Re: [FFmpeg-devel] [PATCH]lavf/avio: Print https warning also for avio_find_protocol_name()
> 在 2019年9月25日，下午8:11，Carl Eugen Hoyos 写道： > > Am Mi., 25. Sept. 2019 um 11:35 Uhr schrieb Carl Eugen Hoyos > : >> >> Hi! >> >> Attached patch helps users fixing ticket #8197. LGTM >> >> Please comment, Carl Eugen Thanks Steven ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH] avformat/utils: Move the reference to the packet list
On 9/25/2019 9:05 PM, Andreas Rheinhardt wrote:
> Up until now, ff_packet_list_put had a flaw: When it moved a packet to
> the list (meaning, when it ought to move the reference to the packet
> list instead of creating a new one via av_packet_ref), it did not reset
> the original packet, confusing the ownership of the data in the packet.
> This has been done because some callers of this function were not
> compatible with resetting the packet.
>
> This commit changes these callers and fixes this flaw. In order to
> indicate that the ownership of the packet has moved to the packet list,
> pointers to constant AVPackets are used whenever the target of the
> pointer might already be owned by the packet list.
>
> Furthermore, the packet is always made refcounted so that its data is
> really owned by the packet. This was already true for the current
> callers.
Ah, my bad. When you said "I can add a commit doing this" i assumed
you'd do it in a separate patch. I already committed the "v4 3/9" one.
I'll apply the doxy changes and the av_packet_make_refcounted() call in
a new patch in a moment.
>
> Signed-off-by: Andreas Rheinhardt
> ---
> libavformat/internal.h | 3 ++-
> libavformat/utils.c| 37 ++---
> 2 files changed, 24 insertions(+), 16 deletions(-)
>
> diff --git a/libavformat/internal.h b/libavformat/internal.h
> index 163587f416..a37404d823 100644
> --- a/libavformat/internal.h
> +++ b/libavformat/internal.h
> @@ -763,7 +763,8 @@ void ff_format_set_url(AVFormatContext *s, char *url);
> *
> * @param head List head element
> * @param tail List tail element
> - * @param pkt The packet being appended
> + * @param pkt The packet being appended. It will be made refcounted
> + * if it isn't already.
> * @param flags Any combination of FF_PACKETLIST_FLAG_* flags
> * @return 0 on success, negative AVERROR value on failure. On failure,
> the list is unchanged
> diff --git a/libavformat/utils.c b/libavformat/utils.c
> index 4657ba2642..9f8a5bfb63 100644
> --- a/libavformat/utils.c
> +++ b/libavformat/utils.c
> @@ -460,10 +460,12 @@ int ff_packet_list_put(AVPacketList **packet_buffer,
> return ret;
> }
> } else {
> -// TODO: Adapt callers in this file so the line below can use
> -// av_packet_move_ref() to effectively move the reference
> -// to the list.
> -pktl->pkt = *pkt;
> +ret = av_packet_make_refcounted(pkt);
> +if (ret < 0) {
> +av_free(pktl);
> +return ret;
> +}
> +av_packet_move_ref(>pkt, pkt);
> }
>
> if (*packet_buffer)
> @@ -835,6 +837,7 @@ int ff_read_packet(AVFormatContext *s, AVPacket *pkt)
>
> for (;;) {
> AVPacketList *pktl = s->internal->raw_packet_buffer;
> +const AVPacket *pkt1;
>
> if (pktl) {
> st = s->streams[pktl->pkt.stream_index];
> @@ -922,9 +925,10 @@ int ff_read_packet(AVFormatContext *s, AVPacket *pkt)
> av_packet_unref(pkt);
> return err;
> }
> -s->internal->raw_packet_buffer_remaining_size -= pkt->size;
> +pkt1 = >internal->raw_packet_buffer_end->pkt;
> +s->internal->raw_packet_buffer_remaining_size -= pkt1->size;
>
> -if ((err = probe_codec(s, st, pkt)) < 0)
> +if ((err = probe_codec(s, st, pkt1)) < 0)
> return err;
> }
> }
> @@ -3032,8 +3036,8 @@ static int has_codec_parameters(AVStream *st, const
> char **errmsg_ptr)
> }
>
> /* returns 1 or 0 if or if not decoded data was returned, or a negative
> error */
> -static int try_decode_frame(AVFormatContext *s, AVStream *st, AVPacket
> *avpkt,
> -AVDictionary **options)
> +static int try_decode_frame(AVFormatContext *s, AVStream *st,
> +const AVPacket *avpkt, AVDictionary **options)
> {
> AVCodecContext *avctx = st->internal->avctx;
> const AVCodec *codec;
> @@ -3525,7 +3529,7 @@ fail:
> return ret;
> }
>
> -static int extract_extradata(AVStream *st, AVPacket *pkt)
> +static int extract_extradata(AVStream *st, const AVPacket *pkt)
> {
> AVStreamInternal *sti = st->internal;
> AVPacket *pkt_ref;
> @@ -3588,7 +3592,7 @@ int avformat_find_stream_info(AVFormatContext *ic,
> AVDictionary **options)
> int64_t read_size;
> AVStream *st;
> AVCodecContext *avctx;
> -AVPacket pkt1, *pkt;
> +AVPacket pkt1;
> int64_t old_offset = avio_tell(ic->pb);
> // new streams might appear, no options for those
> int orig_nb_streams = ic->nb_streams;
> @@ -3707,6 +3711,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
>
> read_size = 0;
> for (;;) {
> +const AVPacket *pkt;
> int analyzed_all_streams;
> if (ff_check_interrupt(>interrupt_callback)) {
> ret = AVERROR_EXIT;
> @@ -3800,14 +3805,16 @@ FF_ENABLE_DEPRECATION_WARNINGS
>
[FFmpeg-devel] [PATCH] avformat/utils: Move the reference to the packet list
Up until now, ff_packet_list_put had a flaw: When it moved a packet to
the list (meaning, when it ought to move the reference to the packet
list instead of creating a new one via av_packet_ref), it did not reset
the original packet, confusing the ownership of the data in the packet.
This has been done because some callers of this function were not
compatible with resetting the packet.
This commit changes these callers and fixes this flaw. In order to
indicate that the ownership of the packet has moved to the packet list,
pointers to constant AVPackets are used whenever the target of the
pointer might already be owned by the packet list.
Furthermore, the packet is always made refcounted so that its data is
really owned by the packet. This was already true for the current
callers.
Signed-off-by: Andreas Rheinhardt
---
libavformat/internal.h | 3 ++-
libavformat/utils.c| 37 ++---
2 files changed, 24 insertions(+), 16 deletions(-)
diff --git a/libavformat/internal.h b/libavformat/internal.h
index 163587f416..a37404d823 100644
--- a/libavformat/internal.h
+++ b/libavformat/internal.h
@@ -763,7 +763,8 @@ void ff_format_set_url(AVFormatContext *s, char *url);
*
* @param head List head element
* @param tail List tail element
- * @param pkt The packet being appended
+ * @param pkt The packet being appended. It will be made refcounted
+ * if it isn't already.
* @param flags Any combination of FF_PACKETLIST_FLAG_* flags
* @return 0 on success, negative AVERROR value on failure. On failure,
the list is unchanged
diff --git a/libavformat/utils.c b/libavformat/utils.c
index 4657ba2642..9f8a5bfb63 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -460,10 +460,12 @@ int ff_packet_list_put(AVPacketList **packet_buffer,
return ret;
}
} else {
-// TODO: Adapt callers in this file so the line below can use
-// av_packet_move_ref() to effectively move the reference
-// to the list.
-pktl->pkt = *pkt;
+ret = av_packet_make_refcounted(pkt);
+if (ret < 0) {
+av_free(pktl);
+return ret;
+}
+av_packet_move_ref(>pkt, pkt);
}
if (*packet_buffer)
@@ -835,6 +837,7 @@ int ff_read_packet(AVFormatContext *s, AVPacket *pkt)
for (;;) {
AVPacketList *pktl = s->internal->raw_packet_buffer;
+const AVPacket *pkt1;
if (pktl) {
st = s->streams[pktl->pkt.stream_index];
@@ -922,9 +925,10 @@ int ff_read_packet(AVFormatContext *s, AVPacket *pkt)
av_packet_unref(pkt);
return err;
}
-s->internal->raw_packet_buffer_remaining_size -= pkt->size;
+pkt1 = >internal->raw_packet_buffer_end->pkt;
+s->internal->raw_packet_buffer_remaining_size -= pkt1->size;
-if ((err = probe_codec(s, st, pkt)) < 0)
+if ((err = probe_codec(s, st, pkt1)) < 0)
return err;
}
}
@@ -3032,8 +3036,8 @@ static int has_codec_parameters(AVStream *st, const char
**errmsg_ptr)
}
/* returns 1 or 0 if or if not decoded data was returned, or a negative error
*/
-static int try_decode_frame(AVFormatContext *s, AVStream *st, AVPacket *avpkt,
-AVDictionary **options)
+static int try_decode_frame(AVFormatContext *s, AVStream *st,
+const AVPacket *avpkt, AVDictionary **options)
{
AVCodecContext *avctx = st->internal->avctx;
const AVCodec *codec;
@@ -3525,7 +3529,7 @@ fail:
return ret;
}
-static int extract_extradata(AVStream *st, AVPacket *pkt)
+static int extract_extradata(AVStream *st, const AVPacket *pkt)
{
AVStreamInternal *sti = st->internal;
AVPacket *pkt_ref;
@@ -3588,7 +3592,7 @@ int avformat_find_stream_info(AVFormatContext *ic,
AVDictionary **options)
int64_t read_size;
AVStream *st;
AVCodecContext *avctx;
-AVPacket pkt1, *pkt;
+AVPacket pkt1;
int64_t old_offset = avio_tell(ic->pb);
// new streams might appear, no options for those
int orig_nb_streams = ic->nb_streams;
@@ -3707,6 +3711,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
read_size = 0;
for (;;) {
+const AVPacket *pkt;
int analyzed_all_streams;
if (ff_check_interrupt(>interrupt_callback)) {
ret = AVERROR_EXIT;
@@ -3800,14 +3805,16 @@ FF_ENABLE_DEPRECATION_WARNINGS
break;
}
-pkt =
-
if (!(ic->flags & AVFMT_FLAG_NOBUFFER)) {
ret = ff_packet_list_put(>internal->packet_buffer,
>internal->packet_buffer_end,
- pkt, 0);
+ , 0);
if (ret < 0)
goto find_stream_info_err;
+
+pkt = >internal->packet_buffer_end->pkt;
+} else {
+pkt =
}
st =
Re: [FFmpeg-devel] [PATCH v4 3/9] avformat/utils: Move the reference to the packet list
On 9/20/2019 5:39 PM, Andreas Rheinhardt wrote: > Up until now, ff_packet_list_put had a flaw: When it moved a packet to > the list (meaning, when it ought to move the reference to the packet > list instead of creating a new one via av_packet_ref), it did not reset > the original packet, confusing the ownership of the data in the packet. > This has been done because some callers of this function were not > compatible with resetting the packet. > > This commit changes these callers and fixes this flaw. In order to > indicate that the ownership of the packet has moved to the packet list, > pointers to constant AVPackets are used whenever the target of the > pointer might already be owned by the packet list. > > Signed-off-by: Andreas Rheinhardt > --- > libavformat/utils.c | 32 +--- > 1 file changed, 17 insertions(+), 15 deletions(-) Applied. ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH v4 2/9] avformat/utils: unref packet on AVInputFormat.read_packet() failure
On 9/20/2019 5:39 PM, Andreas Rheinhardt wrote:
> From: James Almer
>
> Demuxers may have allocated a packet before encountering an error and
> aborting.
