Andreas Rheinhardt
af8d5aab74
lavf/webm_chunk: Fix NULL dereference
...
The earlier version of the webm_chunk muxer had several bugs:
1. If the first packet of an audio stream didn't have a PTS of zero,
then no chunk will be started before a packet is delivered to the
underlying Matroska/WebM muxer, i.e. the AVFormatContext used to write
these packets had a NULL as AVIOContext for output. This is behind the
crash in ticket #5752 .
2. If an error happens during writing a packet, the underlyimg
Matroska/WebM muxer context is freed. This leads to a use-after-free
coupled with a double-free in webm_chunk_write_trailer (which supposes
that the underlying AVFormatContext is still valid).
3. Even when no error occurs at all, webm_chunk_write_trailer is still
buggy: After the underlying Matroska/WebM muxer has written its trailer,
ending the chunk implicitly flushes it again which is illegal at this
point.
These bugs have been fixed.
Fixes #5752 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 8c6ee7626b )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:50 +02:00
Andreas Rheinhardt
eb89291877
avcodec/ttaenc: Fix undefined shift
...
ttaenc contained (1 << unary) - 1 as an argument for a function
expecting an unsigned int. unary can be as big as 31 in this case.
The type of the shift and the whole expression is int, because 1 fits
into an integer, so that the behaviour is undefined if unary == 31
as the result of the shift can't be represented in an int §. Subtraction
by 1 (which makes the result of the whole expression representable in
an int) doesn't change that this is undefined (it usually leads to
signed integer overflow which is undefined, too).
The solution is simple: Make 1 unsigned to change the type of the
whole expression to unsigned int (as the function expects anyway).
Fixes ticket #8153 .
§: This of course presupposes the common int range of -2^31..2^31-1
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ab488a540 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:50 +02:00
Andreas Rheinhardt
25a0887c5a
fftools/ffmpeg: Free swresample dictionary during cleanup
...
Freeing this was forgotten in ad899522 .
Fixes #8315 and #8316 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6f2a3958cf )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:50 +02:00
Andreas Rheinhardt
e5655c0444
avfilter/vf_xbr: Fix left shift of negative number
...
Affected every usage of vf_xbr, e.g. the FATE-tests filter-2xbr,
filter-3xbr, filter-4xbr.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4294dc3589 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:50 +02:00
Andreas Rheinhardt
0b4a122a5a
avfilter/vf_hqx: Fix undefined left shifts of negative numbers
...
Affected every usage of this filter; in particular, it affected the
FATE-tests filter-2xbr, filter-3xbr and filter-4xbr.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fa21194326 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:50 +02:00
Andreas Rheinhardt
d4f2de5151
avcodec/jpeg2000dwt: Fix undefined shifts of negative numbers
...
Affected the vsynth*-jpeg2000 and the vsynth*-jpeg2000-97 FATE tests
(where * ranges over { 1, 2, 3, _lena }) as well as ticket #7983 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5cf593adcd )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:50 +02:00
Andreas Rheinhardt
32c81dffb0
avcodec/ituh263dec: Fix undefined left shift of negative number
...
Fixes ticket #8160 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 324487b596 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:49 +02:00
Andreas Rheinhardt
3c891c3613
avcodec/dnxhdenc: Fix undefined left shifts of negative numbers
...
Affected 61 FATE-tests: 60 vsynth tests and lavf-mxf_opatom.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b7f156e8cb )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:49 +02:00
Andreas Rheinhardt
94d7fbe373
swscale/utils: Fix invalid left shifts of negative numbers
...
Affected the FATE-tests vsynth_lena-dv-411, vsynth1-dv-411,
vsynth2-dv-411 and hevc-paramchange-yuv420p.yuv420p10.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e2646e23be )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:49 +02:00
Andreas Rheinhardt
2c5943a384
swscale/x86/swscale: Fix undefined left shifts of negative numbers
...
This affected many FATE-tests: The number of failing tests went down
from 663 to 344. (Both numbers exclude tests that failed because of
unaligned accesses in code that is inside #if HAVE_FAST_UNALIGNED.)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 736c7c20e7 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:49 +02:00
Andreas Rheinhardt
3eafbebe11
avcodec/exr: Fix undefined left shifts of negative numbers
...
Affected the FATE-tests exr-rgb-scanline-pxr24-half-uint32-13x9 and
exr-rgb-scanline-pxr24-uint32.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b0f949906 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:49 +02:00
Andreas Rheinhardt
2b177a46d2
avformat/movenc: Fix undefined shift
...
Fixes the movenc FATE-test.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 646799b42f )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:49 +02:00
Andreas Rheinhardt
f4bcf5742e
avcodec/pcm: Fix undefined shifts
...
Fixes the acodec-pcm-u16[lb]e FATE-tests.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 69473bec6f )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:49 +02:00
Andreas Rheinhardt
594dd57af4
avcodec/wavpackenc: Fix undefined shifts
...
Fixes ticket #8161 and the acodec-wavpack FATE-test.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 84974c6fb5 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:49 +02:00
Andreas Rheinhardt
788a580620
avcodec/ac3enc: Fix invalid shift
...
Fixes the FATE-tests unknown_layout-ac3, ac3-fixed-encode, ac3-encode
and eac3-encode. It furthermore fixes the ac3-encoder bugs mentioned in
tickets #7994 , #8144 and #8159 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f289ec914 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:48 +02:00
Andreas Rheinhardt
fbaa2dce42
avcodec/tdsc: Fix undefined shifts
...
Fixes the tdsc FATE-test.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 86bef10e7a )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:48 +02:00
Andreas Rheinhardt
5f288e1b29
fftools/ffmpeg_opt: Fix signed integer overflow
...
Fixes ticket #8154 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b1fcba8dd )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:48 +02:00
Andreas Rheinhardt
8bac2df94a
avformat/mov: Fix reel_name size check
...
Only read str_size bytes from offset 30 of extradata if the extradata is
indeed at least 30 + str_size bytes long.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit ff3fad6b0e )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:48 +02:00
Andreas Rheinhardt
9b84d1d505
avformat/mov: Fix memleak upon encountering repeating tags
...
mov_read_custom tries to read three strings belonging to three different
tags. When an already encountered tag is encountered again, a new buffer
for the string to be read is allocated and stored in the pointer
destined for this particular tag. But in this scenario, said pointer
already holds the address of the string read earlier, leading to a leak.
This commit therefore aborts the reading process upon encountering
an already encountered tag.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit dfef1d5e3c )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:48 +02:00
Andreas Rheinhardt
7c50575dcf
avformat/matroskaenc: Don't use NULL for %s format string
...
The argument pertaining to a printf %s conversion specifier must not
be NULL, even if the precision (i.e. the number of characters to write)
is zero. If it is NULL, it is undefined behaviour.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 6de6ce7bc8 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:48 +02:00
Andreas Rheinhardt
a828461303
avformat/webvttdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit c784fe8b86 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:48 +02:00
Andreas Rheinhardt
5808413509
avformat/vplayerdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 67434afa7f )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:47 +02:00
Andreas Rheinhardt
d8c5124ad9
avformat/tedcaptionsdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if allocating the AVStream for the subtitles fails.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 337783b118 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:47 +02:00
Andreas Rheinhardt
f8d1b5d769
avformat/subviewerdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit a708f65273 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:47 +02:00
Andreas Rheinhardt
1cf9ba634e
avformat/subviewer1dec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 9751d75152 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:47 +02:00
Andreas Rheinhardt
49196e704c
avformat/stldec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit e13874b9ea )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:47 +02:00
Andreas Rheinhardt
8120d1ddcf
avformat/srtdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit c70409957c )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:47 +02:00
Andreas Rheinhardt
ba1f99c86a
avformat/sccdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit f3c63e67bb )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:47 +02:00
Andreas Rheinhardt
c9b6385c16
avformat/samidec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle
or when creating extradata.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit f161f8e4ad )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:47 +02:00
Andreas Rheinhardt
f26395604c
avformat/pjsdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 9df560e898 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:46 +02:00
Andreas Rheinhardt
c253f384dc
avformat/mpsubdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon creating an AVStream.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit a5ed8aeea4 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:46 +02:00
Andreas Rheinhardt
ed1f68ccfe
avformat/mpl2dec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 331799747e )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:46 +02:00
Andreas Rheinhardt
1b99059359
avformat/microdvddec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle
or when allocating extradata.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit b12014a5b8 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:46 +02:00
Andreas Rheinhardt
e95ebaa332
avformat/lrcdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit d38694cea9 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:46 +02:00
Andreas Rheinhardt
1a01d3cbb8
avformat/jacosubdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit c13a752733 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:46 +02:00
Andreas Rheinhardt
80b4dd41ff
avformat/assdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle
or if creating the extradata failed.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 5ab39c2d8c )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:46 +02:00
Andreas Rheinhardt
950b32a2e8
avformat/aqtitledec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit a86a5d06d8 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:46 +02:00
Andreas Rheinhardt
19b1f676f6
avformat/mov: Fix memleaks upon read_header failure
...
By default, a demuxer's read_close function is not called automatically
if an error happens when reading the header; instead it is up to the
demuxer to clean up after itself in this case. The mov demuxer did this
by calling its read_close function when it encountered some errors when
reading the header. Yet for other errors (mostly adding side-data to
streams) this has been forgotten, so that all the internal structures
of the demuxer leak.
This commit fixes this by making sure mov_read_close is called when
necessary.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit ac378c535b )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:13:43 +02:00
Andreas Rheinhardt
da59fe3eea
avformat/omadec: Fix memleaks upon read_header failure
...
Fixes possible leaks of id3v2 metadata as well as an AVDES struct in
case the content is encrypted and an error happens lateron.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 3d3ba43bc6 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 14:11:05 +02:00
Andreas Rheinhardt
b5e9226dad
avformat/matroskadec: Use right number of tracks
...
When demuxing a Matroska/WebM file, streams are added for tracks and for
attachments, so that the array containing the former can be NULL even
when the corresponding AVFormatContext has streams. So check for there
to be tracks in the MatroskaDemuxContext instead of just streams in the
AVFormatContext before dereferencing the pointer to the tracks.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 1ef30571a0 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:48:05 +02:00
Andreas Rheinhardt
c6ee2f7c90
avformat/matroskadec: Fix handling gigantic durations
...
matroska_parse_block currently asserts that the duration is not equal to
AV_NOPTS_VALUE, but there is nothing that actually guarantees this. It
is easy to create (spec-compliant) files which run into this assert;
so replace it and instead cap the duration to INT64_MAX, as the duration
field of an AVPacket is an int64_t.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 3714d452b8 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:48:05 +02:00
Andreas Rheinhardt
b9b845e98a
avformat/aviobuf: Don't check for overflow after it happened
...
If adding two ints overflows, it doesn't matter whether the result will
be stored in an unsigned or not; and checking afterwards does not make it
retroactively defined.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 28a078eded )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:48:05 +02:00
Andreas Rheinhardt
7b80a7e498
avformat/matroskaenc: Fix memleak upon encountering bogus chapter
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit cb255b616c )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:48:05 +02:00
Andreas Rheinhardt
f17200f600
fftools/ffmpeg_opt: Check attachment filesize
...
The data of an attachment file is put into an AVCodecParameter's
extradata. The corresponding size field has type int, yet there was no
check for the size to fit into an int. As a consequence, it was possible
to create extradata with negative size (by using a big enough max_alloc).
Other errors were also possible: If SIZE_MAX < INT64_MAX (e.g. on 32bit
systems) then the file size might be truncated before the allocation;
and avio_read() takes an int, too, so one would not have read as much
as one desired.
Furthermore, the extradata is now padded as is required.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 889ad93c88 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:48:05 +02:00
Andreas Rheinhardt
397705d4c1
avformat/webmdashenc: Check codec types
...
The WebM DASH Manifest muxer only supports VP8, VP9, Vorbis and Opus,
but there was no check for this. The codec type is used to get a pointer
to a string containing the codec name or NULL if it is not one of those
four codecs. Said pointer has then been used without further checks as
string for the %s conversion specifier in an avio_printf()) call which
is undefined behaviour.
This commit adds a check for the supported codec types.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit cbea58b2b3 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:48:04 +02:00
Andreas Rheinhardt
445fee99b8
avformat/webmdashenc: Fix memleak upon realloc failure
...
The classical ptr = av_realloc(ptr, size).
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 418e468699 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:28:11 +02:00
Andreas Rheinhardt
3f165b3e63
avformat/matroskadec: Don't discard the upper 32bits of TrackNumber
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit ba36a07734 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:28:11 +02:00
Andreas Rheinhardt
a92b9ed7e3
avformat/hnm: Check for extradata allocation failure
...
and also add padding to it; moreover, don't use memcpy to write one byte
to extradata.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e0f3352d1 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:28:11 +02:00
Andreas Rheinhardt
590a168cf9
avformat/subtitles: Don't increment packet counter prematurely
...
Do it only if the packet has been successfully allocated in
av_new_packet() -- otherwise on error a completely uninitialized packet
would be unreferenced later.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6bd8bcc2ac )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:28:10 +02:00
Andreas Rheinhardt
4639e4743f
avformat/bethsoftvid: Fix potential memleak upon reallocation failure
...
The classical ptr = av_realloc(ptr, size), just with av_fast_realloc().
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5acef12061 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:28:10 +02:00
Andreas Rheinhardt
98efb7afc9
avformat/smoothstreaming: Fix memleaks on errors
...
If an AVFormatContext could be allocated, but white-/blacklists couldn't
be copied, the AVFormatContext would leak as it was only accessible
through a local variable that goes out of scope when one goes to fail.
Furthermore, in case writing a header of a submuxer failed, the options
used for said call could leak.
Both of these memleaks have been fixed.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit abbb466368 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:28:10 +02:00
Andreas Rheinhardt
ff1a79d7f3
avformat/matroskaenc: Check BlockAdditional size before use
...
Don't read a 64bit number before having checked that the data is at
least 8 bytes long.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6e9cc96429 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:28:10 +02:00
Andreas Rheinhardt
3f4195d9ef
avformat/utils: Fix memleaks in avformat_open_input()
...
A demuxer might have allocated memory while reading the header. If
reading the header was successfull and an error happens before returning
(e.g. when queueing the attached pictures), the read_close function
would have never been called, so that all those allocations would leak.
This commit changes this.
Furthermore, there would be even more memleaks if the error level was
set to AV_EF_EXPLODE in case there is both metadata and id3v2 metadata.
This has been fixed, too.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit e2307f4ff1 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:28:08 +02:00
Andreas Rheinhardt
ac6fd4546a
avcodec/cavsdsp: Fix undefined left shifts of negative numbers
...
Affected the ffmpeg-filter_colorkey FATE-test (but only if the C version
of idct8_add is used and not e.g. the x86 SSE2 version).
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Fixes: left shift of negative value -107
Fixes: 20398/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5725389278412800
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0f0f2ab0c3 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:25:25 +02:00
Andreas Rheinhardt
013e49ab52
avformat/matroskaenc: Check for reformatting errors
...
This is needed especially for AV1: If a reformatting error happens (e.g.
if the length field of an OBU contained in the current packet indicates
that said OBU extends beyond the current packet), the data pointer is
still NULL, yet the size is unchanged, so that writing the data leads
to a segmentation fault.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 58428bef4b )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:10:43 +02:00
Andreas Rheinhardt
4c7f9a32f9
avcodec/ra144enc: Fix invalid left shift of negative number
...
by replacing it with a multiplication. Said multiplication can't
overflow an int32_t because lpc_coefs is limited to 16 bit precision.
Fixes the FACE-test acodec-ra144 as well as part of #8217 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e3fb9af6f1 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:10:43 +02:00
Andreas Rheinhardt
c103c203dd
avcodec/adxenc: Avoid undefined left shift of negative numbers
...
Replace "((a << shift) + b) >> shift" by "a + (b >> shift)". This avoids
a left shift which also happens to trigger undefined behaviour in case "a"
is negative. This affected the FATE-tests acodec-adpcm-adx and
acodec-adpcm-adx-trellis; it also fixes ticket #8008 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 59a9d65e0d )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:10:43 +02:00
Andreas Rheinhardt
8c9132a88e
avcodec/adpcm: Fix undefined left shifts of negative numbers
...
Affected the adpcm-afc, adpcm-ea-1, adpcm-ea-2, adpcm-ea-maxis-xa,
adpcm-thp and ea-cdata FATE-tests. Also fixes ticket #8487 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ad8af51b7 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:10:43 +02:00
Andreas Rheinhardt
e40aff3fdb
avcodec/proresenc_anatoliy: Fix invalid left shift of negative number
...
This fixes ticket #7997 as well as the vsynth*-prores_# FATE-tests
(where * ranges over { 1, 2, 3, _lena } and # over { , _int, _444,
_444_int }).
(Given that prev_dc is in the range -0xC000..0x3FFF, no overflow can
happen upon multiplication with 2.)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 198081efb7 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:10:42 +02:00
Andreas Rheinhardt
3a4be74dcd
avformat/wtvdec: Fix memleak when reading header fails
...
Fixes #8314 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 373c1c9b69 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:10:42 +02:00
Zhao Zhili
d04829a36b
avformat/mov: fix memleaks
...
Fix two cases of memleaks:
1. The leak of dv_demux
2. The leak of dv_fctx upon dv_demux allocate failure
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit f3dc38a186 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:10:20 +02:00
Andreas Rheinhardt
b6f31b41cc
libavformat/mov: Fix memleaks when demuxing DV audio
...
The code for demuxing DV audio predates the introduction of refcounted
packets and when the latter was added, changes to the former were
forgotten. This meant that when avpriv_dv_produce_packet initialized the
packet containing the AVBufferRef, the AVBufferRef as well as the
underlying AVBuffer leaked; the actual packet data didn't leak: They
were directly freed, but not via their AVBuffer's free function.
https://samples.ffmpeg.org/ffmpeg-bugs/trac/ticket4671/dir1.tar.bz2
contains samples for this (enable_drefs needs to be enabled for them).
Moreover, errors in avpriv_dv_produce_packet were ignored; this has been
changed, too.
Furthermore, in the hypothetical scenario that the track has a palette,
this would leak, too, so reorder the code so that the palette code
appears after the DV audio code.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 61f5c6ab06 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 13:10:20 +02:00
Andreas Rheinhardt
706ae61cf3
avcodec/bitstream: Don't check for undefined behaviour after it happened
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 5e196dac22 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 16:55:40 +02:00
Andreas Rheinhardt
364a80ecb9
libavcodec/libvpxenc: Don't free user-provided AVPacket
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 26b4509690 )
2020-05-23 20:47:34 +02:00
Andreas Rheinhardt
1a577c59d0
libavcodec/libmp3lame: Don't free user-provided AVPacket
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 7e6941e185 )
2020-05-23 20:47:33 +02:00
Andreas Rheinhardt
174ce949d7
avcodec/libopusenc: Don't free user-provided AVPacket
...
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit b803993b6d )
2020-05-23 20:47:33 +02:00
Andreas Rheinhardt
c13febd843
avformat/matroskadec: Fix default value of BlockAddID
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit dbc50f8a93 )
2020-04-03 22:08:49 +02:00
Mark Harris
9d3509f401
avutil/mem: Fix invalid use of av_alloc_size
...
The alloc_size attribute is valid only on functions that return a
pointer. GCC 9 (not yet released) warns about invalid usage:
./libavutil/mem.h:342:1: warning: 'alloc_size' attribute ignored on a function returning int' [-Wattributes]
342 | av_alloc_size(2, 3) int av_reallocp_array(void *ptr, size_t nmemb, size_t size);
| ^~~~~~~~~~~~~
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4361293fcf )
2019-07-23 01:22:27 -03:00
James Almer
884ecede17
avcodec/hevcdec: decode at most one slice reporting being the first in the picture
...
Fixes deadlocks when decoding packets containing more than one of the aforementioned
slices when using frame threads.
Tested-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 70c8c8a818 )
2019-03-20 21:20:20 -03:00
Paul B Mahol
3d5762380d
avfilter/af_silenceremove: fix possible crash if supplied duration is negative
...
Signed-off-by: Paul B Mahol <onemda@gmail.com >
Fixes ticket #7697 .
(cherry picked from commit 2d1594a8d6 )
2019-01-25 00:58:14 +01:00
Michael Niedermayer
9cba90e5ef
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-18 01:33:38 +01:00
Michael Niedermayer
14778d3fda
avcodec/pngdec: Check compression method
...
method 0 (inflate/deflate) is the only specified in the specification and the only supported
Fixes: Timeout
Fixes: 10976/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PNG_fuzzer-5729372588736512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f99674ddd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-16 18:24:31 +01:00
Michael Niedermayer
3c4a874388
fftools/ffmpeg: Repair reinit_filter feature
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3504004879 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-16 18:21:27 +01:00
Michael Niedermayer
2661025679
avcodec/shorten: Fix integer overflow with offset
...
Fixes: signed integer overflow: -1625810908 - 582229060 cannot be represented in type 'int'
Fixes: 10977/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5732602018267136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f888771cd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-16 13:18:23 +01:00
Michael Niedermayer
14c8795361
avcodec/cavsdec: Propagate error codes inside decode_mb_i()
...
Fixes: Timeout
Fixes: 10702/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5669940938407936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1cee05656 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-04 20:26:01 +01:00
Michael Niedermayer
ecbf42e13a
avcodec/mpegaudio_parser: Consume more than 0 bytes in case of the unsupported mp3adu case
...
Fixes: Timeout
Fixes: 10966/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP3ADU_fuzzer-5348695024336896
Fixes: 10969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP3ADUFLOAT_fuzzer-5691669402877952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df91af140c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-04 20:24:19 +01:00
Michael Niedermayer
6fe9f36dd9
Update for FFmpeg 3.3.9
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 01:32:12 +01:00
Michael Niedermayer
72e1c43d6d
avutil/integer: Fix integer overflow in av_mul_i()
...
Found-by: fate
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3cc3cb663b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
2405af5081
avcodec/msrle: Check that the input is large enough to contain a end of picture code
...
Fixes: Timeout
Fixes: 10625/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSRLE_fuzzer-5659651283091456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 203ccb8746 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
98444e0222
avcodec/jpeg2000dec: Fix off by 1 error in JPEG2000_PGOD_CPRL handling
...
Fixes: assertion failure
Fixes: 10785/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5672160496975872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 305e523105 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
947f7af048
avcodec/mpeg4videodec: Fix typo in sprite delta check
...
Fixes: Integer overflow
Fixes: 10890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5636062181851136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b737317a88 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
65710b7e6c
avcodec/h264_cavlc: Check mb_skip_run
...
Fixes: 10300/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-6292205497483264
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f72b9904fe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
caddb7890a
avcodec/ra144: Fix integer overflow in add_wav()
...
Fixes: signed integer overflow: -2144033225 + -5208934 cannot be represented in type 'int'
Fixes: 10633/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-5679133791617024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c6282141cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
a1f4fe165a
avformat/utils: Never store negative values in last_IP_duration
...
Fixes: integer overflow compute_pkt_fields()
Fixes: compute_pkt_usan
Reported-by: Thomas Guilbert <tguilbert@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 079d1a7175 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
1e59d05e48
avformat/utils: Fix integer overflow in discontinuity check
...
Fixes: signed integer overflow: 7738135736989908991 - -7954308516317364223 cannot be represented in type 'long'
Fixes: find_stream_info_usan
Reported-by: Thomas Guilbert <tguilbert@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4e19cfcfa3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
a9ce7cfc59
avcodec/unary: Improve get_unary() docs
...
Found-by: kierank
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ad89e203bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
6177ed2a9b
avcodec/dvdsubdec: Sanity check len in decode_rle()
...
Fixes: Timeout
Fixes: 9778/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVDSUB_fuzzer-5186007132536832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e7b023e1db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
43a80efee6
avcodec/mpeg4videodec: Fix undefined shift in get_amv()
...
Fixes: runtime error: shift exponent -1 is negative
Fixes: 9938/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5653783529914368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c88afa44c4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
7fb45ccf4e
avcodec/zmbv: Check that the decompressed data size is correct
...
This checks the value exactly for intra frames and checks it against a
minimum for inter frames as they can be variable.
Fixes: Timeout
Fixes: 10182/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZMBV_fuzzer-6245951174344704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e33b28cc79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
bf4026fcbe
avcodec/zmbv: Update decomp_len in raw frames
...
decomp_len is used in raw frames, so it should not be left at the value from
whatever was decoded previously (which may be any other frame)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d201b83cd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
3c3b437d79
avcodec/shorten: Fix bitstream end check in read_header()
...
Fixes: Timeout
Fixes: 9961/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5687856176562176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 28b80c2d52 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
46875255bc
avcodec/dvdsubdec: Avoid branch in decode_run_8bit()
...
Speed improvment 35.5 sec -> 34.7sec
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 71bf033050 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
fa5498cb4d
avcodec/h264_refs: Document last if() in ff_h264_execute_ref_pic_marking()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 697984b9db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
5c91bb1881
avcodec/ra144: Fix undefined integer overflow in add_wav()
...
Fixes: signed integer overflow: -26884 * 91439 cannot be represented in type 'int'
Fixes: 9687/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-4995588121690112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93a203662f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
78a1db00c4
avcodec/indeo4: Check dimensions in decode_pic_hdr()
...
Fixes: Timeout
Fixes: 9654/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-6289863463665664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7592e88bfe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Dale Curtis
1acec9bbf5
avformat/mov: Error on too large stsd entry counts.
...
Entries are always at least 8 bytes per the parsing code, so if we
see an impossible entry count avoid massive allocations. This is
similar to an existing check in mov_read_stsc().
Since ff_mov_read_stsd_entries() does eof checks, an alternative
approach could be to clamp the entry count to atom.size / 8.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 320b631a99 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Bunk
7266a6d23c
examples: Fix use of AV_CODEC_FLAG_GLOBAL_HEADER
...
AV_CODEC_FLAG_GLOBAL_HEADER should be set before calling avcodec_open2() to have any effect.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a82e4fb8c6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
66331499a7
avcodec/hq_hqa: Check remaining input bits in hqa_decode_mb()
...
Fixes: Timeout
Fixes: 9634/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-6267852259590144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9222b972d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
347c50b0d4
avcodec/vb: Check for end of bytestream before reading blocktype
...
Fixes: Timeout
Fixes: 9601/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VB_fuzzer-4550228702134272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1cbac9ce20 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
dc8ec1a5bc
avcodec/snowdec: Fix integer overflow with motion vector residual
...
