From patchwork Thu May 28 16:20:55 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 19935 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 30ABD44B3CF for ; Thu, 28 May 2020 19:22:04 +0300 (EEST) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 081D668AB6F; Thu, 28 May 2020 19:22:04 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-dmta-pe03-2.mx.upcmail.net (vie01a-dmta-pe03-2.mx.upcmail.net [62.179.121.161]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 7D1D368AB6F for ; Thu, 28 May 2020 19:21:57 +0300 (EEST) Received: from [172.31.216.235] (helo=vie01a-pemc-psmtp-pe12.mail.upcmail.net) by vie01a-dmta-pe03.mx.upcmail.net with esmtp (Exim 4.92) (envelope-from ) id 1jeLI5-0005yk-0G for ffmpeg-devel@ffmpeg.org; Thu, 28 May 2020 18:21:57 +0200 Received: from localhost ([213.47.68.29]) by vie01a-pemc-psmtp-pe12.mail.upcmail.net with ESMTP id eLH6jbjwg6Jy6eLH6jQMRr; Thu, 28 May 2020 18:20:56 +0200 X-Env-Mailfrom: michael@niedermayer.cc X-Env-Rcptto: ffmpeg-devel@ffmpeg.org X-SourceIP: 213.47.68.29 X-CNFS-Analysis: v=2.3 cv=GKl27dFK c=1 sm=1 tr=0 a=2hcxjKEKjp0CzLx6oWAm4g==:117 a=2hcxjKEKjp0CzLx6oWAm4g==:17 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=GEAsPZ9sns4A:10 a=ZZnuYtJkoWoA:10 a=q9P2uie-bs7P-zRsTsEA:9 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Thu, 28 May 2020 18:20:55 +0200 Message-Id: <20200528162056.23537-1-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 X-CMAE-Envelope: MS4wfKr41OdJkBv0uTLwdzz9gPHemg8n/sPcyVdoBJoycTJDWo3jBZinhXrdBYXXNHbsGAQ8urIUU3qRfyTs4f8VXTeBJOIcYj8qBENWrGcY5NTRwAuTjL1U szTCa4tgpJ11VgnySYqdC9dy19lR3bDwDHwMnZupnHOyAO8/sfRGPp7n Subject: [FFmpeg-devel] [PATCH 1/2] avcodec: Add AV_CODEC_FLAG2_FAST_UNSAFE, move unsafe uses of FAST to it X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" TODO: Bump Signed-off-by: Michael Niedermayer --- doc/APIchanges | 3 +++ doc/codecs.texi | 2 ++ libavcodec/avcodec.h | 6 ++++++ libavcodec/h264dec.c | 2 +- libavcodec/options_table.h | 1 + tools/target_dec_fuzzer.c | 2 +- 6 files changed, 14 insertions(+), 2 deletions(-) diff --git a/doc/APIchanges b/doc/APIchanges index fb5534b5f5..3e20a44379 100644 --- a/doc/APIchanges +++ b/doc/APIchanges @@ -15,6 +15,9 @@ libavutil: 2017-10-21 API changes, most recent first: +2020-xx-xx - xxxxxxxxxx - lavc 58.xx.100 - avcodec.h + Add AV_CODEC_FLAG2_FAST_UNSAFE + 2020-xx-xx - xxxxxxxxxx - lavc 58.88.100 - avcodec.h codec.h Move AVCodec-related public API to new header codec.h. diff --git a/doc/codecs.texi b/doc/codecs.texi index c092aadc0e..46790b66b3 100644 --- a/doc/codecs.texi +++ b/doc/codecs.texi @@ -787,6 +787,8 @@ Possible values: @table @samp @item fast Allow non spec compliant speedup tricks. +@item fast_unsafe +Allow speedup tricks which can lead to out of array reads and crashes on damaged or crafted files. @item noout Skip bitstream encoding. @item ignorecrop diff --git a/libavcodec/avcodec.h b/libavcodec/avcodec.h index 01099bc8cd..479f219b43 100644 --- a/libavcodec/avcodec.h +++ b/libavcodec/avcodec.h @@ -346,6 +346,12 @@ typedef struct RcOverride{ * Allow non spec compliant speedup tricks. */ #define AV_CODEC_FLAG2_FAST (1 << 0) + +/** + * Allow speedups tricks which can read out of array on non compliant streams. + */ +#define AV_CODEC_FLAG2_FAST_UNSAFE (1 << 1) + /** * Skip bitstream encoding. */ diff --git a/libavcodec/h264dec.c b/libavcodec/h264dec.c index e463fde2a5..b764caa942 100644 --- a/libavcodec/h264dec.c +++ b/libavcodec/h264dec.c @@ -603,7 +603,7 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size) } ret = ff_h2645_packet_split(&h->pkt, buf, buf_size, avctx, h->is_avc, h->nal_length_size, - avctx->codec_id, avctx->flags2 & AV_CODEC_FLAG2_FAST, 0); + avctx->codec_id, avctx->flags2 & AV_CODEC_FLAG2_FAST_UNSAFE, 0); if (ret < 0) { av_log(avctx, AV_LOG_ERROR, "Error splitting the input into NAL units.\n"); diff --git a/libavcodec/options_table.h b/libavcodec/options_table.h index 8ba137f51e..4e26b844f6 100644 --- a/libavcodec/options_table.h +++ b/libavcodec/options_table.h @@ -71,6 +71,7 @@ static const AVOption avcodec_options[] = { {"drop_changed", "Drop frames whose parameters differ from first decoded frame", 0, AV_OPT_TYPE_CONST, {.i64 = AV_CODEC_FLAG_DROPCHANGED }, INT_MIN, INT_MAX, A|V|D, "flags"}, {"flags2", NULL, OFFSET(flags2), AV_OPT_TYPE_FLAGS, {.i64 = DEFAULT}, 0, UINT_MAX, V|A|E|D|S, "flags2"}, {"fast", "allow non-spec-compliant speedup tricks", 0, AV_OPT_TYPE_CONST, {.i64 = AV_CODEC_FLAG2_FAST }, INT_MIN, INT_MAX, V|E, "flags2"}, +{"fast_unsafe", "allow speedup tricks which can read out of arrays", 0, AV_OPT_TYPE_CONST, {.i64 = AV_CODEC_FLAG2_FAST_UNSAFE }, INT_MIN, INT_MAX, V|E, "flags2"}, {"noout", "skip bitstream encoding", 0, AV_OPT_TYPE_CONST, {.i64 = AV_CODEC_FLAG2_NO_OUTPUT }, INT_MIN, INT_MAX, V|E, "flags2"}, {"ignorecrop", "ignore cropping information from sps", 0, AV_OPT_TYPE_CONST, {.i64 = AV_CODEC_FLAG2_IGNORE_CROP }, INT_MIN, INT_MAX, V|D, "flags2"}, {"local_header", "place global headers at every keyframe instead of in extradata", 0, AV_OPT_TYPE_CONST, {.i64 = AV_CODEC_FLAG2_LOCAL_HEADER }, INT_MIN, INT_MAX, V|E, "flags2"}, diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c index d01deaf8d5..414cdab593 100644 --- a/tools/target_dec_fuzzer.c +++ b/tools/target_dec_fuzzer.c @@ -208,7 +208,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { if (flags & 8) ctx->err_recognition |= AV_EF_EXPLODE; } - if ((flags & 0x10) && c->id != AV_CODEC_ID_H264) + if (flags & 0x10) ctx->flags2 |= AV_CODEC_FLAG2_FAST; if (flags & 0x40)