>
> Fixes ticket #8150
>
> Signed-off-by: James Almer
> ---
> Earlier versions of this patchset used av_init_packet() together with
> setting the size and data to zero/NULL. This would have caused memleaks
> when the packet contained data that needs to be freed/unreferenced,
> whereas this approach here runs the risk of double freeing. I consider
> the risk of the latter much lower than the risk of the former and have
> therefore included this patch in this patchset.
>
> libavformat/utils.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/libavformat/utils.c b/libavformat/utils.c
> index 652642a71b..e348df3269 100644
> --- a/libavformat/utils.c
> +++ b/libavformat/utils.c
> @@ -854,6 +854,8 @@ int ff_read_packet(AVFormatContext *s, AVPacket *pkt)
> av_init_packet(pkt);
> ret = s->iformat->read_packet(s, pkt);
> if (ret < 0) {
> +av_packet_unref(pkt);
> +
> /* Some demuxers return FFERROR_REDO when they consume
> data and discard it (ignored streams, junk, extradata).
> We must re-call the demuxer to get the real packet. */
Applied.
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH 2/2] avformat/utils: Fix memleaks
On 9/24/2019 1:31 PM, Andreas Rheinhardt wrote:
> ff_read_packet had potential memleaks:
> 1. If av_packet_make_refcounted fails, it means that the packet is not
> refcounted, but it could nevertheless carry side data and therefore
> needs to be unreferenced.
> 2. If putting a packet on a packet list fails, it wasn't unreferenced.
>
> Furthermore, read_frame_internal leaked a packet's (side) data if a
> context update was required and failed.
>
> Signed-off-by: Andreas Rheinhardt
> ---
> libavformat/utils.c | 16
> 1 file changed, 12 insertions(+), 4 deletions(-)
>
> diff --git a/libavformat/utils.c b/libavformat/utils.c
> index d8ef5fe54c..ff6aecbf3c 100644
> --- a/libavformat/utils.c
> +++ b/libavformat/utils.c
> @@ -872,8 +872,10 @@ int ff_read_packet(AVFormatContext *s, AVPacket *pkt)
> }
>
> err = av_packet_make_refcounted(pkt);
> -if (err < 0)
> +if (err < 0) {
> +av_packet_unref(pkt);
> return err;
> +}
>
> if ((s->flags & AVFMT_FLAG_DISCARD_CORRUPT) &&
> (pkt->flags & AV_PKT_FLAG_CORRUPT)) {
> @@ -914,8 +916,10 @@ int ff_read_packet(AVFormatContext *s, AVPacket *pkt)
> err = ff_packet_list_put(>internal->raw_packet_buffer,
> >internal->raw_packet_buffer_end,
> pkt, 0);
> -if (err)
> +if (err < 0) {
> +av_packet_unref(pkt);
> return err;
> +}
> s->internal->raw_packet_buffer_remaining_size -= pkt->size;
>
> if ((err = probe_codec(s, st, pkt)) < 0)
> @@ -1608,15 +1612,19 @@ static int read_frame_internal(AVFormatContext *s,
> AVPacket *pkt)
> }
>
> ret = avcodec_parameters_to_context(st->internal->avctx,
> st->codecpar);
> -if (ret < 0)
> +if (ret < 0) {
> +av_packet_unref(_pkt);
> return ret;
> +}
>
> #if FF_API_LAVF_AVCTX
> FF_DISABLE_DEPRECATION_WARNINGS
> /* update deprecated public codec context */
> ret = avcodec_parameters_to_context(st->codec, st->codecpar);
> -if (ret < 0)
> +if (ret < 0) {
> +av_packet_unref(_pkt);
> return ret;
> +}
> FF_ENABLE_DEPRECATION_WARNINGS
> #endif
Applied this set of two patches.
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH v4 3/9] avformat/utils: Move the reference to the packet list
On 9/25/2019 7:06 PM, Andreas Rheinhardt wrote:
> James Almer:
>> On 9/20/2019 5:39 PM, Andreas Rheinhardt wrote:
>>> Up until now, ff_packet_list_put had a flaw: When it moved a packet to
>>> the list (meaning, when it ought to move the reference to the packet
>>> list instead of creating a new one via av_packet_ref), it did not reset
>>> the original packet, confusing the ownership of the data in the packet.
>>> This has been done because some callers of this function were not
>>> compatible with resetting the packet.
>>>
>>> This commit changes these callers and fixes this flaw. In order to
>>> indicate that the ownership of the packet has moved to the packet list,
>>> pointers to constant AVPackets are used whenever the target of the
>>> pointer might already be owned by the packet list.
>>>
>>> Signed-off-by: Andreas Rheinhardt
>>> ---
>>> libavformat/utils.c | 32 +---
>>> 1 file changed, 17 insertions(+), 15 deletions(-)
>>>
>>> diff --git a/libavformat/utils.c b/libavformat/utils.c
>>> index e348df3269..58e0db61da 100644
>>> --- a/libavformat/utils.c
>>> +++ b/libavformat/utils.c
>>> @@ -460,10 +460,7 @@ int ff_packet_list_put(AVPacketList **packet_buffer,
>>> return ret;
>>> }
>>> } else {
>>> -// TODO: Adapt callers in this file so the line below can use
>>> -// av_packet_move_ref() to effectively move the reference
>>> -// to the list.
>>> -pktl->pkt = *pkt;
>>> +av_packet_move_ref(>pkt, pkt);
>>
>> I think it would be a good idea ensuring the packet is reference counted
>> here, to have more robust code and not depend on current callers having
>> done it themselves.
>> It's a matter of adding an av_packet_make_refcounted() call before this
>> line, much like it's done in av_bsf_send_packet(). It's essentially a
>> no-op when the packet is already reference counted.
>>
> I can add a commit doing this. But there is at least one potential
> use-case where using av_packet_make_refcounted() is not good: Uncoded
> frames. They aren't currently used in conjunction with this function,
> but that may change of course. Should I add a check for this scenario
> or another FF_PACKETLIST_FLAG_* flag that says that the packet should
> not be made refcounted, but simply moved?
No, moving a packet to the list should give full ownership of the packet
to the list, and the data described in them shouldn't just suddenly
become invalid because some buffer was freed by some other function.
That's precisely what happened with the bitstream filter API, generating
filtering and decoding failures because of how ffmpeg.c used to handle
packets internally, until an av_packet_make_refcounted() call was added
to av_bsf_send_packet().
And i personally don't consider adding a check like the one you suggest
something worth doing. If you want you can add a mention to
ff_packet_list_put() doxy that it will ensure the packet will be refcounted.
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH] Adding a flag to give user the option to have ffmpeg fail instead of warn when mismatches are found in rtmp url stream or application names.
Am Mi., 25. Sept. 2019 um 21:04 Uhr schrieb William Martin : > > From: Will Martin > > Motivation: When running multiple rtmp ingest on the same machine on the same > port, users may want to explicitly forbid mismatched rtmp streams from > successfully completing handshakes. This patch allows for such enforcement There already is a "strict" option, can't it be used here instead of adding a new option? Carl Eugen ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH v4 3/9] avformat/utils: Move the reference to the packet list
James Almer:
> On 9/20/2019 5:39 PM, Andreas Rheinhardt wrote:
>> Up until now, ff_packet_list_put had a flaw: When it moved a packet to
>> the list (meaning, when it ought to move the reference to the packet
>> list instead of creating a new one via av_packet_ref), it did not reset
>> the original packet, confusing the ownership of the data in the packet.
>> This has been done because some callers of this function were not
>> compatible with resetting the packet.
>>
>> This commit changes these callers and fixes this flaw. In order to
>> indicate that the ownership of the packet has moved to the packet list,
>> pointers to constant AVPackets are used whenever the target of the
>> pointer might already be owned by the packet list.
>>
>> Signed-off-by: Andreas Rheinhardt
>> ---
>> libavformat/utils.c | 32 +---
>> 1 file changed, 17 insertions(+), 15 deletions(-)
>>
>> diff --git a/libavformat/utils.c b/libavformat/utils.c
>> index e348df3269..58e0db61da 100644
>> --- a/libavformat/utils.c
>> +++ b/libavformat/utils.c
>> @@ -460,10 +460,7 @@ int ff_packet_list_put(AVPacketList **packet_buffer,
>> return ret;
>> }
>> } else {
>> -// TODO: Adapt callers in this file so the line below can use
>> -// av_packet_move_ref() to effectively move the reference
>> -// to the list.
>> -pktl->pkt = *pkt;
>> +av_packet_move_ref(>pkt, pkt);
>
> I think it would be a good idea ensuring the packet is reference counted
> here, to have more robust code and not depend on current callers having
> done it themselves.
> It's a matter of adding an av_packet_make_refcounted() call before this
> line, much like it's done in av_bsf_send_packet(). It's essentially a
> no-op when the packet is already reference counted.
>
I can add a commit doing this. But there is at least one potential
use-case where using av_packet_make_refcounted() is not good: Uncoded
frames. They aren't currently used in conjunction with this function,
but that may change of course. Should I add a check for this scenario
or another FF_PACKETLIST_FLAG_* flag that says that the packet should
not be made refcounted, but simply moved?
