[FFmpeg-cvslog] Update for FFmpeg 3.3.9

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Thu Nov  1 01:32:12 2018 +0100| [6fe9f36dd9945961c0d95912f5ae5be4d8ea431f] | 
committer: Michael Niedermayer

Update for FFmpeg 3.3.9

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6fe9f36dd9945961c0d95912f5ae5be4d8ea431f
---

 Changelog| 47 +++
 RELEASE  |  2 +-
 doc/Doxyfile |  2 +-
 3 files changed, 49 insertions(+), 2 deletions(-)

diff --git a/Changelog b/Changelog
index 0dd9d68d67..ea75538f17 100644
--- a/Changelog
+++ b/Changelog
@@ -1,6 +1,53 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.
 
+version 3.3.9:
+- avutil/integer: Fix integer overflow in av_mul_i()
+- avcodec/msrle: Check that the input is large enough to contain a end of 
picture code
+- avcodec/jpeg2000dec: Fix off by 1 error in JPEG2000_PGOD_CPRL handling
+- avcodec/mpeg4videodec: Fix typo in sprite delta check
+- avcodec/h264_cavlc: Check mb_skip_run
+- avcodec/ra144: Fix integer overflow in add_wav()
+- avformat/utils: Never store negative values in last_IP_duration
+- avformat/utils: Fix integer overflow in discontinuity check
+- avcodec/unary: Improve get_unary() docs
+- avcodec/dvdsubdec: Sanity check len in decode_rle()
+- avcodec/mpeg4videodec: Fix undefined shift in get_amv()
+- avcodec/zmbv: Check that the decompressed data size is correct
+- avcodec/zmbv: Update decomp_len in raw frames
+- avcodec/shorten: Fix bitstream end check in read_header()
+- avcodec/dvdsubdec: Avoid branch in decode_run_8bit()
+- avcodec/h264_refs: Document last if() in ff_h264_execute_ref_pic_marking()
+- avcodec/ra144: Fix undefined integer overflow in add_wav()
+- avcodec/indeo4: Check dimensions in decode_pic_hdr()
+- avformat/mov: Error on too large stsd entry counts.
+- examples: Fix use of AV_CODEC_FLAG_GLOBAL_HEADER
+- avcodec/hq_hqa: Check remaining input bits in hqa_decode_mb()
+- avcodec/vb: Check for end of bytestream before reading blocktype
+- avcodec/snowdec: Fix integer overflow with motion vector residual
+- avformat/nsvdec: Do not parse multiple NSVf
+- avformat/mlvdec: read_string() received unsigned size, make the argument 
unsigned
+- avformat/rmdec: Fix EOF check in the stream loop in ivr_read_header()
+- avcodec/scpr: Check for min > max in decompress_p()
+- avcodec/shorten: Fix signed 32bit overflow in shift in shorten_decode_frame()
+- avcodec/shorten: Fix integer overflow in residual/LPC combination
+- avcodec/shorten: Check verbatim length
+- avcodec/mpegaudio_parser: Initialize poutbuf*
+- avcodec/aacpsdsp_template: Fix integer overflow in ps_stereo_interpolate_c()
+- avformat/flvenc: Check audio packet size
+- lavc/svq3: Fix regression decoding some files.
+- avcodec/qtrle: Check remaining bytestream in qtrle_decode_XYbpp()
+- avcodec/diracdec: Check bytes count in else branch in decode_lowdelay() too
+- avcodec/diracdec: Check slice numbers for overflows in relation to picture 
dimensions
+- avcodec/diracdec: Change frame_number to 64bit as its a 32bit from the 
bitstream and we also have a -1 special case
+- avcodec/dirac_dwt_template: Fix several integer overflows in 
horizontal_compose_daub97i()
+- avcodec/diracdec: Prevent integer overflow in intermediate in global_mv()
+- swresample/swresample: Fix input channel count in resample_first computation
+- avutil/pixfmt: Document chroma plane size for odd resolutions
+- avcodec/cuviddec: properly take deinterlacing and display delay into account 
for buffer_full check
+- avcodec/bitstream_filters: check the input argument of av_bsf_get_by_name() 
for NULL
+
+
 version 3.3.8:
 - avcodec/dvdsub_parser: Allocate input padding
 - avcodec/dvdsub_parser: Init output buf/size
diff --git a/RELEASE b/RELEASE
index 37d02a6e38..3b47f2e4f8 100644
--- a/RELEASE
+++ b/RELEASE
@@ -1 +1 @@
-3.3.8
+3.3.9
diff --git a/doc/Doxyfile b/doc/Doxyfile
index 7610d18818..3e4b051b18 100644
--- a/doc/Doxyfile
+++ b/doc/Doxyfile
@@ -38,7 +38,7 @@ PROJECT_NAME   = FFmpeg
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER = 3.3.8
+PROJECT_NUMBER = 3.3.9
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/zmbv: Check that the decompressed data size is correct

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Tue Sep 18 00:28:37 2018 +0200| [7fb45ccf4ef537599f9bb2c8925d6a28204650a9] | 
committer: Michael Niedermayer

avcodec/zmbv: Check that the decompressed data size is correct

This checks the value exactly for intra frames and checks it against a
minimum for inter frames as they can be variable.

Fixes: Timeout
Fixes: 
10182/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZMBV_fuzzer-6245951174344704

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit e33b28cc79d164fff22bfee750c9283587c00bc4)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7fb45ccf4ef537599f9bb2c8925d6a28204650a9
---

 libavcodec/zmbv.c | 14 ++
 1 file changed, 14 insertions(+)

diff --git a/libavcodec/zmbv.c b/libavcodec/zmbv.c
index 1ec656be36..b994e96e95 100644
--- a/libavcodec/zmbv.c
+++ b/libavcodec/zmbv.c
@@ -408,6 +408,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, 
int *got_frame, AVPac
 int zret = Z_OK; // Zlib return code
 int len = buf_size;
 int hi_ver, lo_ver, ret;
+int expected_size;
 
 /* parse header */
 if (len < 1)
@@ -504,6 +505,14 @@ static int decode_frame(AVCodecContext *avctx, void *data, 
int *got_frame, AVPac
 memset(c->prev, 0, avctx->width * avctx->height * (c->bpp / 8));
 c->decode_intra= decode_intra;
 }
+if (c->flags & ZMBV_KEYFRAME) {
+expected_size = avctx->width * avctx->height * (c->bpp / 8);
+} else {
+expected_size = (c->bx * c->by * 2 + 3) & ~3;
+}
+if (avctx->pix_fmt == AV_PIX_FMT_PAL8 &&
+(c->flags & (ZMBV_DELTAPAL | ZMBV_KEYFRAME)))
+expected_size += 768;
 
 if (!c->decode_intra) {
 av_log(avctx, AV_LOG_ERROR, "Error! Got no format or no keyframe!\n");
@@ -533,6 +542,11 @@ static int decode_frame(AVCodecContext *avctx, void *data, 
int *got_frame, AVPac
 }
 c->decomp_len = c->zstream.total_out;
 }
+if (expected_size > c->decomp_len ||
+(c->flags & ZMBV_KEYFRAME) && expected_size < c->decomp_len) {
+av_log(avctx, AV_LOG_ERROR, "decompressed size %d is incorrect, 
expected %d\n", c->decomp_len, expected_size);
+return AVERROR_INVALIDDATA;
+}
 if (c->flags & ZMBV_KEYFRAME) {
 frame->key_frame = 1;
 frame->pict_type = AV_PICTURE_TYPE_I;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/utils: Fix integer overflow in discontinuity check

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Fri Oct 12 03:00:32 2018 +0200| [1e59d05e48f9e12aa50a3ad89d6a78c281997a6f] | 
committer: Michael Niedermayer

avformat/utils: Fix integer overflow in discontinuity check

Fixes: signed integer overflow: 7738135736989908991 - -7954308516317364223 
cannot be represented in type 'long'
Fixes: find_stream_info_usan

Reported-by: Thomas Guilbert 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 4e19cfcfa3944fe4cf97bea758f72f104dcaebad)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1e59d05e48f9e12aa50a3ad89d6a78c281997a6f
---

 libavformat/utils.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/utils.c b/libavformat/utils.c
index 4df9ba5665..0f6b0f6e53 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -3622,7 +3622,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
  * sequence, we treat it as a discontinuity. */
 if (st->info->fps_last_dts != AV_NOPTS_VALUE &&
 st->info->fps_last_dts_idx > st->info->fps_first_dts_idx &&
-(pkt->dts - st->info->fps_last_dts) / 1000 >
+(pkt->dts - (uint64_t)st->info->fps_last_dts) / 1000 >
 (st->info->fps_last_dts - 
(uint64_t)st->info->fps_first_dts) /
 (st->info->fps_last_dts_idx - st->info->fps_first_dts_idx)) {
 av_log(ic, AV_LOG_WARNING,

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avutil/integer: Fix integer overflow in av_mul_i()

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Wed Oct 24 01:44:12 2018 +0200| [72e1c43d6df5fc9952d11ee1b6cbd9431f71be50] | 
committer: Michael Niedermayer

avutil/integer: Fix integer overflow in av_mul_i()

Found-by: fate
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 3cc3cb663bf3061e40356392d2f7638de6a479fe)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=72e1c43d6df5fc9952d11ee1b6cbd9431f71be50
---

 libavutil/integer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavutil/integer.c b/libavutil/integer.c
index 6d6855fa1b..ba4aa778c9 100644
--- a/libavutil/integer.c
+++ b/libavutil/integer.c
@@ -74,7 +74,7 @@ AVInteger av_mul_i(AVInteger a, AVInteger b){
 
 if(a.v[i])
 for(j=i; j>16) + out.v[j] + a.v[i]*b.v[j-i];
+carry= (carry>>16) + out.v[j] + a.v[i]*(unsigned)b.v[j-i];
 out.v[j]= carry;
 }
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/jpeg2000dec: Fix off by 1 error in JPEG2000_PGOD_CPRL handling

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Sat Oct 20 22:35:37 2018 +0200| [98444e0222eda0d9e1a67ac28e2822434db4175e] | 
committer: Michael Niedermayer

avcodec/jpeg2000dec: Fix off by 1 error in JPEG2000_PGOD_CPRL handling

Fixes: assertion failure
Fixes: 
10785/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5672160496975872

