Commit Graph

1727 Commits

Author SHA1 Message Date
James Almer e09164940e avformat/mov: free the infe allocated item data on failure
Fixes: memleak
Fixes: 68212/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4963488540721152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Tested-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
2024-04-30 18:29:38 -03:00
James Almer b7debef3cc avformat/mov: support SpatialAudioBox ambisonic layouts with non-diegetic channels
Signed-off-by: James Almer <jamrial@gmail.com>
2024-04-30 11:15:13 -03:00
James Almer 37c8d93e56 avformat/mov: support SpatialAudioBox ambisonic layouts with arbitrary channel mapping
Signed-off-by: James Almer <jamrial@gmail.com>
2024-04-30 11:15:13 -03:00
James Almer 31327c2d07 avformat/mov: fix the check for the heif item parsing loop
Fixes: Null pointer dereference
Fixes: 67861/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5352628142800896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: James Almer <jamrial@gmail.com>
2024-04-27 19:39:23 -03:00
James Almer 5b9db32ccc avformat/mov: ignore old infe box versions
Some files with no image items have them, and were working prior to the recent
HEIF parsing overhaul.
Ignore such boxes instead, to recover the old behavior.

Fixes a regression since d9fed9df2a.

Tested-by: Wu Jianhua <toqsxw@outlook.com>
Signed-off-by: James Almer <jamrial@gmail.com>
2024-04-18 13:00:11 -03:00
Eugene Zemtsov 591e27d1e7 configure: Separate subsystem for Immersive Audio Model
This change allows users to build libavfomat without support
for Immersive Audio Model by specifying --disable-iamf.
It helps to save on binary size in cases where it's important.

Co-authored-by: James Almer <jamrial@gmail.com>
Signed-off-by: Eugene Zemtsov <eugene@chromium.org>
Signed-off-by: James Almer <jamrial@gmail.com>
2024-04-03 09:57:52 -03:00
James Almer 8e294abd9d avformat/mov: simplify the entry count overflow check in the keys atom
Suggested-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Signed-off-by: James Almer <jamrial@gmail.com>
2024-04-02 09:09:35 -03:00
James Almer 5a06d3810e avformat/mov: don't read key_size bytes twice in the keys atom
We only support mdta as type, yet we were not skipping other types,
but rather reading key_size worth of bytes twice per entry.

Signed-off-by: James Almer <jamrial@gmail.com>
2024-04-02 00:16:31 -03:00
James Almer 3d12ba77d9 avformat/mov: take into account the first eight bytes in the keys atom
Signed-off-by: James Almer <jamrial@gmail.com>
2024-04-02 00:13:12 -03:00
Eugene Zemtsov 8a23a145d8 avformat/mov: Check if a key is longer than the atom containing it
Stop reading keys and return AVERROR_INVALIDDATA if key_size
is larger than the amount of space left in the atom.

Bug: https://crbug.com/41496983
Signed-off-by: Eugene Zemtsov <eugene@chromium.org>
Signed-off-by: James Almer <jamrial@gmail.com>
2024-04-02 00:13:12 -03:00
Andreas Rheinhardt 9d219ff149 avformat/mov: Don't add attached pic if one is already present
Fixes: memleak
Fixes: 67714/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5671570999476224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2024-04-02 04:13:44 +02:00
James Almer f492f1ac23 avformat/mov: ensure all items id referenced by a grid are valid
Fixes: null pointer dereference
Fixes: 67494/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6528714521247744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Tested-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
2024-04-01 21:13:04 -03:00
Andreas Rheinhardt 790f793844 avutil/common: Don't auto-include mem.h
There are lots of files that don't need it: The number of object
files that actually need it went down from 2011 to 884 here.

Keep it for external users in order to not cause breakages.

Also improve the other headers a bit while just at it.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2024-03-31 00:08:43 +01:00
James Almer e37b233ee2 Revert "avformat/mov: ignore item boxes for animated heif"
This reverts commit f6b7b473d4.
The image in the item boxes and the animation in the trak box are not
necessarely the same, so both should be exported.