- Andreas
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH] avcodec/tiff: correct the default value of YCbCrSubsampling
On 9/25/2019 5:48 AM, Carl Eugen Hoyos wrote: > Am Di., 24. Sept. 2019 um 20:32 Uhr schrieb Skakov Pavel : > >> TIFF decoder uses wrong default YCbCrSubsampling value so it breaks >> on files that rely on standard default and omit the value. > > Patch applied. > > Thank you, Carl Eugen This patch broke fate-exif-image-tiff and fate-lavf-tiff. ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH] Adding a flag to give user the option to have ffmpeg fail instead of warn when mismatches are found in rtmp url stream or application names.
On 2019-09-25T20:57:08+0200, William Martin wrote: > +av_log(s, AV_LOG_ERROR, "App field don't match up: %s <-> %s. " Although I'm not a native English speaker, since "field" isn't plural, I'm pretty confident "don't" should be "doesn't". -- Reino ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH v4 3/9] avformat/utils: Move the reference to the packet list
On 9/20/2019 5:39 PM, Andreas Rheinhardt wrote:
> Up until now, ff_packet_list_put had a flaw: When it moved a packet to
> the list (meaning, when it ought to move the reference to the packet
> list instead of creating a new one via av_packet_ref), it did not reset
> the original packet, confusing the ownership of the data in the packet.
> This has been done because some callers of this function were not
> compatible with resetting the packet.
>
> This commit changes these callers and fixes this flaw. In order to
> indicate that the ownership of the packet has moved to the packet list,
> pointers to constant AVPackets are used whenever the target of the
> pointer might already be owned by the packet list.
>
> Signed-off-by: Andreas Rheinhardt
> ---
> libavformat/utils.c | 32 +---
> 1 file changed, 17 insertions(+), 15 deletions(-)
>
> diff --git a/libavformat/utils.c b/libavformat/utils.c
> index e348df3269..58e0db61da 100644
> --- a/libavformat/utils.c
> +++ b/libavformat/utils.c
> @@ -460,10 +460,7 @@ int ff_packet_list_put(AVPacketList **packet_buffer,
> return ret;
> }
> } else {
> -// TODO: Adapt callers in this file so the line below can use
> -// av_packet_move_ref() to effectively move the reference
> -// to the list.
> -pktl->pkt = *pkt;
> +av_packet_move_ref(>pkt, pkt);
I think it would be a good idea ensuring the packet is reference counted
here, to have more robust code and not depend on current callers having
done it themselves.
It's a matter of adding an av_packet_make_refcounted() call before this
line, much like it's done in av_bsf_send_packet(). It's essentially a
no-op when the packet is already reference counted.
> }
>
> if (*packet_buffer)
> @@ -835,6 +832,7 @@ int ff_read_packet(AVFormatContext *s, AVPacket *pkt)
>
> for (;;) {
> AVPacketList *pktl = s->internal->raw_packet_buffer;
> +const AVPacket *pkt1;
>
> if (pktl) {
> st = s->streams[pktl->pkt.stream_index];
> @@ -925,9 +923,10 @@ int ff_read_packet(AVFormatContext *s, AVPacket *pkt)
> av_packet_unref(pkt);
> return err;
> }
> -s->internal->raw_packet_buffer_remaining_size -= pkt->size;
> +pkt1 = >internal->raw_packet_buffer_end->pkt;
> +s->internal->raw_packet_buffer_remaining_size -= pkt1->size;
>
> -if ((err = probe_codec(s, st, pkt)) < 0)
> +if ((err = probe_codec(s, st, pkt1)) < 0)
> return err;
> }
> }
> @@ -3035,8 +3034,8 @@ static int has_codec_parameters(AVStream *st, const
> char **errmsg_ptr)
> }
>
> /* returns 1 or 0 if or if not decoded data was returned, or a negative
> error */
> -static int try_decode_frame(AVFormatContext *s, AVStream *st, AVPacket
> *avpkt,
> -AVDictionary **options)
> +static int try_decode_frame(AVFormatContext *s, AVStream *st,
> +const AVPacket *avpkt, AVDictionary **options)
> {
> AVCodecContext *avctx = st->internal->avctx;
> const AVCodec *codec;
> @@ -3528,7 +3527,7 @@ fail:
> return ret;
> }
>
> -static int extract_extradata(AVStream *st, AVPacket *pkt)
> +static int extract_extradata(AVStream *st, const AVPacket *pkt)
> {
> AVStreamInternal *sti = st->internal;
> AVPacket *pkt_ref;
> @@ -3591,7 +3590,7 @@ int avformat_find_stream_info(AVFormatContext *ic,
> AVDictionary **options)
> int64_t read_size;
> AVStream *st;
> AVCodecContext *avctx;
> -AVPacket pkt1, *pkt;
> +AVPacket pkt1;
> int64_t old_offset = avio_tell(ic->pb);
> // new streams might appear, no options for those
> int orig_nb_streams = ic->nb_streams;
> @@ -3710,6 +3709,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
>
> read_size = 0;
> for (;;) {
> +const AVPacket *pkt;
> int analyzed_all_streams;
> if (ff_check_interrupt(>interrupt_callback)) {
> ret = AVERROR_EXIT;
> @@ -3803,14 +3803,16 @@ FF_ENABLE_DEPRECATION_WARNINGS
> break;
> }
>
> -pkt =
> -
> if (!(ic->flags & AVFMT_FLAG_NOBUFFER)) {
> ret = ff_packet_list_put(>internal->packet_buffer,
> >internal->packet_buffer_end,
> - pkt, 0);
> + , 0);
> if (ret < 0)
> goto find_stream_info_err;
> +
> +pkt = >internal->packet_buffer_end->pkt;
> +} else {
> +pkt =
> }
>
> st = ic->streams[pkt->stream_index];
> @@ -3888,7 +3890,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
> limit,
> t, pkt->stream_index);
> if (ic->flags & AVFMT_FLAG_NOBUFFER)
> -av_packet_unref(pkt);
> +av_packet_unref();
>
Re: [FFmpeg-devel] [PATCH v3] avcodec/dnxhdenc: return error if av_malloc failed
On 9/23/2019 12:36 AM, lance.lmw...@gmail.com wrote:
> From: Limin Wang
>
> Signed-off-by: Limin Wang
> ---
> libavcodec/dnxhdenc.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/libavcodec/dnxhdenc.c b/libavcodec/dnxhdenc.c
> index 41b8079a09..c82c5d5140 100644
> --- a/libavcodec/dnxhdenc.c
> +++ b/libavcodec/dnxhdenc.c
> @@ -542,6 +542,8 @@ FF_ENABLE_DEPRECATION_WARNINGS
> if (avctx->active_thread_type == FF_THREAD_SLICE) {
> for (i = 1; i < avctx->thread_count; i++) {
> ctx->thread[i] = av_malloc(sizeof(DNXHDEncContext));
> +if (!ctx->thread[i])
> +goto fail;
> memcpy(ctx->thread[i], ctx, sizeof(DNXHDEncContext));
> }
> }
Pushed.
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 10/12] tools/target_dec_fuzzer: Adjust threshold for MSZH
Fixes: Timeout (250sec -> 6sec)
Fixes:
17627/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSZH_fuzzer-5643017129558016
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
---
tools/target_dec_fuzzer.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c
index 4af7b26e54..7172dffa4b 100644
--- a/tools/target_dec_fuzzer.c
+++ b/tools/target_dec_fuzzer.c
@@ -151,6 +151,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t
size) {
case AV_CODEC_ID_LSCR:maxpixels /= 16; break;
case AV_CODEC_ID_MOTIONPIXELS:maxpixels /= 256; break;
case AV_CODEC_ID_MSS2:maxpixels /= 16384; break;
+case AV_CODEC_ID_MSZH:maxpixels /= 128; break;
case AV_CODEC_ID_SNOW:maxpixels /= 128; break;
case AV_CODEC_ID_TRUEMOTION2: maxpixels /= 1024; break;
}
--
2.23.0
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 09/12] avcodec/pafvideo: Only clear frame when it was written to
This avoids unneeded operations and makes the code faster.
Fixes: Timeout
Fixes:
15724/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PAF_VIDEO_fuzzer-5750842205929472
(12sec -> 9sec)
Fixes:
17625/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PAF_VIDEO_fuzzer-5640515311108096
(16sec -> 4sec)
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
---
libavcodec/pafvideo.c | 10 --
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/libavcodec/pafvideo.c b/libavcodec/pafvideo.c
index 6b4771cbce..07fa05caf8 100644
--- a/libavcodec/pafvideo.c
+++ b/libavcodec/pafvideo.c
@@ -55,6 +55,7 @@ typedef struct PAFVideoDecContext {
int current_frame;
uint8_t *frame[4];
+int dirty[4];
int frame_size;
int video_size;
@@ -187,6 +188,7 @@ static int decode_0(PAFVideoDecContext *c, uint8_t *pkt,
uint8_t code)
j = bytestream2_get_le16(>gb) + offset;
if (bytestream2_get_bytes_left(>gb) < (j - offset) * 16)
return AVERROR_INVALIDDATA;
+c->dirty[page] = 1;
do {
offset++;
if (dst + 3 * c->width + 4 > dend)
@@ -329,9 +331,13 @@ static int paf_video_decode(AVCodecContext *avctx, void
*data,
c->pic->palette_has_changed = 1;
}
+c->dirty[c->current_frame] = 1;
if (code & 0x20)
-for (i = 0; i < 4; i++)
-memset(c->frame[i], 0, c->frame_size);
+for (i = 0; i < 4; i++) {
+if (c->dirty[i])
+memset(c->frame[i], 0, c->frame_size);
+c->dirty[i] = 0;
+}
switch (code & 0x0F) {
case 0:
--
2.23.0
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 12/12] avcodec/4xm: Check index in decode_i_block() also in the path where its not used.
