing filters! [vf#0:0 @ 0x55cf4daff480] Task finished with error code: -22 (Invalid argument) [vf#0:0 @ 0x55cf4daff480] Terminating thread with return code -22 (Invalid argument) [vost#0:0/h264_vaapi @ 0x55cf4db38080] Could not open encoder before EOF [vost#0:0/h264_vaapi @ 0x55cf4db38080] Task finished with error code: -22 (Invalid argument) [vost#0:0/h264_vaapi @ 0x55cf4db38080] Terminating thread with return code -22 (Invalid argument) [out#0/mp4 @ 0x55cf4db37800] Nothing was written into output file, because at least one of its streams received no packets. On Fri, Aug 2, 2024 at 3:41 PM François-Simon Fauteux-Chapleau wrote: > > - On Aug 2, 2024, at 12:11 PM, Quack Doc quackdoct...@gmail.com wrote: > > Pipewire video capture is more generic. Some compositors like weston > > support pipewire as a backend without portals. Gamescope also creates a > > pipewire output without need for portals, it would be *really* nice to > > support gamescope capture with this. Pipewire also gives access to video > > devices directly as well without needing portals, which allows > > ergonomically letting multiple apps accsess v4l2 devices for instance like > > firefox and say discord. So being able to support the file descriptor > > directly, or using target-object much like the pipewiresrc gstreamer would > > be greatly appreciated. > > The patch already supports passing a file descriptor and a PipeWire node ID > directly via the "fd" and "node" options. The portal is only used if these > values are not provided by the user. > > The original motivation for adding these options was to allow communication > with the portal to be handled outside of FFmpeg, but I imagine they could also > be used on e.g. Weston to bypass the portal entirely. > ___ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe". ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 1/8] avcodec/apac: Clean padding space
Fixes: use-of-uninitialized-value Fixes: 70842/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APAC_fuzzer-5758325067677696 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/apac.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/apac.c b/libavcodec/apac.c index f740fb5553b..068ad095300 100644 --- a/libavcodec/apac.c +++ b/libavcodec/apac.c @@ -159,6 +159,7 @@ static int apac_decode(AVCodecContext *avctx, AVFrame *frame, buf= &s->bitstream[s->bitstream_index]; buf_size += s->bitstream_size; s->bitstream_size = buf_size; +memset(buf + buf_size, 0, AV_INPUT_BUFFER_PADDING_SIZE); frame->nb_samples = s->bitstream_size * 16 * 8; if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) -- 2.45.2 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 2/8] avformat/mpeg: Check an avio_read() for failure
Fixes: use-of-uninitialized-value Fixes: 70849/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGPS_fuzzer-4684401009557504 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/mpeg.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavformat/mpeg.c b/libavformat/mpeg.c index c3dff3e4ea2..262e398fa5e 100644 --- a/libavformat/mpeg.c +++ b/libavformat/mpeg.c @@ -566,7 +566,9 @@ redo: static const unsigned char avs_seqh[4] = { 0, 0, 1, 0xb0 }; unsigned char buf[8]; -avio_read(s->pb, buf, 8); +ret = avio_read(s->pb, buf, 8); +if (ret < 0) +return ret; avio_seek(s->pb, -8, SEEK_CUR); if (!memcmp(buf, avs_seqh, 4) && (buf[6] != 0 || buf[7] != 1)) codec_id = AV_CODEC_ID_CAVS; -- 2.45.2 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 3/8] avformat/img2dec: Clear padding data after EOF
Fixes: use-of-uninitialized-value Fixes: 70852/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5179190066872320 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/img2dec.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c index 20b1bc31f6a..3389fa818e9 100644 --- a/libavformat/img2dec.c +++ b/libavformat/img2dec.c @@ -563,6 +563,7 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt) } goto fail; } else { +memset(pkt->data + pkt->size, 0, AV_INPUT_BUFFER_PADDING_SIZE); s->img_count++; s->img_number++; s->pts++; -- 2.45.2 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 4/8] avcodec/parser: clear padding in combine frame
