1
0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-07-11 14:30:22 +02:00
Commit Graph

112830 Commits

Author SHA1 Message Date
9a5f191bfb avcodec/rtv1: fix undefined FFALIGN
Fixes: signed integer overflow: 2147483647 + 4 cannot be represented in type 'int'
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RTV1_fuzzer-6324303861514240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d188a86730)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:53 +02:00
aa4cf7a584 avcodec/hcadec: do not allow code to continue after failed init
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCA_fuzzer-6247136417087488
Fixes: out of array write

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 48eeb198a5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:52 +02:00
30fe9d3511 avcodec/hcadec: do not set hfr_group_count to invalid values
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCA_fuzzer-6247136417087488
Fixes: out of array write

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit addb85ea39)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:52 +02:00
435f172b5d avformat/concatdec: clip outpoint - inpoint overflow in get_best_effort_duration()
An alternative would be to limit all time/duration fields to below 64bit

Fixes: signed integer overflow: -93000000 - 9223372036839000000 cannot be represented in type 'long long'
Fixes: 64546/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-5110813828186112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dd733b2be4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:52 +02:00
21ff582aec avcodec/osq: avoid several signed integer overflows
Fixes: signed integer overflow: 178459578 + 2009763270 cannot be represented in type 'int'
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-5013423686287360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b54c9a9c8f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:51 +02:00
f0c08506f5 avformat/jacosubdec: clarify code
add comments, rename variables and indent things differently

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e83e8d443b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:51 +02:00
356251d750 avformat/cafdec: Check that data chunk end fits within 64bit
Fixes: signed integer overflow: 64 + 9223372036854775803 cannot be represented in type 'long long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6536881135550464
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6536881135550464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b792e4d4c7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:51 +02:00
9459a45036 avformat/iff: Saturate avio_tell() + 12
Fixes: signed integer overflow: 9223372036854775796 + 12 cannot be represented in type 'long long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4898373660704768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b8e754525c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:50 +02:00
521347ee0b avformat/dxa: Adjust order of operations around block align
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-5730576523198464
Fixes: signed integer overflow: 2147483566 + 82 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 50d8e4f273)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:50 +02:00
d66b1af8df avformat/cafdec: dont seek beyond 64bit
Fixes: signed integer overflow: 64 + 9223372036854775807 cannot be represented in type 'long long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6418242730328064
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6418242730328064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d973fcbcc2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:50 +02:00
19ea7b0409 avformat/id3v2: read_uslt() check for the amount read
Fixes: timeout
Fixes: 66783/clusterfuzz-testcase-minimized-ffmpeg_dem_GENH_fuzzer-5356884892647424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c0f4abe2aa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:49 +02:00
e2a58916b1 avcodec/vmixdec: Check shift before use
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 65909/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMIX_fuzzer-519459745831321

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 70b26b693e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:49 +02:00
b171edca3c avformat/mov: Check sample_count and auxiliary_info_default_size to be 0
This combination causes 0 size arrays to be allocated and to leak later

Fixes: memleak
Fixes: 64342/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4520993686945792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3c43299e9e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:49 +02:00
8464563b80 avformat/wady: Check >0 samplerate and channels 1 || 2.
The WADY decoder only supports mono and stereo

This fixes a probetest failure

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6f9e90ab0b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:48 +02:00
a2ceca5cf6 avcodec/cbs_h266_syntax_template: Check tile_y
Fixes: out of array access
Fixes: 67021/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4883576579489792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 57f252b2d1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:48 +02:00
24367ad563 avcodec/proresenc_kostya: Remove bug similarity text
According to kostya, it is not based on Wassermans encoder

CC: Kostya Shishkov <kostya.shishkov@gmail.com>
CC: Anatoliy Wasserman <anatoliy.wasserman@yandex.ru>

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e0e30e07a1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:48 +02:00
d2f57db3ab avcodec/vorbisdec: Check remaining data in vorbis_residue_decode_internal()
Fixes: timeout
Fixes: 66326/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-6295291863040000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dc89cf804a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:47 +02:00
13f0a85c2c avformat/concatdec: Check in and outpoints to be to produce a positive representable duration
Fixes: signed integer overflow: -93000000 - 9223372036839000000 cannot be represented in type 'long'
Fixes: 64546/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-5110813828186112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b2d7cbc378)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:47 +02:00
ae0e91150c avcodec/8bps: Consider width in the minimal size check
Fixes: Timeout
Fixes: 64479/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EIGHTBPS_fuzzer-5434435386081280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5db09574df)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:47 +02:00
abd835bec7 libswscale/utils: Fix bayer to yuvj
Fixes: out of array access.

