Michael Niedermayer
3f8a0d5ad1
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 01:11:57 +01:00
Michael Niedermayer
603d23ffeb
avcodec/vp8: Check for bitstream end before vp7_fade_frame()
...
Fixes: Timeout
Fixes: 5653/clusterfuzz-testcase-5497680018014208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit de675648ce )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-18 23:28:53 +01:00
Michael Niedermayer
09dad52390
avcodec/exr: Check remaining bits in last get code loop
...
Fixes: runtime error: shift exponent -7 is negative
Fixes: 3902/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6081926122176512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dd8351b118 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-17 16:11:57 +01:00
Michael Niedermayer
a3c66132d9
avutil/common: Fix integer overflow in av_clip_uint8_c() and av_clip_uint16_c()
...
Fixes: 5567/clusterfuzz-testcase-minimized-5769966247739392
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab6f571ef7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-17 16:11:19 +01:00
Michael Niedermayer
6cfd81b04c
avcodec/h264_cabac: Tighten allowed coeff_abs range
...
Fixes: integer overflows
Reported-by: "Xiaohan Wang (王消寒)" <xhwang@chromium.org >
Based on limits in "8.5 Transform coefficient decoding process and picture
construction process prior to deblocking filter process"
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f26a63c4ee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-15 14:09:54 +01:00
Xiaohan Wang
07e46226ae
avcodec/h264_cavlc: Set valid qscale value in ff_h264_decode_mb_cavlc()
...
When ff_h264_decode_mb_cavlc() failed due to wrong sl->qscale values,
e.g. dquant out of range, set the qscale to be a valid value before
returning -1 and exiting the function. The qscale value can be used
later e.g. in loop filter.
BUG=806122
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 71f39de2a5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-14 01:08:21 +01:00
Michael Niedermayer
d797d9f215
Changelog: Update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-13 00:41:03 +01:00
Michael Niedermayer
89668fa843
avcodec/vp3: Error out on invalid num_coeffs in unpack_vlcs()
...
This fixes a hypothetical integer overflow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f2318aee8c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-12 03:07:59 +01:00
Michael Niedermayer
dd422f1b5e
avcodec/mpeg4videodec: Ignore multiple VOL headers
...
Fixes: Ticket7005
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 63a4bdbf3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-12 03:07:59 +01:00
Michael Niedermayer
66f831a8d1
avcodec/vp3: Check eob_run
...
Fixes: out of array access
Fixes: 5919/clusterfuzz-testcase-minimized-5859311382167552
Fixes: special case for theora (untested due to lack of sample)
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 570023eab3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-12 03:07:59 +01:00
Michael Niedermayer
c402b672b7
avcodec/huffyuvdec: Check input buffer size
...
Fixes: Timeout
Fixes: 5487/clusterfuzz-testcase-4696837035393024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 08c220d26c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-12 03:02:29 +01:00
Michael Niedermayer
263bddf781
avcodec/wavpack: Fix integer overflow in FFABS
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 5396/clusterfuzz-testcase-minimized-6558555529281536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e50bd61e4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-12 03:02:29 +01:00
Michael Niedermayer
5b6324a94c
avcodec/aacsbr_fixed: Fix overflows in rounding in sbr_hf_assemble()
...
Fixes: runtime error: signed integer overflow: 2052929346 + 204817098 cannot be represented in type 'int'
Fixes: 5275/clusterfuzz-testcase-minimized-5367635958038528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b1bef755f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-12 03:02:29 +01:00
James Almer
c95d343ae1
changelog: update with previous commit
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 03292829aa )
2018-01-31 22:35:13 -03:00
Luca Barbato
7a30e6448c
x264: Support version 153
...
It has native simultaneus 8 and 10 bit support.
(cherry picked from commit c6558e8840 )
(cherry picked from commit 96e8400553 )
2018-01-31 22:09:44 -03:00
Michael Niedermayer
172edcf3ba
Update for 2.8.14
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:41 +01:00
Michael Niedermayer
a0c366b1f5
avcodec/indeo5: Do not leave frame_type set to an invalid value
...
Fixes: null pointer dereference
Fixes: 5264/clusterfuzz-testcase-minimized-4621956621008896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ff9f17851 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:16 +01:00
Michael Niedermayer
4abdd65356
avcodec/hevc_ps: Check log2_sao_offset_scale_*
...
Fixes: 4868/clusterfuzz-testcase-minimized-6236542906400768
Fixes: runtime error: shift exponent 126 is too large for 32-bit type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a75a75c62 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:16 +01:00
Aman Gupta
b40576a9a4
avcodec/hevc_ps: extract one SPS fields required for hvcC construction
...
Signed-off-by: Aman Gupta <aman@tmm1.net >
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:15 +01:00
Michael Niedermayer
b6a7dd174a
avcodec/mpeg4videodec: Avoid possibly aliasing violating casts
...
Found-by: kierank
Reviewed-by: Kieran Kunhya <kieran618@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d4967c04e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:15 +01:00
Michael Niedermayer
f606a943d3
avcodec/get_bits: Document the return code of get_vlc2()
...
Found-by: kierank
Reviewed-by: Kieran Kunhya <kieran618@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a94ff4ccd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:15 +01:00
Michael Niedermayer
54a7d3efc4
avcodec/mpeg4videodec: Check mb_num also against 0
...
The spec implies that 0 is invalid in addition to the existing checks
Found-by: <kierank>
Reviewed-by: Kieran Kunhya <kieran618@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 05f4703a16 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:15 +01:00
Michael Niedermayer
ed06873b7b
avfilter/vf_transpose: Fix used plane count.
...
Fixes out of array access
Fixes: poc.mp4
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c6939f65a1 )
(cherry picked from commit 3f621455d6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:15 +01:00
Michael Niedermayer
c740f585a1
avcodec/hevc_cabac: Check prefix so as to avoid invalid shifts in coeff_abs_level_remaining_decode()
...
I suspect that this can be limited tighter, but i failed to find anything
in the spec that would confirm that.
Fixes: 4833/clusterfuzz-testcase-minimized-5302840101699584
Fixes: runtime error: left shift of 134217730 by 4 places cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a026a3efae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:15 +01:00
Michael Niedermayer
c1f7b2b6e1
avcodec/mjpegdec: Fix integer overflow in DC dequantization
...
Fixes: runtime error: signed integer overflow: -65535 * 65312 cannot be represented in type 'int'
Fixes: 4900/clusterfuzz-testcase-minimized-5769019744321536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1bfc1aa004 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:15 +01:00
Michael Niedermayer
193b6df357
avcodec/hevc_cabac: Move prefix check in coeff_abs_level_remaining_decode() down
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 94d4237a7a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:15 +01:00
Michael Niedermayer
25f7121c7b
avcodec/truemotion2: Fix integer overflow in TM2_RECALC_BLOCK()
...
Fixes: signed integer overflow: 1477974040 - -1877995504 cannot be represented in type 'int'
Fixes: 4861/clusterfuzz-testcase-minimized-4570316383715328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 56a53340ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:15 +01:00
Michael Niedermayer
b9948d5275
avcodec/snowdec: Fix integer overflow before htaps check
...
Fixes: runtime error: signed integer overflow: -1094995529 * 2 cannot be represented in type 'int'
Fixes: 4828/clusterfuzz-testcase-minimized-5100849937252352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2eecf3cf8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:15 +01:00
Michael Niedermayer
0036b62c99
avcodec/ulti: Check number of blocks at init
...
Fixes: Timeout
Fixes: 4832/clusterfuzz-testcase-4699096590843904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 725353525e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:15 +01:00
Michael Niedermayer
b51f1f5a19
avcodec/ac3dec_fixed: Fix integer overflow in scale_coefs()
...
Fixes: runtime error: signed integer overflow: 2147483520 + 128 cannot be represented in type 'int'
Fixes: 4800/clusterfuzz-testcase-minimized-6110372403609600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1f38c7589 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Nikolas Bowe
3e499537a4
avformat/lrcdec: Fix memory leak in lrc_read_header()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ef5994e09d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Nikolas Bowe
5971f1941b
avformat/matroskadec: Fix float-cast-overflow undefined behavior in matroska_parse_tracks()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e07649e618 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Carl Eugen Hoyos
10ed2f1972
configure: bump year
...
Happy new year!
(cherry picked from commit bddf31ba75 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
74aeeb223a
avcodec/arm/sbrdsp_neon: Use a free register instead of putting 2 things in one
...
Fixes high pitched shriek
Fixes: 25420848_1478428308873746_4255813235963330560_n.mp4
Reported-by: Dale Curtis <dalecurtis@google.com >
Reviewed-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7dbbb75ee3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
82fb8dc076
avcodec/h264addpx_template: Fixes integer overflows
...
Fixes: signed integer overflow: 512 + 2147483491 cannot be represented in type 'int'
Fixes: 4780/clusterfuzz-testcase-minimized-4709066174627840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d6945aeee4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
2885e45eb4
avcodec/dirac_dwt: Fix overflows in COMPOSE_HAARiH0/COMPOSE_HAARiL0
...
Fixes: 4830/clusterfuzz-testcase-minimized-5255392054476800
Fixes: signed integer overflow: 2147483646 - -7 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e62a23734 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
c65c4c4759
avcodec/diracdec: Fix integer overflow with quant
...
Fixes: signed integer overflow: 2 + 2147483646 cannot be represented in type 'int'
Fixes: 4792/clusterfuzz-testcase-minimized-6322450775146496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eaa9317589 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
c860d5326f
avcodec/opus_parser: Check payload_len in parse_opus_ts_header()
...
Fixes: clusterfuzz-testcase-minimized-6134545979277312
Fixes: crbug 797469
Reported-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1bcd7fefcb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
a15c056f5c
avcodec/jpeg2000dsp: Fix integer overflows in ict_int()
...
Fixes: signed integer overflow: 46802 * -71230 cannot be represented in type 'int'
Fixes: 4756/clusterfuzz-testcase-minimized-4812495563784192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b3192c64b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
761362fffb
avcodec/h264_slice: Do not attempt to render into frames already output
...
Fixes: null pointer dereference
Fixes: 4698/clusterfuzz-testcase-minimized-5096956322906112
This testcase does not reproduce the issue before 03b82b3ab9
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 476665d4de )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
0abf465dc5
avcodec/exr: Check buf_size more completely
...
Fixes: Out of heap array read
Fixes: 4683/clusterfuzz-testcase-minimized-6152313673613312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 903be5e4f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
2a53778676
avcodec/flacdec: Fix overflow in multiplication in decode_subframe_fixed()
...
Fixes: signed integer overflow: 2 * 1629495328 cannot be represented in type 'int'
Fixes: 4716/clusterfuzz-testcase-minimized-5835915940331520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d23f7a096 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
aae8ea9c18
avcodec/hevcdsp_template: Fix Invalid shifts in put_hevc_qpel_bi_w_h() and put_hevc_qpel_bi_w_w()
...
Fixes: left shift of negative value -1
Fixes: 4690/clusterfuzz-testcase-minimized-6117482428366848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d135f3c514 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
59e3f49ef0
avcodec/flacdec: avoid undefined shift
...
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 4688/clusterfuzz-testcase-minimized-6572210748653568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 560daf8891 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
789157fdde
avcodec/hevcdsp_template.c: Fix undefined shift in FUNC(dequant)
...
Fixes: runtime error: left shift of negative value -180
Fixes: 4626/clusterfuzz-testcase-minimized-5647837887987712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c9ab5ef9c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
d0967e3faf
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD97iH0() and COMPOSE_DD137iL0()
...
Fixes: runtime error: signed integer overflow: 2147483646 + 33554433 cannot be represented in type 'int'
Fixes: 4563/clusterfuzz-testcase-minimized-5438979567517696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4d70fbeec8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
4eb24ae083
avcodec/hevc_cabac: Fix integer overflow in ff_hevc_cu_qp_delta_abs()
...
Fixes: signed integer overflow: 2147483647 + 1073741824 cannot be represented in type 'int'
Fixes: 4555/clusterfuzz-testcase-minimized-4505532481142784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ee143558d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
f75e2cb059
avcodec/hevc_sei: Fix integer overflows in decode_nal_sei_message()
...
Fixes: signed integer overflow: 2147483520 + 255 cannot be represented in type 'int'
Fixes: 4554/clusterfuzz-testcase-minimized-4843714515042304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 991ef6e5b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
d1af42e4b2
avcodec/hevcdsp_template: Fix undefined shift in put_hevc_qpel_bi_w_hv()
...
Fixes: runtime error: left shift of negative value -3
Fixes: 4524/clusterfuzz-testcase-minimized-6055590120914944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 439fbb9c8b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Kelly Ledford
b6731e87c8
libavfilter/af_dcshift.c: Fixed repeated spelling error
...
'threshhold' should be 'threshold'
Signed-off-by: Kelly Ledford <kelly.ledford@intel.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc219082bb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Jun Zhao
15df68bf50
avfilter/formats: fix wrong function name in error message
...
Use perdefined micro __FUNCTION__ rather than hard coding function name
to fix wrong function name in error message.
Signed-off-by: Jun Zhao <jun.zhao@intel.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4280948702 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
f4cce67dca
avcodec/amrwbdec: Fix division by 0 in voice_factor()
...
The added value matches "Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS); LTE; Extended Adaptive Multi-Rate - Wideband (AMR-WB+) codec; Floating-point ANSI-C code (3GPP TS 26.304 version 14.0.0 Release 14)
Extended Adaptive Multi-Rate - Wideband (AMR-WB+) codec; Floating-point ANSI-C code"
Fixes: runtime error: division by zero
Fixes: 4415/clusterfuzz-testcase-minimized-4677752314658816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1d0817d56b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
2bffe4613e
avcodec/dirac_dwt: Fix integer overflows in COMPOSE_DAUB97*
...
Fixes: 4478/clusterfuzz-testcase-minimized-4752113767809024
Fixes: runtime error: signed integer overflow: -2147483626 + -319489 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5e9a13a5a3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Dale Curtis
9166e6abd6
avcodec/vorbis: Fix another 1 << 31 > int32_t::max() with 1u.
...
Didn't notice this one when 9648cc6d was landed.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 95bacb521a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Dale Curtis
8bea0c307d
Don't manipulate duration when it's AV_NOPTS_VALUE.
...
This leads to signed integer overflow.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit c5fd57f483 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Dale Curtis
1bc4e743f5
avcodec/vorbis: 1 << 31 > int32_t::max(), so use 1u << 31 instead.
...
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9648cc6d7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Dale Curtis
2543475730
avformat/utils: Prevent undefined shift with wrap_bits > 64.
...
2LL << (wrap_bits=64 - 1) does not fit in int64_t; change the
code to use a uint64_t (2ULL) and add an av_assert2() to
ensure wrap_bits <= 64.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 03fbc0daa7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
cf32c814ed
avcodec/j2kenc: Fix out of array access in encode_cblk()
...
Fixes: 4427/clusterfuzz-testcase-minimized-5106919271301120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0674087004 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
2f7cced9bb
avcodec/hevcdsp_template: Fix undefined shift in put_hevc_epel_bi_w_h()
...
Fixes: runtime error: left shift of negative value -127
Fixes: 4397/clusterfuzz-testcase-minimized-4779061080489984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0409d33311 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
6011422a54
avcodec/mlpdsp: Fix signed integer overflow, 2nd try
...
The outputted bits should match what is used in the lossless check
Fixes: runtime error: signed integer overflow: -538697856 * 256 cannot be represented in type 'int'
Fixes: 4326/clusterfuzz-testcase-minimized-5689449645080576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 97c00edaa0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
32a92a7a9b
avcodec/kgv1dec: Check that there is enough input for maximum RLE compression
...
Fixes: Timeout
Fixes: 4271/clusterfuzz-testcase-4676667768307712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3aad94bf2b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
74d467baa4
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_FIDELITYi*
...
Fixes: runtime error: signed integer overflow: -2143827186 - 7404944 cannot be represented in type 'int'
Fixes: 4354/clusterfuzz-testcase-minimized-4671122764201984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b6964f764 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
ea24e70a6a
avcodec/mpeg4videodec: Check also for negative versions in the validity check
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e7865ce41 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Dale Curtis
ee13d847a4
Close ogg stream upon error when using AV_EF_EXPLODE.
...
Without this there can be multiple memory leaks for unrecognized
ogg streams.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bce8fc0754 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Dale Curtis
78782ca62d
Fix undefined shift on assumed 8-bit input.
...
decode_user_data() attempts to create an integer |build|
value with 8 bits of spacing for 3 components. However
each component is an int32_t, so shifting each component
is undefined for values outside of the 8 bit range.
This patch simply clamps input to 8-bits per component
and prints out a warning that the values were clamped.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7010dd98b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Jacob Trimble
514bdaafb4
avformat/mov: Propagate errors in mov_switch_root.
...
Signed-off-by: Jacob Trimble <modmaker@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d9cf3bf16 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
107606260c
avcodec/hevcdsp_template: Fix invalid shift in put_hevc_epel_bi_w_v()
...
Fixes: runtime error: left shift of negative value -255
Fixes: 4037/clusterfuzz-testcase-minimized-5290998163832832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d88586e47 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
4e5351940f
avcodec/mlpdsp: Fix undefined shift ff_mlp_pack_output()
...
Fixes: runtime error: left shift of negative value -7862264
Fixes: 4074/clusterfuzz-testcase-minimized-4516104123711488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f7f70738e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
90ad2798ae
avcodec/zmbv: Check that the buffer is large enough for mvec
...
Fixes: Timeout
Fixes: 4143/clusterfuzz-testcase-4736864637419520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ab9568a2c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
813d7f4972
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD137iL0()
...
Fixes: 4035/clusterfuzz-testcase-minimized-6479308925173760
Fixes: runtime error: signed integer overflow: 9 * 402653183 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73964680d7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
ee54354fcd
avcodec/wmv2dec: Check end of bitstream in parse_mb_skip() and ff_wmv2_decode_mb()
...
Fixes: Timeout
Fixes: 3200/clusterfuzz-testcase-5750022136135680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65e0a7c473 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
20d6a6fa5a
avcodec/snowdec: Check for remaining bitstream in decode_blocks()
...
Fixes: Timeout
Fixes: 3142/clusterfuzz-testcase-5007853163118592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4527ec2216 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
7d6319e5e6
avcodec/snowdec: Check intra block dc differences.
...
Fixes: Timeout
Fixes: 3142/clusterfuzz-testcase-5007853163118592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c3b9bbcc6e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Fredrik Hubinette
c11ac27f49
avformat/mov: Check size of STSC allocation
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6fdd75fe6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
0af4a5b180
avcodec/h264dec: Fix potential array overread
...
add padding before scantable arrays
See: 522d850e68
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 380b48fb9f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
0a9e416a19
avcodec/x86/mpegvideodsp: Fix signedness bug in need_emu
...
Fixes: out of array read
Fixes: 3516/attachment-311488.dat
Found-by: Insu Yun, Georgia Tech.
Tested-by: wuninsu@gmail.com
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 58cf31cee7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
b0c2e6e2d2
avcodec/aacdec_fixed: Fix undefined shift
...
Fixes: runtime error: left shift of negative value -801112064
Fixes: 3492/clusterfuzz-testcase-minimized-5784775283441664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fca198fb5b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
cd01fc76c4
avcodec/mdct_*: Fix integer overflow in addition in RESCALE()
...
Fixes: runtime error: signed integer overflow: 1219998458 - -1469874012 cannot be represented in type 'int'
Fixes: 3443/clusterfuzz-testcase-minimized-5369987105554432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 770c934fa1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
7de06077c9
avcodec/snowdec: Fix integer overflow in header parsing
...
Fixes: 3984/clusterfuzz-testcase-minimized-5265759929368576
Fixes: runtime error: signed integer overflow: -1085585801 + -1094995529 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c897a92858 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
d8fb143546
avcodec/cngdec: Fix integer clipping
...
Fixes: runtime error: value -36211.7 is outside the range of representable values of type 'short'
Fixes: 2992/clusterfuzz-testcase-6649611793989632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 51090133b3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
efe9439caa
avcodec/sbrdsp_fixed: Fix integer overflow in shift in sbr_hf_g_filt_c()
...
Fixes: runtime error: shift exponent 66 is too large for 64-bit type 'long long'
Fixes: 3642/clusterfuzz-testcase-minimized-5443853801750528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 981e99ab99 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
fd1854647b
avutil/softfloat: Add FLOAT_MIN
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
92eff6b829
avcodec/aacsbr_fixed: Fix division by zero in sbr_gain_calc()
...
Fixes: 3642/clusterfuzz-testcase-minimized-5443853801750528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d1dec4668 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
b75eb7f8d5
avcodec/h264idct_template: Fix integer overflows in ff_h264_idct8_add()
...
Fixes: runtime error: signed integer overflow: -503316480 + -2013265038 cannot be represented in type 'int'
Fixes: 3805/clusterfuzz-testcase-minimized-6578427831255040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e131b8cedb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
1376beb658
avcodec/xan: Check for bitstream end in xan_huffman_decode()
...
Fixes: Timeout
Fixes: 3707/clusterfuzz-testcase-6465922706440192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4b51437dcc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Luca Barbato
907a704c9f
avformat: Free the internal codec context at the end
...
Avoid a use after free in avformat_find_stream_info.
(cherry picked from commit 9e4a5eb51b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
35c1e95b41
avcodec/xan: Improve overlapping check
...
Fixes: memcpy-param-overlap
Fixes: 3612/clusterfuzz-testcase-minimized-6393461273001984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e8fafef1db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
9d4ad2dbfd
avcodec/aacdec_fixed: Fix integer overflow in apply_dependent_coupling_fixed()
...
Fixes: runtime error: signed integer overflow: 623487 * 536870912 cannot be represented in type 'int'
Fixes: 3594/clusterfuzz-testcase-minimized-4650622935629824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 41d96af2a7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
9ef0472b26
avcodec/aacdec_fixed: Fix integer overflow in predict()
...
Fixes: runtime error: signed integer overflow: -2110708110 + -82837504 cannot be represented in type 'int'
Fixes: 3547/clusterfuzz-testcase-minimized-6009386439802880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0976752420 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
9ba9c5a16f
avcodec/jpeglsdec: Check for end of bitstream in ls_decode_line()
...
Fixes: 1773/clusterfuzz-testcase-minimized-4832523987189760
Fixes: Timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f80224ed19 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
3fc5451f40
avcodec/jpeglsdec: Check ilv for being a supported value
...
Fixes: 1773/clusterfuzz-testcase-minimized-4832523987189760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fe533628b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
c48262d857
avcodec/snowdec: Check mv_scale
...
Fixes: runtime error: signed integer overflow: 2 * -1094995530 cannot be represented in type 'int'
Fixes: 3512/clusterfuzz-testcase-minimized-4812747210489856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 393d6fc739 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
c9298f5d02
avcodec/pafvideo: Check for bitstream end in decode_0()
...
Fixes: Timeout
Fixes: 3529/clusterfuzz-testcase-5057068371279872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c85329cd0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
f62201d550
avcodec/ffv1dec: Fix out of array read in slice counting
...
Fixes: test-201710.mp4
Found-by: 连一汉 <lianyihan@360.cn > and Zhibin Hu
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c20f4fcb74 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
23ea9f91c0
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_53iL0()
...
Fixes: runtime error: signed integer overflow: 2147483646 + 2 cannot be represented in type 'int'
Fixes: 3485/clusterfuzz-testcase-minimized-4940429332054016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bdee75a4e7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
0d9baa6d16
avcodec/mpeg_er: Clear mcsel in mpeg_er_decode_mb()
...
Fixes out of array read
Should fix: 3516/clusterfuzz-testcase-minimized-4608518562775040 (not reprodoceable)
Found-by: Insu Yun, Georgia Tech.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 127a362630 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
fd21cec8a9
avcodec/mpeg4videodec: Use 64 bit intermediates for sprite delta
...
Fixes: runtime error: signed integer overflow: -104713 * 65536 cannot be represented in type 'int'
Fixes: 3453/clusterfuzz-testcase-minimized-5555554657239040
Fixes: 3528/clusterfuzz-testcase-minimized-6283628420005888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e38f280fec )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
3929105913
avcodec/truemotion2: Fix integer overflows in tm2_high_chroma()
...
Fixes: runtime error: signed integer overflow: -1408475220 + -1408475220 cannot be represented in type 'int'
Fixes: 3336/clusterfuzz-testcase-minimized-5656839179993088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 44874b4f5e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
1ad7bbfd21
avcodec/aacdec_template: Clear tns present flag on error
...
Fixes: 3444/clusterfuzz-testcase-minimized-6270352105668608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dcf9bae4a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
df66540dd5
avcodec/proresdec2: SKIP_BITS() does not work with len=32
...
Fixes: invalid shift
Fixes: 3482/clusterfuzz-testcase-minimized-5446915875405824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c37138e01a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
c665a93438
avcodec/hevcdsp_template: Fix undefined shift
...
Fixes: runtime error: left shift of negative value -255
Fixes: 3373/clusterfuzz-testcase-minimized-5604083912146944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fbdab6eca7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
6d03495c70
avcodec/jpeg2000: Check that codsty->log2_prec_widths/heights has been initialized
...
Fixes: OOM
Fixes: 2225/clusterfuzz-testcase-minimized-5505632079708160
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 64e034da95 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
13d16a7b99
avcodec/takdec: Fix integer overflow in decode_lpc()
...
Fixes: runtime error: signed integer overflow: 16748560 + 2143729712 cannot be represented in type 'int'
Fixes: 3202/clusterfuzz-testcase-minimized-4988291642294272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d31f03a02 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
66fd3de40a
avcodec/proresdec2: Check bits in DECODE_CODEWORD(), fixes invalid shift
...
Fixes: runtime error: shift exponent 42 is too large for 32-bit type 'unsigned int'
Fixes: 3410/clusterfuzz-testcase-minimized-5313377960198144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f5eaf0b59 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
a0f854b5ff
avcodec/takdec: Fix integer overflows in decode_subframe()
...
Fixes: runtime error: signed integer overflow: -1562477869 + -691460395 cannot be represented in type 'int'
Fixes: 3196/clusterfuzz-testcase-minimized-4528307146063872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3dabb9c69d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
ed5d0bc237
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_FIDELITYi*()
...
Fixes: runtime error: signed integer overflow: 161 * 13872281 cannot be represented in type 'int'
Fixes: 3295/clusterfuzz-testcase-minimized-4738998142500864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 67da2685e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
104d36647c
avcodec/ffv1dec: Fix integer overflow in read_quant_table()
...
Fixes: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 3361/clusterfuzz-testcase-minimized-5065842955911168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d00fc952b6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
a2d129a841
avcodec/svq3: Fix overflow in svq3_add_idct_c()
...
Fixes: runtime error: signed integer overflow: 2147392585 + 524288 cannot be represented in type 'int'
Fixes: 3348/clusterfuzz-testcase-minimized-4809500517203968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c933c5168 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
fd0b42344a
avcodec/pngdec: Clean up on av_frame_ref() failure
...
Fixes: memleak
Fixes: 3203/clusterfuzz-testcase-minimized-4514553595428864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5480e82d77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
a93bbd8aa3
avcodec/jpeg2000dsp: Fix multiple integer overflows in ict_int()
...
Fixes: runtime error: signed integer overflow: 22553 * -188962 cannot be represented in type 'int'
Fixes: 3042/clusterfuzz-testcase-minimized-5174210131394560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d025e7428 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
f51fc65d66
avcodec/hevcdsp_template: Fix undefined shift in put_hevc_pel_bi_w_pixels
...
Fixes: runtime error: left shift of negative value -95
Fixes: 3077/clusterfuzz-testcase-minimized-4684917524922368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c225da68cf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
18e1ef489a
avcodec/diracdec: Fix overflow in DC computation
...
Fixes: runtime error: signed integer overflow: 11896 + 2147483646 cannot be represented in type 'int'
Fixes: 3053/clusterfuzz-testcase-minimized-6355082062856192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5995856a4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
fa65598309
avformat/asfdec: Fix DoS in asf_build_simple_index()
...
Fixes: Missing EOF check in loop
No testcase
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit afc9c683ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
dc4ef664ab
avformat/mov: Fix DoS in read_tfra()
...
Fixes: Missing EOF check in loop
No testcase
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9cb4eb7728 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
812e06cc82
avcodec/dirac_dwt: Fix multiple overflows in 9/7 lifting
...
Fixes: runtime error: signed integer overflow: 1073901567 + 1073901567 cannot be represented in type 'int'
Fixes: 3124/clusterfuzz-testcase-minimized-454643435752652
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f71cd44147 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
James Almer
a1433196b8
avformat/libssh: check the user provided a password before trying to use it
...
Fixes ticket #6413
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 8ddb6820bd )
2018-01-11 10:42:34 -03:00
Michael Niedermayer
7f0359f05e
Changelog: Update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-02 02:16:08 +02:00
孙浩(晓黑)
d686026507
avformat/mxfdec: Fix Sign error in mxf_read_primer_pack()
...
Fixes: 20170829B.mxf
Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com >
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d00fb9d70 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-01 03:20:54 +02:00
孙浩(晓黑)
accf7d34a8
avformat/mxfdec: Fix DoS issues in mxf_read_index_entry_array()
...
Fixes: 20170829A.mxf
Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com >
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 900f39692c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-01 03:04:25 +02:00
孙浩(晓黑)
5b3986023b
avformat/nsvdec: Fix DoS due to lack of eof check in nsvs_file_offset loop.
...
Fixes: 20170829.nsv
Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com >
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c24bcb5536 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-01 03:03:44 +02:00
Michael Niedermayer
74429912dc
avcodec/snowdec: Fix integer overflow in decode_subband_slice_buffered()
...
Fixes: runtime error: signed integer overflow: 267 * 8388608 cannot be represented in type 'int'
Fixes: 2743/clusterfuzz-testcase-minimized-5820652076400640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 732f976456 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-29 21:21:06 +02:00
Michael Niedermayer
1a5b9b3b8e
avcodec/hevc_ps: Fix undefined shift in pcm code
...
Fixes: runtime error: shift exponent -1 is negative
Fixes: 3091/clusterfuzz-testcase-minimized-6229767969832960
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2a83866c9f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-29 21:20:50 +02:00
Michael Niedermayer
2ff2402c65
avcodec/sbrdsp_fixed: Fix undefined overflows in autocorrelate()
...
Fixes: runtime error: signed integer overflow: 8903997421129740175 + 354481484684609529 cannot be represented in type 'long'
Fixes: 2045/clusterfuzz-testcase-minimized-6751255865065472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eefb68c9c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-28 01:44:23 +02:00
Michael Niedermayer
6b004e23d7
avformat/mvdec: Fix DoS due to lack of eof check
...
