* [FFmpeg-devel] [PATCH 2/4] avformat/genh: Check sample rate
2022-04-11 21:21 [FFmpeg-devel] [PATCH 1/4] avformat/demux: Use unsigned to check duration vs duration_text Michael Niedermayer
@ 2022-04-11 21:21 ` Michael Niedermayer
2022-04-11 21:21 ` [FFmpeg-devel] [PATCH 3/4] avfilter/video: Add ff_default_get_video_buffer2() to set specific alignment Michael Niedermayer
2022-04-11 21:21 ` [FFmpeg-devel] [PATCH 4/4] avfilter/vf_frei0r: Copy to frame allocated according to frei0r requirements Michael Niedermayer
2 siblings, 0 replies; 6+ messages in thread
From: Michael Niedermayer @ 2022-04-11 21:21 UTC (permalink / raw)
To: FFmpeg development discussions and patches
Fixes: signed integer overflow: -2515507630940093440 * 4 cannot be represented in type 'long'
Fixes: 46318/clusterfuzz-testcase-minimized-ffmpeg_dem_GENH_fuzzer-5009637474172928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/genh.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavformat/genh.c b/libavformat/genh.c
index b1c20718f6..a25d4d625a 100644
--- a/libavformat/genh.c
+++ b/libavformat/genh.c
@@ -67,6 +67,9 @@ static int genh_read_header(AVFormatContext *s)
return AVERROR_INVALIDDATA;
st->codecpar->block_align = align * st->codecpar->ch_layout.nb_channels;
st->codecpar->sample_rate = avio_rl32(s->pb);
+ if (st->codecpar->sample_rate < 0)
+ return AVERROR_INVALIDDATA;
+
avio_skip(s->pb, 4);
st->duration = avio_rl32(s->pb);
--
2.17.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 6+ messages in thread* [FFmpeg-devel] [PATCH 3/4] avfilter/video: Add ff_default_get_video_buffer2() to set specific alignment
2022-04-11 21:21 [FFmpeg-devel] [PATCH 1/4] avformat/demux: Use unsigned to check duration vs duration_text Michael Niedermayer
2022-04-11 21:21 ` [FFmpeg-devel] [PATCH 2/4] avformat/genh: Check sample rate Michael Niedermayer
@ 2022-04-11 21:21 ` Michael Niedermayer
2022-04-11 21:21 ` [FFmpeg-devel] [PATCH 4/4] avfilter/vf_frei0r: Copy to frame allocated according to frei0r requirements Michael Niedermayer
2 siblings, 0 replies; 6+ messages in thread
From: Michael Niedermayer @ 2022-04-11 21:21 UTC (permalink / raw)
To: FFmpeg development discussions and patches
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavfilter/video.c | 8 ++++++--
libavfilter/video.h | 1 +
2 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/libavfilter/video.c b/libavfilter/video.c
index b2f0cdf88a..e9eb110ff4 100644
--- a/libavfilter/video.c
+++ b/libavfilter/video.c
@@ -38,13 +38,12 @@ AVFrame *ff_null_get_video_buffer(AVFilterLink *link, int w, int h)
return ff_get_video_buffer(link->dst->outputs[0], w, h);
}
-AVFrame *ff_default_get_video_buffer(AVFilterLink *link, int w, int h)
+AVFrame *ff_default_get_video_buffer2(AVFilterLink *link, int w, int h, int align)
{
AVFrame *frame = NULL;
int pool_width = 0;
int pool_height = 0;
int pool_align = 0;
- int align = av_cpu_max_align();
enum AVPixelFormat pool_format = AV_PIX_FMT_NONE;
if (link->hw_frames_ctx &&
@@ -94,6 +93,11 @@ AVFrame *ff_default_get_video_buffer(AVFilterLink *link, int w, int h)
return frame;
}
+AVFrame *ff_default_get_video_buffer(AVFilterLink *link, int w, int h)
+{