Earlier code assumes that a unscaled bayer to yuvj420 converter exists
but the later code then skips yuvj420

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e9cc9e492f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:46 +02:00
b88210ba04 swscale/swscale: Check srcSliceH for bayer
Fixes: Assertion srcSliceH > 1 failed at libswscale/swscale_unscaled.c:1359
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 64098d0cd8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:46 +02:00
ce35590562 swscale/utils: Allocate more dithererror
Fixes: out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 18f26f8a2f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:46 +02:00
7dbea8ef0b avcodec/indeo3: Round dimensions up in allocate_frame_buffers()
Fixes: Ticket6581

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3be80ce299)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:45 +02:00
e976607831 avutil/rational: Document what is to be expected from av_d2q() of doubles representing rational numbers
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f465badb06)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:45 +02:00
fdc5b25f19 avfilter/signature_lookup: Do not dereference NULL pointers after malloc failure
Fixes: CID 1403229 Dereference after null check

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 98ae1ad7cf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:45 +02:00
c5dcf99399 avfilter/signature_lookup: dont leave uncleared pointers in sll_free()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6c50482951)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:44 +02:00
16bef72c50 avcodec/mpegvideo_enc: Use ptrdiff_t for stride
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e063c1d079)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:44 +02:00
adfa69aaa9 libavformat/hlsenc.c: Populate OTI using AAC profile in write_codec_attr.
This patch populates the third entry for HLS codec attribute using the
AAC profile.

The HLS specifications[1] require this value to be the Object Type ID as
referred to in table 1.3 of ISO/IEC 14496-3:2009[2].

The numerical constants in the code refer to these OTIs minus one, as
documented in commit 372597e[3], confirmed by comparing the values in the
code with the values in the table mentioned above.

Links:
1: https://datatracker.ietf.org/doc/html/rfc6381#section-3.3
2: https://csclub.uwaterloo.ca/~ehashman/ISO14496-3-2009.pdf
3: 372597e538

Changes in this version:
- Default value set to "mp4a.40.2" when profile is unknown for backward
  compatibility.

Signed-off-by: Steven Liu <liuqi05@kuaishou.com>
(cherry picked from commit 797f0b27c1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-04-03 02:03:44 +02:00
5e45c27ba9 avformat/mov: Check if a key is longer than the atom containing it
Stop reading keys and return AVERROR_INVALIDDATA if key_size
is larger than the amount of space left in the atom.

Bug: https://crbug.com/41496983
Signed-off-by: Eugene Zemtsov <eugene@chromium.org>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 8a23a145d8)
2024-04-02 09:14:24 -03:00
3834629897 avcodec/nvenc: support SDK 12.2 bit depth API 2024-04-01 01:05:02 +02:00
3481f8d99f avcodec/nvenc: stop using long deprecated format specifiers 2024-04-01 01:04:59 +02:00
aa5e6017a5 avfilter/buffersrc: fix overriding unknown channel layouts with negotiated one
Fixes ffplay playback of unknown layouts, when SDL directly supports the audio
format, such as:

ffplay -f lavfi anullsrc=cl=2C,aformat=s16

Without the patch, "Channel layout change is not supported" errors are
generated because buffersrc (unknown 2 channel) and buffersink (stereo)
negotiated a stereo layout, but the stereo layout was never stored in the
BufferSourceContext.

This fixes a regression of 7251f90972, but this
is more of a regression of the avfilter channel layout conversion
(1f96db959c).

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit 2df2b4067e)
2024-03-30 21:42:02 +01:00
8d1e092b24 avfilter/af_channelmap: disallow channel index 64
MAX_CH is 64, therefore the maximum index is 63.

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit 2f754a96bd)
2024-03-30 21:30:27 +01:00
0deb010ae7 avfilter/af_channelmap: fix mapping if in_channel was a string but out_channel was not specified
In this case in_channel_idx was never set and the default 0 was used.
Suprisingly no one noticed that the respective fate test output was wrong.

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit 1bea3e9ee2)
2024-03-30 21:30:21 +01:00
88127b743f avfilter/af_channelmap: fix error message if FL source channel was missing
FL channel ID is 0, so for an unset value we must check for ID < 0.

Regression since 1f96db959c.

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit 9a5627ea9a)
2024-03-30 21:30:07 +01:00
f4a6db1222 avcodec/nvdec: reset bitstream_len/nb_slices when resetting bitstream pointer 2024-03-30 00:16:55 +01:00
f309408874 avformat/mov: don't abort on duplicate Mastering Display Metadata boxes
The VP9 spec defines a SmDm box for this information, and the ISOBMFF spec defines a
mdvc one. If both are present, just ignore one of them.
This is in line with clli and CoLL boxes.

Fixes ticket #10711.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 189c32f536)
2024-03-27 13:53:30 -03:00
888602001f fftools/ffplay: use correct buffersink channel layout parameters
Regression since 0995e1f1b3.

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit 7251f90972)
2024-03-19 21:25:07 +01:00
894bebeaf7 avformat/mpegts: detect synchronous metadata KLV more reliably
The mpegts code historically tries to strip (the first) metadata access unit
header from synchronous KLV metadata, but the detection for such streams was
unreliable causing strips of asynchronous metadata or ID3 as well.