Fixes: loop.mv
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f05e2e2dc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-28 01:43:29 +02:00
孙浩 and 张洪亮(望初)
1720050ae6
avformat/rl2: Fix DoS due to lack of eof check
...
Fixes: loop.rl2
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 96f24d1bee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-28 01:43:04 +02:00
孙浩 and 张洪亮(望初)
c70fdd9948
avformat/cinedec: Fix DoS due to lack of eof check
...
Fixes: loop.cine
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7e80b63ecd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-28 01:42:24 +02:00
孙浩 and 张洪亮(望初)
6904464301
avformat/asfdec: Fix DoS due to lack of eof check
...
Fixes: loop.asf
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f9ec5593e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-28 01:42:00 +02:00
Michael Niedermayer
498e07daa1
avformat/hls: Fix DoS due to infinite loop
...
Fixes: loop.m3u
The default max iteration count of 1000 is arbitrary and ideas for a better solution are welcome
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Previous version reviewed-by: Steven Liu <lingjiujianke@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ec414892d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-28 01:41:37 +02:00
Michael Niedermayer
bc57c79970
Update for FFmpeg 2.8.13
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-24 14:42:03 +02:00
Michael Niedermayer
49839ae013
ffprobe: Fix NULL pointer handling in color parameter printing
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 351e28f9a7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-24 12:49:30 +02:00
Michael Niedermayer
c1a9f5675b
ffprobe: Fix null pointer dereference with color primaries
...
Found-by: AD-lab of venustech
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 837cb4325b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b2c39fcc3c0749490dc93bca80f56724878b55fe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-24 12:28:16 +02:00
Michael Niedermayer
ae37bbef43
avcodec/hevc_ps: Check delta_pocs in ff_hevc_decode_short_term_rps()
...
Fixes: integer overflow
Fixes: 2893/clusterfuzz-testcase-minimized-5809330567774208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b44dcbc44 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-24 12:10:33 +02:00
Vitaly Buka
eaf231544f
avformat/aviobuf: Fix signed integer overflow in avio_seek()
...
Signed integer overflow is undefined behavior.
Detected with clang and -fsanitize=signed-integer-overflow
Signed-off-by: Vitaly Buka <vitalybuka@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eca2a49716 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-24 12:08:07 +02:00
Vitaly Buka
05fc22f9f6
avformat/mov: Fix signed integer overflows with total_size
...
Signed integer overflow is undefined behavior.
Detected with clang and -fsanitize=signed-integer-overflow
Signed-off-by: Vitaly Buka <vitalybuka@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a404cb5b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-24 12:03:52 +02:00
Michael Niedermayer
cab75cde01
avcodec/aacdec_template: Fix running cleanup in decode_ics_info()
...
Fixes: out of array read
Fixes: 2873/clusterfuzz-testcase-minimized-5924145713905664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Previous version reviewed-by: Alex Converse <alex.converse@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6f03ffb47d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-23 04:03:16 +02:00
Michael Niedermayer
079849f40c
avcodec/me_cmp: Fix crashes on ARM due to misalignment
...
Adds a diff_pixels_unaligned()
Fixes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872503
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc488ec28a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-21 23:27:35 +02:00
Michael Niedermayer
0b37ae2ae4
avcodec/fic: Fixes signed integer overflow
...
Fixes: runtime error: signed integer overflow: 1037142357 + 1227025305 cannot be represented in type 'int'
Fixes: 3024/clusterfuzz-testcase-minimized-5885660323905536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c9d5b015c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-21 23:27:35 +02:00
Michael Niedermayer
7829a712bb
avcodec/snowdec: Fix off by 1 error
...
Fixes: runtime error: index 4 out of bounds for type 'int8_t [4]'
Fixes: 3023/clusterfuzz-testcase-minimized-6421736130084864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d132683ddd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-21 23:27:35 +02:00
Michael Niedermayer
b463a03476
avcodec/diracdec: Check perspective_exp and zrs_exp.
...
Fixes: undefined shift
Fixes: runtime error: shift exponent 264 is too large for 32-bit type 'int'
Fixes: 2860/clusterfuzz-testcase-minimized-4672811689836544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e6cab8745 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-17 00:27:32 +02:00
Michael Niedermayer
96cf249751
avcodec/mpeg4videodec: Clear mcsel before decoding an image
...
Fixes: runtime error: signed integer overflow: 2146467840 + 1032192 cannot be represented in type 'int'
Fixes: 2826/clusterfuzz-testcase-minimized-5901511613743104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7735ed2974 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-13 01:07:21 +02:00
Michael Niedermayer
30a2c1a1b8
avcodec/dirac_dwt: Fixes integer overflows in COMPOSE_DAUB97*
...
Fix multiple: runtime error: signed integer overflow: 6497 * 3409630 cannot be represented in type 'int'
Fixes: 2819/clusterfuzz-testcase-minimized-4743700301217792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5380f9c1c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-08 19:38:10 +02:00
Michael Niedermayer
5f44aa14dd
avcodec/aacdec_fixed: fix invalid shift in predict()
...
Fixes: runtime error: shift exponent -2 is negative
Fixes: 2818/clusterfuzz-testcase-minimized-5062943676825600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e443051b2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-08 19:37:43 +02:00
Michael Niedermayer
f236601e29
avcodec/h264_slice: Fix overflow in slice offset
...
Fixes: runtime error: signed integer overflow: 1610612736 * 2 cannot be represented in type 'int'
Fixes: 2817/clusterfuzz-testcase-minimized-5289691240726528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f53bde6d8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-08 19:37:25 +02:00
Steven Siloti
f0f45d8404
avformat/utils: fix memory leak in avformat_free_context
...
The pointer to the packet queue is stored in the internal structure
so the queue needs to be flushed before internal is freed.
Signed-off-by: Steven Siloti <ssiloti@bittorrent.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 949debd1d1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-05 23:25:05 +02:00
Michael Niedermayer
9d0eb81cb8
avcodec/dirac_dwt: Fix multiple integer overflows in COMPOSE_DD97iH0()
...
Fixes: runtime error: signed integer overflow: 9 * 335544320 cannot be represented in type 'int'
Fixes: 2739/clusterfuzz-testcase-minimized-6737297955356672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf8ab72ae9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-29 19:13:21 +02:00
Michael Niedermayer
95bbbbd14e
avcodec/diracdec: Fix integer overflow in divide3()
...
Fixes: runtime error: signed integer overflow: -1073746548 * 21845 cannot be represented in type 'int'
Fixes: 2729/clusterfuzz-testcase-minimized-5902915464069120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c0220c768c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-29 14:23:26 +02:00
Michael Niedermayer
406d9fdd13
avcodec/takdec: Fix integer overflow in decode_subframe()
...
Fixes: runtime error: signed integer overflow: -536870912 - 1972191120 cannot be represented in type 'int'
Fixes: 2711/clusterfuzz-testcase-minimized-4975142398590976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c630d159f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-29 14:18:36 +02:00
Michael Niedermayer
8f9cbb3b7e
avformat/rtmppkt: Convert ff_amf_get_field_value() to bytestream2
...
Fixes: out of array accesses
Found-by: JunDong Xie of Ant-financial Light-Year Security Lab
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ffcc82219c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-29 14:17:59 +02:00
Michael Niedermayer
b566ab49ca
avformat/rtmppkt: Convert ff_amf_tag_size() to bytestream2
...
Fixes: out of array accesses
Fixes: crash-9238fa9e8d4fde3beda1f279626f53812cb001cb-SEGV
Found-by: JunDong Xie of Ant-financial Light-Year Security Lab
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 08c073434e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-29 04:49:47 +02:00
Michael Niedermayer
58ce199aba
avcodec/hevc_ps: fix integer overflow in log2_parallel_merge_level_minus2
...
Fixes: runtime error: signed integer overflow: -2147483647 - 2 cannot be represented in type 'int'
Fixes: 2702/clusterfuzz-testcase-minimized-4511932591636480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 74c1c22d7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-26 17:25:20 +02:00
Michael Niedermayer
490b6599bb
avformat/oggparsecelt: Do not re-allocate os->private
...
Fixes: double free
Fixes: clusterfuzz-testcase-minimized-5080550145785856
Found-by: ClusterFuzz
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7140761481 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-26 00:22:55 +02:00
Michael Niedermayer
91442fdc1c
avcodec/aacps: Fix multiple integer overflow in map_val_34_to_20()
...
Fixes: avcodec/aacps.c:511:40: runtime error: signed integer overflow: 1509077651 + 758068176 cannot be represented in type 'int'
Fixes: 2678/clusterfuzz-testcase-minimized-4702787684270080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0764fe1d09 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-26 00:14:04 +02:00
Michael Niedermayer
56e2ec0e9f
avcodec/aacdec_fixed: fix: left shift of negative value -1
...
Fixes: 2699/clusterfuzz-testcase-minimized-5631303862976512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2dfb8c4178 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-26 00:11:56 +02:00
Brice Waegeneire
061be75481
doc/filters: typo in frei0r
...
Signed-off-by: Brice Waegeneire <brice.wge@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6a6eec485d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-23 15:01:05 +02:00
Michael Niedermayer
1b1abf077d
avcodec/aacdec_template (fixed point): Check gain in decode_cce() to avoid undefined shifts later
...
Fixes: runtime error: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 2581/clusterfuzz-testcase-minimized-4681474395602944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2886142e0c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 04:03:11 +02:00
Michael Niedermayer
a84ed3d011
avcodec/mjpegdec: Clip DC also on the negative side.
...
Fixes: runtime error: signed integer overflow: -16711425 + -2130772346 cannot be represented in type 'int'
Fixes: 2533/clusterfuzz-testcase-minimized-5372857678823424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c28f648b19 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 03:48:01 +02:00
Michael Niedermayer
080d6de9df
avcodec/aacps (fixed point): Fix multiple signed integer overflows
...
Fixes: runtime error: signed integer overflow: 1421978265 - -1810326882 cannot be represented in type 'int'
Fixes: 2527/clusterfuzz-testcase-minimized-5260915396050944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 80b9e40b6f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 03:47:46 +02:00
Michael Niedermayer
82ba7646c2
avcodec/sbrdsp_fixed: Fix integer overflow in sbr_hf_apply_noise()
...
Fixes: runtime error: signed integer overflow: -2049425300 + -117591631 cannot be represented in type 'int'
Fixes: part of 2096/clusterfuzz-testcase-minimized-4901566068817920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2061de8a3f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 03:39:54 +02:00
Michael Niedermayer
610bd59522
avcodec/wavpack: Fix invalid shift
...
Fixes: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 2377/clusterfuzz-testcase-minimized-6108505935183872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c07af72098 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 02:50:35 +02:00
Michael Niedermayer
a5e969dd28
avcodec/hevc_ps: Fix integer overflow with beta/tc offsets
...
Fixes: runtime error: signed integer overflow: 2113929216 * 2 cannot be represented in type 'int'
Fixes: 2422/clusterfuzz-testcase-minimized-5242114713583616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit de54a37c1d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 02:50:01 +02:00
Michael Niedermayer
f6954a1482
avcodec/vb: Check vertical GMC component before multiply
...
Fixes: runtime error: signed integer overflow: 8224 * 663584 cannot be represented in type 'int'
Fixes: 2393/clusterfuzz-testcase-minimized-6128334993883136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc6ab72bc7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 02:48:40 +02:00
Michael Niedermayer
a6e90e5998
avcodec/jpeg2000dwt: Fix integer overflow in dwt_decode97_int()
...
Fixes: runtime error: signed integer overflow: -163654656 * 256 cannot be represented in type 'int'
Fixes: 2367/clusterfuzz-testcase-minimized-4648678897745920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea5366670e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 02:45:52 +02:00
Michael Niedermayer
bbcb59b948
avcodec/apedec: Fix integer overflow
...
Fixes: out of array access
Fixes: PoC.ape and others
Found-by: Bingchang, Liu@VARAS of IIE
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ba4beaf614 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-16 17:02:32 +02:00
Michael Niedermayer
bd33b15fe6
avcodec/wavpack: Fix integer overflow in wv_unpack_stereo()
...
Fixes: runtime error: signed integer overflow: 2080374785 + 2080374784 cannot be represented in type 'int'
Fixes: 2351/clusterfuzz-testcase-minimized-5359403240783872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73ea2a028e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-25 02:52:42 +02:00
Michael Niedermayer
7ee48d9de1
avcodec/mpeg4videodec: Fix GMC with videos of dimension 1
...
Fixes: runtime error: shift exponent -1 is negative
Fixes: 2338/clusterfuzz-testcase-minimized-5153426541379584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4976a3411f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-25 02:48:02 +02:00
Michael Niedermayer
fe74c2364e
avcodec/wavpack: Fix integer overflow
...
Fixes: runtime error: signed integer overflow: 227511904 + 1964113935 cannot be represented in type 'int'
Fixes: 2331/clusterfuzz-testcase-minimized-6182185830711296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 24e95f9d4d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-23 03:05:56 +02:00
Michael Niedermayer
7fadd9625f
avcodec/takdec: Fix integer overflow
...
Fixes: runtime error: signed integer overflow: 512 + 2147483146 cannot be represented in type 'int'
Fixes: 2314/clusterfuzz-testcase-minimized-4519333877252096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c2ef4f6b4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-23 03:05:45 +02:00
Michael Niedermayer
be92b27024
avcodec/tiff: Update pointer only when the result is used
...
Fixes: runtime error: signed integer overflow: 538976288 * 32 cannot be represented in type 'int'
Fixes: 2310/clusterfuzz-testcase-minimized-4534784887881728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 27f80ab016 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-23 03:05:34 +02:00
Michael Niedermayer
5c818b6286
avcodec/hevc_filter: Fix invalid shift
...
Fixes: runtime error: left shift of negative value -1
Fixes: 2299/clusterfuzz-testcase-minimized-4843509351710720
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d7b3d5c3f2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-22 03:08:46 +02:00
Michael Niedermayer
b66e30ca76
avcodec/mpeg4videodec: Fix overflow in virtual_ref computation
...
Fixes: runtime error: signed integer overflow: 262144 * -16120 cannot be represented in type 'int'
Fixes: 2292/clusterfuzz-testcase-minimized-6156080415506432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5443c4bdf4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-22 03:08:35 +02:00
Michael Niedermayer
4afd248059
avcodec/wavpack: Fix undefined integer negation
...
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 2291/clusterfuzz-testcase-minimized-5538453481586688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f89747086 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-22 03:07:21 +02:00
Michael Niedermayer
cbc4f40d13
avcodec/aacdec_fixed: Check s for being too small
...
Fixes: runtime error: shift exponent -8 is negative
Fixes: 2286/clusterfuzz-testcase-minimized-5711764169687040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf7edbd6c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-22 03:07:09 +02:00
Anton Mitrofanov
ea73c4813d
avcodec/h264: Fix mix of lossless and lossy MBs decoding
...
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com >
(cherry picked from commit cf231b68da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 03:09:10 +02:00
Anton Mitrofanov
a85f8fd4a6
avcodec/h264_mb: Fix 8x8dct in lossless for new versions of x264
...
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com >
(cherry picked from commit 06dda70f1e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 03:05:01 +02:00
Anton Mitrofanov
365ab04b16
avcodec/h264_cabac: Fix CABAC+8x8dct in 4:4:4
...
Use the correct ctxIdxInc calculation for coded_block_flag.
Keep old behavior for old versions of x264 for backward compatibility.
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com >
(cherry picked from commit 840b41b2a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:27:18 +02:00
Michael Niedermayer
5aa7d228cb
avcodec/takdec: Fixes: integer overflow in AV_SAMPLE_FMT_U8P output
...
Fixes: runtime error: signed integer overflow: 2147483543 + 128 cannot be represented in type 'int'
Fixes: 2234/clusterfuzz-testcase-minimized-6266896041115648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 27c2006805 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-18 15:17:14 +02:00
Michael Niedermayer
0aa14c7f67
avcodec/jpeg2000dsp: Reorder operations in ict_int() to avoid 2 integer overflows
...
Fixes: runtime error: signed integer overflow: 58065 * 51981 cannot be represented in type 'int'
Fixes: 2271/clusterfuzz-testcase-minimized-5778297776504832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c746f92a8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-17 23:34:49 +02:00
Michael Niedermayer
ba23d53710
avcodec/hevcpred_template: Fix left shift of negative value
...
Fixes: runtime error: left shift of negative value -1
Fixes: 2250/clusterfuzz-testcase-minimized-5693382112313344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c94326c1fc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-17 23:34:20 +02:00
Michael Niedermayer
1ce850f96d
avcodec/hevcdec: Fix signed integer overflow in decode_lt_rps()
...
Fixes: runtime error: signed integer overflow: 2147483647 + 6 cannot be represented in type 'int'
Fixes: 2263/clusterfuzz-testcase-minimized-4800359627227136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1edbf5e20c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-17 02:25:56 +02:00
Michael Niedermayer
c436af1559
avcodec/jpeg2000dec: Check nonzerobits more completely
...
Fixes: runtime error: shift exponent 36 is too large for 32-bit type 'int'
Fixes: 2239/clusterfuzz-testcase-minimized-5639766592716800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dfb61ea263 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-17 02:25:28 +02:00
Michael Niedermayer
eb38f232b4
avcodec/shorten: Sanity check maxnlpc
...
Fixes OOM
Fixes: 2131/clusterfuzz-testcase-minimized-4718045157130240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e77ddd31a8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-17 02:23:55 +02:00
Michael Niedermayer
92c5ff0763
avcodec/jpeg2000: Fixes integer overflow in ff_jpeg2000_ceildivpow2()
...
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 2231/clusterfuzz-testcase-minimized-4565181982048256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e3fadc57c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-16 01:43:39 +02:00
Michael Niedermayer
c8733c7376
avcodec/hevcdec: Check nb_sps
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc40674462 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-16 01:07:19 +02:00
Michael Niedermayer
c2562f5a8e
avcodec/hevc_refs: Check nb_refs in add_candidate_ref()
...
Fixes: runtime error: index 16 out of bounds for type 'int [16]'
Fixes: 2209/clusterfuzz-testcase-minimized-5012343912136704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1cb4ef526d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-16 01:07:19 +02:00
Michael Niedermayer
7bca492cfc
avcodec/mpeg4videodec: Check sprite delta upshift against overflowing.
...
Fixes: runtime error: signed integer overflow: -268386304 * 16 cannot be represented in type 'int'
Fixes: 2204/clusterfuzz-testcase-minimized-5616756909408256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 12245ab1f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-16 00:48:16 +02:00
Michael Niedermayer
296b444a5c
avcodec/mpeg4videodec: Fix integer overflow in num_sprite_warping_points=2 case
...
Fixes: runtime error: signed integer overflow: 131072 + 2147352576 cannot be represented in type 'int'
Fixes: 2192/clusterfuzz-testcase-minimized-5370387988742144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a87be404a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-16 00:47:49 +02:00
Michael Niedermayer
fd0da0eef0
avcodec/aacsbr_fixed: Check shift in sbr_hf_assemble()
...
Fixes: runtime error: shift exponent -10 is negative
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d1992448d3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-16 00:46:34 +02:00
Michael Niedermayer
0ac4146389
avcodec/sbrdsp_fixed: Return an error from sbr_hf_apply_noise() if operations are impossible
...
Fixes: 1775/clusterfuzz-testcase-minimized-5330288148217856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d549f026d8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-16 00:45:57 +02:00
Michael Niedermayer
bc8fe5c4bd
avcodec/jpeg2000dwt: Fix runtime error: left shift of negative value -123
...
Fixes: 2208/clusterfuzz-testcase-minimized-5976593765761024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d24043e1a2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-13 19:51:46 +02:00
Michael Niedermayer
0dfda74afc
avcodec/wavpack: Fix runtime error: signed integer overflow: 1886191616 + 277872640 cannot be represented in type 'int'
...
Fixes: 2181/clusterfuzz-testcase-minimized-6314784322486272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c996374d4d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-13 19:48:31 +02:00
Michael Niedermayer
d182bb21ad
avcodec/snowdec: Fix runtime error: left shift of negative value -1
...
Fixes: 2197/clusterfuzz-testcase-minimized-6010716676947968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2e44126363 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-11 15:23:29 +02:00
Michael Niedermayer
295b24643e
avcodec/aacdec_fixed: Fix runtime error: left shift of negative value -1297616
...
Fixes: 2195/clusterfuzz-testcase-minimized-4736721533009920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6d499ecef9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-11 15:23:23 +02:00
Michael Niedermayer
f0f9fa2184
avcodec/tiff: Fix leak of geotags[].val
...
Fixes: 2176/clusterfuzz-testcase-minimized-5908197216878592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 22a25ab389 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-11 03:16:55 +02:00
Michael Niedermayer
e3a75af708
avcodec/ra144: Fix runtime error: signed integer overflow: -2200 * 1033073 cannot be represented in type 'int'
...
Fixes: 2175/clusterfuzz-testcase-minimized-5809657849315328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 71da0a5c97 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-11 03:16:23 +02:00
Michael Niedermayer
5dc0393d96
avcodec/flicvideo: Fix runtime error: signed integer overflow: 4864 * 459296 cannot be represented in type 'int'
...
Fixes: 2174/clusterfuzz-testcase-minimized-5739234533048320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 90e8317b3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-11 03:15:13 +02:00
Michael Niedermayer
f4dae48790
avcodec/indeo4: Check remaining data in Pic hdr extension parsing code
...
Fixes: Timeout
Fixes: 2115/clusterfuzz-testcase-minimized-6594111748440064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a3b5b60bdf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-08 17:38:52 +02:00
Michael Niedermayer
bcdd5463f3
avcodec/ac3dec_fixed: Fix multiple runtime error: signed integer overflow: -39271008 * 59 cannot be represented in type 'int'
...
Fixes: 2113/clusterfuzz-testcase-minimized-6510704959946752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4e3ab1a5c1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-08 17:38:41 +02:00
Michael Niedermayer
e9c8fdbbcb
avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: 53098 * 40448 cannot be represented in type 'int'
...
Fixes: 2106/clusterfuzz-testcase-minimized-6136503639998464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 18bca25adb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 16:56:49 +02:00
Michael Niedermayer
e3d4321739
avcodec/pafvideo: Fix assertion failure
...
Fixes: 2100/clusterfuzz-testcase-minimized-4522961547558912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4360559ee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 16:56:40 +02:00
Michael Niedermayer
8dc06a1cb1
avcodec/takdec: Fix multiple runtime error: signed integer overflow: 637072 * 4096 cannot be represented in type 'int'
...
Fixes: 2079/clusterfuzz-testcase-minimized-5345861779324928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e4efd41b83 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 16:56:25 +02:00
Michael Niedermayer
ffab459e4e
Update for 2.8.12
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:52:03 +02:00
Michael Niedermayer
fb95f1d9d6
avcodec/mjpegdec: Check that reference frame matches the current frame
...
Fixes: out of array read
Fixes: 2097/clusterfuzz-testcase-minimized-5036861833609216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4705edbbb9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
05d7c10fd3
avcodec/tiff: Avoid loosing allocated geotag values
...
Fixes memleak
Fixes: 2076/clusterfuzz-testcase-minimized-6542640243802112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d7cbeab4c1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
dbe771e50d
avcodec/cavs: Fix runtime error: signed integer overflow: -12648062 * 256 cannot be represented in type 'int'
...
Fixes: 2067/clusterfuzz-testcase-minimized-5578430902960128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e6ee86d92 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
e447d3143f
avformat/hls: Check local file extensions
...
This reduces the attack surface of local file-system
information leaking.
It prevents the existing exploit leading to an information leak. As
well as similar hypothetical attacks.
Leaks of information from files and symlinks ending in common multimedia extensions
are still possible. But files with sensitive information like private keys and passwords
generally do not use common multimedia filename extensions.
It does not stop leaks via remote addresses in the LAN.
The existing exploit depends on a specific decoder as well.
It does appear though that the exploit should be possible with any decoder.
The problem is that as long as sensitive information gets into the decoder,
the output of the decoder becomes sensitive as well.
The only obvious solution is to prevent access to sensitive information. Or to
disable hls or possibly some of its feature. More complex solutions like
checking the path to limit access to only subdirectories of the hls path may
work as an alternative. But such solutions are fragile and tricky to implement
portably and would not stop every possible attack nor would they work with all
valid hls files.
Developers have expressed their dislike / objected to disabling hls by default as well
as disabling hls with local files. There also where objections against restricting
remote url file extensions. This here is a less robust but also lower
inconvenience solution.
It can be applied stand alone or together with other solutions.
limiting the check to local files was suggested by nevcairiel
This recommits the security fix without the author name joke which was
originally requested by Nicolas.
Found-by: Emil Lerner and Pavel Cheremushkin
Reported-by: Thierry Foucu <tfoucu@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 189ff42196 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
a20e708352
avcodec/qdrw: Fix null pointer dereference
...
The RGB555 PACKBITSRGN case tries to read a palette, if such
palette is actually stored then it accesses a null pointer.
All 16bit samples i could find use DIRECTBITSRGN.
Fixes: 2065/clusterfuzz-testcase-minimized-6298930457346048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 46b865ea9f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
591a3d2632
avutil/softfloat: Fix sign error in and improve documentation of av_int2sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6019d721d4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
268d84a742
avcodec/hevc_ps: Fix runtime error: index 32 out of bounds for type 'uint8_t [32]'
...
Fixes: 2010/clusterfuzz-testcase-minimized-6209288450080768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 29808fff33 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
6636b35ef0
avcodec/pafvideo: Check packet size and frame code before ff_reget_buffer()
...
Fixes 1745/clusterfuzz-testcase-minimized-6160693365571584
Fixes: Timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit faa5a2181d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
195b5b6cea
avcodec/ac3dec_fixed: Fix runtime error: left shift of 419 by 23 places cannot be represented in type 'int'
...
Fixes: 1352/clusterfuzz-testcase-minimized-5757565017260032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 136ce8baa4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
ad600ec886
avcodec/aacps: Fix runtime error: left shift of 1073741824 by 1 places cannot be represented in type 'INTFLOAT' (aka 'int')
...
Fixes: 2005/clusterfuzz-testcase-minimized-5744226438479872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9faf098163 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
6ebdffe73c
avcodec/wavpack: Fix runtime error: shift exponent 32 is too large for 32-bit type 'int'
...
Fixes: 1967/clusterfuzz-testcase-minimized-5757031199801344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b3e580b7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
d1390a8670
avcodec/wavpack: Fix runtime error: signed integer overflow: 2013265955 - -134217694 cannot be represented in type 'int'
...
Fixes: 1922/clusterfuzz-testcase-minimized-5561194112876544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a47273c803 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
653de8249d
avcodec/cinepak: Check input packet size before frame reallocation
...
Reduces time spend decoding 1917/clusterfuzz-testcase-minimized-5023221273329664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e47057e932 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
041ad6d2bb
avcodec/hevc_ps: Fix runtime error: signed integer overflow: 2147483628 + 256 cannot be represented in type 'int'
...
Fixes: 1909/clusterfuzz-testcase-minimized-6732072662073344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6726328f79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
368aa6aac7
avcodec/ra144: Fixes runtime error: signed integer overflow: 7160 * 327138 cannot be represented in type 'int'
...
Fixes: 1908/clusterfuzz-testcase-minimized-5392712477966336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 08cb69e870 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
9c0c749c33
avcodec/pnm: Use ff_set_dimensions()
...
Fixes: OOM
Fixes: 1906/clusterfuzz-testcase-minimized-4599315114754048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1c0d1d906 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
b62a5c83fc
avcodec/cavsdec: Fix runtime error: signed integer overflow: 59 + 2147483600 cannot be represented in type 'int'
...
Fixes: 1903/clusterfuzz-testcase-minimized-5359318167715840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 58f8cd4ac5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
bb7df22328
avformat/avidec: Limit formats in gab2 to srt and ass/ssa
...
This prevents part of one exploit leading to an information leak
Found-by: Emil Lerner and Pavel Cheremushkin
Reported-by: Thierry Foucu <tfoucu@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5d849b149 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
464288cc5e
avcodec/acelp_pitch_delay: Fix runtime error: value 4.83233e+39 is outside the range of representable values of type 'float'
...
Fixes: 1902/clusterfuzz-testcase-minimized-4762451407011840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 87bddba43b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
3a56bbe001
avcodec/wavpack: Check float_shift
...
Fixes: runtime error: shift exponent 40 is too large for 32-bit type 'unsigned int'
Fixes: 1898/clusterfuzz-testcase-minimized-5970744880136192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4020b009d1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
9a92478556
avcodec/wavpack: Fix runtime error: signed integer overflow: 24 * -2147483648 cannot be represented in type 'int'
...
Fixes: 1894/clusterfuzz-testcase-minimized-4716739789062144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d90c5bf105 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
8d1cd5fa08
avcodec/ansi: Fix frame memleak
...
Fixes: 1892/clusterfuzz-testcase-minimized-4519341733183488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e091b9b3c7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
20b9b1fd77
avcodec/jpeg2000dec: Use ff_set_dimensions()
...
Fixes: OOM
Fixes: 1890/clusterfuzz-testcase-minimized-6329019509243904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f3da6fbff8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
bbc6bfae37
avcodec/truemotion2: Fix passing null pointer to memset()
...
Fixes part of: 1888/clusterfuzz-testcase-minimized-5237704826552320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c901627918 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
b1777d92f9
avcodec/truemotion2: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
...
Fixes part of: 1888/clusterfuzz-testcase-minimized-5237704826552320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9e884f3d9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
33aed7bb76
avcodec/ra144: Fix runtime error: signed integer overflow: -2449 * 1398101 cannot be represented in type 'int'
...
Fixes: 1885/clusterfuzz-testcase-minimized-5336328549957632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7c845450d2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
a7878fe247
avcodec/ra144: Fix runtime error: signed integer overflow: 11184810 * 404 cannot be represented in type 'int'
...
Fixes: 1884/clusterfuzz-testcase-minimized-4637425835966464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4c472c5252 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
ba3bc22940
avcodec/aac_defines: Add missing () to AAC_HALF_SUM() macro
...
Fixes: runtime error: shift exponent 1073741848 is too large for 32-bit type 'INTFLOAT' (aka 'int')
Fixes: 1880/clusterfuzz-testcase-minimized-4900645322620928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 872bac8159 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
3fe7d4c403
avcodec/webp: Fixes null pointer dereference
...