Fixes: use-of-uninitialized-value Fixes: 70852/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5179190066872320 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/parser.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/parser.c b/libavcodec/parser.c index af17ee9c156..426cc314fb0 100644 --- a/libavcodec/parser.c +++ b/libavcodec/parser.c @@ -236,6 +236,7 @@ int ff_combine_frame(ParseContext *pc, int next, } pc->buffer = new_buffer; memcpy(&pc->buffer[pc->index], *buf, *buf_size); +memset(&pc->buffer[pc->index + *buf_size], 0, AV_INPUT_BUFFER_PADDING_SIZE); pc->index += *buf_size; return -1; } -- 2.45.2 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 5/8] avcodec/shorten: clear padding
Fixes: use-of-uninitialized-value Fixes: 70854/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5533480570650624 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/shorten.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/shorten.c b/libavcodec/shorten.c index 102992e2b2c..12a179156a7 100644 --- a/libavcodec/shorten.c +++ b/libavcodec/shorten.c @@ -563,6 +563,7 @@ static int shorten_decode_frame(AVCodecContext *avctx, AVFrame *frame, buf = &s->bitstream[s->bitstream_index]; buf_size += s->bitstream_size; s->bitstream_size = buf_size; +memset(buf + buf_size, 0, AV_INPUT_BUFFER_PADDING_SIZE); /* do not decode until buffer has at least max_framesize bytes or * the end of the file has been reached */ -- 2.45.2 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 6/8] avcodec/vc1dec: Clear mb_type_base and ttblk_base
Fixes: two use-of-uninitialized-value Fixes: 70856/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5539349918187520 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/vc1dec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c index 4b31860c3fe..5f1a5bd437c 100644 --- a/libavcodec/vc1dec.c +++ b/libavcodec/vc1dec.c @@ -379,7 +379,7 @@ static av_cold int vc1_decode_init_alloc_tables(VC1Context *v) if (!v->block || !v->cbp_base) return AVERROR(ENOMEM); v->cbp = v->cbp_base + 2 * s->mb_stride; -v->ttblk_base = av_malloc(sizeof(v->ttblk_base[0]) * 3 * s->mb_stride); +v->ttblk_base = av_mallocz(sizeof(v->ttblk_base[0]) * 3 * s->mb_stride); if (!v->ttblk_base) return AVERROR(ENOMEM); v->ttblk= v->ttblk_base + 2 * s->mb_stride; @@ -393,7 +393,7 @@ static av_cold int vc1_decode_init_alloc_tables(VC1Context *v) v->luma_mv = v->luma_mv_base + 2 * s->mb_stride; /* allocate block type info in that way so it could be used with s->block_index[] */ -v->mb_type_base = av_malloc(s->b8_stride * (mb_height * 2 + 1) + s->mb_stride * (mb_height + 1) * 2); +v->mb_type_base = av_mallocz(s->b8_stride * (mb_height * 2 + 1) + s->mb_stride * (mb_height + 1) * 2); if (!v->mb_type_base) return AVERROR(ENOMEM); v->mb_type[0] = v->mb_type_base + s->b8_stride + 1; -- 2.45.2 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 7/8] avcodec/aic: Clear slice_data
Fixes: use-of-uninitialized-value Fixes: 70865/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AIC_fuzzer-4874102695854080 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/aic.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/libavcodec/aic.c b/libavcodec/aic.c index 3ff170b414f..e12d689c478 100644 --- a/libavcodec/aic.c +++ b/libavcodec/aic.c @@ -465,8 +465,7 @@ static av_cold int aic_decode_init(AVCodecContext *avctx) } } -ctx->slice_data = av_malloc_array(ctx->slice_width, AIC_BAND_COEFFS -* sizeof(*ctx->slice_data)); +ctx->slice_data = av_calloc(ctx->slice_width, AIC_BAND_COEFFS * sizeof(*ctx->slice_data)); if (!ctx->slice_data) { av_log(avctx, AV_LOG_ERROR, "Error allocating slice buffer\n"); -- 2.45.2 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 8/8] avcodec/alsdec: clear last_acf_mantissa