Signed-off-by: James Almer <jamrial@gmail.com>
2024-03-30 12:25:59 -03:00
James Almer 189c32f536 avformat/mov: don't abort on duplicate Mastering Display Metadata boxes
The VP9 spec defines a SmDm box for this information, and the ISOBMFF spec defines a
mdvc one. If both are present, just ignore one of them.
This is in line with clli and CoLL boxes.

Fixes ticket #10711.

Signed-off-by: James Almer <jamrial@gmail.com>
2024-03-27 13:51:28 -03:00
Michael Niedermayer f01a89c5a3
avformat/mov: use 64bit for intermediate for rounding
Fixes: signed integer overflow: 1768972133 + 968491058 cannot be represented in type 'int'
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4802790784303104

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-03-26 23:25:37 +01:00
Michael Niedermayer 0a114d7318
avformat/mov: Do not deallocate heif_item in a input dependant way
Fixes: out of array access
Fixes: 67070/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5685384082161664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-03-26 23:19:49 +01:00
James Almer 1e7ba76562 avformat/mov: free HEIFItem.name when cleaning items in mov_read_trak
Fixes memleaks.

Signed-off-by: James Almer <jamrial@gmail.com>
2024-03-26 10:43:45 -03:00
Andreas Rheinhardt 4a4dcde339 avformat/internal: Move FF_FMT_INIT_CLEANUP to demux.h
and rename it to FF_INFMT_INIT_CLEANUP. This flag is demuxer-only,
so this is the more appropriate place for it.
This does not preclude adding internal flags common to both
demuxer and muxer in the future.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2024-03-26 06:36:43 +01:00
James Almer abcdd3aed7 avformat/mov: don't use cur_item_id as array index
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
2024-03-25 23:20:51 -03:00
Michael Niedermayer 3c43299e9e
avformat/mov: Check sample_count and auxiliary_info_default_size to be 0
This combination causes 0 size arrays to be allocated and to leak later

Fixes: memleak
Fixes: 64342/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4520993686945792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-03-25 21:41:25 +01:00
Andreas Rheinhardt b800327f4c avformat/avformat: Add FFInputFormat, hide internals of AVInputFormat
This commit does for AVInputFormat what commit
59c9dc82f4 did for AVOutputFormat:
It adds a new type FFInputFormat, moves all the internals
of AVInputFormat to it and adds a now reduced AVInputFormat
as first member.

This does not affect/improve extensibility of both public
or private fields for demuxers (it is still a mess due to lavd).

This is possible since 50f34172e0
(which removed the last usage of an internal field of AVInputFormat
in fftools).

(Hint: tools/probetest.c accesses the internals of FFInputFormat
as well, but given that it is a testing tool this is not considered
a problem.)

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2024-03-07 08:53:31 -03:00
James Almer 1a34eb3ffc avformat/mov: fix setting dependent disposition on ambisonic IAMF streams
Signed-off-by: James Almer <jamrial@gmail.com>
2024-03-05 13:26:04 -03:00
James Almer 97e1480c8c avformat/mov: set stream index field in tile grids
It was forgotten for grid type derived images.

Signed-off-by: James Almer <jamrial@gmail.com>
2024-03-04 20:17:52 -03:00
James Almer 8f33d8fa9b avformat/mov: don't mark an item referenced by a grid as dependent if it's the primary item
If it's the primary item, then it's expected to be ready for presentation even
outside of the grid it belongs to.

Signed-off-by: James Almer <jamrial@gmail.com>
2024-03-04 20:17:41 -03:00
James Almer d78c75fe49 avformat/mov: fix setting disposition for the first iamf stream
st->disposition will be overwritten with disposition later in the function.

Signed-off-by: James Almer <jamrial@gmail.com>
2024-03-04 20:17:41 -03:00
Zhao Zhili b56b343e43 avformat/mov: Update bits_per_coded_sample after read pcmC
Fix #10878
2024-03-01 17:23:18 +08:00
Andreas Rheinhardt 1bb7d5ca9f avformat/mov: Don't use entry[-1] in pointer arithmetic
It is undefined behaviour.
Fixes many failed tests with UBSan and GCC 13 like
"src/libavformat/mov.c:4229:44: runtime error: store to address
0x5572abe20f80 with insufficient space for an object of type 'struct
MOVIndexRange'"
(The line number does not refer to the line where &entry[-1]
is assigned.)

Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2024-02-27 10:27:42 +01:00
Andreas Rheinhardt 9d7d03ea45 Revert "avformat/mov: zero initialize the index ranges buffer"
This reverts commit eee3b7e2fb.
It has been made in an attempt to fix UBSan test failures with
GCC 13 (see e.g. [1]), but it did not help at all. So revert it,
but use av_malloc_array() instead of going back to av_malloc().

[1]: https://fate.ffmpeg.org/report.cgi?slot=x86_64-archlinux-gcc-ubsan&time=20240226182430

Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2024-02-27 00:17:39 +01:00
James Almer 41e349c24a avformat/mov: add support for tile HEIF still images
Export each tile as its own stream, and the grid information as a Stream Group
of type TILE_GRID.
This also enables exporting other stream items like thumbnails, which may be
present in non tiled HEIF images too. For those, the primary stream will be
tagged with the default disposition.

Based on a patch by Swaraj Hota

Signed-off-by: James Almer <jamrial@gmail.com>
2024-02-26 12:21:12 -03:00
Dale Curtis 6ef32ea574
Avoid OOM for invalid STCO / CO64 constructions.
The `entries` value is read directly from the stream and used to
allocate memory. This change clamps `entries` to however many are
possible in the remaining atom or file size (whichever is smallest).

Fixes https://crbug.com/1429357

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-02-21 18:23:41 +01:00
James Almer fe637161db avformat/mov: add support for Immersive Audio Model and Formats in ISOBMFF
Signed-off-by: James Almer <jamrial@gmail.com>
2024-02-20 11:24:19 -03:00
James Almer 9ba327e70f avformat/mov: make MOVStreamContext refcounted
This will be useful in the next commit.

Signed-off-by: James Almer <jamrial@gmail.com>
2024-02-20 11:24:19 -03:00
James Almer ce7b519ab7 avformat/mov: factorize out setting the output packet properties
Signed-off-by: James Almer <jamrial@gmail.com>
2024-02-20 11:24:19 -03:00
Marton Balint f8f2142d61 avformat/mov: factorize reading the main part of the chnl atom to mov_chan
Signed-off-by: Marton Balint <cus@passwd.hu>
2024-02-18 10:54:24 +01:00
Anton Khirnov 1e7d2007c3 all: use designated initializers for AVOption.unit
Makes it robust against adding fields before it, which will be useful in
following commits.

Majority of the patch generated by the following Coccinelle script:

@@
typedef AVOption;
identifier arr_name;
initializer list il;
initializer list[8] il1;
expression tail;
@@
AVOption arr_name[] = { il, { il1,
- tail
+ .unit = tail
}, ...  };

with some manual changes, as the script:
* has trouble with options defined inside macros
* sometimes does not handle options under an #else branch
* sometimes swallows whitespace
2024-02-14 14:53:41 +01:00
Damiano Galassi 112d3618ca avformat/mov: add support for 'amve' ambient viewing environment box
As defined in ISOBMFF (ISO/IEC 14496-12) document.

Co-Authored-By: Cosmin Stejerean <cosmin@cosmin.at>
2024-02-04 13:36:25 -03:00
James Almer b94b3eac0e avformat/mov: use a more descriptive name for variables of type HEIFItem
Other HEIF related structs will be introduced, so lets be more specific about what
this one defines.

Signed-off-by: James Almer <jamrial@gmail.com>
2024-02-03 23:08:42 -03:00
James Almer f6b7b473d4 avformat/mov: ignore item boxes for animated heif
Fixes a regression since d9fed9df2a, where the single animated stream would
be exported twice as two independent streams.