Fixes: 1470/clusterfuzz-testcase-minimized-5404421666111488
Fixes: 1472/clusterfuzz-testcase-minimized-5677426430443520
Fixes: 1875/clusterfuzz-testcase-minimized-5536474562822144
Approved-by: BBB
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 67020711b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
5ee31596fa
avcodec/aacdec_fixed: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
...
Fixes: 1878/clusterfuzz-testcase-minimized-6441918630199296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6b9cb5d26a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
1d88ec2fb0
avcodec/snow: Fix runtime error: signed integer overflow: 1086573993 + 1086573994 cannot be represented in type 'int'
...
Fixes: 1871/clusterfuzz-testcase-minimized-5719950331215872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b9c032ebc0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
65f38d1285
avcodec/jpeg2000: Fix runtime error: signed integer overflow: 4185 + 2147483394 cannot be represented in type 'int'
...
Fixes: 1870/clusterfuzz-testcase-minimized-4686788029317120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 781f88bb26 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
0103b3ea92
avcodec/jpeg2000dec: Check tile offsets more completely
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c1812491f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
7b1d93ce9c
avcodec/aacdec_fixed: Fix multiple runtime error: shift exponent 127 is too large for 32-bit type 'int'
...
Fixes: 1851/clusterfuzz-testcase-minimized-5692607495667712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6c3a63fc3d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
19556586d5
avcodec/wnv1: More strict buffer size check
...
This requires at least 25% of a picture to allocate and decode it
Fixes: Timeout
Fixes: 1845/clusterfuzz-testcase-minimized-5075974343360512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f50c25124 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
8fbe1f634f
avcodec/libfdk-aacdec: Correct buffer_size parameter
...
the timeDataSize argument to aacDecoder_DecodeFrame() seems undocumented and until
2016 04 (203e3f28fbebec7011342017fafc2a0bda0ce530) unused.
after that commit libfdk-aacdec interprets it as size in sample units and memsets that on error.
FFmpeg as well as others (like GStreamer) did interpret it as size in bytes
Fixes: 1442/clusterfuzz-testcase-minimized-4540199973421056 (This requires recent libfdk to reproduce)
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ca6776a993 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
492099f9c4
avcodec/sbrdsp_template: Fix: runtime error: signed integer overflow: 849815297 + 1315389781 cannot be represented in type 'int'
...
Fixes: 1770/clusterfuzz-testcase-minimized-5285511235108864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7c36ee216f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
259582feaa
avcodec/ivi_dsp: Fix runtime error: left shift of negative value -2
...
Fixes: 1839/clusterfuzz-testcase-minimized-6238490993885184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 357f2316a0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Kevin Mark
fde04ca718
doc/filters: Clarify scale2ref example
...
Signed-off-by: Kevin Mark <kmark937@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 114e871621 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
59436dc8f8
avcodec/mlpdec: Do not leave invalid values in matrix_out_ch[] on error
...
Fixes: runtime error: index 12 out of bounds for type 'uint8_t [8]'
Fixes: 1832/clusterfuzz-testcase-minimized-6574546079449088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ac8dfcbd89 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
50fb6addc9
avcodec/ra144dec: Fix runtime error: left shift of negative value -17
...
Fixes: 1830/clusterfuzz-testcase-minimized-5828293733384192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53c0c637d3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
fc449d70cf
avformat/mux: Fix copy an paste typo
...
Found-by: Roger Scott <rscott@grammatech.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1a36354698 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
6025edc0c7
avutil/internal: Do not enable CHECKED with DEBUG
...
This avoids potential undefined behavior in debug mode while still allowing
developers which want to check for potential additional overflows to do so
by manually enabling this.
Reviewed-by: wm4
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a44b3abb4c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
1341713550
avcodec/aacdec_fixed: Fix runtime error: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
...
Fixes: 1825/clusterfuzz-testcase-minimized-6002833050566656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e87d146d7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
5529a67817
avcodec/smc: Check remaining input
...
Fixes: Timeout
Fixes: 1818/clusterfuzz-testcase-minimized-5039166473633792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 356194fcb1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
345f296135
avcodec/jpeg2000dec: Fix copy and paste error
...
Found-by: jamrial
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5782e0ba8c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
75d32ff24d
avcodec/jpeg2000dec: Check tile offsets
...
Fixes: runtime error: signed integer overflow: 4096 - -2147483648 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 89325417e7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Max Justicz
87c13e4e88
avcodec/sanm: Fix uninitialized reference frames
...
Fixes: poc.snm
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ca616b0f72 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
52e470097a
avcodec/jpeglsdec: Check get_bits_left() before decoding a picture
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4bc3008d04 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
5148395e86
avcodec/ivi_dsp: Fix multiple runtime error: left shift of negative value -71
...
Fixes: 1734/clusterfuzz-testcase-minimized-5385630815092736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8fb00b3e85 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
32ac3f1b1f
avcodec/mjpegdec: Fix runtime error: signed integer overflow: -32767 * 130560 cannot be represented in type 'int'
...
Fixes: 1724/clusterfuzz-testcase-minimized-4842395432648704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 40fa6a2fa2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
dd373b4027
avcodec/aacdec_fixed: Fix runtime error: shift exponent 34 is too large for 32-bit type 'int'
...
Fixes: 1721/clusterfuzz-testcase-minimized-4719352135811072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5228e44c7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
8bc5e90bb2
avcodec/mpeg4videodec: Check for multiple VOL headers
...
Fixes multiple: runtime error: signed integer overflow: 2147115008 + 413696 cannot be represented in type 'int'
Fixes: 1723/clusterfuzz-testcase-minimized-5309409372667904
Fixes: 1727/clusterfuzz-testcase-minimized-5900685306494976
Fixes: 1737/clusterfuzz-testcase-minimized-5922321338466304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit efeb47fd5d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
5ceb27b0eb
avcodec/vmnc: Check location before use
...
Fixes: runtime error: signed integer overflow: 65535 * 64256 cannot be represented in type 'int'
Fixes: 1717/clusterfuzz-testcase-minimized-5491696676634624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec2b76aab4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
ea4b807c0a
avcodec/takdec: Fix runtime error: signed integer overflow: 8192 * 524308 cannot be represented in type 'int'
...
Fixes: 1630/clusterfuzz-testcase-minimized-6326111917047808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 955db41192 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
0155d1c1cb
avcodec/aac_defines: Fix: runtime error: left shift of negative value -2
...
Fixes: 1716/clusterfuzz-testcase-minimized-4691012196761600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c3547dcbc3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
45c9fe61d9
avcodec/takdec: Fix runtime error: left shift of negative value -63
...
Fixes: 1713/clusterfuzz-testcase-minimized-5791887476654080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d66193252b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
11e2bdd53e
avcodec/mlpdsp: Fix runtime error: signed integer overflow: -24419392 * 128 cannot be represented in type 'int'
...
Fixes: 1711/clusterfuzz-testcase-minimized-5248503515185152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1d04fc94e1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
7d61e21953
avcodec/sbrdsp_fixed: fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
...
Fixes: part of 1709/clusterfuzz-testcase-minimized-4513580554649600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 384508b2ff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
88fabd8016
avcodec/aacsbr_fixed: Fix multiple runtime error: shift exponent 170 is too large for 32-bit type 'int'
...
Fixes part of 1709/clusterfuzz-testcase-minimized-4513580554649600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6310fc714d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
James Almer
24d744cabe
avcodec/hevc_sei: fix amount of bits skipped when reading picture timing SEI message
...
The code was skipping the entire reported SEI message size regardless of
the amount of bits read.
While in theory safe for NALU where the picture timing SEI message is alone
or at the end as we're using the checked bitstream reader, it isn't in any
other situation, where every SEI message in the NALU after the picture
timing one would potentially fail to parse.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit f738140807 )
Conflicts:
libavcodec/hevc_sei.c
2017-05-19 23:38:04 -03:00
James Almer
870f1e3836
avformat/concatdec: fix the h264 annexb extradata check
...
The start code can be either in the first three or four bytes.
(cherry picked from commit b4330a0e02 )
2017-05-19 23:37:59 -03:00
Aaron Levinson
0109a152a1
avformat/utils: free AVStream.codec properly in free_stream()
...
Fixes memory leaks.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit b9d2005ea5 )
2017-05-19 23:37:49 -03:00
James Almer
1c302b606e
avcodec/options: do a more thorough clean up in avcodec_copy_context()
...
Free coded_frame to prevent potential leaks.
Reviewed-by: Aaron Levinson <alevinsn@aracnet.com >
Tested-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit cac8de2da5 )
2017-05-19 23:37:03 -03:00
James Almer
4122e5fcb3
avcodec/options: factorize avcodec_copy_context() cleanup code
...
Reviewed-by: Aaron Levinson <alevinsn@aracnet.com >
Tested-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 54a4c9b4e9 )
2017-05-19 23:22:23 -03:00
Michael Niedermayer
4117f19f2f
avcodec/mlpdec: Do not leave a invalid num_primitive_matrices in the context
...
Fixes: runtime error: index 8 out of bounds for type 'uint8_t [8]'
Fixes: 1699/clusterfuzz-testcase-minimized-6327177438035968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 64ea4d102a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
3ecff1b7e5
avcodec/aacsbr_fixed: Fix multiple runtime error: shift exponent 150 is too large for 32-bit type 'int'
...
Fixes: 1681/clusterfuzz-testcase-minimized-5970545365483520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3fb104f447 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
860ff3c447
avcodec/mimic: Use ff_set_dimensions() to set the dimensions
...
Fixes: OOM
Fixes: 1671/clusterfuzz-testcase-minimized-4759078033162240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e434840fd4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
1397c7f616
avcodec/fic: Fix multiple runtime error: signed integer overflow: 5793 * 419752 cannot be represented in type 'int'
...
Fixes: 1669/clusterfuzz-testcase-minimized-5287529198649344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a173f484b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
346e2d1663
avcodec/mlpdec: Fix: runtime error: left shift of negative value -8
...
Fixes: 1658/clusterfuzz-testcase-minimized-4889937130291200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 25c81e4b73 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
9e62e1cded
avcodec/dfa: Fix: runtime error: signed integer overflow: -14202 * 196877 cannot be represented in type 'int'
...
Fixes: 1657/clusterfuzz-testcase-minimized-4710000079405056
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 58ac7fb9c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
afc0b559f6
avcodec/aacdec: Fix runtime error: signed integer overflow: 2147483520 + 255 cannot be represented in type 'int'
...
Fixes: 1656/clusterfuzz-testcase-minimized-5900404925661184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 94d05ff159 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
f76c1554f6
avcodec/aacdec_template: Fix fixed point scale in decode_cce()
...
Fixes: runtime error: shift exponent 1073741824 is too large for 32-bit type 'int'
Fixes: 1654/clusterfuzz-testcase-minimized-5151903795118080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53a502206a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
209124a944
avcodec/flicvideo: Check frame_size before decrementing
...
Fixes: runtime error: signed integer overflow: -2147483627 - 22 cannot be represented in type 'int'
Fixes: 1637/clusterfuzz-testcase-minimized-5376582493405184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 355e27e24d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
f5d0960872
avcodec/mlpdec: Fix runtime error: left shift of negative value -1
...
Fixes: 1636/clusterfuzz-testcase-minimized-5310494757879808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 552adf1dd3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
07ca48cecf
avcodec/takdec: Fix runtime error: left shift of negative value -42
...
Fixes: 1635/clusterfuzz-testcase-minimized-4992749856096256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 99c4c76cfb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
28d7c43d0f
avcodec/hq_hqa: Fix: runtime error: signed integer overflow: -255 * 10180917 cannot be represented in type 'int'
...
Fixes: 1626/clusterfuzz-testcase-minimized-6416580571299840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d9cb583c8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
9dcd02a5a5
avcodec/truemotion1: Fix multiple runtime error: signed integer overflow: 1246906962 * 2 cannot be represented in type 'int'
...
Fixes: 1616/clusterfuzz-testcase-minimized-5119196578971648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5ea6bc2a166edac37042f2bbc28eb603a0fbeccb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
c90ad2b5cc
avcodec/svq3: Fix runtime error: left shift of negative value -6
...
Fixes: 1604/clusterfuzz-testcase-minimized-5312060206350336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6eb006ad4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
a1778b8cdd
avcodec/tiff: reset sampling[] if its invalid
...
Fixes divission by 0
Fixes: clusterfuzz-testcase-minimized-5592896440893440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f08122fbe0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
aa941e9aa9
avcodec/aacps: Fix undefined behavior
...
Fixes: 1337/clusterfuzz-testcase-minimized-5212314171080704
Fixes the existence of a potentially invalid pointer intermediate
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 527f89e059 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
53567e573b
avcodec/opus_silk: Fix integer overflow and out of array read
...
Fixes: 1362/clusterfuzz-testcase-minimized-6097275002552320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4654baff12 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
ec70017f9f
avcodec/flacdec: Return error code instead of 0 for failures
...
Fixes: infinite loop
Fixes: 1418/clusterfuzz-testcase-minimized-5934472438480896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3f5a68533d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
eca9c51090
avcodec/snowdec: Check width
...
Fixes: out of array read
Fixes: 1419/clusterfuzz-testcase-minimized-6108700873850880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 78aa93807b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
ef94fb391f
avcodec/webp: Update canvas size in vp8_lossy_decode_frame() as in vp8_lossless_decode_frame()
...
Fixes: 1407/clusterfuzz-testcase-minimized-6044604124102656
Fixes: 1420/clusterfuzz-testcase-minimized-6059927359455232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 72810d20b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
4ad139ba23
avcodec/webp: Factor update_canvas_size() out
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4f63b78b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
b3e3cdc0fd
avcodec/cllc: Check prefix
...
Fixes: runtime error: left shift of 1610706944 by 1 places cannot be represented in type 'int'
Fixes: 1421/clusterfuzz-testcase-minimized-6239947507892224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 62c5949bec )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
5b809f53c2
avcodec/dds: Fix runtime error: left shift of 210 by 24 places cannot be represented in type 'int'
...
Fixes: 1510/clusterfuzz-testcase-minimized-5826231746428928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit afb4632cc3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
ab56c64835
avcodec/mpeg4videodec: Clear sprite wraping on unsupported cases in VOP decode
...
Fixes: Integer overflow
Fixes: 1572/clusterfuzz-testcase-minimized-4578773729017856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 467677769a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
b17779fc14
avcodec/ac3dec: Fix: runtime error: index -1 out of bounds for type 'INTFLOAT [2]'
...
It seems dual mono with a LFE channel is not forbidden
Fixes: 1570/clusterfuzz-testcase-minimized-6455337349545984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c55e637072 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
12f969bd2c
avcodec/hqxdsp: Fix runtime error: signed integer overflow: -196264 * 11585 cannot be represented in type 'int'
...
Fixes: 1568/clusterfuzz-testcase-minimized-5944868608147456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b923213276 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
42f2cf1597
libswscale/tests/swscale: Fix uninitialized variables
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7796f29065 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
bfc1534362
avcodec/ffv1dec: Fix runtime error: signed integer overflow: 1550964438 + 1550964438 cannot be represented in type 'int'
...
Fixes: 1559/clusterfuzz-testcase-minimized-5048096079740928
Fixes: 1560/clusterfuzz-testcase-minimized-6011037813833728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8630b2cd36 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
35ed8aa76f
avcodec/webp: Fix signedness in prefix_code check
...
Fixes: out of array read
Fixes: 1557/clusterfuzz-testcase-minimized-6535013757616128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c5cd1c9d3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
4ed535d79b
avcodec/svq3: Fix runtime error: signed integer overflow: 169 * 12717677 cannot be represented in type 'int'
...
Fixes: 1556/clusterfuzz-testcase-minimized-5027865978470400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 86b1b0d33d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
6e46f19cc8
avcodec/mlpdec: Check that there is enough data for headers
...
Fixes: out of array access
Fixes: 1541/clusterfuzz-testcase-minimized-6403410590957568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e3e51f8c14 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
0c92adda48
avcodec/ac3dec: Keep track of band structure
...
It is needed in some corner cases that seem not to be forbidden
Fixes: out of array index
Fixes: 1538/clusterfuzz-testcase-minimized-4696904925446144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9351a156de )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
2ec60b919f
avcodec/webp: Add missing input padding
...
Fixes: 1536/clusterfuzz-testcase-minimized-5973925404082176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a3508cc3fe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
c853966783
avcodec/aacdec_fixed: Fix runtime error: left shift of negative value -1
...
Fixes: 1535/clusterfuzz-testcase-minimized-5826695535788032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 26227d9186 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
699ca0075a
avcodec/aacsbr_template: Do not change bs_num_env before its checked
...
Fixes: 1489/clusterfuzz-testcase-minimized-5075102901207040
Fixes: out of array access
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 87b08ee6d2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
cb45926aa9
avcodec/mlp: Fix multiple runtime error: left shift of negative value -1
...
Fixes: 1512/clusterfuzz-testcase-minimized-4713846423945216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 74dc728a2c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
b198bd75bf
avcodec/vp8dsp: vp7_luma_dc_wht_c: Fix multiple runtime error: signed integer overflow: -1366381240 + -1262413604 cannot be represented in type 'int'
...
Fixes: 1440/clusterfuzz-testcase-minimized-5785716111966208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ccce2248bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
dccd62dc89
avcodec/avcodec: Limit the number of side data elements per packet
...
Fixes: 1293/clusterfuzz-testcase-minimized-6054752074858496
See: [FFmpeg-devel] [PATCH] avcodec/avcodec: Limit the number of side data elements per packet
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d5711cb891 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
4ea880c55e
avcodec/texturedsp: Fix runtime error: left shift of 255 by 24 places cannot be represented in type 'int'
...
Fixes: 1505/clusterfuzz-testcase-minimized-4561688818876416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f225003d17 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
4ce0554daa
avcodec/wmv2dsp: Fix runtime error: signed integer overflow: 181 * -17047030 cannot be represented in type 'int'
...
Fixes: 1503/clusterfuzz-testcase-minimized-5369271855087616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df640dbbc9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
53d5e655c7
avcodec/diracdec: Fix Assertion frame->buf[0] failed at libavcodec/decode.c:610
...
Fixes: 1487/clusterfuzz-testcase-minimized-6288036495097856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6899e6e560 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
f2bdef4f2a
avcodec/msmpeg4dec: Check for cbpy VLC errors
...
Fixes: runtime error: left shift of negative value -1
Fixes: 1480/clusterfuzz-testcase-minimized-5188321007370240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 15e892aad1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
f05cd37d51
avcodec/cllc: Check num_bits
...
Fixes: runtime error: shift exponent -2 is negative
Fixes: 1479/clusterfuzz-testcase-minimized-6638493360979968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2bfd0a9758 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
d6e7a96fc4
avcodec/cllc: Factor VLC_BITS/DEPTH out, do not use repeated literal numbers
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e717fa1f0a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
680157adb2
avcodec/dvbsubdec: Check entry_id
...
Fixes: randomly writing over the array end
Fixes: 1473/clusterfuzz-testcase-minimized-5768907824562176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8a69f2602f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
1f8047adb8
avcodec/aacdec_fixed: Fix multiple shift exponent 33 is too large for 32-bit type 'int'
...
Fixes: 1471/clusterfuzz-testcase-minimized-6376460543590400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a0ff78168 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
df84fb2304
avcodec/mpeg12dec: Fixes runtime error: division by zero
...
Fixes: 1464/clusterfuzz-testcase-minimized-4925445571084288
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c0ece1f4ad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
e7568a4352
avcodec/webp: Always set pix_fmt
...
Fixes: out of array access
Fixes: 1434/clusterfuzz-testcase-minimized-6314998085189632
Fixes: 1435/clusterfuzz-testcase-minimized-6483783723253760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6b5d3fb26f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
60bc8b6282
avfilter/vf_uspp: Fix currently unused input frame dimensions
...
Found-by: Nicolas
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 942036e97c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
79905e0dff
avcodec/truemotion1: Fix multiple runtime error: left shift of negative value -1
...
Fixes: 1446/clusterfuzz-testcase-minimized-5577409124368384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit db5fae3229 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
85d4892cb9
avcodec/eatqi: Fix runtime error: signed integer overflow: 4466147 * 1075 cannot be represented in type 'int'
...
Fixes: 1443/clusterfuzz-testcase-minimized-4826998612426752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8de60ba27 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
507ed0ab52
avcodec/dss_sp: Fix runtime error: signed integer overflow: 2147481189 + 4096 cannot be represented in type 'int'
...
Fixes: 1441/clusterfuzz-testcase-minimized-6223152357048320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ea4287893 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
李赞
37f59340bb
avformat/wavdec: Check chunk_size
...
Fixes integer overflow and out of array access
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d23219637 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
7bbd92f69d
avcodec/cavs: Check updated MV
...
Fixes: runtime error: signed integer overflow: 251 + 2147483647 cannot be represented in type 'int'
Fixes: 1438/clusterfuzz-testcase-minimized-4917542646710272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5871adc90f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
a98d82b13d
avcodec/y41pdec: Fix width in input buffer size check
...
Fixes: out of array read
Fixes: 1437/clusterfuzz-testcase-minimized-4569970002362368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d8d372947 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
4dacf6bc4a
avcodec/svq3: Fix multiple runtime error: signed integer overflow: -237341 * 24552 cannot be represented in type 'int'
...
Fixes: 1429/clusterfuzz-testcase-minimized-5959951610544128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ae6fd1790f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
43bdff201d
avcodec/texturedsp: Fix runtime error: left shift of 218 by 24 places cannot be represented in type 'int'
...
Fixes: 1428/clusterfuzz-testcase-minimized-5263281793007616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2bd8eb05d2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
1c75d1b54b
avcodec/lagarith: Check scale_factor
...
Fixes: 1425/clusterfuzz-testcase-minimized-6295712339853312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ed3c9b5b0d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
5380abf785
avcodec/lagarith: Fix runtime error: left shift of negative value -1
...
Fixes: 1424/clusterfuzz-testcase-minimized-6088327159611392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ddb2dd7edb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
db3d3ced15
avcodec/takdec: Fix multiple runtime error: left shift of negative value -1
...
Fixes: 1423/clusterfuzz-testcase-minimized-5063889899225088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c5d2fa2fdf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
2dcdf145f5
avcodec/indeo2: Check for invalid VLCs
...
Fixes: timeout
Fixes: 1416/clusterfuzz-testcase-minimized-5536862435278848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 159fb8ff7e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
bd908055c8
avcodec/htmlsubtitles: Check for string truncation and return error
...
Fixes out of array access
Fixes: 1354/clusterfuzz-testcase-minimized-5520132195483648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f4ae3cce64 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
6db01ccde7
avcodec/bmvvideo: Fix runtime error: left shift of 137 by 24 places cannot be represented in type 'int'
...
Fixes: 1411/clusterfuzz-testcase-minimized-5776085184675840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 29692023b2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
fbeb8c760c
avcodec/dss_sp: Fix multiple runtime error: signed integer overflow: -15699 * -164039 cannot be represented in type 'int'
...
Fixed: 1409/clusterfuzz-testcase-minimized-5237365020819456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea59ef0c03 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
e7d36d262e
avcodec/dvbsubdec: check region dimensions
...
Fixes: 1408/clusterfuzz-testcase-minimized-6529985844084736
Fixes: integer overflow
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0075d9eced )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
ea10865d78
avcodec/vp8dsp: Fixes: runtime error: signed integer overflow: 1330143360 - -1023040530 cannot be represented in type 'int'
...
Fixes: 1406/clusterfuzz-testcase-minimized-5064865125236736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8824b7370a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
6606445c85
avcodec/hqxdsp: Fix multiple runtime error: signed integer overflow: 248220 * 21407 cannot be represented in type 'int' in idct_col()
...
Fixes: 1405/clusterfuzz-testcase-minimized-5011491835084800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d5118f81b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
ab494a84dd
avcodec/cavsdec: Check sym_factor
...
Fixes: runtime error: signed integer overflow: 25984 * 130560 cannot be represented in type 'int'
Fixes: 1404/clusterfuzz-testcase-minimized-5000441286885376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 279420b5a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
ff342d0587
avcodec/cdxl: Check format for BGR24
...
Fixes: out of array access
Fixes: 1427/clusterfuzz-testcase-minimized-5020737339392000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e42736b95 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
1116de7ba7
avcodec/ffv1dec: Fix copying planes of paletted formats
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a4d387195 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
2474b81eca
avcodec/wmv2dsp: Fix runtime error: signed integer overflow: 181 * -12156865 cannot be represented in type 'int'
...
Fixes: 1401/clusterfuzz-testcase-minimized-6526248148795392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b1f66cf5c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
39108a4724
avcodec/xwddec: Check bpp more completely
...
Fixes out of array access
Fixes: 1399/clusterfuzz-testcase-minimized-4866094172995584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 441026fcb1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
73e68fbe86
avcodec/s302m: Fix left shift of 8 by 28 places cannot be represented in type 'int'
...
Fixes: 1395/clusterfuzz-testcase-minimized-5330939741732864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a38e9797cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
89b2c24931
avcodec/eamad: Fix runtime error: signed integer overflow: 49674 * 49858 cannot be represented in type 'int'
...
Fixes: 1394/clusterfuzz-testcase-minimized-6493376885030912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ac1c87194 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
fc99e4c972
avcodec/g726: Fix runtime error: left shift of negative value -2
...
Fixes: 1393/clusterfuzz-testcase-minimized-5948366791901184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c04aa14882 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
c9cdea2a24
avcodec/ra144: Fix runtime error: left shift of negative value -798
...
Fixes: 1388/clusterfuzz-testcase-minimized-6680800936329216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 78bf446852 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
6856a8f0ad
avcodec/mss34dsp: Fix multiple signed integer overflow
...
Fixes: 1387/clusterfuzz-testcase-minimized-4802757766676480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 464c4b86ee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
d2dba39204
avcodec/targa_y216dec: Fix width type
...
Fixes out of array access
Fixes: 1376/clusterfuzz-testcase-minimized-6361794975105024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3e56db8926 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
91394cc4da
avcodec/ivi_dsp: Fix multiple left shift of negative value -2
...
Fixes: 1385/clusterfuzz-testcase-minimized-5552882663292928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e88cc94e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
833a759d40
avcodec/svq3: Fix multiple runtime error: signed integer overflow: 44161 * 61694 cannot be represented in type 'int'
...
Fixes: 1382/clusterfuzz-testcase-minimized-6013445293998080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 669419939c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
906c9d0804
avcodec/msmpeg4dec: Correct table depth
...
Fixes undefined shift
Fixes: 1381/clusterfuzz-testcase-minimized-5513944540119040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1121d92707 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
5b56c2d83a
avcodec/dds: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
...
Fixes: 1380/clusterfuzz-testcase-minimized-650122545122508
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8a8335de03 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
191e0f7e2b
avcodec/cdxl: Check format parameter
...
Fixes out of array access
Fixes: 1378/clusterfuzz-testcase-minimized-5715088008806400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e1b60aad77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
224ed78e72
avutil/softfloat: Fix overflow in av_div_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 277e397eb5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
d68870a606
avcodec/hq_hqa: Fix runtime error: left shift of negative value -207
...
Fixes: 1375/clusterfuzz-testcase-minimized-6070134701555712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1283c42447 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
afbe970534
avcodec/mss3: Change types in rac_get_model_sym() to match the types they are initialized from
...
Fixes integer overflow
Fixes: 1372/clusterfuzz-testcase-minimized-5712192982745088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ef0f39271 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
b9289fad4b
avcodec/shorten: Check k in get_uint()
...
Fixes: undefined shift
Fixes: 1371/clusterfuzz-testcase-minimized-5770822591447040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b6a51f59c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
ff27d17348
avcodec/webp: Fix null pointer dereference
...
Fixes: 1369/clusterfuzz-testcase-minimized-5048908029886464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9bf4523e40 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
1951a44d77
avcodec/dfa: Fix signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
...
Fixes: 1368/clusterfuzz-testcase-minimized-4507293276176384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 12936a4585 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
54368ac9b3
avcodec/mimic: Fix runtime error: left shift of negative value -1
...
Fixes: 1365/clusterfuzz-testcase-minimized-5624158450876416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fc2c420b82 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
ce0db291c6
avcodec/fic: Fix multiple left shift of negative value -15
...
Fixes: 1356/clusterfuzz-testcase-minimized-6008489086287872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b20c71409b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
00371aff3d
avcodec/mlpdec: Fix runtime error: left shift of negative value -22
...
Fixes: 1355/clusterfuzz-testcase-minimized-6662205472768000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c535436cbe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
acb589b12d
avcodec/snowdec: Check qbias
...
Fixes: signed integer overflow: -1094995529 * 131 cannot be represented in type 'int'
Fixes: 1353/clusterfuzz-testcase-minimized-5208180449607680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 523205ce1e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
5dec065a4d
avutil/softfloat: Fix multiple runtime error: left shift of negative value -8
...
Fixes: 1352/clusterfuzz-testcase-minimized-5757565017260032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 35f3df0d76 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
ddab43d3a8
avcodec/aacsbr_template: Do not leave bs_num_env invalid
...
Fixes out of array read
Fixes: 1349/clusterfuzz-testcase-minimized-5370707196248064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8ad83b793 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
51b8a78851
avcodec/mdec: Fix signed integer overflow: 28835400 * 83 cannot be represented in type 'int'
...
Fixes: 1346/clusterfuzz-testcase-minimized-5776732600664064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a234b5ade3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
1e9fa7c69f
avcodec/dfa: Fix off by 1 error
...
Fixes out of array access
Fixes: 1345/clusterfuzz-testcase-minimized-6062963045695488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f52fbf4f3e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
cd6c4082db
avcodec/nellymoser: Fix multiple left shift of negative value -8591
...
Fixes: 1342/clusterfuzz-testcase-minimized-5490842129137664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0953736b7e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
3366d18c29
avcodec/cdxl: Fix signed integer overflow: 14243456 * 164 cannot be represented in type 'int'
...
Fixes: 1341/clusterfuzz-testcase-minimized-5441502618583040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1002932a3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
cacae0656f
avcodec/g722: Fix multiple runtime error: left shift of negative value -1
...
Fixes: 1340/clusterfuzz-testcase-minimized-4669892148068352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f55df62998 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
a6e7636dac
avcodec/dss_sp: Fix multiple left shift of negative value -466
...
Fixes: 1339/clusterfuzz-testcase-minimized-4614671485108224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38152d9368 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
2197423ec9
avcodec/wnv1: Fix runtime error: left shift of negative value -1
...
Fixes: 1338/clusterfuzz-testcase-minimized-6485546354343936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9fac508ca4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
e924213492
avcodec/tiertexseqv: set the fixed dimenasions, do not depend on the demuxer doing so
...
