Michael Niedermayer
8108273941
avformat/realtextdec: Check for duplicate extradata in realtext_read_header()
...
Fixes: memleak
Fixes: 16140/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5684008052064256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 652ea23cb3michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
7431c6224b
avformat/mpc: deallocate frames array on errors
...
Fixes: memleak on error path
Fixes: 15984/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5679918412726272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit da5039415cmichael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Matt Wolenetz
b68589b40a
lafv/wavdec: Fail bext parsing on incomplete reads
...
avio_read can successfully return even when less than the requested
amount of input was read. wavdec's bext parsing mistakenly assumed a
successful avio_read always read the full amount that was requested.
The result could be dictionary tags populated with partially
uninitialized values.
This change also fixes a broken assertion in wav_parse_bext_string that
was off-by-one, though no known current usage of that method hits that
broken case.
Chromium bug: 987270
Signed-off-by: Matt Wolenetz <wolenetz@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 052d41377amichael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
b60455c715
avformat/utils: Check rfps_duration_sum for overflow
...
Fixes: signed integer overflow: 9151595917793558550 + 297519050751678697 cannot be represented in type 'long'
Fixes: 15496/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5722866475073536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c46fdf305michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
24ed399e57
avformat/xmv: Make bitrate 64bit
...
Fixes: signed integer overflow: 32 * 538976288 cannot be represented in type 'int'
Fixes: 15633/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5752273981931520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 39a6a79bcbmichael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Cameron Cawley
7c1b403365
avformat/rpl: Replace strcpy with av_strlcpy
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 94d45a13c7michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
James Almer
3ecbb180ef
aformat/movenc: add missing padding to output track extradata
...
Fixes ticket #8183 .
Tested-by: Thierry Foucu <tfoucu@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 58aa0ed8f1
2019-09-27 22:22:01 -03:00
Carl Eugen Hoyos
60094fc2f5
lavf/rawenc: Only accept the appropriate stream type for raw muxers.
...
This does not affect the rawvideo muxer.
Fixes ticket #7979 .
(cherry picked from commit aef24efb0c
2019-09-06 16:26:57 -03:00
James Almer
a21a9c7863
avformat/aacdec: resync to the next adts frame on invalid data instead of aborting
...
Should fix ticket #6634
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 881e1f5a62
2019-07-21 01:06:29 -03:00
James Almer
1fbe0286e4
avformat/aacdec: factorize the adts frame resync code
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit a38eab8b75
2019-07-21 01:06:20 -03:00
Michael Niedermayer
a1416c6c8d
avformat/utils: Check timebase before use in estimate_timings()
...
Fixes: division by 0
Fixes: 15480/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5746727434321920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f57e97dfd9michael@niedermayer.cc >
2019-07-08 11:51:59 +02:00
Michael Niedermayer
7d075c5f33
avformat/aviobuf: Delay buffer downsizing until asserts are met
...
Fixes: Assertion failure
Fixes: 15151/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5757079496687616
Fixes: 15205/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5767573242642432
May fix: Ticket7094
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0334632d5cmichael@niedermayer.cc >
2019-06-30 18:48:42 +02:00
Michael Niedermayer
5b8bce805c
avformat/vqf: Check header_size
...
Fixes: 15271/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5735262606327808
Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7c30ff3888michael@niedermayer.cc >
2019-06-29 20:32:14 +02:00
Michael Niedermayer
65e1440140
avformat/mov: Set fragment.found_tfhd only after TFHD has been parsed
...
Fixes: Assertion failure
Fixes: crbug971646.mp4
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 696312c487michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
45d3ba9e5f
avformat/icodec: Free ico->images on error paths
...
Fixes: 15116/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5715173567889408
Fixes: memleak
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 54918b5116michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
0789b6295b
avformat/wsddec: Fix undefined shift
...
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 15123/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5738039235575808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 112eb17a2bmichael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
f487aa964b
avformat/wtvdec: Avoid (32bit signed) sectors
...
Fixes: left shift of negative value -14614752
Fixes: 15174/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5670543606415360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dd357d76e5michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
837e9e8898
avformat/sbgdec: Fixes integer overflow in str_to_time() with hours
...
Fixes: signed integer overflow: 904444 * 3600 cannot be represented in type 'int'
Fixes: 15113/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5764083346833408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2a0f23b9d6michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
e73ef454e8
avformat/vpk: Check offset for validity
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa003019abmichael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
a2ebfb6afe
avformat/vpk: Fix integer overflow in samples_per_block computation
...
