Michael Niedermayer
d5b9ecc2d1
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-07 19:33:31 +02:00
Michael Niedermayer
efe225d307
avcodec/apedec: Fix undefined integer overflow with 24bit
...
Fixes: signed integer overflow: 8683744 * 256 cannot be represented in type 'int'
Fixes: 23527/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5679885932822528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9f7b252cdf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-07 19:30:22 +02:00
Michael Niedermayer
a9fba357e5
avcodec/loco: Fix integer overflow with large values from loco_get_rice()
...
Fixes: signed integer overflow: 155 + 2147483647 cannot be represented in type 'int'
Fixes: 23421/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5652849097965568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ddc5e1f3c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-07 19:29:28 +02:00
Michael Niedermayer
ad609996e6
avformat/smjpegdec: Check the existence of referred streams
...
Fixes: Assertion failure
Fixes: 23758/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5160954605338624.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 321ea59dac )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-07 19:28:34 +02:00
Michael Niedermayer
adffd9d909
avcodec/pnmdec: Fix misaligned reads
...
Found-by: "Steinar H. Gunderson" <steinar+ffmpeg@gunderson.no >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea28ce9bc1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-06 01:51:19 +02:00
Michael Niedermayer
98ce6fd8e7
Update for 2.8.17
2020-07-05 13:01:36 +02:00
Michael Niedermayer
542bfa483c
avformat/utils: reorder duration computation to avoid overflow
...
Fixes: signed integer overflow: 8 * 9223372036854774783 cannot be represented in type 'long'
Fixes: 23381/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4818340509122560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 10cc82c35b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 13:01:36 +02:00
Michael Niedermayer
8cae3778ea
avcodec/pngdec: Check for fctl after idat
...
Fixes: out of array access
Fixes: 23554/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-4796622520451072.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65b1ba680f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 13:01:36 +02:00
Ronald S. Bultje
453519af0d
png: split header state and data state in two separate variables.
...
Fixes a reported (but false) race condition in tsan for fate-apng:
WARNING: ThreadSanitizer: data race (pid=6274)
Read of size 4 at 0x7d680001ec78 by main thread (mutexes: write M1338):
#0 update_thread_context src/libavcodec/pngdec.c:1456 (ffmpeg+0x000000dacf0c)
[..]
Previous write of size 4 at 0x7d680001ec78 by thread T1 (mutexes: write M1335):
#0 decode_idat_chunk src/libavcodec/pngdec.c:737 (ffmpeg+0x000000dae951)
(cherry picked from commit 478f1c3d5e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 13:01:36 +02:00
Michael Niedermayer
0f6fa27b24
avformat/hls: Pass a copy of the URL for probing
...
The segments / url can be modified by the io read when reloading
This may be an alternative or additional fix for Ticket8673
as a further alternative the reload stuff could be disabled during
probing
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5e39880fb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 13:01:36 +02:00
Steven Liu
6959358683
avformat/hls: check segment duration value of EXTINF
...
fix ticket: 8673
set the default EXTINF duration to 1ms if duration is smaller than 1ms
Signed-off-by: Steven Liu <lq@chinaffmpeg.org >
(cherry picked from commit 9dfb19baeb )
2020-07-05 13:01:36 +02:00
Michael Niedermayer
449bdf05f8
avutil/common: Fix integer overflow in av_ceil_log2_c()
...
Fixes: left shift of 1913647649 by 1 places cannot be represented in type 'int'
Fixes: 23572/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5082619795734528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e409262837 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
204a7255fa
avformat/microdvddec: skip malformed lines without frame number.
...
Fixes: signed integer overflow: 1 - -9223372036854775808 cannot be represented in type 'long'
Fixes: 23490/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5133490093031424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8fb7612a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
22669e38e4
avformat/4xm: Check that a video stream was created before returning packets for it
...
Fixes: assertion failure
Fixes: 23434/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5227750851084288.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c517c3f474 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
30242bcb00
avcodec/ffwavesynth: Avoid undefined operation on ts overflow
...
Alternatively these conditions could be treated as errors
Fixes: 23147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5639254549200896
Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'int64_t' (aka 'long')
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 584d334afd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
425c0eafae
avcodec/mpeg4videodec: Fix 2 integer overflows in get_amv()
...
Fixes: signed integer overflow: -144876608 * 16 cannot be represented in type 'int'
Fixes: 22782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-6039584977977344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e361785ee0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
c11634ad75
avcodec/lossless_audiodsp: Fix undefined overflows in scalarproduct_and_madd_int16_c()
...
Fixes: signed integer overflow: 2142077091 + 6881070 cannot be represented in type 'int'
Fixes: 22737/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5958388889681920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c0dfe134be )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
bb5e4743d9
avcodec/sonic: Fix several integer overflows
...
Fixes: signed integer overflow: 2129689466 + 2129689466 cannot be represented in type 'int'
Fixes: 20715/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5155263109922816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 75d520e337 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
c837abe0a9
avcodec/iff: Fix off by x error
...
Fixes: out of array access
Fixes: 23245/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5723121327013888.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 51225dee0a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
08f49d5085
avcodec/wmalosslessdec: Check block_align maximum
...
Fixes: Assertion failure
Fixes: 22737/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5958388889681920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 314d10f7a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
5663dd6662
avcodec/loco: Fix signed integer overflow in loco_get_rice()
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 22975/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5658160970072064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa88cdfd90 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
f46d338341
avformat/thp: Check fps
...
Fixes: division by zero
Fixes: 23162/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4856420817436672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e15b01b4e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
60568d2841
avformat/mpl2dec: Fix integer overflow with duration
...
Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented in type 'long'
Fixes: 23167/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6425051741290496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9a42a67c5c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
a1cfe7baed
avcodec/mpeg12dec: remove outdated comments
...
Found-by: Kieran
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 48de8f5816 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
0d92707437
avcodec/snowdec: Avoid integer overflow with huge qlog
...
Fixes: integer overflow
Fixes: 22285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5682428762128384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38fbf33c72 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
02361a13ef
avcodec/mpeg12dec: Fix got_output
...
This makes got_output consistent with the code in slice_end() which sets the output
in slice_end()
if (s->pict_type == AV_PICTURE_TYPE_B || s->low_delay) {
int ret = av_frame_ref(pict, s->current_picture_ptr->f);
...
} else {
Fixes: assertion failure
Fixes: 22178/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5664234440753152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f33a9803a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
13f9cfbf2b
avformat/4xm: Cleanup on GET_LIST_HEADER() failure
...
Fixes: memleak
Fixes: 23142/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5932860820422656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5313ce654 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
39806a275e
avformat/mlvdec: fail reading a packet with 0 streams
...
Fixes: NULL pointer dereference
Fixes: 22604/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5667739074297856.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5bd5c31087 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
2d29c01766
avformat/thp: Check compcount
...
Fixes: out of array access
Fixes: 22520/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5100297658826752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1ba8484559 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
387ba3cb35
avcodec/adpcm: XA: Check shift similar to filter
...
Fixes: negative shift
Fixes: 22499/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_XA_fuzzer-5765452130418688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6d96bae9c4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
9b432f0e85
avcodec/huffyuvdec: Test vertical coordinate more often
...
Fixes: out of array access
Fixes: 22892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-5135996772679680.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1223ddc56 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
849affacb2
avcodec/hq_hqa: Check info size
...
Fixes: assertion failure
Fixes: 21079/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-5737046523248640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf28521fee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
2c44582d1f
avcodec/wmalosslessdec: Fix integer overflow in mclms_predict()
...
Fixes: signed integer overflow: 2147483636 + 2048 cannot be represented in type 'int'
Fixes: 22016/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5109395618004992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c42ed06695 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
2383c88baa
avcodec/vp9dsp_template: Fix integer overflow(s) in iadst16_1d()
...
Fixes: signed integer overflow: 1080285923 - -1130879337 cannot be represented in type 'int'
Fixes: 22002/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-6260237310099456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 071e293723 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
6b58eaac4d
avcodec/h264dec: Disable forced small_padding on flag2 fast
...
Fixes: 20978/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5746381832847360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
a317af2deb
avcodec/pnmdec: Use unsigned for maxval rescaling
...
Fixes: signed integer overflow: 65535 * 55335 cannot be represented in type 'int'
Fixes: 21955/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-5669206981083136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 49459aca47 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
9161063248
avcodec/ivi: Clear got_p_frame before decoding a new frame using it
...
Fixes: assertion failure
Fixes: 21666/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-5706468994318336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1d633e6a0a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
b35b3dfc25
avcodec/dsddec: Check channels
...
Fixes: division by zero
Fixes: 21677/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DSD_MSBF_fuzzer-5712547983654912
Fixes: 21751/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DSD_LSBF_fuzzer-5197097180856320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2570a8777e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
9fd634161f
avcodec/xvididct: Fix integer overflow in idct_row()
...
Fixes: signed integer overflow: -1238335488 + -1003634688 cannot be represented in type 'int'
Fixes: 21649/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5112005765890048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 620236e4d2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
d8a1e0a79e
avcodec/wmalosslessdec: Fix integer overflows in revert_inter_ch_decorr()
...
Fixes: signed integer overflow: -717241856 + -1434459904 cannot be represented in type 'int'
Fixes: 21405/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5677143666458624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e9a4c4fe99 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
40a039fee4
avformat/mpegenc: Fix integer overflow with AV_NOPTS_VALUE
...
Fixes: signed integer overflow: -9223372036854775808 - 45000 cannot be represented in type 'long'
Fixes: ticket8187
Found-by: Suhwan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9874815b1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
104e38464b
avformat/aadec: Check toc_size to contain the minimum to demuxer uses
...
Fixes: out of array access
Fixes: stack-buffer-overflow-READ-0x0831fff1
Found-by: GalyCannon <galycannon@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit daa2482871 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Dale Curtis
832ae51f9b
avformat/mov: Don't allow negative sample sizes.
...
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d8d554f15 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Vitaly Buka
72a8f82844
mpeg4videoenc: Don't crash with -fsanitize=bounds
...
Also the patch makes this code consistent with mpeg4videodec.c
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f163d30de2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
0c914ee968
avcodec/binkaudio: Fix 2Ghz sample_rate
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 19950/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINKAUDIO_DCT_fuzzer-5765514337189888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Paul
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f603d10b1e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
40e54383a2
avcodec/adpcm: Fix integer overflow in ADPCM THP
...
The reference (thp.txt) uses floats so wrap around would seem incorrect.
Fixes: signed integer overflow: 1073741824 + 1073741824 cannot be represented in type 'int'
Fixes: 20658/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_THP_fuzzer-5646302555930624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b12b05374f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
f8da048589
avcodec/ralf: Check num_blocks before use
...
Fixes: out of array access
Fixes: 20659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5739471895265280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f0c0471075 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
2a9ed44fe2
avcodec/utvideodec: Fix integer overflow in decode_plane()
...
Fixes: signed integer overflow: 2147483594 + 142 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_fuzzer-5658568101724160
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 876cfa67f3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
186599c86f
avcodec/ralf: Fix integer overflow in decode_block()
...
Fixes: signed integer overflow: 289082077 - -2003141111 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5196077752123392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c4330847c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
24f824af86
avcodec/nuv: widen buf_size type
...
Fixes: signed integer overflow: 65312 * 65312 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-5740176118906880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1ac106bf56 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
8970824856
avcodec/g729postfilter: Clip gain before scaling with AGC_FAC1
...
The fixed point integer reference specifies the multiplication used
to have 16bit input and clips so we need to clip the input
The floating point implementation does not seem to do that.
Fixes: signed integer overflow: 6317568 * 410 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G729_fuzzer-5700189272932352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 82d4c7b95e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
8880343974
avformat/thp: Require a video stream
...
The demuxer code assumes the existence of a video stream
Fixes: assertion failure
Fixes: 21512/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5699660783288320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 97c78caf3e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
eb9e718078
avformat/mpeg: Decrease score by 1 for files with very little valid data
...
Fixes: 8233/PPY6574574605_cut.mp3
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 20f7b4dfc9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
8a359e077f
avcodec/pngdec: Check length in fdAT
...
Fixes: 21089/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-5135981419429888
Fixes: out of array read
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 79e5c2ee2b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
e060f917f2
avcodec/g2meet: Check tile_width in epic_jb_decode_tile()
...
Fixes: out of array access
Fixes: 21469/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5199357982015488
Alternatively the arrays can be made bigger or the index can be clipped.
In case a real file with such huge tiles exist we ask the user to upload it.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5501bb28dd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
189d849aa5
avcodec/vp9dsp_template: Fix integer overflows in idct32_1d()
...
Fixes: signed integer overflow: -193177 * 11585 cannot be represented in type 'int'
Fixes: 20557/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5704852816789504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e16e3e63f0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
1c200201cd
libavcodec/wmalosslessdec: prevent sum of positive numbers from becoming negative
...
Fixes: left shift of negative value -8321365
Fixes: 20506/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-4798062906310656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 62e4003780 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
b055fa4b1c
avcodec/txd: Check for input size against the header size.
...
Fixes: Timeout (21sec -> 80ms)
Fixes: 20673/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TXD_fuzzer-5177453863763968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aeb4e43584 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Michael Niedermayer
54ec335e83
avcodec/svq1dec: Check that there is data left after the header
...
Fixes: Timeout (21sec -> 255ms)
Fixes: 20709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ1_fuzzer-5085075089915904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 55e344ee5a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 12:43:08 +02:00
Zhao Zhili
7db4f36291
avformat/mov: fix memleaks
...
Fix two cases of memleaks:
1. The leak of dv_demux
2. The leak of dv_fctx upon dv_demux allocate failure
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit f3dc38a186 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 16:43:20 +02:00
Andreas Rheinhardt
af773c60d6
libavformat/mov: Fix memleaks when demuxing DV audio
...
The code for demuxing DV audio predates the introduction of refcounted
packets and when the latter was added, changes to the former were
forgotten. This meant that when avpriv_dv_produce_packet initialized the
packet containing the AVBufferRef, the AVBufferRef as well as the
underlying AVBuffer leaked; the actual packet data didn't leak: They
were directly freed, but not via their AVBuffer's free function.
https://samples.ffmpeg.org/ffmpeg-bugs/trac/ticket4671/dir1.tar.bz2
contains samples for this (enable_drefs needs to be enabled for them).
Moreover, errors in avpriv_dv_produce_packet were ignored; this has been
changed, too.
Furthermore, in the hypothetical scenario that the track has a palette,
this would leak, too, so reorder the code so that the palette code
appears after the DV audio code.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 61f5c6ab06 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 16:43:13 +02:00
Andreas Rheinhardt
1662f9bb1c
libavcodec/libvpxenc: Don't free user-provided AVPacket
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 26b4509690 )
2020-05-23 21:38:49 +02:00
Andreas Rheinhardt
49a9b454b3
avcodec/libopusenc: Don't free user-provided AVPacket
...
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit b803993b6d )
2020-05-23 21:38:21 +02:00
Michael Niedermayer
f93e026b64
libavformat/Makefile: Fix build issues with async test
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-24 13:48:04 +02:00
Michael Niedermayer
9f52eb5fce
Changelog: Update for 2.8.16
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-24 01:17:24 +02:00
Michael Niedermayer
a1c51c0713
avcodec/hevc_mp4toannexb_bsf: Check nalu_size
...
Fixes: Timeout (29sec -> 5ms)
Fixes: 20237/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_MP4TOANNEXB_fuzzer-5165615044362240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ae2537f53e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
56774297bb
avcodec/iff: Check length before memcpy() in decode_deep_rle32()
...
Fixes: out of array read
Fixes: 20796/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5111364702175232.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b4a33387cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
0516f88c76
avcodec/iff: Fix invalid pointer intermediates in decode_deep_rle32()
...
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc41a29a5a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
9a636c5a76
avcodec/rv40dsp: Fix integer overflows in rv40_weight_func_*()
...
Fixes: signed integer overflow: 40550400 * 128 cannot be represented in type 'int'
Fixes: 20331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV40_fuzzer-5676685725007872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 13171ad2e3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
d0d0962a8b
avcodec/ac3dec_fixed: Fix several invalid left shifts in scale_coefs()
...
Fixes: left shift of negative value -14336
Fixes: 20298/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AC3_FIXED_fuzzer-5675484201615360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e30502abe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
f983115644
avcodec/flac_parser: Do not lose header count in find_headers_search()
...
Fixes: Timeout
Fixes: out of array access
Fixes: 20274/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5649631988154368
Fixes: 19275/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5757535722405888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 55f9683cf6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
9a82db1ce9
avcodec/audiodsp: Fix integer overflow in scalarproduct_int16_c()
...
Fixes: signed integer overflow: 2145417478 + 76702564 cannot be represented in type 'int'
Fixes: 20313/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-5734487724130304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit abb5762e98 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
b4ac197257
avformat/oggdec: Check for EOF after page header
...
Fixes: Infinite loop
Fixes: Ticket8594
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f1589be9fd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
1ff19987be
swscale/yuv2rgb: Fix vertical dither offset with slices
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be3c29e379 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
e6dcdee170
avcodec/dpcm: clip exponent into supported range in XAN DPCM
...
Fixes: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 21200/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XAN_DPCM_fuzzer-5754704894361600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 20ade59d96 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
da076d4aa2
avcodec/flacdsp_template: Fix invalid shifts in decorrelate
...
Fixes: left shift of negative value -2
Fixes: 20303/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5096829297623040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3935c891e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
e0916c7fb5
avcodec/xvididct: Fix integer overflow in MULT()
...
Fixes: signed integer overflow: 23170 * 95058 cannot be represented in type 'int'
Fixes: 20295/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5800212870463488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ccb576191 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
834c9968a0
avcodec/ffwavesynth: Correct undefined overflow of PINK_UNIT
...
Fixes: signed integer overflow: 9223372036854775775 + 128 cannot be represented in type 'long'
Fixes: 20054/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5686385113825280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 187161d62f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
4359dddb72
swscale/output: Fix integer overflow in yuv2rgb_write_full() with out of range input
...
Fixes: signed integer overflow: 1169365504 + 981452800 cannot be represented in type 'int'
Fixes: ticket8293
Found-by: Suhwan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e057e83a4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
John Rummell
1881989f2f
libavformat/amr.c: Check return value from avio_read()
...
If the buffer doesn't contain enough bytes when reading a stream,
fail rather than continuing on with initialized data. Caught by
Chromium fuzzeras (crbug.com/1065731).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5b967f56b6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
John Rummell
01e696609b
libavformat/mov.c: Free aes_decrypt to avoid leaking memory
...
Found by Chromium fuzzers (crbug.com/1057205).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ad91cf1f2f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
John Rummell
e11e62a80a
libavformat/oggdec.c: Check return value from avio_read()
...
If the buffer doesn't contain enough bytes when reading a stream,
fail rather than continuing on with unitialized data. Caught by
Chromium fuzzers (crbug.com/1054229).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b7c67b1ae3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
e1430e1e2b
avformat/asfdec_f: Fix overflow check in get_tag()
...
Fixes: signed integer overflow: 2 * 1210064928 cannot be represented in type 'int'
Fixes: 20873/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5761116909338624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8140fe732 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
a31fc54c6c
avformat/nsvdec: Fix memleaks on errors while reading the header
...
Fixes: memleaks
Fixes: 21084/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5655975492321280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 96c0469455 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
c00a5fc71f
avcodec/ffwavesynth: Fix integer overflow in computation of ddphi
...
Fixes: signed integer overflow: 1302123111085380114 - -8319005078741256972 cannot be represented in type 'long'
Fixes: 20991/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5148554161291264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c85bf16318 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
2df0d6520c
avcodec/mpeg12dec: Fix invalid shift in mpeg2_fast_decode_block_intra()
...
Fixes: left shift of negative value -695
Fixes: 19232/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5702856963522560
Fixes: 19555/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5741218147598336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c40df2166c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
781636afa0
avcodec/mpegaudioenc_template: fix invalid shift of sample
...
Fixes: Ticket8010
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a2c97a8342 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
8aee7f743f
avcodec/motion_est_template: Fix invalid shifts in no_sub_motion_search()
...
Fixes: Ticket8167
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e13eee37ee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
575e88e089
avformat/mpegts: Improve the position determination for avpriv_mpegts_parse_packet()
...
Fixes: assertion failure
Fixes: Ticket 8005
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e5bb48ae59 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
ae9ec86ef3
avformat/mvdec: Check stream numbers
...
Fixes: null pointer dereference
Fixes: 20768/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5638648978735104.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 618a9bea65 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
63abfc87a4
avcodec/pcm: Fix invalid shift in AV_CODEC_ID_PCM_LXF
...
Fixes: left shift of 233 by 24 places cannot be represented in type 'int'
Fixes: 20736/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PCM_LXF_fuzzer-4829212685107200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 051d11f659 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
69f0f5a93d
avcodec/qdm2: Check fft_coefs_index
...
Fixes: out of array access
Fixes: 20660/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5658290216501248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9fc73bf022 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
60a912e005
avformat/avidec: Avoid integer overflow in NI switch check
...
Fixes: signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'long'
Fixes: Ticket8149
Found-by: Suhwan
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 347920ca21 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
9c151e45a8
avfilter/vf_aspect: Fix integer overflow in compute_dar()
...
Fixes: signed integer overflow: 1562273630 * 17 cannot be represented in type 'int'
Fixes: Ticket8323
Found-by: Suhwan
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c0ca0f244 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
bc1e30adc6
avcodec/apedec: Fix invalid shift with 24 bps
...
Fixes: left shift of negative value -463
Fixes: 20542/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5688714435231744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e27867229 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Dale Curtis
efaa2a05c0
avformat/utils: Fix undefined behavior in ff_configure_buffers_for_index()
...
When e2_pts == INT64_MIN and e1_pts >= 0 the calculation of
e2_pts - e1_pts will overflow an int64_t.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f15007afa9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
661446f9d6
avcodec/wmalosslessdec: Fix loop in revert_acfilter()
...
Fixes: out of array read
Fixes: 20059/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5691776237305856
No testcase except the fuzzed one.
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5584c0bb94 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
67f6cab06f
avcodec/lagarith: Sanity check scale
...
A value of 24 and above can collaps the range to 0 which would not work.
Fixes: Timeout (75sec -> 21sec)
Fixes: 18707/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LAGARITH_fuzzer-5708950892969984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fb3855342b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
0590a8c671
avcodec/apedec: Fix integer overflows in predictor_decode_mono_3950()
...
Fixes: signed integer overflow: -2147407150 + -1871606 cannot be represented in type 'int'
Fixes: 18702/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5679095417667584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eb64a5c6f9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
cd9734b52e
avcodec/ralf: Fix integer overflow in apply_lpc()
...
