774d23af2f
avformat/utils: Check rfps_duration_sum for overflow
...
Fixes: signed integer overflow: 9151595917793558550 + 297519050751678697 cannot be represented in type 'long'
Fixes: 15496/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5722866475073536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c46fdf305michael@niedermayer.cc >
2019-11-14 23:30:38 +01:00
cda23a57cc
avformat/xmv: Make bitrate 64bit
...
Fixes: signed integer overflow: 32 * 538976288 cannot be represented in type 'int'
Fixes: 15633/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5752273981931520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 39a6a79bcbmichael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
bcc19ab7b7
avformat/utils: Check timebase before use in estimate_timings()
...
Fixes: division by 0
Fixes: 15480/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5746727434321920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f57e97dfd9michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
241f59eb8b
avformat/aviobuf: Delay buffer downsizing until asserts are met
...
Fixes: Assertion failure
Fixes: 15151/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5757079496687616
Fixes: 15205/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5767573242642432
May fix: Ticket7094
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0334632d5cmichael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
93baaaaa8c
avformat/vqf: Check header_size
...
Fixes: 15271/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5735262606327808
Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7c30ff3888michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
a77473d040
avformat/mov: Set fragment.found_tfhd only after TFHD has been parsed
...
Fixes: Assertion failure
Fixes: crbug971646.mp4
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 696312c487michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
1246e38511
avformat/icodec: Free ico->images on error paths
...
Fixes: 15116/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5715173567889408
Fixes: memleak
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 54918b5116michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
25d3ae9697
avformat/wsddec: Fix undefined shift
...
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 15123/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5738039235575808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 112eb17a2bmichael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
a8ff09d7b7
avformat/wtvdec: Avoid (32bit signed) sectors
...
Fixes: left shift of negative value -14614752
Fixes: 15174/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5670543606415360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dd357d76e5michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
5b4ceb45e3
avformat/sbgdec: Fixes integer overflow in str_to_time() with hours
...
Fixes: signed integer overflow: 904444 * 3600 cannot be represented in type 'int'
Fixes: 15113/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5764083346833408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2a0f23b9d6michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
62c408412f
avformat/vpk: Check offset for validity
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa003019abmichael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
d14dd61a3d
avformat/vpk: Fix integer overflow in samples_per_block computation
...
Fixes: signed integer overflow: 84026453 * 28 cannot be represented in type 'int'
Fixes: 15111/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5675630072430592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c6c4129b4michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
20ecac12c9
avformat/mp3enc: Avoid SEEK_END as it is unsupported
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf3ee6a130michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
e1ceb17ee3
avformat/webm_chunk: Specify expected argument length of get_chunk_filename()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1a74b04737michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
abb7d3f1d0
avformat/webm_chunk: Check header filename length
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3b5b977c9fmichael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
81b5f4fac7
lavf/webm_chunk: Respect buffer size
...
The last argument of av_strlcpy is supposed to contain the size of the
destination buffer, but it was filled with the size of the source
string, effectively negating its very purpose.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73ef1f47f5michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
26d7824352
avformat/mov: Skip stsd adjustment without chunks
...
Fixes: Assertion failure
Fixes: clusterfuzz-testcase-minimized-media_pipeline_integration_fuzzer-5683096400822272
Found-by: Clusterfuzz
Reported-by: Dan Sanders <sandersd@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 18a567c369michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
59ac418258
avformat/aadec: Check for scanf() failure
...
Fixes: use of uninitialized variables
Fixes: blank.aa
Found-by: Chamal De Silva <chamal.desilva@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ed188f6dcdmichael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
cfa7c079f7
lavf/rawenc: Only accept the appropriate stream type for raw muxers.
...
This does not affect the rawvideo muxer.
Fixes ticket #7979 .
(cherry picked from commit aef24efb0c
2019-09-06 19:01:27 -03:00
bb22b9ce21
avformat/aacdec: resync to the next adts frame on invalid data instead of aborting
...
Should fix ticket #6634
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 881e1f5a62
2019-07-23 01:13:41 -03:00
a9282fc964
avformat/aacdec: factorize the adts frame resync code
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit a38eab8b75
2019-07-23 00:46:46 -03:00
2d825946a3
avformat/gdv: Check fps
...
