FFmpeg

Commit Graph

Author	SHA1	Message	Date
Michael Niedermayer	4705edbbb9	avcodec/mjpegdec: Check that reference frame matches the current frame Fixes: out of array read Fixes: 2097/clusterfuzz-testcase-minimized-5036861833609216 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	8 years ago
Michael Niedermayer	40fa6a2fa2	avcodec/mjpegdec: Fix runtime error: signed integer overflow: -32767 * 130560 cannot be represented in type 'int' Fixes: 1724/clusterfuzz-testcase-minimized-4842395432648704 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	8 years ago
Michael Niedermayer	a78ae465fd	avcodec/mjpegdec: Fix runtime error: signed integer overflow: -24543 * 2031616 cannot be represented in type 'int' Fixes: 943/clusterfuzz-testcase-5114865297391616 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	8 years ago
Muhammad Faiz	31f61b0d4f	avcodec: do not use AVFrame accessor Reviewed-by: wm4 <nfxjfg@googlemail.com> Signed-off-by: Muhammad Faiz <mfcc64@gmail.com>	8 years ago
Clément Bœsch	8d94d9798a	lavc/mjpegdec: allow failure while decoding APP Fix decoding frame.jpg from ticket #267 Regression since `9c7ee3749` / `212c6a1d7`	8 years ago
Clément Bœsch	67e370ee52	lavc: fix usages of av_get_codec_tag_string()	8 years ago
Michael Niedermayer	23f3f92361	avcodec/mjpegdec: quant_matrixes can be up to 65535, use uint16_t Fixes invalid shift Fixes: 870/clusterfuzz-testcase-5649105424482304 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	8 years ago
Michael Niedermayer	656a17e126	avcodec/mjpegdec: Check quant_matrixes values for being non zero Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	8 years ago
Michael Niedermayer	800d02abe0	avcodec/mjpegdec: Fix runtime error: left shift of negative value -127 Fixes: 733/clusterfuzz-testcase-4682158096515072 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	8 years ago
Michael Niedermayer	4b72d5cd6f	avcodec/mjpegdec: Fix runtime error: left shift of negative value -511 Fixes: 693/clusterfuzz-testcase-6109776066904064 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	8 years ago
Michael Niedermayer	c91bdd4524	avcodec/mjpegdec: Fix runtime error: left shift of negative value -507 Fixes: 611/clusterfuzz-testcase-5613455820193792 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	8 years ago
Michael Niedermayer	3782656631	avcodec/mjpegdec: Check for for the bitstream end in mjpeg_decode_scan_progressive_ac() Fixes timeout Fixes: 496/clusterfuzz-testcase-5805083497332736 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	8 years ago
Matthieu Bouron	2ae8278832	lavc/mjpegdec: consume SOS data even if the frame is discarded Speeds up next marker search when a SOS marker is found but the frame is discarded (which happens in avformat_find_stream_info).	8 years ago
Michael Niedermayer	755933cb5c	avcodec/mjpegdec: Check remaining bitstream in ljpeg_decode_yuv_scan() Fixes timeout Fixes: 445/fuzz-3-ffmpeg_VIDEO_AV_CODEC_ID_MJPEG_fuzzer Fixes: 456/fuzz-2-ffmpeg_VIDEO_AV_CODEC_ID_JPEGLS_fuzzer Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	8 years ago
Carl Eugen Hoyos	4acea512f3	lavc/mjpegdec: Do not overread too short JFIF tags. Fixes ticket #6055.	8 years ago
Michael Niedermayer	25d9643f11	avcodec/mjpegdec: Check for rgb before flipping Fixes assertion failure due to unsupported case Fixes: 356/fuzz-1-ffmpeg_VIDEO_AV_CODEC_ID_MJPEG_fuzzer Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	8 years ago
Diego Biurrun	212c6a1d70	mjpegdec: Check return values of functions that may fail	8 years ago
Diego Biurrun	67deba8a41	Use avpriv_report_missing_feature() where appropriate	8 years ago
Carl Eugen Hoyos	a6a453ccd1	Cosmetics: Reindent after `e82b181f`.	8 years ago
Carl Eugen Hoyos	e82b181f80	lavc/mjpegdec: Only read JFIF thumbnail size if the segment is long enough. Fixes ticket #5805.	8 years ago
Carl Eugen Hoyos	cef5bc0e6e	lavc/mjpegdec: Do not skip reading quantization tables. They may contain 0xFFs, confusing the start code finding algorithm. Fixes ticket #5819.	8 years ago
Diego Biurrun	b53d8c3ccf	mjpegdec: Drop disabled code	8 years ago
Derek Buitenhuis	d68fb14758	mjpegdec: Properly fail on malloc failure Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com> Signed-off-by: Anton Khirnov <anton@khirnov.net>	9 years ago
Vittorio Giovara	41ed7ab45f	cosmetics: Fix spelling mistakes Signed-off-by: Diego Biurrun <diego@biurrun.de>	9 years ago
Michael Niedermayer	deaf58abf2	avcodec/mjpegdec: Do not try to detect last scan but apply idct after all scans for progressive jpeg Fixes: IMG-20160418-WA0002.jpg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	9 years ago
Michael Niedermayer	de0bcea664	avcodec/mjpegdec: Do not permute quantization tables This fixes issues if the permutation changes, as quantizations tables would need to be reread Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	9 years ago
Carl Eugen Hoyos	260c12cdd1	lavc/mjpegdec: Set sar for multiscope videos. Fixes decoding of the files from ticket #4535 visually.	9 years ago
