There can be cases where there are multiple SEI payloads within a
single SEI NAL. In the particulkar case where the payload comprises
exclusiely of FGC data, the size of the NAL can exceed the size
of the 'dynamic bitstream buffer' which is used to pass the NALU
onto its appropriate parser.
This commit adds 'imvcd_bitstream_buf_realloc' which re-allocates
the 'dynamic bitstream buffer' such that any arbitrarily sized
NALU can be stored without a heap overflow.
Bug = ossfuzz:64286
Test: svc_enc_fuzzer
Before applying the config params (dimensions), the api is validating
the input buffer dimensions. This causes encode fails wrongly. This is
corrected.
The following lines of code have been removed to improve coverage -
[x] Functions -
- isvc_interleaved_copy
- isvc_16bit_interleaved_copy
- isvc_16bit_interleaved_memset
- isvc_iquant_itrans_recon_chroma_4x4_neon
- isvc_iquant_itrans_recon_chroma_4x4_sse42
- isvc_iquant_itrans_recon_4x4_dc_with_res_output_neon
- isvc_iquant_itrans_recon_res_dc_4x4_sse42
- isvc_iquant_itrans_recon_4x4_dc_with_res_accumulate_neon
- isvc_iquant_itrans_recon_res_dc_with_res_acc_4x4_sse42
- isvce_wait_for_thread
[x] Function pointer initialisations for the functions above
Test: svc_enc_fuzzer
For large intra frame intervals or for a choice of bit rate that causes
large bits per frame, it possible that while computing number of bits
available in the gop overflow the datatype bounds. For these
calculations use number_t as this offers wider space
Bug: oss-fuzz-63044
Test: avc_enc_fuzzer
Change-Id: Ifee9130f0021f77905aea67832abc044537088e5
The cases where the value for log2MaxPocLsb was exceeding
'MAX_BITS_IN_POC_LSB' was not being handled correctly,
which was resulting in an integer overflow. This has been
fixed.
Test: mvc_dec_fuzzer
RC uses int32_t to store bitrates and other
parameters internally. For specific magnitudes of
bitrate, framerate, and GOP period, this can
result in signed integer overflow. This is now
detected before calls to RC init.
Note that calls to the 'ISVCE_CMD_CTL_SET_BITRATE' API can also
result in this behaviour but it will be appropriately handled
by 'isvce_svc_frame_params_validate'.
Bug = ossfuzz:63053
Test: svc_enc_fuzzer
This commit does not introduce any new functionality w.r.t previous
commit. But it fixes few things. They are listed below
1. Guard Bands in header files are fixed
2. Header files contains function definition comments. These are same
as in source file. Maintaining same comment at two locations is
unnecessary. These are removed.
3. Maintain Indentation consistency across the code.
4. Remove unused code
This commit does not introduce any new functionality. This is a
cosmetic change. It removes redundant comments, unused variables,
indents to a common guideline.
If the encoder receives inputs that are empty or frames
that have to be skipped due to frame rate pull down,
do not increment picture count.
Bug: oss-fuzz-62827
Test: ./avc-enc-fuzzer
There were cases where errors in a process thread
executing the last MB row would result in the entropy
job list without a terminnating entry, which would
result in a call to ih264_list_dequeue blocking infinitely.
The enum 'ISVCE_ENTROPY_THREAD_STATES_T' is now used to
monitor the eecution state of the entropy thread and handle
the situation described appropriately.
Bug = ossfuzz:62786
Test: svc_enc_fuzzer
avc-qp(QP) scale is logarithmic and Qstep scale is linear.
The translation between log to linear is carried during
rate control modelling.
Look up tables for these translations are modified as per
the literature
The Lambda tables for intra and inter(P) slices are slightly
modified. Lambda tables for B slices is completely replaced
wih new set.
This change is done in accordance with JVT-O079.doc
This commit does not introduce any new functionality w.r.t previous
commit. But it fixes few things. They are listed below:
1. Guard Bands in header files are fixed
2. Header files contains function definition comments. These are same
as in source file. Maintaining same comment at two locations is
unnecessary. These are removed.
3. Improved consistency and code indentation
4. Removed comments that dont align with implementation
5. Grouped headers of a workspace together
When mb qp delta is not signalled due to cbp being zero,
mb qp delta ctxt is not being reset. This is causing bitstream
decode problems when mb qp is enabled
When the i frame interval is larger than idr frame interval, bitrate
deviations are seen in bitstream.
Forced idr_interval to be a multiple of I frame interval.
When IDR frame is skipped due to VBV constraints, the frame
number should not be reset. Since it was reset earlier, it
was leading to bistream being not decodable in such a case.
Restore frame_num during idr skip.
In frame drop mode, the stream generated is non-compliant.
For now disable frame drop mode.
Bug: oss-fuzz-61202
Bug: oss-fuzz-59598
Test: ./avc_enc_fuzzer
Change-Id: Ifed950082ae2c6e70d6a7da4547b6ffeb44cf759
During bitstream overflow errors, it is possible that update post
enc gets skipped as last row might never have to be entropy coded
as we have already consumed the buffer. This can be fatal for
encoding further frames. Move this update to a location where it
is guaranteed to be updated
Bug: oss-fuzz-62378
Test: ./avc_enc_fuzzer
Change-Id: I279deb1f30c15c057c0b6e909834313a1df4fdac
As bitstream overflow errors are not marked as fatal errors and
these recons are being used for reference, its best to return
the partial encoded buffers for application
Change-Id: I30a8e9907cf42d3bc883ee78b28cbae723bad7ac
During entropy error, even though the bitstream buffer is not written
with additional bytes, the bitstream context state is getting updated.
As the number of bits left in current word is updated, the get_num_bits
used for computing header and texture bits can become negative causing
overflow errors
Change-Id: I2f990071a9935b2ee328dbd3915dfbefccbab4c5
At the end of encoding of a frame, the entropy thread communicates
the encoded bit stream size to rc module for update. After this
update, if rc decides to skip the frame due to vbv overflow, the
bitstream context is reset and frame is marked for skip.
Due to an oversight, if entropy encoding sees an error, then this
update is happening at the end of each row. Now rc has decided to
skip the frame and the context is reset. As the bitstream context is
reset, other threads are unaware of this problem and continue encoding.
This is causing issues.
Restrict the rc update to the thread that entropy code the last row.
Bug: oss-fuzz:59543
Bug: 285891354
Test: avc_enc_fuzzer
Change-Id: If45a5f34abb59ece812733af8f54f72ae5474d03