Fixes: Infinite loop
Fixes: signed integer overflow: 2147483644 + 16 cannot be represented in type
'int'
Fixes:
16169/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5662570416963584
Fixes:
16782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5743163859271680
Fixes:
17641/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5711603562971136
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
---
libavcodec/4xm.c | 4
1 file changed, 4 insertions(+)
diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c
index 1f4e2aee24..336c651d31 100644
--- a/libavcodec/4xm.c
+++ b/libavcodec/4xm.c
@@ -525,6 +525,10 @@ static int decode_i_block(FourXContext *f, int16_t *block)
break;
if (code == 0xf0) {
i += 16;
+if (i >= 64) {
+av_log(f->avctx, AV_LOG_ERROR, "run %d overflow\n", i);
+return 0;
+}
} else {
if (code & 0xf) {
level = get_xbits(>gb, code & 0xf);
--
2.23.0
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 11/12] avcodec/loco: Check for end of input in the first line
Fixes: Timeout (85sec -> 0.1sec)
Fixes:
17634/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5666410809786368
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
---
libavcodec/loco.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavcodec/loco.c b/libavcodec/loco.c
index d8bf68a100..e891d83ece 100644
--- a/libavcodec/loco.c
+++ b/libavcodec/loco.c
@@ -155,6 +155,8 @@ static int loco_decode_plane(LOCOContext *l, uint8_t *data,
int width, int heigh
/* restore top line */
for (i = 1; i < width; i++) {
val = loco_get_rice();
+if (val == INT_MIN)
+ return AVERROR_INVALIDDATA;
data[i] = data[i - 1] + val;
}
data += stride;
--
2.23.0
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 05/12] avcodec/alsdec: Avoid dereferencing context pointer in inner interleave loop
This makes the decoder faster
Improves/Fixes: Timeout (22sec -> 20sec)
Testcase:
17619/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5078510820917248
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
---
libavcodec/alsdec.c | 10 ++
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c
index a53c170d18..56313d206c 100644
--- a/libavcodec/alsdec.c
+++ b/libavcodec/alsdec.c
@@ -1815,15 +1815,17 @@ static int decode_frame(AVCodecContext *avctx, void
*data, int *got_frame_ptr,
#define INTERLEAVE_OUTPUT(bps)
\
{
\
int##bps##_t *dest = (int##bps##_t*)frame->data[0];
\
+int channels = avctx->channels;
\
+int32_t **raw_samples = ctx->raw_samples;
\
shift = bps - ctx->avctx->bits_per_raw_sample;
\
if (!ctx->cs_switch) {
\
for (sample = 0; sample < ctx->cur_frame_length; sample++)
\
-for (c = 0; c < avctx->channels; c++)
\
-*dest++ = ctx->raw_samples[c][sample] * (1U << shift);
\
+for (c = 0; c < channels; c++)
\
+*dest++ = raw_samples[c][sample] * (1U << shift);
\
} else {
\
for (sample = 0; sample < ctx->cur_frame_length; sample++)
\
-for (c = 0; c < avctx->channels; c++)
\
-*dest++ = ctx->raw_samples[sconf->chan_pos[c]][sample] *
(1U << shift); \
+for (c = 0; c < channels; c++)
\
+*dest++ = raw_samples[sconf->chan_pos[c]][sample] * (1U <<
shift);\
}
\
}
--
2.23.0
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 04/12] avcodec/hcom: Check that there are dictionary entries
Fixes: out of array read Fixes: 17617/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCOM_fuzzer-5674970478280704 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/hcom.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavcodec/hcom.c b/libavcodec/hcom.c index bce9e80aa5..0559b050c3 100644 --- a/libavcodec/hcom.c +++ b/libavcodec/hcom.c @@ -52,7 +52,8 @@ static av_cold int hcom_init(AVCodecContext *avctx) if (avctx->extradata_size <= 7) return AVERROR_INVALIDDATA; s->dict_entries = AV_RB16(avctx->extradata); -if (avctx->extradata_size < s->dict_entries * 4 + 7) +if (avctx->extradata_size < s->dict_entries * 4 + 7 || +s->dict_entries == 0) return AVERROR_INVALIDDATA; s->delta_compression = AV_RB32(avctx->extradata + 2); s->sample = s->first_sample = avctx->extradata[avctx->extradata_size - 1]; -- 2.23.0 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 06/12] tools/target_dec_fuzzer: Check number of all samples decoded too, like max pixels
Signed-off-by: Michael Niedermayer
---
tools/target_dec_fuzzer.c | 7 +++
1 file changed, 7 insertions(+)
diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c
index 0dc1854738..6c670d8eb9 100644
--- a/tools/target_dec_fuzzer.c
+++ b/tools/target_dec_fuzzer.c
@@ -94,6 +94,7 @@ const uint64_t maxpixels_per_frame = 4096 * 4096;
uint64_t maxpixels;
const uint64_t maxsamples_per_frame = 256*1024*32;
+uint64_t maxsamples;
static const uint64_t FUZZ_TAG = 0x4741542D5A5A5546ULL;
@@ -103,6 +104,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t
size) {
const uint8_t *end = data + size;
uint32_t it = 0;
uint64_t ec_pixels = 0;
+uint64_t nb_samples = 0;
int (*decode_handler)(AVCodecContext *avctx, AVFrame *picture,
int *got_picture_ptr,
const AVPacket *avpkt) = NULL;
@@ -131,6 +133,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t
size) {
case AVMEDIA_TYPE_SUBTITLE: decode_handler = subtitle_handler ; break;
}
maxpixels = maxpixels_per_frame * maxiteration;
+maxsamples = maxsamples_per_frame * maxiteration;
switch (c->id) {
// Allows a small input to generate gigantic output
case AV_CODEC_ID_BINKVIDEO: maxpixels /= 32; break;
@@ -269,6 +272,10 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t
size) {
if (ec_pixels > maxpixels)
goto maximums_reached;
+nb_samples += frame->nb_samples;
+if (nb_samples > maxsamples)
+goto maximums_reached;
+
if (ret <= 0 || ret > avpkt.size)
break;
if (ctx->codec_type != AVMEDIA_TYPE_AUDIO)
--
2.23.0
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 08/12] avcodec/atrac3: Check block_align
Fixes: Infinite loop Fixes: 17620/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3_fuzzer-5086123012915200 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/atrac3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/atrac3.c b/libavcodec/atrac3.c index 6cdcdf1964..dc19a3863e 100644 --- a/libavcodec/atrac3.c +++ b/libavcodec/atrac3.c @@ -964,7 +964,7 @@ static av_cold int atrac3_decode_init(AVCodecContext *avctx) return AVERROR_INVALIDDATA; } -if (avctx->block_align >= UINT_MAX / 2) +if (avctx->block_align >= UINT_MAX / 2 || avctx->block_align <= 0) return AVERROR(EINVAL); q->decoded_bytes_buffer = av_mallocz(FFALIGN(avctx->block_align, 4) + -- 2.23.0 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 03/12] avcodec/fitsdec: Prevent division by 0 with huge data_max
Fixes: division by 0
Fixes:
15657/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5738154838982656
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
---
libavcodec/fitsdec.c | 9 -
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/libavcodec/fitsdec.c b/libavcodec/fitsdec.c
index 4f452422ef..88b841a964 100644
--- a/libavcodec/fitsdec.c
+++ b/libavcodec/fitsdec.c
@@ -195,6 +195,7 @@ static int fits_decode_frame(AVCodecContext *avctx, void
*data, int *got_frame,
uint8_t *dst8;
uint16_t *dst16;
uint64_t t;
+double scale;
FITSHeader header;
FITSContext * fitsctx = avctx->priv_data;
@@ -204,6 +205,12 @@ static int fits_decode_frame(AVCodecContext *avctx, void
*data, int *got_frame,
if (ret < 0)
return ret;
+scale = header.data_max - header.data_min;
+if (scale <= 0 || !isfinite(scale)) {
+scale = 1;
+}
+scale = 1/scale;
+
if (header.rgb) {
if (header.bitpix == 8) {
if (header.naxisn[2] == 3) {
@@ -272,7 +279,7 @@ static int fits_decode_frame(AVCodecContext *avctx, void
*data, int *got_frame,
for (j = 0; j < avctx->width; j++) { \
t = rd; \
if (!header.blank_found || t != header.blank) { \
-*dst++ = ((t - header.data_min) * ((1 << (sizeof(type) *
8)) - 1)) / (header.data_max - header.data_min); \
+*dst++ = ((t - header.data_min) * ((1 << (sizeof(type) *
8)) - 1)) * scale; \
} else { \
*dst++ = fitsctx->blank_val; \
} \
--
2.23.0
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 07/12] tools/target_dec_fuzzer: Print samples decoded like pixels
Signed-off-by: Michael Niedermayer --- tools/target_dec_fuzzer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c index 6c670d8eb9..4af7b26e54 100644 --- a/tools/target_dec_fuzzer.c +++ b/tools/target_dec_fuzzer.c @@ -297,7 +297,7 @@ maximums_reached: decode_handler(ctx, frame, _frame, ); } while (got_frame == 1 && it++ < maxiteration); -fprintf(stderr, "pixels decoded: %"PRId64", iterations: %d\n", ec_pixels, it); +fprintf(stderr, "pixels decoded: %"PRId64", samples decoded: %"PRId64", iterations: %d\n", ec_pixels, nb_samples, it); av_frame_free(); avcodec_free_context(); -- 2.23.0 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 01/12] avcodec/wmaprodec: get frame during frame decode
Fixes: memleak
Fixes:
17615/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA2_fuzzer-5681306024804352
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
---
libavcodec/wmaprodec.c | 10 ++
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/libavcodec/wmaprodec.c b/libavcodec/wmaprodec.c
index d0fa974c80..5ff26e907d 100644
--- a/libavcodec/wmaprodec.c
+++ b/libavcodec/wmaprodec.c
@@ -1793,6 +1793,12 @@ static int xma_decode_packet(AVCodecContext *avctx, void
*data,
AVFrame *frame = data;
int i, ret, offset = INT_MAX;
+if (!s->frames[s->current_stream]->data[0]) {
+s->frames[s->current_stream]->nb_samples = 512;
+if ((ret = ff_get_buffer(avctx, s->frames[s->current_stream], 0)) < 0)
{
+return ret;
+}
+}
/* decode current stream packet */
ret = decode_packet(avctx, >xma[s->current_stream],
s->frames[s->current_stream],
_stream_frame_ptr, avpkt);
@@ -1915,10 +1921,6 @@ static av_cold int xma_decode_init(AVCodecContext *avctx)
s->frames[i] = av_frame_alloc();
if (!s->frames[i])
return AVERROR(ENOMEM);
-s->frames[i]->nb_samples = 512;
-if ((ret = ff_get_buffer(avctx, s->frames[i], 0)) < 0) {
-return AVERROR(ENOMEM);
-}
s->start_channel[i] = start_channels;
start_channels += s->xma[i].nb_channels;
--
2.23.0
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 02/12] avcodec/dstdec: Fix integer overflow in samples_per_frame computation
Fixes: Timeout (? -> 2ms) Fixes: 17616/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5198057947267072 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/dstdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/dstdec.c b/libavcodec/dstdec.c index 0614c99c4b..8a1bc6a738 100644 --- a/libavcodec/dstdec.c +++ b/libavcodec/dstdec.c @@ -37,7 +37,7 @@ #define DST_MAX_CHANNELS 6 #define DST_MAX_ELEMENTS (2 * DST_MAX_CHANNELS) -#define DSD_FS44(sample_rate) (sample_rate * 8 / 44100) +#define DSD_FS44(sample_rate) (sample_rate * 8LL / 44100) #define DST_SAMPLES_PER_FRAME(sample_rate) (588 * DSD_FS44(sample_rate)) -- 2.23.0 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH] Adding a flag to give user the option to have ffmpeg fail instead of warn when mismatches are found in rtmp url stream or application names.