Fixes: signed integer overflow: 2147482897 + 2048 cannot be represented in type 'int'
Fixes: 19240/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5743240326414336
Fixes: 19869/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5150136636538880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fd313d8cf8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
e4c08e9419
avcodec/wmavoice: Fix rounding and integer anomalies in calc_input_response()
...
Fixes: out of array access
Fixes: inf is outside the range of representable values of type 'int'
Fixes: signed integer overflow: -9223372036854775808 - 1 cannot be represented in type 'long'
Fixes: 19316/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5677369365102592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38d3758444 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
bfdc0b24a9
avcodec/pcm: Fix invalid shift in pcm_decode_frame for LXF
...
Fixes: left shift of 32 by 28 places cannot be represented in type 'int'
Fixes: 19472/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PCM_LXF_fuzzer-5704364320096256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 985d3666f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
0a8e5bab37
avcodec/snappy: Sanity check bytestream2_get_levarint()
...
Fixes: left shift of 79 by 28 places cannot be represented in type 'int'
Fixes: 20202/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5719004081815552
Fixes: 20219/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5641738677125120
Fixes: 20389/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5680721517871104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be54da2117 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
f3dfc3bf86
avcodec/mlpdsp: Fix a invalid shift in ff_mlp_rematrix_channel()
...
Fixes: left shift of negative value -2
Fixes: 20305/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-5677196618498048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Jai Luthra <me@jailuthra.in >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fcc9f13717 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
43222c987f
avcodec/avdct: Clear IDCTDSPContext context
...
Fixes use of uninitialized variable and segfault
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b82825eba8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
cee643d7fb
avcodec/apedec: Fix undefined integer overflow in decode_array_0000()
...
Fixes: signed integer overflow: -2143289344 - 6246400 cannot be represented in type 'int'
Fixes: 19239/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5173755680915456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a3655bb02c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
d641368fc2
avcodec/smacker: Check space before decoding type
...
Fixes: Timeout (232sec -> 280ms)
Fixes: 19682/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKER_fuzzer-5654129649385472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6f5c18da59 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
ee3429d72c
avcodec/iff: Over-allocate ham_palbuf for HAM6 IFF-PBM
...
IFF-PBM-HAM6 can read out of array without this overallocation
Fixes: Out of array read
Fixes: 19752/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5675331403120640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8652f4e7a1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
06f4f0d613
avfilter/vf_find_rect: Remove assert
...
A score of 0 is possible
Fixes: Ticket8500
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dfc4714886 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
db8487611b
avfilter/vf_find_rect: Increase worst case score
...
score could be 1.0 which lead to uninitialized values
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ff2474e02 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
23a0acd4d1
swscale/input: Fix several invalid shifts related to rgb2yuv constants
...
Fixes: Invalid shifts
Fixes : #8140
Fixes : #8146
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d48e510124 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
b1e6aaa735
swscale/output: Fix several invalid shifts in yuv2rgb_full_1_c_template()
...
Fixes: Invalid shifts
Fixes : #8320
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b7f97532b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
f355bb59d8
swscale/swscale: Fix several invalid shifts related to vChrDrop
...
Fixes: Invalid shifts
Fixes : #8166
Fixes: filter-crop_scale_vflip FATE-test
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6ca22c118 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
51f6e2d7b8
avcodec/hevc_mp4toannexb_bsf: Avoid NULL memcpy()
...
Fixes: invalid memcpy use
Fixes: 19299/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_MP4TOANNEXB_fuzzer-5169193398042624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e23b5a706 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
ff7e2172d3
avcodec/wmalosslessdec: move channel check up
...
Fixes: out of array access
Fixes: 2nd part of 18429/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-6210814364614656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 891bcc4acc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
0dc4c9f745
avcodec/adpcm: Fix overflow in FFABS() IMA_EA_EACS
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 19235/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_EA_EACS_fuzzer-5680878952382464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 794352ae9d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
aefc24beb2
avcodec/alac: Fix integer overflow in LPC coefficient adaption
...
Fixes: signed integer overflow: 267693597 * 10 cannot be represented in type 'int'
Fixes: 19237/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5755407700328448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6a865cec5e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
20acb6d1be
avcodec/g729postfilter: Optimize out overflowing multiplication from apply_tilt_comp()
...
Fixes: signed integer overflow: -1114392282 * 2 cannot be represented in type 'int'
Fixes: 19236/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G729_fuzzer-5741678938030080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c0bd5fa43d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
e095298478
avcodec/vc1dec: Check field_mode for sprites
...
Fixes: Out of array read
Fixes: 19263/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5389219325542400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 32fb919836 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
6be091ce22
avcodec/vc1dec: Limit bits by the actual bitstream size
...
Fixes: Timeout (350 ->19sec)
Fixes: 19249/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-6566896438870016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c56a52a82c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
92503fd8a9
avcodec/vmdaudio: Check block_align more
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 19788/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMDAUDIO_fuzzer-5743379690553344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 06f6857b54 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Gyan Doshi
4591046007
configure: bump year
...
(cherry picked from commit 7b58702cbd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
9f9cedf29f
avcodec/pgssubdec: Free subtitle on error
...
Fixes: Assertion failure
Fixes: 19753/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGSSUB_fuzzer-5688461843759104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b0a718923b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
97de004ad9
avcodec/ffwavesynth: Fix undefined overflow in wavesynth_synth_sample()
...
Fixes: signed integer overflow: 2147464192 + 21176 cannot be represented in type 'int'
Fixes: 19042/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5719828090585088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fa47f6412d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
ceb35853cb
avcodec/cook: Use 3 stage VLC decoding for channel_coupling
...
Fixes: shift exponent -1 is negative
Fixes: out of array read
Fixes: 19028/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5759766471376896
Fixes: 19037/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5734106625474560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 89fd76db71 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
4326c5383d
avcodec/sonic: Check e in get_symbol()
...
Fixes: signed integer overflow: 1721520852 + 1721520852 cannot be represented in type 'int'
Fixes: 18346/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5709623893426176
Fixes: 18753/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5663299131932672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aea6755611 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
97bc7ddc16
avcodec/twinvqdec: Correct overflow in block align check
...
Fixes: signed integer overflow: 538976288 * 8 cannot be represented in type 'int'
Fixes: 19126/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TWINVQ_fuzzer-5687464110325760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4dc93ae3d7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
27846766d8
avcodec/vc1dec: Fix "return -1" cases
...
Reviewed-by: "mypopy@gmail.com " <mypopy@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 26f040bcb4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
f6179e23cf
avcodec/vc1dec: Free sprite_output_frame on error
...
Fixes: memleaks
Fixes: 19471/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5688035714269184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ee9240be3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
a35b01b84a
avcodec/wmadec: Keep track of exponent initialization per channel
...
Fixes: division by 0
Fixes: 19123/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5655493121146880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf5c850b79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
ac221d9cdd
avcodec/adpcm: Clip predictor for APC
...
Fixes: signed integer overflow: -2147483648 - 13 cannot be represented in type 'int'
Fixes: 18893/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_APC_fuzzer-5630760442920960
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9fe07908c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
2df3b2d01d
avcodec/targa: Check colors vs. available space
...
Fixes: Timeout (37sec -> 52ms)
Fixes: 18892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TARGA_fuzzer-5739537854889984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 01593278ce )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
43fe503107
avcodec/wmavoice: Check remaining input in parse_packet_header()
...
Fixes: Infinite loop
Fixes: 18914/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5731902946541568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 19c41969b2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
45eef1be3a
avcodec/wmalosslessdec: Fix 2 overflows in mclms
...
Fixes: signed integer overflow: 2038337026 + 109343477 cannot be represented in type 'int'
Fixes: 18886/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5673660505653248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 92455c8c65 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
300739d589
avcodec/wmaprodec: Fixes integer overflow with 32bit samples
...
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 18860/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAPRO_fuzzer-5755223125786624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a9cc69c0d5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
bf94919fc0
avcodec/adpcm: Fix invalid shift in xa_decode()
...
Fixes: left shift of negative value -1
Fixes: 18859/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_XA_fuzzer-5748474213040128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 50db30b47d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
daf27acf72
avcodec/wmalosslessdec: Fix several integer issues
...
Fixes: shift exponent -1 is negative (and others)
Fixes: 18852/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5660855295541248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec3fe67074 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
758119ca41
avcodec/pnm: Check that the header is not truncated
...
Fixes: Ticket8430
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c94cb8d9b2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
74673ba276
avcodec/mp3_header_decompress_bsf: Check sample_rate_index
...
Fixes: out of array read
Fixes: 19309/clusterfuzz-testcase-minimized-ffmpeg_BSF_MP3_HEADER_DECOMPRESS_fuzzer-5651002950942720
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f064c7c449 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
1d7226ee65
avcodec/apedec: Fix 2 integer overflows
...
Fixes: signed integer overflow: 2119056926 - -134217728 cannot be represented in type 'int'
Fixes: 18728/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5747539563511808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6e15ba2d1f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
7c15568a50
avcodec/wmaprodec: Set packet_loss when we error out on a sanity check
...
Fixes: left shift of negative value -34
Fixes: 18719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAPRO_fuzzer-5642658173419520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a9cbd25d89 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Michael Niedermayer
3510a1869e
avcodec/truemotion2: Fix 2 integer overflows in tm2_low_res_block()
...
Fixes: signed integer overflow: 1778647621 + 574372924 cannot be represented in type 'int'
Fixes: 18692/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-6248679635943424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93d52a181e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-04-23 21:29:01 +02:00
Andreas Rheinhardt
de9507480a
avformat/matroskadec: Fix default value of BlockAddID
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit dbc50f8a93 )
2020-04-03 23:21:13 +02:00
Michael Niedermayer
5df3efbdd6
Update for 2.8.16
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 21:00:24 +01:00
Michael Niedermayer
29ea453b05
avcodec/utils: Check block_align
...
Fixes: out of array access
Fixes: 18432/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5675574936207360
Fixes: 18326/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5071752362721280
Fixes: 18384/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV1_fuzzer-5769439500304384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f011572e66 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
7d76759b59
avcodec/utils: Check sample_rate before opening the decoder
...
Fixes: signed integer overflow: 2 * -1306460384 cannot be represented in type 'int'
Fixes: 17685/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_fuzzer-5747390337777664
Fixes: 17688/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5739287210885120
Fixes: 17699/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5678394531905536
Fixes: 17738/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5763415733174272
Fixes: 17746/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINKAUDIO_RDFT_fuzzer-5703008159006720
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 75fefb1fb7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
4708c410e2
avcodec/g729dec: require buf_size to be non 0
...
The 0 case was added with the support for multiple packets. It
appears unintended and causes extra complexity and out of array
accesses (though within padding)
No testcase
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f64be9da4c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
fcc8c187fb
avcodec/alac: Fix integer overflow in lpc_prediction() with sign
...
Fixes: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
Fixes: 18643/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5672182449700864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7686ba1f14 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
50dfc2dbf9
avcodec/wmaprodec: Fix buflen computation in save_bits()
...
Fixes: Assertion failure
Fixes: 18630/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAPRO_fuzzer-5201588654440448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 589cb44498 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
f6c63ac83d
avcodec/vc1_block: Fix integer overflow in AC rescaling in vc1_decode_i_block_adv()
...
Fixes: signed integer overflow: 50176 * 262144 cannot be represented in type 'int'
Fixes: 18629/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5182370286403584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e010e489b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
4bfb9fa3fc
avcodec/vmdaudio: Check chunk counts to avoid integer overflow
...
Fixes: signed integer overflow: 4 * 538976288 cannot be represented in type 'int'
Fixes: 18622/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMDAUDIO_fuzzer-5092166174507008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47d963335e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
9640ed3da0
avformat/mxfdec: Clear metadata_sets_count in mxf_read_close()
...
This avoids problems if the function is called twice
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 13816a1d08 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
ce61019eb1
avcodec/nuv: Use ff_set_dimensions()
...
Fixes: OOM
Fixes: 18956/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-5766505644163072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1ca978d636 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
032650458c
avcodec/ffwavesynth: Fix integer overflow with pink_ts_cur/next
...
Fixes: signed integer overflow: 6175076100092079360 - -5034989061050195840 cannot be represented in type 'long'
Fixes: 18614/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5704508847423488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d82ab96e76 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
971a6493da
avcodec/ralf: Fix integer overflows with the filter coefficient in decode_channel()
...
Fixes: signed integer overflow: 1145975808 - -1146173210 cannot be represented in type 'int'
Fixes: 18616/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5121296757424128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 721624c2f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
33fff42d8d
avcodec/g729dec: Use 64bit and clip in scalar product
...
The G729 reference decoder clips after each individual operation and keeps track if overflow
occurred (in the fixed point implementation), this here is
simpler and faster but not 1:1 the same what the reference does.
Non fuzzed samples which trigger any such overflow are welcome, so
the need and impact of different clipping solutions can be evaluated.
Fixes: signed integer overflow: 1271483721 + 1073676289 cannot be represented in type 'int'
Fixes: 18617/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5137705679978496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf9c4a1275 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
8470f8fd81
avcodec/mxpegdec: Check for multiple SOF
...
Fixes: Timeout (14sec -> 9ms)
Fixes: 18598/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-5726095261564928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 75b64e5aa3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
c005d08103
avcodec/nuv: Move comptype check up
...
Fixes: Timeout (23sec -> 5ms)
Fixes: 18517/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-5753135536013312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1138cdecbe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
22b24fe8ae
avcodec/wmavoice: Fix integer overflow in synth_frame()
...
Fixes: left shift of negative value -3
Fixes: 18518/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-6560514359951360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf323f4d38 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
98510f3c84
avutil/lfg: Correct index increment type to avoid undefined behavior
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 18333/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COMFORTNOISE_fuzzer-5668481831272448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6014bcf1b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
1e57ce1dd5
avcodec/cngdec: Remove AV_CODEC_CAP_DELAY
...
As is the decoder will never stop, it will cause an infinite loop. The RFC seems only
to speak of non empty packets so endlessly generating noise from the last empty flush
packets seems wrong.
Fixes: infinite loop
Fixes: 18333/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COMFORTNOISE_fuzzer-5668481831272448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 327a968817 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
aa8498c417
avcodec/iff: Move index use after check in decodeplane8()
...
Fixes: index 9 out of bounds for type 'const uint64_t [8][256]'
Fixes: 18409/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5767030560522240
Fixes: 18720/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5651995784642560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1f8b36cc4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
67103c565c
avcodec/atrac3: Check for huge block aligns
...
The largest documented frame size = block align is 1024 bytes
(https://wiki.multimedia.cx/index.php/ATRAC3 )
Without a limit this can allocate arbitrary memory and trigger OOM
Fixes: OOM
Fixes: 18337/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3_fuzzer-5763861478637568
Fixes: 18556/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3AL_fuzzer-5646183334936576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f09151fff9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
6248ed92fd
avcodec/ralf: use multiply instead of shift to avoid undefined behavior in decode_block()
...
Fixes: left shift of negative value -249
Fixes: 18566/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5649394561187840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b7d02642b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
b48dcc5613
avcodec/wmadec: Require previous exponents for reuse
...
Fixes: division by zero
Fixes: 18474/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5764986962182144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c54b9fc42f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
40872346be
avcodec/vc1_block: Fix undefined behavior in ac prediction rescaling
...
The intermediates are required to fit in 12bit (8.1.3.9 Coefficient Scaling)
See SMPTE 421M-2006 and Amendment 1-2007
Fixes: signed integer overflow: -20691 * 262144 cannot be represented in type 'int'
Fixes: 18479/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5128912371187712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7fc1baf0ca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
0e40a839bb
avcodec/apedec: Fixes integer overflow of res+*data in do_apply_filter()
...
Fixes: signed integer overflow: 7400 + 2147482786 cannot be represented in type 'int'
Fixes: 18405/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5708834760294400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dc3f327e74 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
e710fd6a83
avcodec/sonic: Fix integer overflow in predictor_calc_error()
...
Fixes: signed integer overflow: 5 * -1094995529 cannot be represented in type 'int'
Fixes: 18346/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5709623893426176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8c17b8cef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Carl Eugen Hoyos
fbc6717495
lavc/tableprint_vlc: Remove avpriv_request_sample() from included files.
...
Fixes compilation with --enable-hardcoded-tables.
Fixes ticket #7962 .
(cherry picked from commit c8232e5007 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
c8f306fc0b
avcodec/adpcm: Fix undefined behavior with negative predictions in IMA OKI
...
Fixes: left shift of negative value -30
Fixes: 18392/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_OKI_fuzzer-5631771831435264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7786f6c30e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
e53182c467
avcodec/cook: Move up and extend block_align check
...
Fixes: signed integer overflow: 2046820356 * 8 cannot be represented in type 'int'
Fixes: 18391/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5631674666188800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1c63edcdd2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:58 +01:00
Michael Niedermayer
20facd705e
avcodec/twinvq: Check block_align
...
Fixes: signed integer overflow: 538976288 * 8 cannot be represented in type 'int'
Fixes: 18348/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_METASOUND_fuzzer-6681325716635648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 97f778e9c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
6ef666f4a6
avcodec/cook: Enlarge gain table
...
Fixes: index 25 out of bounds for type 'float [23]'
Fixes: 18355/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5641398941908992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 50001cd440 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
6f4c963d61
avcodec/atrac3plus: Check split point in fill mode 3
...
Fixes: index 32 out of bounds for type 'int [32]'
Fixes: 18350/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3P_fuzzer-5643794862571520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit de5102fd92 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
f1b32668dc
avcodec/wmavoice: Check sample_rate
...
Fixes: left shift of 538976288 by 8 places cannot be represented in type 'int'
Fixes: 18376/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5741645391200256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 55c97a7637 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
f5fdab6b0e
avcodec/apedec: Fix integer overflow in filter_3800()
...
Fixes: signed integer overflow: 2117181180 + 60483298 cannot be represented in type 'int'
Fixes: 18344/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5685327791915008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1c038c5c63 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
31ae31c21e
avcodec/ffv1dec: Use a different error message for the slice level CRC
...
This way they can be told apart easily
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df498cf544 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
7a5c2173fe
avcodec/apedec: Fix undefined integer overflow in long_filter_ehigh_3830()
...
Fixes: signed integer overflow: -1094995529 * 2 cannot be represented in type 'int'
Fixes: 18281/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5692589180715008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1d1719a44d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
ef9340a9dc
avcodec/snowenc: Fix 2 undefined shifts
...
Fixes: Ticket7990
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8802e329c8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
5729bbfdc7
avformat/nutenc: Do not pass NULL to memcmp() in get_needed_flags()
...
This compared to the other suggestions is cleaner and easier to understand
keeping the condition in the if() simple.
This affects alot of fate tests.
See: [FFmpeg-devel] [PATCH 05/11] avformat/nutenc: Don't pass NULL to memcmp
See: [FFmpeg-devel] [PATCH]lavf/nutenc: Do not call memcmp() with NULL argument
Fixes: Ticket 7980
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e4fdeb3fce )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
d7ebf3a074
avcodec/truemotion2: Fix several integer overflows in tm2_low_res_block()
...
Fixes: signed integer overflow: 1077952576 + 1355863565 cannot be represented in type 'int'
Fixes: 16196/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5679842317565952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b655f55ea )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
5ebb902caf
avcodec/adpcm: Fix invalid shifts in ADPCM DTK
...
Fixes: left shift of negative value -1
Fixes: 18397/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_DTK_fuzzer-5675653487132672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 34e701ff93 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
1f183e8cc8
avcodec/apedec: Only clear the needed buffer space, instead of all
...
Fixes: Timeout (15sec -> 0.4sec)
Fixes: 18396/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5730080487112704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f17ea02001 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
62eced0903
avcodec/libvorbisdec: Fix insufficient input checks leading to out of array reads
...
Fixes: 16144/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVORBIS_fuzzer-5638618940440576
Fixes: out of array read
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 069be4aa5d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
f1a20096f7
avcodec/vp5: Check render_x/y
...
Fixes: Timeout (15sec -> 91ms)
Fixes: 18353/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP5_fuzzer-5704150326706176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 698e042c77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
08a0c3cd17
avcodec/ralf: Skip initializing unused filter variables
...
Fixes: left shift of negative value -1
Fixes: 17890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5643307467669504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f4ecf6c39d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
cf5945613f
avformat/pjsdec: Check duration for overflow
...
Fixes: signed integer overflow: -3 - 9223372036854775807 cannot be represented in type 'long'
Fixes: 17828/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5645915116797952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1efaac6932 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
d85af33e05
avcodec/ptx: Check that the input contains at least one line
...
Fixes: Timeout (19sec -> 44ms)
Fixes: 17816/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PTX_fuzzer-5704459950227456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6ad328256 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
50947f65e0
avcodec/alac: Fix integer overflow in LPC
...
Fixes: signed integer overflow: 2147483628 + 128 cannot be represented in type 'int'
Fixes: 17783/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5146470595952640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 44b73a0568 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
684fbde543
avcodec/smacker: Fix integer overflows in pred[] in smka_decode_frame()
...
Fixes: signed integer overflow: -2147481503 + -32732 cannot be represented in type 'int'
Fixes: 17782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKAUD_fuzzer-5769672225456128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a76897e19c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
cdb193839a
avcodec/aliaspixdec: Check input size against minimal picture size
...
Fixes: Timeout (15sec -> 72ms)
Fixes: 17774/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALIAS_PIX_fuzzer-5193929107963904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c69310477 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
77847fd19e
avcodec/ffwavesynth: Fix integer overflows in pink noise addition
...
Fixes: signed integer overflow: -1795675744 + -1926578528 cannot be represented in type 'int'
Fixes: 17741/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5131336402075648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7916b6863c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
d9123585d1
avcodec/vc1_block: Fixes integer overflow in vc1_decode_i_block_adv()
...
Fixes: signed integer overflow: 62220 * 262144 cannot be represented in type 'int'
Fixes: 17145/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5667394743173120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6fdeb20817 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
a3692f4041
avcodec/wmalosslessdec: Check block_align
...
Fixes: NULL pointer dereference
Fixes: 18331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5652847445671936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1c799271e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
366cfe1615
avcodec/g729postfilter: Fix left shift of negative value
...
Fixes: Ticket8176
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f0acc5064 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
8b462c958a
avcodec/binkaudio: Check sample rate
...
Fixes: signed integer overflow: 1092624416 * 2 cannot be represented in type 'int'
Fixes: 18045/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINKAUDIO_RDFT_fuzzer-5718519492116480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2fca09bce4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
68a8bdf5f1
avcodec/adpcm: Check initial predictor for ADPCM_IMA_EA_EACS
...
Fixes: signed integer overflow: -2147483360 - 631 cannot be represented in type 'int'
Fixes: 17701/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_EA_EACS_fuzzer-5711517319692288
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f66e8436d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
dad5ed01a8
avcodec/apedec: Fix integer overflow in predictor_update_3930()
...
