Fixes: signed integer overflow: 33632416 * 64 cannot be represented in type 'int'
Fixes: 421817631/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APV_fuzzer-4957386534354944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: signed integer overflow: 30 + 2147483647 cannot be represented in type 'int'
Fixes: 418335931/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV60_fuzzer-6568264620900352
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
In sunrast_decode_frame(), we use av_malloc_array() allocates memory
to ptr and ptr2. However if buf_end - buf < 1, this function returns
error code without freeing this memory thus cause a leak. Add av_freep()
before return.
Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Instead of setting these unconditionally (they are always zero
for H.261, MPEG-1/2, RV30/40, VC-1), add a variant of
ff_mpeg_er_frame_start() that sets them and remove setting them
from ff_mpeg_er_frame_start(). Also pass these values via parameters
instead of reading them from the MPVContext itself.
This will allow to move them from MPVContext.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
It used to be a tri-state encoding both whether to use FLV picture
headers and whether to use the FLV way of encoding escape values,
but the former is now unnecessary due to the switch to a function
pointer for reading the header. So binarize h263_flv.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Instead add the necessary blocks directly into Mpeg12SliceContext.
This allows to completely remove MPVContext.block.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
These files currently rely on implicit inclusions of avassert.h
and/or mathops.h via get_bits.h.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Add a GetBitContext to H263DecContext instead. This is in preparation
for removing MpegEncContext.gb.
Also move last_resync_gb to H263DecContext.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Instead add the necessary blocks directly to H263DecContext
(only six are needed, not 12 as ff_mpv_common_init()
currently allocates).
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
With the exception of mpeg4_decode_studio_mb(), all decode_mb
functions implicitly presumed that the block provided as
argument coincides with MpegEncContext.block (they zeroed the latter
and then used the former to decode the block); mpeg4_decode_studio_mb()
meanwhile did not use the provided block at all (it uses blocks of
int32_t). So remove said parameter.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This is in preparation for moving the fields only used
by H.263-based decoders from MPVContext to H263DecContext.
For now only the decode_mb function pointer has been moved
(to be able to switch said callback to use an H263DecContext*).
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
The code in h263dec.c is not supposed to know that the MPEG-4
decoder uses an Mpeg4DecContext as private context at all
(said context is only exposed in a header so that hardware
accelerations can access it and for the parser to use).
Passing an MPVContext* directly also allows to remove
the indirection via AVCodecContext.priv_data.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This basically reverts d4967c04e0.
Said commit was based on the false premise that it would
be an aliasing violation to upcast a pointer to structure
to a pointer to a bigger structure containing the original
structure as its first element, but this is just not true.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Instead add the necessary blocks directly to VC1Context
(only six are needed, not 12 as ff_mpv_common_init()
currently allocates).
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Add a GetBitContext to VC1Context instead. This is in preparation
for removing MpegEncContext.gb.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
These decoders only need a single 4x4 block; put it in RV34DecContext.
This is in preparation for removing MpegEncContext.block.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Instead put it into H261DecContext. This is in preparation
for removing MpegEncContext.block.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
In the common case of decoding 420 content, only six blocks are used
and it makes perfect sense for the caller to only have that many.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
It is unused (because unquantizing/the idct has been disabled)
apart from FF_DEBUG_DCT_COEFF debug code which makes no sense
when this function is called via error resilience. So pass a NULL
as block when calling ff_mpv_reconstruct_mb() from mpeg_er_decode_mb()
and disable the debug code in this scenario.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Michael Niedermayer