From: Will Martin
Motivation: When running multiple rtmp ingest on the same machine on the same
port, users may want to explicitly forbid mismatched rtmp streams from
successfully completing handshakes. This patch allows for such enforcement
Signed-off-by: Will Martin
---
libavformat/librtmp.c | 2 ++
libavformat/rtmpproto.c | 24
2 files changed, 22 insertions(+), 4 deletions(-)
diff --git a/libavformat/librtmp.c b/libavformat/librtmp.c
index 43013e46e0..00b49666fd 100644
--- a/libavformat/librtmp.c
+++ b/libavformat/librtmp.c
@@ -52,6 +52,7 @@ typedef struct LibRTMPContext {
int live;
char *temp_filename;
int buffer_size;
+bool strict_paths;
} LibRTMPContext;
static void rtmp_log(int level, const char *fmt, va_list args)
@@ -333,6 +334,7 @@ static const AVOption options[] = {
{"rtmp_swfurl", "URL of the SWF player. By default no value will be sent",
OFFSET(swfurl), AV_OPT_TYPE_STRING, {.str = NULL }, 0, 0, DEC|ENC},
{"rtmp_swfverify", "URL to player swf file, compute hash/size
automatically. (unimplemented)", OFFSET(swfverify), AV_OPT_TYPE_STRING, {.str =
NULL }, 0, 0, DEC},
{"rtmp_tcurl", "URL of the target stream. Defaults to
proto://host[:port]/app.", OFFSET(tcurl), AV_OPT_TYPE_STRING, {.str = NULL },
0, 0, DEC|ENC},
+{"rtmp_strict_paths", "Error instead of warn for mismatch on stream or
application path in url", OFFSET(strict_paths), AV_OPT_TYPE_BOOL, {.i64 = 0 },
0, 1, DEC},
#if CONFIG_NETWORK
{"rtmp_buffer_size", "set buffer size in bytes", OFFSET(buffer_size),
AV_OPT_TYPE_INT, {.i64 = -1}, -1, INT_MAX, DEC|ENC },
#endif
diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c
index b741e421af..dded3b6028 100644
--- a/libavformat/rtmpproto.c
+++ b/libavformat/rtmpproto.c
@@ -129,6 +129,7 @@ typedef struct RTMPContext {
char auth_params[500];
int do_reconnect;
int auth_tried;
+int strict_paths; ///< If true, enforce strict
string matching on rtmp stream and application
} RTMPContext;
#define PLAYER_KEY_OPEN_PART_LEN 30 ///< length of partial key used for
first client digest signing
@@ -477,9 +478,16 @@ static int read_connect(URLContext *s, RTMPContext *rt)
"app", tmpstr, sizeof(tmpstr));
if (ret)
av_log(s, AV_LOG_WARNING, "App field not found in connect\n");
-if (!ret && strcmp(tmpstr, rt->app))
-av_log(s, AV_LOG_WARNING, "App field don't match up: %s <-> %s\n",
+if (!ret && strcmp(tmpstr, rt->app)) {
+if (rt->strict_paths) {
+av_log(s, AV_LOG_ERROR, "App field don't match up: %s <-> %s. "
+ "Exiting since rtmp_strict_paths provided\n", tmpstr, rt->app);
+return AVERROR(EIO);
+} else {
+av_log(s, AV_LOG_WARNING, "App field don't match up: %s <-> %s\n",
tmpstr, rt->app);
+}
+}
ff_rtmp_packet_destroy();
// Send Window Acknowledgement Size (as defined in specification)
@@ -1946,9 +1954,16 @@ static int send_invoke_response(URLContext *s,
RTMPPacket *pkt)
pchar = s->filename;
}
pchar++;
-if (strcmp(pchar, filename))
-av_log(s, AV_LOG_WARNING, "Unexpected stream %s, expecting"
+if (strcmp(pchar, filename)) {
+if (rt->strict_paths) {
+av_log(s, AV_LOG_ERROR, "Unexpected stream %s, expecting
%s. "
+"Exiting since rtmp_strict_paths provided.\n",
filename, pchar);
+return AVERROR(EIO);
+} else {
+av_log(s, AV_LOG_WARNING, "Unexpected stream %s, expecting"
" %s\n", filename, pchar);
+}
+}
}
rt->state = STATE_RECEIVING;
}
@@ -3112,6 +3127,7 @@ static const AVOption rtmp_options[] = {
{"rtmp_listen", "Listen for incoming rtmp connections", OFFSET(listen),
AV_OPT_TYPE_INT, {.i64 = 0}, INT_MIN, INT_MAX, DEC, "rtmp_listen" },
{"listen", "Listen for incoming rtmp connections", OFFSET(listen),
AV_OPT_TYPE_INT, {.i64 = 0}, INT_MIN, INT_MAX, DEC, "rtmp_listen" },
{"timeout", "Maximum timeout (in seconds) to wait for incoming
connections. -1 is infinite. Implies -rtmp_listen 1", OFFSET(listen_timeout),
AV_OPT_TYPE_INT, {.i64 = -1}, INT_MIN, INT_MAX, DEC, "rtmp_listen" },
+{"rtmp_strict_paths", "Error instead of warn for mismatch on stream or
application path in url", OFFSET(strict_paths), AV_OPT_TYPE_BOOL, {.i64 = 0 },
0, 1, DEC},
{ NULL },
};
--
2.20.1 (Apple Git-117)
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH 2/2] avcodec/fitsdec: Prevent division by 0 with huge data_max
On Thu, Jul 18, 2019 at 08:21:21AM +0200, Reimar Döffinger wrote: > > > On 16.07.2019, at 20:31, Michael Niedermayer wrote: > > > On Tue, Jul 16, 2019 at 08:34:14AM +0200, Reimar Döffinger wrote: > >> On 16.07.2019, at 00:50, Michael Niedermayer > >> wrote: > >> > >>> Fixes: division by 0 > >>> Fixes: > >>> 15657/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5738154838982656 > >>> > >>> Found-by: continuous fuzzing process > >>> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > >>> Signed-off-by: Michael Niedermayer > >>> --- > >>> libavcodec/fitsdec.c | 2 +- > >>> 1 file changed, 1 insertion(+), 1 deletion(-) > >>> > >>> diff --git a/libavcodec/fitsdec.c b/libavcodec/fitsdec.c > >>> index 4f452422ef..fe941f199d 100644 > >>> --- a/libavcodec/fitsdec.c > >>> +++ b/libavcodec/fitsdec.c > >>> @@ -174,7 +174,7 @@ static int fits_read_header(AVCodecContext *avctx, > >>> const uint8_t **ptr, FITSHead > >>>return AVERROR_INVALIDDATA; > >>>} > >>>av_log(avctx, AV_LOG_WARNING, "data min/max indicates a blank > >>> image\n"); > >>> -header->data_max ++; > >>> +header->data_max += fabs(header->data_max) / 1000 + 1; > >> > >> This is really non-obvious, both by itself, in where/how it causes the > >> division by 0 and that the error here isn't worse than the division by 0 > >> for example, and why this constant was chosen. > > > > division by 0 occured in: > > *dst++ = ((t - header.data_min) * ((1 << (sizeof(type) * 8)) - 1)) / > > (header.data_max - header.data_min); \ > > I looked at the code, and now it makes even less sense to me. > First, why is that reported as an error at all? > Dividing by 0 is well defined for floating-point. > Next, your patch handles only one corner-case while not handling others. > For example, data_min and data_max can also be inf or NaN, which equally make > no sense (and result in a division by NaN, which can hardly be better than a > division by 0). > Next, bzero is applied to data_min and data_max which can cause precision > issues, so it's a bit questionable but maybe non-trivial to fix completely. > However as data_max is never used but only the delta, most of these issues > can be fixed much more thoroughly (and improve performance) by calculating > and storing only that delta, and before applying bzero. Then delta can simply > be overridden to 1 if it is fishy (not a normal or 0). > Of course there is a question if values above data_max are supposed to result > in output > 1 or be clamped, but I guess that issue can be ignored. > As the code pays no particular attention to precision issue it would also be > a question if calculating the inverse and use multiplications instead of > divisions would make sense, but that admittedly is just an optimization. ill post a different patch which incorprorates some ideas from this thread thx [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Take away the freedom of one citizen and you will be jailed, take away the freedom of all citizens and you will be congratulated by your peers in Parliament. signature.asc Description: PGP signature ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH] aformat/movenc: add missing padding to output track extradata
Fixes ticket #8183.
