1. 11 Mar, 2020 8 commits
  2. 10 Mar, 2020 8 commits
  3. 09 Mar, 2020 6 commits
  4. 08 Mar, 2020 4 commits
  5. 07 Mar, 2020 1 commit
  6. 06 Mar, 2020 1 commit
  7. 05 Mar, 2020 12 commits
    • Andreas Rheinhardt's avatar
      dump_extradata: Insert extradata even for small packets · a88a3cdb
      Andreas Rheinhardt authored
      3469cfab added a check for whether the extradata coincided with the
      beginning of the packet's data in order not to add extradata to packets
      that already have it. But the check used was buggy for packets whose
      size is smaller than the extradata's size. This commit fixes this.
      Signed-off-by: 's avatarAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
      Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
      a88a3cdb
    • Andreas Rheinhardt's avatar
      h264_mp4toannexb: Cosmetics · 4a141f8e
      Andreas Rheinhardt authored
      Mainly reindentation, but some variables were also put into a smaller
      scope.
      Signed-off-by: 's avatarAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
      Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
      4a141f8e
    • Andreas Rheinhardt's avatar
      h264_mp4toannexb: Improve overread checks · 824f7508
      Andreas Rheinhardt authored
      1. Left shifts of signed values are undefined as soon as the result is
      no longer representable in the target type. Therefore make nal_size
      an uint32_t and drop the check for whether it is < 0.
      2. The two checks for overreads (whether the length field is contained
      in the packet and whether the actual unit is contained in the packet)
      can be combined into one because the packet is padded, i.e. a potential
      overread caused by reading the length field without checking whether
      said length field is actually part of the packet's buffer is allowed
      as one always stays within the padding. But one has to be aware of
      a pitfall: The comparison must be performed in (at least) int64_t as
      otherwise buf_end - buf might be promoted to uint32_t in which case
      an already occured overread would appear as a very large number.
      A comment explaining this has been added, too.
      3. Units of size zero are now silently dropped; the earlier code would
      instead read the first byte of the next length field (or the first byte
      of padding) to infer the type of the current unit.
      4. Futhermore, the earlier code returned the wrong error code. This has
      been fixed, too.
      
      Fixes #8290.
      Signed-off-by: 's avatarAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
      Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
      824f7508
    • Andreas Rheinhardt's avatar
      h264_mp4toannexb: Stop reallocating the output buffer · cb47c6c6
      Andreas Rheinhardt authored
      Up until now, h264_mp4toannexb would grow the output packet's buffer by
      the desired amount every time another NAL unit of the input packet has
      been read; this commit changes this: The input buffer is now essentially
      parsed twice, once to determine the final size of the output packet and
      once to write the output packet's data.
      
      Fixes: Timeout
      Fixes: 19322/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_MP4TOANNEXB_fuzzer-5688407821123584
      Signed-off-by: 's avatarAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
      Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
      cb47c6c6
    • Andreas Rheinhardt's avatar
      h264_mp4toannexb: Consistently use pointer comparisons · 84c87e41
      Andreas Rheinhardt authored
      h264_mp4toannexb_filter currently uses both indices/offsets as well as
      direct pointers comparisons for the checks whether one has reached or
      even surpassed the end. This commit removes the offsets.
      Signed-off-by: 's avatarAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
      Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
      84c87e41
    • Andreas Rheinhardt's avatar
      h264_mp4toannexb: Copy one NAL unit at a time · c177520f
      Andreas Rheinhardt authored
      If processing an input NAL unit triggers the insertion of data from
      extradata in front of said NAL unit, the output packet is grown (i.e.
      reallocated) once to accomodate both the new extradata as well as the
      input NAL unit itself; this has been changed: In such a situation, the
      packet is now grown twice. While this is bad for performance, it allows
      to simplify the code and ultimately to stop reallocating the packet
      altogether.
      Signed-off-by: 's avatarAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
      Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
      c177520f
    • Andreas Rheinhardt's avatar
      h264_mp4toannexb: Try to avoid four byte startcodes · 518bbe9e
      Andreas Rheinhardt authored
      According to the H.264 specifications, the only NAL units that need to
      have four byte startcodes in H.264 Annex B format are SPS/PPS units and
      units that start a new access unit. Before af7e953a, the first of these
      conditions wasn't upheld as already existing in-band parameter sets
      would not automatically be written with a four byte startcode, but only
      when they already were at the beginning of their input packets. But it
      made four byte startcodes be used too often as every unit that is written
      together with a parameter set that is inserted from extradata received a
      four byte startcode although a three byte start code would suffice
      unless the unit itself were a parameter set.
      
