virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-18 03:19:31 +02:00
Code Issues Releases Activity
86,546 Commits 37 Branches 400 Tags 464 MiB
8221c71703
Commit Graph

478 Commits

Author SHA1 Message Date
Michael Niedermayer
4705edbbb9 avcodec/mjpegdec: Check that reference frame matches the current frame 
Fixes: out of array read
Fixes: 2097/clusterfuzz-testcase-minimized-5036861833609216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-05 22:43:23 +02:00
Michael Niedermayer
40fa6a2fa2 avcodec/mjpegdec: Fix runtime error: signed integer overflow: -32767 * 130560 cannot be represented in type 'int' 
Fixes: 1724/clusterfuzz-testcase-minimized-4842395432648704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-22 02:16:39 +02:00
Michael Niedermayer
a78ae465fd avcodec/mjpegdec: Fix runtime error: signed integer overflow: -24543 * 2031616 cannot be represented in type 'int' 
Fixes: 943/clusterfuzz-testcase-5114865297391616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-04 20:42:54 +02:00
Muhammad Faiz
31f61b0d4f avcodec: do not use AVFrame accessor 
Reviewed-by: wm4 <nfxjfg@googlemail.com>
Signed-off-by: Muhammad Faiz <mfcc64@gmail.com>
 2017-04-23 14:27:47 +07:00
Clément Bœsch
8d94d9798a lavc/mjpegdec: allow failure while decoding APP 
Fix decoding frame.jpg from ticket #267

Regression since 9c7ee3749 / 212c6a1d7
 2017-04-07 18:05:20 +02:00
Clément Bœsch
9c7ee37490 Merge commit '212c6a1d70df011b6f2a2aa02f7677503287bd00' 
* commit '212c6a1d70df011b6f2a2aa02f7677503287bd00':
  mjpegdec: Check return values of functions that may fail

Merged-by: Clément Bœsch <u@pkh.me>
 2017-04-07 10:17:53 +02:00
Clément Bœsch
e3287077ec Merge commit '67deba8a416d818f3d95aef0aa916589090396e2' 
* commit '67deba8a416d818f3d95aef0aa916589090396e2':
  Use avpriv_report_missing_feature() where appropriate

Merged-by: Clément Bœsch <cboesch@gopro.com>
 2017-03-31 10:40:34 +02:00
Clément Bœsch
67e370ee52 lavc: fix usages of av_get_codec_tag_string() 2017-03-29 14:49:29 +02:00
Michael Niedermayer
23f3f92361 avcodec/mjpegdec: quant_matrixes can be up to 65535, use uint16_t 
Fixes invalid shift
Fixes: 870/clusterfuzz-testcase-5649105424482304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-20 01:38:04 +01:00
Michael Niedermayer
656a17e126 avcodec/mjpegdec: Check quant_matrixes values for being non zero 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-20 01:38:02 +01:00
Clément Bœsch
1a48a51bfc Merge commit 'b53d8c3ccfeff77874f5ca7c68136b6d87a0a69c' 
* commit 'b53d8c3ccfeff77874f5ca7c68136b6d87a0a69c':
  mjpegdec: Drop disabled code

The last chunk is replaced with a comment describing the structure.

Merged-by: Clément Bœsch <u@pkh.me>
 2017-03-19 16:03:25 +01:00
Michael Niedermayer
800d02abe0 avcodec/mjpegdec: Fix runtime error: left shift of negative value -127 
Fixes: 733/clusterfuzz-testcase-4682158096515072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-09 23:28:10 +01:00
Michael Niedermayer
4b72d5cd6f avcodec/mjpegdec: Fix runtime error: left shift of negative value -511 
Fixes: 693/clusterfuzz-testcase-6109776066904064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-03 01:03:29 +01:00
Michael Niedermayer
c91bdd4524 avcodec/mjpegdec: Fix runtime error: left shift of negative value -507 
Fixes: 611/clusterfuzz-testcase-5613455820193792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-19 21:49:03 +01:00
Michael Niedermayer
3782656631 avcodec/mjpegdec: Check for for the bitstream end in mjpeg_decode_scan_progressive_ac() 
Fixes timeout
Fixes: 496/clusterfuzz-testcase-5805083497332736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-01 01:36:50 +01:00
Matthieu Bouron
2ae8278832 lavc/mjpegdec: consume SOS data even if the frame is discarded 
Speeds up next marker search when a SOS marker is found but the frame is
discarded (which happens in avformat_find_stream_info).
 2017-01-29 21:54:16 +01:00
Michael Niedermayer
755933cb5c avcodec/mjpegdec: Check remaining bitstream in ljpeg_decode_yuv_scan() 
Fixes timeout
Fixes: 445/fuzz-3-ffmpeg_VIDEO_AV_CODEC_ID_MJPEG_fuzzer
Fixes: 456/fuzz-2-ffmpeg_VIDEO_AV_CODEC_ID_JPEGLS_fuzzer