Fixes: signed integer overflow: -69555262 * 31 cannot be represented in type 'int'
Fixes: 17698/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5728970447781888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c072c9ed7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
7187b14d9b
avcodec/g729postfilter: Fix undefined intermediate pointers
...
Fixes: index -49 out of bounds for type 'int16_t [192]'
Fixes: 17689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5756275014500352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c61661a2c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
79532fa945
avcodec/g729postfilter: Fix undefined shifts
...
Fixes: left shift of negative value -12
Fixes: 17689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5756275014500352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6a4fdbf112 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
23d226fe42
avcodec/lsp: Fix undefined shifts in lsp2poly()
...
Fixes: left shift of negative value -30635
Fixes: 17689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5756275014500352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b93f52cd6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
68b62e36eb
avcodec/adpcm: Fix left shifts in AV_CODEC_ID_ADPCM_EA
...
Fixes: left shift of negative value -1
Fixes: 17683/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_EA_R2_fuzzer-5111690013704192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8695fbec57 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
560770d32b
avfilter/vf_geq: Use av_clipd() instead of av_clipf()
...
With floats we cannot represent all 32bit integer dimensions
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8813b1a98 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
bd5a214c3c
avcodec/ituh263dec: Check input for minimal frame size
...
Fixes: Timeout (28sec -> 3sec)
Fixes: 17559/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H263_fuzzer-5681050776240128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f0498ed46 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
9c6e76eee7
avcodec/truemotion1: Check that the input has enough space for a minimal index_stream
...
Fixes: Timeout (18sec -> 0.4sec)
Fixes: 17585/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION1_fuzzer-5117015135617024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a660fac98 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
5591681af1
avformat/mpsubdec: Clear queue on error
...
Fixes: Memleaks
Fixes: 17219/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5720539124989952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9a0d36e562 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
e4667a6991
avcodec/sunrast: Check that the input is large enough for the maximally compressed image
...
Fixes: Timeout (17sec -> 15ms)
Fixes: 17224/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SUNRAST_fuzzer-5663218491457536
Fixes: 17224/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SUNRAST_fuzzer-5735590015795200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf0ba75c4a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
18f91bc819
avcodec/sunrast: Check for availability of maplength before allocating image
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 711ad71aea )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
9b424ca5d2
avformat/subtitles: Check nb_subs in ff_subtitles_queue_finalize()
...
Fixes: null pointer dereference
Fixes: 17828/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5645915116797952
Fixes: Ticket8147
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 81b53913bb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
3690b8684f
avcodec/g2meet: Check for end of input in jpg_decode_block()
...
Fixes: Timeout (100sec -> 0.7sec)
Fixes: 8668/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5174143888130048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 61dd2e07be )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
214556b9d9
avcodec/g2meet: Check if adjusted pixel was on the stack
...
This basically checks if a pixel that was coded with prediction
and residual could have been stored using a previous case.
This avoids basically a string of 0 symbols stored in less than
50 bytes to hit a O(n²) codepath.
Fixes: Timeout (too slow to wait -> immediately)
Fixes: 8668/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-4895946310680576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c84c162e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
5812f834d4
avcodec/motionpixels: Mark 2 functions as always_inline
...
Fixes: Timeout (30sec -> 25sec)
Fixes: 17050/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOTIONPIXELS_fuzzer-5719149803732992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 017884bdc3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
923bcf0c3f
avcodec/ralf: Fix integer overflow in decode_channel()
...
Fixes: signed integer overflow: -1094995519 * 64 cannot be represented in type 'int'
Fixes: 17030/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5640695838146560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fbb314b6f2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
4d97765898
vcodec/vc1: compute rangex/y only for P/B frames
...
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int'
Fixes: 16976/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-4847262047404032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e75e7fe160 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
446238d170
avcodec/vc1_pred: Fix invalid shifts in scaleforopp()
...
Fixes: left shift of negative value -2
Fixes: 16964/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5757853565976576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ced9a1cd0a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
e5796aa1b9
avcodec/vc1_block: Fix invalid shift with rangeredfrm
...
Fixes: left shift of negative value -7
Fixes: 16959/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-5200360825683968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c722a69253 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
bdacbbba69
avcodec/vc1: Check for excessive resolution
...
Fixes: overflow in aspect ratio calculation
Fixes: signed integer overflow: 393215 * 14594 cannot be represented in type 'int'
Fixes: 15728/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5661588893204480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 181e138da7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
f7218d155e
avcodec/vc1: check REFDIST
...
"9.1.1.43 P Reference Distance (REFDIST)"
"The value of REFDIST shall be less than, or equal to, 16."
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f7af9e294 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
76c86b0ad9
avcodec/apedec: Fix several integer overflows in predictor_update_filter() and do_apply_filter()
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: signed integer overflow: -14527961 - 2147483425 cannot be represented in type 'int'
Fixes: 16380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5645957131141120
Fixes: 16968/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5716169901735936
Fixes: 17074/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5198710497083392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e95a3e8a7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
4b619bad46
avcodec/hevc_cabac: Tighten the limit on k in ff_hevc_cu_qp_delta_abs()
...
Values larger would fail subsequent tests.
Fixes: signed integer overflow: 5 + 2147483646 cannot be represented in type 'int'
Fixes: 16966/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5695709549953024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f63cd1963e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
bdcff3ef0d
avcodec/4xm: Check index in decode_i_block() also in the path where its not used.
...
Fixes: Infinite loop
Fixes: signed integer overflow: 2147483644 + 16 cannot be represented in type 'int'
Fixes: 16169/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5662570416963584
Fixes: 16782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5743163859271680
Fixes: 17641/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5711603562971136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 87ddf9f1ef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
e5ea4e727c
avcodec/atrac3: Check block_align
...
Fixes: Infinite loop
Fixes: 17620/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3_fuzzer-5086123012915200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2acbbe2623 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
e60504a71d
avcodec/alsdec: Avoid dereferencing context pointer in inner interleave loop
...
This makes the decoder faster
Improves/Fixes: Timeout (22sec -> 20sec)
Testcase: 17619/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5078510820917248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 581a895c5c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
bf5e3a4962
avcodec/g729_parser: Check block_size
...
Fixes: Infinite loop
Fixes: 17611/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5765134928052224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 972a0a818f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
880579a763
avcodec/aacdec: Check if we run out of input in read_stream_mux_config()
...
Fixes: Infinite loop
Fixes: 16920/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5653421289373696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3dce4d03d5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
e15fd9bc25
avcodec/smacker: Fix integer overflow in signed int multiply in SMK_BLK_FILL
...
Fixes: signed integer overflow: 238 * 16843009 cannot be represented in type 'int'
Fixes: 16958/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKER_fuzzer-5193905355620352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 033d2c4884 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
2f095670c8
avcodec/alac: fix undefined behavior with INT_MIN in lpc_prediction()
...
Fixes: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
Fixes: 16786/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5632818851348480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0831cbfe09 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
40d3103d36
avcodec/ffwavesynth: Fix integer overflow in timestamps
...
Fixes: signed integer overflow: 9223371075321077760 * 2 cannot be represented in type 'long'
Fixes: 16447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5698937431785472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c7ccbf40ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
0e406d2008
avcodec/sunrast: Fix indention
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0728d64497 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
fc6664cb2a
avcodec/sunrast: Fix return type for "unsupported (compression) type"
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e8b7709a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
a6f50a53cf
avformat/cdxl: Fix integer overflow in intermediate
...
Fixes: signed integer overflow: 65535 * 65312 cannot be represented in type 'int'
Fixes: 16704/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6294115603447808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c5575c8dc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
2a306730a4
avcodec/hevcdec: repeat character in skiped
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d2d8e797cc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
668d797a57
avcodec/alsdec: Check k from being outside what our implementation can handle
...
The specification does not seem to list what the maximum valid
value is
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 16268/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5638164544225280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e125578994 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
80d27aaf70
avcodec/vp56rac: delay signaling an error on truncated input
...
A threshold of 1 is sufficient for simple_dump_cut.webm, 10 is used
just to be sure the next truncated file doesnt cause the same issue
Obvious alternative fixes are to simply accept that the file is broken or to
write some advanced error concealment or to
simply accept that the decoder wont stop at the end of input.
Fixes: Ticket 8069 (artifacts not the differing md5 which was there before 1afd246960 )
Fixes: simple_dump_cut.webm
Fixes: regression of 1afd246960
fate-vp5 changes because the last frame is truncated and now handled
differently.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b6b9ac5698 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 70fb3fa990d604211d5b24fc43cdfe31560de250)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
8fecba0aa7
avcodec/vp5/6/8: use vpX_rac_is_end()
...
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab56e62e8f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1dd89192c59df0d6655e9308a0782d8c7b259b18)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
04acafdc7c
avcodec/vp56: Add vpX_rac_is_end() to check for the end of input
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0fb83b4c91 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
0e704512b5
avcodec/qdm2: Check frame size
...
Fixes: index 2304 out of bounds for type 'float [2304]'
Fixes: 16332/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5679142481166336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 12b909ba31 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
c01055a1ff
avcodec/vc1_pred: Fix refdist in scaleforopp()
...
Fixes: out of array access
Fixes: 16601/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5656105392275456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 413e0f2516 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
feaf42eb0d
avcodec/vorbisdec: fix FASTDIV usage for vr_type == 2
...
This reverts a hunk from f1ca40ee00
Fixes: out of array read
Fixes: 16924/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5157893162139648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 722fd46965 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
08e46a341a
avcodec/iff: Check for overlap in cmap_read_palette()
...
Fixes: undefined memcpy() use
Fixes: 16302/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5678750575886336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dfa5d1a366 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
6bfec5efc4
avcodec/apedec: Fix 32bit int overflow in do_apply_filter()
...
Fixes: signed integer overflow: 2147480546 + 4096 cannot be represented in type 'int'
Fixes: 16280/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5123442566758400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d3ddef519 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
ac0ffb67f5
avcodec/ralf: fix undefined shift in extend_code()
...
Fixes: left shift of negative value -3
Fixes: 16147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5658392722407424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4778407ab3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
1da3f1084e
avcodec/ralf: fix undefined shift
...
Fixes: left shift of negative value -2
Fixes: 16145/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5146671058518016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ee886988e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
b74d119ee6
avcodec/bgmc: Check input space in ff_bgmc_decode_init()
...
Fixes: Infinite loop
Fixes: 16608/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5636229827133440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b54031a6e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
d35b7197dd
avcodec/truemotion2: Fix multiple integer overflows in tm2_null_res_block()
...
Fixes: signed integer overflow: 1795032576 + 598344192 cannot be represented in type 'int'
Fixes: 16196/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5636723419119616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cc78783ce5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
4b2c2d787c
avcodec/vc1dec: Require res_sprite for wmv3images
...
non res_sprite leads to decoder delay which leads to assertion failure
Fixes: Assertion failure
Fixes: 16402/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5704510034411520
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int'
Fixes: 16425/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5692858838810624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c6b400492 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
720c2deb02
avcodec/vc1_block: Check for double escapes
...
Fixes: out of array read
Fixes: 16331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5672735195267072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6962fd586e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
7954bc8f63
avcodec/vorbisdec: Check get_vlc2() failure
...
Fixes: out of array read
Fixes: 16510/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5754510382727168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 07b948fe60 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
6d6965b7c4
avcodec/tta: Fix integer overflow in prediction
...
Fixes: signed integer overflow: -395281576 + -1827578048 cannot be represented in type 'int'
Fixes: 16038/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5646109705240576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7e9aecc9f3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
c4981bcf07
avcodec/vb: Check input packet size to be large enough to contain flags
...
Fixes: Timeout (->9sec)
Fixes: 16292/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VB_fuzzer-5747063496638464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dea2591d4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
9a46d72235
avcodec/cavsdec: Limit the number of access units per packet to 2
...
Fixes: Timeout (122sec -> 13ms)
Fixes: 15978/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5148925004087296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 37bc8e3249 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:57 +01:00
Michael Niedermayer
db0b447905
avcodec/alac: Fix multiple integer overflows in lpc_prediction()
...
Fixes: signed integer overflow: 2088795537 + 2147254401 cannot be represented in type 'int'
Fixes: signed integer overflow: -1500363496 + -1295351808 cannot be represented in type 'int'
Fixes: signed integer overflow: -79560 * 32640 cannot be represented in type 'int'
Fixes: signed integer overflow: 2088910005 + 2088796058 cannot be represented in type 'int'
Fixes: signed integer overflow: -117258064 - 2088725225 cannot be represented in type 'int'
Fixes: signed integer overflow: 2088725225 - -117258064 cannot be represented in type 'int'
Fixes: 15739/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5630664122040320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ae3d6a337a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:56 +01:00
Michael Niedermayer
72a0e74db9
avcodec/rl2: set dimensions
...
The dimensions are always 320x200 they are hardcoded in the demuxer.
Hardcode them instead in the decoder.
Fixes: Timeout (16sec -> 400ms)
Fixes: 15574/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RL2_fuzzer-5158614072819712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 965e766e48 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-06 20:30:56 +01:00
Michael Niedermayer
d5ab2f5023
avformat/realtextdec: free queue on error
...
Fixes: memleak
Fixes: 16277/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5696629440512000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 493438fafc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 20:58:37 +01:00
Michael Niedermayer
f4c287ed23
avcodec/alsdec: Fix integer overflow in decode_var_block_data()
...
Fixes: signed integer overflow: 1927975249 - -514719744 cannot be represented in type 'int'
Fixes: 16413/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5651206856245248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 661a9b274b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 20:58:37 +01:00
Michael Niedermayer
59f2ec7062
avcodec/alsdec: Limit maximum channels to 512
...
There seems to be no limit in the specification and upto 64k could be stored
512 is choosen as limit as thats the maximum in a conformance sample
An alternative to this patch would be a max_channels variable
Fixes: OOM
Fixes: 16200/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5764788793114624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Thilo Borgmann <thilo.borgmann@mail.de >
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f51e4d026c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 20:58:37 +01:00
Michael Niedermayer
1b0aac8f42
avcodec/anm: Check input size for a frame with just a stop code
...
Fixes: Timeout (11sec -> 6sec)
Fixes: 16344/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ANM_fuzzer-5673032000995328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1965161ef6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 20:58:37 +01:00
Michael Niedermayer
e32ef596a9
avcodec/loco: Check left column value
...
Fixes: Timeout (42sec -> 379 ms)
Fixes: 16323/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5679178099195904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c812db814e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 20:58:37 +01:00
Michael Niedermayer
a982163627
avcodec/ffwavesynth: Fixes invalid shift with pink noise seeking
...
Fixes: left shift of negative value -961533698048
Fixes: 16242/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5738550670131200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cdea0206ef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 20:58:37 +01:00
Michael Niedermayer
479361eb92
avcodec/ffwavesynth: Fix integer overflow for some corner case values
...
Fixes: left shift of negative value -14671840
Fixes: 16000/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5145977817661440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4a88fb546 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 20:58:37 +01:00
Michael Niedermayer
6201a60631
avcodec/indeo2: Check remaining input more often
...
Fixes: Timeout (95sec -> 30ms)
Fixes: 14765/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO2_fuzzer-5692455527120896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpe
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 52939a2c57 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 20:58:37 +01:00
Michael Niedermayer
94242dd739
avcodec/vp56: Consider the alpha start as end of the prior header
...
Fixes: Timeout (23sec -> 71ms)
Fixes: 15661/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP6A_fuzzer-6257865947348992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit db78bc1297 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 20:58:37 +01:00
Michael Niedermayer
6eef056cf5
avcodec/4xm: Check for end of input in decode_p_block()
...
Fixes: Timeout (81sec -> 0.2sec)
Fixes: 16169/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5662570416963584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8f92eb05e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 20:58:37 +01:00
Michael Niedermayer
ba3f7c14af
avcodec/hnm4video: Optimize postprocess_current_frame()
...
Improves: Timeout (220sec -> 108sec)
Improves: 15570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HNM4_VIDEO_fuzzer-5085482213441536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cd460f4da0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:49 +01:00
Michael Niedermayer
296a167b3e
avcodec/hevc_refs: Optimize 16bit generate_missing_ref()
...
Fixes: Timeout (86sec -> 8sec) [these numbers assume also "[FFmpeg-devel] [PATCH 2/5] [RFC] avcodec/hevcdec: Check for overread in hls_decode_entry()"]
Fixes: 15702/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5657764929470464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit da8936969f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:49 +01:00
Michael Niedermayer
514164d4e2
avcodec/dds: Use ff_set_dimensions()
...
Fixes: signed integer overflow: 2082471995 * 36 cannot be represented in type 'int'
Fixes: 16025/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DDS_fuzzer-5136663778426880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9cd1e939cf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:49 +01:00
Michael Niedermayer
3538c3476f
avcodec/mpc8: Fix 32bit mask/enum
...
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 15817/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC8_fuzzer-5636626409062400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e8bb949ade )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:49 +01:00
Michael Niedermayer
781aa8f07f
avcodec/alsdec: Fix integer overflows of raw_samples in decode_var_block_data()
...
This also makes the code consistent with the existing similar MUL64()
in decode_var_block_data()
Fixes: signed integer overflow: -7277630735906765035 + -3272193951413647896 cannot be represented in type 'long'
Fixes: 16015/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5666552818434048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fad3ec89b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:49 +01:00
Michael Niedermayer
09a6d81db0
avcodec/alsdec: Fix integer overflow of raw_samples in decode_blocks()
...
Fixes: signed integer overflow: 2147483424 - -1772303236 cannot be represented in type 'int'
Fixes: 15708/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5067890362941440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ce65232406 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:49 +01:00
Michael Niedermayer
3ee68a677d
avcodec/aacdec_template: fix integer overflow in imdct_and_windowing()
...
Fixes: signed integer overflow: 2147483645 + 4 cannot be represented in type 'int'
Fixes: 15418/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5685269069561856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit da93e2b142 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:49 +01:00
Andreas Rheinhardt
a1233d39c6
libavcodec/iff: Use unsigned to avoid undefined behaviour
...
The initialization of the uint32_t plane32_lut matrix uses left shifts
of the form 1 << plane; plane can be as big as 31 which means that this
is undefined behaviour as 1 will be simply an int. So make it unsigned
to avoid this.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f12e662a3d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:49 +01:00
Michael Niedermayer
92c75a313e
avcodec/alsdec: Check for block_length <= 0 in read_var_block_data()
...
Fixes: left shift of negative value -1
Fixes: 15719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5685731105701888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be4fb282f9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:49 +01:00
Michael Niedermayer
5818ae3cff
avcodec/vqavideo: Set video size
...
Fixes: out of array access
Fixes: 15919/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-5657368257363968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 02f909dc24 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:49 +01:00
Michael Niedermayer
1d752c2a05
avcodec/sanm: Check extradata_size before allocations
...
Fixes: Leaks
Fixes: 15349/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5102530557640704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 172a43ce36 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:49 +01:00
Michael Niedermayer
5a7b7fc025
avcodec/mss1: check for overread and forward errors
...
Fixes: Timeout (106sec -> 14ms)
Fixes: 15576/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSS1_fuzzer-5688080461201408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 43015afd7c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:49 +01:00
Michael Niedermayer
af58de8e49
avcodec/dirac_parser: Fix overflow in dts
...
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 15568/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5634719611355136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 549fcba8fc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:49 +01:00
Michael Niedermayer
21d93e0254
avcodec/ralf: Fix undefined pointer in decode_channel()
...
Fixes: 16203/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5086088934195200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3c06ba1716 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:49 +01:00
Michael Niedermayer
0e69785d53
avcodec/ralf: Fix integer overflow in apply_lpc()
...
Fixes: signed integer overflow: 1603085316 + 1238786562 cannot be represented in type 'int'
Fixes: 16203/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5086088934195200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ccca484324 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:49 +01:00
Michael Niedermayer
ef938d8efd
avcodec/vorbisdec: Implement vr->classifications = 1
...
It appears no valid file uses this, so this is not testable with
a valid file.
Fixes: assertion failure
Fixes: 16187/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5638880618872832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5a5f12e3b3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:49 +01:00
Michael Niedermayer
979d982bc1
avcodec/vorbisdec: Check parameters in vorbis_floor0_decode() before divide
...
Fixes: division by zero
Fixes: 16183/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5688966782648320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aecc9b96d6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
787501ae7f
avcodec/apedec: Fix 2 signed overflows
...
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int'
Fixes: signed integer overflow: 2049431315 + 262759074 cannot be represented in type 'int'
Fixes: 16012/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5719016003338240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 392c028cd2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
b4530a6ac8
avcodec/mss3: Check for the rac stream being invalid in rac_normalize()
...
Fixes: out of array read
Fixes: 15982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSA1_fuzzer-5630676251967488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 99a172f3f4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
4748da854a
avcodec/vc1_block: Check get_vlc2() return before use
...
Fixes: index -1 out of bounds for type 'const uint8_t [185][2]'
Fixes: 15720/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSS2_fuzzer-5666071933091840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2cb1f79735 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
cc600fe4b5
avcodec/apedec: Do not partially clear data array
...
Fixes: Assertion failure and memleak
Fixes: 15709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5182435093905408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e4b522c91 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
18013f760b
avcodec/hnm4video: Forward errors of decode_interframe_v4()
...
Fixes: Timeout (108sec -> 160ms)
Fixes: 15570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HNM4_VIDEO_fuzzer-5085482213441536
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9af8ce754b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
d1c2e5a362
avcodec/vp3: Check that theora is theora
...
Theora is forced to be non zero if it is zero and a sample
is asked for, as suggested by reimar
Fixes: Timeout (2min -> 600ms)
Fixes: 15366/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-5737849938247680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b4bf7226af )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
8d6608c04d
avcodec/vc1_pred: Fix invalid shift in scaleforsame()
...
Fixes: left shift of negative value -1
Fixes: 15531/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5759556258365440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6dfda35dd2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
5c1a6ecb98
avcodec/vc1_block: Fix integer overflow in ff_vc1_pred_dc()
...
Fixes: signed integer overflow: 32796 * 65536 cannot be represented in type 'int'
Fixes: 15430/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5735424087031808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f31ed8f3b0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
e6701fa94b
avcodec/truemotion2: Fix several integer overflows in tm2_motion_block()
...
Fixes: 15524/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5173148372172800
Fixes: signed integer overflow: 13701388 - -2134868270 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9a353ea876 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
f7f3c07282
avcodec/apedec: make left/right unsigned to avoid undefined behavior
...
Fixes: signed integer overflow: 755176387 + 1515360583 cannot be represented in type 'int'
Fixes: 15506/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5706859232624640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf778af149 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
f9749f3335
avcodec/apedec: Fix multiple integer overflows and undefined behaviorin filter_3800()
...