Fixes: out of array access
Fixes: 1348/clusterfuzz-testcase-minimized-6195673642827776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ce551a3925 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
7ab6224083
avcodec/mjpegdec: Fix runtime error: signed integer overflow: -24543 * 2031616 cannot be represented in type 'int'
...
Fixes: 943/clusterfuzz-testcase-5114865297391616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a78ae465fd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
e45de9d279
avcodec/cavsdec: Fix undefined behavior from integer overflow
...
Fixes: 1335/clusterfuzz-testcase-minimized-5566961566089216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a0e5f7f363 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
65bc41b857
avcodec/dvdsubdec: Fix runtime error: left shift of 242 by 24 places cannot be represented in type 'int'
...
Fixes: 1080/clusterfuzz-testcase-5353236754071552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ce7098b8f2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
7dc7d70644
libavcodec/mpeg4videodec: Convert sprite_offset to 64bit
...
This avoids intermediates from overflowing (the final values are checked)
Fixes: runtime error: signed integer overflow: -167712 + -2147352576 cannot be represented in type 'int'
Fixes: 1298/clusterfuzz-testcase-minimized-5955580877340672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1c3a14073 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
4ea21dd574
avcodec/pngdec: Use ff_set_dimensions()
...
Fixes OOM
Fixes: 1314/clusterfuzz-testcase-minimized-4621997222920192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a0296fc056 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
0a391b738e
avcodec/msvideo1: Check buffer size before re-getting the frame
...
Fixes timeout
Fixes: 1306/clusterfuzz-testcase-minimized-6152296217968640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cabfed6895 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
533999aaad
avcodec/h264_cavlc: Fix undefined behavior on qscale overflow
...
Fixes: 1214/clusterfuzz-testcase-minimized-6130606599569408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fc8cff96ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
9d2939a791
avcodec/svq3: Increase offsets to prevent integer overflows
...
Fixes: 1280/clusterfuzz-testcase-minimized-6102353767825408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 382b4fc9b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
97458a040f
avcodec/indeo2: Check remaining bits in ir2_decode_plane()
...
Fixes: 1290/clusterfuzz-testcase-minimized-5815578902134784
Fixes: timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b29feec982 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
7f5c9250de
avcodec/vp3: Check remaining bits in unpack_dct_coeffs()
...
Decreases the time spend decoding junk.
May fix: 1283/clusterfuzz-testcase-minimized-6221126759874560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f00300b77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
37f5bfaa2b
avcodec/mdec: Fix runtime error: left shift of negative value -127
...
Fixes undefined behavior
Fixes: 1275/clusterfuzz-testcase-minimized-6718162017976320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ca82975b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Martin Vignali
d1b23e5c0c
libavcodec/exr : fix float to uint16 conversion for negative float value
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e46d637452 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Derek Buitenhuis
77dd220385
avformat/webmdashenc: Validate the 'streams' adaptation sets parameter
...
It should not be a value larger than the number of streams we have,
or it will cause invalid reads and/or SIGSEGV.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec07efa700 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Derek Buitenhuis
436f1d4562
avformat/webmdashenc: Require the 'adaptation_sets' option to be set
...
This seems to be non-optional, and if the muxer is run without it,
strlen() is run on NULL, causing a segfault.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cbd3a68f3e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
3fd8e79dc9
avcodec/dvdsubdec: Fixes 2 runtime error: left shift of 170 by 24 places cannot be represented in type 'int'
...
Fixes: 619/clusterfuzz-testcase-5803914534322176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 61ee2ca775 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
cbd0036856
avfilter/avfiltergraph: Add assert to write down in machine readable form what is assumed about sample rates in swap_samplerates_on_filter()
...
Fixes CID1397292
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f2b360fc0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
344e5de993
avcodec/tiff: Perform multiply in tiff_unpack_lzma() as 64bit
...
This should make no difference as the value should not be able to be that large
but its more correct this way
Fixes CID1348138
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f48b6b8b91 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Philip Langdale
9c7730417d
avcodec/vdpau_hevc: Fix potential out-of-bounds write
...
The maximum number of references is 16, so the index value cannot
exceed 15.
Fixes Coverity CID 1348139, 1348140, 1348141
(cherry picked from commit 4e6d1c1f4e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
95594b9815
avcodec/tiff: Check geotag count for being non zero
...
Fixes memleak
Fixes: 874/clusterfuzz-testcase-5252796175613952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3182e19c1c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
a2a028af6e
avcodec/vp56: Check avctx->error_concealment before enabling EC
...
Fixes timeout with 847/clusterfuzz-testcase-5291877358108672
Fixes timeout with 850/clusterfuzz-testcase-5721296509861888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 98da63b3f5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
26b2b2d052
avcodec/tiff: Check stripsize strippos for overflow
...
Fixes: 861/clusterfuzz-testcase-5688284384591872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d996b5649 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
17624e4156
avcodec/mpegaudiodec_template: Make l3_unscale() work with e=0
...
Fixes undefined behavior
Fixes: 830/clusterfuzz-testcase-6253175327686656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ebed703f1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
b34ca8295d
avcodec/tiff: Check for multiple geo key directories
...
Fixes memleak
Fixes: 826/clusterfuzz-testcase-5316921379520512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 108b02e547 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
922013c983
avcodec/wavpack: Fix runtime error: shift exponent 32 is too large for 32-bit type 'int'
...
Fixes: 822/clusterfuzz-testcase-4873433189974016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7cebc5a9cc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
36c314e76a
avcodec/rv34: Fix runtime error: signed integer overflow: 36880 * 66288 cannot be represented in type 'int'
...
Fixes: 768/clusterfuzz-testcase-4807444305805312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a66c6e28b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
4e2c1055a0
avcodec/amrwbdec: Fix runtime error: left shift of negative value -1
...
Fixes: 763/clusterfuzz-testcase-6007567320875008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 44e2105189 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
e83d6c6819
avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: -135088512 * 16 cannot be represented in type 'int'
...
Fixes: 736/clusterfuzz-testcase-5580263943831552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e2a4f1a9eb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
96cc855c1a
avcodec/h264_mvpred: Fix runtime error: left shift of negative value -1
...
Fixes: 734/clusterfuzz-testcase-4821293192970240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 222c9f031d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
bf37f12f40
avcodec/mjpegdec: Fix runtime error: left shift of negative value -127
...
Fixes: 733/clusterfuzz-testcase-4682158096515072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 800d02abe0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
4d4ce42f0b
avcodec/wavpack: Fix runtime error: left shift of negative value -5
...
Fixes: 729/clusterfuzz-testcase-5154831595470848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3016e919d4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
f31e43175c
avcodec/wavpack: Fix runtime error: left shift of negative value -2
...
Fixes: 723/clusterfuzz-testcase-6471394663596032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ba15005132 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
5cb5e2550e
avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: 134527392 * 16 cannot be represented in type 'int'
...
This checks the sprite delta intermediates for overflow
Fixes: 716/clusterfuzz-testcase-4890287480504320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fab13bbbcd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
c41ce74c8a
avcodec/mpeg12dec: Fix runtime error: left shift of negative value -13
...
Fixes: 709/clusterfuzz-testcase-4789836449841152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d757ddbaab )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
8ca5f502ac
avcodec/h264_mvpred: Fix multiple runtime error: left shift of negative value
...
Fixes: 710/clusterfuzz-testcase-5091051431788544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab998f4c7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
1a8f1ae223
avcodec/adxdec: Fix runtime error: left shift of negative value -1
...
Fixes: 705/clusterfuzz-testcase-5129572590813184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d23727e042 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
66d81c5926
avcodec/mpeg4videodec: Improve the overflow checks in mpeg4_decode_sprite_trajectory()
...
Also clear the state on errors
Fixes integer overflows in 701/clusterfuzz-testcase-6594719951880192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eb41956636 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
718c1433d9
avcodec/mjpegdec: Fix runtime error: left shift of negative value -511
...
Fixes: 693/clusterfuzz-testcase-6109776066904064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4b72d5cd6f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
b9cc73fafb
avcodec/h264_direct: Fix runtime error: left shift of negative value -14
...
Fixes: 682/clusterfuzz-testcase-4799120021651456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4bd3f1ce3e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
e65462291e
avcodec/pictordec: Check plane value before doing value/mask computations
...
Fixes integer overflow
Fixes: 675/clusterfuzz-testcase-6722971232108544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 63e400a880 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
09e51a464c
avcodec/mpeg4videodec: Fix runtime error: left shift of negative value -2650
...
Fixes: 674/clusterfuzz-testcase-6713275880308736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 25e93aacc2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
5453ac597e
avcodec/eac3dec: Fix runtime error: left shift of negative value -3
...
Fixes: 672/clusterfuzz-testcase-5595018867769344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 87eb374970 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
d782b0b2ad
avcodec/mpeg12dec: Fix runtime error: left shift of negative value -2
...
671/clusterfuzz-testcase-4990381827555328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aff8cf18cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
e5c39ad0e9
avcodec/mpeg4videodec: Check the other 3 sprite points for intermediate overflows
...
This is not necessarily specific to fuzzed files
Fixes: Multiple integer overflows
Fixes: 656/clusterfuzz-testcase-6463814516080640
Fixes: 658/clusterfuzz-testcase-6691260146384896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 76ba09d182 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
a50259df79
avcodec/mpeg4videodec: Check sprite_offset in addition to shifts
...
Fixes: 651/clusterfuzz-testcase-5710668915277824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6871df02d9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
bccc669fb1
avcodec/mpeg4video: Fix runtime error: left shift of negative value
...
Fixes: 644/clusterfuzz-testcase-4726434209726464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6179dc8aa7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
38e34f5015
avcodec/ituh263dec: Fix runtime error: left shift of negative value -22
...
Fixes: 639/clusterfuzz-testcase-5143866241974272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 631f748491 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
12a4a93b40
avcodec/rv40: Fix runtime error: left shift of negative value
...
Fixes: 630/clusterfuzz-testcase-6608718928019456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 956472a323 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
00870c248e
avcodec/h264_cabac: runtime error: signed integer overflow: 2147483647 + 14 cannot be represented in type 'int'
...
Fixes: 614/clusterfuzz-testcase-4931860079575040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 258763ad0e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
016a8e7772
avcodec/mpeg4videodec: Fix runtime error: shift exponent -2 is negative
...
Fixes: 612/clusterfuzz-testcase-4707817137111040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa2b75263e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
8f64abc5e2
avcodec/mjpegdec: Fix runtime error: left shift of negative value -507
...
Fixes: 611/clusterfuzz-testcase-5613455820193792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c91bdd4524 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
554687bff6
avcodec/eac3dec: Fix runtime error: left shift of negative value
...
Fixes: 610/clusterfuzz-testcase-4831030085156864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 067485b673 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
b1817a23c2
avcodec/vp6: clear dimensions on failed resolution change in vp6_parse_header()
...
Fixes: 807/clusterfuzz-testcase-6470061042696192
Fixes null pointer dereference
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 967feea5eb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
f8769b1a70
avcodec/vp56: Reset have_undamaged_frame on resolution changes
...
Fixes: timeout in 758/clusterfuzz-testcase-4720832028868608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6e913f2129 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Thomas Guilbert
b27bcc32c7
avcodec/vp8: Fix hang with slice threads
...
Fixes: 447860.webm
Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9bbc73ae9f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
678dd7cf20
avcodec/vp8: Check for the bitstream end per MB in decode_mb_row_no_filter()
...
Fixes: timeout in 730/clusterfuzz-testcase-5265113739165696 (part 2 of 2)
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: BBB
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1afd246960 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
45abce9e05
avcodec/vp568: Check that there is enough data for ff_vp56_init_range_decoder()
...
Fixes: timeout in 730/clusterfuzz-testcase-5265113739165696 (part 1 of 2)
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: BBB
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 55d7371fe0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
efa47b5c99
avcodec/vp8: remove redundant check
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5098a6f627 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
4e30560efc
avcodec/vp56: Require a correctly decoded frame before using vp56_conceal_mb()
...
Fixes timeout with 700/clusterfuzz-testcase-5660909504561152
Fixes timeout with 702/clusterfuzz-testcase-4553541576294400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ce4f28431 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
94d1f07c3b
avcodec/vp3: Do not return random positive values but the buf size
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d8094a303b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
b382722972
avcodec/vp8: Check for bitsteam end in decode_mb_row_no_filter()
...
Fixes timeout with 686/clusterfuzz-testcase-5853946876788736
this shortcuts (i.e. speeds up) the error and
return-to-user when decoding a truncated frame
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Previous version reviewed by: "Ronald S. Bultje" <rsbultje@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b5ff7d573 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
d19550189f
avcodec/vp56: Factorize vp56_render_mb() out
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4c0139463c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
5c764f0625
avcodec/vp3dsp: Fix multiple signed integer overflow: 46341 * 47523 cannot be represented in type 'int'
...
Fixes: 664/clusterfuzz-testcase-4917047475568640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b8b7921c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
3b067c9edc
Add CHECK/SUINT code
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4614bf2caf )
(cherry picked from commit e8d4eacc07 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3f2a09a43f6fade53227804459e6babb1c7248b3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
0b0f58d462
avcodec/mpeg12dec: Fix runtime error: left shift of negative value -1
...
Fixes: 764/clusterfuzz-testcase-6273034652483584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a720b854b0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
2219045914
avcodec/vp56: Clear dimensions in case of failure in the middle of a resolution change
...
Similar code is used elsewhere in vp56 to force a more complete reinit in the future.
Fixes null pointer dereference
Fixes: 707/clusterfuzz-testcase-4717453097566208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4bed066377 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
ae82d4f0fa
avcodec/vp56: Implement very basic error concealment
...
This should fix the fate failure due to a truncated last frame.
Alternatively the frame could be dropped.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d34bf886e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
18eb359953
avcodec/amrwbdec: Fix 2 runtime errors: left shift of negative value -1
...
Fixes: 669/clusterfuzz-testcase-4847965409640448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6bd79ba59f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
f7e3422a8f
avcodec/pngdec: Fix runtime error: left shift of 152 by 24 places cannot be represented in type 'int'
...
Fixes: 666/clusterfuzz-testcase-6581447227867136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 310d2af319 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
e28c0d4888
avcodec/vp56: Fix sign typo
...
Fixes: 664/clusterfuzz-testcase-4917047475568640
The change to fate is due to a truncated last frames which is now detected as damaged.
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 513a349439 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
68f7ebcd8d
avcodec/mpegaudiodec_template: Correct return code on id3 tag discarding
...
Fixes: 665/clusterfuzz-testcase-4863789881098240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d81616be3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
46828511c2
avcodec/rv34: Simplify and factor get_slice_offset() code
...
This also fixes several integer overflows by checking each value before
use.
Fixes: 662/clusterfuzz-testcase-4898131432964096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8696f25444 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
5eea0562b9
avcodec/pictordec: Do not read more than nb_planes
...
Fixes undefined behavior
Fixes: 622/clusterfuzz-testcase-5745722022428672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 01d196a67d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
34450a86c8
avcodec/srtdec: Fix signed integer overflow: 1811992524 * 384 cannot be represented in type 'int'
...
Fixes: 617/clusterfuzz-testcase-6413875723370496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c11d3634b0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
00a81ed120
avcodec/pngdec: Check bit depth for validity
...
Fixes: runtime error: shift exponent 132 is too large for 32-bit type 'int'
Fixes: 609/clusterfuzz-testcase-4825202619842560
See 11.2.2 IHDR Image header
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4279613a26 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
367222af32
avcodec/mpeg12dec: Fix runtime error: left shift of negative value
...
Fixes: 608/clusterfuzz-testcase-603978286392934
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 706757d26d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
7272eb87df
avcodec/wavpacl: Fix runtime error: left shift of negative value -1
...
Fixes: 607/clusterfuzz-testcase-5108792465293312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 12eebb845a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
02c51f3232
avformat/http: Check for truncated buffers in http_connect()
...
Reported-by: SleepProgger <security@gnutp.com >
Reviewed-by: Steven Liu <lingjiujianke@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8fa18e042a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
James Almer
a1ad585c8e
avformat/apng: fix setting frame delay when max_fps is set to no limit
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 874eb012f7 )
2017-03-21 20:21:12 -03:00
James Almer
31e65eb84d
swresample/resample: free existing ResampleContext on reinit
...
Fixes memleak.
Reviewed-by: wm4 <nfxjfg@googlemail.com >
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit db7a05dab0 )
2017-03-21 12:19:20 -03:00
James Almer
f7f5a52459
swresample/resample: move resample_free() higher in the file
...
Also make it more readable while at it.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 2a8a8a2e98 )
Conflicts:
libswresample/resample.c
2017-03-21 12:19:03 -03:00
Carl Eugen Hoyos
518158693e
lavf/mpeg: Initialize a stack variable used by memcmp().
...
Silence a valgrind warning.
Fixes ticket #6160 .
(cherry picked from commit a5c1c7a8b3 )
2017-02-21 02:16:28 +01:00
Carl Eugen Hoyos
92d8106fa6
lavc/avpacket: Initialize a variable in error path.
...
Fixes ticket #6153 .
Tested-by: Tyson Smith
(cherry picked from commit 1d54be2153 )
2017-02-17 10:44:45 +01:00
Michael Niedermayer
523da8eac1
Update for 2.8.11
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:45:54 +01:00
Michael Niedermayer
912cb27f73
avcodec/h264_slice: Clear ref_counts on redundant slices
...
Fixes reading freed memory
Fixes: 568/clusterfuzz-testcase-6107186067406848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c03029a835 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Matt Wolenetz
4adc99ecb6
lavf/mov.c: Avoid heap allocation wrap in mov_read_uuid
...
Core of patch is from paul@paulmehta.com
Reference https://crbug.com/643951
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
Check value reduced as the code does not support values beyond INT_MAX
Also the check is moved to a more common place and before integer truncation
(cherry picked from commit 2d453188c2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Matt Wolenetz
8be3724e55
lavf/mov.c: Avoid heap allocation wrap in mov_read_hdlr
...
Core of patch is from paul@paulmehta.com
Reference https://crbug.com/643950
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
Check value reduced as the code does not support larger lengths
(cherry picked from commit fd30e4d57f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Michael Niedermayer
142c1737e3
avcodec/pictordec: Fix logic error
...
Fixes: 559/clusterfuzz-testcase-6424225917173760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c2ea3030a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Michael Niedermayer
61b86ae8ce
avcodec/movtextdec: Fix decode_styl() cleanup
...
Fixes: null pointer dereference
Fixes: 555/clusterfuzz-testcase-5986646595993600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e248522d1b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Chris Cunningham
b3ae6cfe11
lavf/matroskadec: fix is_keyframe for early Blocks
...
Blocks are marked as key frames whenever the "reference" field is
zero. This breaks for non-keyframe Blocks with a reference timestamp
of zero.
The likelihood of reference timestamp being zero is increased by a
longstanding bug in muxing that encodes reference timestamp as the
absolute time of the referenced frame (rather than relative to the
current Block timestamp, as described in MKV spec).
Now using INT64_MIN to denote "no reference".
Reported to chromium at http://crbug.com/497889 (contains sample)
(cherry picked from commit ac25840ee3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
James Almer
d053b25b59
configure: bump year
...
Happy new year!
(cherry picked from commit d800d48fc6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Michael Niedermayer
3aa8440baf
avcodec/pngdec: Check trns more completely
...
Fixes out of array access
Fixes: 546/clusterfuzz-testcase-4809433909559296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e477f09d0b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Michael Niedermayer
c9992efd84
avcodec/interplayvideo: Move parameter change check up
...
Fixes out of array read
Fixes: 544/clusterfuzz-testcase-5936536407244800.f8bd9b24_8ba77916_70c2c7be_3df6a2ea_96cd9f14
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b1e2192007 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Michael Niedermayer
87cc0b0474
avcodec/mjpegdec: Check for for the bitstream end in mjpeg_decode_scan_progressive_ac()
...
Fixes timeout
Fixes: 496/clusterfuzz-testcase-5805083497332736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3782656631 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Frank Liberato
d59582a567
avformat/flacdec: Check avio_read result when reading flac block header.
...
Return AVERROR_INVALIDDATA if all four bytes aren't present.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 95bde49982 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Michael Niedermayer
17a9e90d1f
avcodec/utils: correct align value for interplay
...
Fixes out of array access
Fixes: 452/fuzz-1-ffmpeg_VIDEO_AV_CODEC_ID_INTERPLAY_VIDEO_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2080bc3371 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Michael Niedermayer
3aca3f1257
avcodec/vp56: Check for the bitstream end, pass error codes on
...
Fixes timeout
Fixes: 446/fuzz-3-ffmpeg_VIDEO_AV_CODEC_ID_VP6_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e6a242755 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Michael Niedermayer
9f2e4c26a0
avcodec/mjpegdec: Check remaining bitstream in ljpeg_decode_yuv_scan()
...
Fixes timeout
Fixes: 445/fuzz-3-ffmpeg_VIDEO_AV_CODEC_ID_MJPEG_fuzzer
Fixes: 456/fuzz-2-ffmpeg_VIDEO_AV_CODEC_ID_JPEGLS_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 755933cb5c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Michael Niedermayer
1febd817b1
avcodec/pngdec: Fix off by 1 size in decode_zbuf()
...
Fixes out of array access
Fixes: 444/fuzz-2-ffmpeg_VIDEO_AV_CODEC_ID_PNG_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e371f031b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Tobias Rapp
3f3ee3e62f
avformat/avidec: skip odml master index chunks in avi_sync
...
Fixes pts gaps when reading AVI files > 256GiB generated by FFmpeg.
Signed-off-by: Tobias Rapp <t.rapp@noa-archive.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6d579d7c1b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Michael Niedermayer
8be687a81f
avcodec/mjpegdec: Check for rgb before flipping
...
Fixes assertion failure due to unsupported case
Fixes: 356/fuzz-1-ffmpeg_VIDEO_AV_CODEC_ID_MJPEG_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 25d9643f11 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:50 +01:00
Michael Niedermayer
1827fe0989
avutil/random_seed: Reduce the time needed on systems with very low precission clock()
...
This should fix issues on BSD
CLOCKS_PER_SEC is 128 on BSD while SUSv2 requires it to be a million
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4152fc42e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:50 +01:00
Michael Niedermayer
02073b5ab1
avutil/random_seed: Improve get_generic_seed() with higher precission clock()
...
Tested-by: Thomas Turner <thomastdt@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit da73d95bad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:50 +01:00
Michael Niedermayer
1825f7670a
avformat/utils: Print verbose error message if stream count exceeds max_streams
...
Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f0bdd53871 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:50 +01:00
Michael Niedermayer
2647ca4581
avformat/options_table: Set the default maximum number of streams to 1000
...
Fixes CVE-2016-9561, Note the security relevance of this is disputed as
running out of memory can happen with valid files
Suggested-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com >
Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 30581c51e7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:50 +01:00
Michael Niedermayer
2e44b10418
avutil: Add av_image_check_size2()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f542b152aa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:50 +01:00
Michael Niedermayer
c6fbff1358
avformat: Add max_streams option
...
This allows user apps to stop OOM due to excessive number of streams
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1296f84495 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:50 +01:00
Michael Niedermayer
774461ea62
avcodec/ffv1enc: Allocate smaller packet if the worst case size cannot be allocated
...
We are checking during encoding if there is enough space as version 4 needs that
check.
Fixes Ticket6005
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38a7834bbb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:50 +01:00
Michael Niedermayer
94a0a484b7
avcodec/mpeg4videodec: Fix undefined shifts in mpeg4_decode_sprite_trajectory()
...
Fixes: part of 670190.ogg
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8258e36385 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:50 +01:00
Michael Niedermayer
a127f51140
avformat/oggdec: Skip streams in duration correction that did not had their duration set.
...
Fixes: part of 670190.ogg
Fixes integer overflow
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ee2a6f5df8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:50 +01:00
Michael Niedermayer
07ca8300a6
avcodec/ffv1enc: Fix size of first slice
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cff1c0edaa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:50 +01:00
Andreas Cadhalpun
f7e18dea7a
pgssubdec: reset rle_data_len/rle_remaining_len on allocation error
...
The code relies on their validity and otherwise can try to access a NULL
object->rle pointer, causing segmentation faults.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 842e98b4d8 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2017-02-01 02:29:08 +01:00
Michael Niedermayer
16c0d8aa46
update for ffmpeg 2.8.10
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-06 03:50:50 +01:00
Michael Niedermayer
1ec9fd15b9
avformat/http: Match chunksize checks to master..3.0
...
Fixes warning about impossible condition
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-06 03:30:10 +01:00
Michael Niedermayer
4a947f4385
Changelog: fix typos
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-06 01:19:34 +01:00
Michael Niedermayer
e0cb113f9b
ffserver: Check chunk size
...
Fixes out of array access
Fixes: poc_ffserver.py
Found-by: Paul Cher <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5d25faa3f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-06 00:59:22 +01:00
Michael Niedermayer
15abba737b
Avoid using the term "file" and prefer "url" in some docs and comments
...
This should make it less ambigous that these are URLs
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5f27a9c3a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-06 00:59:22 +01:00
Michael Niedermayer
5bfb0b02b6
avformat/rtmppkt: Check for packet size mismatches
...
Fixes out of array access
Found-by: Paul Cher <paulcher@icloud.com >
Reviewed-by: Paul Cher <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d57ca4d9a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-06 00:59:22 +01:00
Timothy Gu
c472c1b3e7
zmqsend: Initialize ret to 0
...
Fixes CID1396857.
(cherry picked from commit d903b4e3ad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-06 00:59:22 +01:00
James Almer
e8dfe3f34a
configure: check for strtoull on msvc
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit b52d3574d4 )
2016-12-05 19:19:11 -03:00
Ronald S. Bultje
d3fc5c17de
http: move chunk handling from http_read_stream() to http_buf_read().
...
(cherry picked from commit 845bb40178 )
2016-12-05 16:20:58 -05:00
Ronald S. Bultje
606b21353d
http: make length/offset-related variables unsigned.
...
Fixes #5992 , reported and found by Paul Cher <paulcher@icloud.com >.
(cherry picked from commit 2a05c8f813 )
2016-12-05 16:20:40 -05:00
Michael Niedermayer
fb93771072
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 01:42:53 +01:00
Michael Niedermayer
3f8bb78f3e
avcodec/flacdec: Fix undefined shift in decode_subframe()
...
Fixes undefined behavior
Fixes: 639961-media
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f5630af51 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 01:05:02 +01:00
Michael Niedermayer
a5989651f0
avcodec/get_bits: Fix get_sbits_long(0)
...
Fixes undefined behavior
Fixes: 640889-media
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c72fa43234 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 01:03:53 +01:00
Michael Niedermayer
1e512388ee
avformat/ffmdec: Check media type for chunks
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e706e2e775 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-03 17:46:37 +01:00
Michael Niedermayer
31d46dc97d
avcodec/flacdec: Fix signed integer overflow in decode_subframe_fixed()
...
Fixes undefined behavior
Fixes: 640912-media
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 83a75bf6c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-03 17:32:54 +01:00
Michael Niedermayer
5790ce6273
avcodec/flacdsp_template: Fix undefined shift in flac_decorrelate_indep_c
...
Fixes: left shift of negative value
Fixes: 668346-media
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit acc163c6ab )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-03 17:32:33 +01:00
Michael Niedermayer
f202fefdb0
avformat/oggparsespeex: Check frames_per_packet and packet_size
...
The speex specification does not seem to restrict these values, thus
the limits where choosen so as to avoid multiplicative overflow
Fixes undefined behavior
Fixes: 635422.ogg
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit afcf15b0db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-03 04:10:31 +01:00
Michael Niedermayer
3af916db37
avformat/utils: Check start/end before computing duration in update_stream_timings()
...
Fixes undefined behavior
Fixes: 637428.ogg
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 90da187f1d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-03 04:10:19 +01:00
Michael Niedermayer
518beeb72f
Changelog: Update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-02 00:47:39 +01:00
Michael Niedermayer
46edc6d5ef
avcodec/flac_parser: Update nb_headers_buffered
...
Fixes infinite loop
Fixes: fuzz.flac
Found-by: Frank Liberato <liberato@google.com >
Reviewed-by: Frank Liberato <liberato@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2475858889 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-01 23:50:40 +01:00
Michael Niedermayer
046cc06f5a
avformat/idroqdec: Check chunk_size for being too large
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 744a0b5206 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-01 23:50:40 +01:00
Andreas Cadhalpun
970781f5f2
Update Changelog
2016-11-27 00:47:03 +01:00
Andreas Cadhalpun
d8ec9e97b9
filmstripdec: correctly check image dimensions
...
This prevents a division by zero in read_packet.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 25012c5644 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:36 +01:00
Andreas Cadhalpun
028c87be95
mss2: only use error correction for matching block counts
...
This fixes a heap-buffer-overflow in ff_er_frame_end when decoding mss2
with coded_width/coded_height larger than width/height.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 2566ad98b0 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:36 +01:00
Andreas Cadhalpun
b45e112bbd
softfloat: decrease MIN_EXP to cover full float range
...
floats are not necessarily normalized, so a normalized softfloat needs
MIN_EXP lowered by 23 to cover that range.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 2d6f46d801 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:35 +01:00
Andreas Cadhalpun
56b120630f
libopusdec: default to stereo for invalid number of channels
...
This fixes an out-of-bounds read if avc->channels is 0.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 8c8f543b81 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:35 +01:00
Andreas Cadhalpun
22cd4aa221
sbgdec: prevent NULL pointer access
...
Reviewed-by: Josh de Kock <josh@itanimul.li >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit dbefbb61b7 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:35 +01:00
Andreas Cadhalpun
8a7b2fbf6f
smacker: limit recursion depth of smacker_decode_bigtree
...
This fixes segmentation faults due to stack-overflow caused by too deep
recursion.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 946ecd19ea )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:35 +01:00
Andreas Cadhalpun
8f27508f1c
mxfdec: fix NULL pointer dereference in mxf_read_packet_old
...
Metadata streams have priv_data set to NULL.
Reviewed-by: Josh de Kock <josh@itanimul.li >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit fdb8c455b6 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:35 +01:00
Andreas Cadhalpun
7552f6fc1b
libschroedingerdec: fix leaking of framewithpts
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 3c0328d58d )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:35 +01:00
Andreas Cadhalpun
70ca4ce17a
libschroedingerdec: don't produce empty frames
...
They are not valid and can cause problems/crashes for API users.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit a86ebbf7f6 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:35 +01:00
Andreas Cadhalpun
ccda73a711
softfloat: handle -INT_MAX correctly
...