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 305e523105f6f59e7572050f19edc9f4671c036c)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=98444e0222eda0d9e1a67ac28e2822434db4175e
---

 libavcodec/jpeg2000dec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
index f844d032a9..4d679a4999 100644
--- a/libavcodec/jpeg2000dec.c
+++ b/libavcodec/jpeg2000dec.c
@@ -1128,7 +1128,7 @@ static int 
jpeg2000_decode_packets_po_iteration(Jpeg2000DecoderContext *s, Jpeg2
 step_x = 32;
 step_y = 32;
 
-if (RSpoc > FFMIN(codsty->nreslevels, REpoc))
+if (RSpoc >= FFMIN(codsty->nreslevels, REpoc))
 continue;
 
 for (reslevelno = RSpoc; reslevelno < FFMIN(codsty->nreslevels, 
REpoc); reslevelno++) {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/zmbv: Update decomp_len in raw frames

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Mon Sep 17 21:33:59 2018 +0200| [bf4026fcbee8209b95d69d36cafb8fab63aeb442] | 
committer: Michael Niedermayer

avcodec/zmbv: Update decomp_len in raw frames

decomp_len is used in raw frames, so it should not be left at the value from
whatever was decoded previously (which may be any other frame)

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 3d201b83cda03fd9e866acafee82d7ce88260e66)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bf4026fcbee8209b95d69d36cafb8fab63aeb442
---

 libavcodec/zmbv.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libavcodec/zmbv.c b/libavcodec/zmbv.c
index f91d2e3931..1ec656be36 100644
--- a/libavcodec/zmbv.c
+++ b/libavcodec/zmbv.c
@@ -519,6 +519,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, 
int *got_frame, AVPac
 return AVERROR_INVALIDDATA;
 }
 memcpy(c->decomp_buf, buf, len);
+c->decomp_len = len;
 } else { // ZLIB-compressed data
 c->zstream.total_in = c->zstream.total_out = 0;
 c->zstream.next_in = (uint8_t*)buf;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/unary: Improve get_unary() docs

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Sat Sep 22 15:18:17 2018 +0200| [a9ce7cfc594916d55958a9e776104ad70a81fea5] | 
committer: Michael Niedermayer

avcodec/unary: Improve get_unary() docs

Found-by: kierank
Signed-off-by: Michael Niedermayer 
(cherry picked from commit ad89e203bfedf25df00e2a6ed9196170d772f25b)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a9ce7cfc594916d55958a9e776104ad70a81fea5
---

 libavcodec/unary.h | 15 ++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/libavcodec/unary.h b/libavcodec/unary.h
index 908dc93507..d57f9f70c5 100644
--- a/libavcodec/unary.h
+++ b/libavcodec/unary.h
@@ -28,7 +28,20 @@
  * @param gb GetBitContext
  * @param[in] stop The bitstop value (unary code of 1's or 0's)
  * @param[in] len Maximum length
- * @return Unary length/index
+ * @return unary 0 based code index. This is also the length in bits of the
+ * code excluding the stop bit.
+ * (in case len=1)
+ * 10
+ * 01
+ * (in case len=2)
+ * 10
+ * 01   1
+ * 00   2
+ * (in case len=3)
+ * 10
+ * 01   1
+ * 001  2
+ * 000  3
  */
 static inline int get_unary(GetBitContext *gb, int stop, int len)
 {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/h264_cavlc: Check mb_skip_run

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Thu Oct  4 03:13:41 2018 +0200| [65710b7e6c89131ed4ea9be7799b8a804505e4d0] | 
committer: Michael Niedermayer

avcodec/h264_cavlc: Check mb_skip_run

Fixes: 
10300/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-6292205497483264
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 
'int'

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit f72b9904fefa79d799d0f6ecc8bd97ce52658725)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=65710b7e6c89131ed4ea9be7799b8a804505e4d0
---

 libavcodec/h264_cavlc.c | 10 --
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/libavcodec/h264_cavlc.c b/libavcodec/h264_cavlc.c
index ffed204441..c88140650a 100644
--- a/libavcodec/h264_cavlc.c
+++ b/libavcodec/h264_cavlc.c
@@ -714,8 +714,14 @@ int ff_h264_decode_mb_cavlc(const H264Context *h, 
H264SliceContext *sl)
 cbp = 0; /* avoid warning. FIXME: find a solution without slowing
 down the code */
 if (sl->slice_type_nos != AV_PICTURE_TYPE_I) {
-if (sl->mb_skip_run == -1)
-sl->mb_skip_run = get_ue_golomb_long(&sl->gb);
+if (sl->mb_skip_run == -1) {
+unsigned mb_skip_run = get_ue_golomb_long(&sl->gb);
+if (mb_skip_run > h->mb_num) {
+av_log(h->avctx, AV_LOG_ERROR, "mb_skip_run %d is invalid\n", 
mb_skip_run);
+return AVERROR_INVALIDDATA;
+}
+sl->mb_skip_run = mb_skip_run;
+}
 
 if (sl->mb_skip_run--) {
 if (FRAME_MBAFF(h) && (sl->mb_y & 1) == 0) {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/mpeg4videodec: Fix undefined shift in get_amv()

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Sat Sep 15 00:20:38 2018 +0200| [43a80efee600d75b5ae9efe52f36303dabfb81bb] | 
committer: Michael Niedermayer

avcodec/mpeg4videodec: Fix undefined shift in get_amv()

Fixes: runtime error: shift exponent -1 is negative
Fixes: 
9938/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5653783529914368

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit c88afa44c4823aba7b6f4a1b01fd6a4169643c57)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=43a80efee600d75b5ae9efe52f36303dabfb81bb
---

 libavcodec/mpeg4videodec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c
index 319a3809ea..91a0d726f9 100644
--- a/libavcodec/mpeg4videodec.c
+++ b/libavcodec/mpeg4videodec.c
@@ -539,7 +539,7 @@ static inline int get_amv(Mpeg4DecContext *ctx, int n)
 len >>= s->quarter_sample;
 
 if (s->real_sprite_warping_points == 1) {
-if (ctx->divx_version == 500 && ctx->divx_build == 413)
+if (ctx->divx_version == 500 && ctx->divx_build == 413 && a >= 
s->quarter_sample)
 sum = s->sprite_offset[0][n] / (1 << (a - s->quarter_sample));
 else
 sum = RSHIFT(s->sprite_offset[0][n] * (1 << s->quarter_sample), a);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/shorten: Fix bitstream end check in read_header()

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Sat Sep 15 02:08:20 2018 +0200| [3c3b437d794703e4172a08b82067612b45f3747e] | 
committer: Michael Niedermayer

avcodec/shorten: Fix bitstream end check in read_header()

Fixes: Timeout
Fixes: 
9961/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5687856176562176

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 28b80c2d52d82eb4f73af5f818dab60946bcf299)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3c3b437d794703e4172a08b82067612b45f3747e
---

 libavcodec/shorten.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/shorten.c b/libavcodec/shorten.c
index c63be626ba..fa5ed3b64b 100644
--- a/libavcodec/shorten.c
+++ b/libavcodec/shorten.c
@@ -456,7 +456,7 @@ static int read_header(ShortenContext *s)
 }
 
 skip_bytes = get_uint(s, NSKIPSIZE);
-if ((unsigned)skip_bytes > get_bits_left(&s->gb)/8) {
+if ((unsigned)skip_bytes > FFMAX(get_bits_left(&s->gb), 0)/8) {
 av_log(s->avctx, AV_LOG_ERROR, "invalid skip_bytes: %d\n", 
skip_bytes);
 return AVERROR_INVALIDDATA;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/msrle: Check that the input is large enough to contain a end of picture code

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Sun Oct 21 14:40:14 2018 +0200| [2405af5081a906cacc053ac4c59b13ef724cd094] | 
committer: Michael Niedermayer

avcodec/msrle: Check that the input is large enough to contain a end of picture 
code

Fixes: Timeout
Fixes: 
10625/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSRLE_fuzzer-5659651283091456

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 203ccb874699ce66beadd53b4631d217b9cd)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2405af5081a906cacc053ac4c59b13ef724cd094
---

 libavcodec/msrle.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavcodec/msrle.c b/libavcodec/msrle.c
index adb55b1302..1ab8a41985 100644
--- a/libavcodec/msrle.c
+++ b/libavcodec/msrle.c
@@ -95,6 +95,9 @@ static int msrle_decode_frame(AVCodecContext *avctx,
 s->buf = buf;
 s->size = buf_size;
 
+if (buf_size < 2) //Minimally a end of picture code should be there
+return AVERROR_INVALIDDATA;
+
 if ((ret = ff_reget_buffer(avctx, s->frame)) < 0)
 return ret;
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/mpeg4videodec: Fix typo in sprite delta check

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Thu Oct 18 01:19:36 2018 +0200| [947f7af04821555f6ee935e5735560daabbe9a14] | 
committer: Michael Niedermayer

avcodec/mpeg4videodec: Fix typo in sprite delta check

Fixes: Integer overflow
Fixes: 
10890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5636062181851136

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit b737317a8813e671c00b8ac7023c47e48ffeb1c8)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=947f7af04821555f6ee935e5735560daabbe9a14
---

 libavcodec/mpeg4videodec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c
index 91a0d726f9..d241c58e8a 100644
--- a/libavcodec/mpeg4videodec.c
+++ b/libavcodec/mpeg4videodec.c
@@ -392,7 +392,7 @@ static int mpeg4_decode_sprite_trajectory(Mpeg4DecContext 
*ctx, GetBitContext *g
 llabs(sprite_offset[0][i] + sprite_delta[i][1] * (h+16LL)) >= 
INT_MAX ||
 llabs(sprite_offset[0][i] + sprite_delta[i][0] * (w+16LL) + 
sprite_delta[i][1] * (h+16LL)) >= INT_MAX ||
 llabs(sprite_delta[i][0] * (w+16LL)) >= INT_MAX ||
-llabs(sprite_delta[i][1] * (w+16LL)) >= INT_MAX ||
+llabs(sprite_delta[i][1] * (h+16LL)) >= INT_MAX ||
 llabs(sd[0]) >= INT_MAX ||
 llabs(sd[1]) >= INT_MAX ||
 llabs(sprite_offset[0][i] + sd[0] * (w+16LL)) >= INT_MAX ||

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/dvdsubdec: Avoid branch in decode_run_8bit()

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Thu Sep 13 04:24:49 2018 +0200| [46875255bc957832bbd3cabf593471c5a16f2e55] | 
committer: Michael Niedermayer

avcodec/dvdsubdec: Avoid branch in decode_run_8bit()