Fixes: left shift of negative value -4
Fixes: signed integer overflow: -15091694 * 167 cannot be represented in type 'int'
Fixes: signed integer overflow: 1898547155 + 453967445 cannot be represented in type 'int'
Fixes: 15258/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5759095564402688
Fixes: signed integer overflow: 962196438 * 31 cannot be represented in type 'int'
Fixes: 15364/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5718799845687296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 267eb2ab7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
f2eb30e654
avcodec/eatgv: Check remaining size after the keyframe header
...
The minimal size which unpack() will not fail on is 5 bytes
Fixes: Timeout (14sec -> 77ms) (testcase 15508)
Fixes: 15508/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATGV_fuzzer-5700053513011200
Fixes: 15996/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATGV_fuzzer-5751353223151616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 009ec8dc33 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
8c66aed22b
avcodec/assdec: undefined use of memcpy()
...
Fixes: null pointer passed as argument 2, which is declared to never be null
Fixes: 16008/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SSA_fuzzer-5650582821404672 (this is a separate issue found in this testcase)
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47b6ca0b02 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
e46c1c68c6
avcodec/brenderpix: Check input size before allocating image
...
An incomplete image is not supported prior to this and will
not produce any output. This commit moves the failure before
time consuming operations.
Fixes: Timeout (81sec -> 76ms)
Fixes: 15723/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BRENDER_PIX_fuzzer-5147265653538816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38b6c48c43 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Matt Wolenetz
82094a703e
lafv/wavdec: Fail bext parsing on incomplete reads
...
avio_read can successfully return even when less than the requested
amount of input was read. wavdec's bext parsing mistakenly assumed a
successful avio_read always read the full amount that was requested.
The result could be dictionary tags populated with partially
uninitialized values.
This change also fixes a broken assertion in wav_parse_bext_string that
was off-by-one, though no known current usage of that method hits that
broken case.
Chromium bug: 987270
Signed-off-by: Matt Wolenetz <wolenetz@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 052d41377a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
b47758964a
avcodec/vorbisdec: Check vlc for floor0 dec vector offset
...
Fixes: out of array access
Fixes: 15649/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5729191309344768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 99f95f39c6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
b217b8ed59
avcodec/vorbisdec: amplitude bits can be more than 25 bits
...
Fixes: assertion failure, invalid shift
Fixes: 15583/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5640157484548096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 308771a738 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
0d922de167
avcodec/apedec: Fix various integer overflows
...
Fixes: signed integer overflow: -538976267 * 31 cannot be represented in type 'int'
Fixes: left shift of 65312 by 16 places cannot be represented in type 'int'
Fixes: 15255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5718831688843264
Fixes: 15547/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5691384901664768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 240bf0e596 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
7700ef6737
avcodec/apedec: Fix multiple integer overflows in predictor_update_filter()
...
Fixes: signed integer overflow: -829262115 + -1410750414 cannot be represented in type 'int'
Fixes: 15251/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5651742252859392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0af08cb803 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
b4185cb154
avcodec/alsdec: Fix 2 integer overflows
...
Fixes: signed integer overflow: 1270564968 + 904828220 cannot be represented in type 'int'
Fixes: 15402/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5755426823471104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9cd0d94f59 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
d36bc33bcc
avcodec/flicvideo: Make line_packets int
...
Fixes: signed integer overflow: -32768 * 196032 cannot be represented in type 'int'
Fixes: 15300/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-5733319519502336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 54bd47f861 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
45a306e4c4
avcodec/dvbsubdec: Use ff_set_dimensions()
...
Fixes: signed integer overflow: 65313 * 65313 cannot be represented in type 'int'
Fixes: 15740/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVBSUB_fuzzer-5641749164195840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5941b7f615 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
996accb0d7
avcodec/ffwavesynth: Check if there is enough extradata before allocation
...
Fixes: OOM
Fixes: 15750/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5702090367696896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65bac4a782 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
af0aea414f
avcodec/ffwavesynth: More correct cast in wavesynth_seek()
...
Fixes: signed integer overflow: 553590816 - -9223372036315799520 cannot be represented in type 'long'
Fixes: 15743/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5705835377852416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f4605770af )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
561aefbf8a
avcodec/ffwavesynth: Check sample rate before use
...
Fixes: division by zero
Fixes: 15725/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5641231956180992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c95857a423 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
73556665ec
avformat/utils: Check rfps_duration_sum for overflow
...
Fixes: signed integer overflow: 9151595917793558550 + 297519050751678697 cannot be represented in type 'long'
Fixes: 15496/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5722866475073536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c46fdf305 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
9ad8710d1c
avcodec/parser: Check next index validity in ff_combine_frame()
...
Fixes: out of array access
Fixes: 15522/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DNXHD_fuzzer-5747756078989312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 15008db0fa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
42734c4578
avcodec/ivi: Ask for samples with odd tiles
...
Fixes: Assertion failure
Fixes: 15422/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO5_fuzzer-5676625481433088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a7e02cf3ad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
332a03042d
avformat/xmv: Make bitrate 64bit
...
Fixes: signed integer overflow: 32 * 538976288 cannot be represented in type 'int'
Fixes: 15633/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5752273981931520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 39a6a79bcb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
f2d81316e8
avcodec/pngdec: Check that previous_picture has same w/h/format
...
Fixes: out of array access
Fixes: 15540/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-5684905029140480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 18c808ffbe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
40c3eedd40
avcodec/huffyuv: remove gray8a (the format is listed but not supported by the implementation)
...
Fixes: null pointer dereference
Fixes: 15464/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-5681391150301184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6aaa01afe4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
65c25ad368
avcodec/mpc8: Fixes invalid shift in mpc8_decode_frame()
...
Fixes: left shift of negative value -456
Fixes: 15561/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC8_fuzzer-5758130404720640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1dbb67d39b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
54b3727a49
avcodec/hq_hqa: Use ff_set_dimensions()
...
Fixes: 15530/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-5637370344374272
Fixes: signed integer overflow: 65312 * 65312 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6229fcd40 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
4696370756
avcodec/rv10: Fix integer overflow in aspect ratio compare
...
Fixes: signed integer overflow: 2040 * 1187872 cannot be represented in type 'int'
Fixes: 15368/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV20_fuzzer-5681657136283648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 14fcf42958 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
a70dd95c43
avcodec/4xm: Fix signed integer overflows in idct()
...
Fixes: signed integer overflow: 20242 * 121095 cannot be represented in type 'int'
Fixes: 15310/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5737051745419264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2bbea155bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
76a60fc760
avcodec/qdm2: Check checksum_size for 0
...
Fixes: Infinite loop
Fixes: 15337/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5757428949319680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b2ebf89a4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
2a1e1bc0b5
avcodec/qdm2: error out of qdm2_fft_decode_tones() before entering endless loop
...
Fixes: signed integer overflow: 2147483646 + 2 cannot be represented in type 'int'
Fixes: infinite loop
Fixes: 15396/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5116605501014016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 694be24bd6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
8f5aff9e2d
avcodec/qdm2: Do not read out of array in fix_coding_method_array()
...
Instead we ask for a sample, its unclear what to do in this case.
Fixes: index 30 out of bounds for type 'int8_t [30][64]'
Fixes: 15339/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5749441484554240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ae021c1239 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
7b4cd6ac8e
avcodec/svq3: Use ff_set_dimension()
...
Fixes: OOM
Fixes: 15410/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-5659464805384192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b114d7687 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
a58dfb447e
avcodec/iff: Check ham vs bpp
...
This checks the ham value much stricter and avoids hitting cases which cannot be reached
with data from the libavformat demuxer.
Fixes: out of array access
Fixes: 15320/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5080476840099840
Fixes: 15423/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5630765833912320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f76d7352e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
ace8a759e6
avcodec/ffwavesynth: use uint32_t to compute difference, it is enough
...
Fixes: signed integer overflow: 6494225984479297536 - -6043795377581187040 cannot be represented in type 'long'
Fixes: 15285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5632780307791872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e9dd3c7126 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
d8c85a3464
avcodec/ffwavesynth: Simplify lcg_seek(), avoid negative case
...
Fixes: negation of -9223372036854775808 cannot be represented in type 'int64_t' (aka 'long'); cast to an unsigned type to negate this value to itself
Fixes: 15289/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5709034499342336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c02209935 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
3bb800525e
avcodec/ffwavesynth: Fix backward lcg_seek()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf2bd3ce79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
05a164a4dc
avcodec/vc1_block: Check for vlc error in vc1_decode_ac_coeff()
...
Fixes: index -1 out of bounds for type 'const uint8_t [185][2]'
Fixes: 15250/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5648992869810176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 79204a1fc8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
c583154829
avcodec/alac: Check lpc_quant
...
lpc_quant of 0 produces undefined behavior, thus disallow this.
If valid samples use this then such a sample would be quite
usefull to confirm the correct&lossles handling of this.
Fixes: libavcodec/alac.c:218:25: runtime error: shift exponent -1 is negative
Fixes: 15273/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5656388535058432
Fixes: 15276/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5761238417539072
Fixes: 15315/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5767260766994432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6474b899c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
fa89d0ec88
avcodec/alsdec: Add FF_CODEC_CAP_INIT_CLEANUP
...
Fixes: multiple memleaks
Fixes: 15293/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5642409288925184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b7b6ddd596 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
4e2bf59270
avcodec/alsdec: Fix integer overflow with buffer number
...
Fixes: signed integer overflow: 65313 * 65313 cannot be represented in type 'int'
Fixes: 15290/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5738074249625600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f64f6058e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
a6d53b3028
avcodec/alsdec: Check opt_order / sb_length in ra_block handling
...
Fixes: out of array access
Fixes: 15277/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5184853437317120
Fixes: 15280/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5741062137577472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0794494c8f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
cabdd900b7
avcodec/alsdec: Fix integer overflow with shifting samples
...
Fixes: signed integer overflow: -346039050 * 8 cannot be represented in type 'int'
Fixes: 15283/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5692700268953600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a3bd4b260e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
91c70cc895
avcodec/alsdec: Fix undefined behavior in decode_rice()
...
Fixes: left shift of 72 by 26 places cannot be represented in type 'int'
Fixes: 15279/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5700665621348352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 51f6870c37 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
7a4e69fed4
avcodec/alsdec: Fixes invalid shifts in read_var_block_data() and INTERLEAVE_OUTPUT()
...
Fixes: left shift of negative value -6
Fixes: 15275/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5742361767837696
Fixes: signed integer overflow: 41582592 * 256 cannot be represented in type 'int'
Fixes: 15296/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5739558227935232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e131568752 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
43ced88379
avcodec/apedec: Add k < 24 check to the only k++ case which lacks such a check
...
Fixes: 15255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5718831688843264
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d4f4f4a15 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
1b491fbf25
avcodec/qdm2: Move fft_order check up
...
This avoids undefined computations with unchecked values
Fixes: shift exponent -21 is negative
Fixes: 15262/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5651261753393152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8d8b8c4ac6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
1894a36d6c
avcodec/libvorbisdec: Check extradata size
...
Fixes: out of array read
Fixes: 15261/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVORBIS_fuzzer-5764908467093504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf3c245566 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
3af9317a11
avcodec/videodsp_template: Fix overflow of addition
...
Fixes: addition of unsigned offset to 0x7f56fc26a9b6 overflowed to 0x7f56fc26a8be*
Fixes: clusterfuzz-testcase-minimized-mediasource_MP4_AVC1_pipeline_integration_fuzzer-4917949056679936
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 247a1de7f7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
40a614a5bf
avcodec/ffwavesynth: Check ts_end - ts_start for overflow
...
Fixes: signed integer overflow: 2314885530818453536 - -8926099139098304480 cannot be represented in type 'long'
Fixes: 15259/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5764366093254656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2db7a3bc4a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
006d1a2f80
avcodec/vc1dsp: Avoid undefined shifts in vc1_v_s_overlap_c / vc1_h_s_overlap_c
...
Fixes: left shift of negative value -13
Fixes: 15260/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5702076048343040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 507ca66ee4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
7b9ca45a43
avcodec/tta: Fix undefined shift
...
Fixes: left shift of negative value -4483
Fixes: 15256/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5738691617619968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ebccd2f778 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
58c95520ee
avcodec/bintext: Check font height
...
Fixes: division by zero
Fixes: 15257/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINTEXT_fuzzer-5757352881422336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bfb58bdd70 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
274423dd46
avcodec/binkdsp: Fix integer overflows in idct
...
Fixes: signed integer overflow: 3784 * 682038 cannot be represented in type 'int'
Fixes: 15265/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5088311799971840
Fixes: 15268/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5666502344179712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7a072fbcc4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
7ddb5fcbac
avcodec/motionpixels: Check for vlc error in mp_get_vlc()
...
Fixes: 15246/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOTIONPIXELS_fuzzer-5168534407086080
Fixes: runtime error: index -1 out of bounds for type 'HuffCode [16]'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 930cdef80a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
1d288d16d8
avcodec/loco: Limit lossy parameter so it is sane and does not overflow
...
Fixes: 15248/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5087440458481664
Fixes: signed integer overflow: 3 + 2147483647 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ce3b0b9066 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
677f461508
avformat/mov: Set fragment.found_tfhd only after TFHD has been parsed
...
Fixes: Assertion failure
Fixes: crbug971646.mp4
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 696312c487 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
1df86144e0
avcodec/aacpsdsp_template: Fix integer overflow in ps_hybrid_analysis_c()
...
Fixes: signed integer overflow: -1539565182 + -798086761 cannot be represented in type 'int'
Fixes: 14807/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-564925382682214
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f8f5668df5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
5a7a2180f8
avcodec/truemotion2: Fix integer overflow in last loop in tm2_update_block()
...
Fixes: signed integer overflow: -1727985666 - 538976288 cannot be represented in type 'int'
Fixes: 15031/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5100228035739648
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3aecd01704 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
d3a1a59c22
avcodec/iff: finetune the palette size check in the mask case
...
Fixes: out of array access
Fixes: 15381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5668057826983936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0f9789c8e3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
b9be7f3adf
avcodec/bink: Reorder operations in init to avoid memleak on error
...
Fixes: Direct leak of 536 byte(s) in 1 object(s)
Fixes: 15266/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5629530426834944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2603f25d32 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
990753e81f
avformat/wtvdec: Avoid (32bit signed) sectors
...
Fixes: left shift of negative value -14614752
Fixes: 15174/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5670543606415360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dd357d76e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
1bf0dd08c5
avcodec/bitstream: Check for more conflicting codes in build_table()
...
Fixes: out of array read
Fixes: 14563/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5646451545210880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a7e3b271fc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
5cca0755c7
avcodec/bitstream: Check for integer code truncation in build_table()
...
Fixes: out of array read
Fixes: 14563/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5646451545210880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e78b0f8374 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
28e2f0c51d
avformat/sbgdec: Fixes integer overflow in str_to_time() with hours
...
Fixes: signed integer overflow: 904444 * 3600 cannot be represented in type 'int'
Fixes: 15113/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5764083346833408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2a0f23b9d6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
ea3df2f7be
avcodec/mjpegdec: Check for non ls PAL8
...
Fixes: Null-dereference READ in av_malloc
Fixes: 15002/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-5643474625363968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 442375fee7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
386368fd91
avcodec/mss4: Check input size against skip bits
...
Fixes: Timeout (17sec -> 20ms)
Fixes: 14615/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MTS2_fuzzer-5093007763701760
Fixes: 14797/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MTS2_fuzzer-5651696119709696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0fef412dff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
7e7f52deda
avcodec/diracdec: Fix integer overflow in global_mv()
...
Fixes: signed integer overflow: 16384 * 196607 cannot be represented in type 'int'
Fixes: 14810/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5091232683917312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a99ffb5bb4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
b4aeb407a5
avcodec/vmnc: Check available space against chunks before reget_buffer()
...
Fixes: Timeout (16sec -> 60ms)
Fixes: 14673/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMNC_fuzzer-5640217517621248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 279d9a84af )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
380289beab
avcodec/aacdec_template: skip apply_tns() if max_sfb is 0 (from previous header decode failure)
...
Fixes: NULL pointer dereference
Fixes: 14723/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5654612436058112
Fixes: 14724/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5712607111020544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf3156e762 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
53b314938f
avcodec/aacdec_fixed: Handle more extreem cases in noise_scale()
...
Its unclear if these cases have any relevance in real files
Fixes: shift exponent -2 is negative
Fixes: 14489/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5681941631729664
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d14663f83 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
7f4ac04f30
avcodec/aacdec_template: Merge 3 #ifs related to noise handling
...
Fewer #if and fewer lines
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc33c99d56 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
3d7b7e5331
avcodec/aacdec_fixed: ssign seems always -1 in noise_scale(), simplify
...
(cherry picked from commit 3d5863d739 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
d418ca3786
avformat/mp3enc: Avoid SEEK_END as it is unsupported
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf3ee6a130 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
805e692303
avcodec/truemotion2: Fix several integer overflows in tm2_update_block()
...
Fixes: signed integer overflow: -1877966852 + -469491713 cannot be represented in type 'int'
Fixes: 14561/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5167608359288832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8eecf761a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
fa0caf43c4
avformat/webm_chunk: Specify expected argument length of get_chunk_filename()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1a74b04737 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
3fa90098a9
avformat/webm_chunk: Check header filename length
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3b5b977c9f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
2f8d30fb9b
avcodec/cpia: Check input size also against linesizes and EOL
...
Fixes: Timeout (14sec -> 29ms)
Fixes: 14733/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CPIA_fuzzer-5707022445576192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Carl Eugen Hoyos <ceffmpeg@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3c0bfa7d1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Adam Richter
b55cf5f53d
libswcale: Fix possible string overflow in test.
...
In libswcale/tests/swcale.c, the function fileTest() calls sscanf in
an argument of "%12s" on character srcStr[] and dstStr[], which are
only 12 bytes. So, if the input string is 12 characters, a
terminating null byte can be written past the end of these arrays.
This bug was found by cppcheck.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b8ed493061 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
332de4c1e4
avcodec/hq_hqa: Check available space before reading slice offsets
...
Fixes: Timeout (43sec -> 18sec)
Fixes: 14556/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-5673543024508928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 407e7c34ca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Andreas Rheinhardt
2df8814ae7
lavf/webm_chunk: Respect buffer size
...
The last argument of av_strlcpy is supposed to contain the size of the
destination buffer, but it was filled with the size of the source
string, effectively negating its very purpose.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73ef1f47f5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
9bb9aa9085
avcodec/jvdec: Use ff_get_buffer() when the content is not reused
...
Fixes: Timeout (11sec -> 5sec)
Fixes: 14473/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JV_fuzzer-5761630857592832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 09edcd3572 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
a4bd19c53a
avcodec/truemotion2: Fix 2 integer overflows in tm2_update_block()
...
Fixes: signed integer overflow: -2147483648 + -1 cannot be represented in type 'int'
Fixes: 14107/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5694078680825856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f4a1b8d409 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
7a5f875e98
avcodec/aacdec_fixed: Fix undefined shift in noise_scale()
...
Fixes: 13655/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5120559430500352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ea211ab79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
37b2a19afa
avutil/avstring: Fix bug and undefined behavior in av_strncasecmp()
...
The function in case of n=0 would read more bytes than 0.
The end pointer could be beyond the allocated space, which
is undefined.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6f0e9a8634 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
ef7bef2ba4
avformat/aadec: Check for scanf() failure
...
Fixes: use of uninitialized variables
Fixes: blank.aa
Found-by: Chamal De Silva <chamal.desilva@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ed188f6dcd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
aa152bcaec
avcodec/ccaption_dec: Add a blank like at the end to avoid rollup reading from outside
...
Fixes: index 20 out of bounds for type 'const char *[4][128]'
Fixes: 14367/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CCAPTION_fuzzer-5718819672162304
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f17e8e90bb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
89b9c72862
avcodec/ivi: Move buffer/block end check to caller of ivi_dc_transform()
...
Fixes: assertion failure
Fixes: 14078/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO5_fuzzer-5760571284127744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 110dce9633 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
059f291aaf
avcodec/diracdec: Use 64bit in intermediate of global motion vector field generation
...
It seems the specification does not limit the value to 32bit
Fixes: signed integer overflow: -109611143 * 24 cannot be represented in type 'int'
Fixes: 13477/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5648337460527104
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 837820f385 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:48 +01:00
Michael Niedermayer
12e4877ae2
avcodec/truemotion2: Fix integer overflow in tm2_decode_blocks()
...
Fixes: signed integer overflow: 255 + 2147483634 cannot be represented in type 'int'
Fixes: 13472/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5712444142387200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ad0533e91 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
4bc3382780
avcodec/hevcdec: Avoid only partly skiping duplicate first slices
...
Fixes: NULL pointer dereference and out of array access
Fixes: 13871/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5746167087890432
Fixes: 13845/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5650370728034304
This also fixes the return code for explode mode
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 54655623a8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Carl Eugen Hoyos
8d3764a54d
lavc/bmp: Avoid a heap buffer overwrite for 1bpp input.
...
Found by Mingi Cho, Seoyoung Kim, and Taekyoung Kwon
of the Information Security Lab, Yonsei University.
(cherry picked from commit 1e34014010 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
0b93f59318
avcodec/truemotion2: Fix integer overflow in tm2_null_res_block()
...
Fixes: signed integer overflow: 1111638592 - -2122219136 cannot be represented in type 'int'
Fixes: 13441/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5732769815068672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1223696c72 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
ce5fb015ac
avcodec/dfa: Check the chunk header is not truncated
...
Fixes: Timeout (11sec -> 3sec)
Fixes: 13218/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DFA_fuzzer-5661074316066816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f20760fadb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
f8cb091b6e
avcodec/dvbsubdec: Check object position
...
Reference: ETSI EN 300 743 V1.2.1 7.2.2 Region composition segment
Fixes: Timeout
Fixes: 13325/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVBSUB_fuzzer-5143979392237568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8c5ae4511 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
d3423fb7d4
avcodec/cdgraphics: Use ff_set_dimensions()
...
Fixes: Timeout (17 sec -> 65 milli sec)
Fixes: 13264/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CDGRAPHICS_fuzzer-5711167941509120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9a9f0e239c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
6e926090d3
avcodec/qpeg: Limit copy in qpeg_decode_intra() to the available bytes
...
Fixes: Timeout (27 sec -> 39 milli sec)
Fixes: 13151/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QPEG_fuzzer-5717536023248896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b819472995 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
9a5150b40c
avcodec/aic: Check remaining bits in aic_decode_coeffs()
...
Fixes: Timeout (78 seconds -> 2 seconds)
Fixes: 13186/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AIC_fuzzer-5639516533030912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 951bb7632f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
1ca27e5215
avcodec/bethsoftvideo: Check block_type
...