This is similar to commit 9ac61e73d0 .
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 0edd569466 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:35 +01:00
Andreas Cadhalpun
0b948b1b8d
pnmdec: make sure v is capped by maxval
...
Otherwise put_bits can be called with a value that doesn't fit in the
sample_len, causing an assertion failure.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit cdb5479c9d )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:35 +01:00
Andreas Cadhalpun
f76947fd56
smvjpegdec: make sure cur_frame is not negative
...
This fixes a heap-buffer-overflow detected by AddressSanitizer.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 360bc0d90a )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:34 +01:00
Andreas Cadhalpun
71fa32bbb7
icodec: correctly check avio_read return value
...
It can read less than the requested amount, in which case buf contains
uninitialized data, causing problems like segmentation faults later on.
Also make sure that image->size is positive, so that it can't match a
negative error code.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 89eb398c7f )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:34 +01:00
Andreas Cadhalpun
8a56b31e7c
icodec: fix leaking pkt on error
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 467eece1be )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:34 +01:00
Andreas Cadhalpun
2260c0776a
dvbsubdec: fix division by zero in compute_default_clut
...
This problem was introduced in commit
4b90dcb849 .
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit c82b8ef0e4 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:34 +01:00
Andreas Cadhalpun
5c55f9881e
proresdec_lgpl: explicitly check coff[3] against slice_data_size
...
The implicit checks via v_data_size and a_data_size don't work in the case
'(hdr_size > 7) && !ctx->alpha_info'.
This fixes segmentation faults due to invalid reads.
This problem was introduced in commit
547c2f002a .
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 1e33035ee7 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:34 +01:00
Andreas Cadhalpun
dc821d42a2
escape124: reject codebook size 0
...
It causes a cb_depth of 32, leading to assertion failures in get_bits.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 226d35c845 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:34 +01:00
Andreas Cadhalpun
b3ac458a5a
mpegts: prevent division by zero
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 1bbb18fe82 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:34 +01:00
Andreas Cadhalpun
3148d1c25f
matroskadec: fix NULL pointer dereference in webm_dash_manifest_read_header
...
The code assumes that s->streams[0] is valid.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit ff100c9dd9 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:34 +01:00
Andreas Cadhalpun
f964046c58
mpegaudio_parser: don't return AVERROR_PATCHWELCOME
...
The API does not allow returning AVERROR codes.
It triggers an assert in av_parser_parse2.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 5249706e9d )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:33 +01:00
Andreas Cadhalpun
0cc619e0d7
mxfdec: fix NULL pointer dereference
...
Metadata streams have priv_data set to NULL.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 0efb610611 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:33 +01:00
Andreas Cadhalpun
0e8c44076d
diracdec: check return code of get_buffer_with_edge
...
If it fails, buffers aren't allocated, causing NULL pointer dereferencing.
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit db79dedb1a )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:33 +01:00
Andreas Cadhalpun
a94f846e2d
ppc: pixblockdsp: do unaligned block accesses correctly again
...
This was broken by the following Libav commit:
4c387c7 ppc: dsputil: do unaligned block accesses correctly
The following tests fail due to this:
fate-checkasm
fate-vsynth1-dnxhd-2k-hr-hq fate-vsynth1-dnxhd-edge1-hr
fate-vsynth1-dnxhd-edge2-hr fate-vsynth1-dnxhd-edge3-hr
fate-vsynth1-dnxhd-hr-sq-mov fate-vsynth1-dnxhd-hr-hq-mov
fate-vsynth2-dnxhd-2k-hr-hq fate-vsynth2-dnxhd-edge1-hr
fate-vsynth2-dnxhd-edge2-hr fate-vsynth2-dnxhd-edge3-hr
fate-vsynth2-dnxhd-hr-sq-mov fate-vsynth2-dnxhd-hr-hq-mov
fate-vsynth3-dnxhd-2k-hr-hq fate-vsynth3-dnxhd-edge1-hr
fate-vsynth3-dnxhd-edge2-hr fate-vsynth3-dnxhd-edge3-hr
fate-vsynth3-dnxhd-hr-sq-mov fate-vsynth3-dnxhd-hr-hq-mov
Fixes trac ticket #5508 .
Reviewed-by: Carl Eugen Hoyos <ceffmpeg@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 3932ccc472 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:33 +01:00
Andreas Cadhalpun
c5fb9df38a
mpeg12dec: unref discarded picture from extradata
...
Otherwise another frame gets referenced into picture, triggering an assert
(from commit 13aae8) in av_frame_ref.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit a92f8edf0c )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:33 +01:00
Andreas Cadhalpun
51ff17d6b9
cavsdec: unref frame before referencing again
...
This fixes asserts (from commit 13aae8) in av_frame_ref and
av_frame_move_ref.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 1966ea012f )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:33 +01:00
Andreas Cadhalpun
e14da0578c
avformat: prevent triggering request_probe assert in ff_read_packet
...
If probe_codec is called with pkt == NULL, it sets probe_packets to 0
and request_probe to -1.
However, request_probe can change when calling s->iformat->read_packet
and thus a probe_packets value of 0 doesn't guarantee a request_probe
value of -1.
In that case calling probe_codec again is necessary to prevent
triggering the assert.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit a5b4476a60 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:30 +01:00
Michael Niedermayer
afd0f8f775
Update for 2.8.9
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:27 +01:00
Michael Niedermayer
13c249e2b5
avformat/mpeg: Adjust vid probe threshold to correct mis-detection
...
Fixes: _ij.mp3
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4e5049a230 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:27 +01:00
Michael Niedermayer
698528207a
avcodec/rv40: Test remaining space in loop of get_dimension()
...
Fixes infinite loop
Fixes: 178/fuzz-3-ffmpeg_VIDEO_AV_CODEC_ID_RV40_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1546d487cf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:27 +01:00
Michael Niedermayer
1e86f1a646
avcodec/ituh263dec: Avoid spending a long time in slice sync
...
Fixes: 177/fuzz-3-ffmpeg_VIDEO_AV_CODEC_ID_FLV1_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2baf36caed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:27 +01:00
Michael Niedermayer
ecc5bada26
avcodec/movtextdec: Add error message for tsmb_size check
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0eb3198005 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:27 +01:00
Michael Niedermayer
b0a5794e30
avcodec/movtextdec: Fix tsmb_size check==0 check
...
Fixes: 173/fuzz-3-ffmpeg_SUBTITLE_AV_CODEC_ID_MOV_TEXT_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a609905723 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:27 +01:00
Michael Niedermayer
63504a2d44
avcodec/movtextdec: Fix potential integer overflow
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ea2715768 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:27 +01:00
Michael Niedermayer
f9e76d3304
avcodec/sunrast: Fix input buffer pointer check
...
Fixes: out of array read
Fixes: poc.dat
Found-by: Bingchang, Liu @VARAS of IIE
Tested-by: bc L <l.bing.chang.bc@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 37138338ff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
3213adceb2
avcodec/tscc: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 979bca5134 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
744f78ce0d
avcodec/rawdec: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f0bc0215a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
147a387fba
avcodec/msvideo1: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 161ccdaa06 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
2312d1d979
avcodec/qpeg: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 16793504df )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
1604a2b1e6
avcodec/qtrle: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d196f2a5a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
f39522b6e7
avcodec/msrle: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6330119a0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
09411a7d5e
avcodec/kmvc: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d99101d09 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
ef32b162e8
avcodec/idcinvideo: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a2b8dde659 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
41b1ec0810
avcodec/cinepak: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 121be31060 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
e3f8b32279
avcodec/8bps: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 042faa847f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
fe4c6aeb99
avcodec/dvdsubdec: Fix off by 1 error
...
Fixes out of array read
Found-by: Thomas Garnier using libFuzzer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c92f55847a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
3177ea512f
avcodec/dvdsubdec: Fix buf_size check
...
Fixes out of array access
Found-by: Thomas Garnier using libFuzzer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 25ab1a65f3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Ronald S. Bultje
e25441912b
vp9: change order of operations in adapt_prob().
...
This is intended to workaround bug "665 Integer Divide Instruction May
Cause Unpredictable Behavior" on some early AMD CPUs, which causes a
div-by-zero in this codepath, such as reported in Mozilla bug #1293996 .
Note that this isn't guaranteed to fix the bug, since a compiler is free
to reorder instructions that don't depend on each other. However, it
appears to fix the bug in Firefox, and a similar patch was applied to
libvpx also (see Chrome bug #599899 ).
(cherry picked from commit be885da342 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
abe16359ba
avcodec/interplayvideo: Check side data size before use
...
Fixes out of array read
Found-by: Thomas Garnier using libFuzzer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 85d23e5cbc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
b9ab4db9f9
avformat/mxfdec: Check size to avoid integer overflow in mxf_read_utf16_string()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fecb3e82a4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:25 +01:00
Michael Niedermayer
8328c07fb1
avcodec/mpegvideo_enc: Clear mmx state in ff_mpv_reallocate_putbitbuffer()
...
This function must be called from the mb or slice encoding loop and MMX state may not
be clean there
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 03ec6b780c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:25 +01:00
Michael Niedermayer
865e3f5553
avcodec/utils: Clear MMX state before returning from avcodec_default_execute*()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f96f9d111 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:25 +01:00
Moritz Barsnick
d1c87a4a6f
cmdutils: fix typos
...
Signed-off-by: Moritz Barsnick <barsnick@gmx.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3e5d27d7a7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:25 +01:00
Moritz Barsnick
b480ca4dbd
lavfi: fix typos
...
Signed-off-by: Moritz Barsnick <barsnick@gmx.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f4e4bde1f4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:25 +01:00
Moritz Barsnick
bb83ff8b41
lavc: fix typos
...
Signed-off-by: Moritz Barsnick <barsnick@gmx.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3305f71025 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:25 +01:00
Moritz Barsnick
d609986f39
tools: fix grammar error
...
Signed-off-by: Moritz Barsnick <barsnick@gmx.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f71c98ee12 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:25 +01:00
Shivraj Patil
b9ec80322b
avutil/mips/generic_macros_msa: rename macro variable which causes segfault for mips r6
...
Signed-off-by: Shivraj Patil <shivraj.patil@imgtec.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1cc13cd2a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:25 +01:00
Ronald S. Bultje
62b2b2195b
videodsp: fix 1-byte overread in top/bottom READ_NUM_BYTES iterations.
...
This can overread (either before start or beyond end) of the buffer in
Nx1 (i.e. height=1) images.
Fixes mozilla bug 1240080.
(cherry picked from commit 0f88b3f82f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-10-05 03:06:45 +02:00
Michael Niedermayer
239f75d6c3
avformat/avidec: Check nb_streams in read_gab2_sub()
...
Fixes null pointer dereference
Fixes: 1/null_point.avi
Found-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2679ad4773 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-10-05 03:06:45 +02:00
Michael Niedermayer
a772613100
avformat/avidec: Remove ancient assert
...
This assert can with crafted files fail, a warning is already printed
for this case.
Fixes assertion failure
Fixes:1/assert.avi
Found-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 14bac7e00d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-10-05 03:06:45 +02:00
Sasi Inguva
ca216c71c7
lavc/movtextdec.c: Avoid infinite loop on invalid data.
...
Signed-off-by: Sasi Inguva <isasi@google.com >
(cherry picked from commit 7e9e1b7070 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-28 11:12:20 +02:00
Michael Niedermayer
ab737ab31d
avcodec/ansi: Check dimensions
...
Fixes: 1.avi
Found-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 69449da436 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-26 21:43:04 +02:00
Michael Niedermayer
69b00a7fb6
avcodec/cavsdsp: use av_clip_uint8() for idct
...
Fixes out of array read
Fixes: 1.swf
Found-by: 连一汉 <lianyihan@360.cn >
Tested-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e318f110b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-23 18:19:56 +02:00
Michael Niedermayer
d828aabf03
Changelog: Update
2016-09-18 01:18:35 +02:00
Michael Niedermayer
0ffdabb58d
avformat/movenc: Check packet in mov_write_single_packet() too
...
Fixes assertion failure
Found-by: durandal117
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2834313933 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-18 00:18:11 +02:00
Michael Niedermayer
e1ab851da6
avformat/movenc: Factor check_pkt() out
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit deabcd2c05 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-18 00:18:11 +02:00
Xinzheng Zhang
0bdfdd6d2f
avformat/utils: fix timebase error in avformat_seek_file()
...
When there is only one stream and stream_index has not specified,
The ts has been transferd by the timebase of stream0 without modifying the stream_index
In this condation it cause seek failure.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ecc04b4f2f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-18 00:18:11 +02:00
Michael Niedermayer
f8dcc9e718
avcodec/g726: Add missing ADDB output mask
...
Fixes: 1.poc
Fixes out of array read
Found-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5af1240fc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-18 00:18:11 +02:00
Michael Niedermayer
175a95bfdd
avcodec/avpacket: clear side_data_elems
...
Fixes null pointer dereference
Found-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5e1bf9d8c0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-18 00:18:11 +02:00
Michael Niedermayer
ac60619acd
avcodec/ccaption_dec: Use simple array instead of AVBuffer
...
This is simpler and fixes an out of array read, fixing it with AVBuffers
would be more complex
Fixes: e00d9e6e50e5495cc93fea41147b97bb/asan_heap-oob_12dcdbb_8798_b32a97ea722dd37bb5066812cc674552.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 752e6dfa3e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-18 00:18:11 +02:00
Michael Niedermayer
48c51b796a
swscale/swscale_unscaled: Try to fix Rgb16ToPlanarRgb16Wrapper() with slices
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e57d99dd4e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-18 00:18:11 +02:00
Michael Niedermayer
26eccf4bd8
swscale/swscale_unscaled: Fix packed_16bpc_bswap() with slices
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47bc1bdafb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-18 00:18:11 +02:00
Michael Niedermayer
8ddeae57ae
avformat/avidec: Fix infinite loop in avi_read_nikon()
...
Fixes: 360/test.poc
Found-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e4e4a9cad7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-18 00:18:11 +02:00
Tobias Rapp
c32ce247a0
cmdutils: fix implicit declaration of SetDllDirectory function
...
Pre-processor check changed by commiter.
Signed-off-by: James Almer <jamrial@gmail.com >
2016-08-29 20:02:24 -03:00
James Almer
2f9bc30956
cmdutils: check for SetDllDirectory() availability
...
It's only available on Windows XP or newer.
Should fix compilation with mingw32 using the default OS target.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
2016-08-26 13:12:02 +02:00
Michael Niedermayer
562f2ba4ed
avcodec/aacenc: Tighter input checks
...
Fixes occurance of NaN/Inf leading to assertion failures and out of array access
Fixes: d1c38a09acc34845c6be3a127a5aacaf/signal_sigsegv_3982225_6121_d18bd5451d4245ee09408f04badd1b83.wmv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 77bf96b047 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-23 12:36:25 +02:00
Michael Niedermayer
5a96b4b443
libavcodec/wmalosslessdec: Check the remaining bits
...
Fixes assertion failure
Fixes: 24ebfda03228b5cc1ef792608cfba458/signal_sigabrt_7ffff6ae7c37_6473_3fa8a111dbc752b1a7c411c5ab79aaa4.wma
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 67318187fb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-21 21:11:47 +02:00
Michael Niedermayer
33ec0280f3
avcodec/diracdec: Check numx/y
...
Fixes division by 0
Fixes: 60261c4469ba3e11059890fb2832a515/asan_generic_135e694_2790_beb94eaa0aeb7d11c0437375a8964a99.drc
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a31e08fa1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-20 19:40:26 +02:00
Michael Niedermayer
2b135f266d
avcodec/indeo2: check ctab
...
Fixes out of array access
Fixes: 6b73fa392ac808f02e95a4e0a5770026/asan_static-oob_1b15f9a_1969_e7778535e5f27225fe0d6ded14721430.AVI
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9ffe44c5c7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-19 14:47:39 +02:00
Michael Niedermayer
e965fedf7e
avformat/swfdec: Fix inflate() error code check
...
Fixes infinite loop
Fixes endless.poc
Found-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a453bbb68f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-19 11:03:50 +02:00
Michael Niedermayer
7132e71a84
Update for FFmpeg 2.8.8
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 22:26:37 +02:00
Michael Niedermayer
7a2329fac1
avcodec/h264: Put context_count check back
...
Fixes assertion failure
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f883f0b0bd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:14 +02:00
Hendrik Leppkes
65fff8e71a
cmdutils: remove the current working directory from the DLL search path on win32
...
Reviewed-by: Matt Oliver <protogonoi@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3bf142c773 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:13 +02:00
Michael Niedermayer
3988470ee3
avcodec/raw: Fix decoding of ilacetest.mov
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bbec14de31 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:13 +02:00
Michael Niedermayer
3a6b27caf8
avcodec/ffv1enc: Fix assertion failure with non zero bits per sample
...
Fixes Ticket5736
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1bfeda5a3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:13 +02:00
Michael Niedermayer
942c3bfbdf
avformat/oggdec: Fix integer overflow with invalid pts
...
If negative pts are possible for some codecs in ogg then the code needs to be
changed to use signed values.
Found-by: Thomas Guilbert <tguilbert@google.com >
Fixes: clusterfuzz_usan-2016-08-02
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c5cc3b08e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:13 +02:00
Michael Niedermayer
486aa4fe39
ffplay: Fix invalid array index
...
Found-by: Thomas Guilbert <tguilbert@google.com >
Fixes: clusterfuzz_usan-2016-08-02
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6cd9a8b67a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:13 +02:00
Michael Niedermayer
da12d544bf
avcodec/vp9_parser: Check the input frame sizes for being consistent
...
Suggested-by: BBB
Fixed-by: BBB
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 77b0f3f26d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:13 +02:00
Kacper Michajłow
73e09e371b
libavformat/rtpdec_asf: zero initialize the AVIOContext struct
...
This fixes crash in avformat_open_input() when accessing
protocol_whitelist field.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e947b75b1c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:13 +02:00
Kacper Michajłow
d3ecb24539
libavutil/opt: Small bugfix in example.
...
Fix const corectness and zero init the struct. This example code would actually crash when initializing string.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 69630f4d30 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:13 +02:00
Sasi Inguva
0f6e244bb0
libx264: Increase x264 opts character limit to 4096
...
Signed-off-by: Sasi Inguva <isasi@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 282477bf45 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:13 +02:00
Michael Niedermayer
054db63120
avformat/mov: Check sample size
...
Fixes integer overflow
Fixes: poc.mp4
Found-by: ajax secure <ajax4sec@hotmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8a3221cc67 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:13 +02:00
Michael Niedermayer
4a0b0cffc1
avformat/format: Fix registering a format more than once and related races
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4cc896ea5f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:13 +02:00
Michael Niedermayer
9fefd76eec
avcodec/flac_parser: Raise threshold for detecting invalid data
...
Fixes regression from Ticket5428
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b0b3676e13 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
087bd8fbdf
avfilter/vf_telecine: Make frame writable before writing into it
...
Fixes Ticket 5627
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fa0097e008 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
40ffbe7678
avcodec/mpc8: Correct end truncation
...
Fixes Ticket5478
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b21f674876 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
ed7fe48445
avcodec/mpegvideo: Do not clear the parse context during init
...
It is allocated before, this cannot work
Fixes Ticket5613
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 24f5136196 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
d9ad05abce
MAINTAINERs cleanup (remove myself from things i de facto dont maintain)
...
x86 is maintained entirely by others these days
ML, mostly too
remove myself from a few spots that have other maintainers and where i
just dont know the code that well anyway to do an ideal job
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bb5bc08ba6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
bfca58ee2f
avcodec/h264: Fix off by 1 context count
...
Fixes fate-h264-xavc-4389 with slice threads
(cherry picked from commit 27c1eae55f )
Conflicts:
libavcodec/h264.c
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
8a32f19d5b
avcodec/alsdec: Check r to prevent out of array read
...
No testcase known
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c36fc857b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Umair Khan
1dd34bdb09
avcodec/alsdec: fix max bits in ltp prefix code
...
The maximum number of bits int the prefix code for
p(0) is 4. By setting it as 3, we were missing the
last 0 bit.
This fixes bug #4715 present on the trac.
Signed-off-by: Umair Khan <omerjerk@gmail.com >
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d64ba9d18 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
04987035ff
avcodec/utils: check skip_samples signedness
...
Fixes Ticket5528
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 153ab83bd3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
a4484854db
avformat/mpegts: Do not trust BSSD descriptor, it is sometimes not an S302M stream
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5eb70ad95 )
Conflicts:
libavformat/mpegts.c
2016-08-15 18:54:34 +02:00
Michael Niedermayer
003fa5c3e3
avcodec/bmp_parser: Check fsize
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 43a4276c69 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
166921c23e
avcodec/bmp_parser: reset state
...
Fixes part of ticket 5598
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 37005e65eb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
591c0b527c
avcodec/bmp_parser: Fix remaining size
...
Fixes part of ticket 5598
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 250b620d29 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
731848ef80
avcodec/bmp_parser: Fix frame_start_found in cross frame cases
...
Fixes part of ticket 5598
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bfe945ac3a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
76fd8145a1
avfilter/af_amix: dont fail if there are no samples in output_frame()
...
Fixes Ticket5326
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit abc957e896 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Vivekanand
5af0ada442
avformat/allformats: Making av_register_all() thread-safe.
...
When multiple threads tries to call av_register_all(), the first thread sets
initialized to 1 and do the register process. At the same time, other thread might
also call av_register_all(), which returns immediately because initialized is set to 1
(even when it has not completed registering codecs). We can avoid this problem
if we set initialised to 1 while exiting from function.
Github: Closes #196
(cherry picked from commit b092ee701f )
Conflicts:
libavformat/allformats.c
2016-08-15 18:54:34 +02:00
Michael Niedermayer
ffb503c9a1
avcodec/mpegvideo: Deallocate last/next picture earlier
...
Fixes regression with mplayers direct rendering and reduces buffer count
pressure in some cases
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 39c0b22df4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
2bbbd3e50a
avcodec/bmp_parser: Fix state
...
Fixes Ticket5598
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d0388bd32e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Thomas Guilbert
669fc1338f
avformat/oggparseopus: Fix Undefined behavior in oggparseopus.c and libavformat/utils.c
...
Fixes: usan_granule_overflow
constant type fix by commiter
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1a82d2cf8f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
9fe1012910
doc/developer.texi: Add a code of conduct
...
See: [FFmpeg-devel] [Vote] Code of Conduct
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 89e9393022 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
90b27febc6
avformat/avidec: Detect index with too short entries
...
Fixes Ticket5498
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d08f2c172f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Chris Cunningham
c1c6cb21b7
avformat/utils: Check negative bps before shifting in ff_get_pcm_codec_id()
...
Fixes: undefined shift.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2875745d35 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
2e0af764b3
avformat/utils: Do not compute the bitrate from duration == 0
...
Fixes division by 0 in fate-acodec-ra144
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 635b2ec5f2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
8857dc6cd8
ffmpeg: Check that r_frame_rate is set before attempting to use it
...
Avoids unexpected occurance and dependency on NaN behavior and divisions by 0
Testcase: fate-lavf-fate-avi_cram
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6085d6b2ae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
67c7f8ca14
swresample/rematrix: Use clipping s16 rematrixing if overflows are possible
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f76157eb0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
500cf2e159
swresample/rematrix: Use error diffusion to avoid error in the DC component of the matrix
...
This fixes the sum of the integer coefficients ending up summing to a value
larger than the value representing unity.
This issue occurs with qN0.dts when converting to stereo
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7fe81bc4f8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Chris Cunningham
345231336f
libavformat/oggdec: Free stream private when header parsing fails.
...
Leaking this private structure opens up the possibility that it may
be re-used when parsing later packets in the stream. This is
problematic if the later packets are not the same codec type (e.g.
private allocated during Vorbis parsing, but later packets are Opus
and the private is assumed to be the oggopus_private type in
opus_header()).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 542f725964 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
fc6f314838
avformat/utils: Check bps before using it in a shift in ff_get_pcm_codec_id()
...
Fixes undefined shift
Fixes: usan_shift
Found-by: Thomas Guilbert <tguilbert@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea791c080d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
3bbef6082a
avformat/oggparseopus: Check that granule pos is within the supported range
...
Larger values would imply file durations of astronomic proportions and cause
overflows
Fixes integer overflow
Fixes: usan_int64_overflow
Found-by: Thomas Guilbert <tguilbert@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8efaee3710 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
0aaf66fb2e
avcodec/mjpegdec: Do not try to detect last scan but apply idct after all scans for progressive jpeg
...
Fixes: IMG-20160418-WA0002.jpg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit deaf58abf2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
330f4ef48c
avformat/options_table: Add missing identifier for very strict compliance
...
Fixes Ticket5443
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 11db7eee9b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Luca Barbato
8887dafda1
librtmp: Avoid an infiniloop setting connection arguments
...
The exit condition was missing.
Signed-off-by: Timothy Gu <timothygu99@gmail.com >
(cherry picked from commit e85d38c20a )
Signed-off-by: Timothy Gu <timothygu99@gmail.com >
2016-07-26 12:08:58 -07:00
James Almer
e9b7ae08d6
avformat/oggparsevp8: fix pts calculation on pages ending with an invisible frame
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 5adfbd3918 )
2016-07-25 09:59:54 -03:00
Michael Niedermayer
da4ea97161
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-29 13:27:40 +02:00
Michael Niedermayer
4e4afe29b9
avcodec/motion_est: Attempt to fix "short data segment overflowed" on IA64
...
This decreases the MV related encoding table sizes
This should have little effect on real world video encoding performance
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d7c75a5db0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-29 13:04:17 +02:00
Michael Niedermayer
2a15860227
avformat/ffmdec: Check pix_fmt
...
Fixes crash
Fixes Ticket5412
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 78baa450d9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-28 23:26:45 +02:00
Michael Niedermayer
66443b0cf3
update for 2.8.7
2016-04-27 05:43:39 +02:00
Michael Niedermayer
58a7500492
avcodec/ttaenc: Reallocate packet if its too small
...
Fixes assertion failure
Fixes Ticket5394
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 005c61c6b8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:12 +02:00
Jan Ekström
3003277103
pgssubdec: fix subpicture output colorspace and range
...
Functionality used before didn't widen the values from limited to
full range. Additionally, now the decoder uses BT.709 where it
should be used according to the video resolution.
Default for not yet set colorimetry is BT.709 due to most observed
HDMV content being HD.
BT.709 coefficients were gathered from the first two parts of BT.709
to BT.2020 conversion guide in ARIB STD-B62 (Pt. 1, Chapter 6.2.2).
They were additionally confirmed by manually calculating values.
Fixes #4637
(cherry picked from commit 9779b62624 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:12 +02:00
Michael Niedermayer
05b33258e3
avcodec/ac3dec: Reset SPX when switching from EAC3 to AC3
...
Fixes Ticket5319
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9ac154d1fa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:12 +02:00
Michael Niedermayer
c6e3682a0c
avfilter/vf_drawtext: Check return code of load_glyph()
...
Fixes segfault
Fixes Ticket5347
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2e67a99fbc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:12 +02:00
Paul B Mahol
e80a4ce69f
avcodec/takdec: add code that got somehow lost in process of REing
...
Signed-off-by: Paul B Mahol <onemda@gmail.com >
(cherry picked from commit 38797a8033 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:12 +02:00
Paul B Mahol
edc61e3aba
avcodec/apedec: fix decoding of stereo files with one channel full of silence
...
Signed-off-by: Paul B Mahol <onemda@gmail.com >
(cherry picked from commit 9149e9c0ba )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:12 +02:00
Michael Niedermayer
5127cb2e78
avcodec/avpacket: Fix off by 5 error
...
Fixes out of array read
Fixes: mozilla bug 1266129
Found-by: Tyson Smith
Tested-by: Tyson Smith
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9f36ea57ae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:12 +02:00
Ivan
70b3e170f9
avcodec/h264: Fix for H.264 configuration parsing
...
Sometimes video fails to decode if H.264 configuration changes mid stream.
The reason is that configuration parser assumes that nal_ref_idc is equal to 11b
while actually some codecs but 01b there. The H.264 spec is somewhat
vague about this but it looks like it allows any non-zero nal_ref_idc for sps/pps.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a727606c4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:12 +02:00
Michael Niedermayer
4e174d95f5
avcodec/bmp_parser: Ensure remaining_size is not too small in startcode packet crossing corner case
...
Fixes Ticket 5438
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e26bdd59b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Marios Titas
21fb4d1282
avfilter/src_movie: fix how we check for overflows with seek_point
...
Currently, if the movie source filter is used and a seek_point is
specified on a file that has a negative start time, ffmpeg will fail.
An easy way to reproduce this is as follows:
$ ffmpeg -vsync passthrough -filter_complex 'color=d=10,setpts=PTS-1/TB' test.mp4
$ ffmpeg -filter_complex 'movie=filename=test.mp4:seek_point=2' -f null -
The problem is caused by checking for int64_t overflow the wrong way.
In general, to check whether a + b overflows, it is not enough to do:
a > INT64_MAX - b
because b might be negative; the correct way is:
b > 0 && > a > INT64_MAX - b
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1f9734f97 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Aaron Boxer
b5d4b1731e
avcodec/j2kenc: Add attribution to OpenJPEG project:
...
http://ghostscript.com/~tor/gs-browse/gs/openjpeg/libopenjpeg/t1.c
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b6b4b0a65e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Michael Niedermayer
ef54c14425
avcodec/h264_slice: Check PPS more extensively when its not copied
...
Fixes Ticket5371
Fixes null pointer dereference
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c50be7a52b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Michael Niedermayer
a35e6ec1bd
avcodec/libutvideodec: copy frame so it has reference counters when refcounted_frames is set
...
Reviewed-by: maintainer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0cd9ff4e3a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Ico Doornekamp
a286f1a5ff
avformat/rtpdec_jpeg: fix low contrast image on low quality setting
...
Original mail and my own followup on ffmpeg-user earlier today:
I have a device sending out a MJPEG/RTP stream on a low quality setting.
Decoding and displaying the video with libavformat results in a washed
out, low contrast, greyish image. Playing the same stream with VLC results
in proper color representation.
Screenshots for comparison:
http://zevv.nl/div/libav/shot-ffplay.jpg
http://zevv.nl/div/libav/shot-vlc.jpg
A pcap capture of a few seconds of video and SDP file for playing the
stream are available at
http://zevv.nl/div/libav/mjpeg.pcap
http://zevv.nl/div/libav/mjpeg.sdp
I believe the problem might be in the calculation of the quantization
tables in the function create_default_qtables(), the attached patch
solves the issue for me.