Fixes: signed integer overflow: -19818 + -2147483648 cannot be represented in type 'int'
Fixes: 9545/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-4928769537081344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit acba153a14 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
b80d7d4a09
avformat/nsvdec: Do not parse multiple NSVf
...
The specification states "NSV files may contain a single file header. "
Fixes: out of array access
Fixes: nsv-asan-002f473f726a0dcbd3bd53e422c4fc40b3cf3421
Found-by: Paul Ch <paulcher@icloud.com >
Tested-by: Paul Ch <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 78d4b6bd43 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
24add16a32
avformat/mlvdec: read_string() received unsigned size, make the argument unsigned
...
Fixes: infinite loop
Fixes: mlv-timeout-e3b8cab9835edecad6823baa057e029671329d04
Found-by: Paul Ch <paulcher@icloud.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e71cb2c8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
44ebea8657
avformat/rmdec: Fix EOF check in the stream loop in ivr_read_header()
...
Fixes: long running loop
Fixes: ivr-timeout-42468cb797f52f025fb329394702f5d4d64322d6
Found-by: Paul Ch <paulcher@icloud.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c2eec1762d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
907699d120
avcodec/scpr: Check for min > max in decompress_p()
...
Fixes: Timeout
Fixes: 9342/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-4795990841229312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3378194ce8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
298ca73ab1
avcodec/shorten: Fix signed 32bit overflow in shift in shorten_decode_frame()
...
Fixes: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 9480/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-6647324284551168 -rss_limit_mb=2000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9b604e96a5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
d16d851238
avcodec/shorten: Fix integer overflow in residual/LPC combination
...
Fixes: signed integer overflow: -540538872 + -2012739576 cannot be represented in type 'int'
Fixes: 9255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5758630052757504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit db7e9082e1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
488c246bf5
avcodec/shorten: Check verbatim length
...
Fixes: Timeout
Fixes: 9252/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5780720709533696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7007dabec0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
0ea1b62b9a
avcodec/mpegaudio_parser: Initialize poutbuf*
...
Possibly fixes: null pointer dereference
Possibly fixes: 9352/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP3ADUFLOAT_fuzzer-5146068961460224
Fixes: Heap-use-after-free
Fixes: 9453/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP3ADUFLOAT_fuzzer-5137954375729152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0f4c3b0b8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
0678985c14
avcodec/aacpsdsp_template: Fix integer overflow in ps_stereo_interpolate_c()
...
Fixes: signed integer overflow: -1813244069 + -1407981383 cannot be represented in type 'int'
Fixes: 8823/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5643295618236416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47db5763e2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
0026d00742
avformat/flvenc: Check audio packet size
...
Fixes: Assertion failure
Fixes: assert_flvenc.c:941_1.swf
Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6b67d7f059 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Nikolas Bowe
e2d052d5c8
lavc/svq3: Fix regression decoding some files.
...
Fixes some SVQ3 encoded files which fail to decode correctly after 6d6faa2a2d .
These files exhibit lots of artifacts and logs show "Media key encryption is not implemented".
However they decode without artifacts before 6d6faa2a2d .
The attatched patch allows these files to successfully decode, but also reject media key files.
Tested on the files in #6094 and http://samples.mplayerhq.hu/V-codecs/SVQ3/Vertical400kbit.sorenson3.mov
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5aeb3b0080 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
1e1c02c51b
avcodec/qtrle: Check remaining bytestream in qtrle_decode_XYbpp()
...
Fixes: Timeout
Fixes: 9213/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QTRLE_fuzzer-5649753332252672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7dd836a3f9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
c1a3212d45
avcodec/diracdec: Check bytes count in else branch in decode_lowdelay() too
...
Fixes: signed integer overflow: 8 * 340018243 cannot be represented in type 'int'
Fixes: 9441/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5194665207791616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bed125b710 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
c07d568603
avcodec/diracdec: Check slice numbers for overflows in relation to picture dimensions
...
Fixes: signed integer overflow: 88 * 33685506 cannot be represented in type 'int'
Fixes: 9433/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5725943535501312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f457c0ad7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
ee5b42ce2f
avcodec/diracdec: Change frame_number to 64bit as its a 32bit from the bitstream and we also have a -1 special case
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 9291/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-6324345860259840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 462d1be6de )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
d5c48e8536
avcodec/dirac_dwt_template: Fix several integer overflows in horizontal_compose_daub97i()
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 8926/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-6047609228623872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 69cac9e130 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
922a29142e
avcodec/diracdec: Prevent integer overflow in intermediate in global_mv()
...
Fixes: signed integer overflow: -393471 * 5460 cannot be represented in type 'int'
Fixes: 8890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-6299775379963904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5129040646 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
31262860cc
swresample/swresample: Fix input channel count in resample_first computation
...
Found-by: Marcin Gorzel <gorzel@google.com >
Reviewed-by: Marcin Gorzel <gorzel@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bce4da85e8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Michael Niedermayer
ea160f0213
avutil/pixfmt: Document chroma plane size for odd resolutions
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be0b77e6e8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 00:52:46 +01:00
Timo Rothenpieler
5c98f8d80a
avcodec/cuviddec: properly take deinterlacing and display delay into account for buffer_full check
...
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2018-10-14 18:33:55 +02:00
James Almer
660e4c0c96
avcodec/bitstream_filters: check the input argument of av_bsf_get_by_name() for NULL
...
Fixes crashes like "ffmpeg -h bsf" caused by passing NULL to strcmp()
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 3258cc6507 )
2018-07-28 22:45:02 -03:00
Michael Niedermayer
18c9d5d3e8
update for 3.3.8
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 20:44:22 +02:00
Michael Niedermayer
eae9ab0193
avcodec/dvdsub_parser: Allocate input padding
...
Fixes: out of array read
Fixes: 9350/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVDSUB_fuzzer-5746777750765568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cd86b5cfe2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Michael Niedermayer
db85ff3578
avcodec/dvdsub_parser: Init output buf/size
...
No testcase
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e6c843776 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Simon Thelen
28e0e494ee
avcodec/imgconvert: fix possible null pointer dereference
...
regression since 354b26a394
(cherry picked from commit 8c2c97403b )
(cherry picked from commit c1e172c2e1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Michael Niedermayer
c8ca54961d
avcodec/dirac_dwt_template: Fix signedness regression in interleave()
...
Found-by: <jdarnley>
Tested-by: James Darnley <james.darnley@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 181435a4de )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Michael Niedermayer
87ddf73e52
avformat/movenc: Write version 2 of audio atom if channels is not known
...
The version 1 needs the channel count and would divide by 0
Fixes: division by 0
Fixes: fpe_movenc.c_1108_1.ogg
Fixes: fpe_movenc.c_1108_2.ogg
Fixes: fpe_movenc.c_1108_3.wav
Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fa19fbcf71 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Rahul Chaudhry
0e9ecdabf3
swresample/arm: rename labels to fix xcode build error
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e84212b78e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Michael Niedermayer
6a0a16e563
avformat/movenc: Check input sample count
...
Fixes: division by 0
Fixes: fpe_movenc.c_199_1.wav
Fixes: fpe_movenc.c_199_2.wav
Fixes: fpe_movenc.c_199_3.wav
Fixes: fpe_movenc.c_199_4.wav
Fixes: fpe_movenc.c_199_5.wav
Fixes: fpe_movenc.c_199_6.wav
Fixes: fpe_movenc.c_199_7.wav
Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a2d21bc5f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Michael Niedermayer
314ca5672d
avcodec/mjpegdec: Check for odd progressive RGB
...
Fixes: out of array access
Fixes: 9225/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-5684770334834688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ee1e3ca5eb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Michael Niedermayer
78b1fbca34
avformat/movenc: Check that frame_types other than EAC3_FRAME_TYPE_INDEPENDENT have a supported substream id
...
Fixes: out of array access
Fixes: ffmpeg_bof_1.avi
Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ed22dc2221 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Michael Niedermayer
68fb93be04
avcodec/vp8_parser: Do not leave data/size uninitialized
...
This is identical to what the VP9 parser does
Fixes: 9215/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVPX_VP8_fuzzer-5768227253649408
Fixes: out of memory access
This may also fix oss fuzz issue 9212
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 284dde24da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Michael Niedermayer
4d77a4a54d
avformat/mms: Add missing chunksize check
...
Fixes: out of array read
Fixes: mms-crash-01b6c5d85f9d9f40f4e879896103e9f5b222816a
Found-by: Paul Ch <paulcher@icloud.com >
1st hunk by Paul Ch <paulcher@icloud.com >
Tested-by: Paul Ch <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cced03dd66 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Michael Niedermayer
9bb3047060
avformat/pva: Check for EOF before retrying in read_part_of_packet()
...
Fixes: Infinite loop
Fixes: pva-4b1835dbc2027bf3c567005dcc78e85199240d06
Found-by: Paul Ch <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9807d3976b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Michael Niedermayer
34654d41d4
avformat/rmdec: Do not pass mime type in rm_read_multi() to ff_rm_read_mdpr_codecdata()
...
Fixes: use after free()
Fixes: rmdec-crash-ffe85b4cab1597d1cfea6955705e53f1f5c8a362
Found-by: Paul Ch <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a7e032a277 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Michael Niedermayer
c43f5e0dce
avcodec/indeo4: Check for end of bitstream in decode_mb_info()
...
Fixes: Timeout
Fixes: 8776/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-5361788798369792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 267ba2aa96 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Michael Niedermayer
01a694d482
avcodec/shorten: Fix undefined addition in shorten_decode_frame()
...
Fixes: signed integer overflow: 1139785606 + 1454196085 cannot be represented in type 'int'
Fixes: 8937/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-6202943597445120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3b10bb8772 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Michael Niedermayer
739e3ff475
avcodec/shorten: Fix undefined integer overflow
...
Fixes: signed integer overflow: 8454144 * 256 cannot be represented in type 'int'
Fixes: 8788/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5728205041303552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 70832333bb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Michael Niedermayer
bba9bb735a
avcodec/jpeg2000dec: Fixes invalid shifts in jpeg2000_decode_packets_po_iteration()
...
Fixes: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 9163/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5661750182543360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 652d7c6348 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Michael Niedermayer
0bc74532a9
avcodec/jpeg2000dec: Check that there are enough bytes for all tiles
...
Fixes: OOM
Fixes: 8781/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5810709081358336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0898a3d990 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Michael Niedermayer
672ada0f17
avformat/movenc: Do not pass AVCodecParameters in avpriv_request_sample
...
Fixes: out of array read
Fixes: ffmpeg_crash_8.avi
Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 95556e27e2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Michael Niedermayer
228c05ee54
avcodec/escape124: Fix spelling errors in comment
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f59c4e4391 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Michael Niedermayer
eedde18f1a
avcodec/ra144: Fix integer overflow in ff_eval_refl()
...
Fixes: signed integer overflow: -4096 * -524288 cannot be represented in type 'int'
Fixes: 8650/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-5734816036159488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b31189881a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Michael Niedermayer
3db270a078
avcodec/cscd: Check output buffer size for lzo.
...
Fixes: Timeout
Fixes: 8665/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CSCD_fuzzer-5768442610188288
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit 78167b498f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Michael Niedermayer
b0c14b02b0
avcodec/escape124: Check buf_size against num_superblocks
...
Fixes: Timeout
Fixes: 8722/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-4843268402577408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6677c98626 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Michael Niedermayer
76c4838a11
avcodec/h264_parser: Reduce needed history for parsing mb index
...
This fixes a bug/regression with very small packets
Fixes: output_file
Regression since: 0782fb6bcb
Reported-by: Thierry Foucu <tfoucu@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d25c945247 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:16:13 +02:00
Michael Niedermayer
4fb69a60f6
avcodec/mjpegdec: Check for end of bitstream in ljpeg_decode_rgb_scan()
...
Fixes: Timeout
Fixes: 8648/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5108395525799936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 540e8c2d64 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
516f8dbc58
avcodec/aacdec_fixed: Fix undefined integer overflow in apply_independent_coupling_fixed()
...
Fixes: signed integer overflow: 1195517 * 2048 cannot be represented in type 'int'
Fixes: 8636/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-4695836326887424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8bd514d934 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
c66723ec49
avcodec/dirac_dwt_template: Fix undefined behavior in interleave()
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 8697/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5197148130902016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 575d8ca026 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
96cf8a9cf9
avutil/common: Fix undefined behavior in av_clip_uintp2_c()
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 8521/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5639024952737792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa41d322be )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
b5d51d23a0
fftools/ffmpeg: Fallback to duration if sample rate is unavailable
...
Regression since: af1761f7
Fixes: Division by 0
Fixes: ffmpeg_crash_1
Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 16d8b13b3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
98f10ca12c
avformat/mov: Only set pkt->duration to non negative values
...
Reviewed-by: Sasi Inguva <isasi@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8176799f31 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
f4f9bd655d
avcodec/h264_ps: Move MAX_LOG2_MAX_FRAME_NUM to header so it can be used in h264_sei
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b796c5ae92 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
5f771a74b2
avcodec/h264_mc_template: Only prefetch motion if the list is used.
...
Fixes: index 59 out of bounds for type 'H264Ref [48]'
Fixes: 8232/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5703295145345024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b55591757 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
a16a4fefb6
avcodec/xwddec: Use ff_set_dimensions()
...
Fixes: OOM
Fixes: 8178/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XWD_fuzzer-4844793342459904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c2852e4e00 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
719931c036
avcodec/wavpack: Fix overflow in adding tail
...
Fixes: signed integer overflow: 2146907204 + 26846088 cannot be represented in type 'int'
Fixes: 8105/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-6233036682166272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d13379fb79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
3f66c3386c
avcodec/shorten: Fix multiple integer overflows
...
Fixes: signed integer overflow: 3 * 1006632960 cannot be represented in type 'int'
Fixes: 8278/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5692857166856192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f2abd36b38 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
c2d16aafbb
avcodec/shorten: Fix undefined shift in fix_bitshift()
...
Fixes: left shift of negative value -9
Fixes: 8571/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5715966875926528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 606c714823 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
b7134d7fb6
avcodec/shorten: Fix a negative left shift in shorten_decode_frame()
...
Fixes: left shift of negative value -9057
Fixes: 8527/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5666853924896768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a711efe922 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
f51163b166
avcodec/shorten: Sanity check nmeans
...
Fixes: OOM
Fixes: 8195/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5179785826271232
The reference software appears to use longs for 32bits and it uses int for nmeans
hinting that the intended maximum size was not 32bit.
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d91a0b503d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
8da3d69163
avcodec/shorten: Check non COMM chunk len before skip in decode_aiff_header()
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 8024/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5109204648984576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 424a81df10 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
bb6d47cf35
avcodec/mjpegdec: Fix integer overflow in ljpeg_decode_rgb_scan()
...
Fixes: signed integer overflow: 32768 + 2147450880 cannot be represented in type 'int'
Fixes: 7885/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-5298834394578944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 936f4a2c2e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
0f1e6771d0
avcodec/truemotion2: Fix overflow in tm2_apply_deltas()
...
Fixes: signed integer overflow: 1077952576 + 1077952576 cannot be represented in type 'int'
Fixes: 7712/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5056281753681920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 79c6047c36 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
412872e6cb
avcodec/opus_silk: Change silk_lsf2lpc() slightly toward silk/NLSF2A.c
...
Fixes: runtime error: signed integer overflow: -1440457022 - 785819492 cannot be represented in type 'int'
Fixes: 7700/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OPUS_fuzzer-6595838684954624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e7dda51150 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
6577ae7119
avcodec/amrwbdec: Fix division by 0 in find_hb_gain()
...
This restructures the code slightly toward D_UTIL_dec_synthesis()
Fixes: 7420/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMRWB_fuzzer-6577305112543232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dce80a4b47 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
9ecb1998b0
avformat/mov: replace a value error by clipping into valid range in mov_read_stsc()
...
Fixes : #7165
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fe84f70819 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
aa50d67cc7
avformat/mov: Break out early if chunk_count is 0 in mov_build_index()
...
Without this some operations might overflow (undefined behavior)
even though the index adding loop would never execute
No testcase known
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 56e76bd057 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
05e253684e
avcodec/fic: Avoid some magic numbers related to cursors
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c6a11714c4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
3be0bcbef6
avcodec/g2meet: ask for sample with overflowing RGB
...
Suggested-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab834b8f36 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
6d8859e234
avcodec/aacdec_fixed: use 64bit to avoid overflow in rounding in apply_dependent_coupling_fixed()
...
Fixes: signed integer overflow: -2141499320 + -14469590 cannot be represented in type 'int'
Fixes: 7351/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-6351214791884800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 90475db97e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
e95a0e261f
oavcodec/aacpsdsp_template: Use unsigned for hs0X to prevent undefined behavior
...
Fixes: signed integer overflow: 1073741842 + 1784008138 cannot be represented in type 'int'
Fixes: 6792/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5677589835284480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 62cb6fadf3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
45ce622f90
avcodec/g723_1dec: Clip bits2 in both directions
...
Fixes: shift exponent 33 is too large for 32-bit type 'int'
Fixes: 6743/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G723_1_fuzzer-5823772687859712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53f241218d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
d1bac7f777
avcodec/mpeg4videoenc: Use 64 bit for times in mpeg4_encode_gop_header()
...
Fixes truncation
Fixes Assertion n <= 31 && value < (1U << n) failed at libavcodec/put_bits.h:169
Fixes: ffmpeg_crash_2.avi
Found-by: Thuan Pham <thuanpv@comp.nus.edu.sg >, Marcel Böhme, Andrew Santosa and Alexandru RazvanCaciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e1182fac1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
fdab123c03
avcodec/mlpdec: Only change noise_type if the related fields are valid
...
Fixes: inconsistency
Fixes:runtime error: index 8 out of bounds for type 'int32_t [8]'
Fixes: 6686/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-5191383498358784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 63c4a4b0d6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
b0207c5b2a
indeo4: Decode all or nothing of a band header.
...
This avoids inconsistent value combinations.
Alternatively it would be possible to add more checks and careful use of
temporary variables, but my try of this quickly seemed to become
a rather large change.
The disadvantage of this, is that the struct is copied back and forth.
Fixes: index 6 out of bounds for type 'const uint16_t [5][16]'
Fixes: 6557/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-4787296550256640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 10c8521265 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
c48ac14c06
avformat/mov: Only fail for STCO/STSC contradictions if both exist
...
Fixes regression with playback of GF9720Repeal20the20Eighth20with20Helen20Linehan.m4a
See: crbug 822666
Found-by: "Mattias Wadman <mattias.wadman@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c2d689c56 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
8283586dce
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD97iH0 / COMPOSE_DD137iL0
...
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int');
Fixes: 6500/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-4523620274536448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cb944fc7f1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
38fd80c656
avcodec/fic: Check available input space for cursor
...
Fixes: out of array read
Fixes: 6546/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FIC_fuzzer-6317064647081984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cb2f7ea96b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
d48738bd67
avcodec/g2meet: Check RGB upper limit
...
Fixes: runtime error: left shift of 1876744317 by 16 places cannot be represented in type 'int'
Fixes: 6799/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5115274731716608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4dd2c8b9ea )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:27 +02:00
Michael Niedermayer
716ab0f2f4
avcodec/jpeg2000dec: Fix undefined shift in the jpeg2000_decode_packets_po_iteration() CPRL case
...
Fixes: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 7955/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-6016721977606144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 652ba72ed3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:26 +02:00
Michael Niedermayer
083c48e6d9
avcodec/jpeg2000dec: Skip init for component in CPRL if nothing is to be done
...
Fixes: assertion failure
Fixes: 7949/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-4819602782552064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a96c131eb5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:26 +02:00
Michael Niedermayer
6315215e5c
avcodec/g2meet: Change order of operations to avoid undefined behavior
...
Fixes: signed integer overflow: 65280 * 196032 cannot be represented in type 'int'
Fixes: 7279/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5977332473921536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a47451458 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:26 +02:00
Michael Niedermayer
90e9b76d3a
avcodec/flac_parser: Fix infinite loop
...
Fixes: crbug/827204
Reported-by: Frank Liberato <liberato@google.com >
Reviewed-by: Frank Liberato <liberato@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 15a2e35e9e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:26 +02:00
Michael Niedermayer
bb7b9238b4
avcodec/wavpack: Fix integer overflow in DEC_MED() / INC_MED()
...
Fixes: runtime error: signed integer overflow: 2147483637 + 128 cannot be represented in type 'int'
Fixes: 6701/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5358324934508544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6e95d80e6f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:26 +02:00
Michael Niedermayer
986747c9e2
avcodec/error_resilience: Fix integer overflow in filter181()
...
Fixes: runtime error: signed integer overflow: 197710 * 10923 cannot be represented in type 'int'
Fixes: 7010/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5667127596941312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1c97035e3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:26 +02:00
Michael Niedermayer
69f861be42
avcodec/h263dec: Check slice_ret in mspeg4 slice loop
...
Fixes infinite loop
Fixes: 6858/clusterfuzz-testcase-ffmpeg_AV_CODEC_ID_MSMPEG4V3_fuzzer-4681563766784000
Fixes: 6890/clusterfuzz-testcase-ffmpeg_AV_CODEC_ID_WMV1_fuzzer-4756103142309888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit de841fbea7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:26 +02:00
Michael Niedermayer
3d29170013
avcodec/elsdec: Fix memleaks
...
Fixes: 6798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5135899701542912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0bd0401336 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:26 +02:00
Michael Niedermayer
77121f6bff
avcodec/vc1_block: simplify ac_val computation
...
also fixes: runtime error: index 1456 out of bounds for type 'int16_t [16]'
Found-by: durandal_1707
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d06b01fc2d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:26 +02:00
Michael Niedermayer
bcc47312d4
avcodec/ffv1enc: Check that the crc + version combination is supported
...
The crc flag is only stored since version 3 thus before this crcs do not
work. We increase the version as needed same as we do with pix_fmts
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d9706f79c1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:26 +02:00
Stephan Holljes
2d975fff05
lavf/http.c: Free allocated client URLContext in case of error.
...
Signed-off-by: Stephan Holljes <klaxa1337@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b6b8c9265 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:26 +02:00
Michael Niedermayer
7784a7c1d8
avcodec/dsicinvideo: Fail if there is only a small fraction of the data available that comprises a full frame
...
Fixes: Timeout
Fixes: 6306/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DSICINVIDEO_fuzzer-5079253549842432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5549488bbf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:26 +02:00
Michael Niedermayer
bd6a181d5a
avcodec/dsicinvideo: Propagate errors from cin_decode_rle()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 942217b153 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:26 +02:00
Michael Niedermayer
45f03502c9
avcodec/dfa: Check dimension against maximum
...
The headers from where the dimensions are read in actual files
are limited to 16bit per component.
Fixes: Timeout
Fixes: 6305/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DFA_fuzzer-4824270749302784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d5a4fcfbb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:26 +02:00
Michael Niedermayer
5d42300731
avcodec/cinepak: Skip empty frames
...
Speeds up decoding from 3 to 0.1 seconds for 6302/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CINEPAK_fuzzer-5626371985375232
Fixes: Timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9033920bec )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:26 +02:00
Michael Niedermayer
4b0181dc00
avcodec/cinepak: move some checks prior to frame allocation
...
Speeds up decoding from 8 to 3 seconds for 6302/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CINEPAK_fuzzer-5626371985375232
Fixes: Timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2324ef1ff3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:26 +02:00
Rahul Chaudhry
f322de901d
swresample/arm: remove unintentional relocation.
...
Branch to global symbol results in reference to PLT, and when compiling
for THUMB-2 - in a R_ARM_THM_JUMP19 relocation. Some linkers don't
support this relocation (ld.gold), while others can end up truncating
the relocation to fit (ld.bfd).
Convert this branch through PLT into a direct branch that the assembler
can resolve locally.
See https://github.com/android-ndk/ndk/issues/337 for background.
The current workaround is to disable neon during gstreamer build,
which is not optimal and can be reverted after this patch:
41556c4157
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b22db4f465 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:26 +02:00
Michael Niedermayer
f4e2ac296d
doc/APIchanges: Fix typos in hashes
...
Thanks-to: Moritz Barsnick <barsnick@gmx.net > for finding the correct ones
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec8a5262b0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-16 19:06:26 +02:00
James Almer
003be3e49e
avdevice/iec61883: free the private context at the end
...
Fixes part of ticket #7146 .
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 5079e96bcc )
2018-04-18 23:02:59 -03:00
James Almer
bc07879bc5
avdevice/iec61883: return reference counted packets
...
Fixes part of ticket #7146 , dealing with leaks of packet data since
commit 87c8812270 .
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit b8629654c6 )
2018-04-18 23:02:55 -03:00
Michael Niedermayer
93e2cb4511
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 23:11:26 +02:00
Michael Niedermayer
d4b5ffeb57
avformat/utils: Check cur_dts in update_initial_timestamps() more
...
Fixes: runtime error: signed integer overflow: 18133149658382192 - -9223090561878065151 cannot be represented in type 'long long'
Fixes: crbug 831552
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 37d46dc21d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 23:10:00 +02:00
Michael Niedermayer
b8ef20becf
avcodec/utils: Enforce minimum width also for VP5/6
...
Fixes: out of array access
Fixes: poc_0411
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Tested-by: GwanYeong Kim <gy741.kim@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 544324827e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 23:09:12 +02:00
Michael Niedermayer
d7bda29820
avcodec/truemotion2: Propagate out of bounds error from GET_TOK()
...
Fixes: Timeout
Fixes: 6389/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5695918121680896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f6304af234 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 23:00:30 +02:00
Michael Niedermayer
01645d5915
avformat/utils: Fix integer overflow in end time calculation in update_stream_timings()
...
Fixes: crbug 829153
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c48ceff786 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 22:59:22 +02:00
Michael Niedermayer
7af6fba145
Update for 3.3.7
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 01:54:06 +02:00
James Almer
3e3704da0c
avformat/utils: fix mixed declarations and code
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 31de45d20b )
2018-04-13 01:20:14 +02:00
Michael Niedermayer
6de499caed
avcodec/mjpegdec: Check input buffer size.
...
Fixes: Timeout
Fixes: 6381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-5665032743419904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8d381b57fd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
41458534aa
avcodec/h264_slice: Fix integer overflow with last_poc
...
Fixes: signed integer overflow: 2147483646 - -2816 cannot be represented in type 'int'
Fixes: crbug 823145
Reported-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c02cd8ca0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
9b56e65e8c
avformat/mov: Fix extradata memleak
...
