From 592ba67815581a0ba371b57a7e3dd3079760fd9d Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 7 Apr 2012 17:25:47 +0200 Subject: [PATCH 01/13] alsdec: Check k used for rice decoder. Values that fail this check will cause failure of decode_rice() Signed-off-by: Michael Niedermayer Signed-off-by: Justin Ruggles (cherry picked from commit 23aae62c2cb4504a09ceb8cd0cabc1c8b260f521) Signed-off-by: Reinhard Tartler --- libavcodec/alsdec.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c index d5e09c5d2a..8932996e57 100644 --- a/libavcodec/alsdec.c +++ b/libavcodec/alsdec.c @@ -651,6 +651,11 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd) for (k = 1; k < sub_blocks; k++) s[k] = s[k - 1] + decode_rice(gb, 0); } + for (k = 1; k < sub_blocks; k++) + if (s[k] > 32) { + av_log(avctx, AV_LOG_ERROR, "k invalid for rice code.\n"); + return AVERROR_INVALIDDATA; + } if (get_bits1(gb)) *bd->shift_lsbs = get_bits(gb, 4) + 1; From 0f81057c125139b8b2fc00ff61b94f6c1d2f4c59 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 29 Feb 2012 06:10:17 +0100 Subject: [PATCH 02/13] alsdec: Check that quantized parcor coeffs are within range. ALS spec: 11.6.3.1.1 Quantization and encoding of parcor coefficients ... In all cases the resulting quantized values ak are restricted to the range [-64,63]. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer Signed-off-by: Justin Ruggles (cherry picked from commit 5b051ec3bdc78f3d89e8d1425674cde8fd6c9ccc) Signed-off-by: Reinhard Tartler --- libavcodec/alsdec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c index 8932996e57..eec6a1680b 100644 --- a/libavcodec/alsdec.c +++ b/libavcodec/alsdec.c @@ -705,6 +705,10 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd) int rice_param = parcor_rice_table[sconf->coef_table][k][1]; int offset = parcor_rice_table[sconf->coef_table][k][0]; quant_cof[k] = decode_rice(gb, rice_param) + offset; + if (quant_cof[k] < -64 || quant_cof[k] > 63) { + av_log(avctx, AV_LOG_ERROR, "quant_cof %d is out of range\n", quant_cof[k]); + return AVERROR_INVALIDDATA; + } } // read coefficients 20 to 126 From c5f9c272e9df0e226503cfc8029308a64d72aae4 Mon Sep 17 00:00:00 2001 From: Thilo Borgmann Date: Sun, 11 Mar 2012 16:56:23 +0100 Subject: [PATCH 03/13] alsdec: Fix out of ltp_gain_values read. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer Signed-off-by: Justin Ruggles (cherry picked from commit 97f0efbfb86d24f081b2caa39f6249e05c95c2ef) Signed-off-by: Reinhard Tartler --- libavcodec/alsdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c index eec6a1680b..4c8e5a9e27 100644 --- a/libavcodec/alsdec.c +++ b/libavcodec/alsdec.c @@ -741,7 +741,7 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd) bd->ltp_gain[0] = decode_rice(gb, 1) << 3; bd->ltp_gain[1] = decode_rice(gb, 2) << 3; - r = get_unary(gb, 0, 4); + r = get_unary(gb, 0, 3); c = get_bits(gb, 2); bd->ltp_gain[2] = ltp_gain_values[r][c]; From c28e1c12adf43044c54383eec8a581f630fffda8 Mon Sep 17 00:00:00 2001 From: Mans Rullgard Date: Sun, 1 Jul 2012 13:36:30 +0100 Subject: [PATCH 04/13] alsdec: remove dead assignments Signed-off-by: Mans Rullgard (cherry picked from commit 4ca6d206d1b5beea42c4290d2ee801aaf5cd31f0) Signed-off-by: Reinhard Tartler --- libavcodec/alsdec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c index 4c8e5a9e27..92b9e6caa5 100644 --- a/libavcodec/alsdec.c +++ b/libavcodec/alsdec.c @@ -770,7 +770,7 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd) int delta[8]; unsigned int k [8]; unsigned int b = av_clip((av_ceil_log2(bd->block_length) - 3) >> 1, 0, 5); - unsigned int i = start; + unsigned int i; // read most significant bits unsigned int high; @@ -781,7 +781,7 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd) current_res = bd->raw_samples + start; - for (sb = 0; sb < sub_blocks; sb++, i = 0) { + for (sb = 0; sb < sub_blocks; sb++) { k [sb] = s[sb] > b ? s[sb] - b : 0; delta[sb] = 5 - s[sb] + k[sb]; From dc5283dffcd41e8a41671d7566dfdd27c25e66bf Mon Sep 17 00:00:00 2001 From: Thilo Borgmann Date: Sun, 15 Apr 2012 18:07:12 +0200 Subject: [PATCH 05/13] alsdec: fix number of decoded samples in first sub-block in BGMC mode. Fixes CVE-2012-2790 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer Signed-off-by: Justin Ruggles (cherry picked from commit 66197988b1ee914825afbc3084e6da63f862068a) Signed-off-by: Reinhard Tartler --- libavcodec/alsdec.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c index 92b9e6caa5..459e2af928 100644 --- a/libavcodec/alsdec.c +++ b/libavcodec/alsdec.c @@ -770,7 +770,6 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd) int delta[8]; unsigned int k [8]; unsigned int b = av_clip((av_ceil_log2(bd->block_length) - 3) >> 1, 0, 5); - unsigned int i; // read most significant bits unsigned int high; @@ -782,28 +781,29 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd) current_res = bd->raw_samples + start; for (sb = 0; sb < sub_blocks; sb++) { + unsigned int sb_len = sb_length - (sb ? 0 : start); + k [sb] = s[sb] > b ? s[sb] - b : 0; delta[sb] = 5 - s[sb] + k[sb]; - ff_bgmc_decode(gb, sb_length, current_res, + ff_bgmc_decode(gb, sb_len, current_res, delta[sb], sx[sb], &high, &low, &value, ctx->bgmc_lut, ctx->bgmc_lut_status); - current_res += sb_length; + current_res += sb_len; } ff_bgmc_decode_end(gb); // read least significant bits and tails - i = start; current_res = bd->raw_samples + start; - for (sb = 0; sb < sub_blocks; sb++, i = 0) { + for (sb = 0; sb < sub_blocks; sb++, start = 0) { unsigned int cur_tail_code = tail_code[sx[sb]][delta[sb]]; unsigned int cur_k = k[sb]; unsigned int cur_s = s[sb]; - for (; i < sb_length; i++) { + for (; start < sb_length; start++) { int32_t res = *current_res; if (res == cur_tail_code) { From 3c55bf1201ac75c5e46b03e3e077031f755f85d0 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 28 Jul 2012 17:14:50 +0600 Subject: [PATCH 06/13] vc1dec: check that coded slice positions and interlacing match. This fixes out of array writes. Addresses: CVE-2012-2796 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer Signed-off-by: Kostya Shishkov (cherry picked from commit 1100acbab26883007898c53efeb289f562c6e514) Signed-off-by: Reinhard Tartler --- libavcodec/vc1dec.