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-01-24 17:50:03 +01:00
Carl Eugen Hoyos
4acea512f3 lavc/mjpegdec: Do not overread too short JFIF tags. 
Fixes ticket #6055.
 2017-01-01 18:53:27 +01:00
Michael Niedermayer
25d9643f11 avcodec/mjpegdec: Check for rgb before flipping 
Fixes assertion failure due to unsupported case

Fixes: 356/fuzz-1-ffmpeg_VIDEO_AV_CODEC_ID_MJPEG_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2016-12-31 03:21:05 +01:00
Diego Biurrun
212c6a1d70 mjpegdec: Check return values of functions that may fail 2016-11-29 13:13:35 +01:00
Diego Biurrun
67deba8a41 Use avpriv_report_missing_feature() where appropriate 2016-11-08 17:54:34 +01:00
Carl Eugen Hoyos
a6a453ccd1 Cosmetics: Reindent after e82b181f. 2016-09-03 14:23:32 +02:00
Carl Eugen Hoyos
e82b181f80 lavc/mjpegdec: Only read JFIF thumbnail size if the segment is long enough. 
Fixes ticket #5805.
 2016-09-03 14:21:46 +02:00
Carl Eugen Hoyos
cef5bc0e6e lavc/mjpegdec: Do not skip reading quantization tables. 
They may contain 0xFFs, confusing the start code finding algorithm.

Fixes ticket #5819.
 2016-09-03 13:25:54 +02:00
Diego Biurrun
b53d8c3ccf mjpegdec: Drop disabled code 2016-08-17 12:16:42 +02:00
Clément Bœsch
2ab823d4a6 Merge commit 'd68fb1475856cf93199e2bc4eee3063902c35df7' 
* commit 'd68fb1475856cf93199e2bc4eee3063902c35df7':
  mjpegdec: Properly fail on malloc failure

Merged-by: Clément Bœsch <u@pkh.me>
 2016-06-25 11:42:57 +02:00
Clément Bœsch
8ef57a0d61 Merge commit '41ed7ab45fc693f7d7fc35664c0233f4c32d69bb' 
* commit '41ed7ab45fc693f7d7fc35664c0233f4c32d69bb':
  cosmetics: Fix spelling mistakes

Merged-by: Clément Bœsch <u@pkh.me>
 2016-06-21 21:55:34 +02:00
Derek Buitenhuis
d68fb14758 mjpegdec: Properly fail on malloc failure 
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
 2016-05-19 13:44:41 +02:00
Vittorio Giovara
41ed7ab45f cosmetics: Fix spelling mistakes 
Signed-off-by: Diego Biurrun <diego@biurrun.de>
 2016-05-04 18:16:21 +02:00
Michael Niedermayer
deaf58abf2 avcodec/mjpegdec: Do not try to detect last scan but apply idct after all scans for progressive jpeg 
Fixes: IMG-20160418-WA0002.jpg

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2016-05-02 12:45:14 +02:00
Michael Niedermayer
de0bcea664 avcodec/mjpegdec: Do not permute quantization tables 
This fixes issues if the permutation changes, as quantizations tables would need to be reread

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2016-04-03 01:50:08 +02:00
Carl Eugen Hoyos
260c12cdd1 lavc/mjpegdec: Set sar for multiscope videos. 
Fixes decoding of the files from ticket #4535 visually.
 2016-03-09 14:06:40 +01:00
Moritz Barsnick
72babb8566 lavc/mjpegdec: avoid printing useless message in default log level 
The change of bps from 0 doesn't contain any info useful to the
user. This message is now at info log level only if the original
value is !=0, otherwise pushed back to debug log level. The
original value is displayed additionally.

