1
0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-06-14 22:15:12 +02:00
Commit Graph

23 Commits

Author SHA1 Message Date
94165d1b79 avformat/iamf: use aligned intreadwrite macros where possible
Signed-off-by: James Almer <jamrial@gmail.com>
2024-08-07 00:16:21 -03:00
ed96ac87a9 avformat/iamf_parse: Check for 0 samples
Fixes: division by zero
Fixes: 70561/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-6199435013455872
Fixes: 70565/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5783790316748800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-08-01 00:18:02 +02:00
9b9e02f2ff avformat/iamf_parse: Check for negative sample sizes
Fixes: index -2 out of bounds for type 'const enum AVCodecID [3]'
Fixes: 69866/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-4971166119821312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-21 15:35:08 +02:00
9ce065c90d avformat/iamf_parse: sanitize audio_roll_distance values
Ensure the values are spec complaint and that no integer overflow can happen.

Signed-off-by: James Almer <jamrial@gmail.com>
2024-07-19 21:07:32 -03:00
7dabad079b avformat/iamf: byteswap values in OpusHeader
Clause 3.11.1 of IAMF[1] states the values are stored in big endian, in
contrast to the Ogg Encapsulation for Opus[2] where they are in little endian.

[1]https://aomediacodec.github.io/iamf/v1.0.0-errata.html#opus-specific
[2]https://datatracker.ietf.org/doc/html/rfc7845#section-5.1

Signed-off-by: James Almer <jamrial@gmail.com>
2024-07-18 23:27:20 -03:00
54b8d5e201 avformat/iamf: rename Codec Config seek_preroll to audio_roll_distance
The semantics for the field are different than the one in AVCodecParameters,
so use the name defined in the IAMF spec to prevent confusion.

Signed-off-by: James Almer <jamrial@gmail.com>
2024-07-18 23:27:20 -03:00
2094f40295 avformat/iamf_writer: fix coded audio_roll_distance values
'seek_preroll' corresponds to 'audio_roll_distance' in IAMF[1]

[1]https://aomediacodec.github.io/iamf/v1.0.0-errata.html#audio_roll_distance

Signed-off-by: James Almer <jamrial@gmail.com>
2024-07-18 23:27:20 -03:00
b248dace92 avformat/iamf_parse: keep substream count consistent
Fixes: member access within null pointer of type 'IAMFSubStream' (aka 'struct IAMFSubStream')
Fixes: 69795/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6216287009701888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-07-16 18:43:14 +02:00
0ae157b360 avformat/iamf_parse: add missing padding to AAC extradata
Fixes: out of array access
Fixes: 68863/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-4833546039525376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: James Almer <jamrial@gmail.com>
2024-06-19 10:12:57 -03:00
7fab9b9761 avformat/iamf_parse: 0 layers are not allowed
Fixes: out of array access
Fixes: 68302/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4665793796177920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-19 12:54:46 +02:00
c69e6cccd7 avformat/iamf_parse: consider nb_substreams when accessing substreams array
Fixes: out of array access
Fixes: 68584/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6256656668229632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-19 12:52:20 +02:00
c21fb3624b avformat/iamf_parse: Remove dead case
Fixes: CID1559546 Logically dead code

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-06-12 00:39:11 +02:00
4593cf7ab3 avformat/iamf_parse: Check sound_system
Fixes: index 13 out of bounds for type 'const struct IAMFSoundSystemMap [13]'
Fixes: 67796/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-4554553191104512

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-04 19:38:29 +02:00
0a693bce62 avformat/iamf_parse: keep count_label consistent on language_label allocation failure
Fixes: null pointer dereference
Fixes: 67023/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6011025237278720

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-01 18:17:28 +02:00
790f793844 avutil/common: Don't auto-include mem.h
There are lots of files that don't need it: The number of object
files that actually need it went down from 2011 to 884 here.

Keep it for external users in order to not cause breakages.

Also improve the other headers a bit while just at it.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2024-03-31 00:08:43 +01:00
56d630e6c2 avformat/iamf_writer: update extradata from packet side data
Some encoders, like flac, propagate updated extradata at the end of encoding
as packet side data. Use it to update the relevant codec_config.

Signed-off-by: James Almer <jamrial@gmail.com>
2024-03-04 21:14:05 -03:00
80131321c4 avformat/iamfdec: set disposition flags to output streams
if there's an audio layer with a single stream that can be rendered alone, mark it
as default. Otherwise, mark every stream as dependent.

Signed-off-by: James Almer <jamrial@gmail.com>
2024-02-19 20:53:36 -03:00
18af922c53 avformat/iamf: Don't mix ownership and non-ownership pointers
IAMFAudioElement and IAMFMixPresentation currently contain
pointers to independently allocated objects that are sometimes
owned by said structures and sometimes not.

More precisely, upon success the demuxer transfers ownership
of these other objects newly created AVStreamGroups, but it
keeps its pointers. iamf_read_close() therefore always resets
these pointers (because the cleanup code always treats them
as ownership pointers). This leads to memory leaks in case
iamf_read_header() without having attached all of these
objects to stream groups.

The muxer has a similar issue: It also clears these pointers
(pointing to objects owned by stream groups created by the user)
in its deinit function.

This commit fixes this memleak by explicitly adding non-ownership
pointers; this also allows to remove the code to reset the
ownership pointers.

Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2024-02-19 23:30:00 +01:00
fa469545ba avcodec: move leb reading functions to its own header
Signed-off-by: James Almer <jamrial@gmail.com>
2024-01-31 11:19:16 -03:00
0b8e51b584 avformat/iamf_parse: use the public iamf helpers to allocate structs
Should fix memory leaks from non-freed fields due to missing AVClass
in the allocated structs.

Signed-off-by: James Almer <jamrial@gmail.com>
2024-01-23 20:57:41 -03:00
04cb307508 avformat/iamf_parse: fix yet annother logical coding error
Signed-off-by: James Almer <jamrial@gmail.com>
2023-12-21 12:24:54 -03:00
7a9aafde3d avformat/iamf_parse: fix another logical coding error
Signed-off-by: James Almer <jamrial@gmail.com>
2023-12-21 11:39:24 -03:00
4ee05182b7 avformat: Immersive Audio Model and Formats demuxer
Signed-off-by: James Almer <jamrial@gmail.com>
2023-12-18 15:20:59 -03:00