40fa6a2fa2
avcodec/mjpegdec: Fix runtime error: signed integer overflow: -32767 * 130560 cannot be represented in type 'int'
...
Fixes: 1724/clusterfuzz-testcase-minimized-4842395432648704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 years ago
a78ae465fd
avcodec/mjpegdec: Fix runtime error: signed integer overflow: -24543 * 2031616 cannot be represented in type 'int'
...
Fixes: 943/clusterfuzz-testcase-5114865297391616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 years ago
31f61b0d4f
avcodec: do not use AVFrame accessor
...
Reviewed-by: wm4 <nfxjfg@googlemail.com>
Signed-off-by: Muhammad Faiz <mfcc64@gmail.com>
8 years ago
8d94d9798a
lavc/mjpegdec: allow failure while decoding APP
...
Fix decoding frame.jpg from ticket #267
Regression since 9c7ee3749212c6a1d7
8 years ago
67e370ee52
lavc: fix usages of av_get_codec_tag_string()
8 years ago
23f3f92361
avcodec/mjpegdec: quant_matrixes can be up to 65535, use uint16_t
...
Fixes invalid shift
Fixes: 870/clusterfuzz-testcase-5649105424482304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 years ago
656a17e126
avcodec/mjpegdec: Check quant_matrixes values for being non zero
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 years ago
800d02abe0
avcodec/mjpegdec: Fix runtime error: left shift of negative value -127
...
Fixes: 733/clusterfuzz-testcase-4682158096515072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 years ago
4b72d5cd6f
avcodec/mjpegdec: Fix runtime error: left shift of negative value -511
...
Fixes: 693/clusterfuzz-testcase-6109776066904064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 years ago
c91bdd4524
avcodec/mjpegdec: Fix runtime error: left shift of negative value -507
...
Fixes: 611/clusterfuzz-testcase-5613455820193792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 years ago
3782656631
avcodec/mjpegdec: Check for for the bitstream end in mjpeg_decode_scan_progressive_ac()
...
Fixes timeout
Fixes: 496/clusterfuzz-testcase-5805083497332736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 years ago
2ae8278832
lavc/mjpegdec: consume SOS data even if the frame is discarded
...
Speeds up next marker search when a SOS marker is found but the frame is
discarded (which happens in avformat_find_stream_info).
8 years ago
755933cb5c
avcodec/mjpegdec: Check remaining bitstream in ljpeg_decode_yuv_scan()
...
Fixes timeout
Fixes: 445/fuzz-3-ffmpeg_VIDEO_AV_CODEC_ID_MJPEG_fuzzer
Fixes: 456/fuzz-2-ffmpeg_VIDEO_AV_CODEC_ID_JPEGLS_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 years ago
4acea512f3
lavc/mjpegdec: Do not overread too short JFIF tags.
...
Fixes ticket #6055 .
8 years ago
25d9643f11
avcodec/mjpegdec: Check for rgb before flipping
...
Fixes assertion failure due to unsupported case
Fixes: 356/fuzz-1-ffmpeg_VIDEO_AV_CODEC_ID_MJPEG_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
8 years ago
212c6a1d70
mjpegdec: Check return values of functions that may fail
8 years ago
67deba8a41
Use avpriv_report_missing_feature() where appropriate
8 years ago
a6a453ccd1
Cosmetics: Reindent after e82b181f.
8 years ago
e82b181f80
lavc/mjpegdec: Only read JFIF thumbnail size if the segment is long enough.
...
Fixes ticket #5805 .
8 years ago
cef5bc0e6e
lavc/mjpegdec: Do not skip reading quantization tables.
...
They may contain 0xFFs, confusing the start code finding algorithm.
Fixes ticket #5819 .
8 years ago
b53d8c3ccf
mjpegdec: Drop disabled code
8 years ago
d68fb14758
mjpegdec: Properly fail on malloc failure
...
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
9 years ago
41ed7ab45f
cosmetics: Fix spelling mistakes
...
Signed-off-by: Diego Biurrun <diego@biurrun.de>
9 years ago
deaf58abf2
avcodec/mjpegdec: Do not try to detect last scan but apply idct after all scans for progressive jpeg
...
Fixes: IMG-20160418-WA0002.jpg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 years ago
de0bcea664
avcodec/mjpegdec: Do not permute quantization tables
...
This fixes issues if the permutation changes, as quantizations tables would need to be reread
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 years ago
260c12cdd1
lavc/mjpegdec: Set sar for multiscope videos.
...
Fixes decoding of the files from ticket #4535 visually.
9 years ago
72babb8566
lavc/mjpegdec: avoid printing useless message in default log level
...
The change of bps from 0 doesn't contain any info useful to the
user. This message is now at info log level only if the original
value is !=0, otherwise pushed back to debug log level. The
original value is displayed additionally.