Fixes: crbug 822705
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a8133119c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Matt Wolenetz
9b1a4da668
lavc/libopusdec: Allow avcodec_open2 to call .close
...
If there is a decoder initialization failure detected in avcodec_open2
after .init is called, allow graceful decoder .close to prevent leaking
libopus decoder allocations.
BUG=828526
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e43e97f0e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
c9452899db
avcodec/movtextdec: Check style_start/end
...
Limits based on 3GPP TS 26.245 V14.0.0
Fixes: Timeout
Fixes: 6377/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOVTEXT_fuzzer-5175929115508736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Philip Langdale <philipl@overt.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 249aca8f98 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
0e5946d5b2
avcodec/aacsbr_fixed: Fix integer overflow in sbr_hf_assemble()
...
Fixes: runtime error: signed integer overflow: 2052929346 + 204817098 cannot be represented in type 'int'
This was missed in b1bef755f6
Fixes: 5275/clusterfuzz-testcase-minimized-5367635958038528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c837918f50 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
23f13130f1
libavcodec/rv34: error out earlier on missing references
...
Fixes visual corruption on seeking
Fixes: downloadTest_clip_24M.rmvb
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6cd81d68c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Hendrik Schreiber
30c26bb78f
swresample/swresample: Fix for seg fault in swr_convert_internal() -> sum2_float during dithering.
...
Removed +len1 in call to s->mix_2_1_f() as I found no logical explanation for it. After removal, problem was gone.
Signed-off-by: Hendrik Schreiber <hs@tagtraum.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 647fd4b829 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
ae2c159b87
avcodec/aacdec_fixed: Fix integer overflow in apply_independent_coupling_fixed()
...
I was not able to reproduce this, this fix is based on just the fuzzer log.
Fixes: 4959/clusterfuzz-testcase-minimized-6035350934781952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 197a4e8fee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
1d3c141af4
avcodec/cscd: Error out when LZ* decompression fails
...
Fixes: Timeout
Fixes: 6304/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CSCD_fuzzer-5754772461191168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d52be5d4e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
heimdallr
3f949b7a64
avcodec/imgconvert: Fix loss mask bug in avcodec_find_best_pix_fmt_of_list()
...
example:
AVPixelFormat pixFmts[] = { AV_PIX_FMT_RGB24, AV_PIX_FMT_RGBA };
int loss = 0;
AVPixelFormat best = avcodec_find_best_pix_fmt_of_list(pixFmts, AV_PIX_FMT_BGRA, 1, &loss);
best is AV_PIX_FMT_RGB24. But AV_PIX_FMT_RGBA is better.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 354b26a394 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
49336482fd
avfilter/vf_signature: use av_strlcpy()
...
Fixes: out of array access
Found-by: Kira <kira_cxy@foxmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 35eeff30ca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
15d4dc0da1
avcodec/utvideodec: Set pro flag based on fourcc
...
This avoids mixing 8bit variants with pro and 10bit with non pro mode.
Fixes: out of array read
Fixes: poc_03_30.avi
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47b7c68ae5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
d79b274acc
avcodec/wmalosslessdec: Fix null pointer dereference in decode_frame()
...
Fixes: 2018_03_23_poc.wav
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea15915b2d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
769cb89738
avcodec/tableprint_vlc: Fix build failure with --enable-hardcoded-tables
...
Found-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c75438b89 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
8a89cce372
avformat/mov: Move +1 in check to avoid hypothetical overflow in add_ctts_entry()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eb60b9d3aa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
899d40c17f
avcodec/get_bits: Make sure the input bitstream with padding can be addressed
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e529fe7633 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
a89b45b492
avformat/mov: Check STSC and remove invalid entries
...
Fixes assertion failure
Fixes: crbug 822547, crbug 822666 and crbug 823009
Affects: aark15sd_9A62E2FA.mp4
Found-by: ClusterFuzz
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e67447a4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
5b586f0bc8
avcodec/nuv: rtjpeg with dimensions less than 16 would result in no decoded pixels thus reject it
...
Fixes: Timeout
Fixes: 6297/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-4882404863901696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 939440ad1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
719b9b673c
avcodec/nuv: Check for minimum input size for uncomprssed and rtjpeg
...
Fixes: Timeout
Fixes: 6297/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-4882404863901696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ee3265dbe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
02bf1c617c
avcodec/wmalosslessdec: Reset num_saved_bits on error path
...
Fixes: NULL pointer dereference
Fixes: poc-201803.wav
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 64c9ce0abc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
edfe9ae63b
avformat/mov: Fix integer overflows related to sample_duration
...
Fixes: runtime error: signed integer overflow: -9166684017437101870 + -2495066639299164439 cannot be represented in type
Fixes: Chromium bug 791349
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f37082827 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
3a29fda42a
avformat/oggparsedaala: Do not adjust AV_NOPTS_VALUE
...
Fixes: potential signed integer overflow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f655ddfb47 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
e61cdbe271
avformat/oggparseogm: Check lb against psize
...
No testcase, this was found during code review
Found-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3e7c847aaf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
e0a08c833d
avformat/oggparseogm: Fix undefined shift in ogm_packet()
...
Fixes: shift exponent 48 is too large for 32-bit type 'int'
Fixes: Chromium bug 786793
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 010b7b30b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
8cf7205a72
avformat/avidec: Fix integer overflow in cum_len check
...
Fixes: signed integer overflow: 3775922176 * 4278190080 cannot be represented in type 'long'
Fixes: Chromium bug 791237
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 06e092e781 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
42bd425205
avformat/oggparsetheora: Do not adjust AV_NOPTS_VALUE
...
Fixes: Chromium bug 795653
Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'long'
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 02ecda4aba )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
e89d8ed7cb
avformat/utils: Fix integer overflow of fps_first/last_dts
...
Fixes: runtime error: signed integer overflow: 7738135736989908991 - -7898362169240453118 cannot be represented in type 'long'
Fixes: Chromium bug 796778
Reported-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b1362e408 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
fef832c188
avformat/oggdec: Fix metadata memleak on multiple headers
...
Fixes: Chromium bug 800123
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit da069e9c68 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
6daa205cd3
libavformat/oggparsevorbis: Fix memleak on multiple headers
...
Fixes: Chromium bug 800123
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3934aa495d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
e908a595db
avcodec/truemotion2rt: Check input buffer size
...
Fixes: Timeout
Fixes: 6250/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2RT_fuzzer-5479814011027456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b5c29b6c2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
c3e774784b
avcodec/g2meet: Check tile dimensions with av_image_check_size2()
...
Fixes: OOM
Fixes: 6216/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-4983807968018432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3981fb8d2a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
4d45d5b606
avcodec/exr: fix invalid shift in unpack_14()
...
Fixes: 6154/clusterfuzz-testcase-minimized-5762231061970944
Fixes: runtime error: shift exponent 63 is too large for 32-bit type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 49062a9017 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
5909508e8d
avcodec/bintext: sanity check dimensions
...
Fixes: Timeout
Fixes: 6277/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XBIN_fuzzer-6047202288861184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 090c0abff9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
bafb13dc0f
avcodec/utvideodec: Check subsample factors
...
Fixes: Out of array read
Fixes: heap_poc
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7414d0bda7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
bcc6d40928
avcodec/smc: Check input packet size
...
Fixes: Timeout
Fixes: 6261/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMC_fuzzer-5811309653262336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0293663483 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
f3562ee6fc
avcodec/cavsdec: Check alpha/beta offset
...
Fixes: Integer overflow
Fixes: 6183/clusterfuzz-testcase-minimized-6269224436629504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ae2eb04648 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
b9d5b1f05d
avcodec/diracdec: Fix integer overflow in mv computation
...
Fixes: signed integer overflow: -2072 + -2147483646 cannot be represented in type 'int'
Fixes: 6097/clusterfuzz-testcase-minimized-5034145253163008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47e65ad63b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
4018d8586f
avcodec/h264_parse: Clear invalid chroma weights in ff_h264_pred_weight_table()
...
Fixes: 6037/clusterfuzz-testcase-minimized-5030249784934400
Fixes: signed integer overflow: 256 * 16992036 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 85c85fffff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
b172815c3c
avcodec/aacdec_templat: Fix integer overflow in apply_ltp()
...
Fixes: signed integer overflow: -1625276744 + -1041893960 cannot be represented in type 'int'
Fixes: 5948/clusterfuzz-testcase-minimized-5791479856365568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 33fe17bdc8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
1a387f1ce6
avcodec/jpeg2000dwt: Fix integer overflows in sr_1d53()
...
Fixes: 5918/clusterfuzz-testcase-minimized-5120505435652096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 793347a545 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
205689ae8a
avcodec/diracdec: Use int64 in global mv to prevent overflow
...
Fixes: runtime error: signed integer overflow: 361 * -6295541 cannot be represented in type 'int'
Fixes: 5911/clusterfuzz-testcase-minimized-6450382197751808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cbcbefdc3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
af5c12c029
avcodec/dxtory: Remove code that corrupts dimensions
...
Fixes: Timeout
Fixes: 5796/clusterfuzz-testcase-minimized-5206729085157376
Does someone have a valid sample that triggers this path ?
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3748746a4d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
93a16aebf2
avcodec/dirac_dwt_template: Fix Integer overflow in horizontal_compose_dd137i()
...
Fixes: 5894/clusterfuzz-testcase-minimized-5315325420634112
Fixes: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 647fa49495 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
37cd7f3375
avcodec/hevcdec: Check luma/chroma_log2_weight_denom
...
Fixes: signed integer overflow: 3 + 2147483647 cannot be represented in type 'int'
Fixes: 5888/clusterfuzz-testcase-minimized-5634701067812864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f82dd4c09b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
1a4f8de03d
avcodec/jpeg2000dec: Use av_image_check_size2()
...
Fixes: OOM
Fixes: 5733/clusterfuzz-testcase-minimized-4906757966004224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 01370b31ac )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
2a85ead5a3
avcodec/vp8: Check for bitstream end before vp7_fade_frame()
...
Fixes: Timeout
Fixes: 5653/clusterfuzz-testcase-5497680018014208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit de675648ce )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
659a23e89f
avcodec/exr: Check remaining bits in last get code loop
...
Fixes: runtime error: shift exponent -7 is negative
Fixes: 3902/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6081926122176512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dd8351b118 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
519d48c861
avutil/common: Fix integer overflow in av_clip_uint8_c() and av_clip_uint16_c()
...
Fixes: 5567/clusterfuzz-testcase-minimized-5769966247739392
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab6f571ef7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
878fc42a90
avcodec/h264_cabac: Tighten allowed coeff_abs range
...
Fixes: integer overflows
Reported-by: "Xiaohan Wang (王消寒)" <xhwang@chromium.org >
Based on limits in "8.5 Transform coefficient decoding process and picture
construction process prior to deblocking filter process"
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f26a63c4ee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Xiaohan Wang
e8fb74c0c9
avcodec/h264_cavlc: Set valid qscale value in ff_h264_decode_mb_cavlc()
...
When ff_h264_decode_mb_cavlc() failed due to wrong sl->qscale values,
e.g. dquant out of range, set the qscale to be a valid value before
returning -1 and exiting the function. The qscale value can be used
later e.g. in loop filter.
BUG=806122
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 71f39de2a5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
76a886dae3
avcodec/vp3: Error out on invalid num_coeffs in unpack_vlcs()
...
This fixes a hypothetical integer overflow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f2318aee8c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
f03616d2a4
avcodec/mpeg4videodec: Ignore multiple VOL headers
...
Fixes: Ticket7005
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 63a4bdbf3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
0df3ad79c7
avcodec/vp3: Check eob_run
...
Fixes: out of array access
Fixes: 5919/clusterfuzz-testcase-minimized-5859311382167552
Fixes: special case for theora (untested due to lack of sample)
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 570023eab3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
65fc03589f
avcodec/pafvideo: Check allocated frame size
...
Fixes: OOM
Fixes: 5549/clusterfuzz-testcase-minimized-5390553567985664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 66acb63028 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
55e6c6b5fe
avcodec/scpr: Fix reading a pixel before the first
...
Fixes: 5540/clusterfuzz-testcase-minimized-6122458273808384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0fb33a8289 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Nekopanda
66881cf2b5
avcodec/mpeg2dec: Fix field selection for skipped macroblocks
...
For B field pictures, the spec says,
> The prediction shall be made from the field of the same parity as the field being predicted.
I did it.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b154cb3e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
838d02fcff
avcodec/huffyuvdec: Check input buffer size
...
Fixes: Timeout
Fixes: 5487/clusterfuzz-testcase-4696837035393024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 08c220d26c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
0322f78177
avcodec/utvideodec: Fix bytes left check in decode_frame()
...
Fixes: out of array read
Fixes: poc-2017.avi
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 118e1b0b33 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
4d4656e8cd
avcodec/wavpack: Fix integer overflow in FFABS
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 5396/clusterfuzz-testcase-minimized-6558555529281536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e50bd61e4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
a97335b1b3
avcodec/aacsbr_fixed: Fix overflows in rounding in sbr_hf_assemble()
...
Fixes: runtime error: signed integer overflow: 2052929346 + 204817098 cannot be represented in type 'int'
Fixes: 5275/clusterfuzz-testcase-minimized-5367635958038528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b1bef755f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
d07a0ae1af
avcodec/exr: Fix memleaks in decode_header()
...
Fixes: 4793/clusterfuzz-testcase-minimized-5707366629638144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a2560a977 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
55f9c21363
avcodec/dirac_dwt: Fix several integer overflows
...
Fixes: runtime error: signed integer overflow: -2146071175 + -268479557 cannot be represented in type 'int'
Fixes: 5237/clusterfuzz-testcase-minimized-4569895275593728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fe1e6c06d0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
38384cdd99
avcodec/indeo5: Do not leave frame_type set to an invalid value
...
Fixes: null pointer dereference
Fixes: 5264/clusterfuzz-testcase-minimized-4621956621008896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ff9f17851 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
4019c2a67c
avcodec/hevc_ps: Check log2_sao_offset_scale_*
...
Fixes: 4868/clusterfuzz-testcase-minimized-6236542906400768
Fixes: runtime error: shift exponent 126 is too large for 32-bit type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a75a75c62 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Aman Gupta
bb5748ec9d
avcodec/hevc_ps: extract SPS fields required for hvcC construction
...
Signed-off-by: Aman Gupta <aman@tmm1.net >
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
90cfaff0bb
avcodec/mpeg4videodec: Avoid possibly aliasing violating casts
...
Found-by: kierank
Reviewed-by: Kieran Kunhya <kieran618@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d4967c04e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
093c80747b
avcodec/get_bits: Document the return code of get_vlc2()
...
Found-by: kierank
Reviewed-by: Kieran Kunhya <kieran618@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a94ff4ccd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
61a911d007
avcodec/mpeg4videodec: Check mb_num also against 0
...
The spec implies that 0 is invalid in addition to the existing checks
Found-by: <kierank>
Reviewed-by: Kieran Kunhya <kieran618@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 05f4703a16 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
d74839d793
avfilter/vf_transpose: Fix used plane count.
...
Fixes out of array access
Fixes: poc.mp4
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c6939f65a1 )
(cherry picked from commit 3f621455d6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
aec30d0da9
avcodec/hevc_cabac: Check prefix so as to avoid invalid shifts in coeff_abs_level_remaining_decode()
...
I suspect that this can be limited tighter, but i failed to find anything
in the spec that would confirm that.
Fixes: 4833/clusterfuzz-testcase-minimized-5302840101699584
Fixes: runtime error: left shift of 134217730 by 4 places cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a026a3efae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
dbe356a009
avcodec/mjpegdec: Fix integer overflow in DC dequantization
...
Fixes: runtime error: signed integer overflow: -65535 * 65312 cannot be represented in type 'int'
Fixes: 4900/clusterfuzz-testcase-minimized-5769019744321536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1bfc1aa004 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
ce82d4722b
avcodec/dxtory: Fix bits left checks
...
Fixes: Timeout
Fixes: 4863/clusterfuzz-testcase-6347354178322432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6e1a167c55 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
fb27cebc93
avcodec/hevc_cabac: Move prefix check in coeff_abs_level_remaining_decode() down
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 94d4237a7a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
162bbc22e2
avcodec/truemotion2: Fix integer overflow in TM2_RECALC_BLOCK()
...
Fixes: signed integer overflow: 1477974040 - -1877995504 cannot be represented in type 'int'
Fixes: 4861/clusterfuzz-testcase-minimized-4570316383715328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 56a53340ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
60bc7a6ec0
avcodec/snowdec: Fix integer overflow before htaps check
...
Fixes: runtime error: signed integer overflow: -1094995529 * 2 cannot be represented in type 'int'
Fixes: 4828/clusterfuzz-testcase-minimized-5100849937252352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2eecf3cf8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
a9fb2f8c80
avcodec/ulti: Check number of blocks at init
...
Fixes: Timeout
Fixes: 4832/clusterfuzz-testcase-4699096590843904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 725353525e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
488a6ae7e5
avcodec/jpeg2000: Check sum of sizes of band->prec before allocating
...
Fixes: OOM
Fixes: 4810/clusterfuzz-testcase-minimized-6034253235093504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6887e41243 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
eecb0ecf51
avcodec/ac3dec_fixed: Fix integer overflow in scale_coefs()
...
Fixes: runtime error: signed integer overflow: 2147483520 + 128 cannot be represented in type 'int'
Fixes: 4800/clusterfuzz-testcase-minimized-6110372403609600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1f38c7589 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Nikolas Bowe
68f9a9fe4b
avformat/lrcdec: Fix memory leak in lrc_read_header()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ef5994e09d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Nikolas Bowe
980fe1b7a6
avformat/matroskadec: Fix float-cast-overflow undefined behavior in matroska_parse_tracks()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e07649e618 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Carl Eugen Hoyos
68ca7aefb2
configure: bump year
...
Happy new year!
(cherry picked from commit bddf31ba75 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
7965ffbeb1
avcodec/utils: Avoid hardcoding duplicated types in sizeof()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 860d991fcd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
d8e501de42
avcodec/arm/sbrdsp_neon: Use a free register instead of putting 2 things in one
...
Fixes high pitched shriek
Fixes: 25420848_1478428308873746_4255813235963330560_n.mp4
Reported-by: Dale Curtis <dalecurtis@google.com >
Reviewed-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7dbbb75ee3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
014ba5c737
avcodec/h264addpx_template: Fixes integer overflows
...
Fixes: signed integer overflow: 512 + 2147483491 cannot be represented in type 'int'
Fixes: 4780/clusterfuzz-testcase-minimized-4709066174627840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d6945aeee4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
bf7715fd29
avcodec/dirac_dwt: Fix overflows in COMPOSE_HAARiH0/COMPOSE_HAARiL0
...
Fixes: 4830/clusterfuzz-testcase-minimized-5255392054476800
Fixes: signed integer overflow: 2147483646 - -7 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e62a23734 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
347744121b
avcodec/diracdec: Fix integer overflow with quant
...
Fixes: signed integer overflow: 2 + 2147483646 cannot be represented in type 'int'
Fixes: 4792/clusterfuzz-testcase-minimized-6322450775146496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eaa9317589 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
ba2f8469ba
avcodec/opus_parser: Check payload_len in parse_opus_ts_header()
...
Fixes: clusterfuzz-testcase-minimized-6134545979277312
Fixes: crbug 797469
Reported-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1bcd7fefcb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
e4afafaa7e
avcodec/jpeg2000dsp: Fix integer overflows in ict_int()
...
Fixes: signed integer overflow: 46802 * -71230 cannot be represented in type 'int'
Fixes: 4756/clusterfuzz-testcase-minimized-4812495563784192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b3192c64b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
d81bfc042c
avcodec/h264_slice: Do not attempt to render into frames already output
...
Fixes: null pointer dereference
Fixes: 4698/clusterfuzz-testcase-minimized-5096956322906112
This testcase does not reproduce the issue before 03b82b3ab9
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 476665d4de )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
Michael Niedermayer
05a9266894
avcodec/dnxhddec: Check dc vlc
...
Fixes: signed integer overflow: 1024 + 2147483640 cannot be represented in type 'int'
Fixes: 4671/clusterfuzz-testcase-minimized-6027464343027712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b2be76c0a4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-04-13 00:35:15 +02:00
James Almer
e2edfff9a8
avformat/hvcc: zero initialize the nal buffers past the last written byte
...
Prevents use of uninitialized values.
Fixes ticket #7038 .
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 9482ec1b20 )
2018-02-24 00:38:00 -03:00
Tobias Rapp
fea559c3d5
swresample/rematrix: fix update of channel matrix if input or output layout is undefined
...
Prefer direct in/out channel count values over channel layout, when
available. Fixes a pan filter bug (ticket #6790 ).
Signed-off-by: Tobias Rapp <t.rapp@noa-archive.com >
(cherry picked from commit 6325bd3717 )
2018-02-19 09:06:29 +01:00
Timo Rothenpieler
09419de216
configure: add support for libnpp* from cuda sdk 9
...
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2018-01-28 14:04:08 +01:00
Timo Rothenpieler
dfd2f4ee26
avcodec/nvenc: also clear data pointer after unregistering a resource
...
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2018-01-28 13:39:35 +01:00
Timo Rothenpieler
d68d537f0a
avcodec/nvenc: add some more error case checks
...
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2018-01-28 13:39:34 +01:00
Timo Rothenpieler
4bb40c32ee
avcodec/nvenc: unregister input resource when unmapping
...
Currently the resource is only ever unregistered when the
registered_frames array is fully in use and an unmapped entry is re-used
and cleaned up.
I'm pretty sure the frame will have been cleaned up before that happens,
so I'm kinda surprised this never blew up.
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2018-01-28 13:39:33 +01:00
Timo Rothenpieler
802ebfae3b
avcodec/nvenc: refcount input frame mappings
...
If some logic like vsync in ffmpeg.c duplicates frames, it might pass
the same frame twice, which will result in a crash due it being
effectively mapped and unmapped twice.
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2018-01-28 13:39:30 +01:00
James Almer
f85b102c80
avformat/libssh: check the user provided a password before trying to use it
...
Fixes ticket #6413
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 8ddb6820bd )
2018-01-11 10:37:53 -03:00
James Almer
03292829aa
changelog: update with previous commit
...
Signed-off-by: James Almer <jamrial@gmail.com >
2017-12-30 19:38:30 -03:00
Luca Barbato
96e8400553
x264: Support version 153
...
It has native simultaneus 8 and 10 bit support.
(cherry picked from commit c6558e8840 )
2017-12-30 19:36:08 -03:00
Michael Niedermayer
54897d7466
Update for 3.3.6
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:13:19 +01:00
Michael Niedermayer
f2b83f4aba
avcodec/exr: Check buf_size more completely
...
Fixes: Out of heap array read
Fixes: 4683/clusterfuzz-testcase-minimized-6152313673613312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 903be5e4f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Michael Niedermayer
1bc06771d8
avcodec/flacdec: Fix overflow in multiplication in decode_subframe_fixed()
...
Fixes: signed integer overflow: 2 * 1629495328 cannot be represented in type 'int'
Fixes: 4716/clusterfuzz-testcase-minimized-5835915940331520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d23f7a096 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Michael Niedermayer
2cde8dc055
avcodec/hevcdsp_template: Fix Invalid shifts in put_hevc_qpel_bi_w_h() and put_hevc_qpel_bi_w_w()
...
Fixes: left shift of negative value -1
Fixes: 4690/clusterfuzz-testcase-minimized-6117482428366848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d135f3c514 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Michael Niedermayer
0da741ba6b
avcodec/flacdec: avoid undefined shift
...
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 4688/clusterfuzz-testcase-minimized-6572210748653568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 560daf8891 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Michael Niedermayer
b66e3e321f
avcodec/hevcdsp_template.c: Fix undefined shift in FUNC(dequant)
...
Fixes: runtime error: left shift of negative value -180
Fixes: 4626/clusterfuzz-testcase-minimized-5647837887987712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c9ab5ef9c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Michael Niedermayer
1d9830cba3
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD97iH0() and COMPOSE_DD137iL0()
...
Fixes: runtime error: signed integer overflow: 2147483646 + 33554433 cannot be represented in type 'int'
Fixes: 4563/clusterfuzz-testcase-minimized-5438979567517696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4d70fbeec8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Michael Niedermayer
41a706b912
avcodec/hevc_cabac: Fix integer overflow in ff_hevc_cu_qp_delta_abs()
...
Fixes: signed integer overflow: 2147483647 + 1073741824 cannot be represented in type 'int'
Fixes: 4555/clusterfuzz-testcase-minimized-4505532481142784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ee143558d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Michael Niedermayer
7a5c738963
tests/audiomatch: Add missing return code at the end of main()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65da5c56e6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Michael Niedermayer
bdba0f6786
avcodec/hevc_sei: Fix integer overflows in decode_nal_sei_message()
...
Fixes: signed integer overflow: 2147483520 + 255 cannot be represented in type 'int'
Fixes: 4554/clusterfuzz-testcase-minimized-4843714515042304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 991ef6e5b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Michael Niedermayer
badca11741
avcodec/hevcdsp_template: Fix undefined shift in put_hevc_qpel_bi_w_hv()
...
Fixes: runtime error: left shift of negative value -3
Fixes: 4524/clusterfuzz-testcase-minimized-6055590120914944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 439fbb9c8b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Kelly Ledford
b7c9f27ad6
libavfilter/af_dcshift.c: Fixed repeated spelling error
...
'threshhold' should be 'threshold'
Signed-off-by: Kelly Ledford <kelly.ledford@intel.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc219082bb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Jun Zhao
603845225c
avfilter/formats: fix wrong function name in error message
...
Use perdefined micro __FUNCTION__ rather than hard coding function name
to fix wrong function name in error message.
Signed-off-by: Jun Zhao <jun.zhao@intel.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4280948702 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Michael Niedermayer
3d297038a9
avcodec/amrwbdec: Fix division by 0 in voice_factor()
...
The added value matches "Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS); LTE; Extended Adaptive Multi-Rate - Wideband (AMR-WB+) codec; Floating-point ANSI-C code (3GPP TS 26.304 version 14.0.0 Release 14)
Extended Adaptive Multi-Rate - Wideband (AMR-WB+) codec; Floating-point ANSI-C code"
Fixes: runtime error: division by zero
Fixes: 4415/clusterfuzz-testcase-minimized-4677752314658816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1d0817d56b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Michael Niedermayer
054188db10
avcodec/diracdsp: Fix integer overflow in PUT_SIGNED_RECT_CLAMPED()
...