      FATE has been updated to reflect the changes. Although the patch leaves
      the extradata unchanged, the size of the extradata according to the FATE
      reports changes. This is due to a quirk in ff_h2645_packet_split which
      is used by extract_extradata: If the input is Annex B, the first zero of
      a four byte startcode is considered a part of the last unit (if any).
      Signed-off-by: 's avatarAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
      Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
      518bbe9e
    • Andreas Rheinhardt's avatar
      h264_mp4toannexb: Simplify extradata insertion · aa486b4b
      Andreas Rheinhardt authored
      Up until now, h264_mp4toannexb stored the offset of the first SPS and
      the first PPS in the (output) extradata in its context and used these
      two numbers together with the size of the extradata and the pointer to
      the extradata to determine what to insert when inserting extradata. This
      led to some very long lines like "s->pps_offset != -1 ? s->pps_offset :
      ctx->par_out->extradata_size - s->sps_offset". Therefore now pointers to
      SPS and PPS are stored along with their respective sizes, so that e.g.
      the above line can be changed to "s->sps_size".
      Signed-off-by: 's avatarAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
      Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
      aa486b4b
    • Andreas Rheinhardt's avatar
      h264_mp4toannexb: Don't forget numOfPictureParameterSets · 4b4f8bd4
      Andreas Rheinhardt authored
      The format of an AVCDecoderConfigurationRecord, the out-of-band
      extradata of H.264 in mp4, is as follows: First four bytes containing
      version, profile and level, one byte for the length size and one byte
      each for the number of SPS, followed by the SPS (each with its own size
      field), followed by a byte containing the number of PPS followed by the
      PPS with their size fields. While the number of SPS/PPS may be zero, the
      bytes containing these numbers are mandatory. Yet the byte containing
      the number of PPS has been ignored in two places:
      1. In the initial check for whether the extradata can contain an
      AVCDecoderConfigurationRecord. The minimum size is 7, not 6.
      2. No check is made for whether the extradata ended right after the last
      byte of the last SPS of the SPS array. Instead the first byte of the
      padding is read as if it were part of the extradata and contained the
      number of PPS (namely zero, given that the padding is zeroed). No error
      or warning was ever raised.
      This has been changed. Such truncated extradata is now considered
      invalid; the check for 2. has been incorporated into the general size
      check.
      Signed-off-by: 's avatarAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
      Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
      4b4f8bd4
    • Andreas Rheinhardt's avatar
      h264_mp4toannexb: Add a comment about possible overread · 01595059
      Andreas Rheinhardt authored
      Before reading a 16bit size field during parsing of extradata, no check
      is performed to make sure that said length field is actually contained
      in the extradata. Given that this overread is not dangerous (the extradata
      is supposed to be padded), only a comment for it has been added; the error
      itself will be detected as part of the normal check for overreads.
      Signed-off-by: 's avatarAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
      Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
      01595059
    • Andreas Rheinhardt's avatar
      h264_mp4toannexb: Improve extradata overread checks · 268dffc1
      Andreas Rheinhardt authored
      Currently during parsing the extradata, h264_mp4toannexb checks for
      overreads by adding the size of the current unit to the current position
      pointer and comparing this to the end position of the extradata. But
      pointer comparisons and pointer arithmetic are only defined if it does not
      exceed the object it is used on (one past the last element of an array
      is allowed, too). In practice, this might lead to overflows. Therefore
      the check has been changed to use bytestream2_get_bytes_left() which
      means that the pointers get subtracted and the result gets compared to
      the available size.
      
      Furthermore, the error code has been fixed.
      Signed-off-by: 's avatarAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
      Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
      268dffc1
    • Andreas Rheinhardt's avatar
      h264_mp4toannexb: Switch to GetByteContext to read extradata · 0ccb31f1
      Andreas Rheinhardt authored
      This is done in order to improve readability. No functional change is
      intended with this commit at all; in particular, the unsafe read
      functions are used throughout as h264_extradata_to_annexb already
      performs its own checks. (These checks will nevertheless be improved
      in further commits.)
      Signed-off-by: 's avatarAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
      Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
      0ccb31f1