Speed improvment 35.5 sec -> 34.7sec

Reviewed-by: Paul B Mahol 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 71bf0330505e2108935d05c5c018ec65eac4b946)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=46875255bc957832bbd3cabf593471c5a16f2e55
---

 libavcodec/dvdsubdec.c | 5 +
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/libavcodec/dvdsubdec.c b/libavcodec/dvdsubdec.c
index e18113c20c..a5107096df 100644
--- a/libavcodec/dvdsubdec.c
+++ b/libavcodec/dvdsubdec.c
@@ -82,10 +82,7 @@ static int decode_run_8bit(GetBitContext *gb, int *color)
 {
 int len;
 int has_run = get_bits1(gb);
-if (get_bits1(gb))
-*color = get_bits(gb, 8);
-else
-*color = get_bits(gb, 2);
+*color = get_bits(gb, 2 + 6*get_bits1(gb));
 if (has_run) {
 if (get_bits1(gb)) {
 len = get_bits(gb, 7);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/utils: Never store negative values in last_IP_duration

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Fri Oct 12 20:55:25 2018 +0200| [a1f4fe165a4063433d1f0472b3ed5dbf15130b96] | 
committer: Michael Niedermayer

avformat/utils: Never store negative values in last_IP_duration

Fixes: integer overflow compute_pkt_fields()
Fixes: compute_pkt_usan

Reported-by: Thomas Guilbert 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 079d1a7175c4b881631a7e7f449c4c13b761cdeb)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a1f4fe165a4063433d1f0472b3ed5dbf15130b96
---

 libavformat/utils.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/libavformat/utils.c b/libavformat/utils.c
index 0f6b0f6e53..362497d284 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -1311,7 +1311,7 @@ static void compute_pkt_fields(AVFormatContext *s, 
AVStream *st,
 
 /* This is tricky: the dts must be incremented by the duration
  * of the frame we are displaying, i.e. the last I- or P-frame. */
-if (st->last_IP_duration == 0)
+if (st->last_IP_duration == 0 && (uint64_t)pkt->duration <= 
INT32_MAX)
 st->last_IP_duration = pkt->duration;
 if (pkt->dts != AV_NOPTS_VALUE)
 st->cur_dts = pkt->dts + st->last_IP_duration;
@@ -1323,7 +1323,8 @@ static void compute_pkt_fields(AVFormatContext *s, 
AVStream *st,
 next_pts != AV_NOPTS_VALUE)
 pkt->pts = next_dts;
 
-st->last_IP_duration = pkt->duration;
+if ((uint64_t)pkt->duration <= INT32_MAX)
+st->last_IP_duration = pkt->duration;
 st->last_IP_pts  = pkt->pts;
 /* Cannot compute PTS if not present (we can compute it only
  * by knowing the future. */

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/dvdsubdec: Sanity check len in decode_rle()

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Thu Sep 13 03:33:50 2018 +0200| [6177ed2a9b703bca232d466e90120bd74860a771] | 
committer: Michael Niedermayer

avcodec/dvdsubdec: Sanity check len in decode_rle()

Fixes: Timeout
Fixes: 
9778/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVDSUB_fuzzer-5186007132536832

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit e7b023e1db9fb13175929c02a02846d03510ec91)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6177ed2a9b703bca232d466e90120bd74860a771
---

 libavcodec/dvdsubdec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/dvdsubdec.c b/libavcodec/dvdsubdec.c
index a5107096df..cf10844753 100644
--- a/libavcodec/dvdsubdec.c
+++ b/libavcodec/dvdsubdec.c
@@ -124,6 +124,8 @@ static int decode_rle(uint8_t *bitmap, int linesize, int w, 
int h,
 len = decode_run_8bit(&gb, &color);
 else
 len = decode_run_2bit(&gb, &color);
+if (len != INT_MAX && len > w - x)
+return AVERROR_INVALIDDATA;
 len = FFMIN(len, w - x);
 memset(d + x, color, len);
 x += len;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/ra144: Fix integer overflow in add_wav()

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Wed Oct 10 04:25:50 2018 +0200| [caddb7890aa68dcce7b0a8df9491a82389cacb47] | 
committer: Michael Niedermayer

avcodec/ra144: Fix integer overflow in add_wav()

Fixes: signed integer overflow: -2144033225 + -5208934 cannot be represented in 
type 'int'
Fixes: 
10633/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-5679133791617024

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit c6282141cba20934d9801f31134872fabbd6ba3e)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=caddb7890aa68dcce7b0a8df9491a82389cacb47
---

 libavcodec/ra144.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/ra144.c b/libavcodec/ra144.c
index 573703d70b..65a744876c 100644
--- a/libavcodec/ra144.c
+++ b/libavcodec/ra144.c
@@ -1516,7 +1516,7 @@ static void add_wav(int16_t *dest, int n, int skip_first, 
int *m,
 
 if (v[0]) {
 for (i=0; i < BLOCKSIZE; i++)
-dest[i] = ((int)(s1[i]*(unsigned)v[0]) + s2[i]*v[1] + s3[i]*v[2]) 
>> 12;
+dest[i] = (int)((s1[i]*(unsigned)v[0]) + s2[i]*v[1] + s3[i]*v[2]) 
>> 12;
 } else {
 for (i=0; i < BLOCKSIZE; i++)
 dest[i] = ( s2[i]*v[1] + s3[i]*v[2]) >> 12;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/diracdec: Prevent integer overflow in intermediate in global_mv()

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Sun Jul 22 18:58:34 2018 +0200| [922a29142e77221f685e875e14435abf7a691f5c] | 
committer: Michael Niedermayer

avcodec/diracdec: Prevent integer overflow in intermediate in global_mv()

Fixes: signed integer overflow: -393471 * 5460 cannot be represented in type 
'int'
Fixes: 
8890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-6299775379963904

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 51290406461ed40b70e0e05b389a461a283f3367)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=922a29142e77221f685e875e14435abf7a691f5c
---

 libavcodec/diracdec.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/diracdec.c b/libavcodec/diracdec.c
index fee2b7787c..5d63464f6c 100644
--- a/libavcodec/diracdec.c
+++ b/libavcodec/diracdec.c
@@ -1399,8 +1399,8 @@ static void global_mv(DiracContext *s, DiracBlock *block, 
int x, int y, int ref)
 int *c  = s->globalmc[ref].perspective;
 
 int m   = (1> (ez+ep);
 block->u.mv[ref][1] = (my + (1<<(ez+ep))) >> (ez+ep);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/nsvdec: Do not parse multiple NSVf

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Thu Aug 16 12:23:20 2018 +0200| [b80d7d4a092048251336806095138ae5f495bad4] | 
committer: Michael Niedermayer

avformat/nsvdec: Do not parse multiple NSVf

The specification states "NSV files may contain a single file header. "
Fixes: out of array access
Fixes: nsv-asan-002f473f726a0dcbd3bd53e422c4fc40b3cf3421

Found-by: Paul Ch 
Tested-by: Paul Ch 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 78d4b6bd43fc266a2ee926f0555c8782246f9445)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b80d7d4a092048251336806095138ae5f495bad4
---

 libavformat/nsvdec.c | 7 +++
 1 file changed, 7 insertions(+)

diff --git a/libavformat/nsvdec.c b/libavformat/nsvdec.c
index d8ce656817..92f7d178f6 100644
--- a/libavformat/nsvdec.c
+++ b/libavformat/nsvdec.c
@@ -176,6 +176,7 @@ typedef struct NSVContext {
 int16_t avsync;
 AVRational framerate;
 uint32_t *nsvs_timestamps;
+int nsvf;
 } NSVContext;
 
 static const AVCodecTag nsv_codec_video_tags[] = {
@@ -266,6 +267,12 @@ static int nsv_parse_NSVf_header(AVFormatContext *s)
 
 nsv->state = NSV_UNSYNC; /* in case we fail */
 
+if (nsv->nsvf) {
+av_log(s, AV_LOG_TRACE, "Multiple NSVf\n");
+return 0;
+}
+nsv->nsvf = 1;
+
 size = avio_rl32(pb);
 if (size < 28)
 return -1;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/mov: Error on too large stsd entry counts.

[Dale Curtis]

ffmpeg | branch: release/3.3 | Dale Curtis  | Thu Aug 
30 15:18:25 2018 -0700| [1acec9bbf55b9d53c20e8d2f147458262abdc28f] | committer: 
Michael Niedermayer

avformat/mov: Error on too large stsd entry counts.

Entries are always at least 8 bytes per the parsing code, so if we
see an impossible entry count avoid massive allocations. This is
similar to an existing check in mov_read_stsc().

Since ff_mov_read_stsd_entries() does eof checks, an alternative
approach could be to clamp the entry count to atom.size / 8.

Signed-off-by: Dale Curtis 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 320b631a99a9f759fd1d5460fd4e285d184b8186)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1acec9bbf55b9d53c20e8d2f147458262abdc28f
---

 libavformat/mov.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index f6db8a47b7..f4687db54e 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -2356,7 +2356,8 @@ static int mov_read_stsd(MOVContext *c, AVIOContext *pb, 
MOVAtom atom)
 avio_rb24(pb); /* flags */
 entries = avio_rb32(pb);
 
-if (entries <= 0) {
+/* Each entry contains a size (4 bytes) and format (4 bytes). */
+if (entries <= 0 || entries > atom.size / 8) {
 av_log(c->fc, AV_LOG_ERROR, "invalid STSD entries %d\n", entries);
 return AVERROR_INVALIDDATA;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/shorten: Fix signed 32bit overflow in shift in shorten_decode_frame()

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Sun Aug 12 23:06:55 2018 +0200| [298ca73ab14ba66fec0596fef1eda92a532a488d] | 
committer: Michael Niedermayer

avcodec/shorten: Fix signed 32bit overflow in shift in shorten_decode_frame()

Fixes: runtime error: left shift of 1 by 31 places cannot be represented in 
type 'int'
Fixes: 
9480/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-6647324284551168
 -rss_limit_mb=2000

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 9b604e96a51a1fca92bbabfe4f7ac53f0470ee41)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=298ca73ab14ba66fec0596fef1eda92a532a488d
---

 libavcodec/shorten.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/shorten.c b/libavcodec/shorten.c
index ad83dfb199..c63be626ba 100644
--- a/libavcodec/shorten.c
+++ b/libavcodec/shorten.c
@@ -711,7 +711,7 @@ static int shorten_decode_frame(AVCodecContext *avctx, void 
*data,
 if (s->version < 2)
 s->offset[channel][s->nmean - 1] = sum / s->blocksize;
 else
-s->offset[channel][s->nmean - 1] = s->bitshift == 32 ? 0 : 
(sum / s->blocksize) * (1 << s->bitshift);
+s->offset[channel][s->nmean - 1] = s->bitshift == 32 ? 0 : 
(sum / s->blocksize) * (1LL << s->bitshift);
 }
 