Fixes: runtime error: signed integer overflow: 2147483646 + 2048 cannot be represented in type 'int'
Fixes: 4479/clusterfuzz-testcase-minimized-6529894147162112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 610dd74502 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Michael Niedermayer
454a2405ce
avcodec/dirac_dwt: Fix integer overflows in COMPOSE_DAUB97*
...
Fixes: 4478/clusterfuzz-testcase-minimized-4752113767809024
Fixes: runtime error: signed integer overflow: -2147483626 + -319489 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5e9a13a5a3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Nikolas Bowe
01ab4117dc
avcodec/extract_extradata_bsf: Fix leak discovered via fuzzing
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5a412a5c3c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Dale Curtis
39db2f9514
avcodec/vorbis: Fix another 1 << 31 > int32_t::max() with 1u.
...
Didn't notice this one when 9648cc6d was landed.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 95bacb521a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Dale Curtis
272a9687a7
Don't manipulate duration when it's AV_NOPTS_VALUE.
...
This leads to signed integer overflow.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit c5fd57f483 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Dale Curtis
9bc2f44c27
avcodec/vorbis: 1 << 31 > int32_t::max(), so use 1u << 31 instead.
...
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9648cc6d7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Dale Curtis
85ea121684
avformat/utils: Prevent undefined shift with wrap_bits > 64.
...
2LL << (wrap_bits=64 - 1) does not fit in int64_t; change the
code to use a uint64_t (2ULL) and add an av_assert2() to
ensure wrap_bits <= 64.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 03fbc0daa7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Michael Niedermayer
79ec638115
avcodec/j2kenc: Fix out of array access in encode_cblk()
...
Fixes: 4427/clusterfuzz-testcase-minimized-5106919271301120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0674087004 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Michael Niedermayer
c8bbddf057
avcodec/hevcdsp_template: Fix undefined shift in put_hevc_epel_bi_w_h()
...
Fixes: runtime error: left shift of negative value -127
Fixes: 4397/clusterfuzz-testcase-minimized-4779061080489984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0409d33311 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Michael Niedermayer
cead6c94c5
avcodec/mlpdsp: Fix signed integer overflow, 2nd try
...
The outputted bits should match what is used in the lossless check
Fixes: runtime error: signed integer overflow: -538697856 * 256 cannot be represented in type 'int'
Fixes: 4326/clusterfuzz-testcase-minimized-5689449645080576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 97c00edaa0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Michael Niedermayer
d5bdcd8a27
avcodec/kgv1dec: Check that there is enough input for maximum RLE compression
...
Fixes: Timeout
Fixes: 4271/clusterfuzz-testcase-4676667768307712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3aad94bf2b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Michael Niedermayer
7bc064d461
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_FIDELITYi*
...
Fixes: runtime error: signed integer overflow: -2143827186 - 7404944 cannot be represented in type 'int'
Fixes: 4354/clusterfuzz-testcase-minimized-4671122764201984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b6964f764 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Michael Niedermayer
70dc266342
avcodec/mpeg4videodec: Check also for negative versions in the validity check
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e7865ce41 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Dale Curtis
2de4eb6fec
Close ogg stream upon error when using AV_EF_EXPLODE.
...
Without this there can be multiple memory leaks for unrecognized
ogg streams.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bce8fc0754 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Dale Curtis
11a940adbc
Fix undefined shift on assumed 8-bit input.
...
decode_user_data() attempts to create an integer |build|
value with 8 bits of spacing for 3 components. However
each component is an int32_t, so shifting each component
is undefined for values outside of the 8 bit range.
This patch simply clamps input to 8-bits per component
and prints out a warning that the values were clamped.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7010dd98b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Dale Curtis
edd0cd21f4
Use ff_thread_once for fixed, float table init.
...
These tables are static so they should only be initialized once
instead of on every call to ff_mpadsp_init().
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5eaaffaf64 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Dale Curtis
362967fec6
Fix leak of frame_duration_buffer in mov_fix_index().
...
Should be unconditionally freed at the end of mov_fix_index() in
case it hasn't been used during the fix up.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Reviewed-by: Sasi Inguva <isasi-at-google.com@ffmpeg.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d073be2291 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Jacob Trimble
a0eccf673c
avformat/mov: Propagate errors in mov_switch_root.
...
Signed-off-by: Jacob Trimble <modmaker@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d9cf3bf16 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:32 +01:00
Michael Niedermayer
fa29141e34
avcodec/hevcdsp_template: Fix invalid shift in put_hevc_epel_bi_w_v()
...
Fixes: runtime error: left shift of negative value -255
Fixes: 4037/clusterfuzz-testcase-minimized-5290998163832832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d88586e47 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
f4e25620a1
avcodec/mlpdsp: Fix undefined shift ff_mlp_pack_output()
...
Fixes: runtime error: left shift of negative value -7862264
Fixes: 4074/clusterfuzz-testcase-minimized-4516104123711488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f7f70738e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
1c9af4d7a8
avcodec/zmbv: Check that the buffer is large enough for mvec
...
Fixes: Timeout
Fixes: 4143/clusterfuzz-testcase-4736864637419520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ab9568a2c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
78a0356fae
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD137iL0()
...
Fixes: 4035/clusterfuzz-testcase-minimized-6479308925173760
Fixes: runtime error: signed integer overflow: 9 * 402653183 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73964680d7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
4a412dc6ad
avcodec/wmv2dec: Check end of bitstream in parse_mb_skip() and ff_wmv2_decode_mb()
...
Fixes: Timeout
Fixes: 3200/clusterfuzz-testcase-5750022136135680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65e0a7c473 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
01439fe1e1
avcodec/snowdec: Check for remaining bitstream in decode_blocks()
...
Fixes: Timeout
Fixes: 3142/clusterfuzz-testcase-5007853163118592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4527ec2216 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
488c2e8487
avcodec/snowdec: Check intra block dc differences.
...
Fixes: Timeout
Fixes: 3142/clusterfuzz-testcase-5007853163118592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c3b9bbcc6e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Fredrik Hubinette
74104d2dc0
avformat/mov: Check size of STSC allocation
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6fdd75fe6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
066c657376
avcodec/vc2enc: Clear coef_buf on allocation
...
Fixes: Use of uninitialized memory
Fixes: assertion failure
Reviewed-by: <atomnuker>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6d00905f81 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
aac7ca7a36
avcodec/h264dec: Fix potential array overread
...
add padding before scantable arrays
See: 522d850e68
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 380b48fb9f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
96fe37a339
avcodec/x86/mpegvideodsp: Fix signedness bug in need_emu
...
Fixes: out of array read
Fixes: 3516/attachment-311488.dat
Found-by: Insu Yun, Georgia Tech.
Tested-by: wuninsu@gmail.com
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 58cf31cee7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
b3067f95c9
avcodec/aacpsdsp_template: Fix integer overflows in ps_decorrelate_c()
...
Fixes: runtime error: signed integer overflow: 1939661764 - -454942263 cannot be represented in type 'int'
Fixes: 3191/clusterfuzz-testcase-minimized-5688798451073024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2afe05402f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
8be48f1c9a
avcodec/aacdec_fixed: Fix undefined shift
...
Fixes: runtime error: left shift of negative value -801112064
Fixes: 3492/clusterfuzz-testcase-minimized-5784775283441664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fca198fb5b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
c1d31ccfac
avcodec/mdct_*: Fix integer overflow in addition in RESCALE()
...
Fixes: runtime error: signed integer overflow: 1219998458 - -1469874012 cannot be represented in type 'int'
Fixes: 3443/clusterfuzz-testcase-minimized-5369987105554432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 770c934fa1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
c8027878d0
avcodec/snowdec: Fix integer overflow in header parsing
...
Fixes: 3984/clusterfuzz-testcase-minimized-5265759929368576
Fixes: runtime error: signed integer overflow: -1085585801 + -1094995529 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c897a92858 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
286e3bf174
avcodec/cngdec: Fix integer clipping
...
Fixes: runtime error: value -36211.7 is outside the range of representable values of type 'short'
Fixes: 2992/clusterfuzz-testcase-6649611793989632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 51090133b3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
19fb467fcb
avcodec/sbrdsp_fixed: Fix integer overflow in shift in sbr_hf_g_filt_c()
...
Fixes: runtime error: shift exponent 66 is too large for 64-bit type 'long long'
Fixes: 3642/clusterfuzz-testcase-minimized-5443853801750528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 981e99ab99 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
67208cf992
avcodec/aacsbr_fixed: Fix division by zero in sbr_gain_calc()
...
Fixes: 3642/clusterfuzz-testcase-minimized-5443853801750528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d1dec4668 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
56a56c0cb5
avutil/softfloat: Add FLOAT_MIN
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e34fe61bf4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
d3264c496a
avcodec/h264idct_template: Fix integer overflows in ff_h264_idct8_add()
...
Fixes: runtime error: signed integer overflow: -503316480 + -2013265038 cannot be represented in type 'int'
Fixes: 3805/clusterfuzz-testcase-minimized-6578427831255040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e131b8cedb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
ffa2d60ac5
avcodec/xan: Check for bitstream end in xan_huffman_decode()
...
Fixes: Timeout
Fixes: 3707/clusterfuzz-testcase-6465922706440192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4b51437dcc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
4a47195d2a
avcodec/exr: fix undefined shift in pxr24_uncompress()
...
Fixes: runtime error: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 3787/clusterfuzz-testcase-minimized-5728764920070144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 66f0c958bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Luca Barbato
912448efc1
avformat: Free the internal codec context at the end
...
Avoid a use after free in avformat_find_stream_info.
(cherry picked from commit 9e4a5eb51b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
6fb7e324fe
avcodec/h264idct_template: Fix integer overflows in ff_h264_idct8_add()
...
Fixes: runtime error: signed integer overflow: 924846844 + 1457520640 cannot be represented in type 'int'
Fixes: 3416/clusterfuzz-testcase-minimized-6125587682820096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b739e1cb8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
faa84a0c06
avcodec/xan: Improve overlapping check
...
Fixes: memcpy-param-overlap
Fixes: 3612/clusterfuzz-testcase-minimized-6393461273001984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e8fafef1db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
02612c3e3e
avcodec/aacdec_fixed: Fix integer overflow in apply_dependent_coupling_fixed()
...
Fixes: runtime error: signed integer overflow: 623487 * 536870912 cannot be represented in type 'int'
Fixes: 3594/clusterfuzz-testcase-minimized-4650622935629824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 41d96af2a7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
18fbf2622c
avcodec/aacdec_fixed: Fix integer overflow in predict()
...
Fixes: runtime error: signed integer overflow: -2110708110 + -82837504 cannot be represented in type 'int'
Fixes: 3547/clusterfuzz-testcase-minimized-6009386439802880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0976752420 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
3d6ffa2bb5
avcodec/jpeglsdec: Check for end of bitstream in ls_decode_line()
...
Fixes: 1773/clusterfuzz-testcase-minimized-4832523987189760
Fixes: Timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f80224ed19 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Niedermayer
b33d302195
avcodec/jpeglsdec: Check ilv for being a supported value
...
Fixes: 1773/clusterfuzz-testcase-minimized-4832523987189760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fe533628b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-30 21:11:31 +01:00
Michael Roitzsch
ca47e9ffdc
lavfi/af_pan: fix sign handling in channel coefficient parser
...
When a channel formula ends with a subtraction, the next formula will
otherwise have its first coefficient negated.
(cherry picked from commit 4f4e19914d )
2017-11-22 10:42:07 +01:00
Rostislav Pehlivanov
a7aac19933
vc2enc_dwt: pad the temporary buffer by the slice size
...
Since non-Haar wavelets need to look into pixels outside the frame, we
need to pad the buffer. The old factor of two seemed to be a workaround
that fact and only padded to the left and bottom. This correctly pads
by the slice size and as such reduces memory usage and potential
exploits.
Reported by Liu Bingchang.
Ideally, there should be no temporary buffer but the encoder is designed
to deinterleave the coefficients into the classical wavelet structure
with the lower frequency values in the top left corner.
Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com >
(cherry picked from commit 3228ac730c )
2017-11-09 02:10:51 +00:00
Fredrik Hubinette
670d3189e9
avformat/id3v2: fix leak in chapter parsing
...
Reviewed-on: https://chromium-review.googlesource.com/439405
Reviewed-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: James Almer <jamrial@gmail.com >
2017-10-26 13:51:03 -03:00
Michael Niedermayer
60b385a5bf
Update for 3.3.5
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:36:17 +02:00
Michael Niedermayer
b33434ec62
tests/ffserver.regression.ref: update checksums to what ffserver currently produces
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 431eccd61e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:34:42 +02:00
Michael Niedermayer
0ccb27e094
ffserver: Fix off by 1 error in path
...
Code suggested by ubitux
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 617f0c65e1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:34:42 +02:00
Michael Niedermayer
e8fd32b69f
avcodec/snowdec: Check mv_scale
...
Fixes: runtime error: signed integer overflow: 2 * -1094995530 cannot be represented in type 'int'
Fixes: 3512/clusterfuzz-testcase-minimized-4812747210489856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 393d6fc739 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:34:42 +02:00
Michael Niedermayer
20fd9217d8
avcodec/pafvideo: Check for bitstream end in decode_0()
...
Fixes: Timeout
Fixes: 3529/clusterfuzz-testcase-5057068371279872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c85329cd0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:34:42 +02:00
Michael Niedermayer
48933f28c2
avcodec/ffv1dec: Fix out of array read in slice counting
...
Fixes: test-201710.mp4
Found-by: 连一汉 <lianyihan@360.cn > and Zhibin Hu
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c20f4fcb74 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:34:42 +02:00
Michael Niedermayer
d13d3feba2
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_53iL0()
...
Fixes: runtime error: signed integer overflow: 2147483646 + 2 cannot be represented in type 'int'
Fixes: 3485/clusterfuzz-testcase-minimized-4940429332054016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bdee75a4e7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:34:42 +02:00
Michael Niedermayer
aa6c44c333
avcodec/mpeg_er: Clear mcsel in mpeg_er_decode_mb()
...
Fixes out of array read
Should fix: 3516/clusterfuzz-testcase-minimized-4608518562775040 (not reprodoceable)
Found-by: Insu Yun, Georgia Tech.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 127a362630 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:34:42 +02:00
Michael Niedermayer
0009272f94
avcodec/mpeg4videodec: Use 64 bit intermediates for sprite delta
...
Fixes: runtime error: signed integer overflow: -104713 * 65536 cannot be represented in type 'int'
Fixes: 3453/clusterfuzz-testcase-minimized-5555554657239040
Fixes: 3528/clusterfuzz-testcase-minimized-6283628420005888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e38f280fec )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:34:42 +02:00
Michael Niedermayer
7cc854ce15
avcodec/x86/lossless_videoencdsp: Fix warning: signed dword value exceeds bounds
...
Add () to regsize define
Suggested-by: Henrik Gramner <henrik@gramner.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 26ea142658 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:34:42 +02:00
Michael Niedermayer
0a231e7dd3
avcodec/x86/lossless_videoencdsp: Fix handling of small widths
...
Fixes out of array access
Fixes: crash-huf.avi
Regression since: 6b41b44149
This could also be fixed by adding checks in the C code that calls the dsp
Found-by: Zhibin Hu and 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df62b70de8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:34:42 +02:00
Michael Niedermayer
ab43bc50c0
avcodec/truemotion2: Fix integer overflows in tm2_high_chroma()
...
Fixes: runtime error: signed integer overflow: -1408475220 + -1408475220 cannot be represented in type 'int'
Fixes: 3336/clusterfuzz-testcase-minimized-5656839179993088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 44874b4f5e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:34:42 +02:00
Michael Niedermayer
4768b30b5b
avcodec/aacdec_template: Clear tns present flag on error
...
Fixes: 3444/clusterfuzz-testcase-minimized-6270352105668608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dcf9bae4a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:34:42 +02:00
Michael Niedermayer
6b9ffcdb2b
avcodec/proresdec2: SKIP_BITS() does not work with len=32
...
Fixes: invalid shift
Fixes: 3482/clusterfuzz-testcase-minimized-5446915875405824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c37138e01a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:34:42 +02:00
Michael Niedermayer
520daf8c0e
avcodec/hevcdsp_template: Fix undefined shift
...
Fixes: runtime error: left shift of negative value -255
Fixes: 3373/clusterfuzz-testcase-minimized-5604083912146944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fbdab6eca7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:34:42 +02:00
Michael Niedermayer
c54317a17e
avcodec/jpeg2000: Check that codsty->log2_prec_widths/heights has been initialized
...
Fixes: OOM
Fixes: 2225/clusterfuzz-testcase-minimized-5505632079708160
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 64e034da95 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:34:42 +02:00
Michael Niedermayer
ab845587d1
avcodec/takdec: Fix integer overflow in decode_lpc()
...
Fixes: runtime error: signed integer overflow: 16748560 + 2143729712 cannot be represented in type 'int'
Fixes: 3202/clusterfuzz-testcase-minimized-4988291642294272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d31f03a02 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:34:42 +02:00
Michael Niedermayer
4bc16930ef
avcodec/proresdec2: Check bits in DECODE_CODEWORD(), fixes invalid shift
...
Fixes: runtime error: shift exponent 42 is too large for 32-bit type 'unsigned int'
Fixes: 3410/clusterfuzz-testcase-minimized-5313377960198144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f5eaf0b59 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:34:42 +02:00
Michael Niedermayer
b5b52c0ca7
avcodec/takdec: Fix integer overflows in decode_subframe()
...
Fixes: runtime error: signed integer overflow: -1562477869 + -691460395 cannot be represented in type 'int'
Fixes: 3196/clusterfuzz-testcase-minimized-4528307146063872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3dabb9c69d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:34:42 +02:00
Michael Niedermayer
940659036f
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_FIDELITYi*()
...
Fixes: runtime error: signed integer overflow: 161 * 13872281 cannot be represented in type 'int'
Fixes: 3295/clusterfuzz-testcase-minimized-4738998142500864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 67da2685e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:34:42 +02:00
Michael Niedermayer
6d1ebb9def
avcodec/ffv1dec: Fix integer overflow in read_quant_table()
...
Fixes: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 3361/clusterfuzz-testcase-minimized-5065842955911168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d00fc952b6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:34:42 +02:00
Michael Niedermayer
4e341bd904
avcodec/svq3: Fix overflow in svq3_add_idct_c()
...
Fixes: runtime error: signed integer overflow: 2147392585 + 524288 cannot be represented in type 'int'
Fixes: 3348/clusterfuzz-testcase-minimized-4809500517203968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c933c5168 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:34:42 +02:00
Michael Niedermayer
bf6cd808be
avcodec/pngdec: Clean up on av_frame_ref() failure
...
Fixes: memleak
Fixes: 3203/clusterfuzz-testcase-minimized-4514553595428864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5480e82d77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 17:34:42 +02:00
James Almer
9f7042f9cd
avcodec/extract_extradata: return an error when buffer allocation fails
...
ret is 0 by default.
Reviewed-by: Mark Thompson <sw@jkqxz.net >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 7bae17e37a )
2017-09-13 17:26:52 -03:00
James Almer
e3a1c0491f
avcodec/hevc_ps: improve check for missing default display window bitstream
...
Fixes ticket #6644
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit c9a1cd08ea )
2017-09-11 22:27:05 -03:00
Michael Niedermayer
41479c83ae
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-12 02:32:11 +02:00
Michael Niedermayer
de260c7b34
avcodec/hevc_ps: Fix c?_qp_offset_list size
...
Fixes: runtime error: index 5 out of bounds for type 'int8_t const[5]'
Fixes:3175/clusterfuzz-testcase-minimized-4736774054084608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit abf3f9fa23 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-12 01:54:08 +02:00
Michael Niedermayer
0c5eb03aac
avcodec/shorten: Move buffer allocation and offset init to end of read_header()
...
They are time consuming operations, performing them after the other checks
improves the speed with damaged input dramatically.
Fixes: Timeout
Fixes: 2928/clusterfuzz-testcase-4992812120539136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 380659604f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-12 01:54:00 +02:00
Michael Niedermayer
eca53fd52b
Update for 3.3.4
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-11 14:54:47 +02:00
Michael Niedermayer
4f97556f54
avcodec/jpeg2000dsp: Fix multiple integer overflows in ict_int()
...
Fixes: runtime error: signed integer overflow: 22553 * -188962 cannot be represented in type 'int'
Fixes: 3042/clusterfuzz-testcase-minimized-5174210131394560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d025e7428 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-11 13:29:37 +02:00
Michael Niedermayer
32fa6ce64a
avcodec/hevcdsp_template: Fix undefined shift in put_hevc_pel_bi_w_pixels
...
Fixes: runtime error: left shift of negative value -95
Fixes: 3077/clusterfuzz-testcase-minimized-4684917524922368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c225da68cf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-11 13:29:18 +02:00
Michael Niedermayer
a295d1870a
avcodec/diracdec: Fix overflow in DC computation
...
Fixes: runtime error: signed integer overflow: 11896 + 2147483646 cannot be represented in type 'int'
Fixes: 3053/clusterfuzz-testcase-minimized-6355082062856192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5995856a4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-11 13:28:41 +02:00
Michael Niedermayer
b590758298
avcodec/scpr: optimize shift loop.
...
Speeds code up from 50sec to 15sec
Fixes Timeout
Fixes: 3242/clusterfuzz-testcase-5811951672229888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 981f04b2ae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-11 13:28:21 +02:00
Michael Niedermayer
8eb8882af5
avcodec/dirac_vlc: limit res_bits in APPEND_RESIDUE()
...
Fixes: runtime error: left shift of 1073741838 by 1 places cannot be represented in type 'int32_t' (aka 'int')
Fixes: 3279/clusterfuzz-testcase-minimized-4564805744590848
Suggested-by: <atomnuker>
Reviewed-by: <atomnuker>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d98d29a775 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Mark Wachsler
1df91b48a3
libavcodec/h264_parse: don't use uninitialized value when chroma_format_idc==0
...
When parsing a monochrome file, chroma_log2_weight_denom was used without
being initialized, which could lead to a bogus error message being printed, e.g.
[h264 @ 0x61a000026480] chroma_log2_weight_denom 24576 is out of range
It also could led to warnings using AddressSanitizer.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fde5c7dc79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
b61e5a878c
avformat/asfdec: Fix DoS in asf_build_simple_index()
...
Fixes: Missing EOF check in loop
No testcase
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit afc9c683ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
d9cf9f5af8
avformat/mov: Fix DoS in read_tfra()
...
Fixes: Missing EOF check in loop
No testcase
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9cb4eb7728 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
8a640fc7cb
avcodec/dirac_vlc: Fix invalid shift in ff_dirac_golomb_read_32bit()
...
Fixes: runtime error: shift exponent 64 is too large for 64-bit type 'residual' (aka 'unsigned long')
Fixes: 2838/clusterfuzz-testcase-minimized-6260066086813696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c595139f1f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
fef0ccc401
avcodec/dirac_dwt: Fix multiple overflows in 9/7 lifting
...
Fixes: runtime error: signed integer overflow: 1073901567 + 1073901567 cannot be represented in type 'int'
Fixes: 3124/clusterfuzz-testcase-minimized-454643435752652
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f71cd44147 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
73427f5c74
avcodec/diracdec: Fix integer overflow in INTRA_DC_PRED()
...
Fixes: runtime error: signed integer overflow: 1168175789 + 1168178473 cannot be represented in type 'int'
Fixes: 3081/clusterfuzz-testcase-minimized-4807564879462400
Fixes: 2844/clusterfuzz-testcase-minimized-5561715838156800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2a0823ae96 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
孙浩(晓黑)
9d3a7c82a6
avformat/mxfdec: Fix Sign error in mxf_read_primer_pack()
...
Fixes: 20170829B.mxf
Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com >
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d00fb9d70 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
孙浩(晓黑)
c01f799314
avformat/mxfdec: Fix DoS issues in mxf_read_index_entry_array()
...
Fixes: 20170829A.mxf
Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com >
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 900f39692c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
孙浩(晓黑)
e6a8d110d7
avformat/nsvdec: Fix DoS due to lack of eof check in nsvs_file_offset loop.
...
Fixes: 20170829.nsv
Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com >
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c24bcb5536 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
cd221a86a6
avcodec/snowdec: Fix integer overflow in decode_subband_slice_buffered()
...
Fixes: runtime error: signed integer overflow: 267 * 8388608 cannot be represented in type 'int'
Fixes: 2743/clusterfuzz-testcase-minimized-5820652076400640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 732f976456 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
25ff26aaac
avcodec/hevc_ps: Fix undefined shift in pcm code
...
Fixes: runtime error: shift exponent -1 is negative
Fixes: 3091/clusterfuzz-testcase-minimized-6229767969832960
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2a83866c9f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
b5f0302eeb
avcodec/sbrdsp_fixed: Fix undefined overflows in autocorrelate()
...
Fixes: runtime error: signed integer overflow: 8903997421129740175 + 354481484684609529 cannot be represented in type 'long'
Fixes: 2045/clusterfuzz-testcase-minimized-6751255865065472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eefb68c9c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
e910f15fcb
avformat/mvdec: Fix DoS due to lack of eof check
...
Fixes: loop.mv
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f05e2e2dc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
孙浩 and 张洪亮(望初)
8cb0f2c4e5
avformat/rl2: Fix DoS due to lack of eof check
...
Fixes: loop.rl2
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 96f24d1bee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
孙浩 and 张洪亮(望初)
6bd562e044
avformat/rmdec: Fix DoS due to lack of eof check
...
Fixes: loop.ivr
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 124eb202e7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
孙浩 and 张洪亮(望初)
4ff1fcd3ca
avformat/cinedec: Fix DoS due to lack of eof check
...
Fixes: loop.cine
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7e80b63ecd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
孙浩 and 张洪亮(望初)
6447815dfb
avformat/asfdec: Fix DoS due to lack of eof check
...
Fixes: loop.asf
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f9ec5593e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
305f37e5be
avformat/hls: Fix DoS due to infinite loop
...
Fixes: loop.m3u
The default max iteration count of 1000 is arbitrary and ideas for a better solution are welcome
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Previous version reviewed-by: Steven Liu <lingjiujianke@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ec414892d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
85ffdcd8ff
ffprobe: Fix NULL pointer handling in color parameter printing
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 351e28f9a7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
5474a7e93b
ffprobe: Fix null pointer dereference with color primaries
...
