From 5e239c7f9e57d09c6a4c1d5762f441950f8d979c Mon Sep 17 00:00:00 2001 From: Alex Converse Date: Thu, 23 Feb 2012 11:08:47 -0800 Subject: [PATCH 1/8] aacdec: Remove erroneous reference to global gain from the out of bounds scalefactor error message. --- libavcodec/aacdec.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c index f491a098c3..186de96856 100644 --- a/libavcodec/aacdec.c +++ b/libavcodec/aacdec.c @@ -1016,7 +1016,6 @@ static int decode_scalefactors(AACContext *ac, float sf[120], GetBitContext *gb, int offset[3] = { global_gain, global_gain - 90, 0 }; int clipped_offset; int noise_flag = 1; - static const char *const sf_str[3] = { "Global gain", "Noise gain", "Intensity stereo position" }; for (g = 0; g < ics->num_window_groups; g++) { for (i = 0; i < ics->max_sfb;) { int run_end = band_type_run_end[idx]; @@ -1055,7 +1054,7 @@ static int decode_scalefactors(AACContext *ac, float sf[120], GetBitContext *gb, offset[0] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60; if (offset[0] > 255U) { av_log(ac->avctx, AV_LOG_ERROR, - "%s (%d) out of range.\n", sf_str[0], offset[0]); + "Scalefactor (%d) out of range.\n", offset[0]); return -1; } sf[idx] = -ff_aac_pow2sf_tab[offset[0] - 100 + POW_SF2_ZERO]; From ee42df8a35c2b795f524c856834d0823dbd4e75d Mon Sep 17 00:00:00 2001 From: Luca Barbato Date: Mon, 27 Feb 2012 22:40:11 +0100 Subject: [PATCH 2/8] avf: reorder AVStream and AVFormatContext --- libavformat/avformat.h | 72 ++++++++++++++++++++++-------------------- 1 file changed, 38 insertions(+), 34 deletions(-) diff --git a/libavformat/avformat.h b/libavformat/avformat.h index 58565fb59a..1aa18d8213 100644 --- a/libavformat/avformat.h +++ b/libavformat/avformat.h @@ -566,7 +566,6 @@ typedef struct AVStream { * encoding: set by libavformat in av_write_header */ AVRational time_base; - enum AVDiscard discard; ///< Selects which packets can be discarded at will and do not need to be demuxed. /** * Decoding: pts of the first frame of the stream, in stream time base. @@ -587,6 +586,8 @@ typedef struct AVStream { int disposition; /**< AV_DISPOSITION_* bit field */ + enum AVDiscard discard; ///< Selects which packets can be discarded at will and do not need to be demuxed. + /** * sample aspect ratio (0 if unknown) * - encoding: Set by user. @@ -609,11 +610,6 @@ typedef struct AVStream { ***************************************************************** */ - /** - * Number of frames that have been demuxed during av_find_stream_info() - */ - int codec_info_nb_frames; - /** * Stream information used internally by av_find_stream_info() */ @@ -626,9 +622,12 @@ typedef struct AVStream { int64_t codec_info_duration; int nb_decoded_frames; } *info; + + AVPacket cur_pkt; const uint8_t *cur_ptr; int cur_len; - AVPacket cur_pkt; + + int pts_wrap_bits; /**< number of bits in pts (used for wrapping control) */ // Timestamp generation support: /** @@ -641,8 +640,8 @@ typedef struct AVStream { int64_t reference_dts; int64_t first_dts; int64_t cur_dts; - int last_IP_duration; int64_t last_IP_pts; + int last_IP_duration; /** * Number of packets to buffer for codec probing @@ -650,6 +649,15 @@ typedef struct AVStream { #define MAX_PROBE_PACKETS 2500 int probe_packets; + /** + * Number of frames that have been demuxed during av_find_stream_info() + */ + int codec_info_nb_frames; + + /* av_read_frame() support */ + enum AVStreamParseType need_parsing; + struct AVCodecParserContext *parser; + /** * last packet in packet_buffer for this stream when muxing. */ @@ -657,16 +665,11 @@ typedef struct AVStream { AVProbeData probe_data; #define MAX_REORDER_DELAY 16 int64_t pts_buffer[MAX_REORDER_DELAY+1]; - /* av_read_frame() support */ - enum AVStreamParseType need_parsing; - struct AVCodecParserContext *parser; AVIndexEntry *index_entries; /**< Only used if the format does not support seeking natively. */ int nb_index_entries; unsigned int index_entries_allocated_size; - - int pts_wrap_bits; /**< number of bits in pts (used for wrapping control) */ } AVStream; #define