+ return ff_default_get_video_buffer2(link, w, h, av_cpu_max_align());
+}
+
AVFrame *ff_get_video_buffer(AVFilterLink *link, int w, int h)
{
AVFrame *ret = NULL;
diff --git a/libavfilter/video.h b/libavfilter/video.h
index f448e4ada4..f37bab9d03 100644
--- a/libavfilter/video.h
+++ b/libavfilter/video.h
@@ -24,6 +24,7 @@
#include "avfilter.h"
AVFrame *ff_default_get_video_buffer(AVFilterLink *link, int w, int h);
+AVFrame *ff_default_get_video_buffer2(AVFilterLink *link, int w, int h, int align);
AVFrame *ff_null_get_video_buffer(AVFilterLink *link, int w, int h);
/**
--
2.17.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 6+ messages in thread* [FFmpeg-devel] [PATCH 4/4] avfilter/vf_frei0r: Copy to frame allocated according to frei0r requirements
2022-04-11 21:21 [FFmpeg-devel] [PATCH 1/4] avformat/demux: Use unsigned to check duration vs duration_text Michael Niedermayer
2022-04-11 21:21 ` [FFmpeg-devel] [PATCH 2/4] avformat/genh: Check sample rate Michael Niedermayer
2022-04-11 21:21 ` [FFmpeg-devel] [PATCH 3/4] avfilter/video: Add ff_default_get_video_buffer2() to set specific alignment Michael Niedermayer
@ 2022-04-11 21:21 ` Michael Niedermayer
2022-04-19 7:41 ` Paul B Mahol
2 siblings, 1 reply; 6+ messages in thread
From: Michael Niedermayer @ 2022-04-11 21:21 UTC (permalink / raw)
To: FFmpeg development discussions and patches
Fixes: issues with non trivial linesize
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavfilter/vf_frei0r.c | 22 ++++++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
diff --git a/libavfilter/vf_frei0r.c b/libavfilter/vf_frei0r.c
index 9cd0098e73..f11ae6e55c 100644
--- a/libavfilter/vf_frei0r.c
+++ b/libavfilter/vf_frei0r.c
@@ -353,14 +353,20 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
{
Frei0rContext *s = inlink->dst->priv;
AVFilterLink *outlink = inlink->dst->outputs[0];
- AVFrame *out;
+ AVFrame *out = ff_default_get_video_buffer2(outlink, outlink->w, outlink->h, 16);
+ if (!out)
+ goto fail;
- out = ff_get_video_buffer(outlink, outlink->w, outlink->h);
- if (!out) {
+ av_frame_copy_props(out, in);
+
+ if (in->linesize[0] != out->linesize[0]) {
+ AVFrame *in2 = ff_default_get_video_buffer2(outlink, outlink->w, outlink->h, 16);
+ if (!in2)
+ goto fail;
+ av_frame_copy(in2, in);
av_frame_free(&in);
- return AVERROR(ENOMEM);
+ in = in2;
}
- av_frame_copy_props(out, in);
s->update(s->instance, in->pts * av_q2d(inlink->time_base) * 1000,
(const uint32_t *)in->data[0],
@@ -369,6 +375,10 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
av_frame_free(&in);
return ff_filter_frame(outlink, out);
+fail:
+ av_frame_free(&in);
+ av_frame_free(&out);
+ return AVERROR(ENOMEM);
}
static int process_command(AVFilterContext *ctx, const char *cmd, const char *args,
@@ -465,7 +475,7 @@ static int source_config_props(AVFilterLink *outlink)
static int source_request_frame(AVFilterLink *outlink)
{
Frei0rContext *s = outlink->src->priv;
- AVFrame *frame = ff_get_video_buffer(outlink, outlink->w, outlink->h);
+ AVFrame *frame = ff_default_get_video_buffer2(outlink, outlink->w, outlink->h, 16);
if (!frame)
return AVERROR(ENOMEM);
--
2.17.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 6+ messages in thread