Found-by: AD-lab of venustech
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 837cb4325b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
eea01de3ff
avcodec/hevc_ps: Check delta_pocs in ff_hevc_decode_short_term_rps()
...
Fixes: integer overflow
Fixes: 2893/clusterfuzz-testcase-minimized-5809330567774208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b44dcbc44 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
deca5e7349
avformat/rtpdec_h264: Fix heap-buffer-overflow
...
Fixes: rtp_sdp/poc.sdp
Found-by: Bingchang <l.bing.chang.bc@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c42a1388a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Vitaly Buka
9739a269fb
avformat/aviobuf: Fix signed integer overflow in avio_seek()
...
Signed integer overflow is undefined behavior.
Detected with clang and -fsanitize=signed-integer-overflow
Signed-off-by: Vitaly Buka <vitalybuka@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eca2a49716 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Vitaly Buka
c889041352
avformat/mov: Fix signed integer overflows with total_size
...
Signed integer overflow is undefined behavior.
Detected with clang and -fsanitize=signed-integer-overflow
Signed-off-by: Vitaly Buka <vitalybuka@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a404cb5b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Vitaly Buka
b6a79b841d
avcodec/utils: Fix signed integer overflow in rc_initial_buffer_occupancy initialization
...
Signed integer overflow is undefined behavior.
Detected with clang and -fsanitize=signed-integer-overflow
Signed-off-by: Vitaly Buka <vitalybuka@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c2bb10ddf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
6ce9b2c1fe
avcodec/aacdec_template: Fix running cleanup in decode_ics_info()
...
Fixes: out of array read
Fixes: 2873/clusterfuzz-testcase-minimized-5924145713905664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Previous version reviewed-by: Alex Converse <alex.converse@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6f03ffb47d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
4a122a0879
avcodec/me_cmp: Fix crashes on ARM due to misalignment
...
Adds a diff_pixels_unaligned()
Fixes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872503
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc488ec28a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
736ef73f9c
avcodec/pixlet: Fixes: undefined shift in av_mod_uintp2()
...
Fixes: runtime error: shift exponent 4294967289 is too large for 32-bit type 'int'
Fixes: 3030/clusterfuzz-testcase-minimized-4649809254285312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8754ccd3b3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
253b7829e4
avcodec/dirac_dwt_template: Fix integer overflow in vertical_compose53iL0()
...
Fixes: runtime error: signed integer overflow: 2147483646 + 2 cannot be represented in type 'int'
Fixes: 3013/clusterfuzz-testcase-minimized-4644084197097472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a165b53daa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
f5227c50b7
avcodec/fic: Fixes signed integer overflow
...
Fixes: runtime error: signed integer overflow: 1037142357 + 1227025305 cannot be represented in type 'int'
Fixes: 3024/clusterfuzz-testcase-minimized-5885660323905536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c9d5b015c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
16772e43ef
avcodec/snowdec: Fix off by 1 error
...
Fixes: runtime error: index 4 out of bounds for type 'int8_t [4]'
Fixes: 3023/clusterfuzz-testcase-minimized-6421736130084864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d132683ddd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
53dae9585f
avcodec/pixlet: fixes integer overflow in read_highpass()
...
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: 2879/clusterfuzz-testcase-minimized-6317542639403008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cadab5a2a7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
99491bd260
avcodec/zmbv: Check decomp_size
...
Fixes: OOM
Fixes: 2710/clusterfuzz-testcase-minimized-4750001420894208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 931c0ac95c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
02d224406f
avcodec/diracdec: Fixes integer overflow
...
Fixes: runtime error: signed integer overflow: 340018243 * 27 cannot be represented in type 'int'
Fixes: 2861/clusterfuzz-testcase-minimized-5361070510178304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 92da23093c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
a33e375d7d
avcodec/diracdec: Check perspective_exp and zrs_exp.
...
Fixes: undefined shift
Fixes: runtime error: shift exponent 264 is too large for 32-bit type 'int'
Fixes: 2860/clusterfuzz-testcase-minimized-4672811689836544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e6cab8745 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
f5c6ce899f
avcodec/ffv1dec_template: Fix undefined shift
...
Fixes: runtime error: left shift of negative value -127
Fixes: 2834/clusterfuzz-testcase-minimized-5988039123795968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 62702eebde )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
dcf02ee6c6
avcodec/mpeg4videodec: Clear mcsel before decoding an image
...
Fixes: runtime error: signed integer overflow: 2146467840 + 1032192 cannot be represented in type 'int'
Fixes: 2826/clusterfuzz-testcase-minimized-5901511613743104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7735ed2974 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
86b5a3d35d
avcodec/dirac_dwt: Fixes integer overflows in COMPOSE_DAUB97*
...
Fix multiple: runtime error: signed integer overflow: 6497 * 3409630 cannot be represented in type 'int'
Fixes: 2819/clusterfuzz-testcase-minimized-4743700301217792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5380f9c1c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
818f73542d
avcodec/aacdec_fixed: fix invalid shift in predict()
...
Fixes: runtime error: shift exponent -2 is negative
Fixes: 2818/clusterfuzz-testcase-minimized-5062943676825600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e443051b2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
1dbfcd65b2
avcodec/h264_slice: Fix overflow in slice offset
...
Fixes: runtime error: signed integer overflow: 1610612736 * 2 cannot be represented in type 'int'
Fixes: 2817/clusterfuzz-testcase-minimized-5289691240726528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f53bde6d8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Steven Siloti
fd871e24e6
avformat/utils: fix memory leak in avformat_free_context
...
The pointer to the packet queue is stored in the internal structure
so the queue needs to be flushed before internal is freed.
Signed-off-by: Steven Siloti <ssiloti@bittorrent.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 949debd1d1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
James Cowgill
8aa32a8d5c
swscale: fix gbrap16 alpha channel issues
...
Fixes filter-pixfmts-scale test failing on big-endian systems due to
alpSrc not being cast to (const int32_t**).
Also fixes distortions in the output alpha channel values by copying the
alpha channel code from the rgba64 case found elsewhere in output.c.
Fixes ticket 6555.
Signed-off-by: James Cowgill <James.Cowgill@imgtec.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 013ec23cbe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
ef8db67c92
avcodec/h264idct_template: Fix integer overflow in ff_h264_idct_add()
...
Fixes: runtime error: signed integer overflow: 26215360 + 2121330944 cannot be represented in type 'int'
Fixes: 2809/clusterfuzz-testcase-minimized-4785181833560064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit d1bfa80ec4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
c554788352
avcodec/diracdsp: fix integer overflow
...
Fixes: runtime error: signed integer overflow: 11 * 225726413 cannot be represented in type 'int'
Fixes: 2764/clusterfuzz-testcase-minimized-5382561922547712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b2d9d72269 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Michael Niedermayer
4306ddd87d
avcodec/diracdec: Check weight_log2denom
...
Fixes: runtime error: shift exponent -1 is negative
Fixes: 2742/clusterfuzz-testcase-minimized-5724322402402304
Fixes: 2744/clusterfuzz-testcase-minimized-4672435653705728
Fixes: 2749/clusterfuzz-testcase-minimized-5298741273690112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 880f5c5913 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-10 01:33:28 +02:00
Timo Rothenpieler
bab4cb3fb5
avcodec/nvenc: only push cuda context on encoder close if encoder exists
...
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2017-09-01 11:02:07 +02:00
Muhammad Faiz
e51e07c34e
avfilter/vf_ssim: fix temp size calculation
...
Also use av_mallocz_array.
Fix Ticket6519.
Reviewed-by: Tobias Rapp <t.rapp@noa-archive.com >
Signed-off-by: Muhammad Faiz <mfcc64@gmail.com >
(cherry picked from commit f2d23ec03f )
2017-08-06 14:53:28 +07:00
Michael Niedermayer
9079c70d20
Changelog:update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-29 19:17:56 +02:00
Michael Niedermayer
4f71435248
avcodec/dirac_dwt: Fix multiple integer overflows in COMPOSE_DD97iH0()
...
Fixes: runtime error: signed integer overflow: 9 * 335544320 cannot be represented in type 'int'
Fixes: 2739/clusterfuzz-testcase-minimized-6737297955356672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf8ab72ae9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-29 19:13:19 +02:00
Michael Niedermayer
934878f2a6
avcodec/diracdec: Fix integer overflow in divide3()
...
Fixes: runtime error: signed integer overflow: -1073746548 * 21845 cannot be represented in type 'int'
Fixes: 2729/clusterfuzz-testcase-minimized-5902915464069120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c0220c768c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-29 14:23:24 +02:00
Michael Niedermayer
38d9a782a5
avcodec/takdec: Fix integer overflow in decode_subframe()
...
Fixes: runtime error: signed integer overflow: -536870912 - 1972191120 cannot be represented in type 'int'
Fixes: 2711/clusterfuzz-testcase-minimized-4975142398590976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c630d159f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-29 14:18:34 +02:00
Michael Niedermayer
6de5ec8ef8
avformat/rtmppkt: Convert ff_amf_get_field_value() to bytestream2
...
Fixes: out of array accesses
Found-by: JunDong Xie of Ant-financial Light-Year Security Lab
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ffcc82219c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-29 14:17:57 +02:00
Michael Niedermayer
0d2b67d17c
avformat/rtmppkt: Convert ff_amf_tag_size() to bytestream2
...
Fixes: out of array accesses
Fixes: crash-9238fa9e8d4fde3beda1f279626f53812cb001cb-SEGV
Found-by: JunDong Xie of Ant-financial Light-Year Security Lab
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 08c073434e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-29 04:49:45 +02:00
Michael Niedermayer
d40bb6f5e9
avcodec/diracdec: Fix integer overflow in signed multiplication in UNPACK_ARITH()
...
Fixes: runtime error: signed integer overflow: 1073741823 * 4 cannot be represented in type 'int'
Fixes: 2729/clusterfuzz-testcase-minimized-5902915464069120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e275a74b0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-28 03:41:07 +02:00
Michael Niedermayer
aadfec7d6c
avcodec/pixlet: Simplify nbits computation
...
Fixes multiple integer overflows
Fixes: runtime error: signed integer overflow: 1 + 2147483647 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aeddb3607b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-28 03:40:59 +02:00
Michael Niedermayer
47c0626ec7
avcodec/dnxhddec: Move mb height check out of non hr branch
...
Fixes: out of array access
Fixes: poc.dnxhd
Found-by: Bingchang, Liu@VARAS of IIE
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 296debd213 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-27 03:11:19 +02:00
Michael Niedermayer
2f75ebe24a
avcodec/hevc_ps: fix integer overflow in log2_parallel_merge_level_minus2
...
Fixes: runtime error: signed integer overflow: -2147483647 - 2 cannot be represented in type 'int'
Fixes: 2702/clusterfuzz-testcase-minimized-4511932591636480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 74c1c22d7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-26 17:24:25 +02:00
Michael Niedermayer
a9081b36f4
avformat/oggparsecelt: Do not re-allocate os->private
...
Fixes: double free
Fixes: clusterfuzz-testcase-minimized-5080550145785856
Found-by: ClusterFuzz
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7140761481 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-26 00:14:56 +02:00
Michael Niedermayer
b120685dca
avcodec/ylc: Fix shift overflow
...
Fixes: runtime error: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 2698/clusterfuzz-testcase-minimized-4713541443518464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 03a9e6ff30 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-26 00:14:20 +02:00
Michael Niedermayer
b44a3cd06e
avcodec/aacps: Fix multiple integer overflow in map_val_34_to_20()
...
Fixes: avcodec/aacps.c:511:40: runtime error: signed integer overflow: 1509077651 + 758068176 cannot be represented in type 'int'
Fixes: 2678/clusterfuzz-testcase-minimized-4702787684270080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0764fe1d09 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-26 00:14:01 +02:00
Michael Niedermayer
a930db5c82
avcodec/aacdec_fixed: fix: left shift of negative value -1
...
Fixes: 2699/clusterfuzz-testcase-minimized-5631303862976512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2dfb8c4178 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-26 00:11:54 +02:00
Michael Niedermayer
f10252e47d
avcodec/dirac_vlc: Fix undefined shift
...
Fixes: runtime error: shift exponent 64 is too large for 64-bit type 'residual' (aka 'unsigned long')
Fixes: 2674/clusterfuzz-testcase-minimized-4999700518273024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 69e7daf6ce )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-24 03:03:14 +02:00
Brice Waegeneire
4627033a23
doc/filters: typo in frei0r
...
Signed-off-by: Brice Waegeneire <brice.wge@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6a6eec485d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-23 15:01:03 +02:00
Vodyannikov Aleksandr
20c440edbc
avcodec/cfhd: Fix decoding regression due to height check
...
Fixes: Ticket6546
Regression since: 54aaadf648
Reviewed-by: Muhammad Faiz <mfcc64@gmail.com >
Reviewed-by: Kieran Kunhya <kierank@obe.tv >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47c9365724 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-23 15:00:51 +02:00
Michael Niedermayer
ab81ea1035
Update for 3.3.3
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:28:08 +02:00
Michael Niedermayer
2f2904030f
avcodec/aacdec_template (fixed point): Check gain in decode_cce() to avoid undefined shifts later
...
Fixes: runtime error: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 2581/clusterfuzz-testcase-minimized-4681474395602944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2886142e0c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
064d0c6462
avcodec/ffv1dec_template: Fix signed integer overflow
...
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 2634/clusterfuzz-testcase-minimized-4540890636877824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4de4308d2a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
9ce4350c48
avcodec/aacdec_template: Fix undefined integer overflow in apply_tns()
...
Fixes: runtime error: signed integer overflow: -2147483648 - 1202286525 cannot be represented in type 'int'
Fixes: 2071/clusterfuzz-testcase-minimized-6036414271586304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ef8f03133 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
6ae1b70cb4
avcodec/magicyuv: Check that vlc len is not too large
...
Fixes: runtime error: shift exponent -95 is negative
Fixes: 2568/clusterfuzz-testcase-minimized-4926115716005888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 341f01290c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
dbb121688c
avcodec/mjpegdec: Clip DC also on the negative side.
...
Fixes: runtime error: signed integer overflow: -16711425 + -2130772346 cannot be represented in type 'int'
Fixes: 2533/clusterfuzz-testcase-minimized-5372857678823424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c28f648b19 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
1667b3ea0f
avcodec/aacps (fixed point): Fix multiple signed integer overflows
...
Fixes: runtime error: signed integer overflow: 1421978265 - -1810326882 cannot be represented in type 'int'
Fixes: 2527/clusterfuzz-testcase-minimized-5260915396050944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 80b9e40b6f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
20d4514f25
avcodec/ylc: Fix vlc of 31 bits
...
Fixes: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 2515/clusterfuzz-testcase-minimized-6197200012967936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fe9242204d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
8d3ac812ff
avcodec/sbrdsp_fixed: Fix integer overflow in sbr_hf_apply_noise()
...
Fixes: runtime error: signed integer overflow: -2049425300 + -117591631 cannot be represented in type 'int'
Fixes: part of 2096/clusterfuzz-testcase-minimized-4901566068817920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2061de8a3f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
ba3a4a94bc
avcodec/hevcdec: do not let updated extradata corrupt state
...
Fixes: out of array access
Fixes: 2451/clusterfuzz-testcase-minimized-4781613957251072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Hendrik Leppkes <h.leppkes@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8cfbc6629 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
fb55620369
avcodec/wavpack: Fix invalid shift
...
Fixes: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 2377/clusterfuzz-testcase-minimized-6108505935183872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c07af72098 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
0a36341e96
avcodec/h264_slice: Fix signed integer overflow
...
Fixes: runtime error: signed integer overflow: 26 + 2147483644 cannot be represented in type 'int'
Fixes: 2456/clusterfuzz-testcase-minimized-4822695051001856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7592d97f10 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
1a21edf7b8
avcodec/hevc_ps: Fix integer overflow with beta/tc offsets
...
Fixes: runtime error: signed integer overflow: 2113929216 * 2 cannot be represented in type 'int'
Fixes: 2422/clusterfuzz-testcase-minimized-5242114713583616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit de54a37c1d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
94c8e53034
avcodec/cfhd: Fix invalid left shift of negative value
...
Fixes: runtime error: left shift of negative value -1
Fixes: 2395/clusterfuzz-testcase-minimized-6540529313513472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c709f009da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
132037ad5b
avcodec/vb: Check vertical GMC component before multiply
...
Fixes: runtime error: signed integer overflow: 8224 * 663584 cannot be represented in type 'int'
Fixes: 2393/clusterfuzz-testcase-minimized-6128334993883136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc6ab72bc7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
f3cb2eedeb
avcodec/hevcdec: do basic validity check on delta_chroma_weight and offset
...
Fixes: runtime error: signed integer overflow: 2147483520 + 128 cannot be represented in type 'int'
Fixes: 2385/clusterfuzz-testcase-minimized-6594333576790016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c874548d6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
736c73a243
avcodec/jpeg2000dwt: Fix integer overflow in dwt_decode97_int()
...
Fixes: runtime error: signed integer overflow: -163654656 * 256 cannot be represented in type 'int'
Fixes: 2367/clusterfuzz-testcase-minimized-4648678897745920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea5366670e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
0272afe70d
avcodec/apedec: Fix integer overflow
...
Fixes: out of array access
Fixes: PoC.ape and others
Found-by: Bingchang, Liu@VARAS of IIE
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ba4beaf614 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
165b2ee692
avcodec/wavpack: Fix integer overflow in wv_unpack_stereo()
...
Fixes: runtime error: signed integer overflow: 2080374785 + 2080374784 cannot be represented in type 'int'
Fixes: 2351/clusterfuzz-testcase-minimized-5359403240783872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73ea2a028e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
ea153eb52c
avcodec/hevc_ps: Fix max_dec_buffer check
...
Fixes: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 2339/clusterfuzz-testcase-minimized-6663164320022528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 63e7bfe78e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
f21e96109d
avcodec/mpeg4videodec: Fix GMC with videos of dimension 1
...
Fixes: runtime error: shift exponent -1 is negative
Fixes: 2338/clusterfuzz-testcase-minimized-5153426541379584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4976a3411f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
94f3c06678
avcodec/wavpack: Fix integer overflow
...
Fixes: runtime error: signed integer overflow: 227511904 + 1964113935 cannot be represented in type 'int'
Fixes: 2331/clusterfuzz-testcase-minimized-6182185830711296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 24e95f9d4d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
3ed986522a
avcodec/takdec: Fix integer overflow
...
Fixes: runtime error: signed integer overflow: 512 + 2147483146 cannot be represented in type 'int'
Fixes: 2314/clusterfuzz-testcase-minimized-4519333877252096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c2ef4f6b4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
f1116294aa
avcodec/tiff: Update pointer only when the result is used
...
Fixes: runtime error: signed integer overflow: 538976288 * 32 cannot be represented in type 'int'
Fixes: 2310/clusterfuzz-testcase-minimized-4534784887881728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 27f80ab016 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
0749384f0a
avcodec/cfhd: Check bpc before setting bpc in context
...
Fixes: runtime error: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 2306/clusterfuzz-testcase-minimized-5002997392211968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6f1d2355a7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
fe8960ab86
avcodec/cfhd: Fix undefined shift
...
Fixes: runtime error: left shift of negative value -1
Fixes: 2303/clusterfuzz-testcase-minimized-5529675273076736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5a950f4e32 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
5b8a97d000
avcodec/hevc_filter: Fix invalid shift
...
Fixes: runtime error: left shift of negative value -1
Fixes: 2299/clusterfuzz-testcase-minimized-4843509351710720
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d7b3d5c3f2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
ada21bca55
avcodec/mpeg4videodec: Fix overflow in virtual_ref computation
...
Fixes: runtime error: signed integer overflow: 262144 * -16120 cannot be represented in type 'int'
Fixes: 2292/clusterfuzz-testcase-minimized-6156080415506432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5443c4bdf4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
72403ba2b9
avcodec/lpc: signed integer overflow in compute_lpc_coefs() (aacdec_fixed)
...
Fixes: runtime error: signed integer overflow: -1575818955 + -915383657 cannot be represented in type 'int'
Fixes: 2224/clusterfuzz-testcase-minimized-6208559949807616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e95fcfe8fb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
eaf2bacca1
avcodec/wavpack: Fix undefined integer negation
...
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 2291/clusterfuzz-testcase-minimized-5538453481586688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f89747086 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
cf61bf8107
avcodec/aacdec_fixed: Check s for being too small
...
Fixes: runtime error: shift exponent -8 is negative
Fixes: 2286/clusterfuzz-testcase-minimized-5711764169687040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf7edbd6c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
93456ca3ea
avcodec/htmlsubtitles: Replace very slow redundant sscanf() calls by cleaner and faster code
...
This reduces the worst case from O(n²) to O(n) time
Fixes Timeout
Fixes: 2127/clusterfuzz-testcase-minimized-6595787859427328
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4132218b87 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Anton Mitrofanov
b2522f35ec
avcodec/h264: Fix mix of lossless and lossy MBs decoding
...
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com >
(cherry picked from commit cf231b68da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Anton Mitrofanov
e8558abeaf
avcodec/h264_mb: Fix 8x8dct in lossless for new versions of x264
...
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com >
(cherry picked from commit 06dda70f1e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Anton Mitrofanov
b8d0d76740
avcodec/h264_cabac: Fix CABAC+8x8dct in 4:4:4
...
Use the correct ctxIdxInc calculation for coded_block_flag.
Keep old behavior for old versions of x264 for backward compatibility.
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com >
(cherry picked from commit 840b41b2a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
4384481fbc
avcodec/takdec: Fixes: integer overflow in AV_SAMPLE_FMT_U8P output
...
Fixes: runtime error: signed integer overflow: 2147483543 + 128 cannot be represented in type 'int'
Fixes: 2234/clusterfuzz-testcase-minimized-6266896041115648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 27c2006805 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
347cc89daf
avcodec/jpeg2000dsp: Reorder operations in ict_int() to avoid 2 integer overflows
...
Fixes: runtime error: signed integer overflow: 58065 * 51981 cannot be represented in type 'int'
Fixes: 2271/clusterfuzz-testcase-minimized-5778297776504832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c746f92a8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
7119574f48
avcodec/hevcpred_template: Fix left shift of negative value
...
Fixes: runtime error: left shift of negative value -1
Fixes: 2250/clusterfuzz-testcase-minimized-5693382112313344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c94326c1fc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
f17443cdcd
avcodec/hevcdec: Fix signed integer overflow in decode_lt_rps()
...
Fixes: runtime error: signed integer overflow: 2147483647 + 6 cannot be represented in type 'int'
Fixes: 2263/clusterfuzz-testcase-minimized-4800359627227136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1edbf5e20c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
ee2396cefd
avcodec/jpeg2000dec: Check nonzerobits more completely
...
Fixes: runtime error: shift exponent 36 is too large for 32-bit type 'int'
Fixes: 2239/clusterfuzz-testcase-minimized-5639766592716800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dfb61ea263 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
01ed8d93b2
avcodec/shorten: Sanity check maxnlpc
...
Fixes OOM
Fixes: 2131/clusterfuzz-testcase-minimized-4718045157130240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e77ddd31a8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
1729101c44
avcodec/truemotion2: Move skip computation after checks
...
Fixes: runtime error: signed integer overflow: 630067357 * 4 cannot be represented in type 'int'
Fixes: 2233/clusterfuzz-testcase-minimized-5943031318446080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3c716682a8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
15cc151709
avcodec/jpeg2000: Fixes integer overflow in ff_jpeg2000_ceildivpow2()
...
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 2231/clusterfuzz-testcase-minimized-4565181982048256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e3fadc57c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
0a709e2a10
avcodec/dnxhd_parser: Do not return invalid value from dnxhd_find_frame_end() on error
...
Fixes: Null pointer dereference
Fixes: CVE-2017-9608
Found-by: Yihan Lian
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 611b356274 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
10d821309b
avcodec/hevcdec: Check nb_sps
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc40674462 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
f8a331598e
avcodec/hevc_refs: Check nb_refs in add_candidate_ref()
...
Fixes: runtime error: index 16 out of bounds for type 'int [16]'
Fixes: 2209/clusterfuzz-testcase-minimized-5012343912136704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1cb4ef526d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
f33c3ccbe7
avcodec/mpeg4videodec: Check sprite delta upshift against overflowing.
...
Fixes: runtime error: signed integer overflow: -268386304 * 16 cannot be represented in type 'int'
Fixes: 2204/clusterfuzz-testcase-minimized-5616756909408256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 12245ab1f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
7a86581afd
avcodec/mpeg4videodec: Fix integer overflow in num_sprite_warping_points=2 case
...
Fixes: runtime error: signed integer overflow: 131072 + 2147352576 cannot be represented in type 'int'
Fixes: 2192/clusterfuzz-testcase-minimized-5370387988742144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a87be404a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
3c98e4be89
avcodec/aacsbr_fixed: Check shift in sbr_hf_assemble()
...
Fixes: runtime error: shift exponent -10 is negative
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d1992448d3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
d2567caea9
avcodec/sbrdsp_fixed: Return an error from sbr_hf_apply_noise() if operations are impossible
...
Fixes: 1775/clusterfuzz-testcase-minimized-5330288148217856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d549f026d8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
452c78a09c
avcodec/libvpxdec: Check that display dimensions fit in the storage dimensions
...
Fixes assertion failure
Fixes: 2112/clusterfuzz-testcase-minimized-4526878557732864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f8593c2f49 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
cce9471373
avcodec/jpeg2000dwt: Fix runtime error: left shift of negative value -123
...
Fixes: 2208/clusterfuzz-testcase-minimized-5976593765761024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d24043e1a2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
34282abc57
avcodec/wavpack: Fix runtime error: signed integer overflow: 1886191616 + 277872640 cannot be represented in type 'int'
...
Fixes: 2181/clusterfuzz-testcase-minimized-6314784322486272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c996374d4d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
e1b6d78bf7
avcodec/snowdec: Fix runtime error: left shift of negative value -1
...
Fixes: 2197/clusterfuzz-testcase-minimized-6010716676947968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2e44126363 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
53a32fdf0a
avcodec/aacdec_fixed: Fix runtime error: left shift of negative value -1297616
...
Fixes: 2195/clusterfuzz-testcase-minimized-4736721533009920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6d499ecef9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
f3ac7e40d6
avcodec/tiff: Fix leak of geotags[].val
...
Fixes: 2176/clusterfuzz-testcase-minimized-5908197216878592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 22a25ab389 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
5217145824
avcodec/ra144: Fix runtime error: signed integer overflow: -2200 * 1033073 cannot be represented in type 'int'
...