Fixes: signed integer overflow: 84026453 * 28 cannot be represented in type 'int'
Fixes: 15111/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5675630072430592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c6c4129b4michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
3760f17e9b
avformat/mp3enc: Avoid SEEK_END as it is unsupported
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf3ee6a130michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
75501f90fd
avformat/webm_chunk: Specify expected argument length of get_chunk_filename()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1a74b04737michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
fd05665f9c
avformat/webm_chunk: Check header filename length
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3b5b977c9fmichael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Andreas Rheinhardt
85578838cb
lavf/webm_chunk: Respect buffer size
...
The last argument of av_strlcpy is supposed to contain the size of the
destination buffer, but it was filled with the size of the source
string, effectively negating its very purpose.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73ef1f47f5michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
05a90821d0
avformat/mov: Skip stsd adjustment without chunks
...
Fixes: Assertion failure
Fixes: clusterfuzz-testcase-minimized-media_pipeline_integration_fuzzer-5683096400822272
Found-by: Clusterfuzz
Reported-by: Dan Sanders <sandersd@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 18a567c369michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
9b4004c054
avformat/aadec: Check for scanf() failure
...
Fixes: use of uninitialized variables
Fixes: blank.aa
Found-by: Chamal De Silva <chamal.desilva@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ed188f6dcdmichael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
James Almer
7211e1ca93
avformat/aacdec: fix demuxing of small frames
...
10 bytes (id3v2 header amount of bytes) were being read before any checks
were made on the bitstream. The result was that we were overreading into
the next frame if the current one was 8 or 9 bytes long.
Fixes tickets #7271 and #7869 .
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit d88193c219
2019-05-06 13:53:39 -03:00
Tristan Matthews
cf7a5c655c
avformat/matroskaenc: fix leak on error
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 1ec777dcdd
2019-04-09 12:10:36 -03:00
Jeremy Dorfman
420fe39aff
avformat/av1: Initialize padding in ff_isom_write_av1c
...
Otherwise, AV1 encodes with FFmpeg trigger use-of-uninitialized-value
warnings under MemorySanitizer, and the output buffer potentially
changes from run to run.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit bb5efd1727
2019-04-09 12:08:30 -03:00
James Almer
58cd70201e
avformat/movenc: free eac3 private data only when closing the stream
...
This makes sure the data is available when writing the moov atom during the
second pass triggered by the faststart movflag.
Fixes ticket #7780
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 27c94c57dc
2019-03-31 20:36:41 -03:00
Michael Niedermayer
ad0f4a7d10
avformat/mov: Fix potential integer overflow in entry check in mov_read_trun()
...
No testcase
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ff13a92a6fmichael@niedermayer.cc >
2019-03-31 23:30:09 +02:00
Michael Niedermayer
5d208aac52
avformat/gdv: Check fps
...
Fixes: Division by 0
Fixes: ffmpeg_zero_division.bin
Found-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38381400fcmichael@niedermayer.cc >
2019-03-14 16:53:57 +01:00
Michael Niedermayer
339f40f618
avformat/webmdashenc: Check id in adaption_sets
...
Fixes: out of array access
Found-by: Wenxiang Qian
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b687b549aamichael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Wenxiang Qian
ec22b46a4d
avformat/http: Fix Out-of-Bounds access in process_line()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 85f91ed760michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Wenxiang Qian
11375cd101
avformat/ftp: Fix Out-of-Bounds Access and Information Leak in ftp.c:393
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a142ffdcaemichael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Michael Niedermayer
4d1fcd734e
avformat/matroskadec: Do not leak queued packets on sync errors
...
Fixes: memleak
Fixes: clusterfuzz-testcase-minimized-audio_decoder_fuzzer-5649187601121280
Reported-by: Chris Cunningham <chcunningham@google.com >
Tested-by: Chris Cunningham <chcunningham@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d1afa7284cmichael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Michael Niedermayer
d25f388584
avformat/mov: Do not use reference stream in mov_read_sidx() if there is no reference stream
...
Fixes: NULL pointer dereference
Fixes: clusterfuzz-testcase-minimized-audio_decoder_fuzzer-5634316373721088
Reported-by: Chris Cunningham <chcunningham@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b0d8b7cb8emichael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Charles Liu
53f3f5233f
avformat/mov: fix hang while seek on a kind of fragmented mp4
...