Fixes: Division by 0
Fixes: ffmpeg_zero_division.bin
Found-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38381400fcmichael@niedermayer.cc >
2019-03-24 10:38:52 +01:00
1613b1669d
avformat/webmdashenc: Check id in adaption_sets
...
Fixes: out of array access
Found-by: Wenxiang Qian
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b687b549aamichael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
3b4630c181
avformat/http: Fix Out-of-Bounds access in process_line()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 85f91ed760michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
e62abf9398
avformat/ftp: Fix Out-of-Bounds Access and Information Leak in ftp.c:393
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a142ffdcaemichael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
f906710870
avformat/matroskadec: Do not leak queued packets on sync errors
...
Fixes: memleak
Fixes: clusterfuzz-testcase-minimized-audio_decoder_fuzzer-5649187601121280
Reported-by: Chris Cunningham <chcunningham@google.com >
Tested-by: Chris Cunningham <chcunningham@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d1afa7284cmichael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
3ae6063f5a
avformat/mov: Do not use reference stream in mov_read_sidx() if there is no reference stream
...
Fixes: NULL pointer dereference
Fixes: clusterfuzz-testcase-minimized-audio_decoder_fuzzer-5634316373721088
Reported-by: Chris Cunningham <chcunningham@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b0d8b7cb8emichael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
08b159fd0d
avformat/mov: validate chunk_count vs stsc_data
...
Bad content may contain stsc boxes with a first_chunk index that
exceeds stco.entries (chunk_count). This ammends the existing check to
include cases where chunk_count == 0. It also patches up the case
when stsc refers to unknown chunks, but stts has no samples (so we
can simply ignore stsc).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1c15449ca9michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
0063964f84
avformat/mov.c: require tfhd to begin parsing trun
...
Detecting missing tfhd avoids re-using tfhd track info from the previous
moof. For files with multiple tracks, this may make a mess of the
avindex and fragindex, which can later trigger av_assert0 in
mov_read_trun().
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ea87e5d9emichael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
136ec39a2f
avformat/rtsp: Check number of streams in sdp_parse_line()
...
Fixes: OOM
Found-by: Michael Hanselmann <public@hansmi.ch >
Reviewed-by: Michael Hanselmann <public@hansmi.ch >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 497c9b0ccemichael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
d3aab63320
avformat/rtsp: Clear reply in every iteration in ff_rtsp_connect()
...
Fixes: Infinite loop
Found-by: Michael Hanselmann <public@hansmi.ch >
Reviewed-by: Michael Hanselmann <public@hansmi.ch >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0b50f27635michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
24438427ef
avformat/wvdec: detect and error out on WavPack DSD files
...
Not currently supported.
(cherry picked from commit db109373d8michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
f51a271f20
avformat/mpegts: Fix side data type for stream id
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab1319d82fmichael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
96062eb3cc
lavf/id3v2: fail read_apic on EOF reading mimetype
...
avio_read may return EOF, leaving the mimetype array unitialized. fail
early when this occurs to avoid using the array in an unitialized state.
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ee1e39a576michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
f9b7c87145
avformat/nutenc: Document trailer index assert better
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a95b73abcmichael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
cb901e1836
lavf/mov: ensure only one tkhd per trak
...
Chromium fuzzing produced a whacky file with extra tkhds. This caused
an AVStream that was already in use to be corrupted by assigning it a
new id, which blows up later in mov_read_trun because the
MOVFragmentStreamInfo.index_entry now points OOB.
Reviewed-by: Baptiste Coudurier <baptiste.coudurier@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9f7b6f7a9michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
d17d08035c
avformat/utils: Never store negative values in last_IP_duration
...
Fixes: integer overflow compute_pkt_fields()
Fixes: compute_pkt_usan
Reported-by: Thomas Guilbert <tguilbert@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 079d1a7175michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
e9975d1b51
avformat/utils: Fix integer overflow in discontinuity check
...
Fixes: signed integer overflow: 7738135736989908991 - -7954308516317364223 cannot be represented in type 'long'
Fixes: find_stream_info_usan
Reported-by: Thomas Guilbert <tguilbert@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4e19cfcfa3michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
eab5f6e419
avformat/mov: Error on too large stsd entry counts.
...
Entries are always at least 8 bytes per the parsing code, so if we
see an impossible entry count avoid massive allocations. This is
similar to an existing check in mov_read_stsc().