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c index 46cfdb0973..38b08a565b 100644 --- a/libavcodec/vc1dec.c +++ b/libavcodec/vc1dec.c @@ -5710,6 +5710,12 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data, mb_height = s->mb_height >> v->field_mode; for (i = 0; i <= n_slices; i++) { if (i > 0 && slices[i - 1].mby_start >= mb_height) { + if (v->field_mode <= 0) { + av_log(v->s.avctx, AV_LOG_ERROR, "Slice %d starts beyond " + "picture boundary (%d >= %d)\n", i, + slices[i - 1].mby_start, mb_height); + continue; + } v->second_field = 1; v->blocks_off = s->mb_width * s->mb_height << 1; v->mb_off = s->mb_stride * s->mb_height >> 1; From a2d4d9f4fbe13cb259f06fb907a056b6f3dd2d15 Mon Sep 17 00:00:00 2001 From: Sean McGovern Date: Thu, 2 Aug 2012 15:37:28 -0400 Subject: [PATCH 07/13] wmapro: prevent division by zero when sample rate is unspecified This fixes Bugzilla #327: Signed-off-by: Kostya Shishkov (cherry picked from commit 3680b2435101a5de56821718a71c828320d535a0) Signed-off-by: Anton Khirnov --- libavcodec/wmaprodec.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/wmaprodec.c b/libavcodec/wmaprodec.c index 3b8c2c8676..9804cc28e7 100644 --- a/libavcodec/wmaprodec.c +++ b/libavcodec/wmaprodec.c @@ -330,6 +330,11 @@ static av_cold int decode_init(AVCodecContext *avctx) return AVERROR_INVALIDDATA; } + if (s->avctx->sample_rate <= 0) { + av_log(avctx, AV_LOG_ERROR, "invalid sample rate\n"); + return AVERROR_INVALIDDATA; + } + s->num_channels = avctx->channels; if (s->num_channels < 0) { From 5acd1c6561c0aa4f11eb9a83cf56790f1db50d23 Mon Sep 17 00:00:00 2001 From: Anton Khirnov Date: Fri, 28 Sep 2012 15:26:48 +0200 Subject: [PATCH 08/13] avidec: return 0, not packet size from read_packet(). (cherry picked from commit eeade678f0a2bac127aeed2fb68d8717a6463420) Signed-off-by: Anton Khirnov --- libavformat/avidec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/avidec.c b/libavformat/avidec.c index 13a39c0e11..af6ee8ed0f 100644 --- a/libavformat/avidec.c +++ b/libavformat/avidec.c @@ -1122,7 +1122,7 @@ resync: ast->packet_size= 0; } - return size; + return 0; } if ((err = avi_sync(s, 0)) < 0) From 141d4ed6c0911fde1913f3b757ace5012eabd897 Mon Sep 17 00:00:00 2001 From: Anton Khirnov Date: Tue, 11 Sep 2012 11:03:52 +0200 Subject: [PATCH 09/13] cmdutils: avoid setting data pointers to invalid values in alloc_buffer() Fixes bug 352. (cherry picked from commit 990450c5bf17afc31a81d6225afaac86d0dca5dd) Conflicts: cmdutils.c Signed-off-by: Anton Khirnov --- avconv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/avconv.c b/avconv.c index 90bc49cc88..34507d4d0c 100644 --- a/avconv.c +++ b/avconv.c @@ -455,7 +455,7 @@ static int alloc_buffer(InputStream *ist, FrameBuffer **pbuf) const int v_shift = i==0 ? 0 : v_chroma_shift; if (s->flags & CODEC_FLAG_EMU_EDGE) buf->data[i] = buf->base[i]; - else + else if (buf->base[i]) buf->data[i] = buf->base[i] + FFALIGN((buf->linesize[i]*edge >> v_shift) + (pixel_size*edge >> h_shift), 32); From 79fb7bc667dd4b9c899b3223d3e4fb5baa6c2e17 Mon Sep 17 00:00:00 2001 From: "Ronald S. Bultje" Date: Fri, 16 Mar 2012 15:24:08 -0700 Subject: [PATCH 10/13] h264: fix deadlocks on incomplete reference frame decoding. If decoding a second complementary field, and the first was decoded in our thread, mark decoding of that field as complete. If decoding fails, mark the decoded field/frame as complete. Do not allow switching between field modes or field/frame mode between slices within the same field/frame. Ensure that two subsequent fields cover top/bottom (rather than top/frame, bottom/frame or such nonsense situations). Fixes various deadlocks when decoding samples with errors in reference frames. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 1e26a48fa23ef8e1cbc424667d387184d8155f15) Fixes Bug 118 Conflicts: libavcodec/h264.c Signed-off-by: Anton Khirnov --- libavcodec/h264.c | 149 +++++++++++++++++++++++++++++++++++++--------- 1 file changed, 121 insertions(+), 28 deletions(-) diff --git a/libavcodec/h264.c b/libavcodec/h264.c index 79298d7b0c..9f6437cd8f 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -2522,8 +2522,8 @@ static int field_end(H264Context *h, int in_setup){ s->mb_y= 0; if (!in_setup && !s->dropable) - ff_thread_report_progress((AVFrame*)s->current_picture_ptr, (16*s->mb_height >> FIELD_PICTURE) - 1, - s->picture_structure==PICT_BOTTOM_FIELD); + ff_thread_report_progress(&s->current_picture_ptr->f, INT_MAX, + s->picture_structure == PICT_BOTTOM_FIELD); if (CONFIG_H264_VDPAU_DECODER && s->avctx->codec->capabilities&CODEC_CAP_HWACCEL_VDPAU) ff_vdpau_h264_set_reference_frames(s); @@ -2640,9 +2640,7 @@ static int decode_slice_header(H264Context *h, H264Context *h0){ int num_ref_idx_active_override_flag; unsigned int slice_type, tmp, i, j; int default_ref_list_done = 0; - int last_pic_structure; - - s->dropable= h->nal_ref_idc == 0; + int last_pic_structure, last_pic_dropable; /* FIXME: 2tap qpel isn't implemented for high bit depth. */ if((s->avctx->flags2 & CODEC_FLAG2_FAST) && !h->nal_ref_idc && !h->pixel_shift){ @@ -2661,8 +2659,14 @@ static int decode_slice_header(H264Context *h, H264Context *h0){ } h0->current_slice = 0; - if (!s0->first_field) - s->current_picture_ptr= NULL; + if (!s0->first_field) { + if (s->current_picture_ptr && !s->dropable && + s->current_picture_ptr->owner2 == s) { + ff_thread_report_progress(&s->current_picture_ptr->f, INT_MAX, + s->picture_structure == PICT_BOTTOM_FIELD); + } + s->current_picture_ptr = NULL; + } } slice_type= get_ue_golomb_31(&s->gb); @@ -2862,6 +2866,8 @@ static int decode_slice_header(H264Context *h, H264Context *h0){ h->mb_mbaff = 0; h->mb_aff_frame = 0; last_pic_structure = s0->picture_structure; + last_pic_dropable = s->dropable; + s->dropable = h->nal_ref_idc == 0; if(h->sps.frame_mbs_only_flag){ s->picture_structure= PICT_FRAME; }else{ @@ -2874,10 +2880,22 @@ static int decode_slice_header(H264Context *h, H264Context *h0){ } h->mb_field_decoding_flag= s->picture_structure != PICT_FRAME; - if(h0->current_slice == 0){ - // Shorten frame num gaps so we don't have to allocate reference frames just to throw them away - if(h->frame_num != h->prev_frame_num) { - int unwrap_prev_frame_num = h->prev_frame_num, max_frame_num = 1<sps.log2_max_frame_num; + if (h0->current_slice != 0) { + if (last_pic_structure != s->picture_structure || + last_pic_dropable != s->dropable) { + av_log(h->s.avctx, AV_LOG_ERROR, + "Changing field mode (%d -> %d) between slices is not allowed\n", + last_pic_structure, s->picture_structure); + s->picture_structure = last_pic_structure; + s->dropable = last_pic_dropable; + return AVERROR_INVALIDDATA; + } + } else { + /* Shorten frame num gaps so we don't have to allocate reference + * frames just to throw them away */ + if (h->frame_num != h->prev_frame_num) { + int unwrap_prev_frame_num = h->prev_frame_num; + int max_frame_num = 1 << h->sps.log2_max_frame_num; if (unwrap_prev_frame_num > h->frame_num) unwrap_prev_frame_num -= max_frame_num; @@ -2890,8 +2908,74 @@ static int decode_slice_header(H264Context *h, H264Context *h0){ } } - while(h->frame_num != h->prev_frame_num && - h->frame_num != (h->prev_frame_num+1)%(1<sps.log2_max_frame_num)){ + /* See if we have a decoded first field looking for a pair... + * Here, we're using that to see if we should mark previously + * decode frames as "finished". + * We have to do that before the "dummy" in-between frame allocation, + * since that can modify s->current_picture_ptr. */ + if (s0->first_field) { + assert(s0->current_picture_ptr); + assert(s0->current_picture_ptr->f.data[0]); + assert(s0->current_picture_ptr->f.reference != DELAYED_PIC_REF); + + /* Mark old field/frame as completed */ + if (!last_pic_dropable && s0->current_picture_ptr->owner2 == s0) { + ff_thread_report_progress(&s0->current_picture_ptr->f, INT_MAX, + last_pic_structure == PICT_BOTTOM_FIELD); + } + + /* figure out if we have a complementary field pair */ + if (!FIELD_PICTURE || s->picture_structure == last_pic_structure) { + /* Previous field is unmatched. Don't display it, but let it + * remain for reference if marked as such. */ + if (!last_pic_dropable && last_pic_structure != PICT_FRAME) { + ff_thread_report_progress(&s0->current_picture_ptr->f, INT_MAX, + last_pic_structure == PICT_TOP_FIELD); + } + } else { + if (s0->current_picture_ptr->frame_num != h->frame_num) { + /* This and previous field were reference, but had + * different frame_nums. Consider this field first in + * pair. Throw away previous field except for reference + * purposes. */ + if (!last_pic_dropable && last_pic_structure != PICT_FRAME) { + ff_thread_report_progress(&s0->current_picture_ptr->f, INT_MAX, + last_pic_structure == PICT_TOP_FIELD); + } + } else { + /* Second field in complementary pair */ + if (!((last_pic_structure == PICT_TOP_FIELD && + s->picture_structure == PICT_BOTTOM_FIELD) || + (last_pic_structure == PICT_BOTTOM_FIELD && + s->picture_structure == PICT_TOP_FIELD))) { + av_log(s->avctx, AV_LOG_ERROR, + "Invalid field mode combination %d/%d\n", + last_pic_structure, s->picture_structure); + s->picture_structure = last_pic_structure; + s->dropable = last_pic_dropable; + return AVERROR_INVALIDDATA; + } else if (last_pic_dropable != s->dropable) { + av_log(s->avctx, AV_LOG_ERROR, + "Cannot combine reference and non-reference fields in the same frame\n"); + av_log_ask_for_sample(s->avctx, NULL); + s->picture_structure = last_pic_structure; + s->dropable = last_pic_dropable; + return AVERROR_INVALIDDATA; + } + + /* Take ownership of this buffer. Note that if another thread owned + * the first field of this buffer, we're not operating on that pointer, + * so the original thread is still responsible for reporting progress + * on that first field (or if that was us, we just did that