The problem is that the argument 'q' is of the type uint8_t. According to the
JPEG standard, if 1 <= q <= 50, the scale factor 'S' should be 5000 / Q.
Because the create_default_qtables() reuses the variable 'q' to store the
result of this calculation, for small values of q < 19, q wil subsequently
overflow and give wrong results in the calculated quantization tables. The
patch below uses a new variable 'S' (same name as in RFC2435) with the proper
range to store the result of the division.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e3e6a2cff4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Michael Niedermayer
d7c15fb25a
avcodec/mjpegenc_common: Store approximate aspect if exact cannot be stored
...
Fixes Ticket5244
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 068026b0f7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Mark Thompson
5c289c932f
lavc/hevc: Allow arbitrary garbage in bytestream as long as at least one NAL unit is found.
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fbec157ea0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Michael Niedermayer
e8b1ce8d1b
avcodec/resample: Remove disabled and faulty code
...
Fixes Ticket5345
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 50ef7361cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Luca Barbato
d77e1c712b
indeo2: Fix banding artefacts
...
Rename luma table to delta table and change how it is used.
CC: libav-stable@libav.org
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com >
Signed-off-by: Diego Biurrun <diego@biurrun.de >
(cherry picked from commit f8c34f4b8d )
(cherry picked from commit 73f3c8f73e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Luca Barbato
d2e473a245
indeo2data: K&R formatting cosmetics
...
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com >
Signed-off-by: Diego Biurrun <diego@biurrun.de >
(cherry picked from commit d4066a7024 )
(cherry picked from commit 522ab0b9a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Przemysław Sobala
4818e074a0
avcodec/imgconvert: Support non-planar colorspaces while padding
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0d097a869c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Michael Niedermayer
7dac928e61
avutil/random_seed: Add the runtime in cycles of the main loop to the entropy pool
...
This should theoretically improve the randomness slightly
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2540d884f3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Martin Cracauer
49fc295612
avutil/channel_layout: AV_CH_LAYOUT_6POINT1_BACK not reachable in parsing
...
Trying to make heads and tails out of DTS 6.1 I can across this typo.
I also noticed that this wiki page is incorrect or misleading, the
channel order for 6.1 given does not match the source code. At the
least it should be clarified that the layout given does not apply to
DTS. https://trac.ffmpeg.org/wiki/AudioChannelManipulation
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73d1398f0c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Michael Niedermayer
d10f4744ff
avformat/concatdec: set safe mode to enabled instead of auto
...
This is safer, as a selected demuxer could still mean that it was auto-detected
by a user application
Reviewed-previously-by: Nicolas George <george@nsup.org >
Reviewed-previously-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 689211d572 )
Conflicts:
libavformat/concatdec.c
2016-04-27 04:40:11 +02:00
Michael Niedermayer
bf76124c51
avformat/utils: fix dts from pts code in compute_pkt_fields() during ascending delay
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit de1de49324 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Boris Nagels
48c25d0512
avformat/rtpenc: Fix integer overflow in NTP_TO_RTP_FORMAT
...
RTCP synchronization packet was broken since commit in ffmpeg version > 2.8.3
(commit: e04b039b15 ) Since this commit (2e814d0329 )
"rtpenc: Simplify code by introducing a macro for rescaling NTP timestamps", NTP_TO_RTP_FORMAT
uses av_rescale_rnd() function to add the data to the packet.
This causes an overflow in the av_rescale_rnd() function and it will return INT64_MIN.
Causing the NTP stamp in the RTCP packet to have an invalid value.
Github: Closes #182
Reverting commit '2e814d0329aded98c811d0502839618f08642685' solves the problem.
(cherry picked from commit 1109ed7973 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Michael Niedermayer
69942c4f6d
avformat/cache: Fix memleak of tree entries
...
Found-by: jamrial
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 554f6e930c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Rodger Combs
7aaab36874
lavf/mov: downgrade sidx errors to non-fatal warnings; fixes trac #5216
...
(cherry picked from commit 22dbc1caaf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Rodger Combs
36e5854801
lavf/mov: fix sidx with edit lists
...
(cherry picked from commit 3617e69d50 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Michael Niedermayer
82492c3a96
avcodec/mjpegdec: Fix decoding slightly odd progressive jpeg
...
Fixes: ebd58db6-dc86-11e5-91c2-59daeddf50c7.jpg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c6f4720b86 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
James Almer
175110a041
libwebpenc_animencoder: print library messages in verbose log levels
...
Reviewed-by: James Zern <jzern@google.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit f875ba4873 )
2016-03-17 12:57:23 -03:00
James Almer
76c157cfd7
libwebpenc_animencoder: zero initialize the WebPAnimEncoderOptions struct
...
This zeroes the WebPAnimEncoderOptions.verbose field, silencing library info messages
printed to stderr.
Reviewed-by: James Zern <jzern@google.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 626b6b769c )
2016-03-17 12:57:20 -03:00
Paul B Mahol
f9f9f31c6c
doc/utils: fix typo for min() description
...
Signed-off-by: Paul B Mahol <onemda@gmail.com >
(cherry picked from commit bdf474bcff )
Signed-off-by: Timothy Gu <timothygu99@gmail.com >
2016-03-02 16:44:18 -08:00
Michael Niedermayer
800334947d
avcodec/avpacket: clear priv in av_init_packet()
...
This should fix leaving uninitialized pointers in priv which can confuse
user applications.
See: https://github.com/golang/go/issues/14426
Only for release branches
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-24 16:56:12 +01:00
Michael Niedermayer
4ccb97650a
swscale/utils: Fix chrSrcHSubSample for GBRAP16
...
Fixes part of Ticket5264
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 67e5bd0c50 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-24 00:04:51 +01:00
Michael Niedermayer
a3d698dcb1
swscale/input: Fix GBRAP16 input
...
Fixes part of Ticket5264
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df36257a53 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-24 00:04:17 +01:00
Carl Eugen Hoyos
1e9aa7907e
postproc: fix unaligned access
...
Based on 59074310 by Andreas Cadhalpun.
Fixes ticket #5259 .
(cherry picked from commit 2aa21eec1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-23 18:01:08 +01:00
Michael Niedermayer
23ef5996a5
avutil/pixdesc: Make get_color_type() aware of CIE XYZ formats
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1ec7a70380 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-22 03:50:51 +01:00
Michael Niedermayer
b3a64fc039
avcodec/h264: Execute error concealment before marking the frame as done.
...
Fixes race condition causing artifacts
Fixes Ticket4122
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 98a0053d0f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-19 02:07:46 +01:00
Michael Niedermayer
21a6b7930e
swscale/x86/output: Fix yuv2planeX_16* with unaligned destination
...
Reviewed-by: BBB
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f6492a2ea8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-17 05:17:35 +01:00
Michael Niedermayer
530192b0e0
swscale/x86/output: Move code into yuv2planeX_mainloop
...
Reviewed-by: BBB
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d07f6e5f1c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-17 05:17:18 +01:00
KO Myung-Hun
8dd71d0bd4
MAINTAINERS: add myself as an OS/2 maintainer
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 346ec91764 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-15 13:22:45 +01:00
Michael Niedermayer
536f6c4ec2
avutil/frame: Free destination qp_table_buf in frame_copy_props()
...
Fixes memleak
Fixes: Ticket4899
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4099e4a77d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-13 21:08:23 +01:00
Michael Niedermayer
af21d609a0
Update for 2.8.6
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 16:23:43 +01:00
Michael Niedermayer
b15ae71305
avcodec/jpeg2000dec: More completely check cdef
...
Fixes out of array access
Fixes: j2k-poc.bin
Found-by: Lucas Leong <wmliang.tw@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0aada30510 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
6fec0dbd2e
avutil/opt: check for and handle errors in av_opt_set_dict2()
...
Previously errors could result in random entries to be lost.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f3ace85d88 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Paul B Mahol
0dc379cfa6
avcodec/flacenc: fix calculation of bits required in case of custom sample rate
...
Sample rate of 11025 takes 16 bits but previous code would pick only 8.
Fixes assertion failure.
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com >
Signed-off-by: Paul B Mahol <onemda@gmail.com >
(cherry picked from commit 3e7d684912 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
b432d883e6
avformat: Document urls a bit
...
Spell-checked-by: Moritz Barsnick <barsnick@gmx.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3130556c0e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
736e42bc33
avformat/libquvi: Set default demuxer and protocol limitations
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 15cc98a0f3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
cb88f428b3
avformat/concat: Check protocol prefix
...
Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e32d01432 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
e0d53cbeef
doc/demuxers: Document enable_drefs and use_absolute_path
...
Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9a8034b8bc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
9819998342
avcodec/mjpegdec: Check for end for both bytes in unescaping
...
Fixes assertion failure
Fixes: c40c779601b77dc6e19aaea0b04b9751/signal_sigabrt_7ffff6ae7cb7_5769_b94f6ec70caecb2d3d76b4771b109ac1.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 509c9e74e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
85cfcb87ff
avcodec/mpegvideo_enc: Check for integer overflow in ff_mpv_reallocate_putbitbuffer()
...
Fixes assertion failure
Fixes: 6568d187979ce17878b6fe5fbbb89142/signal_sigabrt_7ffff6ae7cb7_7176_564bbc6741bdcf907f5c4e685c9a77a2.mpg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b65efbc0f4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
971f47f2eb
avformat/avformat: Replace some references to filenames by urls
...
Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 41e07390e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
00393c56da
avcodec/wmaenc: Check ff_wma_init() for failure
...
Fixes null pointer dereference
Fixes: c4faf8280ba366bf00a79d425f2910a8/signal_sigsegv_1f96477_5177_1448ba7e4125faceb966f44ceb69abfa.qcp
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 19e456d48c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
f77b656b6e
avcodec/mpeg12enc: Move high resolution thread check to before initializing threads
...
Cleaner solution is welcome!
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a53fbda9dc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
8ed4b44657
avformat/img2dec: Use AVOpenCallback
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b750b67d13 )
Conflicts:
libavformat/img2dec.c
2016-01-28 15:53:54 +01:00
Michael Niedermayer
642c54270b
avformat/avio: Limit url option parsing to the documented cases
...
This feature is not know much or used much AFAIK, and it might be helpfull in
exploits.
No specific case is known where it can be used in an exploit though
subsequent commits depend on this commit though
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 984d58a344 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
d64ff3a6a9
avformat/img2dec: do not interpret the filename by default if a IO context has been opened
...
With this, user applications which use custom IO and have set a IO context will not have
their already opened IO context ignored and glob/seq being interpreted
Comments and tests from maintainers of user apps are welcome!
Liked-by: wm4 <nfxjfg@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ccedc1c78 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
c6f6829ce6
avcodec/ass_split: Fix null pointer dereference in ff_ass_style_get()
...
Fixes: 55d71971da50365d542ed14b65565fe1/signal_sigsegv_4765a4_8499_f146af090a94f591d6254515c7700ef5.mkv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 158f0545d8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Derek Buitenhuis
b9551e71bf
mov: Add an option to toggle dref opening
...
This feature is mostly only used by NLE software, and is
both of dubious value being enabled by default, and a
possible security risk.
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 712d962a6a )
Conflicts:
libavformat/isom.h
libavformat/mov.c
libavformat/version.h
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:53 +01:00
Michael Niedermayer
828d85bf86
avcodec/gif: Fix lzw buffer size
...
Fixes out of array access
Fixes: aaa479088e6fb40b04837b3119f47b04/asan_heap-oob_e38c68_8576_9d653078b2470700e2834636f12ff557.tga
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 03d83ba34b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:53 +01:00
Michael Niedermayer
aa833e1a60
avcodec/put_bits: Assert buf_ptr in flush_put_bits()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ef5de0f19 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:53 +01:00
Michael Niedermayer
61850f1c84
avcodec/tiff: Check subsample & rps values more completely
...
Fixes out of array access
Fixes: 83aedfb29af669c4d6e10f1bfad974d2/asan_heap-oob_1ab42fe_4984_9f6ec14462f8d8a00ea24b320572a963.tif
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 89f464e9c2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:53 +01:00
Michael Niedermayer
6897859b5a
swscale/swscale: Add some sanity checks for srcSlice* parameters
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 321e85e176 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:53 +01:00
Michael Niedermayer
f121ed611e
swscale/x86/rgb2rgb_template: Fix planar2x() for short width
...
Fixes: 451b3e0cf956c0bd2f27ed753ac24050/asan_heap-oob_2873c01_3231_7ed10a9464d15f0d57277f5917c566a8.AVI
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8a9aaab26 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:53 +01:00
Michael Niedermayer
6eb76b34ca
swscale/swscale_unscaled: Fix odd height inputs for bayer_to_yv12_wrapper()
...
Fixes: 372d2df1f04b49e25f109f07f90b1505/asan_heap-oob_2835d2e_8501_99e0114d7ba3a6db885d0b4684d200c1.cine
Fixes out of array read
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 757248ea3c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:53 +01:00
Michael Niedermayer
034edcec6d
swscale/swscale_unscaled: Fix odd height inputs for bayer_to_rgb24_wrapper()
...
Fixes: 372d2df1f04b49e25f109f07f90b1505/asan_heap-oob_2835d2e_8501_99e0114d7ba3a6db885d0b4684d200c1.cine
Fixes out of array read
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ad3b6fa7d8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:53 +01:00
Michael Niedermayer
8008a029ab
avcodec/aacenc: Check both channels for finiteness
...
Fixes null pointer dereference
Fixes: 10412fc52ecc6eab40ed67f82ca7b372/signal_sigsegv_2618c99_2129_f808373959e46afb165593332799ffbc.aif
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 057549a9cc )
Conflicts:
libavcodec/aacenc.c
2016-01-28 15:53:53 +01:00
Andreas Cadhalpun
d640bc7545
asfdec_o: check for too small size in asf_read_unknown
...
This fixes infinite loops due to seeking back.
Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit c29e87ad55 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:45 +01:00
Andreas Cadhalpun
93559adfbf
asfdec_o: break if EOF is reached after asf_read_packet_header
...
asf_read_payload can unset eof_reached, so check it also before calling
that function.
This fixes infinite loops.
Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 0e32153e9c )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:45 +01:00
Andreas Cadhalpun
4679e54388
asfdec_o: make sure packet_size is non-zero before seeking
...
This fixes infinite loops due to seeking back.
Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 3776a72962 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:45 +01:00
Andreas Cadhalpun
782257ba66
asfdec_o: prevent overflow causing seekback
...
This fixes infinite loops.
Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 74474750f1 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:45 +01:00
Andreas Cadhalpun
e188c267c8
asfdec_o: check avio_skip in asf_read_simple_index
...
The loop can be very long, even though the file is very short.
Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 0002d845e8 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:44 +01:00
Andreas Cadhalpun
407ab167c0
asfdec_o: reject size > INT64_MAX in asf_read_unknown
...
Both avio_skip and detect_unknown_subobject use int64_t for the size
parameter.
This fixes a segmentation fault due to infinite recursion.
Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit aa18016996 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:44 +01:00
Andreas Cadhalpun
d7fbd03660
asfdec_o: only set asf_pkt->data_size after sanity checks
...
Otherwise invalid values are used unchecked in the next run.
This can cause NULL pointer dereferencing.
Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 763c572801 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:44 +01:00
Hendrik Leppkes
2cd41c5d52
Merge commit '8375dc1dd101d51baa430f34c0bcadfa37873896'
...
* commit '8375dc1dd101d51baa430f34c0bcadfa37873896':
asfdec: handle the case when the stream index has an invalid value better
Merged-by: Hendrik Leppkes <h.leppkes@gmail.com >
(cherry picked from commit bf67ae3cfa )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:44 +01:00
Andreas Cadhalpun
1272b88d04
dca: fix misaligned access in avpriv_dca_convert_bitstream
...
src and dst are only 8-bit-aligned, so accessing them as uint16_t causes
SIGBUS crashes on architectures like sparc.
This fixes ubsan runtime error: load of misaligned address for type
'const uint16_t', which requires 2 byte alignment
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 44ac13eed4 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:44 +01:00
Andreas Cadhalpun
cf99f0dd0f
brstm: fix missing closing brace
...
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 1cb2331eca )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:44 +01:00
Andreas Cadhalpun
247bb203e4
brstm: also allocate b->table in read_packet
...
This fixes NULL pointer dereferencing if the codec is forced to
adpcm_thp even though a different one was detected.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit bcf4ee26a0 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:44 +01:00
Andreas Cadhalpun
94b9e7caae
brstm: make sure an ADPC chunk was read for adpcm_thp
...
This fixes NULL pointer dereferencing.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit d7d37c479f )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:44 +01:00
Andreas Cadhalpun
6ffaf40c02
vorbisdec: reject rangebits 0 with non-0 partitions
...
This causes non-unique elements in floor_setup->data.t1.list, which
makes the stream undecodable according to the specification.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit e7a7b3135a )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:44 +01:00
Andreas Cadhalpun
e3d7796336
vorbisdec: reject channel mapping with less than two channels
...
It causes the angle channel number to equal the magnitude channel
number, which makes the stream undecodable according to the
specification.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit b4b13848de )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:44 +01:00
Andreas Cadhalpun
667a23a032
ffmdec: reset packet_end in case of failure
...
This fixes segmentation faults caused by passing a packet_ptr of NULL to
memcpy.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 40eb2531b2 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:44 +01:00
Paul B Mahol
7b0fb4fdf7
avformat/ipmovie: put video decoding_map_size into packet and use it in decoder
...
The size of decoding map can differ from one calculated
internally, producing artifacts while decoding video.
Signed-off-by: Paul B Mahol <onemda@gmail.com >
(cherry picked from commit c293ef258c )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:28:49 +01:00
Paul B Mahol
40ebeee3fc
avformat/brstm: fix overflow
...
Signed-off-by: Paul B Mahol <onemda@gmail.com >
(cherry picked from commit 3441fef0f8 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:28:43 +01:00
James Almer
b8fa3ff95d
avcodec/wavpackenc: print channel count in av_log call
...
Fixes a warning with -Wformat-extra-args
(cherry picked from commit 17e7fdf61a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 17:53:58 +01:00
James Almer
063928910f
configure: bump copyright year to 2016
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 78129978f0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 16:26:06 +01:00
Michael Niedermayer
e303ca3ac9
Update for 2.8.5
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 16:25:51 +01:00
Michael Niedermayer
28f89bc439
avformat/hls: Even stricter URL checks
...
This fixes a null pointer dereference at least
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cfda1bea4c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 15:49:35 +01:00
Michael Niedermayer
23b903aaf4
avformat/hls: More strict url checks
...
No case is known where these are needed
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ba42b6482 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 14:17:28 +01:00
Michael Niedermayer
4676e20a9d
avcodec/pngenc: Fix mixed up linesizes
...
Fixes out of array accesses
Fixes: 0cf176e6d3ab9fe924f39738e513f547/asan_generic_4a54aa_3431_aaa28be1cb32e307a9890cad06f84fba.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8f4c3e4b92 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:41 +01:00
Michael Niedermayer
0c5a71fece
avcodec/pngenc: Replace memcpy by av_image_copy()
...
Fixes out of array access
Fixes: 0cf176e6d3ab9fe924f39738e513f547/asan_generic_4a54aa_3431_aaa28be1cb32e307a9890cad06f84fba.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ec9c5ce8a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:41 +01:00
Michael Niedermayer
07da25548f
swscale/vscale: Check that 2 tap filters are bilinear before using bilinear code
...
Fixes: out of array reads
Fixes: 07e8b9c5d348ccdf7add0f37de20cf6c/asan_heap-oob_27e8df7_6849_e56653f768070ec8cb52f587048444c2.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eb7802afef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:41 +01:00
Michael Niedermayer
be9b89314f
swscale: Move VScalerContext into vscale.c
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b6e6895f2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:41 +01:00
Michael Niedermayer
cdac68fbab
swscale/utils: Detect and skip unneeded sws_setColorspaceDetails() calls
...
This avoids running various table inits unnecessarily
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cc538e9dbd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:41 +01:00
Michael Niedermayer
1fd9556062
swscale/yuv2rgb: Increase YUV2RGB table headroom
...
This makes SWS more robust
Fixes: 07650a772d98aa63b0fed6370dc89037/asan_heap-oob_27ddeaf_2657_2c81ff264dee5d9712cb3251fb9c3bbb.264
Fixes: out of array read
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8f3a9a8c27 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
c781a1e14b
swscale/yuv2rgb: Factor YUVRGB_TABLE_LUMA_HEADROOM out
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5e5f82a287 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Maxim Andreev
b7d54d6e07
avformat/hls: forbid all protocols except http(s) & file
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7145e80b4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
90c2256ee5
avformat/aviobuf: Fix end check in put_str16()
...
Fixes out of array read
Fixes: 03c406ec9530e594a074ce2979f8a1f0/asan_heap-oob_7dec26_4664_37c52495b2870a2eaac65f53958e76c1.flac
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 115fb6d03e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
f459afdd72
avformat/asfenc: Check pts
...
Fixes integer overflow
Fixes: 0063df8be3aaa30dd6d76f59c8f818c8/signal_sigsegv_7b7b59_3634_bf418b6822bbfa68734411d96b667be3.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7c0b84d899 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
d408261b65
avcodec/mpeg4video: Check time_incr
...
Fixes assertion failure
Fixes out of memory access
Fixes: test_casex.ivf
Found-by: Tyson Smith <twsmith@mozilla.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7c97946d61 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
d7f7586c3f
avcodec/wavpackenc: Check the number of channels
...
They are stored in a byte, thus more than 255 is not possible
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 59c915a403 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
f05e0e76d6
avcodec/wavpackenc: Headers are per channel
...
Fixes: 1b8b83a53bfa751f01b1daa65a4758db/signal_sigabrt_7ffff6ae7cb7_7488_403f71d1a2565b598d01b6cb110fac8f.aiff
Fixes: assertion failure
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 26757b0279 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
e5567f2f69
avcodec/aacdec_template: Check id_map
...
Fixes index out of bounds error
Fixes: aac_index_out_of_bounds.wmv
Found-by: Piotr Bandurski <ami_stuff@o2.pl >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 590863876d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
b8382a1fae
avcodec/dvdec: Fix "left shift of negative value -254"
...
Fixes: dvdec_left_shift.avi
Found-by: Piotr Bandurski <ami_stuff@o2.pl >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93ac72a98d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
9cad208223
avcodec/g2meet: Check for ff_els_decode_bit() failure in epic_decode_run_length()
...
Fixes invalid shift
Fixes: g2m_left_shift_2.wmv
Found-by: Piotr Bandurski <ami_stuff@o2.pl >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 030c7f0309 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
34e06ce309
avcodec/mjpegdec: Fix negative shift
...
Fixes: mjpeg_left_shift.avi
Found-by: Piotr Bandurski <ami_stuff@o2.pl >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d86d7b2486 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
df4ee166f1
avcodec/mss2: Check for repeat overflow
...
Fixes: mss2_left_shift.wmv
Found-by: Piotr Bandurski <ami_stuff@o2.pl >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e273dade78 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
cb4ba7456a
avformat: Add integer fps from 31 to 60 to get_std_framerate()
...
Fixes Ticket 5106
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2039b3e751 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
d79b6dd9f9
avformat/ivfenc: fix division by zero
...
Fixes Ticket 5115
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c8467a07c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
36861557a7
avcodec/mpegvideo_enc: Clip bits_per_raw_sample within valid range
...
Fixes out of array read
Fixes: test_case-mdc.264 (b47be15a120979f5a1a945c938cbef33)
Found-by: Tyson Smith <twsmith@mozilla.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 13f266b50c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Thomas Mundt
3fb97a01ce
avfilter/vf_scale: set proper out frame color range
...
Prevents that following scalers in the filter chain will do unintentional color range conversions.
Fixes Ticket #5096
Signed-off-by: Thomas Mundt <loudmax@yahoo.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73ce8162f3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
6457cd17be
avcodec/motion_est: Fix mv_penalty table size
...
Fixes out of array read
Found-by: Tyson Smith <twsmith@mozilla.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5b4da8a38a )
Conflicts:
libavcodec/motion_est.h
2016-01-15 12:30:40 +01:00
Michael Niedermayer
aee9aa9216
avcodec/h264_slice: Fix integer overflow in implicit weight computation
...
Fixes mozilla bug 1230423
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7cc01c2572 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
14c63dc9b0
swscale/utils: Use normal bilinear scaler if fast cannot be used due to tiny dimensions
...
Fixes Ticket4960
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1edf129cbc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
709abc74f5
avcodec/put_bits: Always check buffer end before writing
...
This causes a overall slowdown of 0.1 % (tested with mpeg4 single thread encoding of matrixbench at QP=3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cccb0ffccc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Andreas Cadhalpun
83c0df90b0
mjpegdec: extend check for incompatible values of s->rgb and s->ls
...
This can happen if s->ls changes from 0 to 1, but picture allocation is
skipped due to s->interlaced.
In that case ff_jpegls_decode_picture could be called even though the
s->picture_ptr frame has the wrong pixel format and thus a wrong
linesize, which results in a too small zero buffer being allocated.
This fixes an out-of-bounds read in ls_decode_line.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 7ea2db6eaf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
0a6324fe93
swscale/utils: Fix intermediate format for cascaded alpha downscaling
...
Fixes Ticket4926
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b83d8be6bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
2f65366c11
avformat/mov: Update handbrake_version threshold for full mp3 parsing
...
Fixes: Endangered\ Species\ 1x01\ Collecting\ Merl.mp4
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d3b6a9abac )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
James Almer
3e3aa25afa
x86/float_dsp: zero extend offset from ff_scalarproduct_float_sse
...
Reviewed-by: Christophe Gisquet <christophe.gisquet@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit dc79824deb )
2016-01-08 14:02:27 -03:00
Paul B Mahol
6a1bf98b3a
avfilter/vf_zoompan: do not free frame we pushed to lavfi
...
Signed-off-by: Paul B Mahol <onemda@gmail.com >
(cherry picked from commit 8bcd1997ea )
Fixes ticket #5113 .
2016-01-02 21:21:43 +01:00
Andreas Cadhalpun
79f407b79a
nuv: sanitize negative fps rate
...
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit f6830cf5ba )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-20 13:39:45 +01:00
Andreas Cadhalpun
174ec7d744
nutdec: reject negative value_len in read_sm_data
...
If it is negative, it can cause the byte position to move backwards in
avio_skip, which in turn makes sm_size negative and thus size larger
than the size of the packet buffer, causing invalid writes in avio_read.
Also fix potential overflow of avio_tell(bc) + value_len.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit ce10f572c1 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-20 13:39:41 +01:00
Andreas Cadhalpun
778c8de40f
xwddec: prevent overflow of lsize * avctx->height
...
This is used to check if the input buffer is large enough, so if this
overflows it can cause a false negative leading to a segmentation fault
in bytestream2_get_bufferu.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 9d38f06d05 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-20 13:39:37 +01:00
Andreas Cadhalpun
38f8c80901
nutdec: only copy the header if it exists
...
Fixes ubsan runtime error: null pointer passed as argument 2, which is
declared to never be null
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 9f82506c79 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-20 13:39:33 +01:00
Andreas Cadhalpun
945ae04fab
exr: fix out of bounds read in get_code
...
This macro unconditionally used out[-1], which causes an out of bounds
read, if out is the very beginning of the buffer.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 90b99a8107 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-20 13:39:29 +01:00
Andreas Cadhalpun
6d7b4dbcb4
on2avc: limit number of bits to 30 in get_egolomb
...
More don't fit into the integer output.
Also use get_bits_long, since get_bits only supports reading up to 25
bits, while get_bits_long supports the full integer range.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 4d5c3b02e9 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-20 13:39:24 +01:00
Michael Niedermayer
644179e0d4
Update Changelog
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-20 02:58:41 +01:00
Andreas Cadhalpun
9be3441c31
rawdec: only exempt BIT0 with need_copy from buffer sanity check
...
Otherwise the too samll buffer is directly used in the frame, causing
segmentation faults, when trying to use the frame.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-20 02:58:21 +01:00
Andreas Cadhalpun
63ecbb82fc
mlvdec: check that index_entries exist
...
This fixes NULL pointer dereferencing.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-20 02:42:13 +01:00
Michael Niedermayer
bdc6ba4604
avcodec/mpeg4videodec: also for empty partitioned slices
...
Fixes assertion failure
Fixes: id_acf3e47f864e1ee4c7b86c0653e0ff31e5bde56e.m4v
Found-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 70f13abb4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-19 23:54:47 +01:00
Michael Niedermayer
3a3be02208
avcodec/h264_refs: Fix long_idx check
...
Fixes out of array read
Fixes mozilla bug 1233606
Found-by: Tyson Smith
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b92b4775a0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-19 22:19:21 +01:00
Michael Niedermayer
cabd9ae5be
avcodec/h264_mc_template: prefetch list1 only if it is used in the MB
...
Fixes ubsan warning
Fixes Mozilla bug 1230276
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8ea57664f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-18 00:55:27 +01:00
Michael Niedermayer
cfbf608c0a
avcodec/h264_slice: Simplify ref2frm indexing
...
This also suppresses a ubsan warning
Fixes Mozilla bug 1230247
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ef8f6464a5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-18 00:55:15 +01:00
Michael Niedermayer
1dddd5371a
Revert "avcodec/aarch64/neon.S: Update neon.s for transpose_4x4H"
...
The change was not correct and broke H264
This reverts commit cd83f899c9 .
(cherry picked from commit 95b59bfb9d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-17 21:50:57 +01:00
Michael Niedermayer
e4a6a8553e
avfilter/vf_mpdecimate: Add missing emms_c()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 997de2e810 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-17 21:32:17 +01:00
Andreas Cadhalpun
748d5fa2ed
sonic: make sure num_taps * channels is not larger than frame_size
...
If that is the case, the loop setting predictor_state in
sonic_decode_frame causes out of bounds reads of int_samples, which has
only frame_size number of elements.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 9637c2531f )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-17 20:04:35 +01:00
Andreas Cadhalpun
796f1a24f5
opus_silk: fix typo causing overflow in silk_stabilize_lsf
...
Due to this typo max_center can be too large, causing nlsf to be set to
too large values, which in turn can cause nlsf[i - 1] + min_delta[i] to
overflow to a negative value, which is not allowed for nlsf and can
cause an out of bounds read in silk_lsf2lpc.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit f61d44b74a )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-17 20:04:30 +01:00
Andreas Cadhalpun
0b24a0e0f1
ffm: reject invalid codec_id and codec_type
...
