GitLab

boyuanxiao-argondesign authored Nov 13, 2018 and Ronald S. Bultje committed Nov 15, 2018

A new coded video sequence (see page 193; section 7.5 of the spec)
begins when we see a sequence header that isn't bit identical to
previous ones. This is the point at which we can throw away previous
frames etc.

The number of read bits can be equal to the size of the packet. Fixes a
triggered assert in
clusterfuzz-testcase-minimized-dav1d_fuzzer-5746175664193536. Credits to
oss-fuzz.

This code originally looked like "assert (init_bit_pos % 8 == 0)" and
I changed it to use "& 7" to match the prevaling style. Unfortunately,
"&" binds more weakly than "==". Oops!

Rupert Swarbrick authored Oct 17, 2018 and Ronald S. Bultje committed Nov 14, 2018

This fixes failures when an OBU has more than a byte's worth of
trailing zeros.

As part of this work, it also rejigs the dav1d_flush_get_bits function
slightly. This worked before, but it wasn't very obvious why (it
worked because bits_left was never more than 7). This patch renames it
to dav1d_bytealign_get_bits, which makes it clearer what it does and
adds a comment explaining why it works properly.

The new dav1d_bytealign_get_bits is also now void (rather than
returning the next byte to read). The patch defines
dav1d_get_bits_pos, which returns the current bit position. This feels
a little easier to reason about.

We also add a new check to make sure that we haven't fallen off the
end of the OBU. This can happen when a byte buffer contains more than
one OBU: the GetBits might not have got to EOF, but we might now be
half-way through the next OBU.

Rupert Swarbrick authored Oct 17, 2018 and Ronald S. Bultje committed Nov 14, 2018

See section 5.9.12 of the AV1 spec. The flag controlling U and V share
a quantization level wasn't being read.

boyuanxiao-argondesign authored Oct 15, 2018 and Ronald S. Bultje committed Nov 14, 2018

The first memset is dead code: if primary_ref_frame is
PRIMARY_REF_NONE then segmentation.update_data is always true. The
patch removes this memset and explains why the copy in the other
branch is correct.

The second memset should always fire: if segmentation is not enabled
for this frame, the seg_data structure should be set to zero rather
than copied from a reference frame (see section 5.9.14 of the AV1
spec).

Fixes decoding of keyframe in #121.

Take the maximal number of tile rows and columns (each 64) into account.
Reduces size of Av1FrameHeader from 9588 to 1648 bytes on x86_64
according to pahole.
Refs #156.

Also clear refpoc[] for intrabc frames. Fixes #146.

This changes sequence header parsing so that we no longer reset
c->have_seq_hdr to 0 if parsing of the most recent sequence header
failed. Rather, we will just continue with the old sequence header
and test any future sequence headers against this. This may help
error resilience in streams that periodically re-send their sequence
header.

Fixes #134.

This reverts commit aeb5a5ef.

Partially reverts b7d2b7d2, fixing a regression
introduced by it.

Signed-off-by: James Almer <jamrial@gmail.com>

Fixes a regression since d8996b18, where
the relevant fields started being written to and read from the wrong struct.

Ronald S. Bultje authored Oct 28, 2018 and Janne Grunau committed Oct 28, 2018

Fixes #123.

Prevent decoding a frame with inconsistent sequence and frame headers.
Fix #124, #125. Fix negative size param in pixel_copy due to inconsistent
sb128 state between frame header (parsed with sb128 == 0) and sequence
header and frame decoding with sb128 == 1. Fix
clusterfuzz-testcase-minimized-dav1d_fuzzer-5707479116152832. Credits to
oss-fuzz.

Parse and use it instead.
Signed-off-by: James Almer <jamrial@gmail.com>

This is more in line with the behavior from libaom.
Signed-off-by: James Almer <jamrial@gmail.com>

Ronald S. Bultje authored Oct 24, 2018 and Janne Grunau committed Oct 24, 2018

This is identical to what libaom does for such OBUs. It prevents us
from doing block decoding, which doesn't make sense for such OBUs,
and would result in using an uninitialized frame header during the
decoding process. Fixes #94.

Ronald S. Bultje authored Oct 24, 2018 and Janne Grunau committed Oct 24, 2018

Fixes #89.

Working only for the first Operating Point for now.

Calling get_uniform(max=1) results in a read_bits(n=0),
In get_uniform, the n param is renamed to max to clarify the
semantics. Asserts are added to detect calls to get_uniform()
and get_bits() that don't actually read anything.

Closes #76

Ronald S. Bultje authored Oct 23, 2018 and Jean-Baptiste Kempf committed Oct 23, 2018

This is identical to what libaom does. Fixes #65.

Janne Grunau authored Oct 18, 2018 and Ronald S. Bultje committed Oct 20, 2018

The simplified versions catches tg_start != 0 for the first tile group
too. Fixes a heap-buffer-overflow in setup_tile when the first tile index is
larger than 0 but the number of tiles is correct. Fixes #61, #73.

Janne Grunau authored Oct 17, 2018 and Ronald S. Bultje committed Oct 18, 2018

Fix following ubsan error in #68:
../src/env.h:296:24: runtime error: shift exponent -1 is negative
[Detaching after fork from child process 22253]
    #0 0x7ffff76ad6f9 in get_poc_diff /home/janne/src/dav1d/build-usan/../src/env.h:296:24
    #1 0x7ffff76ad6f9 in parse_frame_hdr /home/janne/src/dav1d/build-usan/../src/obu.c:757
    #2 0x7ffff7696491 in dav1d_parse_obus /home/janne/src/dav1d/build-usan/../src/obu.c:1023:20
    #3 0x7ffff7921c7d in dav1d_decode /home/janne/src/dav1d/build-usan/../src/lib.c:193:20
    #4 0x424869 in main /home/janne/src/dav1d/build-usan/../tools/dav1d.c:108:20
    #5 0x7ffff63dfae6 in __libc_start_main (/lib64/libc.so.6+0x21ae6)
    #6 0x403489 in _start (/home/janne/src/dav1d/build-usan/tools/dav1d+0x403489)

I can't reproduce the ubsan error in the issue.

Janne Grunau authored Oct 17, 2018 and Ronald S. Bultje committed Oct 18, 2018

Reject out of range values as errors and avoid undefined shifts. Fixes #67.

Janne Grunau authored Oct 11, 2018 and Jean-Baptiste Kempf committed Oct 13, 2018

Makes the tile parsing code simpler. Fixes a heap buffer overflow with
clusterfuzz-testcase-minimized-dav1d_fuzzer-5726018392817664. Credit to
oss-fuzz.

Seen with clusterfuzz-testcase-minimized-dav1d_fuzzer-5749222154960896,
Credit to OSS-Fuzz.

Fixes #48.

Avoids a triggered assert with
david-fuzzing-data:artifacts/crash-f448caf378e250b7eea4fa2d1c3cd7ef4a3211ce.

Signed-off-by: James Almer <jamrial@gmail.com>

Fixes parsing of some error_resilient_mode files.

skal authored Oct 02, 2018 and Ronald S. Bultje committed Oct 05, 2018

"comparison between signed and unsigned integer expressions"

Replaces an assert with a check and return error. Fixes an assert fail
with crash-ea35702b18cd8c17da7505126eb0e6aa6914f09d.

Fixes a fuzzing crash with crash-96e2d10fd8effbbcb0c8eedcbe05de50b1582fd2.