 /* copy wrap samples for use with next block */

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/mpegaudio_parser: Initialize poutbuf*

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Sun Aug  5 14:51:36 2018 +0200| [0ea1b62b9ac50739b12b9d72c991456ed2f2d192] | 
committer: Michael Niedermayer

avcodec/mpegaudio_parser: Initialize poutbuf*

Possibly fixes: null pointer dereference
Possibly fixes: 
9352/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP3ADUFLOAT_fuzzer-5146068961460224
Fixes: Heap-use-after-free
Fixes: 
9453/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP3ADUFLOAT_fuzzer-5137954375729152

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 0f4c3b0b8e5435d13fd3b64c91969b31c3c018dc)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0ea1b62b9ac50739b12b9d72c991456ed2f2d192
---

 libavcodec/mpegaudio_parser.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/mpegaudio_parser.c b/libavcodec/mpegaudio_parser.c
index 8c39825792..a072851ecf 100644
--- a/libavcodec/mpegaudio_parser.c
+++ b/libavcodec/mpegaudio_parser.c
@@ -98,6 +98,8 @@ static int mpegaudio_parse(AVCodecParserContext *s1,
 } else if (codec_id == AV_CODEC_ID_MP3ADU) {
 avpriv_report_missing_feature(avctx,
 "MP3ADU full parser");
+*poutbuf = NULL;
+*poutbuf_size = 0;
 return 0; /* parsers must not return error codes */
 }
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/diracdec: Change frame_number to 64bit as its a 32bit from the bitstream and we also have a -1 special case

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Sun Jul 22 20:45:39 2018 +0200| [ee5b42ce2f2f45a28d12643cf86538f7a7535d47] | 
committer: Michael Niedermayer

avcodec/diracdec: Change frame_number to 64bit as its a 32bit from the 
bitstream and we also have a -1 special case

Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 
'int'
Fixes: 
9291/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-6324345860259840

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 462d1be6dec5ff4768be8c202f359cbf037db3c6)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ee5b42ce2f2f45a28d12643cf86538f7a7535d47
---

 libavcodec/diracdec.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/diracdec.c b/libavcodec/diracdec.c
index 5d63464f6c..eeaa8f4498 100644
--- a/libavcodec/diracdec.c
+++ b/libavcodec/diracdec.c
@@ -140,7 +140,7 @@ typedef struct DiracContext {
 GetBitContext gb;
 AVDiracSeqHeader seq;
 int seen_sequence_header;
-int frame_number;   /* number of the next frame to display   */
+int64_t frame_number;   /* number of the next frame to display   */
 Plane plane[3];
 int chroma_x_shift;
 int chroma_y_shift;
@@ -2300,7 +2300,7 @@ static int dirac_decode_frame(AVCodecContext *avctx, void 
*data, int *got_frame,
 }
 
 if (*got_frame)
-s->frame_number = picture->display_picture_number + 1;
+s->frame_number = picture->display_picture_number + 1LL;
 
 return buf_idx;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/indeo4: Check dimensions in decode_pic_hdr()

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Sun Aug 26 01:58:32 2018 +0200| [78a1db00c4c41258791c8ff9d5bc1adcc176cf69] | 
committer: Michael Niedermayer

avcodec/indeo4: Check dimensions in decode_pic_hdr()

Fixes: Timeout
Fixes: 
9654/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-6289863463665664

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 7592e88bfe3d5bf9109a55acd025af9110618405)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=78a1db00c4c41258791c8ff9d5bc1adcc176cf69
---

 libavcodec/indeo4.c | 8 
 1 file changed, 8 insertions(+)

diff --git a/libavcodec/indeo4.c b/libavcodec/indeo4.c
index 199af1a3c2..eee868cb7c 100644
--- a/libavcodec/indeo4.c
+++ b/libavcodec/indeo4.c
@@ -30,6 +30,7 @@
 #define BITSTREAM_READER_LE
 #include "avcodec.h"
 #include "get_bits.h"
+#include "libavutil/imgutils.h"
 #include "indeo4data.h"
 #include "internal.h"
 #include "ivi.h"
@@ -178,6 +179,13 @@ static int decode_pic_hdr(IVI45DecContext *ctx, 
AVCodecContext *avctx)
 pic_conf.chroma_bands = 0;
 if (pic_conf.luma_bands)
 pic_conf.chroma_bands = decode_plane_subdivision(&ctx->gb);
+
+if (av_image_check_size2(pic_conf.pic_width, pic_conf.pic_height, 
avctx->max_pixels, AV_PIX_FMT_YUV410P, 0, avctx) < 0) {
+av_log(avctx, AV_LOG_ERROR, "picture dimensions %d %d cannot be 
decoded\n",
+   pic_conf.pic_width, pic_conf.pic_height);
+return AVERROR_INVALIDDATA;
+}
+
 ctx->is_scalable = pic_conf.luma_bands != 1 || pic_conf.chroma_bands != 1;
 if (ctx->is_scalable && (pic_conf.luma_bands != 4 || pic_conf.chroma_bands 
!= 1)) {
 av_log(avctx, AV_LOG_ERROR, "Scalability: unsupported subdivision! 
Luma bands: %d, chroma bands: %d\n",

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/flvenc: Check audio packet size

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Sat Jul 28 15:03:50 2018 +0200| [0026d007428a1ef5cd4e8f54bafc54c0306beab9] | 
committer: Michael Niedermayer

avformat/flvenc: Check audio packet size

Fixes: Assertion failure
Fixes: assert_flvenc.c:941_1.swf

Found-by: #CHEN HONGXU# 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 6b67d7f05918f7a1ee8fc6ff21355d7e8736aa10)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0026d007428a1ef5cd4e8f54bafc54c0306beab9
---

 libavformat/flvenc.c | 5 +
 1 file changed, 5 insertions(+)

diff --git a/libavformat/flvenc.c b/libavformat/flvenc.c
index 899b07ea7b..e966c36c65 100644
--- a/libavformat/flvenc.c
+++ b/libavformat/flvenc.c
@@ -879,6 +879,11 @@ static int flv_write_packet(AVFormatContext *s, AVPacket 
*pkt)
 int flags = -1, flags_size, ret;
 int64_t cur_offset = avio_tell(pb);
 
+if (par->codec_type == AVMEDIA_TYPE_AUDIO && !pkt->size) {
+av_log(s, AV_LOG_WARNING, "Empty audio Packet\n");
+return AVERROR(EINVAL);
+}
+
 if (par->codec_id == AV_CODEC_ID_VP6F || par->codec_id == AV_CODEC_ID_VP6A 
||
 par->codec_id == AV_CODEC_ID_VP6  || par->codec_id == AV_CODEC_ID_AAC)
 flags_size = 2;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/hq_hqa: Check remaining input bits in hqa_decode_mb()

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Mon Aug 20 22:53:32 2018 +0200| [66331499a7d221d5053f74452c976b2d8f2038f6] | 
committer: Michael Niedermayer

avcodec/hq_hqa: Check remaining input bits in hqa_decode_mb()

Fixes: Timeout
Fixes: 
9634/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-6267852259590144

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit c9222b972d6cbdaf6571cf7ae0a6513bffa5ff9f)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=66331499a7d221d5053f74452c976b2d8f2038f6
---

 libavcodec/hq_hqa.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavcodec/hq_hqa.c b/libavcodec/hq_hqa.c
index f88ad7d5f5..ec9da3e04f 100644
--- a/libavcodec/hq_hqa.c
+++ b/libavcodec/hq_hqa.c
@@ -181,6 +181,9 @@ static int hqa_decode_mb(HQContext *c, AVFrame *pic, int 
qgroup,
 int flag = 0;
 int i, ret, cbp;
 
+if (get_bits_left(gb) < 1)
+return AVERROR_INVALIDDATA;
+
 cbp = get_vlc2(gb, c->hqa_cbp_vlc.table, 5, 1);
 
 for (i = 0; i < 12; i++)

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/vb: Check for end of bytestream before reading blocktype

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Mon Aug 20 22:19:23 2018 +0200| [347c50b0d4e7119e77edcd0871b5d9c841877af4] | 
committer: Michael Niedermayer

avcodec/vb: Check for end of bytestream before reading blocktype

Fixes: Timeout
Fixes: 
9601/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VB_fuzzer-4550228702134272

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 1cbac9ce20d32806febf64cbd9f830e1485695ca)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=347c50b0d4e7119e77edcd0871b5d9c841877af4
---

 libavcodec/vb.c | 4 
 1 file changed, 4 insertions(+)

diff --git a/libavcodec/vb.c b/libavcodec/vb.c
index 021657f7d8..c6dd6fb456 100644
--- a/libavcodec/vb.c
+++ b/libavcodec/vb.c
@@ -107,6 +107,10 @@ static int vb_decode_framedata(VBDecContext *c, int offset)
 blk2   = 0;
 for (blk = 0; blk < blocks; blk++) {
 if (!(blk & 3)) {
+if (bytestream2_get_bytes_left(&g) < 1) {
+av_log(c->avctx, AV_LOG_ERROR, "Insufficient data\n");
+return AVERROR_INVALIDDATA;
+}
 blocktypes = bytestream2_get_byte(&g);
 }
 switch (blocktypes & 0xC0) {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/mlvdec: read_string() received unsigned size, make the argument unsigned

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Thu Aug 16 15:36:28 2018 +0200| [24add16a323630d38be67203b2272b951ce68575] | 
committer: Michael Niedermayer

avformat/mlvdec: read_string() received unsigned size, make the argument 
unsigned

Fixes: infinite loop
Fixes: mlv-timeout-e3b8cab9835edecad6823baa057e029671329d04

Found-by: Paul Ch 
Reviewed-by: Paul B Mahol 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 1e71cb2c8edcf3dad657c15a6fb8572862f2afb9)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=24add16a323630d38be67203b2272b951ce68575
---

 libavformat/mlvdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/mlvdec.c b/libavformat/mlvdec.c
index 319cd26de4..6d774a191d 100644
--- a/libavformat/mlvdec.c
+++ b/libavformat/mlvdec.c
@@ -77,7 +77,7 @@ static int check_file_header(AVIOContext *pb, uint64_t guid)
 return 0;
 }
 