A negative codec_id cannot be handled by the found_decoder API of
AVStream->info: if the codec_id is not recognized, found_decoder is set
to -codec_id, which has to be '<0' according to the API documentation.
This can cause NULL pointer dereferencing in try_decode_frame.
Also make sure the codec_type matches the expected one for codec_id.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit ecf63b7cc2 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-17 20:04:25 +01:00
Andreas Cadhalpun
a79a5c32f9
golomb: always check for invalid UE golomb codes in get_ue_golomb
...
Also correct the check to reject log < 7, because UPDATE_CACHE only
guarantees 25 meaningful bits.
This fixes undefined behavior:
runtime error: shift exponent is negative
Testing with START/STOP timers in get_ue_golomb, one for the first
branch (A) and one for the second (B), shows that there is practically no
slowdown, e.g. for the cavs decoder:
With the check in the B branch:
629 decicycles in get_ue_golomb B, 4194260 runs, 44 skips
433 decicycles in get_ue_golomb A,268434102 runs, 1354 skips
Without the check:
624 decicycles in get_ue_golomb B, 4194273 runs, 31 skips
433 decicycles in get_ue_golomb A,268434203 runs, 1253 skips
Since the B branch is executed far less often than the A branch, this
change is negligible, even more so for the h264 decoder, where the ratio
B/A is a lot smaller.
Fixes: mozilla bug 1230239
Fixes: fbeb8b2c7c996e9b91c6b1af319d7ebc/asan_heap-oob_195450f_2743_e8856ece4579ea486670be2b236099a0.bit
Found-by: Tyson Smith
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 22e960ad47 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-17 20:03:56 +01:00
Andreas Cadhalpun
b9087aa651
sbr_qmf_analysis: sanitize input for 32-bit imdct
...
If the input contains too many too large values, the imdct can overflow.
Even if it didn't, the output would be larger than the valid range of 29
bits.
Note that this is a very delicate limit: Allowing values up to 1<<25
does not prevent input larger than 1<<29 from arriving at
sbr_sum_square, while limiting values to 1<<23 breaks the
fate-aac-fixed-al_sbr_hq_cm_48_5.1 test.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit fdc94db37e )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-17 20:03:48 +01:00
Andreas Cadhalpun
7e94ea3dd1
sbrdsp_fixed: assert that input values are in the valid range
...
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit a9c20e922c )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-17 20:03:44 +01:00
Andreas Cadhalpun
cb44683a8c
aacsbr: ensure strictly monotone time borders
...
This fixes a division by zero in the aac_fixed decoder.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit ff8816f717 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-17 20:03:34 +01:00
Andreas Cadhalpun
dcd837e41c
aacenc: update max_sfb when num_swb changes
...
This fixes out-of-bounds reads in avoid_clipping.
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 5b0da6999f )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-17 20:03:29 +01:00
Andreas Cadhalpun
507e0314c0
aaccoder: prevent crash of anmr coder
...
If minq is negative, the range of sf_idx can be larger than
SCALE_MAX_DIFF allows, causing assertion failures later in
encode_scale_factors.
Reviewed-by: Claudio Freire <klaussfreire@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 7a4652dd5d )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-17 20:03:02 +01:00
Andreas Cadhalpun
76af12f542
ffmdec: reject zero-sized chunks
...
If size is zero, avio_get_str fails, leaving the buffer uninitialized.
This causes invalid reads in av_set_options_string.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit a611375db5 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-17 20:02:55 +01:00
Michael Niedermayer
20a48eaaf1
swscale/x86/rgb2rgb_template: Fallback to mmx in interleaveBytes() if the alignment is insufficient for SSE*
...
This also as a sideeffect fixes the non aligned case
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a066ff89bc )
2015-12-15 11:16:22 +01:00
Michael Niedermayer
31aeb96533
swscale/x86/rgb2rgb_template: Do not crash on misaligend stride
...
Fixes Ticket5013
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 80bfce35cc )
2015-12-15 11:16:10 +01:00
Michael Niedermayer
95a144ae62
avformat/mxfenc: Do not crash if there is no packet in the first stream
...
Fixes: Ticket4914
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b51e7554e7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-13 17:27:04 +01:00
Nicolas George
1450a39ad4
lavf/tee: fix side data double free.
...
Similar to 33fefdb44 .
Fix trac ticket #4921 .
Signed-off-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1acc90eaa5 )
Conflicts:
libavformat/tee.c
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-13 10:14:24 +01:00
Michael Niedermayer
d07f658201
avformat/hlsenc: Check the return code of avformat_write_header()
...
Fixes: segfault
Fixes: Ticket5067
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c62d1780ff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-13 02:59:32 +01:00
Michael Niedermayer
07b43fb69a
avformat/mov: Enable parser for mp3s by old HandBrake
...
Fixes Ticket5047
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 861f47ddf4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-13 02:15:36 +01:00
Michael Niedermayer
e3f08d9359
avformat/mxfenc: Fix integer overflow in length computation
...
Fixes: CID1341577
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 537e901fe6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-13 02:15:14 +01:00
Michael Niedermayer
f87d2617d5
Changelog: Update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-12 23:25:12 +01:00
zjh8890
cd83f899c9
avcodec/aarch64/neon.S: Update neon.s for transpose_4x4H
...
The transpose_4x4H is wrong which cost me much time to find this bug. The orders of r2 and r3 are wrong,
this bug waste me much time while I make aarch64 arm instruction which used the function.
(cherry picked from commit c18176bd55 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-12 15:05:06 +01:00
Rainer Hochecker
5e105aca01
avformat/utils: estimate_timings_from_pts - increase retry counter, fixes invalid duration for ts files with hevc codec
...
Fixes a mpegts file with hevc that fails estimating duration. Increasing number of
retries fixes the issue.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d8c2f1a28 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-09 20:46:47 +01:00
Michael Niedermayer
a9c721da12
avformat/matroskaenc: Check codecdelay before use
...
Fixes CID1238790
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e6971db12b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-09 18:27:54 +01:00
Michael Niedermayer
4608cc176b
avutil/mathematics: Fix division by 0
...
Fixes: CID1341571
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc8b1e694c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-09 17:53:44 +01:00
Andreas Cadhalpun
2e54b8c379
mjpegdec: consider chroma subsampling in size check
...
If the chroma components are subsampled, smaller buffers are allocated
for them. In that case the maximal block_offset for the chroma
components is not as large as for the luma component.
This fixes out of bounds writes causing segmentation faults or memory
corruption.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 5adb5d9d89 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-07 01:34:13 +01:00
Michael Niedermayer
913c642c21
Update for 2.8.4
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 10:42:02 +01:00
James Zern
cb4985ea9a
libvpxenc: remove some unused ctrl id mappings
...
VP8E_UPD_ENTROPY, VP8E_UPD_REFERENCE, VP8E_USE_REFERENCE were removed
from libvpx and the remaining values were never used here
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Zern <jzern@google.com >
(cherry picked from commit 6540fe04a3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:28 +01:00
Michael Niedermayer
d27d59fef7
avcodec/vp3: ensure header is parsed successfully before tables
...
Fixes assertion failure
Fixes: 266ee543812e934f7b4a72923a2701d4/signal_sigabrt_7ffff6ae7cc9_7322_85218d61759d461bdf7387180e8000c9.ogg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 26379d4fdd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:28 +01:00
Michael Niedermayer
ea4d9cb3e5
avcodec/jpeg2000dec: Check bpno in decode_cblk()
...
Fixes: undefined shift
Fixes: c409ef86f892335a0a164b5871174d5a/asan_heap-oob_1dff564_2159_162b7234616deab02b544410455eb07b.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a85b02dcf7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
e5a4044771
avcodec/pgssubdec: Fix left shift of 255 by 24 places cannot be represented in type int
...
Fixes: b293a6479bb4b5286cff24d356bfd955/asan_generic_225c3c9_7819_cc526b657450c6cdef1371b526499626.mkv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f2419888b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
af44545613
swscale/utils: Fix for runtime error: left shift of negative value -1
...
Fixes: c106b36fa36db8ff8f3ed0c82be7bea2/asan_heap-oob_32699f0_6321_467b9a1d7e03d7cfd310b7e65dc53bcc.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 325b59368d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
10fc3d690c
avcodec/hevc: Fix integer overflow of entry_point_offset
...
Fixes out of array read
Fixes: d41d8cd98f00b204e9800998ecf8427e/signal_sigsegv_321165b_7641_077dfcd8cbc80b1c0b470c8554cd6ffb.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2140858524 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
0fa92fee43
avcodec/dirac_parser: Check that there is a previous PU before accessing it
...
Fixes out of array read
Fixes: 99d142c47e6ba3510a74b872a1a2ae72/asan_heap-oob_11b36f4_3811_0f5c69e7609a88a580135678de1df844.dxa
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a08681f1e6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
cf79fd0317
avcodec/dirac_parser: Add basic validity checks for next_pu_offset and prev_pu_offset
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c7d6ec947c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
b253035ab2
avcodec/dirac_parser: Fix potential overflows in pointer checks
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 79798f7c57 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
ded0a04153
avcodec/wmaprodec: Check bits per sample to be within the range not causing integer overflows
...
Fixes: 549d5aab1480d10f2a775ed90b0342f1/signal_sigabrt_7ffff6ae7cc9_5643_96bbb0cfe3e28be1dadfce1075016345.wma
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 66e05f6ff5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
16c5da92d9
avcodec/wmaprodec: Fix overflow of cutoff
...
Fixes: 129ca3e28d73af7b1e24a9d4118e7a2d/signal_sigabrt_7ffff6ae7cc9_836_762b310fc3ef6087bd7771e5d8e90b9b.asf
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c56f8303e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
0e3ec7db53
avformat/smacker: fix integer overflow with pts_inc
...
Fixes: ce19e41f0ef1e52a23edc488faecdb58/asan_heap-oob_2504e97_4202_ffa0df1baed14022b9bfd4f8ac23d0cb.smk
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ed47e9729 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
73966b0161
avcodec/vp3: Fix "runtime error: left shift of negative value"
...
Fixes: 5c6129154b356b80bcab86f9e3ee5d29/signal_sigabrt_7ffff6ae7cc9_7322_d26ac6d7cb6567db1b8be0159b387d0b.ogg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 18268f761b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
b8621a2e98
avformat/riffdec: Initialize bitrate
...
Fixes CID1338334
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 32bf6550cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Timo Teräs
aa9ac199b8
mpegencts: Fix overflow in cbr mode period calculations
...
ts->mux_rate is int (signed 32-bit) type. The period calculations
will start to overflow when mux_rate > 5mbps. This fixes overflows
by converting first to 64-bit type.
Fixes #5044 .
Signed-off-by: Timo Teräs <timo.teras@iki.fi >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 64f7db554e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
f2258e9899
avutil/timecode: Fix fps check
...
The fps variable is explicitly set to -1 in case of some errors, the check must
thus be signed or the code setting it needs to use 0 as error code
the type of the field could be changed as well but its in an installed header
Fixes: integer overflow
Fixes: 9982cc157b1ea90429435640a989122f/asan_generic_3ad004a_3799_22cf198d9cd09928e2d9ad250474fa58.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b46dcd5209 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
e04b039b15
avutil/mathematics: return INT64_MIN (=AV_NOPTS_VALUE) from av_rescale_rnd() for overflows
...
Fixes integer overflow
Fixes: mozilla bug 1229167
Found-by: Tyson Smith
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f03c2ceec1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
d295ddffe1
avcodec/apedec: Check length in long_filter_high_3800()
...
Fixes out of array read
Fixes: 0a7ff0c1d93da9cef28a315ec91b692a/asan_heap-oob_4a52e5_3604_9c56dbb20e308f4faeef7b35f688521a.ape
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cd7524fdd1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
aab65146af
avcodec/vp3: always set pix_fmt in theora_decode_header()
...
Fixes assertion failure
Fixes: d0bb0662da342ec65f8f2a081222e6b9/signal_sigabrt_7ffff6ae7cc9_5471_82964f0a9ac2f4d3d59390c15473f6f7.ogg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a814f1d364 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
8cd3def81d
avcodec/mpeg4videodec: Check available data before reading custom matrix
...
Fixes: out of array read
Fixes: 76c515fc3779d1b838667c61ea13ce92/asan_heap-oob_1fc0d07_8913_794a4629a264ebdb25b58d3a94ed1785.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 891dc8f875 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
460710500e
avutil/mathematics: Do not treat INT64_MIN as positive in av_rescale_rnd
...
The code expects actual positive numbers and gives completely wrong
results if INT64_MIN is treated as positive
Instead clip it into the valid range that is add 1 and treat it as
negative
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 25e37f5ea9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
4d9999705f
avutil/integer: Fix av_mod_i() with negative dividend
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a9cb18855 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
3d69716bae
avformat/dump: Fix integer overflow in av_dump_format()
...
Fixes part of mozilla bug 1229167
Found-by: Tyson Smith
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e7f452022 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
2fbf723585
avcodec/h264_refs: Check that long references match before use
...
Fixes out of array read
Fixes: 59bb925e90201fa0f87f0a31945d43b5/asan_heap-oob_4a52e5_3388_66027f11e3d072f1e02401ecc6193361.jvt
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa427537b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
7372b42b18
avcodec/utils: Clear dimensions in ff_get_buffer() on failure
...
Fixes out of array access
Fixes: 482d8f2fd17c9f532b586458a33f267c/asan_heap-oob_4a52b6_7417_1d08d477736d66cdadd833d146bb8bae.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit abee0a1c60 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
fe89682d7c
avcodec/utils: Use 64bit for aspect ratio calculation in avcodec_string()
...
Fixes integer overflow
Fixes: 3a45b2ae02f2cf12b7bd99543cdcdae5/asan_heap-oob_1dff502_8022_899f75e1e81046ebd7b6c2394a1419f4.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f03bebc79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
ce6dd54711
avcodec/hevc: Check max ctb addresses for WPP
...
Fixes out of array read
Fixes: 2f95ddd996db8a6281d2e18c184595a7/asan_heap-oob_192fe91_3330_58e4441181e30a66c19f743dcb392347.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dad354f38d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
d32c9723a6
avcodec/vp3: Clear context on reinitialization failure
...
Fixes null pointer dereference
Fixes: 1536b9b096a8f95b742bae9d3d761cc6/signal_sigsegv_294aaed_2039_8d1797aeb823ea43858d0fa45c9eb899.ogv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6105b7219a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
1cbc2cb508
avcodec/hevc: allocate entries unconditionally
...
Fixes out of array access
Fixes: 08664a2a7921ef48172f26495c7455be/asan_heap-oob_23036c6_3301_523388ef84285a0270caf67a43247b59.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d85aa76115 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
e348769544
avcodec/hevc_cabac: Fix multiple integer overflows
...
Fixes: 04ec80eefa77aecd7a49a442cc02baea/asan_heap-oob_19544fa_3303_1905796cd9d8e15f86d664332caabc00.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d5028f61e4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:26 +01:00
Michael Niedermayer
9ce96a688b
avcodec/jpeg2000dwt: Check ndeclevels before calling dwt_encode*()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit feb3f39614 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:26 +01:00
Michael Niedermayer
9d5bdca3d8
avcodec/jpeg2000dwt: Check ndeclevels before calling dwt_decode*()
...
Fixes out of array access
Fixes: 01859c9a9ac6cd60a008274123275574/asan_heap-oob_1dff571_8250_50d3d1611e294c3519fd1fa82198b69b.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 75422280fb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:26 +01:00
Michael Niedermayer
31e54f41a0
avcodec/hevc: Check entry_point_offsets
...
Fixes out of array read
Fixes: 007c4a36608ebdf27ee260ad60a81184/asan_heap-oob_32076b4_2243_116b1cb29d91cc4974d6680e3d10bd91.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ef9f7bbfa4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:26 +01:00
Carl Eugen Hoyos
aa3101a9e8
lavf/rtpenc_jpeg: Less strict check for standard Huffman tables.
...
There can be one or more Huffman table segments DHT.
Reported-by: Andrey Utkin
2015-12-02 14:56:53 +01:00
Michael Niedermayer
ff3e717003
avcodec/ffv1dec: Clear quant_table_count if its invalid
...
Fixes deallocation of corrupted pointer
Fixes: 343dfbe142a38b521ed069dc4ea7c03b/signal_sigsegv_421427_4074_ffb11959610278cd40dbc153464aa254.avi
No releases affected
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e04126072e )
Fixes ticket #5052 .
2015-12-02 12:03:17 +01:00
Michael Niedermayer
1c6243228c
avcodec/ffv1dec: Print an error if the quant table count is invalid
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8b254e436 )
2015-12-02 11:57:34 +01:00
Andrey Utkin
482bece29b
doc/filters/drawtext: fix centering example
...
Signed-off-by: Andrey Utkin <andrey.od.utkin@gmail.com >
Signed-off-by: Lou Logan <lou@lrcd.com >
(cherry picked from commit 648b26acc5 )
Signed-off-by: Timothy Gu <timothygu99@gmail.com >
2015-12-01 17:32:05 -08:00
James Almer
644296e736
avutil/softfloat: use abort() instead of av_assert0(0)
...
Fixes compilation of host tool aacps_fixed_tablegen.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 9f4a41bf99 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-27 15:01:22 +01:00
Michael Niedermayer
a353cc44a6
Update for 2.8.3
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-27 14:29:04 +01:00
Michael Niedermayer
4c718691ea
avcodec/cabac: Check initial cabac decoder state
...
Fixes integer overflows
Fixes: 1430e9c43fae47a24c179c7c54f94918/signal_sigsegv_421427_2340_591e9810c7b09efe501ad84638c9e9f8.264
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Found-by: xiedingbao (Ticket4727)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8000d484b8 )
Conflicts:
libavcodec/cabac.h
2015-11-27 14:07:03 +01:00
Michael Niedermayer
24c504bd0a
avcodec/cabac_functions: Fix "left shift of negative value -31767"
...
Fixes: 1430e9c43fae47a24c179c7c54f94918/signal_sigsegv_421427_2340_591e9810c7b09efe501ad84638c9e9f8.264
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Found-by: xiedingbao (Ticket4727)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1f6b05f52 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-27 14:03:01 +01:00
Michael Niedermayer
6b91701de3
avcodec/h264_slice: Limit max_contexts when slice_context_count is initialized
...
Fixes out of array access
Fixes: 1430e9c43fae47a24c179c7c54f94918/signal_sigsegv_421427_2049_f2192b6829ab6e0eefcb035329c03c60.264
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4ea4d2f438 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:06:39 +01:00
Martin Storsjö
1290c85c9d
rtmpcrypt: Do the xtea decryption in little endian mode
...
The XTEA algorithm operates on 32 bit numbers, not on byte sequences.
The XTEA implementation in libavutil is written assuming big endian
numbers, while the rtmpe signature encryption assumes little endian.
This fixes rtmpe communication with rtmpe servers that use signature
type 8 (XTEA), e.g. crunchyroll.
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st >
(cherry picked from commit e7728319b92dbb4fb949155e33de7ff5358ddff3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:06:39 +01:00
Michael Niedermayer
b70f7d20e1
avformat/matroskadec: Check subtitle stream before dereferencing
...
Unrecognized streams are not allocated
Fixes: flicker-1.color1.vp91447030769.08.webm
Found-by: Chris Cunningham <chcunningham@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5034b324c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:06:39 +01:00
Michael Niedermayer
71a3113333
avcodec/pngdec: Replace assert by request for sample for unsupported TRNS cases
...
Fixes assertion failure
Fixes: 7f646252a30ee28b583aac1f82e7985e/signal_sigabrt_7ffff6ae7cc9_7353_62fc077bf2f454d39e188c69807193a6.png
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a62178be80 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:06:39 +01:00
Michael Niedermayer
859a6edaed
avformat/utils: Do not init parser if probing is unfinished
...
Fixes assertion failure
Fixes: 136f8b8d47af7892306625e597dee655/signal_sigabrt_7ffff6ae7cc9_8941_ab11bea57c84796418f481f873dc31ba.dvr_ms
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1ef336e912 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:06:39 +01:00
Michael Niedermayer
2dc1f3a02b
avcodec/jpeg2000dec: Fix potential integer overflow with tile dimensions
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65d3359fb3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:06:39 +01:00
Michael Niedermayer
9a9dda615b
avcodec/jpeg2000: Use av_image_check_size() in ff_jpeg2000_init_component()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 016fd413f9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:42 +01:00
Michael Niedermayer
b3bc05290a
avcodec/wmaprodec: Check for overread in decode_packet()
...
Fixes assertion failure
Fixes: 0256e92df2df7e933b43a2c70e4c8040/signal_sigabrt_7ffff6ae7cc9_1358_999ac18684788221490757582ce9af84.wma
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ad698e24e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:42 +01:00
Michael Niedermayer
093e58228e
avcodec/smacker: Check that the data size is a multiple of a sample vector
...
Fixes out of array access
Fixes: ce19e41f0ef1e52a23edc488faecdb58/asan_heap-oob_2504e97_4202_ffa0df1baed14022b9bfd4f8ac23d0cb.smk
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a9af07a49 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:42 +01:00
Michael Niedermayer
948d93d3f4
avcodec/takdec: Skip last p2 sample (which is unused)
...
Fixes out of array read
Fixes: cb3f38b08b4541523974667c7d1eee9e/asan_heap-oob_2659e18_9838_021fd5cd635bf76cede6398cd9ecbcdd.tak
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 08b520636e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:41 +01:00
Michael Niedermayer
824e72d9b7
avcodec/dxtory: Fix input size check in dxtory_decode_v1_410()
...
Fixes potential out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 76b6f4b7d9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:41 +01:00
Michael Niedermayer
c7a970a3a0
avcodec/dxtory: Fix input size check in dxtory_decode_v1_420()
...
Fixes out of array read
Fixes: c50c4aa6cefda71b19a31ea12302980c/asan_heap-oob_12be5fd_7011_33ebd015a74976215934add72b9c8352.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9caa9414cc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:41 +01:00
Michael Niedermayer
6af38b2718
avcodec/error_resilience: avoid accessing previous or next frames tables beyond height
...
The height of tables can be rounded up for MBAFF but this does not imply that is also true
for the previous frames
Fixes out of array reads
Fixes: c106b36fa36db8ff8f3ed0c82be7bea2/asan_heap-oob_32699f0_6321_467b9a1d7e03d7cfd310b7e65dc53bcc.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a105f52855 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:41 +01:00
Michael Niedermayer
0ce7baa245
avcodec/dpx: Move need_align to act per line
...
Fixes out of array read
Fixes: 61cf123c081ee2bb774d307c75bdb99e/asan_heap-oob_1224f76_5546_bee833ffae73f752b489b9eeaac52db7.dpx
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8aaae8e0f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:41 +01:00
Michael Niedermayer
7f0b58947d
avcodec/flashsv: Check size before updating it
...
Fixes out of array read
Fixes: 3c857d4d90365731524716e6d051e43a/signal_sigsegv_7f4f59bcc29e_1386_20abd2c8e655cb9c75b24368e65fe3b1.flv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 17705f5d4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:41 +01:00
Michael Niedermayer
f64ffbbdc0
avcodec/ivi: Check image dimensions
...
Fixes integer overflow
Fixes: 1e32c6c591d940337c20b197ec1c4d3d/asan_heap-oob_4a52e5_8946_0bb0d9e863def56005e49f1d89bdc94d.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df91aa034b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:41 +01:00
Michael Niedermayer
c0748b9954
avcodec/utils: Better check for channels in av_get_audio_frame_duration()
...
Fixes integer overflow
Fixes: 0c2625f236ced104d402b4a03c0d65c7/asan_generic_274e1ce_5990_9314e7a67c26aecf011b178ade9f217c.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4e16ad2868 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:41 +01:00
Michael Niedermayer
dbfec68d32
avcodec/jpeg2000dec: Check for duplicate SIZ marker
...
Fixes: 0231a17345734228011c6f35a64e4594/asan_heap-oob_1d92a72_3218_1213809a9e3affec77e4c191fdfdc0a9.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 44a7f17d0b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:41 +01:00
Andreas Cadhalpun
34f2d74555
aacsbr: don't call sbr_dequant twice without intermediate read_sbr_data
...
Doing that doesn't make sense, because the only purpose of sbr_dequant
is to process the data from read_sbr_data.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 1c3e43a627 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
Andreas Cadhalpun
22017f7745
hqx: correct type and size check of info_offset
...
It is used as size argument of ff_canopus_parse_info_tag, which uses it
as size argument to bytestream2_init, which only supports sizes up to
INT_MAX.
Changing it's type to unsigned simplifies the check.
Reviewed-by: Vittorio Giovara <vittorio.giovara@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 1ed7fcd42a )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
Andreas Cadhalpun
b372ad819e
mxfdec: check edit_rate also for physical_track
...
Previously only the edit_rate of material_track was checked.
If it's negative, it causes assertion failures in av_rescale_rnd.
Reviewed-by: Tim Nicholson <nichot20-at-yahoo.com@ffmpeg.org >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 047bf82c18 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
Michael Niedermayer
bdbfc12e7f
avcodec/jpeg2000: Change coord to 32bit to support larger than 32k width or height
...
Fixes: 03e0abe721b1174856d41a1eb5d6a896/signal_sigabrt_7ffff6ae7cc9_3813_e71bf3541abed3ccba031cd5ba0269a4.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0eb7de1973 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
Michael Niedermayer
c3a44a2a55
avcodec/jpeg2000dec: Check SIZ dimensions to be within the supported range
...
Fixes potential integer overflows
Fixes: 03e0abe721b1174856d41a1eb5d6a896/signal_sigabrt_7ffff6ae7cc9_3813_e71bf3541abed3ccba031cd5ba0269a4.avi
This fix is choosen to be simple to backport, better solution
for master is planed
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ef819c40b )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
Michael Niedermayer
d1d48d4319
avcodec/jpeg2000: Check comp coords to be within the supported size
...
Fixes assertion failure
Fixes: 03e0abe721b1174856d41a1eb5d6a896/signal_sigabrt_7ffff6ae7cc9_3813_e71bf3541abed3ccba031cd5ba0269a4.avi
This fix is choosen to be simple to backport, better solution
for master is planed
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1a8cbcb35 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
Andreas Cadhalpun
6b0bc64f54
mpegvideo: clear overread in clear_context
...
Otherwise the h263p decoder can try to copy overread bytes, even though
buffer is NULL.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 6a69a175e7 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
Michael Niedermayer
983e63b490
avcodec/avrndec: Use the AVFrame format instead of the context
...
Fixes out of array read
Fixes: 20dd01398dee0f6d83d7e5410a2ae8eb/signal_sigsegv_39eeb1f_4001_62efbdf1c60748dabf1ec310b59525fd.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ccba8aaff2 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
Andreas Cadhalpun
bf2f7115d9
dds: disable palette flag for compressed images
...
Having both is not valid and can cause a NULL pointer dereference of
frame->data[1] later.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com >
(cherry picked from commit 0a8bff788b )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
Andreas Cadhalpun
ef699b4135
dds: validate compressed source buffer size
...
A too small buffer will cause segfaults somewhere below
decompress_texture_thread.
Reviewed-by: Vittorio Giovara <vittorio.giovara@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 9a37d47644 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
Andreas Cadhalpun
a8513826dd
dds: validate source buffer size before copying
...
If it is too small av_image_copy_plane segfaults.
Reviewed-by: Vittorio Giovara <vittorio.giovara@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 1675809d2d )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
Andreas Cadhalpun
df31acda64
dvdsubdec: validate offset2 similar to offset1
...
If it is negative, it causes segmentation faults in decode_rle.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit f621749d11 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:45 +01:00
Andreas Cadhalpun
d09fd0736a
brstm: reject negative sample rate
...
A negative sample rate causes assertion failures in av_rescale_rnd.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 7b67fe20f6 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:45 +01:00
Andreas Cadhalpun
c3f276b608
aacps: avoid division by zero in stereo_processing
...
This fixes a SIGFPE crash in the aac_fixed decoder.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com >
(cherry picked from commit ef7fe9851e )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:45 +01:00
Andreas Cadhalpun
510d88ae93
softfloat: assert when the argument of av_sqrt_sf is negative
...
The correct result can't be expressed in SoftFloat.
Currently it returns a random value from an out of bounds read.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit f3866a14c3 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:45 +01:00
Michael Niedermayer
c4133b25f8
avcodec/takdec: Use memove, avoid undefined memcpy() use
...
Fixes: e214333cbd94c91228e624ff39329ce6/asan_generic_4a5159_6412_96cda2530e80607210ab41ccae3d456d.tak
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7cea3430a5 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:41 +01:00
Michael Niedermayer
c9b3451da3
Update Changelog
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 01:17:17 +01:00
Andreas Cadhalpun
46f83b059b
aacsbr_fixed: check for envelope scalefactors overflowing
...
This prevents various values from getting an insanely huge exponent.
If someone knows a cleaner solution, thats welcome!
This is similar to commit 8978c74 for aacsbr.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 0e36a14a42 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:43:01 +01:00
Andreas Cadhalpun
ce2664f5f7
aacdec: don't return frames without data from aac_decode_er_frame
...
This is similar to commit ec38a1b for aac_decode_frame_int.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d7f29bfa69 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:42:50 +01:00
Michael Niedermayer
8364d607ac
avcodec/aacsbr_fixed: Try to initialize sum[0..1] differently to fix build with VS2012
...
Found-by: Hendrik Leppkes <h.leppkes@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8a024f6a43 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:42:43 +01:00
Michael Niedermayer
21e42d9b0d
avcodec/aacsbr: Use FLOAT_0
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dcf1cf5d24 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:42:35 +01:00
Andreas Cadhalpun
e10c353ca5
softfloat: handle INT_MIN correctly in av_int2sf
...
Otherwise v=INT_MIN doesn't get normalized and thus triggers av_assert2
in other functions.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 9ac61e73d0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
Michael Niedermayer
72be96ac55
avutil/softfloat: Include negative numbers in cmp/gt tests
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 955cdc43a3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
Michael Niedermayer
6581e40e1a
avutil/softfloat: Fix av_gt_sf() with large exponents try #2
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 05b05a7a84 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
Michael Niedermayer
0f9c617979
avutil/softfloat: Add test for av_gt_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 791ea23e57 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
Michael Niedermayer
f9998d1994
avutil/softfloat: Extend the av_cmp_sf() test to cover a wider range of exponents
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ecfb076141 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
Michael Niedermayer
7ad4bf4899
avutil/softfloat: Fix overflows in shifts in av_cmp_sf() and av_gt_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cee3c9d29a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
Michael Niedermayer
43ada90fc5
avutil/softfloat: Add test for av_cmp_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df2a2117d2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
Ganesh Ajjanagadde
476ddffccb
avutil/common: add FFDIFFSIGN macro
...