above). + * By taking ownership, we assign responsibility to ourselves to + * report progress on the second field. */ + s0->current_picture_ptr->owner2 = s0; + } + } + } + + while (h->frame_num != h->prev_frame_num && + h->frame_num != (h->prev_frame_num + 1) % (1 << h->sps.log2_max_frame_num)) { Picture *prev = h->short_ref_count ? h->short_ref[0] : NULL; av_log(h->s.avctx, AV_LOG_DEBUG, "Frame num gap %d %d\n", h->frame_num, h->prev_frame_num); if (ff_h264_frame_start(h) < 0) @@ -2922,7 +3006,9 @@ static int decode_slice_header(H264Context *h, H264Context *h0){ } } - /* See if we have a decoded first field looking for a pair... */ + /* See if we have a decoded first field looking for a pair... + * We're using that to see whether to continue decoding in that + * frame, or to allocate a new one. */ if (s0->first_field) { assert(s0->current_picture_ptr); assert(s0->current_picture_ptr->f.data[0]); @@ -2938,16 +3024,11 @@ static int decode_slice_header(H264Context *h, H264Context *h0){ s0->first_field = FIELD_PICTURE; } else { - if (h->nal_ref_idc && - s0->current_picture_ptr->f.reference && - s0->current_picture_ptr->frame_num != h->frame_num) { - /* - * This and previous field were reference, but had - * different frame_nums. Consider this field first in - * pair. Throw away previous field except for reference - * purposes. - */ - s0->first_field = 1; + if (s0->current_picture_ptr->frame_num != h->frame_num) { + /* This and the previous field had different frame_nums. + * Consider this field first in pair. Throw away previous + * one except for reference purposes. */ + s0->first_field = 1; s0->current_picture_ptr = NULL; } else { @@ -3803,8 +3884,9 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){ hx = h->thread_context[context_count]; ptr= ff_h264_decode_nal(hx, buf + buf_index, &dst_length, &consumed, next_avc - buf_index); - if (ptr==NULL || dst_length < 0){ - return -1; + if (ptr == NULL || dst_length < 0) { + buf_index = -1; + goto end; } i= buf_index + consumed; if((s->workaround_bugs & FF_BUG_AUTODETECT) && i+3nal_unit_type != NAL_IDR_SLICE) { av_log(h->s.avctx, AV_LOG_ERROR, "Invalid mix of idr and non-idr slices"); - return -1; + buf_index = -1; + goto end; } idr(h); // FIXME ensure we don't lose some frames if there is reordering case NAL_SLICE: @@ -3962,7 +4045,8 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){ dsputil_init(&s->dsp, s->avctx); } else { av_log(avctx, AV_LOG_ERROR, "Unsupported bit depth: %d\n", h->sps.bit_depth_luma); - return -1; + buf_index = -1; + goto end; } } break; @@ -4004,6 +4088,15 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){ } if(context_count) execute_decode_slices(h, context_count); + +end: + /* clean up */ + if (s->current_picture_ptr && s->current_picture_ptr->owner2 == s && + !s->dropable) { + ff_thread_report_progress(&s->current_picture_ptr->f, INT_MAX, + s->picture_structure == PICT_BOTTOM_FIELD); + } + return buf_index; } From 5920d00d741796a7e1a53241c7814d529cb68455 Mon Sep 17 00:00:00 2001 From: Justin Ruggles Date: Tue, 28 Feb 2012 18:52:30 -0500 Subject: [PATCH 11/13] libvorbis: fix use of minrate/maxrate AVOptions - enable the options for audio encoding - properly check