-static void read_string(AVFormatContext *avctx, AVIOContext *pb, const char 
*tag, int size)
+static void read_string(AVFormatContext *avctx, AVIOContext *pb, const char 
*tag, unsigned size)
 {
 char * value = av_malloc(size + 1);
 if (!value) {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/h264_refs: Document last if() in ff_h264_execute_ref_pic_marking()

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Fri Aug 17 02:06:27 2018 +0200| [fa5498cb4dae73d4cf733e1578851547d17f1716] | 
committer: Michael Niedermayer

avcodec/h264_refs: Document last if() in ff_h264_execute_ref_pic_marking()

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 697984b9db4d4d199680f43ac3eb662cd1d37eff)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=fa5498cb4dae73d4cf733e1578851547d17f1716
---

 libavcodec/h264_refs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libavcodec/h264_refs.c b/libavcodec/h264_refs.c
index af70829594..2cdb67f978 100644
--- a/libavcodec/h264_refs.c
+++ b/libavcodec/h264_refs.c
@@ -806,6 +806,7 @@ int ff_h264_execute_ref_pic_marking(H264Context *h)
 }
 }
 
+// Detect unmarked random access points
 if (   err >= 0
 && h->long_ref_count==0
 && (   h->short_ref_count<=2

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/ra144: Fix undefined integer overflow in add_wav()

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Sun Aug 26 02:26:24 2018 +0200| [5c91bb1881a88980ad19e40d2fcadbfe0eacef6a] | 
committer: Michael Niedermayer

avcodec/ra144: Fix undefined integer overflow in add_wav()

Fixes: signed integer overflow: -26884 * 91439 cannot be represented in type 
'int'
Fixes: 
9687/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-4995588121690112

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 93a203662f6ff1bb9fd2e966bf7df27e9bdb1916)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5c91bb1881a88980ad19e40d2fcadbfe0eacef6a
---

 libavcodec/ra144.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/ra144.c b/libavcodec/ra144.c
index cf8127c236..573703d70b 100644
--- a/libavcodec/ra144.c
+++ b/libavcodec/ra144.c
@@ -1516,7 +1516,7 @@ static void add_wav(int16_t *dest, int n, int skip_first, 
int *m,
 
 if (v[0]) {
 for (i=0; i < BLOCKSIZE; i++)
-dest[i] = (s1[i]*v[0] + s2[i]*v[1] + s3[i]*v[2]) >> 12;
+dest[i] = ((int)(s1[i]*(unsigned)v[0]) + s2[i]*v[1] + s3[i]*v[2]) 
>> 12;
 } else {
 for (i=0; i < BLOCKSIZE; i++)
 dest[i] = ( s2[i]*v[1] + s3[i]*v[2]) >> 12;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/scpr: Check for min > max in decompress_p()

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Sat Aug  4 23:45:52 2018 +0200| [907699d1207f50f3a0f9c96443ffbde71bb580e5] | 
committer: Michael Niedermayer

avcodec/scpr: Check for min > max in decompress_p()

Fixes: Timeout
Fixes: 
9342/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-4795990841229312

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 3378194ce8e9a126a7cc6ed57bedde1221790469)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=907699d1207f50f3a0f9c96443ffbde71bb580e5
---

 libavcodec/scpr.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavcodec/scpr.c b/libavcodec/scpr.c
index 694450abf0..f286ca8575 100644
--- a/libavcodec/scpr.c
+++ b/libavcodec/scpr.c
@@ -522,6 +522,9 @@ static int decompress_p(AVCodecContext *avctx,
 return ret;
 
 max += temp << 8;
+if (min > max)
+return AVERROR_INVALIDDATA;
+
 memset(s->blocks, 0, sizeof(*s->blocks) * s->nbcount);
 
 while (min <= max) {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/rmdec: Fix EOF check in the stream loop in ivr_read_header()

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Thu Aug 16 15:36:29 2018 +0200| [44ebea8657e2c786b8b22ebee69d97a2b0efd07f] | 
committer: Michael Niedermayer

avformat/rmdec: Fix EOF check in the stream loop in ivr_read_header()

Fixes: long running loop
Fixes: ivr-timeout-42468cb797f52f025fb329394702f5d4d64322d6

Found-by: Paul Ch 
Reviewed-by: Paul B Mahol 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit c2eec1762d372663c35aaf3d6ee419bafb185057)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=44ebea8657e2c786b8b22ebee69d97a2b0efd07f
---

 libavformat/rmdec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index 3eb49a5d29..f3fa550c63 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -1270,6 +1270,8 @@ static int ivr_read_header(AVFormatContext *s)
 if (avio_rb32(pb) == MKBETAG('M', 'L', 'T', 'I')) {
 ret = rm_read_multi(s, pb, st, NULL);
 } else {
+if (avio_feof(pb))
+return AVERROR_INVALIDDATA;
 avio_seek(pb, -4, SEEK_CUR);
 ret = ff_rm_read_mdpr_codecdata(s, pb, st, st->priv_data, 
len, NULL);
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] examples: Fix use of AV_CODEC_FLAG_GLOBAL_HEADER

[Michael Bunk]

ffmpeg | branch: release/3.3 | Michael Bunk  | Thu Aug 
30 08:56:19 2018 +0200| [7266a6d23c8943d76cf1e056671c9a8bd9902069] | committer: 
Michael Niedermayer

examples: Fix use of AV_CODEC_FLAG_GLOBAL_HEADER

AV_CODEC_FLAG_GLOBAL_HEADER should be set before calling avcodec_open2() to 
have any effect.

Signed-off-by: Michael Niedermayer 
(cherry picked from commit a82e4fb8c6f26e75506df6818fee1b61f940cbeb)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7266a6d23c8943d76cf1e056671c9a8bd9902069
---

 doc/examples/transcoding.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/doc/examples/transcoding.c b/doc/examples/transcoding.c
index 476ec69afe..0e2fe0a4a1 100644
--- a/doc/examples/transcoding.c
+++ b/doc/examples/transcoding.c
@@ -173,6 +173,9 @@ static int open_output_file(const char *filename)
 enc_ctx->time_base = (AVRational){1, enc_ctx->sample_rate};
 }
 
+if (ofmt_ctx->oformat->flags & AVFMT_GLOBALHEADER)
+enc_ctx->flags |= AV_CODEC_FLAG_GLOBAL_HEADER;
+
 /* Third parameter can be used to pass settings to encoder */
 ret = avcodec_open2(enc_ctx, encoder, NULL);
 if (ret < 0) {
@@ -184,8 +187,6 @@ static int open_output_file(const char *filename)
 av_log(NULL, AV_LOG_ERROR, "Failed to copy encoder parameters 
to output stream #%u\n", i);
 return ret;
 }
-if (ofmt_ctx->oformat->flags & AVFMT_GLOBALHEADER)
-enc_ctx->flags |= AV_CODEC_FLAG_GLOBAL_HEADER;
 
 out_stream->time_base = enc_ctx->time_base;
 stream_ctx[i].enc_ctx = enc_ctx;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/snowdec: Fix integer overflow with motion vector residual

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Mon Aug 20 20:15:19 2018 +0200| [dc8ec1a5bc8539339f866c77f1f1b917b6a4e125] | 
committer: Michael Niedermayer

avcodec/snowdec: Fix integer overflow with motion vector residual

Fixes: signed integer overflow: -19818 + -2147483648 cannot be represented in 
type 'int'
Fixes: 
9545/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-4928769537081344

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit acba153a148782c08f9fd17f0c05b93468f3cbd0)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=dc8ec1a5bc8539339f866c77f1f1b917b6a4e125
---

 libavcodec/snowdec.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/snowdec.c b/libavcodec/snowdec.c
index 00fa064102..a9fe91d251 100644
--- a/libavcodec/snowdec.c
+++ b/libavcodec/snowdec.c
@@ -208,8 +208,8 @@ static int decode_q_branch(SnowContext *s, int level, int 
x, int y){
 return AVERROR_INVALIDDATA;
 }
 pred_mv(s, &mx, &my, ref, left, top, tr);
-mx+= get_symbol(&s->c, &s->block_state[128 + 32*(mx_context + 
16*!!ref)], 1);
-my+= get_symbol(&s->c, &s->block_state[128 + 32*(my_context + 
16*!!ref)], 1);
+mx+= (unsigned)get_symbol(&s->c, &s->block_state[128 + 
32*(mx_context + 16*!!ref)], 1);
+my+= (unsigned)get_symbol(&s->c, &s->block_state[128 + 
32*(my_context + 16*!!ref)], 1);
 }
 set_blocks(s, level, x, y, l, cb, cr, mx, my, ref, type);
 }else{

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/qtrle: Check remaining bytestream in qtrle_decode_XYbpp()

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Sun Jul 29 12:40:48 2018 +0200| [1e1c02c51b3bab52753fd09ecaea0a852df1a623] | 
committer: Michael Niedermayer

avcodec/qtrle: Check remaining bytestream in qtrle_decode_XYbpp()

Fixes: Timeout
Fixes: 
9213/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QTRLE_fuzzer-5649753332252672