This is of use for defining comparator callbacks. Common approaches like
return x-y are not safe due to the risks of overflow.
Furthermore, the (x > y) - (x < y) trick is optimized to branchless
code.
This also documents this macro accordingly.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Ganesh Ajjanagadde <gajjanagadde@gmail.com >
(cherry picked from commit 265f83fd35 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
Michael Niedermayer
b533998d0a
avutil/softfloat: Add tests for exponent underflows
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 596dfe7d6c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-11 23:32:58 +01:00
Michael Niedermayer
acd203fc0d
avutil/softfloat: Fix exponent underflow in av_div_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 046218b212 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-11 23:32:54 +01:00
Michael Niedermayer
402c4a9f81
avutil/softfloat: Fix exponent underflow in av_mul_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1e3303fc0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-11 23:32:51 +01:00
Michael Niedermayer
6e4bfbe936
avutil/softfloat: Fix typo in av_mul_sf() doxy
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4135a2bfd6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-11 23:32:48 +01:00
Michael Niedermayer
f38beb47da
avutil/softfloat: Correctly set the exponent for 0.0 in av_sqrt_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 107db5abf3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-11 23:32:32 +01:00
Michael Niedermayer
efa9128556
avutil/softfloat: FLOAT_0 should use MIN_EXP
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a66b243d52 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-11 23:32:27 +01:00
Michael Niedermayer
3de8521667
swresample/resample: increase precision for compensation
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 351e625d60 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-11 18:41:01 +01:00
Rodger Combs
edf5e88eac
lavf/mov: add support for sidx fragment indexes
...
Fixes trac #3842
(cherry picked from commit 4ab5666759 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-11 02:50:39 +01:00
Michael Niedermayer
8d634be4ce
update versions for 2.8.2
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-11 02:50:39 +01:00
Michael Niedermayer
9a6d581076
avformat/mxfenc: Only store user comment related tags when needed
...
Also support disabling them as they seem to cause problems to some
Users. They are also not allowed in IRT D-10 thus the default for
mxf_d10 is not to write them
This also decreases the filesize when no user comment are stored
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d9726893f3 )
Conflicts:
libavformat/mxfenc.c
2015-11-11 02:21:32 +01:00
Michael Niedermayer
84f8157662
tests/fate/avformat: Fix fate-lavf
...
The CMP variable seems to have been inherited from fate-api-seek which set it to null
the mxf reference needed a change due to c7e14a279f
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b83c849e87 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-10 11:20:21 +01:00
Simon Thelen
e5a2f5e74d
doc/ffmpeg: Clarify that the sdp_file option requires an rtp output.
...
Signed-off-by: Simon Thelen <ffmpeg-dev@c-14.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b02201efb5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-09 23:58:05 +01:00
Simon Thelen
dac3598563
ffmpeg: Don't try and write sdp info if none of the outputs had an rtp format.
...
Fixes a segfault when trying to write nonexistent rtp information.
Signed-off-by: Simon Thelen <ffmpeg-dev@c-14.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 70fb5eadc5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-09 23:56:29 +01:00
Andreas Cadhalpun
c0cd8747ef
apng: use correct size for output buffer
...
The buffer needs s->bpp bytes, at maximum currently 10.
Assert that s->bpp is not larger.
This fixes a stack buffer overflow.
Reviewed-by: wm4 <nfxjfg@googlemail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 3e8e1a660e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-07 14:11:12 +01:00
Andreas Cadhalpun
e217224456
jvdec: avoid unsigned overflow in comparison
...
The return type of strlen is size_t, i.e. unsigned, so if pd->buf_size
is 3, the right side overflows leading to a wrong result of the
comparison and subsequently a heap buffer overflow.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit db374790c7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-07 14:10:41 +01:00
Michael Niedermayer
56419053bc
avcodec/jpeg2000dec: Clip all tile coordinates
...
Fixes out of array access
Fixes: b877a6b788a25c70e8b1d014f8628549/asan_heap-oob_1da2c3f_2324_5a1b329b0b3c4bb6b1d775660ac56717.r3d
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 43492ff3ab )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-07 03:02:04 +01:00
Michael Niedermayer
11b4822ddb
avcodec/microdvddec: Check for string end in 'P' case
...
Fixes out of array read
Fixes: a9502b60f4cecc19475382aee255f73c/asan_heap-oob_1e87fba_2548_a8ad47f6dde36644fe9cdc444d4632d0.sub
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c719cd6cf7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-07 01:10:58 +01:00
Michael Niedermayer
2de2959305
avcodec/dirac_parser: Fix undefined memcpy() use
...
Fixes: 9d375e415486edd1a0c826f2307d89a4/asan_generic_4a5159_1577_faa333e83dacdd9e4dd322380aeed537.iss
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit daefd8ab2f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-07 01:10:16 +01:00
Michael Niedermayer
b93a8bd838
avformat/xmv: Discard remainder of packet on error
...
Fixes infinite loop
Fixes: 9c48ae2680c5f23bca3d20ff0f325fd8/asan_generic_4c254d_1374_993f1e5967dd6f844b8d72f978ce2a6c.pss
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 79c4a338e4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-06 02:55:48 +01:00
Michael Niedermayer
2817eb514c
avformat/xmv: factor return check out of if/else
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9b6fac11da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-06 02:55:13 +01:00
Michael Niedermayer
6e085f9a32
avcodec/mpeg12dec: Do not call show_bits() with invalid bits
...
Fixes assertion failure
Fixes: 63e50545709a6440d3d59f6426d58db9/signal_sigabrt_7ffff6ae7cc9_8189_3272a3010fd98ddf947c662bbde1ac13.ts
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 973c3dba27 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-06 01:17:00 +01:00
Michael Niedermayer
a7bbb7fb88
avcodec/faxcompr: Add missing runs check in decode_uncompressed()
...
Fixes out of array access
Fixes: 54e488b9da4abbceaf405d6492515697/asan_heap-oob_32769b0_160_a8755eb08ee8f9579348501945a33955.TIF
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d4a731b84a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-05 21:50:14 +01:00
Michael Niedermayer
1290037626
libavutil/channel_layout: Check strtol*() for failure
...
Fixes assertion failure
Fixes: 4f5814bb15d2dda6fc18ef9791b13816/signal_sigabrt_7ffff6ae7cc9_65_7209d160d168b76f311be6cd64a548eb.wv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9bfd6a8c3 )
Conflicts:
libavutil/channel_layout.c
2015-11-05 20:47:15 +01:00
Michael Niedermayer
c7174d5204
avformat/mpegts: Only start probing data streams within probe_packets
...
Fixes assertion failure
Fixes: 4321db8ac331f5967ebfbfe80ce5eb78/signal_sigabrt_7ffff6ae7cc9_7213_0d6457b9d6897fa7c78507fa5de53510.ts
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3692d859f4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-05 18:23:11 +01:00
Michael Niedermayer
ff30907205
avcodec/hevc_ps: Check chroma_format_idc
...
Fixes out of array access
Fixes: 24d05e8b84676799c735c9e27d97895e/asan_heap-oob_1b70f6a_2955_7c3652a7f370f9f3ef40642bc2c99bb2.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93f30f825c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-05 15:17:56 +01:00
Michael Niedermayer
a6ae88bb25
avcodec/ffv1dec: Check for 0 quant tables
...
Fixes assertion failure
Fixes: 07ec1fc3c1cbf2d3edcd7d9b52ca156c/asan_heap-oob_13624c5_491_ecd4720a03e697ba750b235690656c8f.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5745cf799a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-05 01:49:09 +01:00
Michael Niedermayer
4567cba0b8
avcodec/mjpegdec: Reinitialize IDCT on BPP changes
...
Fixes misaligned access
Fixes: dc9262a469f6f315f74c087a7b3a7f35/signal_sigsegv_2e95bcd_9_9c0f9f4a9ba82aa9b3ab2b91ce4d5277.jpg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cc35f6f476 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-04 22:16:38 +01:00
Michael Niedermayer
fdb8842639
avcodec/mjpegdec: Check index in ljpeg_decode_yuv_scan() before using it
...
Fixes: 04715144ba237443010554be0d05343f/asan_heap-oob_1eafc76_1737_c685b48041a563461839e4e7ab97abb8.jpg
Fixes out of array access
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d24888ef19 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-04 19:42:29 +01:00
Tobias Rapp
c6c801d993
avutil/file_open: avoid file handle inheritance on Windows
...
Avoids inheritance of file handles on Windows systems similar to the
O_CLOEXEC/FD_CLOEXEC flag on Linux.
Fixes file lock issues in Windows applications when a child process
is started with handle inheritance enabled (standard input/output
redirection) while a FFmpeg transcoding is running in the parent
process.
Links relevant to the subject:
https://msdn.microsoft.com/en-us/library/w7sa2b22.aspx
Describes the _wsopen() function and the O_NOINHERIT flag. File handles
opened by _wsopen() are inheritable by default.
https://msdn.microsoft.com/en-us/library/windows/desktop/ms682425%28v=vs.85%29.aspx
Describes handle inheritance when creating new processes. Handle
inheritance must be enabled (bInheritHandles = TRUE) e.g. when you want
to pass handles for stdin/stdout via lpStartupInfo.
Signed-off-by: Tobias Rapp <t.rapp@noa-audio.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4746653466 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-02 19:15:32 +01:00
Michael Niedermayer
aa34146e41
avcodec/h264_slice: Disable slice threads if there are multiple access units in a packet
...
Fixes null pointer dereference
Fixes part of Ticket4977
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9368d2da3d33cac845f2fdf663df500b53625c5e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-31 22:57:52 +01:00
Lucas de Andrade
fcb8ee98f6
avformat/hls: update cookies on setcookie response
...
Context cookies must be updated when a playlist response return Setcookie header.
See: 770dd10504
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-30 18:12:30 +01:00
Kieran Kunhya
2f5f940bef
opusdec: Don't run vector_fmul_scalar on zero length arrays
...
Fixes crashes on fuzzed files
Fixes Ticket4969 part2
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b3e5f15b95 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-30 17:55:31 +01:00
Michael Niedermayer
6ac9d6303f
avcodec/opusdec: Fix extra samples read index
...
Fixes crash
Fixes Ticket4969 part 1
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 07225fa74f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-30 17:55:31 +01:00
Michael Niedermayer
81a2ad762b
avcodec/ffv1: Initialize vlc_state on allocation
...
This ensures that they are always set to valid values
Fixes Ticket4939
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a878dfa4f5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-30 17:55:31 +01:00
Michael Niedermayer
c8a1324d1e
avcodec/ffv1dec: update progress in case of broken pointer chains
...
Fixes deadlock
Fixes Ticket4932
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5063a18f56 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-30 17:55:31 +01:00
Michael Niedermayer
6a0e10ae0d
avcodec/ffv1dec: Clear slice coordinates if they are invalid or slice header decoding fails for other reasons
...
Fixes Ticket4931
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4c2d4e8700 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-30 17:55:31 +01:00
Martin Storsjö
3f3e12c768
rtsp: Allow $ as interleaved packet indicator before a complete response header
...
Some RTSP servers ("HiIpcam/V100R003 VodServer/1.0.0") respond to
our keepalive GET_PARAMETER request by a truncated RTSP header
(lacking the final empty line to indicate a complete response
header). Prior to 764ec70149 , this worked just fine since we
reacted to the $ as interleaved packet indicator anywhere.
Since $ is a valid character within the response header lines,
764ec70149 changed it to be ignored there. But to keep
compatibility with such broken servers, we need to at least
allow reacting to it at the start of lines.
Fixes ticket #4952 .
Signed-off-by: Martin Storsjö <martin@martin.st >
(cherry picked from commit e02dcdf6bb )
2015-10-27 13:40:06 +01:00
Ronald S. Bultje
6616762134
videodsp: don't overread edges in vfix3 emu_edge.
...
Fixes trac ticket 3226. Also see Andreas' analysis in
https://bugs.debian.org/801745 , which was very helpful.
(cherry picked from commit 52f84d82bd )
2015-10-25 01:05:31 +02:00
wm4
96b87d5cfa
avformat/mp3dec: improve junk skipping heuristic
...
Commit 2b3e9bbfb5 caused problems for a
certain API user:
https://code.google.com/p/chromium/issues/detail?id=537725
https://code.google.com/p/chromium/issues/detail?id=542032
The problem seems rather arbitrary, because if there's junk, anything
can happen. In this case, the imperfect junk skipping just caused it to
read different junk, from what I can see.
We can improve the accuracy of junk detection by a lot by checking if 2
consecutive frames use the same configuration. While in theory it might
be completely fine for the 1st frame to have a different format than the
2nd frame, it's exceedingly unlikely, and I can't think of a legitimate
use-case.
This is approximately the same mpg123 does for junk skipping. The
set of compared header bits is the same as the libavcodec mp3 parser
uses for similar purposes.
(cherry picked from commit de1b1a7da9 )
2015-10-20 12:35:43 +02:00
Marton Balint
e0e28dad90
concatdec: fix file_start_time calculation regression
...
Fixes ticket #4924 .
Found-by: Jaroslav Šnajdr <jsnajdr@gmail.com >
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit df239b7619 )
2015-10-17 22:36:33 +02:00
周晓勇
1a67b0f9ae
avcodec: loongson optimize h264dsp idct and loop filter with mmi
...
Change-Id: Ic87fb8f5cd22a502ff9dbbc5a5a8ea97cfc8a1dd
Signed-off-by: ZhouXiaoyong <zhouxiaoyong@loongson.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-16 14:47:56 +02:00
Michael Niedermayer
e3fcd88f08
avcodec/jpeg2000dec: Clear properties in jpeg2000_dec_cleanup() too
...
Fixes: Ticket4878
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c980c5e54d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-16 14:47:56 +02:00
Anssi Hannula
68a6178ef0
avformat/hls: add support for EXT-X-MAP
...
Without EXT-X-MAP support we miss the first bytes of some streams.
These streams worked by luck before byte-ranged segment support was added in
da7759b357
Fixes ticket #4797 .
(cherry picked from commit 9099079488 )
Conflicts:
libavformat/hls.c
2015-10-15 14:27:20 +02:00
Anssi Hannula
d51ddd45b2
avformat/hls: fix segment selection regression on track changes of live streams
...
Commit ad701326b4 ("avformat/hls: open playlists immediately when
AVDISCARD_ALL is dropped") inadvertently caused first_packet to never be
cleared, causing select_cur_seq_no() to not use the specific code for
live streams.
In practice this means that when the user selects a different audio
track during live stream (i.e. non-VOD) playback, there may be some
additional delay as the code might select an incorrect segment at first,
and we have to wait for video to catch audio (if too late segment was
selected) or to download more following audio segments (if too early
segment was selected).
Fix that by restoring the zeroing of first_packet.
(cherry picked from commit fd74d45d51 )
2015-10-15 14:21:29 +02:00
Carl Eugen Hoyos
c2db8ebc08
configure: Require libkvazaar < 0.7.
...
Fixes ticket #4925 .
Reviewed-by: Arttu Ylä-Outinen
2015-10-14 14:15:30 +02:00
Michael Niedermayer
b46efcb293
avcodec/vp8: Do not use num_coeff_partitions in thread/buffer setup
...
The variable is not a constant and can lead to race conditions
Fixes: repro.webm (not reproducable with FFmpeg alone)
Found-by: Dale Curtis <dalecurtis@google.com >
Tested-by: Dale Curtis <dalecurtis@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dabea74d0e )
2015-10-14 14:15:11 +02:00
Michael Niedermayer
40934e0e9b
Update for 2.8.1
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-13 20:44:52 +02:00
Pedro Arthur
bb3b4ad460
swscale: fix ticket #4881
...
When scaling only a slice of a frame the output was written always
in the first lines leaving the rest of the frame black.
(cherry picked from commit 5bd62a1b3c )
2015-10-13 20:11:42 +02:00
Andreas Cadhalpun
13d3749424
doc: fix spelling errors
...
Reviewed-by: Lou Logan <lou@lrcd.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 8d6625642d )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-10-12 21:46:54 +02:00
Andreas Cadhalpun
173053a125
hls: only seek if there is an offset
...
If there is no #EXT-X-BYTERANGE specified, there is no need to seek.
Seeking fails anyway for rtmp, because this protocol does not support
url_seek.
This fixes CNN.m3u from trac ticket 4797 (i.e. Debian bug #798189 ).
Reviewed-by: wm4 <nfxjfg@googlemail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit f9f0b4c08e )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-10-12 21:46:54 +02:00
Alexandra Hájková
8118fdf8bb
asfdec: add more checks for size left in asf packet buffer
...
Signed-off-by: Luca Barbato <lu_zero@gentoo.org >
(cherry picked from commit c0a49077ea )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-10-12 21:46:54 +02:00
Alexandra Hájková
f235f511a0
asfdec: alloc enough space for storing name in asf_read_metadata_obj
...
Signed-off-by: Luca Barbato <lu_zero@gentoo.org >
(cherry picked from commit 77cf236689 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-10-12 21:46:54 +02:00
Michael Niedermayer
c149a4afee
avcodec/pngdec: Check blend_op.
...
Fixes CID1322359, CID1322358
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e7e4f13f9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-12 02:23:36 +02:00
赵宇龙
02d8abf0f5
h264_mp4toannexb: fix pps offfset fault when there are more than one sps in avcc
...
the pps offset is used to locate pps in the spspps_buf; however, the
current calc method is wrong because it is the offset of the original
avctx->extradata;
when there is only one sps in the avcc; the value is correct by
coincidence, however, it will
fail in avcc with multi sps
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6b32d0d86b6bec2b5cb565d6ab4556f8cd66214a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-12 02:23:36 +02:00
Michael Niedermayer
9579550b2b
avcodec/h264_mp4toannexb_bsf: Use av_freep() to free spspps_buf
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d126ef188 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-12 02:23:36 +02:00
Michael Niedermayer
7ec05ae969
avformat/avidec: Workaround broken initial frame
...
Fixes Ticket4851
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3e2ef00394 )
2015-10-09 21:15:15 +02:00
wm4
b9841ba98c
avformat/hls: fix some cases of HLS streams which require cookies
...
Broken by commit ba12ba859a . This only
happens with HLS streams which use encryption and require preserving
cookies sent by the server.
Fixes trac issue #4846 .
(cherry picked from commit 26eb294007 )
2015-10-09 21:14:23 +02:00
Paul B Mahol
39df4d2475
avcodec/pngdec: reset has_trns after every decode_frame_png()
...
Fixes #4887 .
Signed-off-by: Paul B Mahol <onemda@gmail.com >
(cherry picked from commit 1d0487f77f )
2015-10-09 21:14:02 +02:00
Przemysław Sobala
635831c087
lavf/img2dec: Fix memory leak
...
Fixes #4886
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 01dd7e025c )
2015-10-09 21:13:49 +02:00
wm4
291a2f1ea7
avcodec/mp3: fix skipping zeros
...
Commits 43bc5cf9 and c5371f77 add code for skipping initial zeros in mp3
packets. This code forgot to report to the user that data was skipped at
all.
Since audio codecs allow partial packet decoding, the user application
has to rely on the return value. It will remove the data reported as
consumed by the decoder, and feed it to the decoder again. This resulted
in the mp3 frame after the zero region to be decoded over and over
again, until the zero region was finally skipped by the application.
Fix this by including the amount of skipped bytes to the number of
consumed bytes returned by the decode call.
Fixes trac ticket #4890 .
(cherry picked from commit cb1da9fb8d )
2015-10-09 21:12:30 +02:00
Clément Bœsch
ee1bcd3436
avformat/srtdec: make sure we probe a number
...
Fixes regression since 7218352e02 : WebVTT
files were matching the SRT probing.
(cherry picked from commit 40d9d6de90 )
2015-10-09 10:56:31 +02:00
James Almer
408240267a
configure: check for ID3D11VideoContext
...
Should fix compilation with mingw-w64 trunk, where ID3D11VideoDecoder is available
but ID3D11VideoContext still isn't.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit b8e4df46ab )
2015-10-08 17:08:04 -03:00
wm4
eca7b0dcce
avformat/vobsub: compare correct packet stream IDs
...
The stream ID is essentially an arbitrary number defined by the .idx
file headers. They have to match the IDs in the .sub stream. The vobsub
demuxer assumed the IDs would just start from 0, increassing by 1 for
each stream. This is not correct. In the sample I had, the IDs were
starting from 1, leading to no subtitles being displayed at all.
Fix this by using the correct stream ID.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a47ad06baf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 15:21:45 +02:00
Clément Bœsch
64b659673a
avformat/srtdec: more lenient first line probing
...
Fixes Ticket #4898
(cherry picked from commit 7218352e02 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 15:21:39 +02:00
Clément Bœsch
1d9d300d65
avformat/srtdec: fix number check for the first character
...
(cherry picked from commit d161a2a72b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 15:21:24 +02:00
Shivraj Patil
a931ad554d
avcodec/mips: build fix for MSA 64bit
...
Modified datatype of function argument (pitch from int32_t to ptrdiff_t).
Signed-off-by: Shivraj Patil <shivraj.patil@imgtec.com >
Commit in master: 322e960dbf
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 14:32:05 +02:00
Shivraj Patil
7236080d27
avcodec/mips: build fix for MSA
...
Modified sps and pps access from old HEVCContext(s) structure to newly introduced HEVCParamSets(ps).
Signed-off-by: Shivraj Patil <shivraj.patil@imgtec.com >
Commit in master: b0732b0214
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 14:31:49 +02:00
Andrey Utkin
6dcd2ebd34
avformat/httpauth: Add space after commas in HTTP/RTSP auth header
...
This fixes access to Grandstream cameras, which return 401 to ffmpeg
otherwise.
VLC sends Authorization: header with spaces between parameters, and it
is known to work with Grandstream devices and broad range of other HTTP
and RTSP servers, so author considers switching to such behaviour safe.
Just for record - RFC 2617 (HTTP Auth) does not specify the need in
spaces, so this is not a bug of FFmpeg.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fdb3283872 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
DHE
83d75c70df
libavformat/hlsenc: Use of uninitialized memory unlinking old files
...
Fixes ticket#4900
Signed-off-by: DHE <git@dehacked.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 76e3f8242d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Michael Niedermayer
818ebcbf5c
avcodec/x86/sbrdsp: Fix using uninitialized upper 32bit of noise
...
Fixes crash
Fixes: flicker-1.scout3d21443372922.28.m4a
Found-by: Dale Curtis <dalecurtis@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b82b934a1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Michael Niedermayer
837113ab5f
avcodec/ffv1dec: Fix off by 1 error in quant_table_count check
...
Fixes: invalid_read.nut
Found-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d221d9e06 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Michael Niedermayer
97340bdfa3
avcodec/ffv1dec: Explicitly check read_quant_table() return value
...
Forwards the error code, avoids potential integer overflow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 10bbf6cf62 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Jeremy James
61fd5a3072
dnxhddata: correct weight tables
...
CID 1260 (as evidenced by incorrect decoding of a sample from ticket
4876) seems to use incorrect weight tables. It appears those tables
were not zigzag-scanned.
Apply zigzag on weight tables for new CIDs 1258, 1259, and 1260, and
fix an incorrect chroma table for CID 1256.
Fixes last issue from ticket #4876 .
Found-by: Christophe Gisquet <christophe.gisquet@gmail.com >
Signed-off-by: Christophe Gisquet <christophe.gisquet@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 428424fe75 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Christophe Gisquet
f5f9c166a1
dnxhddec: decode and use interlace mb flag
...
This bit is 1 in some samples, and seems to coincide with interlaced
mbs and CID1260. 2008 specs do not know about it, and maintain qscale
is 11 bits. This looks oversized, but may help larger bitdepths.
Currently, it leads to an obviously incorrect qscale value, meaning
its syntax is shifted by 1. However, reading 11 bits also leads to
obviously incorrect decoding: qscale seems to be 10 bits.
However, as most profiles still have 11bits qscale, the feature is
restricted to the CID1260 profile.
The encoder writes 12 bits of syntax, last and first bits always 0,
which is now somewhat inconsistent with the decoder, but ends up with
the same effect (progressive + reserved bit).
Partially fixes ticket #4876 .
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2801a1352d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Pedro Arthur
01bf0a178d
swscale: fix ticket #4877
...
(cherry picked from commit a8602dde5e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Michael Niedermayer
3cd1be9702
avcodec/rangecoder: Check e
...
Fixes hang.nut
Found-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b2955b6c5a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Michael Niedermayer
d4b1fe72c2
avcodec/ffv1: seperate slice_count from max_slice_count
...
Fix segfault with too large slice_count
Fixes Ticket4879
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa6c43f3fd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Pedro Arthur
a8d0dcbafa
swscale: fix ticket 4850
...
(cherry picked from commit 77367f61b3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Michael Niedermayer
2a6103a082
cmdutils: Filter dst/srcw/h
...
Dimensions / pixel formats for scaling must be set through the -s / pix_fmt options
or the scale / format filters. Otherwise there are mismatches between whet is
in/output to the scaler and for what the scaler is configured
Fixes Ticket4856
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a0af9fd954 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Ganesh Ajjanagadde
3fedd64d4b
avutil/log: fix zero length gnu_printf format string warning
...
This should fix warning reported by fate client:
http://fate.ffmpeg.org/report.cgi?time=20150917113121&slot=x86_32-linux-gnu-gcc-4.5.1-have_6regs .
Untested.
Signed-off-by: Ganesh Ajjanagadde <gajjanagadde@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 63cdb6e4a5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Simon Thelen
9bbcd1cc7b
lavf/webvttenc: Require webvtt file to contain exactly one WebVTT stream.
...
Not requiring this can end up producing hilariously broken files
together with -c:s copy (e.g. a webvtt file containing binary subtitle data).
Signed-off-by: Simon Thelen <ffmpeg-dev@c-14.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b84232694e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Michael Niedermayer
9801c9524a
swscale/swscale: Fix "unused variable" warning
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ae40c5a70 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Michael Niedermayer
08fc0d771a
avcodec/mjpegdec: Fix decoding RGBA RCT LJPEG
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 055e56e9f7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Michael Niedermayer
a3db85581e
MAINTAINERS: add 2.8, drop 2.2
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
James Almer
ddbb8d5eda
doc: mention libavcodec can decode Opus natively
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit fd9ac48dc8 )
2015-09-20 23:30:50 -03:00
Hendrik Leppkes
41aa6b2095
hevc: properly handle no_rasl_output_flag when removing pictures from the DPB
...
Fixes ticket #4185 .
Reviewed-By: Mickael Raulet <Mickael.Raulet@insa-rennes.fr >
Signed-off-by: Hendrik Leppkes <h.leppkes@gmail.com >
2015-09-20 00:18:57 +02:00
Paul B Mahol
fb0d41932d
avfilter/af_ladspa: process all channels for nb_handles > 1
...
Signed-off-by: Paul B Mahol <onemda@gmail.com >
(cherry picked from commit dc1050a3e8 )
2015-09-16 12:50:13 +00:00
Ricardo Constantino
aa46ae8848
configure: add libsoxr to swresample's pkgconfig
...
Fixes linking in FFMS and f265 at least, when ffmpeg is compiled with
libsoxr.
Signed-off-by: Ricardo Constantino <wiiaboo@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2641eeeefe )
Signed-off-by: Timothy Gu <timothygu99@gmail.com >
2015-09-09 07:41:33 -07:00
Hendrik Schreiber
c3021738fc
lavc: Fix compilation with --disable-everything --enable-parser=mpeg4video.
...
(cherry picked from commit 9d742d23d2 )
2015-09-09 16:23:26 +02:00
Michael Niedermayer
b72c184194
avcodec/h264_sei: Remove "Subtitles with data type 0x%02x" sample request
...
Suggested-by: Carl and Hendrik
2015-09-08 23:02:00 +02:00
Michael Niedermayer
d86c5f8de8
RELEASE_NOTES based on 2.7
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-09-08 22:33:04 +02:00
周晓勇
0752e44b1f
avcodec: loongson delete invalid simple idct put and add optimization
...
Change-Id: I23a36c65915f01a1cf20e317c14b8eaaa62958b4
Signed-off-by: ZhouXiaoyong <zhouxiaoyong@loongson.cn >
Fixes Decoding of http://loongnix.org/ftp/multimedia/testing/nanocore_720p_24fps_mpeg4_ac3_short.avi
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a78656a187 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-09-08 22:31:44 +02:00
Michael Niedermayer
1d42df7292
Add NOA credits
2015-09-08 22:31:44 +02:00
Gwenole Beauchesne
eaabfe8ef8
vaapi: fix local header include.
...
Signed-off-by: Gwenole Beauchesne <gwenole.beauchesne@intel.com >
(cherry picked from commit aea611dc3e )
2015-09-07 15:32:56 +02:00
Michael Niedermayer
90d29c3d04
Changelog: Add 2.8
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-09-06 16:00:01 +02:00
Michael Niedermayer
48211b0c0d
set version to 2.8
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-09-06 15:48:55 +02:00
Ganesh Ajjanagadde
aa661d3672
avfilter/af_asyncts: use llabs for int64_t
...
long may not be 64 bit on all platforms; so labs on int64_t is unsafe.
This fixes a warning reported in:
http://fate.ffmpeg.org/log.cgi?time=20150905071512&log=compile&slot=i386-darwin-clang-polly-3.7
Signed-off-by: Ganesh Ajjanagadde <gajjanagadde@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d74123d03e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-09-06 12:11:23 +02:00
Zhang Rui
8cd24f8fe7
avformat/async: replace strerror with av_err2str
...
Fixes CID1322337
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 929451c5cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-09-06 11:56:54 +02:00
Rostislav Pehlivanov
7e853879ce
fate: increase the fuzz of the AAC encoder aref test
...
Almost fine on SunOS without yasm but 5 wasn't enough.
Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com >
2015-09-06 00:27:08 +02:00
Michael Niedermayer
f598ca088e
doc/APIchanges: Fill in missing fields and correct one lavu version
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0acd4e75fd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-09-05 18:34:01 +02:00
Michael Niedermayer
2710c14a83
doc/APIchanges: add 2.8 cut line
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 982e235d76 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-09-05 18:33:58 +02:00
James Almer
1a56be9cdc
avutil: undo FF_API_CRYPTO_CONTEXT deprecation for 2.8 release
...
There's no consensus yet if this deprecation is desired, so it's removed
from this release for the time being
Signed-off-by: James Almer <jamrial@gmail.com >
2015-09-05 13:02:29 -03:00