Fixes: Timeout (17 seconds -> 1 second)
Fixes: 13184/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BETHSOFTVID_fuzzer-5711446296494080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b8ecadec05 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
4797b6092d
avcodec/jpeg2000dwt: Fix integer overflow in dwt_decode97_int()
...
Fixes: runtime error: signed integer overflow: 2147483598 + 128 cannot be represented in type 'int'
Fixes: 12926/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5705100733972480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4801eea0d4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
d555be4ba5
avcodec/error_resilience: Use a symmetric check for skipping MV estimation
...
This speeds up the testcase by a factor of 4
Fixes: Timeout
Fixes: 13100/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV2_fuzzer-5767533905313792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e4289cb253 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
1911fdb7b8
avcodec/mlpdec: Insuffient typo
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fc32e08941 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
da696f9966
avcodec/jvdec: Check available input space before decode8x8()
...
Fixes: Timeout (78 sec -> 15 millisec)
Fixes: 13147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JV_fuzzer-5727107827630080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 61523683c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
8dde01b57b
avformat/webmdashenc: Check id in adaption_sets
...
Fixes: out of array access
Found-by: Wenxiang Qian
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b687b549aa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Wenxiang Qian
423319d157
avformat/http: Fix Out-of-Bounds access in process_line()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 85f91ed760 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Wenxiang Qian
7426a7c958
avformat/ftp: Fix Out-of-Bounds Access and Information Leak in ftp.c:393
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a142ffdcae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
chcunningham
4123064b5f
avformat/mov.c: require tfhd to begin parsing trun
...
Detecting missing tfhd avoids re-using tfhd track info from the previous
moof. For files with multiple tracks, this may make a mess of the
avindex and fragindex, which can later trigger av_assert0 in
mov_read_trun().
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ea87e5d9e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
5f0699d39a
avcodec/pgssubdec: Check for duplicate display segments
...
In such a duplication the previous gets overwritten and leaks
Fixes: memleak
Fixes: 12510/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGSSUB_fuzzer-5694439226343424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e35c3d887b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
61894a612b
avformat/rtsp: Check number of streams in sdp_parse_line()
...
Fixes: OOM
Found-by: Michael Hanselmann <public@hansmi.ch >
Reviewed-by: Michael Hanselmann <public@hansmi.ch >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 497c9b0cce )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
90fbb18a7c
avformat/rtsp: Clear reply in every iteration in ff_rtsp_connect()
...
Fixes: Infinite loop
Found-by: Michael Hanselmann <public@hansmi.ch >
Reviewed-by: Michael Hanselmann <public@hansmi.ch >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0b50f27635 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
54c01b6f94
avcodec/fic: Check that there is input left in fic_decode_block()
...
Fixes: Timeout
Fixes: 12450/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FIC_fuzzer-5661984622641152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit db1c4acd02 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
af857cb62f
avutil/mem: Optimize fill32() by unrolling and using 64bit
...
Reviewed-by: Marton Balint <cus@passwd.hu >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 12b1338be3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
James Almer
d9590afafc
configure: bump year
...
Happy new year!
(cherry picked from commit 3209d7b393 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
1e41754792
avcodec/4xm: Fix returned error codes
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 07607a1db8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
415dd357af
avcodec/mjpegbdec: Fix some misplaced {} and spaces
...
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 11a8d2ccab )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
David Bryant
12dcf732ff
avformat/wvdec: detect and error out on WavPack DSD files
...
Not currently supported.
(cherry picked from commit db109373d8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
gxw
a7f94ae583
avcodec/mips: Fix failed case: hevc-conformance-AMP_A_Samsung_* when enable msa
...
The AV_INPUT_BUFFER_PADDING_SIZE has been increased to 64, but the value is still 32
in function ff_hevc_sao_edge_filter_8_msa. So, use AV_INPUT_BUFFER_PADDING_SIZE directly.
Also, use MAX_PB_SIZE directly instead of 64. Fate tests passed.
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f652c7a45c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
75c53cf09e
avcodec/fic: Fail on invalid slice size/off
...
Fixes: Timeout
Fixes: 11486/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FIC_fuzzer-5677133863583744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 30a7a81cdc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
6cc642cafa
postproc/postprocess_template: Avoid using %4 for the threshold compare
...
This avoids problems if %4 is the stack pointer
the constraints do not allow %4 to be the stack pointer but gcc 9 may
no longer support specifying such constraints
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4325527e1c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 19:41:47 +01:00
Michael Niedermayer
01b179f39b
avcodec/mjpegdec: Fix indention of ljpeg_decode_yuv_scan()
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea30ac1e40 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 15:45:24 +01:00
chcunningham
68be54dfbe
lavf/id3v2: fail read_apic on EOF reading mimetype
...
avio_read may return EOF, leaving the mimetype array unitialized. fail
early when this occurs to avoid using the array in an unitialized state.
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ee1e39a576 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 15:45:24 +01:00
Michael Niedermayer
8381cbf692
avformat/nutenc: Document trailer index assert better
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a95b73abc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 15:45:24 +01:00
chcunningham
acd49222eb
lavf/mov: ensure only one tkhd per trak
...
Chromium fuzzing produced a whacky file with extra tkhds. This caused
an AVStream that was already in use to be corrupted by assigning it a
new id, which blows up later in mov_read_trun because the
MOVFragmentStreamInfo.index_entry now points OOB.
Reviewed-by: Baptiste Coudurier <baptiste.coudurier@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9f7b6f7a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 15:45:24 +01:00
Michael Niedermayer
b3dab0f894
avcodec/msvideo1: Check for too small dimensions
...
Such low resolution would result in empty output as a minimum of 4x4 is needed
We could also check for multiple of 4 dimensions but that is not needed
Fixes: Timeout
Fixes: 11191/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSVIDEO1_fuzzer-5739529588178944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 953bd58861 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 15:45:24 +01:00
Michael Niedermayer
d6b647e221
avcodec/wmv2dec: Skip I frame if its smaller than 1/8 of the minimal size
...
Frames that small are not valid and of limited use for error concealment, while
being very computationally intensive to process.
Fixes: Timeout
Fixes: 11168/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV2_fuzzer-5733782032744448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d6f4341522 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 15:45:24 +01:00
Michael Niedermayer
b84cda4b63
avcodec/msmpeg4dec: Skip frame if its smaller than 1/8 of the minimal size
...
Frames that small are not valid and of limited use for error concealment, while
being very computationally intensive to process.
Fixes: Timeout
Fixes: 11318/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSMPEG4V1_fuzzer-5710884555456512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 09ec182864 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 15:45:24 +01:00
Michael Niedermayer
c78d5c9ce9
avcodec/truemotion2: fix integer overflows in tm2_low_chroma()
...
Fixes: 11295/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-4888953459572736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ae39d7956 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-02 15:45:24 +01:00
Mark Harris
266b784bb3
avutil/mem: Fix invalid use of av_alloc_size
...
The alloc_size attribute is valid only on functions that return a
pointer. GCC 9 (not yet released) warns about invalid usage:
./libavutil/mem.h:342:1: warning: 'alloc_size' attribute ignored on a function returning int' [-Wattributes]
342 | av_alloc_size(2, 3) int av_reallocp_array(void *ptr, size_t nmemb, size_t size);
| ^~~~~~~~~~~~~
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4361293fcf )
2019-07-23 01:21:55 -03:00
James Almer
88588a24e9
avcodec/hevcdec: decode at most one slice reporting being the first in the picture
...
Fixes deadlocks when decoding packets containing more than one of the aforementioned
slices when using frame threads.
Tested-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 70c8c8a818 )
2019-03-20 22:41:29 -03:00
Paul B Mahol
8abdfe8392
avfilter/af_silenceremove: fix possible crash if supplied duration is negative
...
Signed-off-by: Paul B Mahol <onemda@gmail.com >
Fixes ticket #7697 .
(cherry picked from commit 2d1594a8d6 )
2019-01-25 00:56:50 +01:00
Michael Niedermayer
3ae8a4cf06
avcodec/pngdec: Check compression method
...
method 0 (inflate/deflate) is the only specified in the specification and the only supported
Fixes: Timeout
Fixes: 10976/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PNG_fuzzer-5729372588736512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f99674ddd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-16 18:24:34 +01:00
Michael Niedermayer
0728911951
avcodec/shorten: Fix integer overflow with offset
...
Fixes: signed integer overflow: -1625810908 - 582229060 cannot be represented in type 'int'
Fixes: 10977/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5732602018267136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f888771cd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-16 13:18:26 +01:00
Michael Niedermayer
0acb6f692e
avcodec/cavsdec: Propagate error codes inside decode_mb_i()
...
Fixes: Timeout
Fixes: 10702/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5669940938407936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1cee05656 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-04 20:26:04 +01:00
Michael Niedermayer
cf21323dd4
avcodec/mpegaudio_parser: Consume more than 0 bytes in case of the unsupported mp3adu case
...
Fixes: Timeout
Fixes: 10966/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP3ADU_fuzzer-5348695024336896
Fixes: 10969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP3ADUFLOAT_fuzzer-5691669402877952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df91af140c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-04 20:24:22 +01:00
Michael Niedermayer
d8ecb335fe
avformat/flvenc: Check audio packet size
...
Fixes: Assertion failure
Fixes: assert_flvenc.c:941_1.swf
Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6b67d7f059 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-02 19:32:43 +01:00
Michael Niedermayer
6f84b1c458
avutil/integer: Fix integer overflow in av_mul_i()
...
Found-by: fate
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3cc3cb663b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-25 00:24:55 +02:00
Michael Niedermayer
3049d6d821
avcodec/msrle: Check that the input is large enough to contain a end of picture code
...
Fixes: Timeout
Fixes: 10625/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSRLE_fuzzer-5659651283091456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 203ccb8746 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-25 00:24:30 +02:00
Michael Niedermayer
bdd3c7af5e
avcodec/jpeg2000dec: Fix off by 1 error in JPEG2000_PGOD_CPRL handling
...
Fixes: assertion failure
Fixes: 10785/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5672160496975872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 305e523105 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 00:54:29 +02:00
Michael Niedermayer
d74cd4d69a
avcodec/mpeg4videodec: Fix typo in sprite delta check
...
Fixes: Integer overflow
Fixes: 10890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5636062181851136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b737317a88 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 00:53:45 +02:00
Michael Niedermayer
89a8b69e9b
avcodec/h264_cavlc: Check mb_skip_run
...
Fixes: 10300/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-6292205497483264
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f72b9904fe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-19 00:18:01 +02:00
Michael Niedermayer
e42f2eb165
avcodec/ra144: Fix integer overflow in add_wav()
...
Fixes: signed integer overflow: -2144033225 + -5208934 cannot be represented in type 'int'
Fixes: 10633/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-5679133791617024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c6282141cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-18 23:59:13 +02:00
Michael Niedermayer
dc13bac6de
avformat/utils: Never store negative values in last_IP_duration
...
Fixes: integer overflow compute_pkt_fields()
Fixes: compute_pkt_usan
Reported-by: Thomas Guilbert <tguilbert@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 079d1a7175 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-18 12:52:59 +02:00
Michael Niedermayer
6ce3fee455
avformat/utils: Fix integer overflow in discontinuity check
...
Fixes: signed integer overflow: 7738135736989908991 - -7954308516317364223 cannot be represented in type 'long'
Fixes: find_stream_info_usan
Reported-by: Thomas Guilbert <tguilbert@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4e19cfcfa3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-18 12:49:46 +02:00
Michael Niedermayer
604957c557
avcodec/unary: Improve get_unary() docs
...
Found-by: kierank
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ad89e203bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-07 21:05:50 +02:00
Michael Niedermayer
c2f02af696
avcodec/dvdsubdec: Sanity check len in decode_rle()
...
Fixes: Timeout
Fixes: 9778/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVDSUB_fuzzer-5186007132536832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e7b023e1db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-03 12:37:52 +02:00
Michael Niedermayer
49023147c7
avcodec/mpeg4videodec: Fix undefined shift in get_amv()
...
Fixes: runtime error: shift exponent -1 is negative
Fixes: 9938/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5653783529914368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c88afa44c4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-03 12:32:56 +02:00
Michael Niedermayer
79c018351e
avcodec/zmbv: Check that the decompressed data size is correct
...
This checks the value exactly for intra frames and checks it against a
minimum for inter frames as they can be variable.
Fixes: Timeout
Fixes: 10182/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZMBV_fuzzer-6245951174344704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e33b28cc79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-03 12:31:19 +02:00
Michael Niedermayer
edae5259c0
avcodec/zmbv: Update decomp_len in raw frames
...
decomp_len is used in raw frames, so it should not be left at the value from
whatever was decoded previously (which may be any other frame)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d201b83cd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-03 12:06:41 +02:00
Michael Niedermayer
f2640f7648
avcodec/shorten: Fix bitstream end check in read_header()
...
Fixes: Timeout
Fixes: 9961/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5687856176562176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 28b80c2d52 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-09-15 20:03:25 +02:00
Michael Niedermayer
6645783a3a
avcodec/dvdsubdec: Avoid branch in decode_run_8bit()
...
Speed improvment 35.5 sec -> 34.7sec
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 71bf033050 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-09-15 20:02:43 +02:00
Michael Niedermayer
fb0cd972a7
avcodec/h264_refs: Document last if() in ff_h264_execute_ref_pic_marking()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 697984b9db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-09-03 00:09:11 +02:00
Michael Niedermayer
2d65c44f22
avcodec/ra144: Fix undefined integer overflow in add_wav()
...
Fixes: signed integer overflow: -26884 * 91439 cannot be represented in type 'int'
Fixes: 9687/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-4995588121690112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93a203662f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-09-03 00:07:59 +02:00
Michael Niedermayer
db39404c15
avcodec/hq_hqa: Check remaining input bits in hqa_decode_mb()
...
Fixes: Timeout
Fixes: 9634/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-6267852259590144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9222b972d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-08-25 22:16:21 +02:00
Michael Niedermayer
8717129d58
avcodec/vb: Check for end of bytestream before reading blocktype
...
Fixes: Timeout
Fixes: 9601/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VB_fuzzer-4550228702134272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1cbac9ce20 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-08-25 22:15:49 +02:00
Michael Niedermayer
7ddcb02809
avcodec/snowdec: Fix integer overflow with motion vector residual
...
Fixes: signed integer overflow: -19818 + -2147483648 cannot be represented in type 'int'
Fixes: 9545/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-4928769537081344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit acba153a14 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-08-25 22:14:51 +02:00
Michael Niedermayer
898f833863
avformat/nsvdec: Do not parse multiple NSVf
...
The specification states "NSV files may contain a single file header. "
Fixes: out of array access
Fixes: nsv-asan-002f473f726a0dcbd3bd53e422c4fc40b3cf3421
Found-by: Paul Ch <paulcher@icloud.com >
Tested-by: Paul Ch <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 78d4b6bd43 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-08-20 16:10:20 +02:00
Michael Niedermayer
b671ebfd61
avformat/mlvdec: read_string() received unsigned size, make the argument unsigned
...
Fixes: infinite loop
Fixes: mlv-timeout-e3b8cab9835edecad6823baa057e029671329d04
Found-by: Paul Ch <paulcher@icloud.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e71cb2c8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-08-17 21:55:33 +02:00
Michael Niedermayer
bb070fc468
avcodec/shorten: Fix integer overflow in residual/LPC combination
...
Fixes: signed integer overflow: -540538872 + -2012739576 cannot be represented in type 'int'
Fixes: 9255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5758630052757504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit db7e9082e1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-08-16 03:24:47 +02:00
Michael Niedermayer
ed0f21a89a
avcodec/shorten: Check verbatim length
...
Fixes: Timeout
Fixes: 9252/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5780720709533696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7007dabec0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-08-16 03:23:31 +02:00
Michael Niedermayer
a36d649ffc
avcodec/mpegaudio_parser: Initialize poutbuf*
...
Possibly fixes: null pointer dereference
Possibly fixes: 9352/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP3ADUFLOAT_fuzzer-5146068961460224
Fixes: Heap-use-after-free
Fixes: 9453/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP3ADUFLOAT_fuzzer-5137954375729152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0f4c3b0b8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-08-12 22:19:25 +02:00
Michael Niedermayer
b12e1618a3
avcodec/qtrle: Check remaining bytestream in qtrle_decode_XYbpp()
...
Fixes: Timeout
Fixes: 9213/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QTRLE_fuzzer-5649753332252672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7dd836a3f9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-08-03 02:18:56 +02:00
Michael Niedermayer
1c05c6bd91
avcodec/diracdec: Change frame_number to 64bit as its a 32bit from the bitstream and we also have a -1 special case
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 9291/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-6324345860259840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 462d1be6de )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-08-03 02:17:26 +02:00
Michael Niedermayer
00c3f178a8
avcodec/diracdec: Prevent integer overflow in intermediate in global_mv()
...
Fixes: signed integer overflow: -393471 * 5460 cannot be represented in type 'int'
Fixes: 8890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-6299775379963904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5129040646 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-08-03 02:15:43 +02:00
Michael Niedermayer
83ffda78dd
swresample/swresample: Fix input channel count in resample_first computation
...
Found-by: Marcin Gorzel <gorzel@google.com >
Reviewed-by: Marcin Gorzel <gorzel@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bce4da85e8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-08-03 02:14:31 +02:00
Michael Niedermayer
56b188941f
avutil/pixfmt: Document chroma plane size for odd resolutions
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be0b77e6e8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-20 13:15:48 +02:00
Michael Niedermayer
48e104a824
update for 2.8.15
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-15 20:29:24 +02:00
Michael Niedermayer
83679bd293
avcodec/dvdsub_parser: Allocate input padding
...
Fixes: out of array read
Fixes: 9350/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVDSUB_fuzzer-5746777750765568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cd86b5cfe2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-15 20:08:57 +02:00
Michael Niedermayer
d25463c515
avcodec/dvdsub_parser: Init output buf/size
...
No testcase
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e6c843776 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-15 20:07:51 +02:00
Simon Thelen
03af6ab540
avcodec/imgconvert: fix possible null pointer dereference
...
regression since 354b26a394
(cherry picked from commit 8c2c97403b )
(cherry picked from commit c1e172c2e1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-15 19:25:36 +02:00
Rahul Chaudhry
9ffbda72c7
swresample/arm: rename labels to fix xcode build error
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e84212b78e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-13 18:36:55 +02:00
James Almer
7ae182e0b7
avformat/utils: fix mixed declarations and code
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 31de45d20b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 10:51:01 +02:00
James Almer
8199713699
libwebpenc_animencoder: add missing braces to struct initialization
...
The first member of the WebPAnimEncoderOptions struct is non scalar
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 488e6409df )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 10:47:30 +02:00
Michael Niedermayer
5775f83796
avformat/movenc: Check input sample count
...
Fixes: division by 0
Fixes: fpe_movenc.c_199_1.wav
Fixes: fpe_movenc.c_199_2.wav
Fixes: fpe_movenc.c_199_3.wav
Fixes: fpe_movenc.c_199_4.wav
Fixes: fpe_movenc.c_199_5.wav
Fixes: fpe_movenc.c_199_6.wav
Fixes: fpe_movenc.c_199_7.wav
Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a2d21bc5f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
270a7ff111
avcodec/mjpegdec: Check for odd progressive RGB
...
Fixes: out of array access
Fixes: 9225/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-5684770334834688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ee1e3ca5eb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
a80b8a01cc
avformat/movenc: Check that frame_types other than EAC3_FRAME_TYPE_INDEPENDENT have a supported substream id
...
Fixes: out of array access
Fixes: ffmpeg_bof_1.avi
Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ed22dc2221 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
feb31c7ade
avformat/mms: Add missing chunksize check
...
Fixes: out of array read
Fixes: mms-crash-01b6c5d85f9d9f40f4e879896103e9f5b222816a
Found-by: Paul Ch <paulcher@icloud.com >
1st hunk by Paul Ch <paulcher@icloud.com >
Tested-by: Paul Ch <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cced03dd66 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
c75b8c9733
avformat/pva: Check for EOF before retrying in read_part_of_packet()
...
Fixes: Infinite loop
Fixes: pva-4b1835dbc2027bf3c567005dcc78e85199240d06
Found-by: Paul Ch <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9807d3976b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
4652b0f8fe
avcodec/indeo4: Check for end of bitstream in decode_mb_info()
...
Fixes: Timeout
Fixes: 8776/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-5361788798369792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 267ba2aa96 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
29c7a02bb2
avcodec/shorten: Fix undefined addition in shorten_decode_frame()
...
Fixes: signed integer overflow: 1139785606 + 1454196085 cannot be represented in type 'int'
Fixes: 8937/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-6202943597445120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3b10bb8772 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
b6af5c8880
avcodec/jpeg2000dec: Fixes invalid shifts in jpeg2000_decode_packets_po_iteration()
...
Fixes: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 9163/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5661750182543360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 652d7c6348 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
76e10cd327
avcodec/jpeg2000dec: Check that there are enough bytes for all tiles
...
Fixes: OOM
Fixes: 8781/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5810709081358336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0898a3d990 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
f780dabc50
avcodec/escape124: Fix spelling errors in comment
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f59c4e4391 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
65c9c1b061
avcodec/ra144: Fix integer overflow in ff_eval_refl()
...
Fixes: signed integer overflow: -4096 * -524288 cannot be represented in type 'int'
Fixes: 8650/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-5734816036159488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b31189881a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
3b02b9ad2b
avcodec/cscd: Check output buffer size for lzo.
...
Fixes: Timeout
Fixes: 8665/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CSCD_fuzzer-5768442610188288
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit 78167b498f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
9bfdb49b74
avcodec/escape124: Check buf_size against num_superblocks
...
Fixes: Timeout
Fixes: 8722/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-4843268402577408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6677c98626 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
8db6c2993b
avcodec/mjpegdec: Check for end of bitstream in ljpeg_decode_rgb_scan()
...
Fixes: Timeout
Fixes: 8648/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5108395525799936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 540e8c2d64 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
e495910d4c
avcodec/aacdec_fixed: Fix undefined integer overflow in apply_independent_coupling_fixed()
...
Fixes: signed integer overflow: 1195517 * 2048 cannot be represented in type 'int'
Fixes: 8636/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-4695836326887424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8bd514d934 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
c1121e7ec2
avutil/common: Fix undefined behavior in av_clip_uintp2_c()
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 8521/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5639024952737792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa41d322be )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
8326072995
fftools/ffmpeg: Fallback to duration if sample rate is unavailable
...
Regression since: af1761f7
Fixes: Division by 0
Fixes: ffmpeg_crash_1
Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 16d8b13b3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
ed4e35a0fd
avformat/mov: Only set pkt->duration to non negative values
...
Reviewed-by: Sasi Inguva <isasi@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8176799f31 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
cc65755a0d
avcodec/h264_mc_template: Only prefetch motion if the list is used.
