From 0b55d67e02077adb3ddeaec687787e7dffab55b4 Mon Sep 17 00:00:00 2001 From: James Zern Date: Thu, 27 Apr 2023 12:10:19 -0700 Subject: update METADATA this was missed in: 0f47219b9f Merge commit 'v1.13.0' into m/master the date is from that commit. Test: N/A (cherry picked from https://android-review.googlesource.com/q/commit:4024ada0e78d8c602ea2198c9991d35723a7735d) Merged-In: I5e2b54d1adbcd8f05dc44792a0616d4f14d32955 Change-Id: I5e2b54d1adbcd8f05dc44792a0616d4f14d32955 --- METADATA | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/METADATA b/METADATA index 7070cddda..67f44168d 100644 --- a/METADATA +++ b/METADATA @@ -6,14 +6,14 @@ third_party { type: GIT value: "https://chromium.googlesource.com/webm/libvpx" } - version: "v1.12.0" + version: "v1.13.0" license_type: NOTICE security { tag: "NVD-CPE2.3:cpe:/a:webmproject:libvpx:-" } last_upgrade_date { - year: 2022 - month: 11 - day: 15 + year: 2023 + month: 2 + day: 10 } } -- cgit v1.2.3 From 51653b1d7344c2d830ae206690ab8f9db01c0cb5 Mon Sep 17 00:00:00 2001 From: James Zern Date: Tue, 3 Oct 2023 17:46:51 -0700 Subject: Merge tag 'v1.13.1' into aosp/main libvpx 1.13.1 2023-09-29 v1.13.1 "Ugly Duckling" This release contains two security related fixes. One each for VP8 and VP9. - Upgrading: This release is ABI compatible with the previous release. - Bug fixes: https://crbug.com/1486441 (CVE-2023-5217) Fix to a crash related to VP9 encoding (#1642) * tag 'v1.13.1': update CHANGELOG update version to 1.13.1 Fix bug with smaller width bigger size vp9_alloccommon: clear allocation sizes on free VP8: disallow thread count changes encode_api_test: add ConfigResizeChangeThreadCount README: update release version to 1.13.0 Bug: 302695759, https://crbug.com/webm/1818 Test: presubmit (cherry picked from https://android-review.googlesource.com/q/commit:3d5b29ccb9e64dec8cb2ac53b9150b23b9d81eec) Merged-In: I2c47fd337332b3cff819a5931239f2e1f2e838e4 Change-Id: I2c47fd337332b3cff819a5931239f2e1f2e838e4 --- CHANGELOG | 10 ++++++++++ METADATA | 6 +++--- README | 2 +- README.android | 8 ++++---- README.version | 2 +- libs.mk | 2 +- test/encode_api_test.cc | 46 +++++++++++++++++++++++++++++++++++++++++++- test/resize_test.cc | 11 +++-------- vp8/encoder/onyx_if.c | 5 +++++ vp9/common/vp9_alloccommon.c | 15 ++++++++------- vp9/encoder/vp9_encoder.c | 27 ++++++++++++++++++++++++-- 11 files changed, 106 insertions(+), 28 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 3fb2d19bb..f932f6bf4 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,3 +1,13 @@ +2023-09-29 v1.13.1 "Ugly Duckling" + This release contains two security related fixes. One each for VP8 and VP9. + + - Upgrading: + This release is ABI compatible with the previous release. + + - Bug fixes: + https://crbug.com/1486441 (CVE-2023-5217) + Fix to a crash related to VP9 encoding (#1642) + 2023-01-31 v1.13.0 "Ugly Duckling" This release includes more Neon and AVX2 optimizations, adds a new codec control to set