Signed-off-by: Moritz Barsnick <barsnick@gmx.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 years ago
81f14884b5
lavc/mjpegdec: avoid unneeded allocation if the frame is to be skipped
9 years ago
c6f4720b86
avcodec/mjpegdec: Fix decoding slightly odd progressive jpeg
...
Fixes: ebd58db6-dc86-11e5-91c2-59daeddf50c7.jpg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 years ago
45fa03b1f9
mjpegdec: Do not assume unused plane pointer are NULL.
...
We do neither document nor check such a requirement
and for application-provided get_buffer2 they could
contain the result of a malloc(0) or whatever value
they had previously.
This fixes a use-after-free in e.g. MPlayer:
https://trac.mplayerhq.hu/ticket/2262
We might want to consider changing the (documented)
API in addition though.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
9 years ago
0f31d401c3
lavc/mjpegdec: Fix decoding images with Adobe_CM tag.
...
Fixes ticket #5267 .
9 years ago
27f1ea5097
lavc/mjpegdec: use ptrdiff_t instead of ssize_t
...
Fixes build on msvc.
9 years ago
0d733ec379
lavc/mjpegdec: speed up scan data copy
9 years ago
21f9468402
avutil: Rename FF_CEIL_COMPAT to AV_CEIL_COMPAT
...
Libav, for some reason, merged this as a public API function. This will
aid in future merges.
A define is left for backwards compat, just in case some person
used it, since it is in a public header.
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
9 years ago
7a90edc188
lavc/mjpegdec: Set SAR even if no resolution is available.
...
Fixes ticket #4479 .
9 years ago
509c9e74e5
avcodec/mjpegdec: Check for end for both bytes in unescaping
...
Fixes assertion failure
Fixes: c40c779601b77dc6e19aaea0b04b9751/signal_sigabrt_7ffff6ae7cb7_5769_b94f6ec70caecb2d3d76b4771b109ac1.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 years ago
d86d7b2486
avcodec/mjpegdec: Fix negative shift
...
Fixes: mjpeg_left_shift.avi
Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 years ago
7ea2db6eaf
mjpegdec: extend check for incompatible values of s->rgb and s->ls
...
This can happen if s->ls changes from 0 to 1, but picture allocation is
skipped due to s->interlaced.
In that case ff_jpegls_decode_picture could be called even though the
s->picture_ptr frame has the wrong pixel format and thus a wrong
linesize, which results in a too small zero buffer being allocated.
This fixes an out-of-bounds read in ls_decode_line.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
9 years ago
5adb5d9d89
mjpegdec: consider chroma subsampling in size check
...
If the chroma components are subsampled, smaller buffers are allocated
for them. In that case the maximal block_offset for the chroma
components is not as large as for the luma component.
This fixes out of bounds writes causing segmentation faults or memory
corruption.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
9 years ago
fb99ef0bd3
avcodec: use AV_OPT_TYPE_BOOL in a bunch of places
9 years ago
3885ef0c6c
avcodec/mjpegdec: fix typo on a warning
9 years ago
ad0203d7b0
lavc/mjpegdec: set FF_CODEC_CAP_SKIP_FRAME_FILL_PARAM capability
9 years ago
cc35f6f476
avcodec/mjpegdec: Reinitialize IDCT on BPP changes
...
Fixes misaligned access
Fixes: dc9262a469f6f315f74c087a7b3a7f35/signal_sigsegv_2e95bcd_9_9c0f9f4a9ba82aa9b3ab2b91ce4d5277.jpg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 years ago
d24888ef19
avcodec/mjpegdec: Check index in ljpeg_decode_yuv_scan() before using it
...
Fixes: 04715144ba237443010554be0d05343f/asan_heap-oob_1eafc76_1737_c685b48041a563461839e4e7ab97abb8.jpg
Fixes out of array access
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 years ago
ff0dfb5c36
lavc/mjpegdec: honor skip_frame option
9 years ago
055e56e9f7
avcodec/mjpegdec: Fix decoding RGBA RCT LJPEG
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 years ago
5d8e836d0e
Replace all remaining occurances of step/depth_minus1 and offset_plus1
9 years ago
fa9af304f0
avcodec/mjpegdec: Remove message asking for a non mod 16 AMV sample
...
Ticket4770 contains such a sample and it decodes fine
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 years ago
84170d4be0
lavc/mjpegdec: Detect more CMYK images.
...
Fixes ticket #4772 .
9 years ago
daf2c35f52
lavc: Remove newline from avpriv_request_sample() calls.
9 years ago
Michael Niedermayer
Muhammad Faiz
Clément Bœsch
Clément Bœsch
Matthieu Bouron
Carl Eugen Hoyos
Diego Biurrun
Derek Buitenhuis
Vittorio Giovara
Moritz Barsnick
Matthieu Bouron
Reimar Döffinger
Andreas Cadhalpun
Clément Bœsch
James Almer
Hendrik Leppkes