...
Fixes: index 59 out of bounds for type 'H264Ref [48]'
Fixes: 8232/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5703295145345024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b55591757 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
2b60986513
avcodec/xwddec: Use ff_set_dimensions()
...
Fixes: OOM
Fixes: 8178/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XWD_fuzzer-4844793342459904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c2852e4e00 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
acfdaa463e
avcodec/wavpack: Fix overflow in adding tail
...
Fixes: signed integer overflow: 2146907204 + 26846088 cannot be represented in type 'int'
Fixes: 8105/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-6233036682166272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d13379fb79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
6fdc61b8f6
avcodec/shorten: Fix multiple integer overflows
...
Fixes: signed integer overflow: 3 * 1006632960 cannot be represented in type 'int'
Fixes: 8278/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5692857166856192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f2abd36b38 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
f41da2bd5f
avcodec/shorten: Sanity check nmeans
...
Fixes: OOM
Fixes: 8195/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5179785826271232
The reference software appears to use longs for 32bits and it uses int for nmeans
hinting that the intended maximum size was not 32bit.
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d91a0b503d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
ce4cb475a3
avcodec/mjpegdec: Fix integer overflow in ljpeg_decode_rgb_scan()
...
Fixes: signed integer overflow: 32768 + 2147450880 cannot be represented in type 'int'
Fixes: 7885/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-5298834394578944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 936f4a2c2e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
ea0734e3f0
avcodec/truemotion2: Fix overflow in tm2_apply_deltas()
...
Fixes: signed integer overflow: 1077952576 + 1077952576 cannot be represented in type 'int'
Fixes: 7712/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5056281753681920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 79c6047c36 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
4c3a7aaea8
avcodec/opus_silk: Change silk_lsf2lpc() slightly toward silk/NLSF2A.c
...
Fixes: runtime error: signed integer overflow: -1440457022 - 785819492 cannot be represented in type 'int'
Fixes: 7700/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OPUS_fuzzer-6595838684954624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e7dda51150 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
832d9accfc
avcodec/amrwbdec: Fix division by 0 in find_hb_gain()
...
This restructures the code slightly toward D_UTIL_dec_synthesis()
Fixes: 7420/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMRWB_fuzzer-6577305112543232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dce80a4b47 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
17ed3c809d
avformat/mov: replace a value error by clipping into valid range in mov_read_stsc()
...
Fixes : #7165
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fe84f70819 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
674929cd46
avformat/mov: Break out early if chunk_count is 0 in mov_build_index()
...
Without this some operations might overflow (undefined behavior)
even though the index adding loop would never execute
No testcase known
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 56e76bd057 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
f98794c73a
avcodec/fic: Avoid some magic numbers related to cursors
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c6a11714c4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
781dcd5db6
avcodec/g2meet: ask for sample with overflowing RGB
...
Suggested-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab834b8f36 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
4c2bb473d3
avcodec/aacdec_fixed: use 64bit to avoid overflow in rounding in apply_dependent_coupling_fixed()
...
Fixes: signed integer overflow: -2141499320 + -14469590 cannot be represented in type 'int'
Fixes: 7351/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-6351214791884800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 90475db97e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
6bbef93883
avcodec/mpeg4videoenc: Use 64 bit for times in mpeg4_encode_gop_header()
...
Fixes truncation
Fixes Assertion n <= 31 && value < (1U << n) failed at libavcodec/put_bits.h:169
Fixes: ffmpeg_crash_2.avi
Found-by: Thuan Pham <thuanpv@comp.nus.edu.sg >, Marcel Böhme, Andrew Santosa and Alexandru RazvanCaciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e1182fac1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
3d4e0858d6
avcodec/mlpdec: Only change noise_type if the related fields are valid
...
Fixes: inconsistency
Fixes:runtime error: index 8 out of bounds for type 'int32_t [8]'
Fixes: 6686/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-5191383498358784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 63c4a4b0d6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
931f837731
indeo4: Decode all or nothing of a band header.
...
This avoids inconsistent value combinations.
Alternatively it would be possible to add more checks and careful use of
temporary variables, but my try of this quickly seemed to become
a rather large change.
The disadvantage of this, is that the struct is copied back and forth.
Fixes: index 6 out of bounds for type 'const uint16_t [5][16]'
Fixes: 6557/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-4787296550256640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 10c8521265 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
854835966b
avformat/mov: Only fail for STCO/STSC contradictions if both exist
...
Fixes regression with playback of GF9720Repeal20the20Eighth20with20Helen20Linehan.m4a
See: crbug 822666
Found-by: "Mattias Wadman <mattias.wadman@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c2d689c56 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
a89f074d89
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD97iH0 / COMPOSE_DD137iL0
...
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int');
Fixes: 6500/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-4523620274536448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cb944fc7f1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
888bdb127b
avcodec/fic: Check available input space for cursor
...
Fixes: out of array read
Fixes: 6546/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FIC_fuzzer-6317064647081984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cb2f7ea96b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
fc097bf1cd
avcodec/g2meet: Check RGB upper limit
...
Fixes: runtime error: left shift of 1876744317 by 16 places cannot be represented in type 'int'
Fixes: 6799/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5115274731716608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4dd2c8b9ea )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
c10babcadc
avcodec/jpeg2000dec: Fix undefined shift in the jpeg2000_decode_packets_po_iteration() CPRL case
...
Fixes: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 7955/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-6016721977606144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 652ba72ed3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
4e9e1ab815
avcodec/jpeg2000dec: Skip init for component in CPRL if nothing is to be done
...
Fixes: assertion failure
Fixes: 7949/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-4819602782552064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a96c131eb5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
02f4e846d2
avcodec/g2meet: Change order of operations to avoid undefined behavior
...
Fixes: signed integer overflow: 65280 * 196032 cannot be represented in type 'int'
Fixes: 7279/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5977332473921536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a47451458 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
8e3918f1db
avcodec/flac_parser: Fix infinite loop
...
Fixes: crbug/827204
Reported-by: Frank Liberato <liberato@google.com >
Reviewed-by: Frank Liberato <liberato@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 15a2e35e9e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
f20c62538b
avcodec/wavpack: Fix integer overflow in DEC_MED() / INC_MED()
...
Fixes: runtime error: signed integer overflow: 2147483637 + 128 cannot be represented in type 'int'
Fixes: 6701/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5358324934508544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6e95d80e6f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:56 +02:00
Michael Niedermayer
9a7a3b2262
avcodec/error_resilience: Fix integer overflow in filter181()
...
Fixes: runtime error: signed integer overflow: 197710 * 10923 cannot be represented in type 'int'
Fixes: 7010/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5667127596941312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1c97035e3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:55 +02:00
Michael Niedermayer
1f057b23c7
avcodec/h263dec: Check slice_ret in mspeg4 slice loop
...
Fixes infinite loop
Fixes: 6858/clusterfuzz-testcase-ffmpeg_AV_CODEC_ID_MSMPEG4V3_fuzzer-4681563766784000
Fixes: 6890/clusterfuzz-testcase-ffmpeg_AV_CODEC_ID_WMV1_fuzzer-4756103142309888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit de841fbea7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:55 +02:00
Michael Niedermayer
6f68d2ca0b
avcodec/elsdec: Fix memleaks
...
Fixes: 6798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5135899701542912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0bd0401336 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:55 +02:00
Michael Niedermayer
60e7be58d9
avcodec/vc1_block: simplify ac_val computation
...
also fixes: runtime error: index 1456 out of bounds for type 'int16_t [16]'
Found-by: durandal_1707
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d06b01fc2d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:55 +02:00
Michael Niedermayer
8eee712737
avcodec/ffv1enc: Check that the crc + version combination is supported
...
The crc flag is only stored since version 3 thus before this crcs do not
work. We increase the version as needed same as we do with pix_fmts
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d9706f79c1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:55 +02:00
Stephan Holljes
1877282323
lavf/http.c: Free allocated client URLContext in case of error.
...
Signed-off-by: Stephan Holljes <klaxa1337@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b6b8c9265 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:55 +02:00
Michael Niedermayer
c7329c733c
avcodec/dsicinvideo: Fail if there is only a small fraction of the data available that comprises a full frame
...
Fixes: Timeout
Fixes: 6306/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DSICINVIDEO_fuzzer-5079253549842432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5549488bbf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:55 +02:00
Michael Niedermayer
a868e804d9
avcodec/dsicinvideo: Propagate errors from cin_decode_rle()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 942217b153 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:55 +02:00
Michael Niedermayer
79cc326bab
avcodec/dfa: Check dimension against maximum
...
The headers from where the dimensions are read in actual files
are limited to 16bit per component.
Fixes: Timeout
Fixes: 6305/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DFA_fuzzer-4824270749302784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d5a4fcfbb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:55 +02:00
Michael Niedermayer
bd7231cad1
avcodec/cinepak: Skip empty frames
...
Speeds up decoding from 3 to 0.1 seconds for 6302/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CINEPAK_fuzzer-5626371985375232
Fixes: Timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9033920bec )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:55 +02:00
Michael Niedermayer
173e04ee85
avcodec/cinepak: move some checks prior to frame allocation
...
Speeds up decoding from 8 to 3 seconds for 6302/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CINEPAK_fuzzer-5626371985375232
Fixes: Timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2324ef1ff3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:55 +02:00
Rahul Chaudhry
e5b29c60f0
swresample/arm: remove unintentional relocation.
...
Branch to global symbol results in reference to PLT, and when compiling
for THUMB-2 - in a R_ARM_THM_JUMP19 relocation. Some linkers don't
support this relocation (ld.gold), while others can end up truncating
the relocation to fit (ld.bfd).
Convert this branch through PLT into a direct branch that the assembler
can resolve locally.
See https://github.com/android-ndk/ndk/issues/337 for background.
The current workaround is to disable neon during gstreamer build,
which is not optimal and can be reverted after this patch:
41556c4157
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b22db4f465 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:55 +02:00
Michael Niedermayer
f337adcd28
doc/APIchanges: Fix typos in hashes
...
Thanks-to: Moritz Barsnick <barsnick@gmx.net > for finding the correct ones
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec8a5262b0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:55 +02:00
Michael Niedermayer
25ecdac8be
avformat/utils: Check cur_dts in update_initial_timestamps() more
...
Fixes: runtime error: signed integer overflow: 18133149658382192 - -9223090561878065151 cannot be represented in type 'long long'
Fixes: crbug 831552
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 37d46dc21d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:55 +02:00
Michael Niedermayer
9af1e014f7
avcodec/utils: Enforce minimum width also for VP5/6
...
Fixes: out of array access
Fixes: poc_0411
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Tested-by: GwanYeong Kim <gy741.kim@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 544324827e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:55 +02:00
Michael Niedermayer
6186bfad38
avcodec/truemotion2: Propagate out of bounds error from GET_TOK()
...
Fixes: Timeout
Fixes: 6389/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5695918121680896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f6304af234 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:55 +02:00
Michael Niedermayer
23dcc9ff7c
avcodec/mjpegdec: Check input buffer size.
...
Fixes: Timeout
Fixes: 6381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-5665032743419904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8d381b57fd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:55 +02:00
Matt Wolenetz
54bde32f37
lavc/libopusdec: Allow avcodec_open2 to call .close
...
If there is a decoder initialization failure detected in avcodec_open2
after .init is called, allow graceful decoder .close to prevent leaking
libopus decoder allocations.
BUG=828526
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e43e97f0e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:55 +02:00
Michael Niedermayer
07cd51f10e
avcodec/movtextdec: Check style_start/end
...
Limits based on 3GPP TS 26.245 V14.0.0
Fixes: Timeout
Fixes: 6377/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOVTEXT_fuzzer-5175929115508736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Philip Langdale <philipl@overt.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 249aca8f98 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:55 +02:00
Michael Niedermayer
01f124da7f
avcodec/aacsbr_fixed: Fix integer overflow in sbr_hf_assemble()
...
Fixes: runtime error: signed integer overflow: 2052929346 + 204817098 cannot be represented in type 'int'
This was missed in b1bef755f6
Fixes: 5275/clusterfuzz-testcase-minimized-5367635958038528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c837918f50 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:52:55 +02:00
Hendrik Schreiber
fe4e35e202
swresample/swresample: Fix for seg fault in swr_convert_internal() -> sum2_float during dithering.
...
Removed +len1 in call to s->mix_2_1_f() as I found no logical explanation for it. After removal, problem was gone.
Signed-off-by: Hendrik Schreiber <hs@tagtraum.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 647fd4b829 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
d3d5382dad
avcodec/aacdec_fixed: Fix integer overflow in apply_independent_coupling_fixed()
...
I was not able to reproduce this, this fix is based on just the fuzzer log.
Fixes: 4959/clusterfuzz-testcase-minimized-6035350934781952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 197a4e8fee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
704bebc91f
avcodec/cscd: Error out when LZ* decompression fails
...
Fixes: Timeout
Fixes: 6304/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CSCD_fuzzer-5754772461191168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d52be5d4e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
heimdallr
eb86546109
avcodec/imgconvert: Fix loss mask bug in avcodec_find_best_pix_fmt_of_list()
...
example:
AVPixelFormat pixFmts[] = { AV_PIX_FMT_RGB24, AV_PIX_FMT_RGBA };
int loss = 0;
AVPixelFormat best = avcodec_find_best_pix_fmt_of_list(pixFmts, AV_PIX_FMT_BGRA, 1, &loss);
best is AV_PIX_FMT_RGB24. But AV_PIX_FMT_RGBA is better.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 354b26a394 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
367d459f78
avcodec/wmalosslessdec: Fix null pointer dereference in decode_frame()
...
Fixes: 2018_03_23_poc.wav
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea15915b2d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
e1aec9bb8d
avcodec/tableprint_vlc: Fix build failure with --enable-hardcoded-tables
...
Found-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c75438b89 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
20e6a8dee8
avcodec/get_bits: Make sure the input bitstream with padding can be addressed
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e529fe7633 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
17f626528a
avformat/mov: Check STSC and remove invalid entries
...
Fixes assertion failure
Fixes: crbug 822547, crbug 822666 and crbug 823009
Affects: aark15sd_9A62E2FA.mp4
Found-by: ClusterFuzz
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e67447a4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
b4e66382c2
avcodec/nuv: rtjpeg with dimensions less than 16 would result in no decoded pixels thus reject it
...
Fixes: Timeout
Fixes: 6297/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-4882404863901696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 939440ad1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
ff58729223
avcodec/nuv: Check for minimum input size for uncomprssed and rtjpeg
...
Fixes: Timeout
Fixes: 6297/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-4882404863901696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ee3265dbe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
1c0914e4f3
avcodec/wmalosslessdec: Reset num_saved_bits on error path
...
Fixes: NULL pointer dereference
Fixes: poc-201803.wav
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 64c9ce0abc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
5770793dec
avformat/mov: Fix integer overflows related to sample_duration
...
Fixes: runtime error: signed integer overflow: -9166684017437101870 + -2495066639299164439 cannot be represented in type
Fixes: Chromium bug 791349
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f37082827 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
6b51dc9223
avformat/oggparseogm: Check lb against psize
...
No testcase, this was found during code review
Found-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3e7c847aaf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
31783dc5fe
avformat/oggparseogm: Fix undefined shift in ogm_packet()
...
Fixes: shift exponent 48 is too large for 32-bit type 'int'
Fixes: Chromium bug 786793
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 010b7b30b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
3b5645a729
avformat/avidec: Fix integer overflow in cum_len check
...
Fixes: signed integer overflow: 3775922176 * 4278190080 cannot be represented in type 'long'
Fixes: Chromium bug 791237
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 06e092e781 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
7d915afd23
avformat/oggparsetheora: Do not adjust AV_NOPTS_VALUE
...
Fixes: Chromium bug 795653
Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'long'
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 02ecda4aba )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
4bcfe9f19c
avformat/utils: Fix integer overflow of fps_first/last_dts
...
Fixes: runtime error: signed integer overflow: 7738135736989908991 - -7898362169240453118 cannot be represented in type 'long'
Fixes: Chromium bug 796778
Reported-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b1362e408 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
5279e86596
libavformat/oggparsevorbis: Fix memleak on multiple headers
...
Fixes: Chromium bug 800123
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3934aa495d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
6d3f8992ac
avcodec/bintext: sanity check dimensions
...
Fixes: Timeout
Fixes: 6277/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XBIN_fuzzer-6047202288861184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 090c0abff9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
e724bd1dd9
avcodec/utvideodec: Check subsample factors
...
Fixes: Out of array read
Fixes: heap_poc
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7414d0bda7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
11d0464565
avcodec/smc: Check input packet size
...
Fixes: Timeout
Fixes: 6261/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMC_fuzzer-5811309653262336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0293663483 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
d81e0f925a
avcodec/cavsdec: Check alpha/beta offset
...
Fixes: Integer overflow
Fixes: 6183/clusterfuzz-testcase-minimized-6269224436629504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ae2eb04648 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
84bf347ff0
avcodec/diracdec: Fix integer overflow in mv computation
...
Fixes: signed integer overflow: -2072 + -2147483646 cannot be represented in type 'int'
Fixes: 6097/clusterfuzz-testcase-minimized-5034145253163008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47e65ad63b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
36a1e9be5a
avcodec/jpeg2000dwt: Fix integer overflows in sr_1d53()
...
Fixes: 5918/clusterfuzz-testcase-minimized-5120505435652096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 793347a545 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
Michael Niedermayer
299b981382
avcodec/diracdec: Use int64 in global mv to prevent overflow
...
Fixes: runtime error: signed integer overflow: 361 * -6295541 cannot be represented in type 'int'
Fixes: 5911/clusterfuzz-testcase-minimized-6450382197751808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cbcbefdc3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-10 01:18:52 +02:00
James Almer
26755a8c6f
avformat/hvcc: zero initialize the nal buffers past the last written byte
...
Prevents use of uninitialized values.
Fixes ticket #7038 .
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 9482ec1b20 )
2018-02-24 00:36:57 -03:00
Michael Niedermayer
3f8a0d5ad1
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 01:11:57 +01:00
Michael Niedermayer
603d23ffeb
avcodec/vp8: Check for bitstream end before vp7_fade_frame()
...
Fixes: Timeout
Fixes: 5653/clusterfuzz-testcase-5497680018014208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit de675648ce )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-18 23:28:53 +01:00
Michael Niedermayer
09dad52390
avcodec/exr: Check remaining bits in last get code loop
...
Fixes: runtime error: shift exponent -7 is negative
Fixes: 3902/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6081926122176512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dd8351b118 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-17 16:11:57 +01:00
Michael Niedermayer
a3c66132d9
avutil/common: Fix integer overflow in av_clip_uint8_c() and av_clip_uint16_c()
...
Fixes: 5567/clusterfuzz-testcase-minimized-5769966247739392
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab6f571ef7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-17 16:11:19 +01:00
Michael Niedermayer
6cfd81b04c
avcodec/h264_cabac: Tighten allowed coeff_abs range
...
Fixes: integer overflows
Reported-by: "Xiaohan Wang (王消寒)" <xhwang@chromium.org >
Based on limits in "8.5 Transform coefficient decoding process and picture
construction process prior to deblocking filter process"
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f26a63c4ee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-15 14:09:54 +01:00
Xiaohan Wang
07e46226ae
avcodec/h264_cavlc: Set valid qscale value in ff_h264_decode_mb_cavlc()
...
When ff_h264_decode_mb_cavlc() failed due to wrong sl->qscale values,
e.g. dquant out of range, set the qscale to be a valid value before
returning -1 and exiting the function. The qscale value can be used
later e.g. in loop filter.
BUG=806122
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 71f39de2a5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-14 01:08:21 +01:00
Michael Niedermayer
d797d9f215
Changelog: Update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-13 00:41:03 +01:00
Michael Niedermayer
89668fa843
avcodec/vp3: Error out on invalid num_coeffs in unpack_vlcs()
...
This fixes a hypothetical integer overflow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f2318aee8c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-12 03:07:59 +01:00
Michael Niedermayer
dd422f1b5e
avcodec/mpeg4videodec: Ignore multiple VOL headers
...
Fixes: Ticket7005
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 63a4bdbf3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-12 03:07:59 +01:00
Michael Niedermayer
66f831a8d1
avcodec/vp3: Check eob_run
...
Fixes: out of array access
Fixes: 5919/clusterfuzz-testcase-minimized-5859311382167552
Fixes: special case for theora (untested due to lack of sample)
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 570023eab3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-12 03:07:59 +01:00
Michael Niedermayer
c402b672b7
avcodec/huffyuvdec: Check input buffer size
...
Fixes: Timeout
Fixes: 5487/clusterfuzz-testcase-4696837035393024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 08c220d26c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-12 03:02:29 +01:00
Michael Niedermayer
263bddf781
avcodec/wavpack: Fix integer overflow in FFABS
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 5396/clusterfuzz-testcase-minimized-6558555529281536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e50bd61e4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-12 03:02:29 +01:00
Michael Niedermayer
5b6324a94c
avcodec/aacsbr_fixed: Fix overflows in rounding in sbr_hf_assemble()
...
Fixes: runtime error: signed integer overflow: 2052929346 + 204817098 cannot be represented in type 'int'
Fixes: 5275/clusterfuzz-testcase-minimized-5367635958038528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b1bef755f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-12 03:02:29 +01:00
James Almer
c95d343ae1
changelog: update with previous commit
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 03292829aa )
2018-01-31 22:35:13 -03:00
Luca Barbato
7a30e6448c
x264: Support version 153
...
It has native simultaneus 8 and 10 bit support.
(cherry picked from commit c6558e8840 )
(cherry picked from commit 96e8400553 )
2018-01-31 22:09:44 -03:00
Michael Niedermayer
172edcf3ba
Update for 2.8.14
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:41 +01:00
Michael Niedermayer
a0c366b1f5
avcodec/indeo5: Do not leave frame_type set to an invalid value
...
Fixes: null pointer dereference
Fixes: 5264/clusterfuzz-testcase-minimized-4621956621008896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ff9f17851 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:16 +01:00
Michael Niedermayer
4abdd65356
avcodec/hevc_ps: Check log2_sao_offset_scale_*
...
Fixes: 4868/clusterfuzz-testcase-minimized-6236542906400768
Fixes: runtime error: shift exponent 126 is too large for 32-bit type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a75a75c62 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:16 +01:00
Aman Gupta
b40576a9a4
avcodec/hevc_ps: extract one SPS fields required for hvcC construction
...
Signed-off-by: Aman Gupta <aman@tmm1.net >
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:15 +01:00
Michael Niedermayer
b6a7dd174a
avcodec/mpeg4videodec: Avoid possibly aliasing violating casts
...
