FFmpeg

Commit Graph

Author	SHA1	Message	Date
Michael Niedermayer	4a10bc8f6f	avcodec/cbs_jpeg: Fix uninitialized end index in cbs_jpeg_split_fragment() Fixes: Out of array read Fixes: 24043/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5084566275751936.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	5 years ago
Andreas Rheinhardt	1bdbc50bf4	avcodec/cbs: Remove unused function parameters Several cbs-functions had an unused CodedBitstreamContext parameter. This commit removes these. Reviewed-by: Mark Thompson <sw@jkqxz.net> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>	5 years ago
Michael Niedermayer	a3dc67c984	avcodec/cbs_jpeg: Fix infinite loop in cbs_jpeg_split_fragment() Fixes: Timeout Fixes: 21104/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5129580475318272 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	5 years ago
Andreas Rheinhardt	14dd0a9057	avcodec/cbs: Avoid leaving the ... out in calls to variadic macros According to C99, there has to be at least one argument for every ... in a variadic function-like macro. In practice most (all?) compilers also allow to leave it completely out, but it is nevertheless required: In a variadic macro "there shall be more arguments in the invocation than there are parameters in the macro definition (excluding the ...)." (C99, 6.10.3.4). CBS (not the framework itself, but the macros used in the cbs_*_syntax_template.c files) relies on the compiler allowing to leave a variadic macro argument out. This leads to warnings when compiling in -pedantic mode, e.g. "warning: must specify at least one argument for '...' parameter of variadic macro [-Wgnu-zero-variadic-macro-arguments]" from Clang. Most of these warnings can be easily avoided: The syntax_templates mostly contain helper macros that expand to more complex variadic macros and these helper macros often omit an argument for the .... Modifying them to always expand to complex macros with an empty argument for the ... at the end fixes most of these warnings: The number of warnings went down from 400 to 0 for cbs_av1, from 1114 to 32 for cbs_h2645, from 38 to 0 for cbs_jpeg, from 166 to 0 for cbs_mpeg2 and from 110 to 8 for cbs_vp9. These eight remaining warnings for cbs_vp9 have been fixed by switching to another macro in cbs_vp9_syntax_template: The fixed values for the sync bytes as well as the trailing bits for byte-alignment are now read via the fixed() macro (this also adds a check to ensure that trailing bits are indeed zero as they have to be). Reviewed-by: Mark Thompson <sw@jkqxz.net> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>	5 years ago
Michael Niedermayer	1812352d76	avcodec/cbs_jpeg: Check length for SOS Fixes: out of array access Fixes: 19734/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5673507031875584 Fixes: 19353/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5703944462663680 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	5 years ago
Andreas Rheinhardt	5ad1c1a18a	avcodec/cbs_jpeg: Use memcpy when writing pictures This is possible because the size of a scan header is always a multiple of a byte. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>	5 years ago
Andreas Rheinhardt	ac5d5046c8	avcodec/cbs: Fix potential double-free when adding unit fails ff_cbs_insert_unit_data() has two modes of operation: It can insert a unit with a newly created reference to an already existing AVBuffer; or it can take a buffer and create an AVBuffer for it. Said buffer will then become owned by the unit lateron. A potential memleak/double-free exists in the second case, because if creating the AVBuffer fails, the function immediately returns, but when it fails lateron, the supplied buffer will be freed. The caller has no way to distinguish between these two outcomes. The only such caller (cbs_jpeg_split_fragment() in cbs_jpeg.c) opted for a potential double-free. This commit changes this by explicitly stating that a non-refcounted buffer will be freed on error. The aforementioned caller has been brought in line with this. Fixes CID 1452623. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>	5 years ago
Andreas Rheinhardt	7c92eaace2	avcodec/cbs: Factor out common code for writing units All cbs-functions to write units share a common pattern: 1. They check whether they have a write buffer (that is used to store the unit's data until the needed size becomes known after writing the unit when a dedicated buffer will be allocated). 2. They use this buffer for a PutBitContext. 3. The (codec-specific) writing takes place through the PutBitContext. 4. The return value is checked. AVERROR(ENOSPC) here always indicates that the buffer was too small and leads to a reallocation of said buffer. 5. The final buffer will be allocated and the data copied. This commit factors this common code out in a single function in cbs.c. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>	5 years ago
Andreas Rheinhardt	4e7e30bbe0	cbs: Don't set AVBuffer's opaque cbs is currently inconsistent regarding the opaque field that can be used as a special argument to av_buffer_create in order to be used during freeing the buffer: ff_cbs_alloc_unit_content and all the free functions used name this parameter as if it should contain a pointer to the unit whose content is about to be created; but both ff_cbs_alloc_unit_content as well as ff_cbs_h264_add_sei_message actually use a pointer to the CodedBitstreamContext as opaque. It should actually be neither, because it is unneeded (as is evidenced by the fact that none of the free functions use this pointer at all) and because it ties the unit's content to the lifetime of other objects, although a refcounted buffer is supposed to have its own lifetime that only ends when its reference count reaches zero. This problem manifests itself in the pointer becoming dangling. The pointer to the unit can become dangling if another unit is added to the fragment later as happens in the bitstream filters; in this case, the pointer can point to the wrong unit (if the fragment's unit array needn't be relocated) or it can point to where the array was earlier. It can also become dangling if the unit's content is meant to survive the resetting of the fragment it was originally read with. This applies to the extradata of H.264 and HEVC. The pointer to the context can become dangling if the context is closed before the content is freed. Although this doesn't seem to happen right now, it could happen, in particular if one uses different CodedBitstreamContexts for in- and output. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>	6 years ago
Andreas Rheinhardt	b71a0367a6	cbs: Remove useless initializations Up until now, a temporary variable was used and initialized every time a value was read in CBS; if reading turned out to be successfull, this value was overwritten (without having ever been looked at) with the value read if reading was successfull; on failure the variable wasn't touched either. Therefore these initializations can be and have been removed. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>	6 years ago
Andreas Rheinhardt	ad2745e867	cbs_av1, cbs_jpeg, cbs_mpeg2, cbs_vp9: Fix undef READ has already been undefined at this point; it is obviously intended to undef WRITE. Furthermore, leb128 (in cbs_av1) was undefined too often and inconsistently. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>	6 years ago
Mark Thompson	525de2000b	lavc/cbs: Add JPEG support	6 years ago

12 Commits (912f125c4224da6c6b07e53b1c0d3fbdb429a989)