AV_PROGRAM_RUNNING 1 @@ -739,6 +742,9 @@ typedef struct AVFormatContext { */ AVIOContext *pb; + /* stream info */ + int ctx_flags; /**< Format-specific flags, see AVFMTCTX_xx */ + /** * A list of all streams in the file. New streams are created with * avformat_new_stream(). @@ -752,8 +758,6 @@ typedef struct AVFormatContext { AVStream **streams; char filename[1024]; /**< input or output filename */ - /* stream info */ - int ctx_flags; /**< Format-specific flags, see AVFMTCTX_xx */ /** * Decoding: position of the first frame of the component, in @@ -846,12 +850,6 @@ typedef struct AVFormatContext { unsigned int nb_chapters; AVChapter **chapters; - /** - * Flags to enable debugging. - */ - int debug; -#define FF_FDEBUG_TS 0x0001 - AVDictionary *metadata; /** @@ -887,6 +885,11 @@ typedef struct AVFormatContext { */ AVIOInterruptCB interrupt_callback; + /** + * Flags to enable debugging. + */ + int debug; +#define FF_FDEBUG_TS 0x0001 /***************************************************************** * All fields below this line are not part of the public API. They * may not be used outside of libavformat and can be changed and @@ -894,19 +897,6 @@ typedef struct AVFormatContext { * New public fields should be added right above. ***************************************************************** */ - /** - * Raw packets from the demuxer, prior to parsing and decoding. - * This buffer is used for buffering packets until the codec can - * be identified, as parsing cannot be done without knowing the - * codec. - */ - struct AVPacketList *raw_packet_buffer; - struct AVPacketList *raw_packet_buffer_end; - /** - * Remaining size available for raw_packet_buffer, in bytes. - */ -#define RAW_PACKET_BUFFER_SIZE 2500000 - int raw_packet_buffer_remaining_size; /** * This buffer is only needed when packets were already buffered but @@ -921,6 +911,20 @@ typedef struct AVFormatContext { /* av_seek_frame() support */ int64_t data_offset; /**< offset of the first packet */ + + /** + * Raw packets from the demuxer, prior to parsing and decoding. + * This buffer is used for buffering packets until the codec can + * be identified, as parsing cannot be done without knowing the + * codec. + */ + struct AVPacketList *raw_packet_buffer; + struct AVPacketList *raw_packet_buffer_end; + /** + * Remaining size available for raw_packet_buffer, in bytes. + */ +#define RAW_PACKET_BUFFER_SIZE 2500000 + int raw_packet_buffer_remaining_size; } AVFormatContext; typedef struct AVPacketList { From 0c1759ac4b1ff8f0305dab4f244fa929b77a6fab Mon Sep 17 00:00:00 2001 From: Luca Barbato Date: Sat, 25 Feb 2012 21:45:23 +0100 Subject: [PATCH 3/8] segment: implement wrap around Provide a way to wrap around the segment index so pseudostreaming live through a web server and html5 browser is simpler. Also ensure that 0 (disable) is a valid value across the options providing wrap around. --- doc/muxers.texi | 2 ++ libavformat/segment.c | 8 ++++++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/doc/muxers.texi b/doc/muxers.texi index aab3b6a638..4878e7630e 100644 --- a/doc/muxers.texi +++ b/doc/muxers.texi @@ -353,6 +353,8 @@ Set segment duration to @var{t} seconds. Generate also a listfile named @var{name}. @item segment_list_size @var{size} Overwrite the listfile once it reaches @var{size} entries. +@item segment_wrap @var{limit} +Wrap around segment index once it reaches @var{limit}. @end table @example diff --git a/libavformat/segment.c b/libavformat/segment.c index 89ae62d312..1af412ad53 100644 --- a/libavformat/segment.c +++ b/libavformat/segment.c @@ -39,6 +39,7 @@ typedef struct { char *list; /**< Set by a private option. */ float time; /**< Set by a private option. */ int size; /**< Set by a private option. */ + int wrap; /**< Set by a private option. */ int64_t offset_time; int64_t recording_time; int has_video; @@ -51,6 +52,9 @@ static int segment_start(AVFormatContext *s) AVFormatContext *oc = c->avf; int err = 0; + if (c->wrap) + c->number %= c->wrap; + if (av_get_frame_filename(oc->filename, sizeof(oc->filename), s->filename, c->number++) < 0) return AVERROR(EINVAL); @@ -206,12 +210,11 @@ static int seg_write_packet(AVFormatContext *s, AVPacket *pkt) if (seg->list) { avio_printf(seg->pb, "%s\n", oc->filename); avio_flush(seg->pb); - if (!