Found-by: kierank
Reviewed-by: Kieran Kunhya <kieran618@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d4967c04e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:15 +01:00
Michael Niedermayer
f606a943d3
avcodec/get_bits: Document the return code of get_vlc2()
...
Found-by: kierank
Reviewed-by: Kieran Kunhya <kieran618@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a94ff4ccd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:15 +01:00
Michael Niedermayer
54a7d3efc4
avcodec/mpeg4videodec: Check mb_num also against 0
...
The spec implies that 0 is invalid in addition to the existing checks
Found-by: <kierank>
Reviewed-by: Kieran Kunhya <kieran618@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 05f4703a16 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:15 +01:00
Michael Niedermayer
ed06873b7b
avfilter/vf_transpose: Fix used plane count.
...
Fixes out of array access
Fixes: poc.mp4
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c6939f65a1 )
(cherry picked from commit 3f621455d6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:15 +01:00
Michael Niedermayer
c740f585a1
avcodec/hevc_cabac: Check prefix so as to avoid invalid shifts in coeff_abs_level_remaining_decode()
...
I suspect that this can be limited tighter, but i failed to find anything
in the spec that would confirm that.
Fixes: 4833/clusterfuzz-testcase-minimized-5302840101699584
Fixes: runtime error: left shift of 134217730 by 4 places cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a026a3efae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:15 +01:00
Michael Niedermayer
c1f7b2b6e1
avcodec/mjpegdec: Fix integer overflow in DC dequantization
...
Fixes: runtime error: signed integer overflow: -65535 * 65312 cannot be represented in type 'int'
Fixes: 4900/clusterfuzz-testcase-minimized-5769019744321536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1bfc1aa004 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:15 +01:00
Michael Niedermayer
193b6df357
avcodec/hevc_cabac: Move prefix check in coeff_abs_level_remaining_decode() down
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 94d4237a7a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:15 +01:00
Michael Niedermayer
25f7121c7b
avcodec/truemotion2: Fix integer overflow in TM2_RECALC_BLOCK()
...
Fixes: signed integer overflow: 1477974040 - -1877995504 cannot be represented in type 'int'
Fixes: 4861/clusterfuzz-testcase-minimized-4570316383715328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 56a53340ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:15 +01:00
Michael Niedermayer
b9948d5275
avcodec/snowdec: Fix integer overflow before htaps check
...
Fixes: runtime error: signed integer overflow: -1094995529 * 2 cannot be represented in type 'int'
Fixes: 4828/clusterfuzz-testcase-minimized-5100849937252352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2eecf3cf8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:15 +01:00
Michael Niedermayer
0036b62c99
avcodec/ulti: Check number of blocks at init
...
Fixes: Timeout
Fixes: 4832/clusterfuzz-testcase-4699096590843904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 725353525e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 23:47:15 +01:00
Michael Niedermayer
b51f1f5a19
avcodec/ac3dec_fixed: Fix integer overflow in scale_coefs()
...
Fixes: runtime error: signed integer overflow: 2147483520 + 128 cannot be represented in type 'int'
Fixes: 4800/clusterfuzz-testcase-minimized-6110372403609600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1f38c7589 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Nikolas Bowe
3e499537a4
avformat/lrcdec: Fix memory leak in lrc_read_header()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ef5994e09d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Nikolas Bowe
5971f1941b
avformat/matroskadec: Fix float-cast-overflow undefined behavior in matroska_parse_tracks()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e07649e618 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Carl Eugen Hoyos
10ed2f1972
configure: bump year
...
Happy new year!
(cherry picked from commit bddf31ba75 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
74aeeb223a
avcodec/arm/sbrdsp_neon: Use a free register instead of putting 2 things in one
...
Fixes high pitched shriek
Fixes: 25420848_1478428308873746_4255813235963330560_n.mp4
Reported-by: Dale Curtis <dalecurtis@google.com >
Reviewed-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7dbbb75ee3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
82fb8dc076
avcodec/h264addpx_template: Fixes integer overflows
...
Fixes: signed integer overflow: 512 + 2147483491 cannot be represented in type 'int'
Fixes: 4780/clusterfuzz-testcase-minimized-4709066174627840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d6945aeee4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
2885e45eb4
avcodec/dirac_dwt: Fix overflows in COMPOSE_HAARiH0/COMPOSE_HAARiL0
...
Fixes: 4830/clusterfuzz-testcase-minimized-5255392054476800
Fixes: signed integer overflow: 2147483646 - -7 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e62a23734 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
c65c4c4759
avcodec/diracdec: Fix integer overflow with quant
...
Fixes: signed integer overflow: 2 + 2147483646 cannot be represented in type 'int'
Fixes: 4792/clusterfuzz-testcase-minimized-6322450775146496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eaa9317589 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
c860d5326f
avcodec/opus_parser: Check payload_len in parse_opus_ts_header()
...
Fixes: clusterfuzz-testcase-minimized-6134545979277312
Fixes: crbug 797469
Reported-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1bcd7fefcb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
a15c056f5c
avcodec/jpeg2000dsp: Fix integer overflows in ict_int()
...
Fixes: signed integer overflow: 46802 * -71230 cannot be represented in type 'int'
Fixes: 4756/clusterfuzz-testcase-minimized-4812495563784192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b3192c64b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
761362fffb
avcodec/h264_slice: Do not attempt to render into frames already output
...
Fixes: null pointer dereference
Fixes: 4698/clusterfuzz-testcase-minimized-5096956322906112
This testcase does not reproduce the issue before 03b82b3ab9
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 476665d4de )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
0abf465dc5
avcodec/exr: Check buf_size more completely
...
Fixes: Out of heap array read
Fixes: 4683/clusterfuzz-testcase-minimized-6152313673613312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 903be5e4f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
2a53778676
avcodec/flacdec: Fix overflow in multiplication in decode_subframe_fixed()
...
Fixes: signed integer overflow: 2 * 1629495328 cannot be represented in type 'int'
Fixes: 4716/clusterfuzz-testcase-minimized-5835915940331520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d23f7a096 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
aae8ea9c18
avcodec/hevcdsp_template: Fix Invalid shifts in put_hevc_qpel_bi_w_h() and put_hevc_qpel_bi_w_w()
...
Fixes: left shift of negative value -1
Fixes: 4690/clusterfuzz-testcase-minimized-6117482428366848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d135f3c514 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
59e3f49ef0
avcodec/flacdec: avoid undefined shift
...
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 4688/clusterfuzz-testcase-minimized-6572210748653568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 560daf8891 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
789157fdde
avcodec/hevcdsp_template.c: Fix undefined shift in FUNC(dequant)
...
Fixes: runtime error: left shift of negative value -180
Fixes: 4626/clusterfuzz-testcase-minimized-5647837887987712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c9ab5ef9c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:15 +01:00
Michael Niedermayer
d0967e3faf
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD97iH0() and COMPOSE_DD137iL0()
...
Fixes: runtime error: signed integer overflow: 2147483646 + 33554433 cannot be represented in type 'int'
Fixes: 4563/clusterfuzz-testcase-minimized-5438979567517696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4d70fbeec8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
4eb24ae083
avcodec/hevc_cabac: Fix integer overflow in ff_hevc_cu_qp_delta_abs()
...
Fixes: signed integer overflow: 2147483647 + 1073741824 cannot be represented in type 'int'
Fixes: 4555/clusterfuzz-testcase-minimized-4505532481142784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ee143558d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
f75e2cb059
avcodec/hevc_sei: Fix integer overflows in decode_nal_sei_message()
...
Fixes: signed integer overflow: 2147483520 + 255 cannot be represented in type 'int'
Fixes: 4554/clusterfuzz-testcase-minimized-4843714515042304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 991ef6e5b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
d1af42e4b2
avcodec/hevcdsp_template: Fix undefined shift in put_hevc_qpel_bi_w_hv()
...
Fixes: runtime error: left shift of negative value -3
Fixes: 4524/clusterfuzz-testcase-minimized-6055590120914944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 439fbb9c8b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Kelly Ledford
b6731e87c8
libavfilter/af_dcshift.c: Fixed repeated spelling error
...
'threshhold' should be 'threshold'
Signed-off-by: Kelly Ledford <kelly.ledford@intel.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc219082bb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Jun Zhao
15df68bf50
avfilter/formats: fix wrong function name in error message
...
Use perdefined micro __FUNCTION__ rather than hard coding function name
to fix wrong function name in error message.
Signed-off-by: Jun Zhao <jun.zhao@intel.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4280948702 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
f4cce67dca
avcodec/amrwbdec: Fix division by 0 in voice_factor()
...
The added value matches "Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS); LTE; Extended Adaptive Multi-Rate - Wideband (AMR-WB+) codec; Floating-point ANSI-C code (3GPP TS 26.304 version 14.0.0 Release 14)
Extended Adaptive Multi-Rate - Wideband (AMR-WB+) codec; Floating-point ANSI-C code"
Fixes: runtime error: division by zero
Fixes: 4415/clusterfuzz-testcase-minimized-4677752314658816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1d0817d56b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
2bffe4613e
avcodec/dirac_dwt: Fix integer overflows in COMPOSE_DAUB97*
...
Fixes: 4478/clusterfuzz-testcase-minimized-4752113767809024
Fixes: runtime error: signed integer overflow: -2147483626 + -319489 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5e9a13a5a3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Dale Curtis
9166e6abd6
avcodec/vorbis: Fix another 1 << 31 > int32_t::max() with 1u.
...
Didn't notice this one when 9648cc6d was landed.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 95bacb521a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Dale Curtis
8bea0c307d
Don't manipulate duration when it's AV_NOPTS_VALUE.
...
This leads to signed integer overflow.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit c5fd57f483 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Dale Curtis
1bc4e743f5
avcodec/vorbis: 1 << 31 > int32_t::max(), so use 1u << 31 instead.
...
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9648cc6d7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Dale Curtis
2543475730
avformat/utils: Prevent undefined shift with wrap_bits > 64.
...
2LL << (wrap_bits=64 - 1) does not fit in int64_t; change the
code to use a uint64_t (2ULL) and add an av_assert2() to
ensure wrap_bits <= 64.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 03fbc0daa7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
cf32c814ed
avcodec/j2kenc: Fix out of array access in encode_cblk()
...
Fixes: 4427/clusterfuzz-testcase-minimized-5106919271301120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0674087004 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
2f7cced9bb
avcodec/hevcdsp_template: Fix undefined shift in put_hevc_epel_bi_w_h()
...
Fixes: runtime error: left shift of negative value -127
Fixes: 4397/clusterfuzz-testcase-minimized-4779061080489984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0409d33311 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
6011422a54
avcodec/mlpdsp: Fix signed integer overflow, 2nd try
...
The outputted bits should match what is used in the lossless check
Fixes: runtime error: signed integer overflow: -538697856 * 256 cannot be represented in type 'int'
Fixes: 4326/clusterfuzz-testcase-minimized-5689449645080576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 97c00edaa0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
32a92a7a9b
avcodec/kgv1dec: Check that there is enough input for maximum RLE compression
...
Fixes: Timeout
Fixes: 4271/clusterfuzz-testcase-4676667768307712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3aad94bf2b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
74d467baa4
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_FIDELITYi*
...
Fixes: runtime error: signed integer overflow: -2143827186 - 7404944 cannot be represented in type 'int'
Fixes: 4354/clusterfuzz-testcase-minimized-4671122764201984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b6964f764 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
ea24e70a6a
avcodec/mpeg4videodec: Check also for negative versions in the validity check
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e7865ce41 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Dale Curtis
ee13d847a4
Close ogg stream upon error when using AV_EF_EXPLODE.
...
Without this there can be multiple memory leaks for unrecognized
ogg streams.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bce8fc0754 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Dale Curtis
78782ca62d
Fix undefined shift on assumed 8-bit input.
...
decode_user_data() attempts to create an integer |build|
value with 8 bits of spacing for 3 components. However
each component is an int32_t, so shifting each component
is undefined for values outside of the 8 bit range.
This patch simply clamps input to 8-bits per component
and prints out a warning that the values were clamped.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7010dd98b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Jacob Trimble
514bdaafb4
avformat/mov: Propagate errors in mov_switch_root.
...
Signed-off-by: Jacob Trimble <modmaker@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d9cf3bf16 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
107606260c
avcodec/hevcdsp_template: Fix invalid shift in put_hevc_epel_bi_w_v()
...
Fixes: runtime error: left shift of negative value -255
Fixes: 4037/clusterfuzz-testcase-minimized-5290998163832832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d88586e47 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
4e5351940f
avcodec/mlpdsp: Fix undefined shift ff_mlp_pack_output()
...
Fixes: runtime error: left shift of negative value -7862264
Fixes: 4074/clusterfuzz-testcase-minimized-4516104123711488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f7f70738e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
90ad2798ae
avcodec/zmbv: Check that the buffer is large enough for mvec
...
Fixes: Timeout
Fixes: 4143/clusterfuzz-testcase-4736864637419520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ab9568a2c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
813d7f4972
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD137iL0()
...
Fixes: 4035/clusterfuzz-testcase-minimized-6479308925173760
Fixes: runtime error: signed integer overflow: 9 * 402653183 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73964680d7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
ee54354fcd
avcodec/wmv2dec: Check end of bitstream in parse_mb_skip() and ff_wmv2_decode_mb()
...
Fixes: Timeout
Fixes: 3200/clusterfuzz-testcase-5750022136135680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65e0a7c473 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
20d6a6fa5a
avcodec/snowdec: Check for remaining bitstream in decode_blocks()
...
Fixes: Timeout
Fixes: 3142/clusterfuzz-testcase-5007853163118592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4527ec2216 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
7d6319e5e6
avcodec/snowdec: Check intra block dc differences.
...
Fixes: Timeout
Fixes: 3142/clusterfuzz-testcase-5007853163118592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c3b9bbcc6e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Fredrik Hubinette
c11ac27f49
avformat/mov: Check size of STSC allocation
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6fdd75fe6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
0af4a5b180
avcodec/h264dec: Fix potential array overread
...
add padding before scantable arrays
See: 522d850e68
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 380b48fb9f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
0a9e416a19
avcodec/x86/mpegvideodsp: Fix signedness bug in need_emu
...
Fixes: out of array read
Fixes: 3516/attachment-311488.dat
Found-by: Insu Yun, Georgia Tech.
Tested-by: wuninsu@gmail.com
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 58cf31cee7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
b0c2e6e2d2
avcodec/aacdec_fixed: Fix undefined shift
...
Fixes: runtime error: left shift of negative value -801112064
Fixes: 3492/clusterfuzz-testcase-minimized-5784775283441664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fca198fb5b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
cd01fc76c4
avcodec/mdct_*: Fix integer overflow in addition in RESCALE()
...
Fixes: runtime error: signed integer overflow: 1219998458 - -1469874012 cannot be represented in type 'int'
Fixes: 3443/clusterfuzz-testcase-minimized-5369987105554432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 770c934fa1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
7de06077c9
avcodec/snowdec: Fix integer overflow in header parsing
...
Fixes: 3984/clusterfuzz-testcase-minimized-5265759929368576
Fixes: runtime error: signed integer overflow: -1085585801 + -1094995529 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c897a92858 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
d8fb143546
avcodec/cngdec: Fix integer clipping
...
Fixes: runtime error: value -36211.7 is outside the range of representable values of type 'short'
Fixes: 2992/clusterfuzz-testcase-6649611793989632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 51090133b3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
efe9439caa
avcodec/sbrdsp_fixed: Fix integer overflow in shift in sbr_hf_g_filt_c()
...
Fixes: runtime error: shift exponent 66 is too large for 64-bit type 'long long'
Fixes: 3642/clusterfuzz-testcase-minimized-5443853801750528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 981e99ab99 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
fd1854647b
avutil/softfloat: Add FLOAT_MIN
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
92eff6b829
avcodec/aacsbr_fixed: Fix division by zero in sbr_gain_calc()
...
Fixes: 3642/clusterfuzz-testcase-minimized-5443853801750528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d1dec4668 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
b75eb7f8d5
avcodec/h264idct_template: Fix integer overflows in ff_h264_idct8_add()
...
Fixes: runtime error: signed integer overflow: -503316480 + -2013265038 cannot be represented in type 'int'
Fixes: 3805/clusterfuzz-testcase-minimized-6578427831255040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e131b8cedb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
1376beb658
avcodec/xan: Check for bitstream end in xan_huffman_decode()
...
Fixes: Timeout
Fixes: 3707/clusterfuzz-testcase-6465922706440192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4b51437dcc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Luca Barbato
907a704c9f
avformat: Free the internal codec context at the end
...
Avoid a use after free in avformat_find_stream_info.
(cherry picked from commit 9e4a5eb51b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
35c1e95b41
avcodec/xan: Improve overlapping check
...
Fixes: memcpy-param-overlap
Fixes: 3612/clusterfuzz-testcase-minimized-6393461273001984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e8fafef1db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
9d4ad2dbfd
avcodec/aacdec_fixed: Fix integer overflow in apply_dependent_coupling_fixed()
...
Fixes: runtime error: signed integer overflow: 623487 * 536870912 cannot be represented in type 'int'
Fixes: 3594/clusterfuzz-testcase-minimized-4650622935629824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 41d96af2a7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
9ef0472b26
avcodec/aacdec_fixed: Fix integer overflow in predict()
...
Fixes: runtime error: signed integer overflow: -2110708110 + -82837504 cannot be represented in type 'int'
Fixes: 3547/clusterfuzz-testcase-minimized-6009386439802880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0976752420 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
9ba9c5a16f
avcodec/jpeglsdec: Check for end of bitstream in ls_decode_line()
...
Fixes: 1773/clusterfuzz-testcase-minimized-4832523987189760
Fixes: Timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f80224ed19 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
3fc5451f40
avcodec/jpeglsdec: Check ilv for being a supported value
...
Fixes: 1773/clusterfuzz-testcase-minimized-4832523987189760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fe533628b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
c48262d857
avcodec/snowdec: Check mv_scale
...
Fixes: runtime error: signed integer overflow: 2 * -1094995530 cannot be represented in type 'int'
Fixes: 3512/clusterfuzz-testcase-minimized-4812747210489856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 393d6fc739 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
c9298f5d02
avcodec/pafvideo: Check for bitstream end in decode_0()
...
Fixes: Timeout
Fixes: 3529/clusterfuzz-testcase-5057068371279872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c85329cd0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
f62201d550
avcodec/ffv1dec: Fix out of array read in slice counting
...
Fixes: test-201710.mp4
Found-by: 连一汉 <lianyihan@360.cn > and Zhibin Hu
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c20f4fcb74 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
23ea9f91c0
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_53iL0()
...
Fixes: runtime error: signed integer overflow: 2147483646 + 2 cannot be represented in type 'int'
Fixes: 3485/clusterfuzz-testcase-minimized-4940429332054016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bdee75a4e7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
0d9baa6d16
avcodec/mpeg_er: Clear mcsel in mpeg_er_decode_mb()
...
Fixes out of array read
Should fix: 3516/clusterfuzz-testcase-minimized-4608518562775040 (not reprodoceable)
Found-by: Insu Yun, Georgia Tech.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 127a362630 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
fd21cec8a9
avcodec/mpeg4videodec: Use 64 bit intermediates for sprite delta
...
Fixes: runtime error: signed integer overflow: -104713 * 65536 cannot be represented in type 'int'
Fixes: 3453/clusterfuzz-testcase-minimized-5555554657239040
Fixes: 3528/clusterfuzz-testcase-minimized-6283628420005888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e38f280fec )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
3929105913
avcodec/truemotion2: Fix integer overflows in tm2_high_chroma()
...
Fixes: runtime error: signed integer overflow: -1408475220 + -1408475220 cannot be represented in type 'int'
Fixes: 3336/clusterfuzz-testcase-minimized-5656839179993088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 44874b4f5e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
1ad7bbfd21
avcodec/aacdec_template: Clear tns present flag on error
...
Fixes: 3444/clusterfuzz-testcase-minimized-6270352105668608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dcf9bae4a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
df66540dd5
avcodec/proresdec2: SKIP_BITS() does not work with len=32
...
Fixes: invalid shift
Fixes: 3482/clusterfuzz-testcase-minimized-5446915875405824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c37138e01a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
c665a93438
avcodec/hevcdsp_template: Fix undefined shift
...
Fixes: runtime error: left shift of negative value -255
Fixes: 3373/clusterfuzz-testcase-minimized-5604083912146944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fbdab6eca7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
6d03495c70
avcodec/jpeg2000: Check that codsty->log2_prec_widths/heights has been initialized
...
Fixes: OOM
Fixes: 2225/clusterfuzz-testcase-minimized-5505632079708160
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 64e034da95 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
13d16a7b99
avcodec/takdec: Fix integer overflow in decode_lpc()
...
Fixes: runtime error: signed integer overflow: 16748560 + 2143729712 cannot be represented in type 'int'
Fixes: 3202/clusterfuzz-testcase-minimized-4988291642294272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d31f03a02 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
66fd3de40a
avcodec/proresdec2: Check bits in DECODE_CODEWORD(), fixes invalid shift
...
Fixes: runtime error: shift exponent 42 is too large for 32-bit type 'unsigned int'
Fixes: 3410/clusterfuzz-testcase-minimized-5313377960198144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f5eaf0b59 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
a0f854b5ff
avcodec/takdec: Fix integer overflows in decode_subframe()
...
Fixes: runtime error: signed integer overflow: -1562477869 + -691460395 cannot be represented in type 'int'
Fixes: 3196/clusterfuzz-testcase-minimized-4528307146063872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3dabb9c69d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
ed5d0bc237
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_FIDELITYi*()
...
Fixes: runtime error: signed integer overflow: 161 * 13872281 cannot be represented in type 'int'
Fixes: 3295/clusterfuzz-testcase-minimized-4738998142500864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 67da2685e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
104d36647c
avcodec/ffv1dec: Fix integer overflow in read_quant_table()
...
Fixes: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 3361/clusterfuzz-testcase-minimized-5065842955911168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d00fc952b6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
a2d129a841
avcodec/svq3: Fix overflow in svq3_add_idct_c()
...
Fixes: runtime error: signed integer overflow: 2147392585 + 524288 cannot be represented in type 'int'
Fixes: 3348/clusterfuzz-testcase-minimized-4809500517203968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c933c5168 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
fd0b42344a
avcodec/pngdec: Clean up on av_frame_ref() failure
...
Fixes: memleak
Fixes: 3203/clusterfuzz-testcase-minimized-4514553595428864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5480e82d77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
a93bbd8aa3
avcodec/jpeg2000dsp: Fix multiple integer overflows in ict_int()
...
Fixes: runtime error: signed integer overflow: 22553 * -188962 cannot be represented in type 'int'
Fixes: 3042/clusterfuzz-testcase-minimized-5174210131394560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d025e7428 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
f51fc65d66
avcodec/hevcdsp_template: Fix undefined shift in put_hevc_pel_bi_w_pixels
...
