- 05 Mar, 2020 9 commits
-
-
Andreas Rheinhardt authored
The format of an AVCDecoderConfigurationRecord, the out-of-band extradata of H.264 in mp4, is as follows: First four bytes containing version, profile and level, one byte for the length size and one byte each for the number of SPS, followed by the SPS (each with its own size field), followed by a byte containing the number of PPS followed by the PPS with their size fields. While the number of SPS/PPS may be zero, the bytes containing these numbers are mandatory. Yet the byte containing the number of PPS has been ignored in two places: 1. In the initial check for whether the extradata can contain an AVCDecoderConfigurationRecord. The minimum size is 7, not 6. 2. No check is made for whether the extradata ended right after the last byte of the last SPS of the SPS array. Instead the first byte of the padding is read as if it were part of the extradata and contained the number of PPS (namely zero, given that the padding is zeroed). No error or warning was ever raised. This has been changed. Such truncated extradata is now considered invalid; the check for 2. has been incorporated into the general size check. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-
Andreas Rheinhardt authored
Before reading a 16bit size field during parsing of extradata, no check is performed to make sure that said length field is actually contained in the extradata. Given that this overread is not dangerous (the extradata is supposed to be padded), only a comment for it has been added; the error itself will be detected as part of the normal check for overreads. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-
Andreas Rheinhardt authored
Currently during parsing the extradata, h264_mp4toannexb checks for overreads by adding the size of the current unit to the current position pointer and comparing this to the end position of the extradata. But pointer comparisons and pointer arithmetic are only defined if it does not exceed the object it is used on (one past the last element of an array is allowed, too). In practice, this might lead to overflows. Therefore the check has been changed to use bytestream2_get_bytes_left() which means that the pointers get subtracted and the result gets compared to the available size. Furthermore, the error code has been fixed. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-
Andreas Rheinhardt authored
This is done in order to improve readability. No functional change is intended with this commit at all; in particular, the unsafe read functions are used throughout as h264_extradata_to_annexb already performs its own checks. (These checks will nevertheless be improved in further commits.) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-
Andreas Rheinhardt authored
bytestream2_get_bytes_left returns an unsigned int; as a result, it returns big positive numbers if an overread already happened, making it unsuitable for scenarios where one wants to allow this in a controlled way (because the buffer is actually padded so that no segfaults can happen). So change it to return an ordinary int. Also, bytestream2_get_bytes_left_p has been modified in the same way. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-
Michael Niedermayer authored
Fixes: assertion failure Fixes: 19301/clusterfuzz-testcase-minimized-ffmpeg_BSF_AV1_FRAME_MERGE_fuzzer-5743212006473728 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: Michael Niedermayer <michael@niedermayer.cc>
-
Jun Zhao authored
Enabled the 3GP-DASH Release-10/Relase-11(3GPP TS26.247) profile to dash demuxer probe. Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
-
Jun Zhao authored
Dashdec can able to handle MPEG-2 TS streams by default as well, used MP4Box to create the segmented MPEG-2 TS files for verification. Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
-
Jun Zhao authored
Add missed framesync part in filter docs. Reviewed-by: Gyan Doshi <ffmpeg@gyani.pro> Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
-
- 04 Mar, 2020 1 commit
-
-
Michael Niedermayer authored
Fixes: Multiple out of array accesses Fixes: 20817/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SIREN_fuzzer-5754041227542528.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-
- 03 Mar, 2020 7 commits
-
-
James Almer authored
It's a duplicate of the properly implemented nvdec libavcodec hwaccel Reviewed-by: Timo Rothenpieler <timo@rothenpieler.org> Signed-off-by: James Almer <jamrial@gmail.com>
-
Paul B Mahol authored
Make possible to parse expressions and store results as arguments for target filters.
-
James Almer authored
Simplifies code considerably. Reviewed-by: Anton Khirnov <anton@khirnov.net> Reviewed-by: Timo Rothenpieler <timo@rothenpieler.org> Signed-off-by: James Almer <jamrial@gmail.com>
-
Paul B Mahol authored
-
Paul B Mahol authored
-
Paul B Mahol authored
-
Guo, Yejun authored
Signed-off-by: Guo, Yejun <yejun.guo@intel.com> Reviewed-by: Pedro Arthur <bygrandao@gmail.com>
-
- 02 Mar, 2020 5 commits
-
-
Michael Niedermayer authored
Fixes: out of array access Fixes: 20828/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_APM_fuzzer-5712770106654720 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-
Andreas Rheinhardt authored
ff_alloc_extradata() already sets the size of the extradata so doing it again is unnecessary. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Reviewed-by: Gyan Doshi <ffmpeg@gyani.pro> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-
Marton Balint authored
The standard does not seem to require the counter to be zero based, but some checker tools (MyriadBits MXFInspect, Interra Baton) have validations against 0 start... Fixes ticket #6781. Signed-off-by: Marton Balint <cus@passwd.hu>
-
Paul B Mahol authored
-
Paul B Mahol authored
-
- 01 Mar, 2020 2 commits
-
-
Paul B Mahol authored
-
Paul B Mahol authored
-
- 29 Feb, 2020 8 commits
-
-
Paul B Mahol authored
-
Andreas Rheinhardt authored
The second ; in a double ;; is actually a null statement. It triggers the typical declaration-after-statement compiler-warnings if it occurs in the middle of several declarations (like here). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-
Andreas Rheinhardt authored
Fixes #8094. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-
Paul B Mahol authored
Other part of size is calculated from both available horizontal and vertical FOV and given one size component.
-
Paul B Mahol authored
-
Paul B Mahol authored
-
Paul B Mahol authored
-
Paul B Mahol authored
-
- 28 Feb, 2020 6 commits
-
-
Andreas Rheinhardt authored
The second ; in a double ;; is actually a null statement. It triggers the typical declaration-after-statement compiler-warnings if it occurs in the middle of several declarations (like here). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-
Michael Niedermayer authored
Fixes: regression Fixes: Ticket8511 Reviewed-by: Anton Khirnov <anton@khirnov.net> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-
Linjie Fu authored
Signed-off-by: Linjie Fu <linjie.fu@intel.com> Reviewed-by: Andriy Gelman <andriy.gelman@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-
Linjie Fu authored
"In both cases.." and "Repeat this call until.." would be better to be in a separate line. http://ffmpeg.org/doxygen/trunk/group__lavc__encdec.htmlSigned-off-by: Linjie Fu <linjie.fu@intel.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-
Andreas Rheinhardt authored
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-
Paul B Mahol authored
-
- 27 Feb, 2020 2 commits
-
-
Paul B Mahol authored
-
Michael Niedermayer authored
Fixes: Ticket8010 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-