per frame QP, upgrades GoogleTest to v1.12.1, and includes diff --git a/METADATA b/METADATA index 67f44168d..a0b8c20da 100644 --- a/METADATA +++ b/METADATA @@ -6,14 +6,14 @@ third_party { type: GIT value: "https://chromium.googlesource.com/webm/libvpx" } - version: "v1.13.0" + version: "v1.13.1" license_type: NOTICE security { tag: "NVD-CPE2.3:cpe:/a:webmproject:libvpx:-" } last_upgrade_date { year: 2023 - month: 2 - day: 10 + month: 10 + day: 3 } } diff --git a/README b/README index 477a145ba..444289a23 100644 --- a/README +++ b/README @@ -1,4 +1,4 @@ -v1.12.0 Torrent Duck +v1.13.1 Ugly Duckling Welcome to the WebM VP8/VP9 Codec SDK! diff --git a/README.android b/README.android index bbcf66cba..c67aa18ab 100644 --- a/README.android +++ b/README.android @@ -1,12 +1,12 @@ Name: libvpx URL: http://www.webmproject.org -Version: v1.13.0 +Version: v1.13.1 License: BSD License File: libvpx/LICENSE -Date: Friday February 10 2023 -Branch: v1.13.0 -Commit: d6eb9696aa72473c1a11d34d928d35a3acc0c9a9 +Date: Tuesday October 03 2023 +Branch: ugly-duckling +Commit: 10b9492dcf05b652e2e4b370e205bd605d421972 Description: Contains the sources used to compile libvpx. diff --git a/README.version b/README.version index 9858b39c9..8e5eaa236 100644 --- a/README.version +++ b/README.version @@ -1,5 +1,5 @@ URL: https://chromium.googlesource.com/webm/libvpx/ -Version: v1.13.0 +Version: v1.13.1 BugComponent: 42195 Owners: jzern, jianj Local Modifications: diff --git a/libs.mk b/libs.mk index 1f7f03aa3..13d878901 100644 --- a/libs.mk +++ b/libs.mk @@ -314,7 +314,7 @@ $(BUILD_PFX)libvpx_g.a: $(LIBVPX_OBJS) # (c1, a1, r1) and set MAJOR to [c1-a1], MINOR to a1 and PATCH to r1 SO_VERSION_MAJOR := 8 SO_VERSION_MINOR := 0 -SO_VERSION_PATCH := 0 +SO_VERSION_PATCH := 1 ifeq ($(filter darwin%,$(TGT_OS)),$(TGT_OS)) LIBVPX_SO := libvpx.$(SO_VERSION_MAJOR).dylib SHARED_LIB_SUF := .dylib diff --git a/test/encode_api_test.cc b/test/encode_api_test.cc index ecdf92834..e0e793b15 100644 --- a/test/encode_api_test.cc +++ b/test/encode_api_test.cc @@ -304,7 +304,6 @@ TEST(EncodeAPI, SetRoi) { void InitCodec(const vpx_codec_iface_t &iface, int width, int height, vpx_codec_ctx_t *enc, vpx_codec_enc_cfg_t *cfg) { - ASSERT_EQ(vpx_codec_enc_config_default(&iface, cfg, 0), VPX_CODEC_OK); cfg->g_w = width; cfg->g_h = height; cfg->g_lag_in_frames = 0; @@ -342,6 +341,7 @@ TEST(EncodeAPI, ConfigChangeThreadCount) { vpx_codec_ctx_t ctx = {}; } enc; + ASSERT_EQ(vpx_codec_enc_config_default(iface, &cfg, 0), VPX_CODEC_OK); EXPECT_NO_FATAL_FAILURE( InitCodec(*iface, kWidth, kHeight, &enc.ctx, &cfg)); if (IsVP9(iface)) { @@ -360,4 +360,48 @@ TEST(EncodeAPI, ConfigChangeThreadCount) { } } +TEST(EncodeAPI, ConfigResizeChangeThreadCount) { + constexpr int kInitWidth = 1024; + constexpr int kInitHeight = 1024; + + for (const auto *iface : kCodecIfaces) { + SCOPED_TRACE(vpx_codec_iface_name(iface)); + for (int i = 0; i < (IsVP9(iface) ? 