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 7dd836a3f9771e0e44df1b27e67d6866d91e06d7)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1e1c02c51b3bab52753fd09ecaea0a852df1a623
---

 libavcodec/qtrle.c | 10 ++
 1 file changed, 10 insertions(+)

diff --git a/libavcodec/qtrle.c b/libavcodec/qtrle.c
index 1b0d2016b5..cd8301d143 100644
--- a/libavcodec/qtrle.c
+++ b/libavcodec/qtrle.c
@@ -155,6 +155,8 @@ static inline void qtrle_decode_2n4bpp(QtrleContext *s, int 
row_ptr,
 CHECK_PIXEL_PTR(0);
 
 while ((rle_code = (int8_t)bytestream2_get_byte(&s->g)) != -1) {
+if (bytestream2_get_bytes_left(&s->g) < 1)
+return;
 if (rle_code == 0) {
 /* there's another skip code in the stream */
 pixel_ptr += (num_pixels * (bytestream2_get_byte(&s->g) - 1));
@@ -210,6 +212,8 @@ static void qtrle_decode_8bpp(QtrleContext *s, int row_ptr, 
int lines_to_change)
 CHECK_PIXEL_PTR(0);
 
 while ((rle_code = (int8_t)bytestream2_get_byte(&s->g)) != -1) {
+if (bytestream2_get_bytes_left(&s->g) < 1)
+return;
 if (rle_code == 0) {
 /* there's another skip code in the stream */
 pixel_ptr += (4 * (bytestream2_get_byte(&s->g) - 1));
@@ -259,6 +263,8 @@ static void qtrle_decode_16bpp(QtrleContext *s, int 
row_ptr, int lines_to_change
 CHECK_PIXEL_PTR(0);
 
 while ((rle_code = (int8_t)bytestream2_get_byte(&s->g)) != -1) {
+if (bytestream2_get_bytes_left(&s->g) < 1)
+return;
 if (rle_code == 0) {
 /* there's another skip code in the stream */
 pixel_ptr += (bytestream2_get_byte(&s->g) - 1) * 2;
@@ -303,6 +309,8 @@ static void qtrle_decode_24bpp(QtrleContext *s, int 
row_ptr, int lines_to_change
 CHECK_PIXEL_PTR(0);
 
 while ((rle_code = (int8_t)bytestream2_get_byte(&s->g)) != -1) {
+if (bytestream2_get_bytes_left(&s->g) < 1)
+return;
 if (rle_code == 0) {
 /* there's another skip code in the stream */
 pixel_ptr += (bytestream2_get_byte(&s->g) - 1) * 3;
@@ -350,6 +358,8 @@ static void qtrle_decode_32bpp(QtrleContext *s, int 
row_ptr, int lines_to_change
 CHECK_PIXEL_PTR(0);
 
 while ((rle_code = (int8_t)bytestream2_get_byte(&s->g)) != -1) {
+if (bytestream2_get_bytes_left(&s->g) < 1)
+return;
 if (rle_code == 0) {
 /* there's another skip code in the stream */
 pixel_ptr += (bytestream2_get_byte(&s->g) - 1) * 4;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] lavc/svq3: Fix regression decoding some files.

[Nikolas Bowe]

ffmpeg | branch: release/3.3 | Nikolas Bowe  | Mon Jul 30 
17:22:02 2018 -0700| [e2d052d5c8321487338979568c1e372727002603] | committer: 
Michael Niedermayer

lavc/svq3: Fix regression decoding some files.

Fixes some SVQ3 encoded files which fail to decode correctly after 6d6faa2a2d.
These files exhibit lots of artifacts and logs show "Media key encryption is 
not implemented".
However they decode without artifacts before 6d6faa2a2d.
The attatched patch allows these files to successfully decode, but also reject 
media key files.

Tested on the files in #6094 and 
http://samples.mplayerhq.hu/V-codecs/SVQ3/Vertical400kbit.sorenson3.mov

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 5aeb3b008080d8d4a38f245d557dbc9bd6c36dcf)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e2d052d5c8321487338979568c1e372727002603
---

 libavcodec/svq3.c | 9 -
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/libavcodec/svq3.c b/libavcodec/svq3.c
index 5cb5bd45b7..e5bbb393e0 100644
--- a/libavcodec/svq3.c
+++ b/libavcodec/svq3.c
@@ -1065,16 +1065,15 @@ static int svq3_decode_slice_header(AVCodecContext 
*avctx)
 av_log(s->avctx, AV_LOG_ERROR, "illegal slice type %u \n", slice_id);
 return -1;
 }
-if (get_bits1(&s->gb_slice)) {
-avpriv_report_missing_feature(s->avctx, "Media key encryption");
-return AVERROR_PATCHWELCOME;
-}
 
 s->slice_type = ff_h264_golomb_to_pict_type[slice_id];
 
 if ((header & 0x9F) == 2) {
-i = (s->mb_num < 64) ? 5 : av_log2(s->mb_num - 1);
+i = (s->mb_num < 64) ? 6 : (1 + av_log2(s->mb_num - 1));
 get_bits(&s->gb_slice, i);
+} else if (get_bits1(&s->gb_slice)) {
+avpriv_report_missing_feature(s->avctx, "Media key encryption");
+return AVERROR_PATCHWELCOME;
 }
 
 s->slice_num  = get_bits(&s->gb_slice, 8);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/shorten: Fix integer overflow in residual/LPC combination

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Sun Aug 12 22:55:59 2018 +0200| [d16d851238f4c056837ba6d8fef4b0c274b8d146] | 
committer: Michael Niedermayer

avcodec/shorten: Fix integer overflow in residual/LPC combination

Fixes: signed integer overflow: -540538872 + -2012739576 cannot be represented 
in type 'int'
Fixes: 
9255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5758630052757504

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit db7e9082e1a1479c6a8844f7adf77eae03cc2aa7)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d16d851238f4c056837ba6d8fef4b0c274b8d146
---

 libavcodec/shorten.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/shorten.c b/libavcodec/shorten.c
index 01d0a1..ad83dfb199 100644
--- a/libavcodec/shorten.c
+++ b/libavcodec/shorten.c
@@ -391,7 +391,7 @@ static int decode_subframe_lpc(ShortenContext *s, int 
command, int channel,
 for (j = 0; j < pred_order; j++)
 sum += coeffs[j] * (unsigned)s->decoded[channel][i - j - 1];
 s->decoded[channel][i] = get_sr_golomb_shorten(&s->gb, residual_size) +
- (sum >> qshift);
+ (unsigned)(sum >> qshift);
 }
 
 /* add offset to current samples */

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/aacpsdsp_template: Fix integer overflow in ps_stereo_interpolate_c()

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Sat Jul 28 10:59:09 2018 +0200| [0678985c14dd716efaa373ed5986b6e7230365d7] | 
committer: Michael Niedermayer

avcodec/aacpsdsp_template: Fix integer overflow in ps_stereo_interpolate_c()

Fixes: signed integer overflow: -1813244069 + -1407981383 cannot be represented 
in type 'int'
Fixes: 
8823/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5643295618236416

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 47db5763e21c5e3b0ddde2430d15938f8d88480d)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0678985c14dd716efaa373ed5986b6e7230365d7
---

 libavcodec/aacpsdsp_template.c | 8 
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/libavcodec/aacpsdsp_template.c b/libavcodec/aacpsdsp_template.c
index 8f72624559..b924148e0f 100644
--- a/libavcodec/aacpsdsp_template.c
+++ b/libavcodec/aacpsdsp_template.c
@@ -149,10 +149,10 @@ static void ps_stereo_interpolate_c(INTFLOAT (*l)[2], 
INTFLOAT (*r)[2],
 INTFLOAT h1 = h[0][1];
 INTFLOAT h2 = h[0][2];
 INTFLOAT h3 = h[0][3];
-INTFLOAT hs0 = h_step[0][0];
-INTFLOAT hs1 = h_step[0][1];
-INTFLOAT hs2 = h_step[0][2];
-INTFLOAT hs3 = h_step[0][3];
+UINTFLOAT hs0 = h_step[0][0];
+UINTFLOAT hs1 = h_step[0][1];
+UINTFLOAT hs2 = h_step[0][2];
+UINTFLOAT hs3 = h_step[0][3];
 int n;
 
 for (n = 0; n < len; n++) {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/shorten: Check verbatim length

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Sun Aug 12 22:43:33 2018 +0200| [488c246bf565d56f153874d1348435c7187679a1] | 
committer: Michael Niedermayer

avcodec/shorten: Check verbatim length

Fixes: Timeout
Fixes: 
9252/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5780720709533696

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 7007dabec08f2f9f81661e71ef482dde394e17a8)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=488c246bf565d56f153874d1348435c7187679a1
---

 libavcodec/shorten.c | 5 +
 1 file changed, 5 insertions(+)

diff --git a/libavcodec/shorten.c b/libavcodec/shorten.c
index 68c2a2d804..01d0a1 100644
--- a/libavcodec/shorten.c
+++ b/libavcodec/shorten.c
@@ -623,6 +623,11 @@ static int shorten_decode_frame(AVCodecContext *avctx, 
void *data,
 switch (cmd) {
 case FN_VERBATIM:
 len = get_ur_golomb_shorten(&s->gb, VERBATIM_CKSIZE_SIZE);
+if (len < 0 || len > get_bits_left(&s->gb)) {
+av_log(avctx, AV_LOG_ERROR, "verbatim length %d invalid\n",
+   len);
+return AVERROR_INVALIDDATA;
+}
 while (len--)
 get_ur_golomb_shorten(&s->gb, VERBATIM_BYTE_SIZE);
 break;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/diracdec: Check slice numbers for overflows in relation to picture dimensions

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Sun Jul 22 21:26:24 2018 +0200| [c07d568603d33fe3d3c38d888da859f202299382] | 
committer: Michael Niedermayer

avcodec/diracdec: Check slice numbers for overflows in relation to picture 
dimensions

Fixes: signed integer overflow: 88 * 33685506 cannot be represented in type 
'int'
Fixes: 
9433/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5725943535501312

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit f457c0ad7f73e31e99761f2ad3738cf3b3c24ca0)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c07d568603d33fe3d3c38d888da859f202299382
---

 libavcodec/diracdec.c | 5 -
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libavcodec/diracdec.c b/libavcodec/diracdec.c
index eeaa8f4498..5a4877386b 100644
--- a/libavcodec/diracdec.c
+++ b/libavcodec/diracdec.c
@@ -1242,7 +1242,10 @@ static int dirac_unpack_idwt_params(DiracContext *s)
 else {
 s->num_x= get_interleaved_ue_golomb(gb);
 s->num_y= get_interleaved_ue_golomb(gb);
-if (s->num_x * s->num_y == 0 || s->num_x * (uint64_t)s->num_y > 
INT_MAX) {
+if (s->num_x * s->num_y == 0 || s->num_x * (uint64_t)s->num_y > 
INT_MAX ||
+s->num_x * (uint64_t)s->avctx->width  > INT_MAX ||
+s->num_y * (uint64_t)s->avctx->height > INT_MAX
+) {
 av_log(s->avctx,AV_LOG_ERROR,"Invalid numx/y\n");
 s->num_x = s->num_y = 0;
 return AVERROR_INVALIDDATA;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/dirac_dwt_template: Fix several integer overflows in horizontal_compose_daub97i()

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Sun Jul 22 19:11:04 2018 +0200| [d5c48e8536d007a0cfdaf3e7cd5ab428db948374] | 
committer: Michael Niedermayer

avcodec/dirac_dwt_template: Fix several integer overflows in 
horizontal_compose_daub97i()

Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 
'int'
Fixes: 
8926/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-6047609228623872