Signed-off-by: James Almer <jamrial@gmail.com>
2024-02-01 11:19:15 -03:00
James Almer 0042cf8980 avformat/mov: split off MOVStreamContext freeing into its own function
Signed-off-by: James Almer <jamrial@gmail.com>
2024-02-01 10:28:57 -03:00
Thomas Siedel aa3155e4c2 avformat/mp4: add muxer support for H266/VVC
Add muxer for vvcc byte stream format.
Add AV_CODEC_ID_VVC to ff_mp4_obj_type.
Add AV_CODEC_ID_VVC to ISO Media codec (VvcConfigurationBox vvi1,
vvc1 defined in ISO/IEC 14496-15:2021).
Add VvcConfigurationBox vvcC which extends FullBox type in
ISO/IEC 14496-15:2021.

Tested with:
    ffmpeg -i NovosobornayaSquare_1920x1080.mp4 -c:v libvvenc test.mp4 && ffmpeg -i test.mp4 -f null -
    ffmpeg -i NovosobornayaSquare_1920x1080.mp4 -c:v copy test.mp4     && ffmpeg -i test.mp4 -f md5 -

Signed-off-by: James Almer <jamrial@gmail.com>
Signed-off-by: Thomas Siedel <thomas.ff@spin-digital.com>
Co-Authored-By: Nuo Mi <nuomi2021@gmail.com>
2024-01-31 22:14:12 +08:00
James Almer eee3b7e2fb avformat/mov: zero initialize the index ranges buffer
Signed-off-by: James Almer <jamrial@gmail.com>
2024-01-23 18:39:52 -03:00
Anton Khirnov 08bebeb1be Revert "all: Don't set AVClass.item_name to its default value"
Some callers assume that item_name is always set, so this may be
considered an API break.

This reverts commit 0c6203c97a.
2024-01-20 10:34:48 +01:00
James Almer be4fcf027b avformat/mov: reset a log message as trace level
Accidentally changed in d9fed9df2a

Signed-off-by: James Almer <jamrial@gmail.com>
2024-01-15 22:17:50 -03:00
James Almer d9fed9df2a avformat/mov: improve HEIF parsing
Parse iprp and iinf boxes and its child boxes to get the actual codec used
(AV1 for avif, HEVC for heic), and properly export extradata and other
properties in a generic way.
The avif tests reference files are updated as the extradata is now exported.

Based on a patch by Swaraj Hota

Co-authored-by: Swaraj Hota <swarajhota353@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
2024-01-15 15:10:15 -03:00
James Almer 0405f71e19 avformat/mov: rename avif fields to heif
They are no longer avif specific.

Signed-off-by: James Almer <jamrial@gmail.com>
2024-01-10 18:26:53 -03:00
Vignesh Venkatasubramanian via ffmpeg-devel a0821345eb avformat/mov: Add support for demuxing still HEIC images
They are similar to AVIF images (both use the HEIF container).
The only additional work needed is to parse the hvcC box and put
it in the extradata.

With this patch applied, ffmpeg (when built with an HEVC decoder)
is able to decode the files in
https://github.com/nokiatech/heif/tree/gh-pages/content/images

Also add a couple of fate tests with samples from
https://github.com/nokiatech/heif_conformance/tree/master/conformance_files

Partially fixes trac ticket #6521.

Signed-off-by: Vignesh Venkatasubramanian <vigneshv@google.com>
Signed-off-by: James Almer <jamrial@gmail.com>
2024-01-09 16:44:14 -03:00
Thomas Guilbert ff451df947
avformat/mov: Fix MSAN issue with stsd_id
Fixes: use of uninitialized value
Fixes: bbb-320x240-2video-2audio.mp4

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-12-29 19:24:17 +01:00
Michael Niedermayer cfc0a68d4d
avformat/mov: do not set sign bit for chunk_offsets
Fixes: signed integer overflow: 2314885530818453536 - -7412889664301817824 cannot be represented in type 'long'
Fixes: 64296/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6304027146846208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2023-12-29 01:00:49 +01:00
Andreas Rheinhardt 0c6203c97a all: Don't set AVClass.item_name to its default value
Unnecessary since acf63d5350adeae551d412db699f8ca03f7e76b9;
also avoids relocations.

Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2023-12-22 15:12:33 +01:00