Binary searching would hang if the fragment items do NOT have timestamp for the
specified stream.
For example, a fmp4 consists of separated 'moof' boxes for each track, and
separated 'sidx' for each segment, but no 'mfra' box. Then every fragment item
only have the timestamp for one of its tracks.
Example:
ffmpeg -f lavfi -i testsrc -f lavfi -i sine -movflags dash+frag_keyframe+skip_trailer+separate_moof -t 1 out.mp4
ffmpeg -ss 0.5 -i out.mp4 -f null none
Also fixes the hang in ticket #7572 , but not the reason for having
AV_NOPTS_VALUE timestamps there.
Signed-off-by: Charles Liu <liuchh83@gmail.com >
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit aa25198f1b
2019-02-11 22:07:54 +01:00
Marton Balint
110eff79ca
avformat/async: fix assertion condition when draining buffer
...
Fixes some random assertion failures with
ffprobe -show_packets async:samples/ffmpeg-bugs/trac/ticket6132/Samsung_HDR_-_Chasing_the_Light.ts > /dev/null
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit 4b46d1ee46
2019-02-11 22:07:06 +01:00
chcunningham
00cdf4e4e5
avformat/mov: validate chunk_count vs stsc_data
...
Bad content may contain stsc boxes with a first_chunk index that
exceeds stco.entries (chunk_count). This ammends the existing check to
include cases where chunk_count == 0. It also patches up the case
when stsc refers to unknown chunks, but stts has no samples (so we
can simply ignore stsc).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1c15449ca9michael@niedermayer.cc >
2019-02-08 12:22:37 +01:00
chcunningham
bcc71f30ad
avformat/mov.c: require tfhd to begin parsing trun
...
Detecting missing tfhd avoids re-using tfhd track info from the previous
moof. For files with multiple tracks, this may make a mess of the
avindex and fragindex, which can later trigger av_assert0 in
mov_read_trun().
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ea87e5d9emichael@niedermayer.cc >
2019-02-08 12:22:13 +01:00
Michael Niedermayer
953f97979f
avformat/rtsp: Check number of streams in sdp_parse_line()
...
Fixes: OOM
Found-by: Michael Hanselmann <public@hansmi.ch >
Reviewed-by: Michael Hanselmann <public@hansmi.ch >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 497c9b0ccemichael@niedermayer.cc >
2019-01-31 18:03:35 +01:00
Michael Niedermayer
e75a73d629
avformat/rtsp: Clear reply in every iteration in ff_rtsp_connect()
...
Fixes: Infinite loop
Found-by: Michael Hanselmann <public@hansmi.ch >
Reviewed-by: Michael Hanselmann <public@hansmi.ch >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0b50f27635michael@niedermayer.cc >
2019-01-31 17:29:41 +01:00
Michael Niedermayer
6b6c854658
avformat/libopenmpt: Fix successfull typo
...
Reviewed-by: Lou Logan <lou@lrcd.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 571af98a59michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
David Bryant
ea279bd160
avformat/wvdec: detect and error out on WavPack DSD files
...
Not currently supported.
(cherry picked from commit db109373d8michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Jacob Trimble
73c90818b1
libavformat/mov: Fix NULL-dereference read for some encrypted content.
...
When reading frames, we need to use the fragment for the correct
stream. Sometimes the "current" fragment is not the same as the one
the frame is for.
Found by Chromium's ClusterFuzz:
https://crbug.com/906392 and https://crbug.com/915524
Signed-off-by: Jacob Trimble <modmaker@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 555f332e7amichael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
e3fbbb7d18
avformat/mpegts: Fix side data type for stream id
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab1319d82fmichael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
chcunningham
45f5f2086e
lavf/id3v2: fail read_apic on EOF reading mimetype
...
avio_read may return EOF, leaving the mimetype array unitialized. fail
early when this occurs to avoid using the array in an unitialized state.
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ee1e39a576michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
f5859d4a8e
avformat/nutenc: Document trailer index assert better
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a95b73abcmichael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
chcunningham
54fbdacc37
lavf/mov: ensure only one tkhd per trak
...
Chromium fuzzing produced a whacky file with extra tkhds. This caused
an AVStream that was already in use to be corrupted by assigning it a
new id, which blows up later in mov_read_trun because the
MOVFragmentStreamInfo.index_entry now points OOB.
Reviewed-by: Baptiste Coudurier <baptiste.coudurier@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9f7b6f7a9michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