Fixes: use-of-uninitialized-value Fixes: 70869/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5476567461986304 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/alsdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c index f4f67917d76..28f20799854 100644 --- a/libavcodec/alsdec.c +++ b/libavcodec/alsdec.c @@ -2112,7 +2112,7 @@ static av_cold int decode_init(AVCodecContext *avctx) ctx->acf = av_malloc_array(channels, sizeof(*ctx->acf)); ctx->shift_value = av_calloc(channels, sizeof(*ctx->shift_value)); ctx->last_shift_value = av_calloc(channels, sizeof(*ctx->last_shift_value)); -ctx->last_acf_mantissa = av_malloc_array(channels, sizeof(*ctx->last_acf_mantissa)); +ctx->last_acf_mantissa = av_calloc(channels, sizeof(*ctx->last_acf_mantissa)); ctx->raw_mantissa = av_calloc(channels, sizeof(*ctx->raw_mantissa)); ctx->larray = av_malloc_array(ctx->cur_frame_length * 4, sizeof(*ctx->larray)); -- 2.45.2 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH 4/8] avcodec/parser: clear padding in combine frame
On Sun, 4 Aug 2024 at 22:53, Michael Niedermayer wrote: > > Fixes: use-of-uninitialized-value > Fixes: > 70852/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5179190066872320 > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer > --- > libavcodec/parser.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/libavcodec/parser.c b/libavcodec/parser.c > index af17ee9c156..426cc314fb0 100644 > --- a/libavcodec/parser.c > +++ b/libavcodec/parser.c > @@ -236,6 +236,7 @@ int ff_combine_frame(ParseContext *pc, int next, > } > pc->buffer = new_buffer; > memcpy(&pc->buffer[pc->index], *buf, *buf_size); > +memset(&pc->buffer[pc->index + *buf_size], 0, > AV_INPUT_BUFFER_PADDING_SIZE); > pc->index += *buf_size; > return -1; > } > -- > 2.45.2 We already had patch like that some time ago, https://patchwork.ffmpeg.org/project/ffmpeg/patch/20240627004037.1336-2-kaspe...@gmail.com/ - Kacper ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH 2/4] avformat/jpegxl_anim_dec: initialize bit buffer
On Sun, 4 Aug 2024 at 16:23, Michael Niedermayer wrote: > > Fixes: use-of-uninitialized-value > Fixes: > 70837/clusterfuzz-testcase-minimized-ffmpeg_dem_JPEGXL_ANIM_fuzzer-5089407768526848 > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer > --- > libavformat/jpegxl_anim_dec.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/libavformat/jpegxl_anim_dec.c b/libavformat/jpegxl_anim_dec.c > index ac95d3b9617..3045167e1f9 100644 > --- a/libavformat/jpegxl_anim_dec.c > +++ b/libavformat/jpegxl_anim_dec.c > @@ -77,7 +77,7 @@ static int jpegxl_anim_read_header(AVFormatContext *s) > JXLAnimDemuxContext *ctx = s->priv_data; > AVIOContext *pb = s->pb; > AVStream *st; > -uint8_t head[256 + AV_INPUT_BUFFER_PADDING_SIZE]; > +uint8_t head[256 + AV_INPUT_BUFFER_PADDING_SIZE] = {0}; > const int sizeofhead = sizeof(head) - AV_INPUT_BUFFER_PADDING_SIZE; > int headsize = 0, ret; > FFJXLMetadata meta = { 0 }; > -- > 2.45.2 Not sure it is required to zero the whole buffer. I sent an alternative patch some time ago, which clears only the relevant area. https://patchwork.ffmpeg.org/project/ffmpeg/patch/20240627004037.1336-4-kaspe...@gmail.com/ - Kacper ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH 3/8] avformat/img2dec: Clear padding data after EOF
On Sun, 4 Aug 2024 at 23:01, Michael Niedermayer wrote: > > Fixes: use-of-uninitialized-value > Fixes: > 70852/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5179190066872320 > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer > --- > libavformat/img2dec.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c > index 20b1bc31f6a..3389fa818e9 100644 > --- a/libavformat/img2dec.c > +++ b/libavformat/img2dec.c > @@ -563,6 +563,7 @@ int ff_img_read_packet(AVFormatContext *s1, AVPacket *pkt) > } > goto fail; > } else { > +memset(pkt->data + pkt->size, 0, AV_INPUT_BUFFER_PADDING_SIZE); > s->img_count++; > s->img_number++; > s->pts++; > -- > 2.45.2 I've also had this one (https://patchwork.ffmpeg.org/project/ffmpeg/patch/20240627004037.1336-3-kaspe...@gmail.com/), but probably it is better to do it only in the else branch here. So, LGTM. - Kacper ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH] avcodec/av1_vaapi: Enable AV1Profile2 VAAPI support.