Fixes: 2175/clusterfuzz-testcase-minimized-5809657849315328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 71da0a5c97 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
311f2f5aba
avcodec/flicvideo: Fix runtime error: signed integer overflow: 4864 * 459296 cannot be represented in type 'int'
...
Fixes: 2174/clusterfuzz-testcase-minimized-5739234533048320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 90e8317b3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:37 +02:00
Michael Niedermayer
460abcd671
avcodec/cfhd: Check band parameters before storing them
...
Fixes out of array read
Fixes: 2169/clusterfuzz-testcase-minimized-5688641642823680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 54aaadf648 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:36 +02:00
Michael Niedermayer
741c341968
avcodec/h264_parse: Check picture structure when initializig weight table
...
Fixes: runtime error: index 49 out of bounds for type 'int [48][2][2]'
Fixes: 2159/clusterfuzz-testcase-minimized-5267945972301824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a1ad368a78b153b63ccc07af864b3611e2a4ac3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:36 +02:00
Michael Niedermayer
ad9ce1fa1d
avcodec/indeo4: Check remaining data in Pic hdr extension parsing code
...
Fixes: Timeout
Fixes: 2115/clusterfuzz-testcase-minimized-6594111748440064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a3b5b60bdf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:36 +02:00
Michael Niedermayer
50c2ef91d3
avcodec/ac3dec_fixed: Fix multiple runtime error: signed integer overflow: -39271008 * 59 cannot be represented in type 'int'
...
Fixes: 2113/clusterfuzz-testcase-minimized-6510704959946752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4e3ab1a5c1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 15:26:36 +02:00
Matthieu Bouron
20f5e2c177
lavc/aarch64/simple_idct: fix idct_col4_top coefficient
...
Fixes regression introduced by 5d0b8b1ae3 .
2017-06-13 17:48:13 +02:00
Michael Niedermayer
6d7192bcb7
Update for 3.3.2
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 22:11:21 +02:00
Michael Niedermayer
4c7477f132
avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: 53098 * 40448 cannot be represented in type 'int'
...
Fixes: 2106/clusterfuzz-testcase-minimized-6136503639998464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 18bca25adb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 16:56:47 +02:00
Michael Niedermayer
90b6425b12
avcodec/pafvideo: Fix assertion failure
...
Fixes: 2100/clusterfuzz-testcase-minimized-4522961547558912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4360559ee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 16:56:38 +02:00
Michael Niedermayer
07944df9a7
avcodec/takdec: Fix multiple runtime error: signed integer overflow: 637072 * 4096 cannot be represented in type 'int'
...
Fixes: 2079/clusterfuzz-testcase-minimized-5345861779324928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e4efd41b83 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 16:56:23 +02:00
Michael Niedermayer
34887d091d
avcodec/mjpegdec: Check that reference frame matches the current frame
...
Fixes: out of array read
Fixes: 2097/clusterfuzz-testcase-minimized-5036861833609216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4705edbbb9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 03:44:35 +02:00
Michael Niedermayer
ec5e262e1d
avcodec/tiff: Avoid loosing allocated geotag values
...
Fixes memleak
Fixes: 2076/clusterfuzz-testcase-minimized-6542640243802112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d7cbeab4c1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 03:44:35 +02:00
Michael Niedermayer
0fb432a23b
avcodec/cavs: Fix runtime error: signed integer overflow: -12648062 * 256 cannot be represented in type 'int'
...
Fixes: 2067/clusterfuzz-testcase-minimized-5578430902960128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e6ee86d92 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 03:44:35 +02:00
Michael Niedermayer
3dd1f38329
avformat/hls: Check local file extensions
...
This reduces the attack surface of local file-system
information leaking.
It prevents the existing exploit leading to an information leak. As
well as similar hypothetical attacks.
Leaks of information from files and symlinks ending in common multimedia extensions
are still possible. But files with sensitive information like private keys and passwords
generally do not use common multimedia filename extensions.
It does not stop leaks via remote addresses in the LAN.
The existing exploit depends on a specific decoder as well.
It does appear though that the exploit should be possible with any decoder.
The problem is that as long as sensitive information gets into the decoder,
the output of the decoder becomes sensitive as well.
The only obvious solution is to prevent access to sensitive information. Or to
disable hls or possibly some of its feature. More complex solutions like
checking the path to limit access to only subdirectories of the hls path may
work as an alternative. But such solutions are fragile and tricky to implement
portably and would not stop every possible attack nor would they work with all
valid hls files.
Developers have expressed their dislike / objected to disabling hls by default as well
as disabling hls with local files. There also where objections against restricting
remote url file extensions. This here is a less robust but also lower
inconvenience solution.
It can be applied stand alone or together with other solutions.
limiting the check to local files was suggested by nevcairiel
This recommits the security fix without the author name joke which was
originally requested by Nicolas.
Found-by: Emil Lerner and Pavel Cheremushkin
Reported-by: Thierry Foucu <tfoucu@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 189ff42196 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 03:44:35 +02:00
Michael Niedermayer
d34d06d1e2
avcodec/qdrw: Fix null pointer dereference
...
The RGB555 PACKBITSRGN case tries to read a palette, if such
palette is actually stored then it accesses a null pointer.
All 16bit samples i could find use DIRECTBITSRGN.
Fixes: 2065/clusterfuzz-testcase-minimized-6298930457346048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 46b865ea9f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 03:44:35 +02:00
Michael Niedermayer
cefbc513ea
avutil/softfloat: Fix sign error in and improve documentation of av_int2sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6019d721d4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 03:44:35 +02:00
Michael Niedermayer
0d19167a65
avcodec/hevc_ps: Fix runtime error: index 32 out of bounds for type 'uint8_t [32]'
...
Fixes: 2010/clusterfuzz-testcase-minimized-6209288450080768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 29808fff33 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 03:44:35 +02:00
Michael Niedermayer
00312b5ea4
avcodec/dxv: Check remaining bytes in dxv_decompress_raw()
...
Fixes: Timeout
Fixes: 2006/clusterfuzz-testcase-minimized-5766515037044736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eb50492270 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 03:44:35 +02:00
Michael Niedermayer
b7904b58af
avcodec/pafvideo: Check packet size and frame code before ff_reget_buffer()
...
Fixes 1745/clusterfuzz-testcase-minimized-6160693365571584
Fixes: Timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit faa5a2181d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 03:44:35 +02:00
Michael Niedermayer
aae731b9d3
avcodec/ac3dec_fixed: Fix runtime error: left shift of 419 by 23 places cannot be represented in type 'int'
...
Fixes: 1352/clusterfuzz-testcase-minimized-5757565017260032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 136ce8baa4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 03:44:35 +02:00
Michael Niedermayer
4e6de49a5a
avformat/options: log filename on open
...
The loglevel is choosen so that the main filename and any images of
multi image sequences are shown only at debug level to avoid
clutter.
This makes exploits in playlists more visible. As they would show
accesses to private/sensitive files
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53e0d5d724 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 03:44:35 +02:00
Michael Niedermayer
52a7ae844b
avcodec/aacps: Fix runtime error: left shift of 1073741824 by 1 places cannot be represented in type 'INTFLOAT' (aka 'int')
...
Fixes: 2005/clusterfuzz-testcase-minimized-5744226438479872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9faf098163 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 03:44:35 +02:00
Michael Niedermayer
3dc62e679a
avcodec/wavpack: Fix runtime error: shift exponent 32 is too large for 32-bit type 'int'
...
Fixes: 1967/clusterfuzz-testcase-minimized-5757031199801344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b3e580b7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 03:44:35 +02:00
Michael Niedermayer
4f02447d45
avcodec/cfhd: Fix runtime error: signed integer overflow: 65280 * 65288 cannot be represented in type 'int'
...
Fixes: 1925/clusterfuzz-testcase-minimized-5564569688735744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cd6f319a74 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 03:44:35 +02:00
Michael Niedermayer
30abd8e6f9
avcodec/wavpack: Fix runtime error: signed integer overflow: 2013265955 - -134217694 cannot be represented in type 'int'
...
Fixes: 1922/clusterfuzz-testcase-minimized-5561194112876544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a47273c803 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 03:44:35 +02:00
Michael Niedermayer
706b427ff5
avcodec/cinepak: Check input packet size before frame reallocation
...
Reduces time spend decoding 1917/clusterfuzz-testcase-minimized-5023221273329664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e47057e932 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 03:44:35 +02:00
Michael Niedermayer
797621afab
avcodec/hevc_ps: Fix runtime error: signed integer overflow: 2147483628 + 256 cannot be represented in type 'int'
...
Fixes: 1909/clusterfuzz-testcase-minimized-6732072662073344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6726328f79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 03:44:35 +02:00
Michael Niedermayer
e3a1d133f7
avcodec/ra144: Fixes runtime error: signed integer overflow: 7160 * 327138 cannot be represented in type 'int'
...
Fixes: 1908/clusterfuzz-testcase-minimized-5392712477966336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 08cb69e870 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 03:44:35 +02:00
Michael Niedermayer
fc74ac463c
avcodec/pnm: Use ff_set_dimensions()
...
Fixes: OOM
Fixes: 1906/clusterfuzz-testcase-minimized-4599315114754048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1c0d1d906 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 03:44:35 +02:00
Michael Niedermayer
eac6114e01
avcodec/cavsdec: Fix runtime error: signed integer overflow: 59 + 2147483600 cannot be represented in type 'int'
...
Fixes: 1903/clusterfuzz-testcase-minimized-5359318167715840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 58f8cd4ac5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 03:44:35 +02:00
Ganapathy Kasi
9b351d0d88
avcodec/nvenc: fix hw accelerated transcode with bframes
...
hw accelerated transcode (h264_cuvid -> h264_nvenc with -hwaccel cuvid) was
broken after the filtergraph initialization was changed to intialize decoder
first followed by encoder (commit af1761f7b5 ).
During initialzing encoder with bframes, local buffers are allocated
internally in encoder which fails since no cuda context is available. Now
pushing the correct cuda context before encoder initialization fixes the issue.
Also adding push/pop cuda ctx during create/destroy/map/unmap resources and
destroy encoder session.
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2017-06-02 21:37:43 +02:00
Micah Galizia
e5e01d2477
libavformat/hls: Observe Set-Cookie headers
...
Signed-off-by: Micah Galizia <micahgalizia@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4c73020f4 )
Signed-off-by: Micah Galizia <micahgalizia@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Micah Galizia
771206c0db
libavformat/http: Ignore expired cookies
...
Signed-off-by: Micah Galizia <micahgalizia@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 28b2467074 )
Signed-off-by: Micah Galizia <micahgalizia@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
1998147f2e
avformat/avidec: Limit formats in gab2 to srt and ass/ssa
...
This prevents part of one exploit leading to an information leak
Found-by: Emil Lerner and Pavel Cheremushkin
Reported-by: Thierry Foucu <tfoucu@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5d849b149 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
003cce421d
avcodec/acelp_pitch_delay: Fix runtime error: value 4.83233e+39 is outside the range of representable values of type 'float'
...
Fixes: 1902/clusterfuzz-testcase-minimized-4762451407011840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 87bddba43b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
795f65eed5
avcodec/wavpack: Check float_shift
...
Fixes: runtime error: shift exponent 40 is too large for 32-bit type 'unsigned int'
Fixes: 1898/clusterfuzz-testcase-minimized-5970744880136192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4020b009d1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
a24cd04074
avcodec/wavpack: Fix runtime error: signed integer overflow: 24 * -2147483648 cannot be represented in type 'int'
...
Fixes: 1894/clusterfuzz-testcase-minimized-4716739789062144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d90c5bf105 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
c1074aea71
avcodec/ansi: Fix frame memleak
...
Fixes: 1892/clusterfuzz-testcase-minimized-4519341733183488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e091b9b3c7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
d59e6cef79
avcodec/dds: Fix runtime error: left shift of 145 by 24 places cannot be represented in type 'int'
...
Fixes: 1891/clusterfuzz-testcase-minimized-6274417925554176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c49fa2a514 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
0a0eec60c8
avcodec/jpeg2000dec: Use ff_set_dimensions()
...
Fixes: OOM
Fixes: 1890/clusterfuzz-testcase-minimized-6329019509243904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f3da6fbff8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
ece91a3918
avcodec/truemotion2: Fix passing null pointer to memset()
...
Fixes part of: 1888/clusterfuzz-testcase-minimized-5237704826552320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c901627918 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
722cc62baa
avcodec/truemotion2: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
...
Fixes part of: 1888/clusterfuzz-testcase-minimized-5237704826552320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9e884f3d9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
3a0e4368ec
avcodec/ra144: Fix runtime error: signed integer overflow: -2449 * 1398101 cannot be represented in type 'int'
...
Fixes: 1885/clusterfuzz-testcase-minimized-5336328549957632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7c845450d2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
22dab0f4e1
avcodec/ra144: Fix runtime error: signed integer overflow: 11184810 * 404 cannot be represented in type 'int'
...
Fixes: 1884/clusterfuzz-testcase-minimized-4637425835966464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4c472c5252 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
b578ba915f
avcodec/aac_defines: Add missing () to AAC_HALF_SUM() macro
...
Fixes: runtime error: shift exponent 1073741848 is too large for 32-bit type 'INTFLOAT' (aka 'int')
Fixes: 1880/clusterfuzz-testcase-minimized-4900645322620928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 872bac8159 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
080edf29e7
avcodec/webp: Fixes null pointer dereference
...
Fixes: 1470/clusterfuzz-testcase-minimized-5404421666111488
Fixes: 1472/clusterfuzz-testcase-minimized-5677426430443520
Fixes: 1875/clusterfuzz-testcase-minimized-5536474562822144
Approved-by: BBB
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 67020711b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
be9268e350
avcodec/aacdec_fixed: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
...
Fixes: 1878/clusterfuzz-testcase-minimized-6441918630199296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6b9cb5d26a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
b419c7564c
avcodec/ylc: Check count in build_vlc()
...
Fixes: runtime error: signed integer overflow: 211633430 + 2147483647 cannot be represented in type 'int'
Fixes: 1874/clusterfuzz-testcase-minimized-5037763613163520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 67b30decf7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
586e00d7d3
avcodec/snow: Fix runtime error: signed integer overflow: 1086573993 + 1086573994 cannot be represented in type 'int'
...
Fixes: 1871/clusterfuzz-testcase-minimized-5719950331215872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b9c032ebc0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
bc2cbb3077
avcodec/jpeg2000: Fix runtime error: signed integer overflow: 4185 + 2147483394 cannot be represented in type 'int'
...
Fixes: 1870/clusterfuzz-testcase-minimized-4686788029317120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 781f88bb26 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
cd3314552b
avcodec/jpeg2000dec: Check tile offsets more completely
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c1812491f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
3e18f0fddd
avcodec/sheervideo: Check input buffer size before allocating and decoding
...
Fixes: Timeout
Fixes: 1858/clusterfuzz-testcase-minimized-6450473802399744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d8030c14bd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
b330fec1ce
avcodec/aacdec_fixed: Fix multiple runtime error: shift exponent 127 is too large for 32-bit type 'int'
...
Fixes: 1851/clusterfuzz-testcase-minimized-5692607495667712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6c3a63fc3d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
1d589a93b0
avcodec/wnv1: More strict buffer size check
...
This requires at least 25% of a picture to allocate and decode it
Fixes: Timeout
Fixes: 1845/clusterfuzz-testcase-minimized-5075974343360512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f50c25124 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
d2476bd465
avcodec/libfdk-aacdec: Correct buffer_size parameter
...
the timeDataSize argument to aacDecoder_DecodeFrame() seems undocumented and until
2016 04 (203e3f28fbebec7011342017fafc2a0bda0ce530) unused.
after that commit libfdk-aacdec interprets it as size in sample units and memsets that on error.
FFmpeg as well as others (like GStreamer) did interpret it as size in bytes
Fixes: 1442/clusterfuzz-testcase-minimized-4540199973421056 (This requires recent libfdk to reproduce)
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ca6776a993 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
c0895d64f5
avcodec/sbrdsp_template: Fix: runtime error: signed integer overflow: 849815297 + 1315389781 cannot be represented in type 'int'
...
Fixes: 1770/clusterfuzz-testcase-minimized-5285511235108864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7c36ee216f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
f5626db24e
avcodec/ivi_dsp: Fix runtime error: left shift of negative value -2
...
Fixes: 1839/clusterfuzz-testcase-minimized-6238490993885184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 357f2316a0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Kevin Mark
573e40e8f1
doc/filters: Clarify scale2ref example
...
Signed-off-by: Kevin Mark <kmark937@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 114e871621 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
75d881f1a9
avcodec/mlpdec: Do not leave invalid values in matrix_out_ch[] on error
...
Fixes: runtime error: index 12 out of bounds for type 'uint8_t [8]'
Fixes: 1832/clusterfuzz-testcase-minimized-6574546079449088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ac8dfcbd89 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
b803624aae
avcodec/ra144dec: Fix runtime error: left shift of negative value -17
...
Fixes: 1830/clusterfuzz-testcase-minimized-5828293733384192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53c0c637d3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
dbff2d602d
avcodec/pixlet: Fix runtime error: signed integer overflow: 2147483647 + 32 cannot be represented in type 'int'
...
Fixes: 1829/clusterfuzz-testcase-minimized-5527165321871360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 77d9889821 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
92a23e2a63
avformat/mux: Fix copy an paste typo
...
Found-by: Roger Scott <rscott@grammatech.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1a36354698 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
42163d4c55
avutil/internal: Do not enable CHECKED with DEBUG
...
This avoids potential undefined behavior in debug mode while still allowing
developers which want to check for potential additional overflows to do so
by manually enabling this.
Reviewed-by: wm4
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a44b3abb4c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
4e8c5721b3
avcodec/clearvideo: Check buf_size before decoding frame
...
Fixes; Timeout
Fixes: 1826/clusterfuzz-testcase-minimized-5728569256837120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 43c394dcae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
f85a71527a
avcodec/aacdec_fixed: Fix runtime error: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
...
Fixes: 1825/clusterfuzz-testcase-minimized-6002833050566656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e87d146d7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
a49743407b
avcodec/smc: Check remaining input
...
Fixes: Timeout
Fixes: 1818/clusterfuzz-testcase-minimized-5039166473633792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 356194fcb1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
190787a026
avcodec/diracdec: Fix off by 1 error in quant check
...
Fixes: out of array read
Fixes: 1781/clusterfuzz-testcase-minimized-4617176877105152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b946bd8ef2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
80cebb992c
avcodec/jpeg2000dec: Fix copy and paste error
...
Found-by: jamrial
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5782e0ba8c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
38fd2a33b9
avcodec/jpeg2000dec: Check tile offsets
...
Fixes: runtime error: signed integer overflow: 4096 - -2147483648 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 89325417e7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Max Justicz
861c05b286
avcodec/sanm: Fix uninitialized reference frames
...
Fixes: poc.snm
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ca616b0f72 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
ba7ea7c4b1
avcodec/jpeglsdec: Check get_bits_left() before decoding a picture
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4bc3008d04 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Max Justicz
6b839e9aa3
avcodec/fmvc: Fix use of uninitialized memory when the first frame is not a keyframe
...
Fixes: fmvc-poc.avi
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3766aa7343 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
abd5277318
avcodec/ivi_dsp: Fix multiple runtime error: left shift of negative value -71
...
Fixes: 1734/clusterfuzz-testcase-minimized-5385630815092736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8fb00b3e85 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
17a4e791bf
avcodec/mjpegdec: Fix runtime error: signed integer overflow: -32767 * 130560 cannot be represented in type 'int'
...
Fixes: 1724/clusterfuzz-testcase-minimized-4842395432648704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 40fa6a2fa2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
e73efe4691
avcodec/aacdec_fixed: Fix runtime error: shift exponent 34 is too large for 32-bit type 'int'
...
Fixes: 1721/clusterfuzz-testcase-minimized-4719352135811072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5228e44c7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
a7442f8d35
avcodec/mpeg4videodec: Check for multiple VOL headers
...
Fixes multiple: runtime error: signed integer overflow: 2147115008 + 413696 cannot be represented in type 'int'
Fixes: 1723/clusterfuzz-testcase-minimized-5309409372667904
Fixes: 1727/clusterfuzz-testcase-minimized-5900685306494976
Fixes: 1737/clusterfuzz-testcase-minimized-5922321338466304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit efeb47fd5d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
d11c686204
avcodec/vp9block: fix runtime error: signed integer overflow: 196675 * 20670 cannot be represented in type 'int'
...
Fixes: 1710/clusterfuzz-testcase-minimized-4837032931098624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d4ee767808 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
0ea475942e
avcodec/vmnc: Check location before use
...
Fixes: runtime error: signed integer overflow: 65535 * 64256 cannot be represented in type 'int'
Fixes: 1717/clusterfuzz-testcase-minimized-5491696676634624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec2b76aab4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
3cfb016071
avcodec/takdec: Fix runtime error: signed integer overflow: 8192 * 524308 cannot be represented in type 'int'
...
Fixes: 1630/clusterfuzz-testcase-minimized-6326111917047808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 955db41192 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
f832d7361d
avcodec/aac_defines: Fix: runtime error: left shift of negative value -2
...
Fixes: 1716/clusterfuzz-testcase-minimized-4691012196761600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c3547dcbc3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
ff4f525905
avcodec/takdec: Fix runtime error: left shift of negative value -63
...
Fixes: 1713/clusterfuzz-testcase-minimized-5791887476654080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d66193252b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
a5875f8a1e
avcodec/mlpdsp: Fix runtime error: signed integer overflow: -24419392 * 128 cannot be represented in type 'int'
...
Fixes: 1711/clusterfuzz-testcase-minimized-5248503515185152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1d04fc94e1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
f397613f05
avcodec/sbrdsp_fixed: fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
...
Fixes: part of 1709/clusterfuzz-testcase-minimized-4513580554649600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 384508b2ff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
9c65a87bd4
avcodec/aacsbr_fixed: Fix multiple runtime error: shift exponent 170 is too large for 32-bit type 'int'
...
Fixes part of 1709/clusterfuzz-testcase-minimized-4513580554649600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6310fc714d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
e605faaabc
avcodec/mlpdec: Do not leave a invalid num_primitive_matrices in the context
...
Fixes: runtime error: index 8 out of bounds for type 'uint8_t [8]'
Fixes: 1699/clusterfuzz-testcase-minimized-6327177438035968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 64ea4d102a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
f3b6ea1408
avcodec/aacsbr_fixed: Fix multiple runtime error: shift exponent 150 is too large for 32-bit type 'int'
...
Fixes: 1681/clusterfuzz-testcase-minimized-5970545365483520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3fb104f447 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
e46bc3052d
avcodec/mimic: Use ff_set_dimensions() to set the dimensions
...
Fixes: OOM
Fixes: 1671/clusterfuzz-testcase-minimized-4759078033162240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e434840fd4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
f254c7ea13
avcodec/fic: Fix multiple runtime error: signed integer overflow: 5793 * 419752 cannot be represented in type 'int'
...
Fixes: 1669/clusterfuzz-testcase-minimized-5287529198649344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a173f484b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
fc7c379060
avcodec/pixlet: Fix reading invalid numbers of bits
...
Fixes: asertion failure
Fixes: 1664/clusterfuzz-testcase-minimized-6587801187385344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d32ebce8fd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
686eb3b1ed
avcodec/mlpdec: Fix: runtime error: left shift of negative value -8
...
Fixes: 1658/clusterfuzz-testcase-minimized-4889937130291200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 25c81e4b73 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
b6c0ad571f
avcodec/dfa: Fix: runtime error: signed integer overflow: -14202 * 196877 cannot be represented in type 'int'
...
Fixes: 1657/clusterfuzz-testcase-minimized-4710000079405056
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 58ac7fb9c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
72e5607c87
avcodec/aacdec: Fix runtime error: signed integer overflow: 2147483520 + 255 cannot be represented in type 'int'
...
Fixes: 1656/clusterfuzz-testcase-minimized-5900404925661184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 94d05ff159 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
4186702184
avcodec/aacdec_template: Fix fixed point scale in decode_cce()
...
Fixes: runtime error: shift exponent 1073741824 is too large for 32-bit type 'int'
Fixes: 1654/clusterfuzz-testcase-minimized-5151903795118080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53a502206a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
fedd8b6507
avcodec/fmvc: Fix off by 1 error
...
Fixes: out of array access
Fixes: 1643/clusterfuzz-testcase-minimized-6117573403869184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e11dcc35bb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
6ebb9e7b77
avcodec/flicvideo: Check frame_size before decrementing
...
Fixes: runtime error: signed integer overflow: -2147483627 - 22 cannot be represented in type 'int'
Fixes: 1637/clusterfuzz-testcase-minimized-5376582493405184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 355e27e24d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
6e788fadae
avcodec/mlpdec: Fix runtime error: left shift of negative value -1
...
Fixes: 1636/clusterfuzz-testcase-minimized-5310494757879808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 552adf1dd3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
f34dc82d56
avcodec/takdec: Fix runtime error: left shift of negative value -42
...
Fixes: 1635/clusterfuzz-testcase-minimized-4992749856096256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 99c4c76cfb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
b7b28b6aad
avcodec/hq_hqa: Fix: runtime error: signed integer overflow: -255 * 10180917 cannot be represented in type 'int'
...
Fixes: 1626/clusterfuzz-testcase-minimized-6416580571299840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d9cb583c8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
21d50c185d
avcodec/scpr: mask bits to prevent out of array read
...
Fixes: 1615/clusterfuzz-testcase-minimized-6625214647500800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5666b95c9f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
72e5ccfe37
avcodec/truemotion1: Fix multiple runtime error: signed integer overflow: 1246906962 * 2 cannot be represented in type 'int'
...
Fixes: 1616/clusterfuzz-testcase-minimized-5119196578971648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5ea6bc2a166edac37042f2bbc28eb603a0fbeccb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
b147ded288
avcodec/svq3: Fix runtime error: left shift of negative value -6
...
Fixes: 1604/clusterfuzz-testcase-minimized-5312060206350336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6eb006ad4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Michael Niedermayer
75697b500c
avcodec/tiff: reset sampling[] if its invalid
...
Fixes divission by 0
Fixes: clusterfuzz-testcase-minimized-5592896440893440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f08122fbe0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-02 01:14:38 +02:00
Martin Storsjö
1cbeb16187
configure: Fix the msvcrt version check for mingw32
...