for user-set maxrate - use correct calling order in vorbis_encode_setup_managed() (cherry picked from commit 182d4f1f3855460ee8634ea052f33332cf9d174e) Conflicts: libavcodec/libvorbis.c Fixes a part of Bug 277 Signed-off-by: Anton Khirnov --- libavcodec/libvorbis.c | 6 +++--- libavcodec/options.c | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/libavcodec/libvorbis.c b/libavcodec/libvorbis.c index 25e600671f..c790ff0f65 100644 --- a/libavcodec/libvorbis.c +++ b/libavcodec/libvorbis.c @@ -74,12 +74,12 @@ static av_cold int oggvorbis_init_encoder(vorbis_info *vi, AVCodecContext *avcco return -1; } else { int minrate = avccontext->rc_min_rate > 0 ? avccontext->rc_min_rate : -1; - int maxrate = avccontext->rc_min_rate > 0 ? avccontext->rc_max_rate : -1; + int maxrate = avccontext->rc_max_rate > 0 ? avccontext->rc_max_rate : -1; /* constant bitrate */ if (vorbis_encode_setup_managed(vi, avccontext->channels, - avccontext->sample_rate, minrate, - avccontext->bit_rate, maxrate)) + avccontext->sample_rate, maxrate, + avccontext->bit_rate, minrate)) return -1; /* variable bitrate by estimate, disable slow rate management */ diff --git a/libavcodec/options.c b/libavcodec/options.c index 26f3ab3b11..bd0083c826 100644 --- a/libavcodec/options.c +++ b/libavcodec/options.c @@ -226,8 +226,8 @@ static const AVOption options[]={ {"rc_qmod_freq", "experimental quantizer modulation", OFFSET(rc_qmod_freq), AV_OPT_TYPE_INT, {.dbl = DEFAULT }, INT_MIN, INT_MAX, V|E}, {"rc_override_count", NULL, OFFSET(rc_override_count), AV_OPT_TYPE_INT, {.dbl = DEFAULT }, INT_MIN, INT_MAX}, {"rc_eq", "set rate control equation", OFFSET(rc_eq), AV_OPT_TYPE_STRING, {.str = NULL}, CHAR_MIN, CHAR_MAX, V|E}, -{"maxrate", "set max video bitrate tolerance (in bits/s)", OFFSET(rc_max_rate), AV_OPT_TYPE_INT, {.dbl = DEFAULT }, INT_MIN, INT_MAX, V|E}, -{"minrate", "set min video bitrate tolerance (in bits/s)", OFFSET(rc_min_rate), AV_OPT_TYPE_INT, {.dbl = DEFAULT }, INT_MIN, INT_MAX, V|E}, +{"maxrate", "set max bitrate tolerance (in bits/s)", OFFSET(rc_max_rate), AV_OPT_TYPE_INT, {.dbl = DEFAULT }, INT_MIN, INT_MAX, V|A|E}, +{"minrate", "set min bitrate tolerance (in bits/s)", OFFSET(rc_min_rate), AV_OPT_TYPE_INT, {.dbl = DEFAULT }, INT_MIN, INT_MAX, V|A|E}, {"bufsize", "set ratecontrol buffer size (in bits)", OFFSET(rc_buffer_size), AV_OPT_TYPE_INT, {.dbl = DEFAULT }, INT_MIN, INT_MAX, A|V|E}, {"rc_buf_aggressivity", "currently useless", OFFSET(rc_buffer_aggressivity), AV_OPT_TYPE_FLOAT, {.dbl = 1.0 }, -FLT_MAX, FLT_MAX, V|E}, {"i_qfactor", "qp factor between P and I frames", OFFSET(i_quant_factor), AV_OPT_TYPE_FLOAT, {.dbl = -0.8 }, -FLT_MAX, FLT_MAX, V|E}, From 24025cc0b972a8c2e8b3018cb7c53c1f55fe5fbb Mon Sep 17 00:00:00 2001 From: Justin Ruggles Date: Tue, 28 Feb 2012 19:33:07 -0500 Subject: [PATCH 12/13] libvorbis: use VBR by default, with default quality of 3 (cherry picked from commit 147ff24a0e8d819615a0f596df3ea47dddd79fdc) Conflicts: libavcodec/libvorbis.c Fixes a part of Bug 277 Signed-off-by: Anton Khirnov --- libavcodec/libvorbis.