(seg->number % seg->size)) { + if (seg->size && !(seg->number % seg->size)) { avio_close(seg->pb); if ((ret = avio_open2(&seg->pb, seg->list, AVIO_FLAG_WRITE, &s->interrupt_callback, NULL)) < 0) goto fail; - } } } @@ -250,6 +253,7 @@ static const AVOption options[] = { { "segment_time", "segment length in seconds", OFFSET(time), AV_OPT_TYPE_FLOAT, {.dbl = 2}, 0, FLT_MAX, E }, { "segment_list", "output the segment list", OFFSET(list), AV_OPT_TYPE_STRING, {.str = NULL}, 0, 0, E }, { "segment_list_size", "maximum number of playlist entries", OFFSET(size), AV_OPT_TYPE_INT, {.dbl = 5}, 0, INT_MAX, E }, + { "segment_wrap", "number after which the index wraps", OFFSET(wrap), AV_OPT_TYPE_INT, {.dbl = 0}, 0, INT_MAX, E }, { NULL }, }; From bd7a647c0d3071456e066a2d2b6dc4ea807c6ffc Mon Sep 17 00:00:00 2001 From: Diego Biurrun Date: Sat, 18 Feb 2012 13:43:59 +0100 Subject: [PATCH 4/8] msmpeg4: Replace forward declaration by proper #include. --- libavcodec/msmpeg4.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/libavcodec/msmpeg4.c b/libavcodec/msmpeg4.c index 7aeb0bedce..1f3dc3a3a1 100644 --- a/libavcodec/msmpeg4.c +++ b/libavcodec/msmpeg4.c @@ -34,6 +34,7 @@ #include "libavutil/x86_cpu.h" #include "h263.h" #include "mpeg4video.h" +#include "vc1data.h" /* * You can also call this codec : MPEG4 with a twist ! @@ -59,9 +60,6 @@ static uint32_t v2_dc_lum_table[512][2]; static uint32_t v2_dc_chroma_table[512][2]; -/* vc1 externs */ -extern const uint8_t ff_wmv3_dc_scale_table[32]; - #include "msmpeg4data.h" #if CONFIG_ENCODERS //strangely gcc includes this even if it is not referenced From fc9bc08dca9ac32526251e19fcf738d23b8c68d1 Mon Sep 17 00:00:00 2001 From: "Ronald S. Bultje" Date: Tue, 28 Feb 2012 10:22:28 -0800 Subject: [PATCH 5/8] Indeo3: fix crashes on corrupt bitstreams. Splits at borders of cells are invalid, since it leaves one of the cells with a width/height of zero. Also, propagate errors on buffer allocation failures, so we don't continue decoding (which crashes). Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org --- libavcodec/indeo3.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/libavcodec/indeo3.c b/libavcodec/indeo3.c index 4fbbfbbf51..ed3535adc7 100644 --- a/libavcodec/indeo3.c +++ b/libavcodec/indeo3.c @@ -724,6 +724,8 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx, SPLIT_CELL(ref_cell->height, curr_cell.height); ref_cell->ypos += curr_cell.height; ref_cell->height -= curr_cell.height; + if (ref_cell->height <= 0 || curr_cell.height <= 0) + return AVERROR_INVALIDDATA; } else if (code == V_SPLIT) { if (curr_cell.width > strip_width) { /* split strip */ @@ -732,6 +734,8 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx, SPLIT_CELL(ref_cell->width, curr_cell.width); ref_cell->xpos += curr_cell.width; ref_cell->width -= curr_cell.width; + if (ref_cell->width <= 0 || curr_cell.width <= 0) + return AVERROR_INVALIDDATA; } while (1) { /* loop until return */ @@ -887,13 +891,16 @@ static int decode_frame_headers(Indeo3DecodeContext *ctx, AVCodecContext *avctx, return AVERROR_INVALIDDATA; if (width != ctx->width || height != ctx->height) { + int res; + av_dlog(avctx, "Frame dimensions changed!\n"); ctx->width = width; ctx->height = height; free_frame_buffers(ctx); - allocate_frame_buffers(ctx, avctx); + if ((res = allocate_frame_buffers(ctx, avctx)) < 0) + return res; avcodec_set_dimensions(avctx, width, height); } From cfac648e6af31e1ea58ddc753677761d83d89710 Mon Sep 17 00:00:00 2001 From: Diego Biurrun Date: Tue, 21 Feb 2012 23:33:01 +0100 Subject: [PATCH 6/8] doxygen: Remove documentation for non-existing parameters; misc small fixes. --- libavcodec/aacdec.c | 4 ---- libavcodec/wmaprodec.c | 1 - libavcodec/wmavoice.c | 3 --- libavdevice/x11grab.c | 1 - libavformat/mov_chan.h | 4 ++-- libavformat/mpegts.h | 4 ---- libavformat/rl2.c | 1 - libavutil/avutil.h | 3 +-- 8 files changed, 3 insertions(+), 18 deletions(-) diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c index 186de96856..811ec0bd9d 100644 --- a/libavcodec/aacdec.c +++ b/libavcodec/aacdec.c @@ -399,8 +399,6 @@ static uint64_t sniff_channel_order(uint8_t (*layout_map)[3], int tags) /** * Configure output channel order based on the current program configuration element. * - * @param che_pos current channel position configuration - * * @return Returns error status. 