Already checked generically as none of the codecs here
have the AV_CODEC_CAP_CHANNEL_CONF set.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
None of the codecs used here has the AV_CODEC_CAP_CHANNEL_CONF
cap set, so the sample rate is checked generically.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Check that all audio codecs except decoders with the
AV_CODEC_CAP_CHANNEL_CONF flag have a positive sample rate set.
Fixes: AVERROR_BUG return
Fixes: 413997604/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCA_fuzzer-5188382613635072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Before this patch, the DFPWM1a encoder was marked as supporting
variable frame sizes. The DFPWM1a format converts eight bytes
of input into one output byte and so it simply padded the number
of data output by
frame->nb_samples * frame->ch_layout.nb_channels / 8 +
(frame->nb_samples % 8 > 0 ? 1 : 0)
This has several bugs:
a) The additional byte leads to eight additional input byte being
read; this can read into the frame's padding, i.e. the data can
be uninitialized.
b) The criterion for whether one should pad is wrong:
nb_samples * nb_channels should be tested for divisibility by eight.
c) The created frames can be undecodable (at least with our decoder):
Our decoder requires the number of bits per frame to divisible by
the number of channels, yet the above approach does not guarantee this.
d) The padding will be added in the middle of the stream (potentially
for every packet).
This commit fixes all of this by removing the variable frame size cap
and using AVCodecInternal.pad_samples to pad the last frame so that
nb_samples * nb_channels is always a multiple of eight.
The lavf-dfpwm FATE-test was affected by a). The frames originated from
lavfi and were part of an audio frame pool, so that the padding
contained data from an earlier (bigger) frame. Now the last frame is
properly filled with silence.
Reported-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Use av_frame_replace() instead. Also remove the error message:
It was highly misleading (as if av_frame_clone() duplicated
the AVFrame data buffers instead of just creating a new reference).
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Fixes the following FATE-tests when run under Clang-UBSan:
ffmpeg-loopback-decoding, lavf-mxf_ffv1,
vsynth{1,2,3,_lena}-ffv1-v{0,2}, vsynth1-ffv{1,2,3,_lena},
vsynth{1,2,3,_lena}-ffv1-v3-yuv{420p,422p10,444p16}
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Fixes the following error when running with Clang-UBSan:
src/libavcodec/indeo3.c:556:26: runtime error: applying non-zero offset 2560 to null pointer
This fixes the indeo3-2 FATE test.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Added support for MV-HEVC encoding for stereoscopic videos (2 views
only). Compatible with the framepack filter when using the
AV_STEREO3D_FRAMESEQUENCE format.
Signed-off-by: Diego de Souza <ddesouza@nvidia.com>
In put_main_header(), av_mallocz() allocates memory to local variable
buffer, buffer leaks if av_mallocz() to *out failed. Add av_free(buffer)
before return error code.
Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
The ret value is checked later on again, so this check
is redundant and would cause the frame to not be unrefd on
failure as well.
So remove this check and add one before av_frame_remove_side_data
to ensure it is not called with an invalid frame.
Fix CID 1648350
Reviewed-by: Frank Plowman <post@frankplowman.com>
Add handling here for
sps_scaling_matrix_for_alternative_colour_space_disabled_flag.
Also add parentheses to make behaviour a little more explicit,
where &&'s precedence over || was relied on previously.
Reported-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Frank Plowman <post@frankplowman.com>
It is unnecessary for decoders (they just set
AVCodecContext.sample_fmt). This also fixes a warning
with Clang (because sample_fmts is set directly,
not via CODEC_SAMPLEFMTS).
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This returns to code closer to prior 56c334d732
The prior fixes should limit the sum and avoid the need for double argument log2()
Fixes: Assertion n>=0 && n<=32 failed at libavcodec/get_bits.h:406
Fixes: 410109093/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6550900028276736
No testcases except fuzzers
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 410109093/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6550900028276736
Note, none of the available osq files uses update_stats(), this change may fix or break
files using coding_mode == 2. The code prior looks wrong though
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Need to skip 2 more bytes because comp sections are 12 bytes long.
Fixes decryption since ciph_type is now being set.
Signed-off-by: Pavel Roslyy <roslypav@gmail.com>
acelp_kelvin, g729, qcelp, sipr and wmavoice decoders all depend upon
mips/{acelp_filters_mips,celp_filters_mips,acelp_vectors_mips}.o when
arch is mips.
g723_1 depends on mips/{celp_filters_mips,acelp_vectors_mips}.o.
comfortnoise, evrc, ra144 and ra288 depend on mips/celp_filters_mips.o.
The check for whether we can use the fast path to process
AC coefficients used the qscale value belonging to a different
slice; this worked in practice, because the predicted AC values
are zero in this case, so it does not matter whether we use
the fast or the slow path.
Fix this by checking for first_slice_line instead. This fixes all
the races in the encoding part of the vsynth*-mpeg4-thread tests
(and fixes them if no frame threading is in use for the decoding part).
(The left prediction check may use data from a different slice, too,
but said slice is always processed by the same thread, so that no race
can happen. Given that out-of-slice AC values are zero, it does not
matter whether we use the fast path or the slow path either.)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Only used by the decoder now that the encoder solves
out-of-slice predictions by setting the out-of-slice
values appropriately.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Now that every slice (and therefore every thread) uses its own
DC array, one can simply set the out-of-slice DC values to its
expected values (this is not possible for the decoders due
to error resilience).
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This fixes data races (which are UB) in the MPEG-4 and H.263+
encoder when predicting DC values; these encoders unconditionally
read values from the line above the current line and only check
lateron (via first_slice_line) whether said prediction can be used
at all. It will also allow to remove said checks (by setting the
entries to 1024 upon opening a new slice).
The vsynth{1,2,3,_lena}-mpeg4-thread FATE tests were affected by this:
https://fate.ffmpeg.org/report.cgi?slot=x86_64-archlinux-gcc-tsan-slices&time=20250613002615
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
The chroma dc_val pointers are mostly unused (accesses use
dc_val[0] and block_index), so remove them.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