2 : 1); ++i) { + vpx_codec_enc_cfg_t cfg = {}; + struct Encoder { + ~Encoder() { EXPECT_EQ(vpx_codec_destroy(&ctx), VPX_CODEC_OK); } + vpx_codec_ctx_t ctx = {}; + } enc; + + ASSERT_EQ(vpx_codec_enc_config_default(iface, &cfg, 0), VPX_CODEC_OK); + // Start in threaded mode to ensure resolution and thread related + // allocations are updated correctly across changes in resolution and + // thread counts. See https://crbug.com/1486441. + cfg.g_threads = 4; + EXPECT_NO_FATAL_FAILURE( + InitCodec(*iface, kInitWidth, kInitHeight, &enc.ctx, &cfg)); + if (IsVP9(iface)) { + EXPECT_EQ(vpx_codec_control_(&enc.ctx, VP9E_SET_TILE_COLUMNS, 6), + VPX_CODEC_OK); + EXPECT_EQ(vpx_codec_control_(&enc.ctx, VP9E_SET_ROW_MT, i), + VPX_CODEC_OK); + } + + cfg.g_w = 1000; + cfg.g_h = 608; + EXPECT_EQ(vpx_codec_enc_config_set(&enc.ctx, &cfg), VPX_CODEC_OK) + << vpx_codec_error_detail(&enc.ctx); + + cfg.g_w = 16; + cfg.g_h = 720; + + for (const auto threads : { 1, 4, 8, 6, 2, 1 }) { + cfg.g_threads = threads; + EXPECT_NO_FATAL_FAILURE(EncodeWithConfig(cfg, &enc.ctx)) + << "iteration: " << i << " threads: " << threads; + } + } + } +} + } // namespace diff --git a/test/resize_test.cc b/test/resize_test.cc index 715bb9d70..d9420a454 100644 --- a/test/resize_test.cc +++ b/test/resize_test.cc @@ -102,11 +102,8 @@ void ScaleForFrameNumber(unsigned int frame, unsigned int initial_w, if (frame < 30) { return; } - if (frame < 100) { - *w = initial_w * 7 / 10; - *h = initial_h * 16 / 10; - return; - } + *w = initial_w * 7 / 10; + *h = initial_h * 16 / 10; return; } if (frame < 10) { @@ -559,9 +556,7 @@ TEST_P(ResizeRealtimeTest, TestExternalResizeWorks) { } } -// TODO(https://crbug.com/webm/1642): This causes a segfault in -// init_encode_frame_mb_context(). -TEST_P(ResizeRealtimeTest, DISABLED_TestExternalResizeSmallerWidthBiggerSize) { +TEST_P(ResizeRealtimeTest, TestExternalResizeSmallerWidthBiggerSize) { ResizingVideoSource video; video.flag_codec_ = true; video.smaller_width_larger_size_ = true; diff --git a/vp8/encoder/onyx_if.c b/vp8/encoder/onyx_if.c index 4bbeadef0..148a16cc4 100644 --- a/vp8/encoder/onyx_if.c +++ b/vp8/encoder/onyx_if.c @@ -1443,6 +1443,11 @@ void vp8_change_config(VP8_COMP *cpi, VP8_CONFIG *oxcf) { last_h = cpi->oxcf.Height; prev_number_of_layers = cpi->oxcf.number_of_layers; + if (cpi->initial_width) { + // TODO(https://crbug.com/1486441): Allow changing thread counts; the + // allocation is done once in vp8_create_compressor(). + oxcf->multi_threaded = cpi->oxcf.multi_threaded; + } cpi->oxcf = *oxcf; switch (cpi->oxcf.Mode) { diff --git a/vp9/common/vp9_alloccommon.c b/vp9/common/vp9_alloccommon.c index faad657a0..9e73e40ea 100644 --- a/vp9/common/vp9_alloccommon.c +++ b/vp9/common/vp9_alloccommon.c @@ -65,6 +65,7 @@ static void free_seg_map(VP9_COMMON *cm) { vpx_free(cm->seg_map_array[i]); cm->seg_map_array[i] = NULL; } + cm->seg_map_alloc_size = 0; cm->current_frame_seg_map = NULL; cm->last_frame_seg_map = NULL; @@ -108,6 +109,7 @@ void