0 - OK, !0 - error */ static av_cold int output_configure(AACContext *ac, @@ -442,8 +440,6 @@ static av_cold int output_configure(AACContext *ac, /** * Decode an array of 4 bit element IDs, optionally interleaved with a stereo/mono switching bit. * - * @param cpe_map Stereo (Channel Pair Element) map, NULL if stereo bit is not present. - * @param sce_map mono (Single Channel Element) map * @param type speaker type/position for these channels */ static void decode_channel_map(uint8_t layout_map[][3], diff --git a/libavcodec/wmaprodec.c b/libavcodec/wmaprodec.c index 444e8a543e..2b9f4a5d8b 100644 --- a/libavcodec/wmaprodec.c +++ b/libavcodec/wmaprodec.c @@ -1481,7 +1481,6 @@ static void save_bits(WMAProDecodeCtx *s, GetBitContext* gb, int len, *@brief Decode a single WMA packet. *@param avctx codec context *@param data the output buffer - *@param data_size number of bytes that were written to the output buffer *@param avpkt input packet *@return number of bytes that were read from the input buffer */ diff --git a/libavcodec/wmavoice.c b/libavcodec/wmavoice.c index 8854e35d93..9553089cc7 100644 --- a/libavcodec/wmavoice.c +++ b/libavcodec/wmavoice.c @@ -1725,9 +1725,6 @@ static int check_bits_for_superframe(GetBitContext *orig_gb, * (if less than 480), usually used to prevent blanks at track boundaries. * * @param ctx WMA Voice decoder context - * @param samples pointer to output buffer for voice samples - * @param data_size pointer containing the size of #samples on input, and the - * amount of #samples filled on output * @return 0 on success, <0 on error or 1 if there was not enough data to * fully parse the superframe */ diff --git a/libavdevice/x11grab.c b/libavdevice/x11grab.c index bf3011bac8..305fda6e76 100644 --- a/libavdevice/x11grab.c +++ b/libavdevice/x11grab.c @@ -146,7 +146,6 @@ x11grab_region_win_init(struct x11_grab *s) * Initialize the x11 grab device demuxer (public device demuxer API). * * @param s1 Context from avformat core - * @param ap Parameters from avformat core * @return
    *
  • AVERROR(ENOMEM) no memory left
    • *
  • AVERROR(EIO) other failure case
    • diff --git a/libavformat/mov_chan.h b/libavformat/mov_chan.h index abb6916144..bd6adf6ad4 100644 --- a/libavformat/mov_chan.h +++ b/libavformat/mov_chan.h @@ -40,9 +40,9 @@ uint64_t ff_mov_get_channel_layout(uint32_t tag, uint32_t bitmap); /** - * Get the channel layout for the specified channel layout tag. + * Get the channel layout for the specified channel label. * - * @param[in] tag channel label + * @param[in] label channel label * @return channel layout mask fragment */ uint32_t ff_mov_get_channel_label(uint32_t label); diff --git a/libavformat/mpegts.h b/libavformat/mpegts.h index e38f2e09a3..9f2ba3f8f3 100644 --- a/libavformat/mpegts.h +++ b/libavformat/mpegts.h @@ -96,10 +96,6 @@ typedef struct { * @param stream_type STREAM_TYPE_xxx * @param pp Descriptor buffer pointer * @param desc_list_end End of buffer - * @param mp4_dec_config_descr_len Length of 'mp4_dec_config_descr', or zero if not present - * @param mp4_es_id - * @param pid - * @param mp4_dec_config_descr * @return <0 to stop processing */ int ff_parse_mpeg2_descriptor(AVFormatContext *fc, AVStream *st, int stream_type, diff --git a/libavformat/rl2.c b/libavformat/rl2.c index bb0a961a66..d84b8b9fd6 100644 --- a/libavformat/rl2.c +++ b/libavformat/rl2.c @@ -69,7 +69,6 @@ static int rl2_probe(AVProbeData *p) /** * read rl2 header data and setup the avstreams * @param s demuxer context - * @param ap format parameters * @return 0 on success, AVERROR otherwise */ static av_cold int rl2_read_header(AVFormatContext *s) diff --git a/libavutil/avutil.h b/libavutil/avutil.h index c9c71415e9..e4219eb87f 100644 --- a/libavutil/avutil.h +++ b/libavutil/avutil.h @@ -31,7 +31,7 @@ * * @section libav_intro Introduction * - * This document describe the usage of the different libraries + * This document describes the usage of the different libraries * provided by Libav. * * @li @ref libavc "libavcodec" encoding/decoding library @@ -40,7 +40,6 @@ * @li @ref lavd "libavdevice" special devices muxing/demuxing library * @li @ref lavu "libavutil" common utility library * @li @subpage libswscale color conversion and scaling library - * */ /** From 934cd18a43151ba4b819d9270d539cdb26f6e079 Mon Sep 17 00:00:00 2001 From: "Ronald S. Bultje" Date: Tue, 28 Feb 2012 11:35:36 -0800 Subject: [PATCH 7/8] oma: don't read beyond end of leaf_table. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org --- libavformat/omadec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/omadec.c b/libavformat/omadec.c index fc9c2921e6..7c54ffbc97 100644 --- a/libavformat/omadec.c +++ b/libavformat/omadec.c @@ -231,7 +231,7 @@ static int decrypt_init(AVFormatContext *s, ID3v2ExtraMeta *em, uint8_t *header) rprobe(s, gdata, oc->r_val) < 0 && nprobe(s, gdata, oc->n_val) < 0) { int i; - for (i = 0; i < sizeof(leaf_table); i += 2) { + for (i = 0; i < FF_ARRAY_ELEMS(leaf_table); i += 2) { uint8_t buf[16]; AV_WL64(buf, leaf_table[i]); AV_WL64(&buf[8], leaf_table[i+1]); From bbeb29133b55b7256d18f5aaab8b5c8e919a173a Mon Sep 17 00:00:00 2001 From: Alex Converse Date: Tue, 28 Feb 2012 11:50:22 -0800 Subject: [PATCH 8/8] adpcm: Clip step_index values read from the bitstream at the beginning of each frame. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind --- libavcodec/adpcm.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c index bd86ab0e61..302f2ffe57 100644 --- a/libavcodec/adpcm.c +++ b/libavcodec/adpcm.c @@ -696,7 +696,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data, for (channel = 0; channel < avctx->channels; channel++) { cs = &c->status[channel]; cs->predictor = (int16_t)bytestream_get_le16(&src); - cs->step_index = *src++; + cs->step_index = av_clip(*src++, 0, 88); src++; *samples++ = cs->predictor; } @@ -719,8 +719,8 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data, c->status[0].predictor = (int16_t)AV_RL16(src + 10); c->status[1].predictor = (int16_t)AV_RL16(src + 12); - c->status[0].step_index = src[14]; - c->status[1].step_index = src[15]; + c->status[0].step_index = av_clip(src[14], 0, 88); + c->status[1].step_index = av_clip(src[15], 0, 88); /* sign extend the predictors */ src += 16; diff_channel = c->status[1].predictor; @@ -760,7 +760,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data, for (channel = 0; channel < avctx->channels; channel++) { cs = &c->status[channel]; cs->predictor = (int16_t)bytestream_get_le16(&src); - cs->step_index = *src++; + cs->step_index = av_clip(*src++, 0, 88); src++; } @@ -823,7 +823,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data, src += 4; // skip sample count (already read) for (i=0; i<=st; i++) - c->status[i].step_index = bytestream_get_le32(&src); + c->status[i].step_index = av_clip(bytestream_get_le32(&src), 0, 88); for (i=0; i<=st; i++) c->status[i].predictor = bytestream_get_le32(&src); @@ -1037,11 +1037,11 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data, case CODEC_ID_ADPCM_IMA_SMJPEG: if (avctx->codec->id == CODEC_ID_ADPCM_IMA_AMV) { c->status[0].predictor = sign_extend(bytestream_get_le16(&src), 16); - c->status[0].step_index = bytestream_get_le16(&src); + c->status[0].step_index = av_clip(bytestream_get_le16(&src), 0, 88); src += 4; } else { c->status[0].predictor = sign_extend(bytestream_get_be16(&src), 16); - c->status[0].step_index = bytestream_get_byte(&src); + c->status[0].step_index = av_clip(bytestream_get_byte(&src), 0, 88); src += 1; }