Since ff_mov_read_stsd_entries() does eof checks, an alternative
approach could be to clamp the entry count to atom.size / 8.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 320b631a99michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
0ef49c0818
avformat/nsvdec: Do not parse multiple NSVf
...
The specification states "NSV files may contain a single file header. "
Fixes: out of array access
Fixes: nsv-asan-002f473f726a0dcbd3bd53e422c4fc40b3cf3421
Found-by: Paul Ch <paulcher@icloud.com >
Tested-by: Paul Ch <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 78d4b6bd43michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
ff5196a98a
avformat/mlvdec: read_string() received unsigned size, make the argument unsigned
...
Fixes: infinite loop
Fixes: mlv-timeout-e3b8cab9835edecad6823baa057e029671329d04
Found-by: Paul Ch <paulcher@icloud.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e71cb2c8emichael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
17c0347977
avformat/rmdec: Fix EOF check in the stream loop in ivr_read_header()
...
Fixes: long running loop
Fixes: ivr-timeout-42468cb797f52f025fb329394702f5d4d64322d6
Found-by: Paul Ch <paulcher@icloud.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c2eec1762dmichael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
44e878d086
avformat/flvenc: Check audio packet size
...
Fixes: Assertion failure
Fixes: assert_flvenc.c:941_1.swf
Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6b67d7f059michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
2b8d4f6f01
avformat/movenc: Write version 2 of audio atom if channels is not known
...
The version 1 needs the channel count and would divide by 0
Fixes: division by 0
Fixes: fpe_movenc.c_1108_1.ogg
Fixes: fpe_movenc.c_1108_2.ogg
Fixes: fpe_movenc.c_1108_3.wav
Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fa19fbcf71michael@niedermayer.cc >
2018-07-17 11:46:33 +02:00
20ad61ffb7
avformat/movenc: Check input sample count
...
Fixes: division by 0
Fixes: fpe_movenc.c_199_1.wav
Fixes: fpe_movenc.c_199_2.wav
Fixes: fpe_movenc.c_199_3.wav
Fixes: fpe_movenc.c_199_4.wav
Fixes: fpe_movenc.c_199_5.wav
Fixes: fpe_movenc.c_199_6.wav
Fixes: fpe_movenc.c_199_7.wav
Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a2d21bc5fmichael@niedermayer.cc >
2018-07-08 01:37:54 +02:00
36c779bffe
avformat/movenc: Check that frame_types other than EAC3_FRAME_TYPE_INDEPENDENT have a supported substream id
...
Fixes: out of array access
Fixes: ffmpeg_bof_1.avi
Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ed22dc2221michael@niedermayer.cc >
2018-07-07 12:27:14 +02:00
5da77e7e9e
avformat/mms: Add missing chunksize check
...
Fixes: out of array read
Fixes: mms-crash-01b6c5d85f9d9f40f4e879896103e9f5b222816a
Found-by: Paul Ch <paulcher@icloud.com >
1st hunk by Paul Ch <paulcher@icloud.com >
Tested-by: Paul Ch <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cced03dd66michael@niedermayer.cc >
2018-07-07 12:27:00 +02:00
717ece29fd
avformat/pva: Check for EOF before retrying in read_part_of_packet()
...
Fixes: Infinite loop
Fixes: pva-4b1835dbc2027bf3c567005dcc78e85199240d06
Found-by: Paul Ch <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9807d3976bmichael@niedermayer.cc >
2018-07-07 12:27:00 +02:00
09401d0a0a
avformat/rmdec: Do not pass mime type in rm_read_multi() to ff_rm_read_mdpr_codecdata()
...
Fixes: use after free()
Fixes: rmdec-crash-ffe85b4cab1597d1cfea6955705e53f1f5c8a362
Found-by: Paul Ch <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a7e032a277michael@niedermayer.cc >
2018-07-07 12:27:00 +02:00
9dea41eac7
avformat/asfdec_o: Check size_bmp more fully
...
Fixes: integer overflow and out of array access
Fixes: asfo-crash-46080c4341572a7137a162331af77f6ded45cbd7
Found-by: Paul Ch <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b46ebdbffmichael@niedermayer.cc >
2018-07-07 12:27:00 +02:00
Michael Niedermayer