On Di, 2024-07-30 at 16:02 -0400, David (Ming Qiang) Wu via ffmpeg-devel wrote: > AV1Profile2 VAAPI is supported and tested on AMD VCN5. > > Signed-off-by: David (Ming Qiang) Wu > --- > libavcodec/av1dec.c | 3 +++ > libavcodec/vaapi_decode.c | 3 +++ > 2 files changed, 6 insertions(+) > > diff --git a/libavcodec/av1dec.c b/libavcodec/av1dec.c > index 1d5b9ef4f4..77f63661a0 100644 > --- a/libavcodec/av1dec.c > +++ b/libavcodec/av1dec.c > @@ -599,6 +599,9 @@ static int get_pixel_format(AVCodecContext *avctx) > case AV_PIX_FMT_YUV420P12: > #if CONFIG_AV1_VULKAN_HWACCEL > *fmtp++ = AV_PIX_FMT_VULKAN; > +#endif > +#if CONFIG_AV1_VAAPI_HWACCEL > + *fmtp++ = AV_PIX_FMT_VAAPI; > #endif > break; > case AV_PIX_FMT_YUV422P: > diff --git a/libavcodec/vaapi_decode.c b/libavcodec/vaapi_decode.c > index a59194340f..a077e47326 100644 > --- a/libavcodec/vaapi_decode.c > +++ b/libavcodec/vaapi_decode.c > @@ -448,6 +448,9 @@ static const struct { > MAP(AV1, AV1_MAIN, AV1Profile0), > MAP(AV1, AV1_HIGH, AV1Profile1), > #endif > +#if VA_CHECK_VERSION(1, 23, 0) > + MAP(AV1, AV1_PROFESSIONAL, AV1Profile2), > +#endif > > #undef MAP LGTM, Please ping when libva 2.23 (VA-API 1.23) is released officially. Thanks Haihao > }; ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH 1/2] lavc/vaapi_decode: Make it possible to send multiple slice params buffers
On Di, 2024-07-30 at 11:31 +0200, Sebastian Ramacher wrote: > On 2024-05-07 06:59:51 +, Xiang, Haihao wrote: > > On So, 2024-04-28 at 09:26 +0200, David Rosca wrote: > > > --- > > > libavcodec/vaapi_av1.c | 2 +- > > > libavcodec/vaapi_decode.c | 3 ++- > > > libavcodec/vaapi_decode.h | 1 + > > > libavcodec/vaapi_h264.c | 2 +- > > > libavcodec/vaapi_hevc.c | 4 ++-- > > > libavcodec/vaapi_mjpeg.c | 2 +- > > > libavcodec/vaapi_mpeg2.c | 2 +- > > > libavcodec/vaapi_mpeg4.c | 2 +- > > > libavcodec/vaapi_vc1.c | 2 +- > > > libavcodec/vaapi_vp8.c | 2 +- > > > libavcodec/vaapi_vp9.c | 2 +- > > > 11 files changed, 13 insertions(+), 11 deletions(-) > > > > > > diff --git a/libavcodec/vaapi_av1.c b/libavcodec/vaapi_av1.c > > > index 1f563483b9..4a90db1e09 100644 > > > --- a/libavcodec/vaapi_av1.c > > > +++ b/libavcodec/vaapi_av1.c > > > @@ -409,7 +409,7 @@ static int vaapi_av1_decode_slice(AVCodecContext > > > *avctx, > > > .tg_end = s->tg_end, > > > }; > > > > > > - err = ff_vaapi_decode_make_slice_buffer(avctx, pic, &slice_param, > > > + err = ff_vaapi_decode_make_slice_buffer(avctx, pic, &slice_param, > > > 1, > > > > > > sizeof(VASliceParameterBufferAV1), > > > buffer, > > > size); > > > diff --git a/libavcodec/vaapi_decode.c b/libavcodec/vaapi_decode.c > > > index 21b273cd0f..8e9f647c20 100644 > > > --- a/libavcodec/vaapi_decode.c > > > +++ b/libavcodec/vaapi_decode.c > > > @@ -63,6 +63,7 @@ int ff_vaapi_decode_make_param_buffer(AVCodecContext > > > *avctx, > > > int ff_vaapi_decode_make_slice_buffer(AVCodecContext *avctx, > > > VAAPIDecodePicture *pic, > > > const void *params_data, > > > + int nb_params, > > > size_t params_size, > > > const void *slice_data, > > > size_t slice_size) > > > @@ -88,7 +89,7 @@ int ff_vaapi_decode_make_slice_buffer(AVCodecContext > > > *avctx, > > > > > > vas = vaCreateBuffer(ctx->hwctx->display, ctx->va_context, > > > VASliceParameterBufferType, > > > - params_size, 1, (void*)params_data, > > > + params_size, nb_params, (void*)params_data, > > > &pic->slice_buffers[index]); > > > if (vas != VA_STATUS_SUCCESS) { > > > av_log(avctx, AV_LOG_ERROR, "Failed to create slice " > > > diff --git a/libavcodec/vaapi_decode.h b/libavcodec/vaapi_decode.h > > > index 6beda14e52..702171e108 100644 > > > --- a/libavcodec/vaapi_decode.h > > > +++ b/libavcodec/vaapi_decode.h > > > @@ -73,6 +73,7 @@ int ff_vaapi_decode_make_param_buffer(AVCodecContext > > > *avctx, > > > int ff_vaapi_decode_make_slice_buffer(AVCodecContext *avctx, > > > VAAPIDecodePicture *pic, > > > const void *params_data, > > > + int nb_params, > > > size_t params_size, > > > const void *slice_data, > > > size_t slice_size); > > > diff --git a/libavcodec/vaapi_h264.c b/libavcodec/vaapi_h264.c > > > index 55cf5a05ee..b47531ce1c 100644 > > > --- a/libavcodec/vaapi_h264.c > > > +++ b/libavcodec/vaapi_h264.c > > > @@ -375,7 +375,7 @@ static int vaapi_h264_decode_slice(AVCodecContext > > > *avctx, > > > slice_param.chroma_offset_l1); > > > > > > err = ff_vaapi_decode_make_slice_buffer(avctx, pic, > > > - &slice_param, > > > sizeof(slice_param), > > > + &slice_param, 1, > > > sizeof(slice_param), > > > buffer, size); > > > if (err) { > > > ff_vaapi_decode_cancel(avctx, pic); > > > diff --git a/libavcodec/vaapi_hevc.c b/libavcodec/vaapi_hevc.c > > > index 3bdd2dd1b8..3937b7574a 100644 > > > --- a/libavcodec/vaapi_hevc.c > > > +++ b/libavcodec/vaapi_hevc.c > > > @@ -353,7 +353,7 @@ static int vaapi_hevc_end_frame(AVCodecContext *avctx) > > > if (pic->last_size) { > > > last_slice_param->LongSliceFlags.fields.LastSliceOfPic = 1; > > > ret = ff_vaapi_decode_make_slice_buffer(avctx, &pic->pic, > > > - &pic->last_slice_param, > > > slice_param_size, > > > + &pic->last_slice_param, > > > 1, > > > slice_param_size, > > > pic->last_buffer, pic- > > > > last_size); > > > if (ret < 0
Re: [FFmpeg-devel] [PATCH 1/3] lavu/hwcontext_vaapi: Add option to allow to specify vendor id when init hw device
On Vr, 2024-07-26 at 09:05 +0800, fei.w.wang-at-intel@ffmpeg.org wrote: > From: Fei Wang > > Vendor id will help to select desired device in case of kernel driver is > unknow or unsupported, for vendor may support different kernel driver on > different platforms. > > Signed-off-by: Fei Wang > --- > doc/ffmpeg.texi | 8 > libavutil/hwcontext_vaapi.c | 29 + > libavutil/version.h | 2 +- > 3 files changed, 38 insertions(+), 1 deletion(-) > > diff --git a/doc/ffmpeg.texi b/doc/ffmpeg.texi > index 877edae3b3..842e92ad1a 100644 > --- a/doc/ffmpeg.texi > +++ b/doc/ffmpeg.texi > @@ -1458,6 +1458,11 @@ The following options are recognized: > When @var{device} is not specified, use this option to specify the name of > the kernel > driver associated with the