Moritz Barsnick	72babb8566	lavc/mjpegdec: avoid printing useless message in default log level The change of bps from 0 doesn't contain any info useful to the user. This message is now at info log level only if the original value is !=0, otherwise pushed back to debug log level. The original value is displayed additionally. Signed-off-by: Moritz Barsnick <barsnick@gmx.net> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	9 years ago
Matthieu Bouron	81f14884b5	lavc/mjpegdec: avoid unneeded allocation if the frame is to be skipped	9 years ago
Michael Niedermayer	c6f4720b86	avcodec/mjpegdec: Fix decoding slightly odd progressive jpeg Fixes: ebd58db6-dc86-11e5-91c2-59daeddf50c7.jpg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	9 years ago
Reimar Döffinger	45fa03b1f9	mjpegdec: Do not assume unused plane pointer are NULL. We do neither document nor check such a requirement and for application-provided get_buffer2 they could contain the result of a malloc(0) or whatever value they had previously. This fixes a use-after-free in e.g. MPlayer: https://trac.mplayerhq.hu/ticket/2262 We might want to consider changing the (documented) API in addition though. Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>	9 years ago
Carl Eugen Hoyos	0f31d401c3	lavc/mjpegdec: Fix decoding images with Adobe_CM tag. Fixes ticket #5267.	9 years ago
Matthieu Bouron	27f1ea5097	lavc/mjpegdec: use ptrdiff_t instead of ssize_t Fixes build on msvc.	9 years ago
Matthieu Bouron	0d733ec379	lavc/mjpegdec: speed up scan data copy	9 years ago
Derek Buitenhuis	21f9468402	avutil: Rename FF_CEIL_COMPAT to AV_CEIL_COMPAT Libav, for some reason, merged this as a public API function. This will aid in future merges. A define is left for backwards compat, just in case some person used it, since it is in a public header. Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>	9 years ago
Carl Eugen Hoyos	7a90edc188	lavc/mjpegdec: Set SAR even if no resolution is available. Fixes ticket #4479.	9 years ago
Michael Niedermayer	509c9e74e5	avcodec/mjpegdec: Check for end for both bytes in unescaping Fixes assertion failure Fixes: c40c779601b77dc6e19aaea0b04b9751/signal_sigabrt_7ffff6ae7cb7_5769_b94f6ec70caecb2d3d76b4771b109ac1.avi Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	9 years ago
Michael Niedermayer	d86d7b2486	avcodec/mjpegdec: Fix negative shift Fixes: mjpeg_left_shift.avi Found-by: Piotr Bandurski <ami_stuff@o2.pl> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	9 years ago
Andreas Cadhalpun	7ea2db6eaf	mjpegdec: extend check for incompatible values of s->rgb and s->ls This can happen if s->ls changes from 0 to 1, but picture allocation is skipped due to s->interlaced. In that case ff_jpegls_decode_picture could be called even though the s->picture_ptr frame has the wrong pixel format and thus a wrong linesize, which results in a too small zero buffer being allocated. This fixes an out-of-bounds read in ls_decode_line. Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>	9 years ago
Andreas Cadhalpun	5adb5d9d89	mjpegdec: consider chroma subsampling in size check If the chroma components are subsampled, smaller buffers are allocated for them. In that case the maximal block_offset for the chroma components is not as large as for the luma component. This fixes out of bounds writes causing segmentation faults or memory corruption. Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>	9 years ago
Clément Bœsch	fb99ef0bd3	avcodec: use AV_OPT_TYPE_BOOL in a bunch of places	9 years ago
James Almer	3885ef0c6c	avcodec/mjpegdec: fix typo on a warning	9 years ago
Matthieu Bouron	ad0203d7b0	lavc/mjpegdec: set FF_CODEC_CAP_SKIP_FRAME_FILL_PARAM capability	9 years ago
Michael Niedermayer	cc35f6f476	avcodec/mjpegdec: Reinitialize IDCT on BPP changes Fixes misaligned access Fixes: dc9262a469f6f315f74c087a7b3a7f35/signal_sigsegv_2e95bcd_9_9c0f9f4a9ba82aa9b3ab2b91ce4d5277.jpg Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	9 years ago
Michael Niedermayer	d24888ef19	avcodec/mjpegdec: Check index in ljpeg_decode_yuv_scan() before using it Fixes: 04715144ba237443010554be0d05343f/asan_heap-oob_1eafc76_1737_c685b48041a563461839e4e7ab97abb8.jpg Fixes out of array access Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	9 years ago
Matthieu Bouron	ff0dfb5c36	lavc/mjpegdec: honor skip_frame option	9 years ago
Michael Niedermayer	055e56e9f7	avcodec/mjpegdec: Fix decoding RGBA RCT LJPEG Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	9 years ago
Hendrik Leppkes	5d8e836d0e	Replace all remaining occurances of step/depth_minus1 and offset_plus1	9 years ago
Michael Niedermayer	fa9af304f0	avcodec/mjpegdec: Remove message asking for a non mod 16 AMV sample Ticket4770 contains such a sample and it decodes fine Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	9 years ago
Carl Eugen Hoyos	84170d4be0	lavc/mjpegdec: Detect more CMYK images. Fixes ticket #4772.	10 years ago

1 2 3 4 5 ...

478 Commits (80b9e40b6f1e15db9f36c195e7375e65f6b4924f)