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 69cac9e130dc8c9d2a5b8012011df372974adf35)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d5c48e8536d007a0cfdaf3e7cd5ab428db948374
---

 libavcodec/dirac_dwt_template.c | 8 
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/libavcodec/dirac_dwt_template.c b/libavcodec/dirac_dwt_template.c
index 2369c8d15b..5d55d932a1 100644
--- a/libavcodec/dirac_dwt_template.c
+++ b/libavcodec/dirac_dwt_template.c
@@ -190,15 +190,15 @@ static void RENAME(horizontal_compose_daub97i)(uint8_t 
*_b, uint8_t *_temp, int
 
 // second stage combined with interleave and shift
 b0 = b2 = COMPOSE_DAUB97iL0(temp[w2], temp[0], temp[w2]);
-b[0] = (b0 + 1) >> 1;
+b[0] = ~((~b0) >> 1);
 for (x = 1; x < w2; x++) {
 b2 = COMPOSE_DAUB97iL0(temp[x+w2-1], temp[x ], temp[x+w2]);
 b1 = COMPOSE_DAUB97iH0(  b0, temp[x+w2-1], b2);
-b[2*x-1] = (b1 + 1) >> 1;
-b[2*x  ] = (b2 + 1) >> 1;
+b[2*x-1] = ~((~b1) >> 1);
+b[2*x  ] = ~((~b2) >> 1);
 b0 = b2;
 }
-b[w-1] = (COMPOSE_DAUB97iH0(b2, temp[w-1], b2) + 1) >> 1;
+b[w-1] = ~((~COMPOSE_DAUB97iH0(b2, temp[w-1], b2)) >> 1);
 }
 
 static void RENAME(vertical_compose_dirac53iH0)(uint8_t *_b0, uint8_t *_b1, 
uint8_t *_b2,

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/diracdec: Check bytes count in else branch in decode_lowdelay() too

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Sun Jul 22 21:42:16 2018 +0200| [c1a3212d45a99dce153f4185befc49daa579ef10] | 
committer: Michael Niedermayer

avcodec/diracdec: Check bytes count in else branch in decode_lowdelay() too

Fixes: signed integer overflow: 8 * 340018243 cannot be represented in type 
'int'
Fixes: 
9441/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5194665207791616

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit bed125b7108481574f36fdd6ee699b27354602e8)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c1a3212d45a99dce153f4185befc49daa579ef10
---

 libavcodec/diracdec.c | 4 
 1 file changed, 4 insertions(+)

diff --git a/libavcodec/diracdec.c b/libavcodec/diracdec.c
index 5a4877386b..c2a6bcbd31 100644
--- a/libavcodec/diracdec.c
+++ b/libavcodec/diracdec.c
@@ -985,6 +985,10 @@ static int decode_lowdelay(DiracContext *s)
 for (slice_x = 0; bufsize > 0 && slice_x < s->num_x; slice_x++) {
 bytes = (slice_num+1) * (int64_t)s->lowdelay.bytes.num / 
s->lowdelay.bytes.den
- slice_num* (int64_t)s->lowdelay.bytes.num / 
s->lowdelay.bytes.den;
+if (bytes >= INT_MAX || bytes*8 > bufsize) {
+av_log(s->avctx, AV_LOG_ERROR, "too many bytes\n");
+return AVERROR_INVALIDDATA;
+}
 slices[slice_num].bytes   = bytes;
 slices[slice_num].slice_x = slice_x;
 slices[slice_num].slice_y = slice_y;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] swresample/swresample: Fix input channel count in resample_first computation

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Tue Jul 24 22:44:12 2018 +0200| [31262860ccd33b704a31f945fa1b9442b4e328c7] | 
committer: Michael Niedermayer

swresample/swresample: Fix input channel count in resample_first computation

Found-by: Marcin Gorzel 
Reviewed-by: Marcin Gorzel 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit bce4da85e8110b66040a5fb07ffc724ab4e09a86)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=31262860ccd33b704a31f945fa1b9442b4e328c7
---

 libswresample/swresample.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libswresample/swresample.c b/libswresample/swresample.c
index 170f76bc56..c740f5d5fd 100644
--- a/libswresample/swresample.c
+++ b/libswresample/swresample.c
@@ -318,7 +318,7 @@ av_cold int swr_init(struct SwrContext *s){
 
 av_assert0(s->used_ch_count);
 av_assert0(s->out.ch_count);
-s->resample_first= RSC*s->out.ch_count/s->in.ch_count - RSC < 
s->out_sample_rate/(float)s-> in_sample_rate - 1.0;
+s->resample_first= RSC*s->out.ch_count/s->used_ch_count - RSC < 
s->out_sample_rate/(float)s-> in_sample_rate - 1.0;
 
 s->in_buffer= s->in;
 s->silence  = s->in;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avutil/pixfmt: Document chroma plane size for odd resolutions

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer  | 
Wed Jul 18 22:22:35 2018 +0200| [ea160f02137e515a7909b73eba172da008af614a] | 
committer: Michael Niedermayer

avutil/pixfmt: Document chroma plane size for odd resolutions

Signed-off-by: Michael Niedermayer 
(cherry picked from commit be0b77e6e83b61c2da338201b5ddfae1c9acedc5)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ea160f02137e515a7909b73eba172da008af614a
---

 libavutil/pixfmt.h | 4 
 1 file changed, 4 insertions(+)

diff --git a/libavutil/pixfmt.h b/libavutil/pixfmt.h
index 5dafc341a1..926bf5ae43 100644
--- a/libavutil/pixfmt.h
+++ b/libavutil/pixfmt.h
@@ -42,6 +42,10 @@
  * This is stored as BGRA on little-endian CPU architectures and ARGB on
  * big-endian CPUs.
  *
+ * @note
+ * If the resolution is not a multiple of the chroma subsampling factor
+ * then the chroma plane resolution must be rounded up.
+ *
  * @par
  * When the pixel format is palettized RGB32 (AV_PIX_FMT_PAL8), the palettized
  * image data is stored in AVFrame.data[0]. The palette is transported in

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/vdpau: Initialise driver version variable explicitly

[Philip Langdale]

ffmpeg | branch: master | Philip Langdale  | Wed Oct 31 
16:58:09 2018 -0700| [4a976200d7853588336005a394dd31d905f5caf6] | committer: 
Philip Langdale

avcodec/vdpau: Initialise driver version variable explicitly

If the identification string ever changed, we might not match anything
in the sscanf(). At least have predictable behaviour.

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4a976200d7853588336005a394dd31d905f5caf6
---

 libavcodec/vdpau.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/vdpau.c b/libavcodec/vdpau.c
index 59454e8c4b..167f06d7ae 100644
--- a/libavcodec/vdpau.c
+++ b/libavcodec/vdpau.c
@@ -208,7 +208,7 @@ int ff_vdpau_common_init(AVCodecContext *avctx, 
VdpDecoderProfile profile,
 return vdpau_error(status);
 if (avctx->codec_id == AV_CODEC_ID_HEVC && strncmp(info_string, "NVIDIA ", 
7) == 0 &&
 !(avctx->hwaccel_flags & AV_HWACCEL_FLAG_ALLOW_PROFILE_MISMATCH)) {
-int driver_version;
+int driver_version = 0;
 sscanf(info_string, "NVIDIA VDPAU Driver Shared Library  %d", 
&driver_version);
 if (driver_version < 410) {
 av_log(avctx, AV_LOG_VERBOSE, "HEVC with NVIDIA VDPAU drivers is 
buggy, skipping.\n");

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] cbs_h264: Include SEI type names in trace output

[Mark Thompson]

ffmpeg | branch: master | Mark Thompson  | Sat Oct 27 22:39:46 
2018 +0100| [30fcc10937966cd24b253d4b8267c455f2212b8a] | committer: Mark 
Thompson

cbs_h264: Include SEI type names in trace output

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=30fcc10937966cd24b253d4b8267c455f2212b8a
---

 libavcodec/cbs_h264_syntax_template.c | 16 
 1 file changed, 16 insertions(+)

diff --git a/libavcodec/cbs_h264_syntax_template.c 
b/libavcodec/cbs_h264_syntax_template.c
index 9e29132fec..dbf9ff1268 100644
--- a/libavcodec/cbs_h264_syntax_template.c
+++ b/libavcodec/cbs_h264_syntax_template.c
@@ -513,6 +513,8 @@ static int FUNC(sei_buffering_period)(CodedBitstreamContext 
*ctx, RWContext *rw,
 const H264RawSPS *sps;
 int err, i, length;
 
+HEADER("Buffering Period");
+
 ue(seq_parameter_set_id, 0, 31);
 
 sps = h264->sps[current->seq_parameter_set_id];
@@ -605,6 +607,8 @@ static int FUNC(sei_pic_timing)(CodedBitstreamContext *ctx, 
RWContext *rw,
 const H264RawSPS *sps;
 int err;
 
+HEADER("Picture Timing");
+
 sps = h264->active_sps;
 if (!sps) {
 // If there is exactly one possible SPS but it is not yet active
@@ -674,6 +678,8 @@ static int FUNC(sei_pan_scan_rect)(CodedBitstreamContext 
*ctx, RWContext *rw,
 {
 int err, i;
 
+HEADER("Pan-Scan Rectangle");
+
 ue(pan_scan_rect_id, 0, UINT32_MAX - 1);
 flag(pan_scan_rect_cancel_flag);
 
@@ -699,6 +705,8 @@ static int 
FUNC(sei_user_data_registered)(CodedBitstreamContext *ctx, RWContext
 {
 int err, i, j;
 
+HEADER("User Data Registered ITU-T T.35");
+
 u(8, itu_t_t35_country_code, 0x00, 0xff);
 if (current->itu_t_t35_country_code != 0xff)
 i = 1;
@@ -731,6 +739,8 @@ static int 
FUNC(sei_user_data_unregistered)(CodedBitstreamContext *ctx, RWContex
 {
 int err, i;
 
+HEADER("User Data Unregistered");
+
 #ifdef READ
 if (*payload_size < 16) {
 av_log(ctx->log_ctx, AV_LOG_ERROR,
@@ -758,6 +768,8 @@ static int FUNC(sei_recovery_point)(CodedBitstreamContext 
*ctx, RWContext *rw,
 {
 int err;
 
+HEADER("Recovery Point");
+
 ue(recovery_frame_cnt, 0, 65535);
 flag(exact_match_flag);
 flag(broken_link_flag);
@@ -771,6 +783,8 @@ static int 
FUNC(sei_display_orientation)(CodedBitstreamContext *ctx, RWContext *
 {
 int err;
 
+HEADER("Display Orientation");
+
 flag(display_orientation_cancel_flag);
 if (!current->display_orientation_cancel_flag) {
 flag(hor_flip);
@@ -788,6 +802,8 @@ static int 
FUNC(sei_mastering_display_colour_volume)(CodedBitstreamContext *ctx,
 {
 int err, c;
 
+HEADER("Mastering Display Colour Volume");
+
 for (c = 0; c < 3; c++) {
 us(16, display_primaries_x[c], 0, 5, 1, c);
 us(16, display_primaries_y[c], 0, 5, 1, c);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] cbs_h265: Add PTL parsing for Main 10 Still Picture profile

[Mark Thompson]

ffmpeg | branch: master | Mark Thompson  | Sat Oct 27 22:39:47 
2018 +0100| [2dee0679e9a88e1fea51ebd3dcd2bbbf6e1777d6] | committer: Mark 
Thompson

cbs_h265: Add PTL parsing for Main 10 Still Picture profile

This was added in the 2018 version of the standard.