This was actually broken when committed in 46e3936fb04; the
test never succeeded, and thus, _aligned_malloc wasn't actually
used on legacy mingw.
Signed-off-by: Martin Storsjö <martin@martin.st >
(cherry picked from commit 427f7a1f9e )
2017-05-31 13:03:07 +02:00
Matthieu Bouron
6ee4b20f4a
lavf/mov: make invalid m{d,v}hd time_scale default to 1 instead of erroring out
...
Some samples have their metadata track time_scale incorrectly set to 0
and the check introduced by a398f054fd
prevents playback of those samples. Setting the time_scale to 1 fixes
playback.
2017-05-23 15:53:37 +02:00
Matthieu Bouron
3e38bf95c5
lavc/ffjni: add missing '\n'
2017-05-23 15:50:46 +02:00
Matthieu Bouron
cbae648eb8
lavc/mediacodec_wrapper: do not declare JNIAMedia{Codec,CodecList,Format}Fields on the stack
2017-05-23 15:50:42 +02:00
Matthieu Bouron
2fb25e2dd6
lavc/mediacodec_wrapper: fix local reference leaks
2017-05-23 15:50:38 +02:00
Timo Rothenpieler
3bc5e427e4
avcodec/nvenc: remove unnecessary alignment
...
Fixes #6260
2017-05-23 11:50:45 +02:00
Hendrik Leppkes
8640339dbb
Use AVOnce as a static variable consistently
...
Using AVOnce as a stack variable makes no sense as the state is lost
when the function exits.
This fixes repeated calls to av(filter/device)_register_all
2017-05-22 12:36:52 +02:00
Muhammad Faiz
7fae0ea21d
avfilter: take_samples: do not directly return frame when samples are skipped
...
Modifying data pointer when skipping samples may make it unaligned.
Workaround for Ticket6349.
This should fix the crash of ticket's testcase and a crash/regression
with avxsynth (reported by Michael Niedermayer).
Also change frame->nb_samples < max to frame->nb_samples <= max.
This improves performance. Benchmark:
./ffmpeg -filter_complex "aevalsrc=0:n=1166,firequalizer=fixed=on" -f null null
old:
25767 decicycles in take_samples, 1023 runs, 1 skips
25422 decicycles in take_samples, 2047 runs, 1 skips
25181 decicycles in take_samples, 4095 runs, 1 skips
24904 decicycles in take_samples, 8191 runs, 1 skips
new:
550 decicycles in take_samples, 1024 runs, 0 skips
548 decicycles in take_samples, 2048 runs, 0 skips
545 decicycles in take_samples, 4096 runs, 0 skips
544 decicycles in take_samples, 8192 runs, 0 skips
Reviewed-by: Nicolas George <george@nsup.org >
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Muhammad Faiz <mfcc64@gmail.com >
(cherry picked from commit fc3a03fcf9 )
2017-05-20 23:30:29 +07:00
Aaron Levinson
19fea7d703
avutil/hwcontext_dxva2: Don't improperly free IDirect3DSurface9 objects
...
Add dxva2_pool_release_dummy() and use it in call to
av_buffer_create() in dxva2_pool_alloc().
Prior to this change, av_buffer_create() was called with NULL for the
third argument, which indicates that av_buffer_default_free() should
be used to free the buffer's data. Eventually, it gets to
buffer_pool_free() and calls buf->free() on a surface object (which is
av_buffer_default_free()).
This can result in a crash when the debug version of the C-runtime is
used on Windows. While it doesn't appear to result in a crash when
the release version of the C-runtime is used on Windows, it likely
results in memory corruption, since av_free() is being called on
memory that was allocated using
IDirectXVideoAccelerationService::CreateSurface().
Signed-off-by: Aaron Levinson <alevinsn@aracnet.com >
Reviewed-by: wm4 <nfxjfg@googlemail.com >
Reviewed-by: Steven Liu <lingjiujianke@gmail.com >
Reviewed-by: Mark Thompson <sw@jkqxz.net >
(cherry picked from commit 0c1c514643 )
2017-05-16 22:00:48 +01:00
Michael Niedermayer
c1c50650df
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 18:22:27 +02:00
Clément Bœsch
ff1f181178
doc/general: fix project name after 2b1a6b1ae
...
(cherry picked from commit d8eb40bd70 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 18:22:05 +02:00
Michael Niedermayer
9b33462dc4
avcodec/pixlet: Fix shift exponent 4294967268 is too large for 32-bit type 'int'
...
Fixes: 1336/clusterfuzz-testcase-minimized-4761381930795008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f5b6c7e1e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 17:56:21 +02:00
Michael Niedermayer
dd349b24ce
avcodec/aacps: Fix undefined behavior
...
Fixes: 1337/clusterfuzz-testcase-minimized-5212314171080704
Fixes the existence of a potentially invalid pointer intermediate
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 527f89e059 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 17:56:21 +02:00
Michael Niedermayer
814dd3e9eb
avcodec/opus_silk: Fix integer overflow and out of array read
...
Fixes: 1362/clusterfuzz-testcase-minimized-6097275002552320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4654baff12 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 17:56:21 +02:00
Michael Niedermayer
224b47f76d
avcodec/flacdec: Return error code instead of 0 for failures
...
Fixes: infinite loop
Fixes: 1418/clusterfuzz-testcase-minimized-5934472438480896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3f5a68533d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 17:56:21 +02:00
Michael Niedermayer
b4cea069a5
avcodec/snowdec: Check width
...
Fixes: out of array read
Fixes: 1419/clusterfuzz-testcase-minimized-6108700873850880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 78aa93807b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 17:56:21 +02:00
Michael Niedermayer
0f98030290
avcodec/webp: Update canvas size in vp8_lossy_decode_frame() as in vp8_lossless_decode_frame()
...
Fixes: 1407/clusterfuzz-testcase-minimized-6044604124102656
Fixes: 1420/clusterfuzz-testcase-minimized-6059927359455232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 72810d20b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 17:56:21 +02:00
Michael Niedermayer
d93a5a8d11
avcodec/webp: Factor update_canvas_size() out
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4f63b78b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 17:56:21 +02:00
Michael Niedermayer
70d3ad7b6f
avcodec/cllc: Check prefix
...
Fixes: runtime error: left shift of 1610706944 by 1 places cannot be represented in type 'int'
Fixes: 1421/clusterfuzz-testcase-minimized-6239947507892224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 62c5949bec )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 17:56:21 +02:00
Michael Niedermayer
d2108de6b8
avcodec/fmvc: Check nb_blocks
...
Fixes: out of array read
Fixes: 1508/clusterfuzz-testcase-minimized-5011336327069696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0158b405a7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 17:56:21 +02:00
Michael Niedermayer
d9b25b3923
avcodec/rscc: Check pixel_size for overflow
...
Fixes: 1509/clusterfuzz-testcase-minimized-5129419876204544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 934572c5c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 17:56:21 +02:00
Michael Niedermayer
0f928e5918
avcodec/dds: Fix runtime error: left shift of 210 by 24 places cannot be represented in type 'int'
...
Fixes: 1510/clusterfuzz-testcase-minimized-5826231746428928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit afb4632cc3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 17:56:20 +02:00
Michael Niedermayer
611ef6381b
avcodec/pixlet: Fixes: runtime error: signed integer overflow: 9203954323419769657 + 29897660706736950 cannot be represented in type 'long'
...
Fixes: 1569/clusterfuzz-testcase-minimized-6328690508038144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a453f5549a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 17:56:20 +02:00
Michael Niedermayer
340690e8e6
avcodec/mpeg4videodec: Clear sprite wraping on unsupported cases in VOP decode
...
Fixes: Integer overflow
Fixes: 1572/clusterfuzz-testcase-minimized-4578773729017856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 467677769a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 17:56:20 +02:00
Michael Niedermayer
0991208151
avcodec/ac3dec: Fix: runtime error: index -1 out of bounds for type 'INTFLOAT [2]'
...
It seems dual mono with a LFE channel is not forbidden
Fixes: 1570/clusterfuzz-testcase-minimized-6455337349545984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c55e637072 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 17:56:20 +02:00
Michael Niedermayer
b38c8fd291
avcodec/hqxdsp: Fix runtime error: signed integer overflow: -196264 * 11585 cannot be represented in type 'int'
...
Fixes: 1568/clusterfuzz-testcase-minimized-5944868608147456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b923213276 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 17:56:20 +02:00
Michael Niedermayer
bc6c12b7e7
avcodec/g723_1dec: Fix LCG type
...
Fixes: 1567/clusterfuzz-testcase-minimized-5693653555085312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f2c539d350 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 17:56:20 +02:00
Matthieu Bouron
1d37fe95e8
lavc/mediacodec_wrapper: fix local reference leaks
...
Reviewed-by: Clément Bœsch <u@pkh.me >
2017-05-14 10:49:23 +02:00
Matthieu Bouron
79122e2671
lavc/ffjni: fix local reference leak
...
Reviewed-by: Clément Bœsch <u@pkh.me >
2017-05-14 10:49:11 +02:00
Matthieu Bouron
d8afd8d371
lavc/aarch64/simple_idct: fix iOS build without gas-preprocessor
...
Separates macro arguments with commas and passes .4H/.8H as macro
arguments instead of 4H/8H (the later form being interpreted as an
hexadecimal value).
Fixes ticket #6324 .
Suggested-by: Martin Storsjö <martin@martin.st >
2017-05-14 10:49:06 +02:00
James Almer
7f79879a01
avcodec/aac_adtstoasc: fix ASC passthrough on small frames
...
ASC frames smaller than AAC_ADTS_HEADER_SIZE were being discarded.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 0f05f2c7e6 )
2017-05-13 23:15:07 -03:00
James Almer
6a9017d3a5
avcodec/aacenc_ltp: fix use of uninitialized values
...
Fixes some valgrind warnings.
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 8cd8c83317 )
2017-05-13 23:15:05 -03:00
James Almer
d7b86cd308
avcodec/hevc_sei: fix amount of bits skipped when reading picture timing SEI message
...
The code was skipping the entire reported SEI message size regardless of
the amount of bits read.
While in theory safe for NALU where the picture timing SEI message is alone
or at the end as we're using the checked bitstream reader, it isn't in any
other situation, where every SEI message in the NALU after the picture
timing one would potentially fail to parse.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit f738140807 )
Conflicts:
libavcodec/hevc_sei.c
2017-05-13 23:09:05 -03:00
James Almer
8c33e2e11b
avcodec/avpacket: allow only one element per type in packet side data
...
It was never meant to do otherwise, as av_packet_get_side_data() returns the first
entry it finds of a given type.
Based on code from libavformat's av_stream_add_side_data().
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 28f60eeabb )
2017-05-13 22:15:40 -03:00
Michael Niedermayer
8fbd347508
Update for 3.3.1
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 02:38:30 +02:00
Michael Niedermayer
bbda126477
libswscale/tests/swscale: Fix uninitialized variables
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7796f29065 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 01:44:58 +02:00
Michael Niedermayer
236912f789
avcodec/ffv1dec: Fix runtime error: signed integer overflow: 1550964438 + 1550964438 cannot be represented in type 'int'
...
Fixes: 1559/clusterfuzz-testcase-minimized-5048096079740928
Fixes: 1560/clusterfuzz-testcase-minimized-6011037813833728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8630b2cd36 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:50 +02:00
Michael Niedermayer
9fb677dd82
avcodec/webp: Fix signedness in prefix_code check
...
Fixes: out of array read
Fixes: 1557/clusterfuzz-testcase-minimized-6535013757616128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c5cd1c9d3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:50 +02:00
Michael Niedermayer
3ed0d94b82
avcodec/svq3: Fix runtime error: signed integer overflow: 169 * 12717677 cannot be represented in type 'int'
...
Fixes: 1556/clusterfuzz-testcase-minimized-5027865978470400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 86b1b0d33d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:50 +02:00
Michael Niedermayer
6f8dab7a7b
avcodec/mlpdec: Check that there is enough data for headers
...
Fixes: out of array access
Fixes: 1541/clusterfuzz-testcase-minimized-6403410590957568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e3e51f8c14 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:50 +02:00
Michael Niedermayer
47da68fc8e
avcodec/ac3dec: Keep track of band structure
...
It is needed in some corner cases that seem not to be forbidden
Fixes: out of array index
Fixes: 1538/clusterfuzz-testcase-minimized-4696904925446144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9351a156de )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:50 +02:00
Michael Niedermayer
479bb1cacd
avcodec/webp: Add missing input padding
...
Fixes: 1536/clusterfuzz-testcase-minimized-5973925404082176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a3508cc3fe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:50 +02:00
Michael Niedermayer
b0f3f56bbc
avcodec/aacdec_fixed: Fix runtime error: left shift of negative value -1
...
Fixes: 1535/clusterfuzz-testcase-minimized-5826695535788032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 26227d9186 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:50 +02:00
Michael Niedermayer
128b42f4d1
avcodec/aacsbr_template: Do not change bs_num_env before its checked
...
Fixes: 1489/clusterfuzz-testcase-minimized-5075102901207040
Fixes: out of array access
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 87b08ee6d2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:50 +02:00
Michael Niedermayer
d1dd90ae54
avcodec/scpr: Fix multiple runtime error: index 256 out of bounds for type 'unsigned int [256]'
...
Fixes: 1519/clusterfuzz-testcase-minimized-5286680976162816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2171dfae8c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:50 +02:00
Michael Niedermayer
00a9eaff97
avcodec/mlp: Fix multiple runtime error: left shift of negative value -1
...
Fixes: 1512/clusterfuzz-testcase-minimized-4713846423945216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 74dc728a2c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:50 +02:00
Michael Niedermayer
906f1f66a8
avcodec/xpmdec: Fix multiple pointer/memory issues
...
Most of these were found through code review in response to
fixing 1466/clusterfuzz-testcase-minimized-5961584419536896
There is thus no testcase for most of this.
The initial issue was Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cb243972b1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:50 +02:00
Michael Niedermayer
f0ee408624
avcodec/vp8dsp: vp7_luma_dc_wht_c: Fix multiple runtime error: signed integer overflow: -1366381240 + -1262413604 cannot be represented in type 'int'
...
Fixes: 1440/clusterfuzz-testcase-minimized-5785716111966208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ccce2248bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:50 +02:00
Michael Niedermayer
5121f31cac
avcodec/avcodec: Limit the number of side data elements per packet
...
Fixes: 1293/clusterfuzz-testcase-minimized-6054752074858496
See: [FFmpeg-devel] [PATCH] avcodec/avcodec: Limit the number of side data elements per packet
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d5711cb891 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:50 +02:00
Michael Niedermayer
3526d25017
avcodec/texturedsp: Fix runtime error: left shift of 255 by 24 places cannot be represented in type 'int'
...
Fixes: 1505/clusterfuzz-testcase-minimized-4561688818876416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f225003d17 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:50 +02:00
Michael Niedermayer
34ae610115
avcodec/g723_1dec: Fix runtime error: left shift of negative value -1
...
Fixes: 1504/clusterfuzz-testcase-minimized-6249212138225664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4c0245686 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:50 +02:00
Michael Niedermayer
ee92ea8903
avcodec/wmv2dsp: Fix runtime error: signed integer overflow: 181 * -17047030 cannot be represented in type 'int'
...
Fixes: 1503/clusterfuzz-testcase-minimized-5369271855087616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df640dbbc9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:50 +02:00
Michael Niedermayer
256b9442df
avcodec/diracdec: Fix Assertion frame->buf[0] failed at libavcodec/decode.c:610
...
Fixes: 1487/clusterfuzz-testcase-minimized-6288036495097856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6899e6e560 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:50 +02:00
Michael Niedermayer
971fe06074
avcodec/msmpeg4dec: Check for cbpy VLC errors
...
Fixes: runtime error: left shift of negative value -1
Fixes: 1480/clusterfuzz-testcase-minimized-5188321007370240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 15e892aad1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:50 +02:00
Michael Niedermayer
5d0e4c877f
avcodec/cllc: Check num_bits
...
Fixes: runtime error: shift exponent -2 is negative
Fixes: 1479/clusterfuzz-testcase-minimized-6638493360979968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2bfd0a9758 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
383fdec3b2
avcodec/cllc: Factor VLC_BITS/DEPTH out, do not use repeated literal numbers
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e717fa1f0a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
79f6a1b96e
avcodec/scpr: Check y in first line loop in decompress_i()
...
Fixes: out of array access
Fixes: 1478/clusterfuzz-testcase-minimized-5285486908145664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ac5067146 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
9b754ccc53
avcodec/dvbsubdec: Check entry_id
...
Fixes: randomly writing over the array end
Fixes: 1473/clusterfuzz-testcase-minimized-5768907824562176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8a69f2602f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
363b46cdbf
avcodec/aacdec_fixed: Fix multiple shift exponent 33 is too large for 32-bit type 'int'
...
Fixes: 1471/clusterfuzz-testcase-minimized-6376460543590400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a0ff78168 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
35f293fe89
avcodec/mpeg12dec: Fixes runtime error: division by zero
...
Fixes: 1464/clusterfuzz-testcase-minimized-4925445571084288
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c0ece1f4ad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
4a974cb595
avcodec/pixlet: Fix runtime error: signed integer overflow: 436207616 * -5160230545260541 cannot be represented in type 'long'
...
Fixes: 1462/clusterfuzz-testcase-minimized-6558894463647744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 60765cc42e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
924a2dd57a
avcodec/webp: Always set pix_fmt
...
Fixes: out of array access
Fixes: 1434/clusterfuzz-testcase-minimized-6314998085189632
Fixes: 1435/clusterfuzz-testcase-minimized-6483783723253760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6b5d3fb26f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
e9c3c8df45
avfilter/vf_uspp: Fix currently unused input frame dimensions
...
Found-by: Nicolas
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 942036e97c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
e6997adee9
avcodec/truemotion1: Fix multiple runtime error: left shift of negative value -1
...
Fixes: 1446/clusterfuzz-testcase-minimized-5577409124368384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit db5fae3229 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
3af036360d
avcodec/eatqi: Fix runtime error: signed integer overflow: 4466147 * 1075 cannot be represented in type 'int'
...
Fixes: 1443/clusterfuzz-testcase-minimized-4826998612426752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8de60ba27 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
3459fd598e
avcodec/dss_sp: Fix runtime error: signed integer overflow: 2147481189 + 4096 cannot be represented in type 'int'
...
Fixes: 1441/clusterfuzz-testcase-minimized-6223152357048320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ea4287893 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
李赞
f58b45f0ac
avformat/wavdec: Check chunk_size
...
Fixes integer overflow and out of array access
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d23219637 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
5d2ddaa139
avcodec/cavs: Check updated MV
...
Fixes: runtime error: signed integer overflow: 251 + 2147483647 cannot be represented in type 'int'
Fixes: 1438/clusterfuzz-testcase-minimized-4917542646710272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5871adc90f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
f66eaded01
avcodec/y41pdec: Fix width in input buffer size check
...
Fixes: out of array read
Fixes: 1437/clusterfuzz-testcase-minimized-4569970002362368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d8d372947 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
452629fb23
avcodec/svq3: Fix multiple runtime error: signed integer overflow: -237341 * 24552 cannot be represented in type 'int'
...
Fixes: 1429/clusterfuzz-testcase-minimized-5959951610544128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ae6fd1790f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
311b29134e
avcodec/texturedsp: Fix runtime error: left shift of 218 by 24 places cannot be represented in type 'int'
...
Fixes: 1428/clusterfuzz-testcase-minimized-5263281793007616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2bd8eb05d2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
be3a7857ed
avcodec/lagarith: Check scale_factor
...
Fixes: 1425/clusterfuzz-testcase-minimized-6295712339853312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ed3c9b5b0d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
95c80c7d27
avcodec/lagarith: Fix runtime error: left shift of negative value -1
...
Fixes: 1424/clusterfuzz-testcase-minimized-6088327159611392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ddb2dd7edb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
497de399c9
avcodec/takdec: Fix multiple runtime error: left shift of negative value -1
...
Fixes: 1423/clusterfuzz-testcase-minimized-5063889899225088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c5d2fa2fdf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
8850dc3771
avcodec/indeo2: Check for invalid VLCs
...
Fixes: timeout
Fixes: 1416/clusterfuzz-testcase-minimized-5536862435278848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 159fb8ff7e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
d9adb13ff6
avcodec/g723_1dec: Fix several integer related cases of undefined behaviour
...
Fixes: 1412/clusterfuzz-testcase-minimized-6561308772139008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d3088e0fd8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
9e54114647
avcodec/htmlsubtitles: Check for string truncation and return error
...
Fixes out of array access
Fixes: 1354/clusterfuzz-testcase-minimized-5520132195483648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f4ae3cce64 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
49aa0e9cc7
avcodec/bmvvideo: Fix runtime error: left shift of 137 by 24 places cannot be represented in type 'int'
...
Fixes: 1411/clusterfuzz-testcase-minimized-5776085184675840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 29692023b2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
27a30e4166
avcodec/dss_sp: Fix multiple runtime error: signed integer overflow: -15699 * -164039 cannot be represented in type 'int'
...
Fixed: 1409/clusterfuzz-testcase-minimized-5237365020819456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea59ef0c03 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
abeb7838ca
avcodec/dvbsubdec: check region dimensions
...
Fixes: 1408/clusterfuzz-testcase-minimized-6529985844084736
Fixes: integer overflow
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0075d9eced )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
6ec9c902ee
avcodec/vp8dsp: Fixes: runtime error: signed integer overflow: 1330143360 - -1023040530 cannot be represented in type 'int'
...
Fixes: 1406/clusterfuzz-testcase-minimized-5064865125236736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8824b7370a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
0d17ecffa5
avcodec/hqxdsp: Fix multiple runtime error: signed integer overflow: 248220 * 21407 cannot be represented in type 'int' in idct_col()
...
Fixes: 1405/clusterfuzz-testcase-minimized-5011491835084800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d5118f81b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
88893627a1
avcodec/cavsdec: Check sym_factor
...
Fixes: runtime error: signed integer overflow: 25984 * 130560 cannot be represented in type 'int'
Fixes: 1404/clusterfuzz-testcase-minimized-5000441286885376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 279420b5a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
a483e46b79
avcodec/cdxl: Check format for BGR24
...
Fixes: out of array access
Fixes: 1427/clusterfuzz-testcase-minimized-5020737339392000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e42736b95 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
97eb92b276
avcodec/ffv1dec: Fix copying planes of paletted formats
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a4d387195 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
e397902d47
avcodec/wmv2dsp: Fix runtime error: signed integer overflow: 181 * -12156865 cannot be represented in type 'int'
...
Fixes: 1401/clusterfuzz-testcase-minimized-6526248148795392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b1f66cf5c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
edb8d29ca5
avcodec/xwddec: Check bpp more completely
...
Fixes out of array access
Fixes: 1399/clusterfuzz-testcase-minimized-4866094172995584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 441026fcb1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
bf4b8b1677
avcodec/aacdec_template: Do not decode 2nd PCE if it will lead to failure
...
Fixes: out of array read
Fixes: 1072/clusterfuzz-testcase-6456688074817536
Fixes: 1398/clusterfuzz-testcase-minimized-4576913622302720
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5e0dbf530 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
298de0a183
avcodec/s302m: Fix left shift of 8 by 28 places cannot be represented in type 'int'
...
Fixes: 1395/clusterfuzz-testcase-minimized-5330939741732864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a38e9797cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
8795bf9e5d
avcodec/eamad: Fix runtime error: signed integer overflow: 49674 * 49858 cannot be represented in type 'int'
...
Fixes: 1394/clusterfuzz-testcase-minimized-6493376885030912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ac1c87194 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
77af726871
avcodec/g726: Fix runtime error: left shift of negative value -2
...
Fixes: 1393/clusterfuzz-testcase-minimized-5948366791901184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c04aa14882 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
9970fa10c0
avcodec/magicyuv: Check len to be supported
...
Fixes: shift exponent -1 is negative
Fixes: 1390/clusterfuzz-testcase-minimized-5452757630713856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2162b862eb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
ffa39cd574
avcodec/ra144: Fix runtime error: left shift of negative value -798
...
Fixes: 1388/clusterfuzz-testcase-minimized-6680800936329216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 78bf446852 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
3f7a9eef51
avcodec/mss34dsp: Fix multiple signed integer overflow
...
Fixes: 1387/clusterfuzz-testcase-minimized-4802757766676480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 464c4b86ee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
eec20b665a
avcodec/targa_y216dec: Fix width type
...
Fixes out of array access
Fixes: 1376/clusterfuzz-testcase-minimized-6361794975105024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3e56db8926 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
4f0fecf9fa
avcodec/texturedsp: Fix multiple runtime error: left shift of 255 by 24 places cannot be represented in type 'int'
...
Fixes: 1386/clusterfuzz-testcase-minimized-5323086394032128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e92fb2bea1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
fca86d3e28
avcodec/ivi_dsp: Fix multiple left shift of negative value -2
...
Fixes: 1385/clusterfuzz-testcase-minimized-5552882663292928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e88cc94e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
bd739bce1c
avcodec/svq3: Fix multiple runtime error: signed integer overflow: 44161 * 61694 cannot be represented in type 'int'
...
Fixes: 1382/clusterfuzz-testcase-minimized-6013445293998080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 669419939c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
f8eea96d64
avcodec/msmpeg4dec: Correct table depth
...
Fixes undefined shift
Fixes: 1381/clusterfuzz-testcase-minimized-5513944540119040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1121d92707 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
c108bba1ae
avcodec/dds: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
...
Fixes: 1380/clusterfuzz-testcase-minimized-650122545122508
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8a8335de03 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
973a66108b
avcodec/cdxl: Check format parameter
...
Fixes out of array access
Fixes: 1378/clusterfuzz-testcase-minimized-5715088008806400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e1b60aad77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
cbc5796fc3
avutil/softfloat: Fix overflow in av_div_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 277e397eb5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
66b7e165db
avcodec/hq_hqa: Fix runtime error: left shift of negative value -207
...
Fixes: 1375/clusterfuzz-testcase-minimized-6070134701555712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1283c42447 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
99bedf74ac
avcodec/mss3: Change types in rac_get_model_sym() to match the types they are initialized from
...
Fixes integer overflow
Fixes: 1372/clusterfuzz-testcase-minimized-5712192982745088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ef0f39271 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
2ff5e3f54e
avcodec/shorten: Check k in get_uint()
...