Signed-off-by: Moritz Barsnick <barsnick@gmx.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2016-03-08 16:42:34 +01:00
Matthieu Bouron
81f14884b5 lavc/mjpegdec: avoid unneeded allocation if the frame is to be skipped 2016-03-07 12:36:23 +01:00
Michael Niedermayer
c6f4720b86 avcodec/mjpegdec: Fix decoding slightly odd progressive jpeg 
Fixes: ebd58db6-dc86-11e5-91c2-59daeddf50c7.jpg

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2016-02-28 18:46:35 +01:00
Reimar Döffinger
45fa03b1f9 mjpegdec: Do not assume unused plane pointer are NULL. 
We do neither document nor check such a requirement
and for application-provided get_buffer2 they could
contain the result of a malloc(0) or whatever value
they had previously.
This fixes a use-after-free in e.g. MPlayer:
https://trac.mplayerhq.hu/ticket/2262
We might want to consider changing the (documented)
API in addition though.

Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
 2016-02-28 13:32:01 +01:00
Carl Eugen Hoyos
0f31d401c3 lavc/mjpegdec: Fix decoding images with Adobe_CM tag. 
Fixes ticket #5267.
 2016-02-25 13:26:13 +01:00
Matthieu Bouron
27f1ea5097 lavc/mjpegdec: use ptrdiff_t instead of ssize_t 
Fixes build on msvc.
 2016-01-28 09:25:59 +01:00
Matthieu Bouron
0d733ec379 lavc/mjpegdec: speed up scan data copy 2016-01-27 20:08:52 +01:00
Derek Buitenhuis
21f9468402 avutil: Rename FF_CEIL_COMPAT to AV_CEIL_COMPAT 
Libav, for some reason, merged this as a public API function. This will
aid in future merges.

A define is left for backwards compat, just in case some person
used it, since it is in a public header.

Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
 2016-01-27 16:36:46 +00:00
Carl Eugen Hoyos
7a90edc188 lavc/mjpegdec: Set SAR even if no resolution is available. 
Fixes ticket #4479.
 2016-01-27 10:23:37 +01:00
Michael Niedermayer
509c9e74e5 avcodec/mjpegdec: Check for end for both bytes in unescaping 
Fixes assertion failure
Fixes: c40c779601b77dc6e19aaea0b04b9751/signal_sigabrt_7ffff6ae7cb7_5769_b94f6ec70caecb2d3d76b4771b109ac1.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2016-01-21 23:47:29 +01:00
Michael Niedermayer
d86d7b2486 avcodec/mjpegdec: Fix negative shift 
Fixes: mjpeg_left_shift.avi

Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2016-01-10 15:59:27 +01:00
Andreas Cadhalpun
7ea2db6eaf mjpegdec: extend check for incompatible values of s->rgb and s->ls 
This can happen if s->ls changes from 0 to 1, but picture allocation is
skipped due to s->interlaced.

In that case ff_jpegls_decode_picture could be called even though the
s->picture_ptr frame has the wrong pixel format and thus a wrong
linesize, which results in a too small zero buffer being allocated.

This fixes an out-of-bounds read in ls_decode_line.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
 2015-12-31 17:30:25 +01:00
Andreas Cadhalpun
5adb5d9d89 mjpegdec: consider chroma subsampling in size check 
If the chroma components are subsampled, smaller buffers are allocated
for them. In that case the maximal block_offset for the chroma
components is not as large as for the luma component.

This fixes out of bounds writes causing segmentation faults or memory
corruption.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
 2015-12-06 22:40:41 +01:00
Clément Bœsch
fb99ef0bd3 avcodec: use AV_OPT_TYPE_BOOL in a bunch of places 2015-12-04 15:37:05 +01:00
James Almer
3885ef0c6c avcodec/mjpegdec: fix typo on a warning 2015-11-25 19:24:24 -03:00
Matthieu Bouron
ad0203d7b0 lavc/mjpegdec: set FF_CODEC_CAP_SKIP_FRAME_FILL_PARAM capability 2015-11-15 10:13:24 +01:00
Michael Niedermayer
cc35f6f476 avcodec/mjpegdec: Reinitialize IDCT on BPP changes 
Fixes misaligned access
Fixes: dc9262a469f6f315f74c087a7b3a7f35/signal_sigsegv_2e95bcd_9_9c0f9f4a9ba82aa9b3ab2b91ce4d5277.jpg

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2015-11-04 21:51:21 +01:00
Michael Niedermayer
d24888ef19 avcodec/mjpegdec: Check index in ljpeg_decode_yuv_scan() before using it 
Fixes: 04715144ba237443010554be0d05343f/asan_heap-oob_1eafc76_1737_c685b48041a563461839e4e7ab97abb8.jpg
Fixes out of array access

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2015-11-04 19:33:33 +01:00