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/libavcodec/libvorbis.c b/libavcodec/libvorbis.c index c790ff0f65..60235d7df7 100644 --- a/libavcodec/libvorbis.c +++ b/libavcodec/libvorbis.c @@ -29,6 +29,7 @@ #include "libavutil/opt.h" #include "avcodec.h" #include "bytestream.h" +#include "internal.h" #include "vorbis.h" #include "libavutil/mathematics.h" @@ -59,6 +60,12 @@ static const AVOption options[] = { { "iblock", "Sets the impulse block bias", offsetof(OggVorbisContext, iblock), AV_OPT_TYPE_DOUBLE, { .dbl = 0 }, -15, 0, AV_OPT_FLAG_AUDIO_PARAM | AV_OPT_FLAG_ENCODING_PARAM }, { NULL } }; + +static const AVCodecDefault defaults[] = { + { "b", "0" }, + { NULL }, +}; + static const AVClass class = { "libvorbis", av_default_item_name, options, LIBAVUTIL_VERSION_INT }; static av_cold int oggvorbis_init_encoder(vorbis_info *vi, AVCodecContext *avccontext) @@ -66,11 +73,18 @@ static av_cold int oggvorbis_init_encoder(vorbis_info *vi, AVCodecContext *avcco OggVorbisContext *context = avccontext->priv_data; double cfreq; - if (avccontext->flags & CODEC_FLAG_QSCALE) { - /* variable bitrate */ + if (avccontext->flags & CODEC_FLAG_QSCALE || !avccontext->bit_rate) { + /* variable bitrate + * NOTE: we use the oggenc range of -1 to 10 for global_quality for + * user convenience, but libvorbis uses -0.1 to 1.0. + */ + float q = avccontext->global_quality / (float)FF_QP2LAMBDA; + /* default to 3 if the user did not set quality or bitrate */ + if (!(avccontext->flags & CODEC_FLAG_QSCALE)) + q = 3.0; if (vorbis_encode_setup_vbr(vi, avccontext->channels, avccontext->sample_rate, - avccontext->global_quality / (float)FF_QP2LAMBDA / 10.0)) + q / 10.0)) return -1; } else { int minrate = avccontext->rc_min_rate > 0 ? avccontext->rc_min_rate : -1; @@ -262,4 +276,5 @@ AVCodec ff_libvorbis_encoder = { .sample_fmts = (const enum AVSampleFormat[]) { AV_SAMPLE_FMT_S16, AV_SAMPLE_FMT_NONE }, .long_name = NULL_IF_CONFIG_SMALL("libvorbis Vorbis"), .priv_class = &class, + .defaults = defaults, }; From be209bdabb11c59de17220bdbf0bf9c9f7cc16f5 Mon Sep 17 00:00:00 2001 From: Anton Khirnov Date: Sun, 8 Jul 2012 17:01:17 +0200 Subject: [PATCH 13/13] vf_pad: don't give up its own reference to the output buffer. Conflicts: libavfilter/vf_pad.c Fixes Bug 245 Signed-off-by: Anton Khirnov --- libavfilter/vf_pad.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavfilter/vf_pad.c b/libavfilter/vf_pad.c index 9ba91ed21c..8f583da16d 100644 --- a/libavfilter/vf_pad.c +++ b/libavfilter/vf_pad.c @@ -300,6 +300,7 @@ static void start_frame(AVFilterLink *inlink, AVFilterBufferRef *inpicref) { PadContext *pad = inlink->dst->priv; AVFilterBufferRef *outpicref = avfilter_ref_buffer(inpicref, ~0); + AVFilterBufferRef *for_next_filter; int plane; for (plane = 0; plane < 4 && outpicref->data[plane]; plane++) { @@ -336,12 +337,14 @@ static void start_frame(AVFilterLink *inlink, AVFilterBufferRef *inpicref) outpicref->video->w = pad->w; outpicref->video->h = pad->h; - avfilter_start_frame(inlink->dst->outputs[0], outpicref); + for_next_filter = avfilter_ref_buffer(outpicref, ~0); + avfilter_start_frame(inlink->dst->outputs[0], for_next_filter); } static void end_frame(AVFilterLink *link) { avfilter_end_frame(link->dst->outputs[0]); + avfilter_unref_buffer(link->dst->outputs[0]->out_buf); avfilter_unref_buffer(link->cur_buf); }