MISB ST 1402 specifies required stream type, stream id and registration
descriptor (which eventually maps to the codec ID) so let's use all of these
for reliable detection.

Fixes a regression caused by 468615f204.

Fixes ticket #10828, #10883.

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit 0aaee4741c)
2024-03-19 21:25:07 +01:00
3fb9425a75 swresample/resample: fix rounding errors with filter_size=1 and phase_shift=0
Depending on input chunk size noticable corrpution was hearable, here is an
example command line:

ffplay -f lavfi -i "sine=440:r=8000:samples_per_frame=32,aresample=24000:filter_size=1:phase_shift=0"

Fix this by rounding the fixed point fractions up instead of down.

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit 7b1b9bb31f)
2024-03-19 21:25:07 +01:00
d3145298c0 avformat/mxfdec: remove resolve_strong_ref usage with AnyType
UUIDs do not have to be unique if their type sets them apart, so avoid using
AnyType, since we are only interested in specific types.

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit aa299faa9a)
2024-03-19 21:25:07 +01:00
fafdcb2a35 avfilter/vf_convolution: add float user_rdiv[4] to allow user options to apply correctly
Previously to support dynamic reconfigurations of the matrix string (e.g. 0m),
the rdiv values would always be cleared to 0.f, causing the rdiv to be
recalculated based on the new filter. This however had the side effect of
always ignoring user specified rdiv values.

Instead float user_rdiv[0] is added to ConvolutionContext which will store the
user specified rdiv values. Then the original rdiv array will store either the
user_rdiv or the automatically calculated 1/sum.

This fixes trac ticket #10294, #10867.

Signed-off-by: Stone Chen <chen.stonechen@gmail.com>
Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit ef917950f0)
2024-03-19 21:25:07 +01:00
0c4777a569 avformat/libsrt: use SRT_EPOLL_IN for waiting for an incoming connection
This is the proper poll mode for waiting for an incoming connection according
to the SRT API docs.

Fixes ticket #9142.

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit 87677c2195)
2024-03-19 21:25:07 +01:00
2af975f2c1 avformat/mxfdec: do not use AnyType when resolving Descriptors and MultipleDescriptors
By using AnyType for resolving a strong reference we searched among all types,
not just the ones which can be the target of the reference, which in some cases
caused to find the wrong type, if the metadata set UUIDs were not unique.

UUIDs do not have to be unique if their type sets them apart, SMPTE 377M says:

> StrongRef: 'One to One’ relationship between sets and implemented in MXF
> with UUIDs. Strong References are typed which means that the definition
> identifies the kind of set which is the target of the reference.

Fixes ticket #10865.

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit 68f2b32ef2)
2024-03-19 21:25:07 +01:00
9e0cfc48ac avformat/mxfdec: move resolving Descriptors to the multi descriptor resolve function
Also remove unused descriptor member from MXFPackage.

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit 41672f5586)
2024-03-19 21:25:07 +01:00
98436c51be avutil/hwcontext_d3d11va: prefer DXGI 1.1 factory when available
A lot of modern stuff straight up fails on the old 1.0 factory, which is
masked by the fact that it's only used when an explicit adapter is
specified.
2024-03-18 13:31:58 +01:00
33efa50fa4 avcodec/libsvtav1: send the EOS signal without a one frame delay to allow for the library to operate in a low-delay mode
Co-authored-by: Amir Naghdinezhad <amir.naghdinezhad@intel.com>
Signed-off-by: Cosmin Stejerean <cosmin@cosmin.at>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 69dd1ce610)
2024-02-27 19:40:40 -03:00
25abb63bfc avcodec/libsvtav1: add version guard for external param
Setting of external param 'force_key_frames' was added in 7bcc1b4eb8.
It is available since v1.1.0 but ffmpeg allows linking against v0.9.0.

(cherry picked from commit 67a2571a55)
2024-02-27 19:40:40 -03:00
f9b68bc9a5 lavc/vvc: Read subpic ID when only one subpicture is present
Previously, the following syntax elements were not read in the case
sps_num_subpics_minus is 0:
* sps_subpic_id_len_minus1
* sps_subpic_id_mapping_explicitly_signalled_flag
* sps_subpic_id_mapping_present_flag
* sps_subpic_id[i]
This was causing failures to decode bitstreams, for example the DVB's
"VVC HDR UHDTV1 OpenGOP 3840x2160 50fps HLG10 PiP" V&V bitstream.

Patch fixes this by moving the reads for these syntax elements out a
scope.

Signed-off-by: Frank Plowman <post@frankplowman.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 8b6219a99d)
2024-02-25 20:48:37 -03:00
192fca4b59 lavc/vvc: Correct sps_num_subpics_minus1 minimum
The spec says "the value of sps_num_subpics_minus1 shall be in the
range of 0 to MaxSlicesPerAu − 1, inclusive."

Signed-off-by: Frank Plowman <post@frankplowman.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 53ab7ff67e)
2024-02-25 20:48:37 -03:00