Recherche avancée

Sur d’autres sites (8239)

• avcodec/utils : Require a non zero channels unless AV_CODEC_CAP_CHANNEL_CONF is set

  9 septembre 2020, par Michael Niedermayer

  avcodec/utils : Require a non zero channels unless AV_CODEC_CAP_CHANNEL_CONF is set
  This avoids per codec checks for channels not being 0
  Fixes : division by 0
  
  Fixes : 25419/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FASTAUDIO_fuzzer-5632544761184256
  
  Fixes : 25433/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FASTAUDIO_fuzzer-6215671900536832
  Found-by : continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
  
  Suggested-by : Paul B Mahol <onemda@gmail.com>
  
  See : [FFmpeg-devel] [PATCH 1/3] avcodec/fastaudio : Check channel
  
  Reviewed-by : Paul B Mahol <onemda@gmail.com>
  
  Signed-off-by : Michael Niedermayer <michael@niedermayer.cc>
  

  • [DH] libavcodec/utils.c

• lavc/vvc : Ensure subpictures don't overlap

  22 février, par Frank Plowman

  lavc/vvc : Ensure subpictures don't overlap
  This is essentially a re-implementation of
  
  https://patchwork.ffmpeg.org/project/ffmpeg/patch/20241005223955.54158-1-post@frankplowman.com/
  That patch was not applied last time.  Instead we opted to identify
  
  issues which could be caused by invalid subpicture layouts and remedy
  
  those issues where they manifest, either through error detection or code
  
  hardening.  This was primarily implemented in the set
  
  https://patchwork.ffmpeg.org/project/ffmpeg/list/?series=13381.
  This has worked to some degree, however issues with subpicture layouts
  
  continue to crop up from the fuzzer and I've fixed a number of bugs
  
  related to subpicture layouts since then.  I think it's best to return
  
  to the initial plan and simply check if the subpicture layout is valid
  
  initially.
  This implementation is also lighter than the first time — by doing a
  
  bit more logic in pps_subpic_less_than_one_tile_slice, we are able to
  
  store a tile_in_subpic map rather than a ctu_in_subpic map.  This
  
  reduces the size of the map to the point it becomes possible to allocate
  
  it on the stack.  Similar to 8bd66a8c9587af61c7b46558be3c4ee317c1af5a,
  
  the layout is also validated in the slice map construction code, rather
  
  than in the CBS, which avoids duplicating some logic.
  Signed-off-by : Frank Plowman <post@frankplowman.com>
  

  • [DH] libavcodec/vvc/ps.c

• avfilter/vf_remap : Fix double-free of AVFilterFormats on error

  7 août 2020, par Andreas Rheinhardt

  avfilter/vf_remap : Fix double-free of AVFilterFormats on error
  The query_formats function of the remap filter tries to allocate
  
  two lists of formats which on success are attached to more permanent objects
  
  (AVFilterLinks) for storage afterwards. If attaching a list to an
  
  AVFilterLink succeeds, it is in turn owned by the AVFilterLink (or more
  
  exactly, the AVFilterLink becomes one of the common owners of the list).
  
  Yet if attaching a list to one of its links succeeds and an error happens
  
  lateron, both lists were manually freed, which means that is wrong if the
  
  list is already owned by one or more links ; these links' pointers to
  
  their lists will become dangling and there will be a double-free/use-after-
  
  free when these links are cleaned up automatically.
  This commit fixes this by removing the custom free code ; this will
  
  temporarily add a leaking codepath (if attaching a list not already
  
  owned by a link to a link fails, the list will leak), but this will
  
  be fixed soon by making sure that an AVFilterFormats without owner will
  
  be automatically freed when attaching it to an AVFilterLink fails.
  
  Notice at most one list leaks because a new list is only allocated
  
  after the old list has been successfully attached to a link.
  Reviewed-by : Nicolas George <george@nsup.org>
  
  Reviewed-by : Paul B Mahol <onemda@gmail.com>
  
  Signed-off-by : Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
  

  • [DH] libavfilter/vf_remap.c