Signed-off-by: James Almer
---
libavformat/movenc.c | 15 ++-
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/libavformat/movenc.c b/libavformat/movenc.c
index c824ff5ba1..e3283871d0 100644
--- a/libavformat/movenc.c
+++ b/libavformat/movenc.c
@@ -5377,12 +5377,13 @@ int ff_mov_write_packet(AVFormatContext *s, AVPacket
*pkt)
!TAG_IS_AVCI(trk->tag) &&
(par->codec_id != AV_CODEC_ID_DNXHD)) {
trk->vos_len = par->extradata_size;
-trk->vos_data = av_malloc(trk->vos_len);
+trk->vos_data = av_malloc(trk->vos_len + AV_INPUT_BUFFER_PADDING_SIZE);
if (!trk->vos_data) {
ret = AVERROR(ENOMEM);
goto err;
}
memcpy(trk->vos_data, par->extradata, trk->vos_len);
+memset(trk->vos_data + trk->vos_len, 0, AV_INPUT_BUFFER_PADDING_SIZE);
}
if (par->codec_id == AV_CODEC_ID_AAC && pkt->size > 2 &&
@@ -5460,12 +5461,13 @@ int ff_mov_write_packet(AVFormatContext *s, AVPacket
*pkt)
par->codec_id == AV_CODEC_ID_AC3) && !trk->vos_len) {
/* copy frame to create needed atoms */
trk->vos_len = size;
-trk->vos_data = av_malloc(size);
+trk->vos_data = av_malloc(size + AV_INPUT_BUFFER_PADDING_SIZE);
if (!trk->vos_data) {
ret = AVERROR(ENOMEM);
goto err;
}
memcpy(trk->vos_data, pkt->data, size);
+memset(trk->vos_data + size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
}
if (trk->entry >= trk->cluster_capacity) {
@@ -6090,12 +6092,13 @@ static int
mov_create_dvd_sub_decoder_specific_info(MOVTrack *track,
cur += strspn(cur, "\n\r");
}
if (have_palette) {
-track->vos_data = av_malloc(16*4);
+track->vos_data = av_malloc(16*4 + AV_INPUT_BUFFER_PADDING_SIZE);
if (!track->vos_data)
return AVERROR(ENOMEM);
for (i = 0; i < 16; i++) {
AV_WB32(track->vos_data + i * 4, palette[i]);
}
+memset(track->vos_data + 16*4, 0, AV_INPUT_BUFFER_PADDING_SIZE);
track->vos_len = 16 * 4;
}
st->codecpar->width = width;
@@ -6453,11 +6456,12 @@ static int mov_write_header(AVFormatContext *s)
mov_create_dvd_sub_decoder_specific_info(track, st);
else if (!TAG_IS_AVCI(track->tag) && st->codecpar->codec_id !=
AV_CODEC_ID_DNXHD) {
track->vos_len = st->codecpar->extradata_size;
-track->vos_data = av_malloc(track->vos_len);
+track->vos_data = av_malloc(track->vos_len +
AV_INPUT_BUFFER_PADDING_SIZE);
if (!track->vos_data) {
return AVERROR(ENOMEM);
}
memcpy(track->vos_data, st->codecpar->extradata,
track->vos_len);
+memset(track->vos_data + track->vos_len, 0,
AV_INPUT_BUFFER_PADDING_SIZE);
}
}
@@ -6713,10 +6717,11 @@ static int mov_write_trailer(AVFormatContext *s)
AVCodecParameters *par = track->par;
track->vos_len = par->extradata_size;
-track->vos_data = av_malloc(track->vos_len);
+track->vos_data = av_malloc(track->vos_len +
AV_INPUT_BUFFER_PADDING_SIZE);
if (!track->vos_data)
return AVERROR(ENOMEM);
memcpy(track->vos_data, par->extradata, track->vos_len);
+memset(track->vos_data + track->vos_len, 0,
AV_INPUT_BUFFER_PADDING_SIZE);
}
mov->need_rewrite_extradata = 0;
}
--
2.22.0
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 1/2] avfilter/vf_stack: simplify main processing path
Signed-off-by: Paul B Mahol
---
libavfilter/vf_stack.c | 93 ++
1 file changed, 48 insertions(+), 45 deletions(-)
diff --git a/libavfilter/vf_stack.c b/libavfilter/vf_stack.c
index 4d254e0013..3b05807a95 100644
--- a/libavfilter/vf_stack.c
+++ b/libavfilter/vf_stack.c
@@ -82,6 +82,10 @@ static av_cold int init(AVFilterContext *ctx)
if (!s->frames)
return AVERROR(ENOMEM);
+s->items = av_calloc(s->nb_inputs, sizeof(*s->items));
+if (!s->items)
+return AVERROR(ENOMEM);
+
if (!strcmp(ctx->filter->name, "xstack")) {
if (!s->layout) {
if (s->nb_inputs == 2) {
@@ -93,10 +97,6 @@ static av_cold int init(AVFilterContext *ctx)
return AVERROR(EINVAL);
}
}
-
-s->items = av_calloc(s->nb_inputs, sizeof(*s->items));
-if (!s->items)
-return AVERROR(ENOMEM);
}
for (i = 0; i < s->nb_inputs; i++) {
@@ -123,7 +123,7 @@ static int process_frame(FFFrameSync *fs)
StackContext *s = fs->opaque;
AVFrame **in = s->frames;
AVFrame *out;
-int i, p, ret, offset[4] = { 0 };
+int i, p, ret;
for (i = 0; i < s->nb_inputs; i++) {
if ((ret = ff_framesync_get_frame(>fs, i, [i], 0)) < 0)
@@ -137,44 +137,14 @@ static int process_frame(FFFrameSync *fs)
out->sample_aspect_ratio = outlink->sample_aspect_ratio;
for (i = 0; i < s->nb_inputs; i++) {
-AVFilterLink *inlink = ctx->inputs[i];
-int linesize[4];
-int height[4];
-
-if (s->is_horizontal || s->is_vertical) {
-if ((ret = av_image_fill_linesizes(linesize, inlink->format,
inlink->w)) < 0) {
-av_frame_free();
-return ret;
-}
-
-height[1] = height[2] = AV_CEIL_RSHIFT(inlink->h,
s->desc->log2_chroma_h);
-height[0] = height[3] = inlink->h;
-}
+StackItem *item = >items[i];
for (p = 0; p < s->nb_planes; p++) {
-if (s->is_vertical) {
-av_image_copy_plane(out->data[p] + offset[p] *
out->linesize[p],
-out->linesize[p],
-in[i]->data[p],
-in[i]->linesize[p],
-linesize[p], height[p]);
-offset[p] += height[p];
-} else if (s->is_horizontal) {
-av_image_copy_plane(out->data[p] + offset[p],
-out->linesize[p],
-in[i]->data[p],
-in[i]->linesize[p],
-linesize[p], height[p]);
-offset[p] += linesize[p];
-} else {
-StackItem *item = >items[i];
-
-av_image_copy_plane(out->data[p] + out->linesize[p] *
item->y[p] + item->x[p],
-out->linesize[p],
-in[i]->data[p],
-in[i]->linesize[p],
-item->linesize[p], item->height[p]);
-}
+av_image_copy_plane(out->data[p] + out->linesize[p] * item->y[p] +
item->x[p],
+out->linesize[p],
+in[i]->data[p],
+in[i]->linesize[p],
+item->linesize[p], item->height[p]);
}
}
@@ -197,20 +167,53 @@ static int config_output(AVFilterLink *outlink)
return AVERROR_BUG;
if (s->is_vertical) {
-for (i = 1; i < s->nb_inputs; i++) {
+for (i = 0; i < s->nb_inputs; i++) {
+AVFilterLink *inlink = ctx->inputs[i];
+StackItem *item = >items[i];
+
if (ctx->inputs[i]->w != width) {
av_log(ctx, AV_LOG_ERROR, "Input %d width %d does not match
input %d width %d.\n", i, ctx->inputs[i]->w, 0, width);
return AVERROR(EINVAL);
}
-height += ctx->inputs[i]->h;
+
+if ((ret = av_image_fill_linesizes(item->linesize, inlink->format,
inlink->w)) < 0) {
+return ret;
+}
+
+item->height[1] = item->height[2] = AV_CEIL_RSHIFT(inlink->h,
s->desc->log2_chroma_h);
+item->height[0] = item->height[3] = inlink->h;
+
+if (i) {
+item->y[1] = item->y[2] = AV_CEIL_RSHIFT(height,
s->desc->log2_chroma_h);
+item->y[0] = item->y[3] = height;
+
+height += ctx->inputs[i]->h;
+}
}
} else if (s->is_horizontal) {
-for (i = 1; i < s->nb_inputs; i++) {
+for (i = 0; i < s->nb_inputs; i++) {
+AVFilterLink *inlink = ctx->inputs[i];
+StackItem *item = >items[i];
+
if (ctx->inputs[i]->h != height) {
av_log(ctx, AV_LOG_ERROR,
[FFmpeg-devel] [PATCH 2/2] avfilter/vf_stack: add slice threading
Signed-off-by: Paul B Mahol
---
libavfilter/vf_stack.c | 43 +++---
1 file changed, 28 insertions(+), 15 deletions(-)
diff --git a/libavfilter/vf_stack.c b/libavfilter/vf_stack.c
index 3b05807a95..b9e87a4429 100644
--- a/libavfilter/vf_stack.c
+++ b/libavfilter/vf_stack.c
@@ -116,6 +116,29 @@ static av_cold int init(AVFilterContext *ctx)
return 0;
}
+static int process_slice(AVFilterContext *ctx, void *arg, int job, int nb_jobs)
+{
+StackContext *s = ctx->priv;
+AVFrame *out = arg;
+AVFrame **in = s->frames;
+const int start = (s->nb_inputs * job ) / nb_jobs;
+const int end = (s->nb_inputs * (job+1)) / nb_jobs;
+
+for (int i = start; i < end; i++) {
+StackItem *item = >items[i];
+
+for (int p = 0; p < s->nb_planes; p++) {
+av_image_copy_plane(out->data[p] + out->linesize[p] * item->y[p] +
item->x[p],
+out->linesize[p],
+in[i]->data[p],
+in[i]->linesize[p],
+item->linesize[p], item->height[p]);
+}
+}
+
+return 0;
+}
+
static int process_frame(FFFrameSync *fs)
{
AVFilterContext *ctx = fs->parent;
@@ -123,7 +146,7 @@ static int process_frame(FFFrameSync *fs)
StackContext *s = fs->opaque;
AVFrame **in = s->frames;
AVFrame *out;
-int i, p, ret;
+int i, ret;
for (i = 0; i < s->nb_inputs; i++) {
if ((ret = ff_framesync_get_frame(>fs, i, [i], 0)) < 0)
@@ -136,17 +159,7 @@ static int process_frame(FFFrameSync *fs)
out->pts = av_rescale_q(s->fs.pts, s->fs.time_base, outlink->time_base);
out->sample_aspect_ratio = outlink->sample_aspect_ratio;
-for (i = 0; i < s->nb_inputs; i++) {
-StackItem *item = >items[i];
-
-for (p = 0; p < s->nb_planes; p++) {
-av_image_copy_plane(out->data[p] + out->linesize[p] * item->y[p] +
item->x[p],
-out->linesize[p],
-in[i]->data[p],
-in[i]->linesize[p],
-item->linesize[p], item->height[p]);
-}
-}
+ctx->internal->execute(ctx, process_slice, out, NULL, FFMIN(s->nb_inputs,
ff_filter_get_nb_threads(ctx)));
return ff_filter_frame(outlink, out);
}
@@ -370,7 +383,7 @@ AVFilter ff_vf_hstack = {
.init = init,
.uninit= uninit,
.activate = activate,
-.flags = AVFILTER_FLAG_DYNAMIC_INPUTS,
+.flags = AVFILTER_FLAG_DYNAMIC_INPUTS |
AVFILTER_FLAG_SLICE_THREADS,
};
#endif /* CONFIG_HSTACK_FILTER */
@@ -390,7 +403,7 @@ AVFilter ff_vf_vstack = {
.init = init,
.uninit= uninit,
.activate = activate,
-.flags = AVFILTER_FLAG_DYNAMIC_INPUTS,
+.flags = AVFILTER_FLAG_DYNAMIC_INPUTS |
AVFILTER_FLAG_SLICE_THREADS,
};
#endif /* CONFIG_VSTACK_FILTER */
@@ -416,7 +429,7 @@ AVFilter ff_vf_xstack = {