desired device. This option is available only when > the hardware acceleration method @emph{drm} and @emph{vaapi} are enabled. > +@item vendor_id > +When @var{device} and @var{kernel_driver} are not specified, use this option > to specify > +the vendor id associated with the desired device. This option is available > only when the > +hardware acceleration method @emph{drm} and @emph{vaapi} are enabled and > @emph{kernel_driver} > +is not specified. > @end table > > Examples: > @@ -1473,6 +1478,9 @@ Create a vaapi device on DirectX adapter 1. > > @item -init_hw_device vaapi:,kernel_driver=i915 > Create a vaapi device on a device associated with kernel driver @samp{i915}. > + > +@item -init_hw_device vaapi:,vendor_id=0x8086 > +Create a vaapi device on a device associated with vendor id @samp{0x8086}. > @end table > > @item vdpau > diff --git a/libavutil/hwcontext_vaapi.c b/libavutil/hwcontext_vaapi.c > index 4cb25dd032..014541752a 100644 > --- a/libavutil/hwcontext_vaapi.c > +++ b/libavutil/hwcontext_vaapi.c > @@ -1748,7 +1748,9 @@ static int vaapi_device_create(AVHWDeviceContext *ctx, > const char *device, > #if CONFIG_LIBDRM > drmVersion *info; > const AVDictionaryEntry *kernel_driver; > + const AVDictionaryEntry *vendor_id; > kernel_driver = av_dict_get(opts, "kernel_driver", NULL, 0); > + vendor_id = av_dict_get(opts, "vendor_id", NULL, 0); > #endif > for (n = 0; n < max_devices; n++) { > snprintf(path, sizeof(path), > @@ -1803,6 +1805,33 @@ static int vaapi_device_create(AVHWDeviceContext *ctx, > const char *device, > close(priv->drm_fd); > priv->drm_fd = -1; > continue; > + } else if (vendor_id) { > + drmDevicePtr device; > + char drm_vendor[8]; > + if (drmGetDevice(priv->drm_fd, &device)) { > + av_log(ctx, AV_LOG_VERBOSE, > + "Failed to get DRM device info for device > %d.\n", n); > + close(priv->drm_fd); > + priv->drm_fd = -1; > + continue; > + } > + > + snprintf(drm_vendor, sizeof(drm_vendor), "0x%x", device- > >deviceinfo.pci->vendor_id); > + if (strcmp(vendor_id->value, drm_vendor)) { > + av_log(ctx, AV_LOG_VERBOSE, "Ignoring device %d " > + "with non-matching vendor id (%s).\n", > + n, vendor_id->value); > + drmFreeDevice(&device); > + close(priv->drm_fd); > + priv->drm_fd = -1; > + continue; > + } > + av_log(ctx, AV_LOG_VERBOSE, "Trying to use " > + "DRM render node for device %d, " > + "with matching vendor id (%s).\n", > + n, vendor_id->value); > + drmFreeDevice(&device); > + break; > } > drmFreeVersion(info); > #endif > diff --git a/libavutil/version.h b/libavutil/version.h > index 814892a4d5..852eeef1d6 100644 > --- a/libavutil/version.h > +++ b/libavutil/version.h > @@ -79,7 +79,7 @@ > */ > > #define LIBAVUTIL_VERSION_MAJOR 59 > -#define LIBAVUTIL_VERSION_MINOR 28 > +#define LIBAVUTIL_VERSION_MINOR 29 > #define LIBAVUTIL_VERSION_MICRO 100 > > #define LIBAVUTIL_VERSION_INT AV_VERSION_INT(LIBAVUTIL_VERSION_MAJOR, \ Patchset LGTM, I will apply these patches if there are no objections. Thanks Haihao ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".