vp9_free_context_buffers(VP9_COMMON *cm) { cm->above_context = NULL; vpx_free(cm->above_seg_context); cm->above_seg_context = NULL; + cm->above_context_alloc_cols = 0; vpx_free(cm->lf.lfm); cm->lf.lfm = NULL; } @@ -133,13 +135,6 @@ int vp9_alloc_context_buffers(VP9_COMMON *cm, int width, int height) { cm->free_mi(cm); if (cm->alloc_mi(cm, new_mi_size)) goto fail; } - - if (cm->seg_map_alloc_size < cm->mi_rows * cm->mi_cols) { - // Create the segmentation map structure and set to 0. - free_seg_map(cm); - if (alloc_seg_map(cm, cm->mi_rows * cm->mi_cols)) goto fail; - } - if (cm->above_context_alloc_cols < cm->mi_cols) { vpx_free(cm->above_context); cm->above_context = (ENTROPY_CONTEXT *)vpx_calloc( @@ -154,6 +149,12 @@ int vp9_alloc_context_buffers(VP9_COMMON *cm, int width, int height) { cm->above_context_alloc_cols = cm->mi_cols; } + if (cm->seg_map_alloc_size < cm->mi_rows * cm->mi_cols) { + // Create the segmentation map structure and set to 0. + free_seg_map(cm); + if (alloc_seg_map(cm, cm->mi_rows * cm->mi_cols)) goto fail; + } + if (vp9_alloc_loop_filter(cm)) goto fail; return 0; diff --git a/vp9/encoder/vp9_encoder.c b/vp9/encoder/vp9_encoder.c index b66fdc0bc..e38507754 100644 --- a/vp9/encoder/vp9_encoder.c +++ b/vp9/encoder/vp9_encoder.c @@ -1973,6 +1973,17 @@ static void alloc_copy_partition_data(VP9_COMP *cpi) { } } +static void free_copy_partition_data(VP9_COMP *cpi) { + vpx_free(cpi->prev_partition); + cpi->prev_partition = NULL; + vpx_free(cpi->prev_segment_id); + cpi->prev_segment_id = NULL; + vpx_free(cpi->prev_variance_low); + cpi->prev_variance_low = NULL; + vpx_free(cpi->copied_frame_cnt); + cpi->copied_frame_cnt = NULL; +} + void vp9_change_config(struct VP9_COMP *cpi, const VP9EncoderConfig *oxcf) { VP9_COMMON *const cm = &cpi->common; RATE_CONTROL *const rc = &cpi->rc; @@ -2052,6 +2063,8 @@ void vp9_change_config(struct VP9_COMP *cpi, const VP9EncoderConfig *oxcf) { new_mi_size = cm->mi_stride * calc_mi_size(cm->mi_rows); if (cm->mi_alloc_size < new_mi_size) { vp9_free_context_buffers(cm); + vp9_free_pc_tree(&cpi->td); + vpx_free(cpi->mbmi_ext_base); alloc_compressor_data(cpi); realloc_segmentation_maps(cpi); cpi->initial_width = cpi->initial_height = 0; @@ -2070,8 +2083,18 @@ void vp9_change_config(struct VP9_COMP *cpi, const VP9EncoderConfig *oxcf) { update_frame_size(cpi); if (last_w != cpi->oxcf.width || last_h != cpi->oxcf.height) { - memset(cpi->consec_zero_mv, 0, - cm->mi_rows * cm->mi_cols * sizeof(*cpi->consec_zero_mv)); + vpx_free(cpi->consec_zero_mv); + CHECK_MEM_ERROR( + cm, cpi->consec_zero_mv, + vpx_calloc(cm->mi_rows * cm->mi_cols, sizeof(*cpi->consec_zero_mv))); + + vpx_free(cpi->skin_map); + CHECK_MEM_ERROR( + cm, cpi->skin_map, + vpx_calloc(cm->mi_rows * cm->mi_cols, sizeof(cpi->skin_map[0]))); + + free_copy_partition_data(cpi); + alloc_copy_partition_data(cpi); if (cpi->oxcf.aq_mode == CYCLIC_REFRESH_AQ) vp9_cyclic_refresh_reset_resize(cpi); rc->rc_1_frame = 0; -- cgit v1.2.3