.init = init,
.uninit= uninit,
.activate = activate,
-.flags = AVFILTER_FLAG_DYNAMIC_INPUTS,
+.flags = AVFILTER_FLAG_DYNAMIC_INPUTS |
AVFILTER_FLAG_SLICE_THREADS,
};
#endif /* CONFIG_XSTACK_FILTER */
--
2.17.1
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH v4] doc/filters: add 4x4 layout example for xstack filter
Ok, the formatting is fine except for one. See below. On 25-09-2019 03:56 AM, lance.lmw...@gmail.com wrote: From: Limin Wang Reviewed-by: Gyan Signed-off-by: Limin Wang --- doc/filters.texi | 42 +- 1 file changed, 41 insertions(+), 1 deletion(-) diff --git a/doc/filters.texi b/doc/filters.texi index e41384a..a8342c0 100644 --- a/doc/filters.texi +++ b/doc/filters.texi @@ -19057,6 +19057,13 @@ terminates. Default value is 0. @itemize @item Display 4 inputs into 2x2 grid. + +Below is the 4 inputs position: +@example +input1(0, 0) | input3(w0, 0) +input2(0, h0) | input4(w0, h0) +@end example + Note that if inputs are of different sizes unused gaps might appear, as not all of output video is used. @example @@ -19065,6 +19072,12 @@ xstack=inputs=4:layout=0_0|0_h0|w0_0|w0_h0 @item Display 4 inputs into 1x4 grid. + +Below is the 4 inputs position: +@example +input1(0, 0) | input2(0, h0) | input3(0, h0+h1) | input4(0, h0+h1+h2) Since this is 1 column x 4 rows, these should be different lines without the separator. +@end example + Note that if inputs are of different sizes unused gaps might appear, as not all of output video is used. @example @@ -19073,11 +19086,38 @@ xstack=inputs=4:layout=0_0|0_h0|0_h0+h1|0_h0+h1+h2 @item Display 9 inputs into 3x3 grid. + +Below is the 9 inputs position: +@example +input1(0, 0) | input4(w0, 0) | input7(w0+w1, 0) +input2(0, h0) | input5(w0, h0) | input8(w0+w1, h0) +input3(0, h0+h1) | input6(w0, h0+h1) | input9(w0+w1, h0+h1) Shouldn't the third column be at x = w0+w3? w1 is width of input2, right? +@end example + Note that if inputs are of different sizes unused gaps might appear, as not all of output video is used. @example -xstack=inputs=9:layout=w3_0|w3_h0+h2|w3_h0|0_h4|0_0|w3+w1_0|0_h1+h2|w3+w1_h0|w3+w1_h1+h2 +xstack=inputs=9:layout=0_0|0_h0|0_h0+h1|w0_0|w0_h0|w0_h0+h1|w0+w1_0|w0+w1_h0|w0+w1_h0+h1 @end example + +@item +Display 16 inputs into 4x4 grid. + +Below is the 16 inputs position: +@example +input1(0, 0) | input5(w0, 0) | input9 (w0+w1, 0) | input13(w0+w1+w2, 0) +input2(0, h0) | input6(w0, h0) | input10(w0+w1, h0) | input14(w0+w1+w2, h0) +input3(0, h0+h1) | input7(w0, h0+h1) | input11(w0+w1, h0+h1) | input15(w0+w1+w2, h0+h1) +input4(0, h0+h1+h2)| input8(w0, h0+h1+h2)| input12(w0+w1, h0+h1+h2)| input16(w0+w1+w2, h0+h1+h2) Same as above. You should also note that when videos are of different sizes, the videos may overlap e.g. if height of input5 is greater than input1, then input6 will be overlaid on top of part of input5. Gyan ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH] avcodec/qtrleenc: fix undefined behaviour
Fixes #7991. Signed-off-by: Paul B Mahol --- libavcodec/qtrleenc.c | 7 --- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/libavcodec/qtrleenc.c b/libavcodec/qtrleenc.c index cdd864bf82..6669c1302f 100644 --- a/libavcodec/qtrleenc.c +++ b/libavcodec/qtrleenc.c @@ -259,9 +259,10 @@ static void qtrle_encode_line(QtrleEncContext *s, const AVFrame *p, int line, ui /* These bulk costs increase every iteration */ lowest_bulk_cost += s->pixel_size; sec_lowest_bulk_cost += s->pixel_size; - -this_line -= s->pixel_size; -prev_line -= s->pixel_size; +if (this_line >= p->data[0] + s->pixel_size) +this_line -= s->pixel_size; +if (prev_line >= s->previous_frame->data[0] + s->pixel_size) +prev_line -= s->pixel_size; } /* Good! Now we have the best sequence for this line, let's output it. */ -- 2.17.1 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH 4/5] tools/target_dec_fuzzer: Set max_samples
On Tue, Sep 03, 2019 at 02:14:25AM +0200, Michael Niedermayer wrote: > Signed-off-by: Michael Niedermayer > --- > tools/target_dec_fuzzer.c | 4 > 1 file changed, 4 insertions(+) will apply [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Rewriting code that is poorly written but fully understood is good. Rewriting code that one doesnt understand is a sign that one is less smart then the original author, trying to rewrite it will not make it better. signature.asc Description: PGP signature ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH 5/5] avcodec/apedec: Check max_samples
On Tue, Sep 03, 2019 at 02:39:27PM -0300, James Almer wrote: > On 9/3/2019 8:13 AM, Michael Niedermayer wrote: > > On Mon, Sep 02, 2019 at 09:40:47PM -0300, James Almer wrote: > >> On 9/2/2019 9:14 PM, Michael Niedermayer wrote: > >>> Fixes: OOM > >>> Fixes: > >>> 16627/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5638059583864832 > >>> > >>> Found-by: continuous fuzzing process > >>> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > >>> Signed-off-by: Michael Niedermayer > >>> --- > >>> libavcodec/apedec.c | 3 +++ > >>> 1 file changed, 3 insertions(+) > >>> > >>> diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c > >>> index e218f7c043..774ce18531 100644 > >>> --- a/libavcodec/apedec.c > >>> +++ b/libavcodec/apedec.c > >>> @@ -1475,6 +1475,9 @@ static int ape_decode_frame(AVCodecContext *avctx, > >>> void *data, > >>> return AVERROR_INVALIDDATA; > >>> } > >>> > >>> +if (nblocks * (int64_t)avctx->channels > avctx->max_samples) > >>> +return AVERROR(EINVAL); > >>> + > >> > >> Shouldn't this be checked in ff_get_buffer()? Same as max_pixels, but > >> checking "frame->nb_samples > avctx->max_samples" instead or > >> width/height. Otherwise it will barely be used. > > > > you are correct, it should be checked in *get_buffer somewhere too. > > But the offending allocation occurs before any *get_buffer calls so > > this check here is what is neccessary and sufficient for this specific > > bug > > If the allocation you're talking about is > https://git.videolan.org/?p=ffmpeg.git;a=blob;f=libavcodec/apedec.c;h=490b11b94e0b1666f18248b2b247c874fed6e0bc;hb=HEAD#l1500 > then you could just move it (and the five lines that follow it) right > below the ff_get_buffer() call. ill apply a patch which does the check in ff_get_buffer() at the same point where its done for max_pixels thx [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB The greatest way to live with honor in this world is to be what we pretend to be. -- Socrates signature.asc Description: PGP signature ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH 3/5] avcodec: add max_samples
On Tue, Sep 03, 2019 at 07:52:35PM +0200, Nicolas George wrote: > James Almer (12019-09-03): > > I prefer a separate field. If the existing field was called in a more > > ambiguous way I'd be ok with reusing it, but not like this. > > Same for me. ok, will apply thanks [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Dictatorship naturally arises out of democracy, and the most aggravated form of tyranny and slavery out of the most extreme liberty. -- Plato signature.asc Description: PGP signature ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH]lavf/avio: Print https warning also for avio_find_protocol_name()
Am Mi., 25. Sept. 2019 um 11:35 Uhr schrieb Carl Eugen Hoyos : > > Hi! > > Attached patch helps users fixing ticket #8197. > > Please comment, Carl Eugen From 92a62e4f56f4820d79529060636e0382b33b376b Mon Sep 17 00:00:00 2001 From: Carl Eugen Hoyos Date: Wed, 25 Sep 2019 11:32:57 +0200 Subject: [PATCH] lavf/avio: Print https warning also for avio_find_protocol_name(). Helps to fix ticket #8197. --- libavformat/avio.c | 7 +++ 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/libavformat/avio.c b/libavformat/avio.c index 663789ec02..c1bad312cd 100644 --- a/libavformat/avio.c +++ b/libavformat/avio.c @@ -283,6 +283,9 @@ static const struct URLProtocol *url_find_protocol(const char *filename) } } av_freep(); +if (av_strstart(filename, "https:", NULL) || av_strstart(filename, "tls:", NULL)) +av_log(NULL, AV_LOG_WARNING, "https protocol not found, recompile FFmpeg with " + "openssl, gnutls or securetransport enabled.\n"); return NULL; } @@ -297,10 +300,6 @@ int ffurl_alloc(URLContext **puc, const char *filename, int flags, return url_alloc_for_protocol(puc, p, filename, flags, int_cb); *puc = NULL; -if (av_strstart(filename, "https:", NULL) || av_strstart(filename, "tls:", NULL)) -av_log(NULL, AV_LOG_WARNING, "https protocol not found, recompile FFmpeg with " - "openssl, gnutls " - "or securetransport enabled.\n"); return AVERROR_PROTOCOL_NOT_FOUND; } -- 2.23.0 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH 01/13] avformat/mux: Move packet references
Andreas Rheinhardt:
> Andreas Rheinhardt:
>> In the common case that the input packet was already refcounted,
>> ff_interleave_add_packet would allocate a new AVPacketList, use
>> av_packet_ref to create a new reference to the buffer for the
>> AVPacketList's packet, interleave the packet and finally unreference
>> the original input packet.