Fixes: undefined shift
Fixes: 1371/clusterfuzz-testcase-minimized-5770822591447040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b6a51f59c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
28c618355c
avcodec/webp: Fix null pointer dereference
...
Fixes: 1369/clusterfuzz-testcase-minimized-5048908029886464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9bf4523e40 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
88a3e4c34e
avcodec/dfa: Fix signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
...
Fixes: 1368/clusterfuzz-testcase-minimized-4507293276176384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 12936a4585 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
e2462c8828
avcodec/g723_1: Fix multiple runtime error: left shift of negative value
...
Fixes: 1367/clusterfuzz-testcase-minimized-571496882346393
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4ace2d2219 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
139d881273
avcodec/mimic: Fix runtime error: left shift of negative value -1
...
Fixes: 1365/clusterfuzz-testcase-minimized-5624158450876416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fc2c420b82 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
6f590bf05f
avcodec/clearvideo: Fix multiple runtime error: left shift of negative value -1024
...
Fixes: 1360/clusterfuzz-testcase-minimized-5606472043986944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c0ffcb34c7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
cab8d31804
avcodec/fic: Fix multiple left shift of negative value -15
...
Fixes: 1356/clusterfuzz-testcase-minimized-6008489086287872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b20c71409b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
3585986a00
avcodec/mlpdec: Fix runtime error: left shift of negative value -22
...
Fixes: 1355/clusterfuzz-testcase-minimized-6662205472768000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c535436cbe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
645b36ce64
avcodec/snowdec: Check qbias
...
Fixes: signed integer overflow: -1094995529 * 131 cannot be represented in type 'int'
Fixes: 1353/clusterfuzz-testcase-minimized-5208180449607680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 523205ce1e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
67835afd79
avutil/softfloat: Fix multiple runtime error: left shift of negative value -8
...
Fixes: 1352/clusterfuzz-testcase-minimized-5757565017260032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 35f3df0d76 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
955b97704f
avcodec/aacsbr_template: Do not leave bs_num_env invalid
...
Fixes out of array read
Fixes: 1349/clusterfuzz-testcase-minimized-5370707196248064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8ad83b793 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
28b6588b48
avcodec/mdec: Fix signed integer overflow: 28835400 * 83 cannot be represented in type 'int'
...
Fixes: 1346/clusterfuzz-testcase-minimized-5776732600664064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a234b5ade3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
7617b90f07
avcodec/dfa: Fix off by 1 error
...
Fixes out of array access
Fixes: 1345/clusterfuzz-testcase-minimized-6062963045695488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f52fbf4f3e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
2adf20b3da
avcodec/nellymoser: Fix multiple left shift of negative value -8591
...
Fixes: 1342/clusterfuzz-testcase-minimized-5490842129137664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0953736b7e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
b80d4f58d8
avcodec/cdxl: Fix signed integer overflow: 14243456 * 164 cannot be represented in type 'int'
...
Fixes: 1341/clusterfuzz-testcase-minimized-5441502618583040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1002932a3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
85bf84c96c
avcodec/g722: Fix multiple runtime error: left shift of negative value -1
...
Fixes: 1340/clusterfuzz-testcase-minimized-4669892148068352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f55df62998 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
5520e00a49
avcodec/dss_sp: Fix multiple left shift of negative value -466
...
Fixes: 1339/clusterfuzz-testcase-minimized-4614671485108224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38152d9368 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
671530ccb4
avcodec/wnv1: Fix runtime error: left shift of negative value -1
...
Fixes: 1338/clusterfuzz-testcase-minimized-6485546354343936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9fac508ca4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
1e8212798c
avcodec/tiertexseqv: set the fixed dimenasions, do not depend on the demuxer doing so
...
Fixes: out of array access
Fixes: 1348/clusterfuzz-testcase-minimized-6195673642827776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ce551a3925 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
484ce1af75
avcodec/mjpegdec: Fix runtime error: signed integer overflow: -24543 * 2031616 cannot be represented in type 'int'
...
Fixes: 943/clusterfuzz-testcase-5114865297391616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a78ae465fd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
175a569f5b
avcodec/cavsdec: Fix undefined behavior from integer overflow
...
Fixes: 1335/clusterfuzz-testcase-minimized-5566961566089216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a0e5f7f363 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
dd3a5f04b9
avcodec/dvdsubdec: Fix runtime error: left shift of 242 by 24 places cannot be represented in type 'int'
...
Fixes: 1080/clusterfuzz-testcase-5353236754071552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ce7098b8f2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
a5bcb36874
libavcodec/mpeg4videodec: Convert sprite_offset to 64bit
...
This avoids intermediates from overflowing (the final values are checked)
Fixes: runtime error: signed integer overflow: -167712 + -2147352576 cannot be represented in type 'int'
Fixes: 1298/clusterfuzz-testcase-minimized-5955580877340672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1c3a14073 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
142c65ba9c
avcodec/pngdec: Use ff_set_dimensions()
...
Fixes OOM
Fixes: 1314/clusterfuzz-testcase-minimized-4621997222920192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a0296fc056 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
dfda395b2f
avcodec/msvideo1: Check buffer size before re-getting the frame
...
Fixes timeout
Fixes: 1306/clusterfuzz-testcase-minimized-6152296217968640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cabfed6895 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
927ff67ab4
avcodec/h264_cavlc: Fix undefined behavior on qscale overflow
...
Fixes: 1214/clusterfuzz-testcase-minimized-6130606599569408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fc8cff96ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
44eabc5d5d
avcodec/dcadsp: Fix runtime error: signed integer overflow
...
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9244b839b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
78fd652af4
avcodec/svq3: Reject dx/dy beyond 16bit
...
The code does use 16bit sized arrays later so larger deltas would not work
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 48b3117844 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
65a9d0c66c
avcodec/svq3: Increase offsets to prevent integer overflows
...
Fixes: 1280/clusterfuzz-testcase-minimized-6102353767825408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 382b4fc9b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
b1fc2c5c25
avcodec/indeo2: Check remaining bits in ir2_decode_plane()
...
Fixes: 1290/clusterfuzz-testcase-minimized-5815578902134784
Fixes: timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b29feec982 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
b6a4aeb2f6
avcodec/vp3: Check remaining bits in unpack_dct_coeffs()
...
Decreases the time spend decoding junk.
May fix: 1283/clusterfuzz-testcase-minimized-6221126759874560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f00300b77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
0875b2651d
doc/developer: Add terse documentation of assumed C implementation defined behavior
...
Suggested-by: "Ronald S. Bultje" <rsbultje@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b706ddbae3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
681ca7ecd0
avcodec/bmp: Use ff_set_dimensions()
...
Fixes out of memory
Fixes: 1282/clusterfuzz-testcase-minimized-5400131681648640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 63b8d4146d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
51f24cb3f5
avcodec/mdec: Fix runtime error: left shift of negative value -127
...
Fixes undefined behavior
Fixes: 1275/clusterfuzz-testcase-minimized-6718162017976320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ca82975b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Michael Niedermayer
87dcc7502d
avcodec/x86/vc1dsp_init: Fix build failure with --disable-optimizations and clang
...
compilers doing DCE at -O0 do not necessarily understand "complex" boolean expressions
Build succeeds with this change, this was the only failure
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fa8fd0808f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Martin Vignali
3ffde707df
libavcodec/exr : fix float to uint16 conversion for negative float value
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e46d637452 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Derek Buitenhuis
2ff9e21f7f
avformat/webmdashenc: Validate the 'streams' adaptation sets parameter
...
It should not be a value larger than the number of streams we have,
or it will cause invalid reads and/or SIGSEGV.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec07efa700 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Derek Buitenhuis
9eb0d76e25
avformat/webmdashenc: Require the 'adaptation_sets' option to be set
...
This seems to be non-optional, and if the muxer is run without it,
strlen() is run on NULL, causing a segfault.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cbd3a68f3e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-14 00:21:49 +02:00
Marton Balint
508e410d34
lavfi/avfiltergraph: only return EOF in avfilter_graph_request_oldest if all sinks EOFed
...
Fixes a regression introduced in 32c59a115d ,
becoming effective in 912969a33e .
Fixes trimmed output of
ffmpeg -f lavfi -i "sine=d=0.01" -f lavfi -i "sine=d=1" -filter_complex "[0:a]anull[a1];[1:a]anull[a2]" -map "[a1]" -f null none -map "[a2]" -f framecrc -
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit c0443c1af1 )
2017-05-07 19:53:46 +02:00
wm4
059db22040
ffmpeg: check for unconnected outputs
...
Fixes e.g.:
ffmpeg -f lavfi -i testsrc -f lavfi -i testsrc -filter_complex "[0:v][1:v]psnr[out]" -f null none
Fixes ticket #6323 .
(cherry picked from commit 974ee16d6a )
2017-05-07 19:52:00 +02:00
Aaron Levinson
329176adc5
avformat/utils: free AVStream.codec properly in free_stream()
...
Fixes memory leaks.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit b9d2005ea5 )
2017-05-06 17:30:18 -03:00
James Almer
8119efdbec
avcodec/options: do a more thorough clean up in avcodec_copy_context()
...
Free coded_frame, coded_side_data and unref hw_device_ctx to prevent
potential leaks.
Reviewed-by: Aaron Levinson <alevinsn@aracnet.com >
Tested-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit cac8de2da5 )
2017-05-06 17:30:07 -03:00
James Almer
4f19268eee
avcodec/options: factorize avcodec_copy_context() cleanup code
...
Reviewed-by: Aaron Levinson <alevinsn@aracnet.com >
Tested-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 54a4c9b4e9 )
2017-05-06 17:29:59 -03:00
Muhammad Faiz
58a8e4733a
ffmpeg: count packets when queued
...
Because write_packet() fakely writes packets to muxer by queueing
them when muxer hasn't been initialized, it should also increment
frame_number fakely.
This is required because code in do_streamcopy() rely on
frame_number.
Should fix Ticket6227
Reviewed-by: James Almer <jamrial@gmail.com >
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Muhammad Faiz <mfcc64@gmail.com >
(cherry picked from commit c4be288fdb )
2017-05-02 16:42:36 -03:00
James Almer
cfca0b9139
avformat/concatdec: fix the h264 annexb extradata check
...
The start code can be either in the first three or four bytes.
(cherry picked from commit b4330a0e02 )
2017-04-26 21:50:02 -03:00
Paul B Mahol
da693f8daa
avcodec/dnxhd_parser: fix parsing interlaced video, simplify code
...
There appears to be no need to treat interlaced videos differently,
also that code is flawed, as for at least one input cur_field would
be always 0.
Fixes ticket #6344 .
Signed-off-by: Paul B Mahol <onemda@gmail.com >
(cherry picked from commit ac30754a14 )
2017-04-25 00:29:37 +02:00
Marton Balint
ed2ed4ac0f
ffmpeg; check return code of avcodec_send_frame when flushing encoders
...
Fixes Coverity CID 1404841.
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit c037f2f1ba )
2017-04-22 23:17:22 +02:00
Ronald S. Bultje
1968a1eef1
pthread_frame: make accesses to debug field be protected by owner lock.
...
The av_log() is done outside the lock, but this way the accesses to the
field (reads and writes) are always protected by a mutex. The av_log()
is not run inside the lock context because it may involve user callbacks
and doing that in performance-sensitive code is probably not a good idea.
This should fix occasional tsan warnings when running fate-h264, like:
WARNING: ThreadSanitizer: data race (pid=10916)
Write of size 4 at 0x7d64000174fc by main thread (mutexes: write M2313):
#0 update_context_from_user src/libavcodec/pthread_frame.c:335 (ffmpeg+0x000000df7b06)
[..]
Previous read of size 4 at 0x7d64000174fc by thread T1 (mutexes: write M2311):
#0 ff_thread_await_progress src/libavcodec/pthread_frame.c:592 (ffmpeg+0x000000df8b3e)
(cherry picked from commit 2e664b9c1e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-13 02:29:26 +02:00
Ronald S. Bultje
f4f3bf3c94
pthread_frame: allow per-field ThreadFrame owners.
...
This tries to handle cases where separate invocations of decode_frame()
(each running in separate threads) write to respective fields in the
same AVFrame->data[]. Having per-field owners makes interaction between
readers (the referencing thread) and writers (the decoding thread)
slightly more optimal if both accesses are field-based, since they will
use the respective producer's thread objects (mutex/cond) instead of
sharing the thread objects of the first field's producer.
In practice, this fixes the following tsan-warning in fate-h264:
WARNING: ThreadSanitizer: data race (pid=21615)
Read of size 4 at 0x7d640000d9fc by thread T2 (mutexes: write M1006):
#0 ff_thread_report_progress pthread_frame.c:569 (ffmpeg:x86_64+0x100f7cf54)
[..]
Previous write of size 4 at 0x7d640000d9fc by main thread (mutexes: write M1004):
#0 update_context_from_user pthread_frame.c:335 (ffmpeg:x86_64+0x100f81abb)
(cherry picked from commit 083300bea9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-13 02:29:26 +02:00
Ronald S. Bultje
6557ea8e2b
vp8: make mv_min/max thread-local if using partition threading.
...
Fixes tsan warnings like this in fate-vp8-test-vector-007:
WARNING: ThreadSanitizer: data race (pid=65909)
Write of size 4 at 0x7d8c0000e088 by thread T1:
#0 vp8_decode_mb_row_sliced vp8.c:2519 (ffmpeg:x86_64+0x100995ede)
[..]
Previous write of size 4 at 0x7d8c0000e088 by thread T2:
#0 vp8_decode_mb_row_sliced vp8.c:2519 (ffmpeg:x86_64+0x100995ede)
(cherry picked from commit fed92adbb3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-13 02:29:26 +02:00
Ronald S. Bultje
9d742f774a
vp8: make wait/thread_mb_pos atomic.
...
Fixes tsan warnings like this in fate-vp8-test-vector-007:
WARNING: ThreadSanitizer: data race (pid=3590)
Write of size 4 at 0x7d8c0000e07c by thread T2:
#0 decode_mb_row_no_filter src/libavcodec/vp8.c:2330 (ffmpeg+0x000000ffb59e)
[..]
Previous write of size 4 at 0x7d8c0000e07c by thread T1:
#0 decode_mb_row_no_filter src/libavcodec/vp8.c:2330 (ffmpeg+0x000000ffb59e)
(cherry picked from commit 9a54c6f243 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-13 02:29:26 +02:00
Ronald S. Bultje
5e84c94f69
huffyuv: assign correct per-thread avctx pointer to HYuvContext::avctx.
...
Fixes the following tsan warning when running fate-vsynth_lena-ffvhuff:
WARNING: ThreadSanitizer: data race (pid=6484)
Write of size 8 at 0x7d64000154b8 by main thread (mutexes: write M1331):
#0 update_context_from_user src/libavcodec/pthread_frame.c:331 (ffmpeg+0x000000dca887)
[..]
Previous read of size 8 at 0x7d64000154b8 by thread T2 (mutexes: write M1334):
#0 draw_slice src/libavcodec/huffyuvdec.c:857 (ffmpeg+0x000000bcc86f)
(cherry picked from commit 7c7e7c44a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-13 02:29:26 +02:00
Ronald S. Bultje
e90de50195
png: set AVFrame flags/fields before calling setup_finished().
...
Fixes tsan warnings in fate-apng:
WARNING: ThreadSanitizer: data race (pid=51230)
Read of size 4 at 0x7d50000042fc by main thread (mutexes: write M1000):
#0 frame_copy_props frame.c:302 (ffmpeg:x86_64+0x1019a35d6)
[..]
Previous write of size 4 at 0x7d50000042fc by thread T1 (mutexes: write M997):
#0 decode_idat_chunk pngdec.c:708 (ffmpeg:x86_64+0x100f5562a)
(cherry picked from commit eff2861a75 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-13 02:29:26 +02:00
Ronald S. Bultje
51ca6fda05
png: split header state and data state in two separate variables.
...
Fixes a reported (but false) race condition in tsan for fate-apng:
WARNING: ThreadSanitizer: data race (pid=6274)
Read of size 4 at 0x7d680001ec78 by main thread (mutexes: write M1338):
#0 update_thread_context src/libavcodec/pngdec.c:1456 (ffmpeg+0x000000dacf0c)
[..]
Previous write of size 4 at 0x7d680001ec78 by thread T1 (mutexes: write M1335):
#0 decode_idat_chunk src/libavcodec/pngdec.c:737 (ffmpeg+0x000000dae951)
(cherry picked from commit 478f1c3d5e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-13 02:29:26 +02:00
Ronald S. Bultje
d1cae50a04
hevc: only write to max_ra and pocTid0 in the first slice.
...
Values from subsequent values are guaranteed to be identical (since
poc and nal_unit_type are checked to be the same between slices), so
this doesn't affect output in any way, but does resolve the remaining
reported race conditions (by tsan) in fate-hevc.
In practice, this fixes tsan warnings like this:
WARNING: ThreadSanitizer: data race (pid=25334)
Read of size 4 at 0x7d9c0001adcc by main thread (mutexes: write M1386):
#0 hevc_update_thread_context src/libavcodec/hevcdec.c:3310 (ffmpeg+0x000000b41c7c)
[..]
Previous write of size 4 at 0x7d9c0001adcc by thread T1 (mutexes: write M1383):
#0 hls_slice_header src/libavcodec/hevcdec.c:596 (ffmpeg+0x000000b43a22)
(cherry picked from commit 1f50baa2b2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-13 02:29:26 +02:00
Ronald S. Bultje
b51217381d
pthread_frame: call update_context_from_user() after acquiring lock.
...
Otherwise the thread may still be in the middle of decoding a previous
frame, which would effectively trigger a race condition on any field
concurrently read and written.
In practice, this fixes tsan warnings like the following:
WARNING: ThreadSanitizer: data race (pid=17380)
Write of size 4 at 0x7d64000160fc by main thread:
#0 update_context_from_user src/libavcodec/pthread_frame.c:335 (ffmpeg+0x000000dca515)
[..]
Previous read of size 4 at 0x7d64000160fc by thread T2 (mutexes: write M1821):
#0 ff_thread_report_progress src/libavcodec/pthread_frame.c:565 (ffmpeg+0x000000dcb08a)
(cherry picked from commit 1269cd5b6f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-13 02:29:26 +02:00
Ronald S. Bultje
f5f0b2f44c
ffmpeg: make transcode_init_done atomic.
...
Should fix tsan warnings in fate-fifo-muxer-h264/wav:
WARNING: ThreadSanitizer: data race (pid=26552)
Write of size 4 at 0x000001e0d7c0 by main thread:
#0 transcode_init src/ffmpeg.c:3761 (ffmpeg+0x00000050ca1c)
[..]
Previous read of size 4 at 0x000001e0d7c0 by thread T1:
#0 decode_interrupt_cb src/ffmpeg.c:460 (ffmpeg+0x0000004fde19)
(cherry picked from commit 76d8c77430 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-13 02:29:26 +02:00
Ronald S. Bultje
e9fc7a90ba
h264: don't sync pic_id between threads.
...
This is how the ref list manager links bitstream IDs to H264Picture/Ref
objects, and is local to the producer thread. There is no need for the
consumer thread to know the bitstream IDs of its references in their
respective producer threads.
In practice, this fixes tsan warnings when running fate-h264:
WARNING: ThreadSanitizer: data race (pid=19295)
Read of size 4 at 0x7dbc0000e614 by main thread (mutexes: write M1914):
#0 ff_h264_ref_picture src/libavcodec/h264_picture.c:112 (ffmpeg+0x0000013b3709)
[..]
Previous write of size 4 at 0x7dbc0000e614 by thread T2 (mutexes: write M1917):
#0 build_def_list src/libavcodec/h264_refs.c:91 (ffmpeg+0x0000013b46cf)
(cherry picked from commit e72690b18d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-13 02:29:26 +02:00
Ronald S. Bultje
414d11fff6
h264: don't re-call ff_h264_direct_ref_list_init() w/ frame-mt.
...
I'm hoping that this will address the remaining tsan fate-h264 issues:
WARNING: ThreadSanitizer: data race (pid=24478)
Read of size 8 at 0x7dbc0001c828 by main thread (mutexes: write M3243):
#0 ff_h264_ref_picture src/libavcodec/h264_picture.c:107 (ffmpeg+0x0000013b78d8)
[..]
Previous write of size 1 at 0x7dbc0001c82e by thread T2 (mutexes: write M3245):
#0 ff_h264_direct_ref_list_init src/libavcodec/h264_direct.c:137 (ffmpeg+0x000001382c93)
But I'm not sure because I haven't been able to reproduce locally.
(cherry picked from commit 7f05c5cea0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-13 02:29:26 +02:00
James Almer
1830b0a6c7
avformat/movenc: auto insert vp9_superframe bsf when needed
...
Experimental VP9 support was added to the muxer recently.
Reviewed-by: Ronald S. Bultje <rsbultje@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit d36a3f5a78 )
2017-04-12 20:53:55 -03:00
Carl Eugen Hoyos
0ed4f26cf2
configure: Fix decklink license dependency.
...
(cherry picked from commit a081acc440 )
2017-04-12 22:51:03 +02:00
Marton Balint
69e35db80d
ffprobe: only use custom logging callback if -show_log is set
...
The custom callback can cause significant CPU usage on Windows for some large
files with many index entries for some reason.
v2: Move check after parsing options.
Signed-off-by: Marton Balint <cus@passwd.hu >
2017-04-12 21:09:32 +02:00
Marton Balint
af43c7092c
tests/fate/filter-video: fix framerate filter tests
...
Signed-off-by: Marton Balint <cus@passwd.hu >
2017-04-12 21:09:18 +02:00
Marton Balint
ecdf52745f
avfilter/vf_framerate: always request input if no output is provided in request_frame
...
Fixes ticket #6285 .
Signed-off-by: Marton Balint <cus@passwd.hu >
2017-04-12 21:08:45 +02:00
Michael Niedermayer
07e7ebf52d
add release notes based on release 3.2
...
Name suggestion was from Tobias Rapp and Bodecs Bela
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-12 03:12:19 +02:00
Michael Niedermayer
37589e6443
Update for 3.3
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-12 02:24:58 +02:00
Michael Niedermayer
ad37fb86d7
doc/APIchanges: Fill in missing fields
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5b441d2981 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-12 02:22:51 +02:00
Michael Niedermayer
4f325589f9
avformat/oggparseogm: Check ff_alloc_extradata() for failure
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9eff4b0d2b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-11 23:39:21 +02:00
Michael Niedermayer
707d4c7fb5
avformat/oggparseogm: Check available data before reading global header
...
Fixes use of uninitialized data
Found-by: Thomas Guilbert <tguilbert@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 170d864d2c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-11 23:39:21 +02:00
Michael Niedermayer
c30d0ace65
avcodec/pixlet: Reorder rlen check
...
This changes nothing but is nicer looking as this checks rlen
Maybe this helps coverity remove CID1397743
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c94d551ea7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-11 23:39:21 +02:00
Michael Niedermayer
0c188bc595
avcodec/mjpegenc_huffman: Assert length in ff_mjpegenc_huffman_compute_bits()
...
This should help coverity see that the issues this leads to cannot occur
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8dd0c12648 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-11 23:39:21 +02:00
Rostislav Pehlivanov
72e038acaf
mpegvideo_enc: disable optimized huffman coding with AMV or slice threads
...
Doesn't work yet with slice threading and won't work with AMV.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 03eb0515c1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-11 23:39:21 +02:00
Michael Niedermayer
83e6a4a32b
Revert "mjpegenc: disable huffman coding with AMV"
...
This was the wrong patch
This reverts commit 7f9b492d54 .
(cherry picked from commit 724bb805ef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-11 23:39:21 +02:00
Michael Niedermayer
7182fbc471
doc/examples/decode_video: Fix format string vulnerability
...
Fixes: CID1404843
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 23edd41a0d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-11 23:39:21 +02:00
Steven Liu
0b4d87fad1
Revert "avutil/avstring: add av_strreplace API into avstring"
...
This reverts commit 99e5d81ef9 .
2017-04-11 08:05:54 +08:00
Rostislav Pehlivanov
7034009f62
mjpegenc: disable huffman coding with AMV
...
Isn't supported.
Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com >
(cherry picked from commit 7f9b492d54 )
Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com >
2017-04-09 00:02:46 +01:00
Rostislav Pehlivanov
6c9574e490
mjpegenc_common: check for codec ID before using avctx->priv_data
...
When coding lossless jpeg the priv context will be pointing to LJpegEncContext
rather than MpegEncContext, which the function expects.
Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com >
(cherry picked from commit 2c9be3882a )
Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com >
2017-04-09 00:02:12 +01:00
James Almer
37fcf089b4
avformat/matroskaenc: don't try to update flac extradata if live streaming
...
(cherry picked from commit a8b5f37501 )
2017-04-08 17:44:42 -03:00
Michael Niedermayer
f4400a92f5
avformat/mov: Check creation_time for overflow
...
Fixes integer overflow
Fixes: 701640
Found-by: Found-by: Thomas Guilbert <tguilbert@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 39ee3ddff8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-08 22:31:05 +02:00
Michael Niedermayer
a430ba9925
avcodec/dvdsubdec: Fixes 2 runtime error: left shift of 170 by 24 places cannot be represented in type 'int'
...
Fixes: 619/clusterfuzz-testcase-5803914534322176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 61ee2ca775 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-08 22:31:05 +02:00
Michael Niedermayer
1833ec5334
avcodec/h264: Check weight values to be within the specs limits.
...
Fixes: integer overflows
Fixes: 911/clusterfuzz-testcase-5415105606975488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 08117a4015 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-08 22:31:05 +02:00
Thierry Foucu
c9c977be27
libavformat/mov: Fix memory leak, need to free the chapter tracks array
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ac24a8202a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-04-08 22:31:05 +02:00
Mark Thompson
3c9e1b89a1
Changelog: fix position of VAAPI MPEG-2/VP8 encode entry
...
This was merged in the wrong place.
(cherry picked from commit 3cbf717425 )
2017-04-02 23:20:19 +01:00
James Almer
2ff93effb3
Changelog: add missing entry for VP8 QSV decoder
...
(cherry picked from commit 7ab9d3f341 )
2017-04-02 18:40:02 -03:00
James Almer
b1377b2d28
Changelog: add 3.3
2017-04-02 18:39:47 -03:00
Diego Biurrun
e0064df4ff
build: Add missing object dependency for extract_extradata bitstream filter
...
Cherry-picked from libav commit cfee5e1a0f
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit f8e29a3716 )
2017-04-02 16:12:33 -03:00