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2dee0679e9a88e1fea51ebd3dcd2bbbf6e1777d6
---

 libavcodec/cbs_h265_syntax_template.c | 5 +
 1 file changed, 5 insertions(+)

diff --git a/libavcodec/cbs_h265_syntax_template.c 
b/libavcodec/cbs_h265_syntax_template.c
index d4e4f7b1c2..e43f3caf99 100644
--- a/libavcodec/cbs_h265_syntax_template.c
+++ b/libavcodec/cbs_h265_syntax_template.c
@@ -130,6 +130,11 @@ static int FUNC(profile_tier_level)(CodedBitstreamContext 
*ctx, RWContext *rw,
 fixed(24, general_reserved_zero_34bits, 0);
 fixed(10, general_reserved_zero_34bits, 0);
 }
+} else if (profile_compatible(2)) {
+fixed(7, general_reserved_zero_7bits, 0);
+flag(general_one_picture_only_constraint_flag);
+fixed(24, general_reserved_zero_35bits, 0);
+fixed(11, general_reserved_zero_35bits, 0);
 } else {
 fixed(24, general_reserved_zero_43bits, 0);
 fixed(19, general_reserved_zero_43bits, 0);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] doc/fate.texi: Mention that samples should be uploaded before pushing dependent commits

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer  | Tue 
Oct 23 23:31:24 2018 +0200| [793a3e7bc909ee96bb253950bce3d3b0e2e188a2] | 
committer: Michael Niedermayer

doc/fate.texi: Mention that samples should be uploaded before pushing dependent 
commits

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=793a3e7bc909ee96bb253950bce3d3b0e2e188a2
---

 doc/fate.texi | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/fate.texi b/doc/fate.texi
index a352994230..2be61d639c 100644
--- a/doc/fate.texi
+++ b/doc/fate.texi
@@ -155,6 +155,8 @@ space on each client, network bandwidth and so on benefit 
from smaller test case
 Also keep in mind older checkouts use existing sample files, that means in
 practice generally do not replace, remove or overwrite files as it likely would
 break older checkouts or releases.
+Also all needed samples for a commit should be uploaded, ideally 24
+hours, before the push.
 
 @example
 #First update your local samples copy:

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] [ffmpeg-web] branch master updated. c38da5e web/documentation: add new book about FFmpeg in China

[ffmpeg-git]

The branch, master has been updated
   via  c38da5ec2cdb67c634c4ad6001ad5a7b23383e78 (commit)
  from  e51f0b6f978d9958a0abfb59da2e674d7e22ea3f (commit)


- Log -
commit c38da5ec2cdb67c634c4ad6001ad5a7b23383e78
Author: Steven Liu 
AuthorDate: Thu Oct 18 07:40:09 2018 +0800
Commit: Lou Logan 
CommitDate: Wed Oct 31 12:50:10 2018 -0800

web/documentation: add new book about FFmpeg in China

Signed-off-by: Steven Liu 

diff --git a/src/documentation b/src/documentation
index e3bbf4c..a975002 100644
--- a/src/documentation
+++ b/src/documentation
@@ -131,6 +131,8 @@
   
 http://ffmpeg.tv";>FFmpeg Basics by Frantisek Korbel,
   describes various FFmpeg features and common tasks.
+http://book.chinaffmpeg.com";>FFmpeg Beginner's handbook 
Chinese Version by Steven Liu,
+describes FFmpeg common use method in Chinese, from command line to 
API usage.
   
 


---

Summary of changes:
 src/documentation | 2 ++
 1 file changed, 2 insertions(+)


hooks/post-receive
-- 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avfilter: add (a)graphmonitor filter(s)

[Paul B Mahol]

ffmpeg | branch: master | Paul B Mahol  | Sat Oct 27 19:17:08 
2018 +0200| [323c2cfd384a06ad1e5233306156eb931185193f] | committer: Paul B Mahol

avfilter: add (a)graphmonitor filter(s)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=323c2cfd384a06ad1e5233306156eb931185193f
---

 Changelog|   1 +
 doc/filters.texi |  57 ++
 libavfilter/Makefile |   2 +
 libavfilter/allfilters.c |   2 +
 libavfilter/f_graphmonitor.c | 425 +++
 libavfilter/version.h|   2 +-
 6 files changed, 488 insertions(+), 1 deletion(-)

diff --git a/Changelog b/Changelog
index de0383047e..5ce1233b10 100644
--- a/Changelog
+++ b/Changelog
@@ -41,6 +41,7 @@ version :
 - decoding S12M timecode in h264
 - xstack filter
 - pcm vidc decoder and encoder
+- (a)graphmonitor filter
 
 
 version 4.0:
diff --git a/doc/filters.texi b/doc/filters.texi
index 9b84b1145b..200af0d2d1 100644
--- a/doc/filters.texi
+++ b/doc/filters.texi
@@ -10300,6 +10300,63 @@ gradfun=radius=8
 
 @end itemize
 
+@section graphmonitor, agraphmonitor
+Show various filtergraph stats.
+
+With this filter one can debug complete filtergraph.
+Especially issues with links filling with queued frames.
+
+The filter accepts the following options:
+
+@table @option
+@item size, s
+Set video output size. Default is @var{hd720}.
+
+@item opacity, o
+Set video opacity. Default is @var{0.9}. Allowed range is from @var{0} to 
@var{1}.
+
+@item mode, m
+Set output mode, can be @var{fulll} or @var{compact}.
+In @var{compact} mode only filters with some queued frames have displayed 
stats.
+
+@item flags, f
+Set flags which enable which stats are shown in video.
+
+Available values for flags are:
+@table @samp
+@item queue
+Display number of queued frames in each link.
+
+@item frame_count_in
+Display number of frames taken from filter.
+
+@item frame_count_out
+Display number of frames given out from filter.
+
+@item pts
+Display current filtered frame pts.
+
+@item time
+Display current filtered frame time.
+
+@item timebase
+Display time base for filter link.
+
+@item format
+Display used format for filter link.
+
+@item size
+Display video size or number of audio channels in case of audio used by filter 
link.
+
+@item rate
+Display video frame rate or sample rate in case of audio used by filter link.
+@end table
+
+@item rate, r
+Set upper limit for video rate of output stream, Default value is @var{25}.
+This guarantee that output video frame rate will not be higher than this value.
+@end table
+
 @section greyedge
 A color constancy variation filter which estimates scene illumination via grey 
edge algorithm
 and corrects the scene colors accordingly.
diff --git a/libavfilter/Makefile b/libavfilter/Makefile
index a98c64b7ce..c35cd8f422 100644
--- a/libavfilter/Makefile
+++ b/libavfilter/Makefile
@@ -240,6 +240,7 @@ OBJS-$(CONFIG_FSPP_FILTER)   += vf_fspp.o
 OBJS-$(CONFIG_GBLUR_FILTER)  += vf_gblur.o
 OBJS-$(CONFIG_GEQ_FILTER)+= vf_geq.o
 OBJS-$(CONFIG_GRADFUN_FILTER)+= vf_gradfun.o
+OBJS-$(CONFIG_GRAPHMONITOR_FILTER)   += f_graphmonitor.o
 OBJS-$(CONFIG_GREYEDGE_FILTER)   += vf_colorconstancy.o
 OBJS-$(CONFIG_HALDCLUT_FILTER)   += vf_lut3d.o framesync.o
 OBJS-$(CONFIG_HFLIP_FILTER)  += vf_hflip.o
@@ -437,6 +438,7 @@ OBJS-$(CONFIG_NULLSINK_FILTER)   += 
vsink_nullsink.o
 # multimedia filters
 OBJS-$(CONFIG_ABITSCOPE_FILTER)  += avf_abitscope.o
 OBJS-$(CONFIG_ADRAWGRAPH_FILTER) += f_drawgraph.o
+OBJS-$(CONFIG_AGRAPHMONITOR_FILTER)  += f_graphmonitor.o
 OBJS-$(CONFIG_AHISTOGRAM_FILTER) += avf_ahistogram.o
 OBJS-$(CONFIG_APHASEMETER_FILTER)+= avf_aphasemeter.o
 OBJS-$(CONFIG_AVECTORSCOPE_FILTER)   += avf_avectorscope.o
diff --git a/libavfilter/allfilters.c b/libavfilter/allfilters.c
index b2cb58fc38..d5a211bda5 100644
--- a/libavfilter/allfilters.c
+++ b/libavfilter/allfilters.c
@@ -227,6 +227,7 @@ extern AVFilter ff_vf_fspp;
 extern AVFilter ff_vf_gblur;
 extern AVFilter ff_vf_geq;
 extern AVFilter ff_vf_gradfun;
+extern AVFilter ff_vf_graphmonitor;
 extern AVFilter ff_vf_greyedge;
 extern AVFilter ff_vf_haldclut;
 extern AVFilter ff_vf_hflip;
@@ -418,6 +419,7 @@ extern AVFilter ff_vsink_nullsink;
 /* multimedia filters */
 extern AVFilter ff_avf_abitscope;
 extern AVFilter ff_avf_adrawgraph;
+extern AVFilter ff_avf_agraphmonitor;
 extern AVFilter ff_avf_ahistogram;
 extern AVFilter ff_avf_aphasemeter;
 extern AVFilter ff_avf_avectorscope;
diff --git a/libavfilter/f_graphmonitor.c b/libavfilter/f_graphmonitor.c
new file mode 100644
index 00..7052c84d9b
--- /dev/null
+++ b/libavfilter/f_graphmonitor.c
@@ -0,0 +1,425 @@
+/*
+ * Copyright (c) 2018 Paul B Mahol
+ *
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the ter