>> This commit changes this: It uses av_packet_move_ref to transfer
>> the packet to its destination. In case the input packet is refcounted,
>> this saves an allocation and a free (of an AVBufferRef); if not, the
>> packet is made refcounted before moving it. When the input packet has
>> side data, one saves even more than one allocation+free.
>>
>> Furthermore, when the packet is in reality an uncoded frame, a hacky
>> ad-hoc variant of av_packet_move_ref has been employed. Not any more.
>>
>> Signed-off-by: Andreas Rheinhardt
>> ---
>> libavformat/mux.c | 11 ---
>> 1 file changed, 4 insertions(+), 7 deletions(-)
>>
>> diff --git a/libavformat/mux.c b/libavformat/mux.c
>> index 8ab5ea8c2b..ac370fb24d 100644
>> --- a/libavformat/mux.c
>> +++ b/libavformat/mux.c
>> @@ -930,17 +930,16 @@ int ff_interleave_add_packet(AVFormatContext *s,
>> AVPacket *pkt,
>> if ((pkt->flags & AV_PKT_FLAG_UNCODED_FRAME)) {
>> av_assert0(pkt->size == UNCODED_FRAME_PACKET_SIZE);
>> av_assert0(((AVFrame *)pkt->data)->buf);
>> -this_pktl->pkt = *pkt;
>> -pkt->buf = NULL;
>> -pkt->side_data = NULL;
>> -pkt->side_data_elems = 0;
>> } else {
>> -if ((ret = av_packet_ref(_pktl->pkt, pkt)) < 0) {
>> +if ((ret = av_packet_make_refcounted(pkt)) < 0) {
>> av_free(this_pktl);
>> return ret;
>> }
>> }
>>
>> +av_packet_move_ref(_pktl->pkt, pkt);
>> +pkt = _pktl->pkt;
>> +
>> if (s->streams[pkt->stream_index]->last_in_packet_buffer) {
>> next_point = &(st->last_in_packet_buffer->next);
>> } else {
>> @@ -989,8 +988,6 @@ next_non_null:
>> s->streams[pkt->stream_index]->last_in_packet_buffer =
>> *next_point = this_pktl;
>>
>> -av_packet_unref(pkt);
>> -
>> return 0;
>> }
>>
>>
> Ping for this patch and the remaining unmerged patches in this
> patchset (patches 1, 2, 4, 5, 7-13).
>
> - Andreas
>
Another ping.
- Andreas
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH 4/4] avcodec/g729_parser: Check block_size
lgtm
On 9/25/19, Michael Niedermayer wrote:
> Fixes: Infinite loop
> Fixes:
> 17611/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5765134928052224
>
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer
> ---
> libavcodec/g729_parser.c | 6 ++
> 1 file changed, 6 insertions(+)
>
> diff --git a/libavcodec/g729_parser.c b/libavcodec/g729_parser.c
> index 5a57025d62..010f688104 100644
> --- a/libavcodec/g729_parser.c
> +++ b/libavcodec/g729_parser.c
> @@ -53,6 +53,12 @@ static int g729_parse(AVCodecParserContext *s1,
> AVCodecContext *avctx,
> s->duration = avctx->frame_size;
> }
>
> +if (!s->block_size) {
> +*poutbuf = buf;
> +*poutbuf_size = buf_size;
> +return buf_size;
> +}
> +
> if (!s->remaining)
> s->remaining = s->block_size;
> if (s->remaining <= buf_size) {
> --
> 2.23.0
>
> ___
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 4/4] avcodec/g729_parser: Check block_size
Fixes: Infinite loop
Fixes:
17611/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5765134928052224
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
---
libavcodec/g729_parser.c | 6 ++
1 file changed, 6 insertions(+)
diff --git a/libavcodec/g729_parser.c b/libavcodec/g729_parser.c
index 5a57025d62..010f688104 100644
--- a/libavcodec/g729_parser.c
+++ b/libavcodec/g729_parser.c
@@ -53,6 +53,12 @@ static int g729_parse(AVCodecParserContext *s1,
AVCodecContext *avctx,
s->duration = avctx->frame_size;
}
+if (!s->block_size) {
+*poutbuf = buf;
+*poutbuf_size = buf_size;
+return buf_size;
+}
+
if (!s->remaining)
s->remaining = s->block_size;
if (s->remaining <= buf_size) {
--
2.23.0
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 2/4] avcodec/cavsdec: Check remaining bitstream in the main loop in decode_pic()
Fixes: Timeout (149sec ->1sec)
Fixes:
17311/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5679368642232320
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
---
libavcodec/cavsdec.c | 14 --
tests/ref/fate/cavs | 2 +-
2 files changed, 13 insertions(+), 3 deletions(-)
diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c
index 1c4f71824a..436f902ab3 100644
--- a/libavcodec/cavsdec.c
+++ b/libavcodec/cavsdec.c
@@ -1101,11 +1101,16 @@ static int decode_pic(AVSContext *h)
do {
if (check_for_slice(h))
skip_count = -1;
-if (h->skip_mode_flag && (skip_count < 0))
+if (h->skip_mode_flag && (skip_count < 0)) {
+if (get_bits_left(>gb) < 1)
+break;
skip_count = get_ue_golomb(>gb);
+}
if (h->skip_mode_flag && skip_count--) {
decode_mb_p(h, P_SKIP);
} else {
+if (get_bits_left(>gb) < 1)
+break;
mb_type = get_ue_golomb(>gb) + P_SKIP + h->skip_mode_flag;
if (mb_type > P_8X8)
ret = decode_mb_i(h, mb_type - P_8X8 - 1);
@@ -1119,11 +1124,16 @@ static int decode_pic(AVSContext *h)
do {
if (check_for_slice(h))
skip_count = -1;
-if (h->skip_mode_flag && (skip_count < 0))
+if (h->skip_mode_flag && (skip_count < 0)) {
+if (get_bits_left(>gb) < 1)
+break;
skip_count = get_ue_golomb(>gb);
+}
if (h->skip_mode_flag && skip_count--) {
ret = decode_mb_b(h, B_SKIP);
} else {
+if (get_bits_left(>gb) < 1)
+break;
mb_type = get_ue_golomb(>gb) + B_SKIP + h->skip_mode_flag;
if (mb_type > B_8X8)
ret = decode_mb_i(h, mb_type - B_8X8 - 1);
diff --git a/tests/ref/fate/cavs b/tests/ref/fate/cavs
index ddcbe04d15..4c3d127fa3 100644
--- a/tests/ref/fate/cavs
+++ b/tests/ref/fate/cavs
@@ -172,4 +172,4 @@
0,166,166,1, 622080, 0x05496a5d
0,167,167,1, 622080, 0xdcb4cee8
0,168,168,1, 622080, 0xb41172e5
-0,169,169,1, 622080, 0x56c72478
+0,169,169,1, 622080, 0x26146e0b
--
2.23.0
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 3/4] avcodec/sbcdec: Initilaize nubmer of channels
Fixes: out of array access Fixes: 17609/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SBC_fuzzer-5758729319874560 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/sbcdec.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/sbcdec.c b/libavcodec/sbcdec.c index 546b38c106..937946e2d2 100644 --- a/libavcodec/sbcdec.c +++ b/libavcodec/sbcdec.c @@ -348,6 +348,7 @@ static int sbc_decode_frame(AVCodecContext *avctx, if (frame_length <= 0) return frame_length; +avctx->channels = frame->channels = sbc->frame.channels; frame->format = AV_SAMPLE_FMT_S16P; frame->nb_samples = sbc->frame.blocks * sbc->frame.subbands; -- 2.23.0 ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH 1/4] avformat/shortendec: Check k in probe
Fixes: Assertion failure
Fixes:
17640/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5708767475269632
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
---
libavformat/shortendec.c | 8 +++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/libavformat/shortendec.c b/libavformat/shortendec.c
index a2879dc5a3..f7390b2e62 100644
--- a/libavformat/shortendec.c
+++ b/libavformat/shortendec.c
@@ -40,12 +40,18 @@ static int shn_probe(const AVProbeData *p)
channels = get_ur_golomb_shorten(, 0);
blocksize = 256;
} else {
-int k;
+unsigned k;
k = get_ur_golomb_shorten(, 2);
+if (k > 31)
+return 0;
internal_ftype = get_ur_golomb_shorten(, k);
k = get_ur_golomb_shorten(, 2);
+if (k > 31)
+return 0;
channels = get_ur_golomb_shorten(, k);
k = get_ur_golomb_shorten(, 2);
+if (k > 31)
+return 0;
blocksize = get_ur_golomb_shorten(, k);
}
--
2.23.0
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-devel] [PATCH]lavf/avio: Print https warning also for avio_find_protocol_name()
Hi! Attached patch helps users fixing ticket #8197. Please comment, Carl Eugen ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH v1 1/2] lavu/pixfmt: add new pixel format a2r10g10b10/a2b10g10r10
Am Mi., 25. Sept. 2019 um 04:46 Uhr schrieb Xinpeng Sun : > Add two 10 bit RGBA pixel format for hardware color space > conversion support in VAAPI and QSV: > > 2:10:10:10 10 bit: A2R10G10B10 > 2:10:10:10 10 bit: A2B10G10R10 Without more explanation, this patch is not ok. Carl Eugen ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
Re: [FFmpeg-devel] [PATCH] avcodec/tiff: correct the default value of YCbCrSubsampling
Am Di., 24. Sept. 2019 um 20:32 Uhr schrieb Skakov Pavel : > TIFF decoder uses wrong default YCbCrSubsampling value so it breaks > on files that rely on standard default and omit the value. Patch applied. Thank you, Carl Eugen ___ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