Fixes: runtime error: left shift of negative value -95
Fixes: 3077/clusterfuzz-testcase-minimized-4684917524922368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c225da68cf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
18e1ef489a
avcodec/diracdec: Fix overflow in DC computation
...
Fixes: runtime error: signed integer overflow: 11896 + 2147483646 cannot be represented in type 'int'
Fixes: 3053/clusterfuzz-testcase-minimized-6355082062856192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5995856a4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
fa65598309
avformat/asfdec: Fix DoS in asf_build_simple_index()
...
Fixes: Missing EOF check in loop
No testcase
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit afc9c683ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
dc4ef664ab
avformat/mov: Fix DoS in read_tfra()
...
Fixes: Missing EOF check in loop
No testcase
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9cb4eb7728 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
Michael Niedermayer
812e06cc82
avcodec/dirac_dwt: Fix multiple overflows in 9/7 lifting
...
Fixes: runtime error: signed integer overflow: 1073901567 + 1073901567 cannot be represented in type 'int'
Fixes: 3124/clusterfuzz-testcase-minimized-454643435752652
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f71cd44147 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 22:56:14 +01:00
James Almer
a1433196b8
avformat/libssh: check the user provided a password before trying to use it
...
Fixes ticket #6413
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 8ddb6820bd )
2018-01-11 10:42:34 -03:00
Michael Niedermayer
7f0359f05e
Changelog: Update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-02 02:16:08 +02:00
孙浩(晓黑)
d686026507
avformat/mxfdec: Fix Sign error in mxf_read_primer_pack()
...
Fixes: 20170829B.mxf
Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com >
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d00fb9d70 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-01 03:20:54 +02:00
孙浩(晓黑)
accf7d34a8
avformat/mxfdec: Fix DoS issues in mxf_read_index_entry_array()
...
Fixes: 20170829A.mxf
Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com >
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 900f39692c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-01 03:04:25 +02:00
孙浩(晓黑)
5b3986023b
avformat/nsvdec: Fix DoS due to lack of eof check in nsvs_file_offset loop.
...
Fixes: 20170829.nsv
Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com >
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c24bcb5536 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-01 03:03:44 +02:00
Michael Niedermayer
74429912dc
avcodec/snowdec: Fix integer overflow in decode_subband_slice_buffered()
...
Fixes: runtime error: signed integer overflow: 267 * 8388608 cannot be represented in type 'int'
Fixes: 2743/clusterfuzz-testcase-minimized-5820652076400640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 732f976456 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-29 21:21:06 +02:00
Michael Niedermayer
1a5b9b3b8e
avcodec/hevc_ps: Fix undefined shift in pcm code
...
Fixes: runtime error: shift exponent -1 is negative
Fixes: 3091/clusterfuzz-testcase-minimized-6229767969832960
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2a83866c9f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-29 21:20:50 +02:00
Michael Niedermayer
2ff2402c65
avcodec/sbrdsp_fixed: Fix undefined overflows in autocorrelate()
...
Fixes: runtime error: signed integer overflow: 8903997421129740175 + 354481484684609529 cannot be represented in type 'long'
Fixes: 2045/clusterfuzz-testcase-minimized-6751255865065472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eefb68c9c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-28 01:44:23 +02:00
Michael Niedermayer
6b004e23d7
avformat/mvdec: Fix DoS due to lack of eof check
...
Fixes: loop.mv
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f05e2e2dc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-28 01:43:29 +02:00
孙浩 and 张洪亮(望初)
1720050ae6
avformat/rl2: Fix DoS due to lack of eof check
...
Fixes: loop.rl2
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 96f24d1bee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-28 01:43:04 +02:00
孙浩 and 张洪亮(望初)
c70fdd9948
avformat/cinedec: Fix DoS due to lack of eof check
...
Fixes: loop.cine
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7e80b63ecd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-28 01:42:24 +02:00
孙浩 and 张洪亮(望初)
6904464301
avformat/asfdec: Fix DoS due to lack of eof check
...
Fixes: loop.asf
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f9ec5593e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-28 01:42:00 +02:00
Michael Niedermayer
498e07daa1
avformat/hls: Fix DoS due to infinite loop
...
Fixes: loop.m3u
The default max iteration count of 1000 is arbitrary and ideas for a better solution are welcome
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Previous version reviewed-by: Steven Liu <lingjiujianke@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ec414892d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-28 01:41:37 +02:00
Michael Niedermayer
bc57c79970
Update for FFmpeg 2.8.13
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-24 14:42:03 +02:00
Michael Niedermayer
49839ae013
ffprobe: Fix NULL pointer handling in color parameter printing
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 351e28f9a7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-24 12:49:30 +02:00
Michael Niedermayer
c1a9f5675b
ffprobe: Fix null pointer dereference with color primaries
...
Found-by: AD-lab of venustech
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 837cb4325b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b2c39fcc3c0749490dc93bca80f56724878b55fe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-24 12:28:16 +02:00
Michael Niedermayer
ae37bbef43
avcodec/hevc_ps: Check delta_pocs in ff_hevc_decode_short_term_rps()
...
Fixes: integer overflow
Fixes: 2893/clusterfuzz-testcase-minimized-5809330567774208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b44dcbc44 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-24 12:10:33 +02:00
Vitaly Buka
eaf231544f
avformat/aviobuf: Fix signed integer overflow in avio_seek()
...
Signed integer overflow is undefined behavior.
Detected with clang and -fsanitize=signed-integer-overflow
Signed-off-by: Vitaly Buka <vitalybuka@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eca2a49716 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-24 12:08:07 +02:00
Vitaly Buka
05fc22f9f6
avformat/mov: Fix signed integer overflows with total_size
...
Signed integer overflow is undefined behavior.
Detected with clang and -fsanitize=signed-integer-overflow
Signed-off-by: Vitaly Buka <vitalybuka@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a404cb5b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-24 12:03:52 +02:00
Michael Niedermayer
cab75cde01
avcodec/aacdec_template: Fix running cleanup in decode_ics_info()
...
Fixes: out of array read
Fixes: 2873/clusterfuzz-testcase-minimized-5924145713905664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Previous version reviewed-by: Alex Converse <alex.converse@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6f03ffb47d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-23 04:03:16 +02:00
Michael Niedermayer
079849f40c
avcodec/me_cmp: Fix crashes on ARM due to misalignment
...
Adds a diff_pixels_unaligned()
Fixes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872503
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc488ec28a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-21 23:27:35 +02:00
Michael Niedermayer
0b37ae2ae4
avcodec/fic: Fixes signed integer overflow
...
Fixes: runtime error: signed integer overflow: 1037142357 + 1227025305 cannot be represented in type 'int'
Fixes: 3024/clusterfuzz-testcase-minimized-5885660323905536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c9d5b015c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-21 23:27:35 +02:00
Michael Niedermayer
7829a712bb
avcodec/snowdec: Fix off by 1 error
...
Fixes: runtime error: index 4 out of bounds for type 'int8_t [4]'
Fixes: 3023/clusterfuzz-testcase-minimized-6421736130084864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d132683ddd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-21 23:27:35 +02:00
Michael Niedermayer
b463a03476
avcodec/diracdec: Check perspective_exp and zrs_exp.
...
Fixes: undefined shift
Fixes: runtime error: shift exponent 264 is too large for 32-bit type 'int'
Fixes: 2860/clusterfuzz-testcase-minimized-4672811689836544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e6cab8745 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-17 00:27:32 +02:00
Michael Niedermayer
96cf249751
avcodec/mpeg4videodec: Clear mcsel before decoding an image
...
Fixes: runtime error: signed integer overflow: 2146467840 + 1032192 cannot be represented in type 'int'
Fixes: 2826/clusterfuzz-testcase-minimized-5901511613743104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7735ed2974 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-13 01:07:21 +02:00
Michael Niedermayer
30a2c1a1b8
avcodec/dirac_dwt: Fixes integer overflows in COMPOSE_DAUB97*
...
Fix multiple: runtime error: signed integer overflow: 6497 * 3409630 cannot be represented in type 'int'
Fixes: 2819/clusterfuzz-testcase-minimized-4743700301217792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5380f9c1c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-08 19:38:10 +02:00
Michael Niedermayer
5f44aa14dd
avcodec/aacdec_fixed: fix invalid shift in predict()
...
Fixes: runtime error: shift exponent -2 is negative
Fixes: 2818/clusterfuzz-testcase-minimized-5062943676825600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e443051b2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-08 19:37:43 +02:00
Michael Niedermayer
f236601e29
avcodec/h264_slice: Fix overflow in slice offset
...
Fixes: runtime error: signed integer overflow: 1610612736 * 2 cannot be represented in type 'int'
Fixes: 2817/clusterfuzz-testcase-minimized-5289691240726528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f53bde6d8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-08 19:37:25 +02:00
Steven Siloti
f0f45d8404
avformat/utils: fix memory leak in avformat_free_context
...
The pointer to the packet queue is stored in the internal structure
so the queue needs to be flushed before internal is freed.
Signed-off-by: Steven Siloti <ssiloti@bittorrent.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 949debd1d1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-05 23:25:05 +02:00
Michael Niedermayer
9d0eb81cb8
avcodec/dirac_dwt: Fix multiple integer overflows in COMPOSE_DD97iH0()
...
Fixes: runtime error: signed integer overflow: 9 * 335544320 cannot be represented in type 'int'
Fixes: 2739/clusterfuzz-testcase-minimized-6737297955356672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf8ab72ae9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-29 19:13:21 +02:00
Michael Niedermayer
95bbbbd14e
avcodec/diracdec: Fix integer overflow in divide3()
...
Fixes: runtime error: signed integer overflow: -1073746548 * 21845 cannot be represented in type 'int'
Fixes: 2729/clusterfuzz-testcase-minimized-5902915464069120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c0220c768c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-29 14:23:26 +02:00
Michael Niedermayer
406d9fdd13
avcodec/takdec: Fix integer overflow in decode_subframe()
...
Fixes: runtime error: signed integer overflow: -536870912 - 1972191120 cannot be represented in type 'int'
Fixes: 2711/clusterfuzz-testcase-minimized-4975142398590976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c630d159f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-29 14:18:36 +02:00
Michael Niedermayer
8f9cbb3b7e
avformat/rtmppkt: Convert ff_amf_get_field_value() to bytestream2
...
Fixes: out of array accesses
Found-by: JunDong Xie of Ant-financial Light-Year Security Lab
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ffcc82219c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-29 14:17:59 +02:00
Michael Niedermayer
b566ab49ca
avformat/rtmppkt: Convert ff_amf_tag_size() to bytestream2
...
Fixes: out of array accesses
Fixes: crash-9238fa9e8d4fde3beda1f279626f53812cb001cb-SEGV
Found-by: JunDong Xie of Ant-financial Light-Year Security Lab
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 08c073434e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-29 04:49:47 +02:00
Michael Niedermayer
58ce199aba
avcodec/hevc_ps: fix integer overflow in log2_parallel_merge_level_minus2
...
Fixes: runtime error: signed integer overflow: -2147483647 - 2 cannot be represented in type 'int'
Fixes: 2702/clusterfuzz-testcase-minimized-4511932591636480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 74c1c22d7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-26 17:25:20 +02:00
Michael Niedermayer
490b6599bb
avformat/oggparsecelt: Do not re-allocate os->private
...
Fixes: double free
Fixes: clusterfuzz-testcase-minimized-5080550145785856
Found-by: ClusterFuzz
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7140761481 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-26 00:22:55 +02:00
Michael Niedermayer
91442fdc1c
avcodec/aacps: Fix multiple integer overflow in map_val_34_to_20()
...
Fixes: avcodec/aacps.c:511:40: runtime error: signed integer overflow: 1509077651 + 758068176 cannot be represented in type 'int'
Fixes: 2678/clusterfuzz-testcase-minimized-4702787684270080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0764fe1d09 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-26 00:14:04 +02:00
Michael Niedermayer
56e2ec0e9f
avcodec/aacdec_fixed: fix: left shift of negative value -1
...
Fixes: 2699/clusterfuzz-testcase-minimized-5631303862976512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2dfb8c4178 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-26 00:11:56 +02:00
Brice Waegeneire
061be75481
doc/filters: typo in frei0r
...
Signed-off-by: Brice Waegeneire <brice.wge@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6a6eec485d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-23 15:01:05 +02:00
Michael Niedermayer
1b1abf077d
avcodec/aacdec_template (fixed point): Check gain in decode_cce() to avoid undefined shifts later
...
Fixes: runtime error: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 2581/clusterfuzz-testcase-minimized-4681474395602944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2886142e0c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 04:03:11 +02:00
Michael Niedermayer
a84ed3d011
avcodec/mjpegdec: Clip DC also on the negative side.
...
Fixes: runtime error: signed integer overflow: -16711425 + -2130772346 cannot be represented in type 'int'
Fixes: 2533/clusterfuzz-testcase-minimized-5372857678823424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c28f648b19 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 03:48:01 +02:00
Michael Niedermayer
080d6de9df
avcodec/aacps (fixed point): Fix multiple signed integer overflows
...
Fixes: runtime error: signed integer overflow: 1421978265 - -1810326882 cannot be represented in type 'int'
Fixes: 2527/clusterfuzz-testcase-minimized-5260915396050944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 80b9e40b6f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 03:47:46 +02:00
Michael Niedermayer
82ba7646c2
avcodec/sbrdsp_fixed: Fix integer overflow in sbr_hf_apply_noise()
...
Fixes: runtime error: signed integer overflow: -2049425300 + -117591631 cannot be represented in type 'int'
Fixes: part of 2096/clusterfuzz-testcase-minimized-4901566068817920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2061de8a3f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 03:39:54 +02:00
Michael Niedermayer
610bd59522
avcodec/wavpack: Fix invalid shift
...
Fixes: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 2377/clusterfuzz-testcase-minimized-6108505935183872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c07af72098 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 02:50:35 +02:00
Michael Niedermayer
a5e969dd28
avcodec/hevc_ps: Fix integer overflow with beta/tc offsets
...
Fixes: runtime error: signed integer overflow: 2113929216 * 2 cannot be represented in type 'int'
Fixes: 2422/clusterfuzz-testcase-minimized-5242114713583616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit de54a37c1d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 02:50:01 +02:00
Michael Niedermayer
f6954a1482
avcodec/vb: Check vertical GMC component before multiply
...
Fixes: runtime error: signed integer overflow: 8224 * 663584 cannot be represented in type 'int'
Fixes: 2393/clusterfuzz-testcase-minimized-6128334993883136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc6ab72bc7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 02:48:40 +02:00
Michael Niedermayer
a6e90e5998
avcodec/jpeg2000dwt: Fix integer overflow in dwt_decode97_int()
...
Fixes: runtime error: signed integer overflow: -163654656 * 256 cannot be represented in type 'int'
Fixes: 2367/clusterfuzz-testcase-minimized-4648678897745920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea5366670e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 02:45:52 +02:00
Michael Niedermayer
bbcb59b948
avcodec/apedec: Fix integer overflow
...
Fixes: out of array access
Fixes: PoC.ape and others
Found-by: Bingchang, Liu@VARAS of IIE
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ba4beaf614 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-16 17:02:32 +02:00
Michael Niedermayer
bd33b15fe6
avcodec/wavpack: Fix integer overflow in wv_unpack_stereo()
...
Fixes: runtime error: signed integer overflow: 2080374785 + 2080374784 cannot be represented in type 'int'
Fixes: 2351/clusterfuzz-testcase-minimized-5359403240783872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73ea2a028e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-25 02:52:42 +02:00
Michael Niedermayer
7ee48d9de1
avcodec/mpeg4videodec: Fix GMC with videos of dimension 1
...
Fixes: runtime error: shift exponent -1 is negative
Fixes: 2338/clusterfuzz-testcase-minimized-5153426541379584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4976a3411f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-25 02:48:02 +02:00
Michael Niedermayer
fe74c2364e
avcodec/wavpack: Fix integer overflow
...
Fixes: runtime error: signed integer overflow: 227511904 + 1964113935 cannot be represented in type 'int'
Fixes: 2331/clusterfuzz-testcase-minimized-6182185830711296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 24e95f9d4d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-23 03:05:56 +02:00
Michael Niedermayer
7fadd9625f
avcodec/takdec: Fix integer overflow
...
Fixes: runtime error: signed integer overflow: 512 + 2147483146 cannot be represented in type 'int'
Fixes: 2314/clusterfuzz-testcase-minimized-4519333877252096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c2ef4f6b4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-23 03:05:45 +02:00
Michael Niedermayer
be92b27024
avcodec/tiff: Update pointer only when the result is used
...
Fixes: runtime error: signed integer overflow: 538976288 * 32 cannot be represented in type 'int'
Fixes: 2310/clusterfuzz-testcase-minimized-4534784887881728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 27f80ab016 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-23 03:05:34 +02:00
Michael Niedermayer
5c818b6286
avcodec/hevc_filter: Fix invalid shift
...
Fixes: runtime error: left shift of negative value -1
Fixes: 2299/clusterfuzz-testcase-minimized-4843509351710720
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d7b3d5c3f2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-22 03:08:46 +02:00
Michael Niedermayer
b66e30ca76
avcodec/mpeg4videodec: Fix overflow in virtual_ref computation
...
Fixes: runtime error: signed integer overflow: 262144 * -16120 cannot be represented in type 'int'
Fixes: 2292/clusterfuzz-testcase-minimized-6156080415506432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5443c4bdf4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-22 03:08:35 +02:00
Michael Niedermayer
4afd248059
avcodec/wavpack: Fix undefined integer negation
...
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 2291/clusterfuzz-testcase-minimized-5538453481586688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f89747086 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-22 03:07:21 +02:00
Michael Niedermayer
cbc4f40d13
avcodec/aacdec_fixed: Check s for being too small
...
Fixes: runtime error: shift exponent -8 is negative
Fixes: 2286/clusterfuzz-testcase-minimized-5711764169687040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf7edbd6c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-22 03:07:09 +02:00
Anton Mitrofanov
ea73c4813d
avcodec/h264: Fix mix of lossless and lossy MBs decoding
...
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com >
(cherry picked from commit cf231b68da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 03:09:10 +02:00
Anton Mitrofanov
a85f8fd4a6
avcodec/h264_mb: Fix 8x8dct in lossless for new versions of x264
...
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com >
(cherry picked from commit 06dda70f1e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 03:05:01 +02:00
Anton Mitrofanov
365ab04b16
avcodec/h264_cabac: Fix CABAC+8x8dct in 4:4:4
...
Use the correct ctxIdxInc calculation for coded_block_flag.
Keep old behavior for old versions of x264 for backward compatibility.
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com >
(cherry picked from commit 840b41b2a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:27:18 +02:00
Michael Niedermayer
5aa7d228cb
avcodec/takdec: Fixes: integer overflow in AV_SAMPLE_FMT_U8P output
...
Fixes: runtime error: signed integer overflow: 2147483543 + 128 cannot be represented in type 'int'
Fixes: 2234/clusterfuzz-testcase-minimized-6266896041115648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 27c2006805 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-18 15:17:14 +02:00
Michael Niedermayer
0aa14c7f67
avcodec/jpeg2000dsp: Reorder operations in ict_int() to avoid 2 integer overflows
...
Fixes: runtime error: signed integer overflow: 58065 * 51981 cannot be represented in type 'int'
Fixes: 2271/clusterfuzz-testcase-minimized-5778297776504832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c746f92a8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-17 23:34:49 +02:00
Michael Niedermayer
ba23d53710
avcodec/hevcpred_template: Fix left shift of negative value
...
Fixes: runtime error: left shift of negative value -1
Fixes: 2250/clusterfuzz-testcase-minimized-5693382112313344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c94326c1fc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-17 23:34:20 +02:00
Michael Niedermayer
1ce850f96d
avcodec/hevcdec: Fix signed integer overflow in decode_lt_rps()
...
Fixes: runtime error: signed integer overflow: 2147483647 + 6 cannot be represented in type 'int'
Fixes: 2263/clusterfuzz-testcase-minimized-4800359627227136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1edbf5e20c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-17 02:25:56 +02:00
Michael Niedermayer
c436af1559
avcodec/jpeg2000dec: Check nonzerobits more completely
...
Fixes: runtime error: shift exponent 36 is too large for 32-bit type 'int'
Fixes: 2239/clusterfuzz-testcase-minimized-5639766592716800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dfb61ea263 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-17 02:25:28 +02:00
Michael Niedermayer
eb38f232b4
avcodec/shorten: Sanity check maxnlpc
...
Fixes OOM
Fixes: 2131/clusterfuzz-testcase-minimized-4718045157130240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e77ddd31a8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-17 02:23:55 +02:00
Michael Niedermayer
92c5ff0763
avcodec/jpeg2000: Fixes integer overflow in ff_jpeg2000_ceildivpow2()
...
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 2231/clusterfuzz-testcase-minimized-4565181982048256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e3fadc57c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-16 01:43:39 +02:00
Michael Niedermayer
c8733c7376
avcodec/hevcdec: Check nb_sps
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc40674462 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-16 01:07:19 +02:00
Michael Niedermayer
c2562f5a8e
avcodec/hevc_refs: Check nb_refs in add_candidate_ref()
...
Fixes: runtime error: index 16 out of bounds for type 'int [16]'
Fixes: 2209/clusterfuzz-testcase-minimized-5012343912136704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1cb4ef526d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-16 01:07:19 +02:00
Michael Niedermayer
7bca492cfc
avcodec/mpeg4videodec: Check sprite delta upshift against overflowing.
...
Fixes: runtime error: signed integer overflow: -268386304 * 16 cannot be represented in type 'int'
Fixes: 2204/clusterfuzz-testcase-minimized-5616756909408256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 12245ab1f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-16 00:48:16 +02:00
Michael Niedermayer
296b444a5c
avcodec/mpeg4videodec: Fix integer overflow in num_sprite_warping_points=2 case
...
Fixes: runtime error: signed integer overflow: 131072 + 2147352576 cannot be represented in type 'int'
Fixes: 2192/clusterfuzz-testcase-minimized-5370387988742144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a87be404a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-16 00:47:49 +02:00
Michael Niedermayer
fd0da0eef0
avcodec/aacsbr_fixed: Check shift in sbr_hf_assemble()
...
Fixes: runtime error: shift exponent -10 is negative
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d1992448d3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-16 00:46:34 +02:00
Michael Niedermayer
0ac4146389
avcodec/sbrdsp_fixed: Return an error from sbr_hf_apply_noise() if operations are impossible
...
Fixes: 1775/clusterfuzz-testcase-minimized-5330288148217856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d549f026d8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-16 00:45:57 +02:00
Michael Niedermayer
bc8fe5c4bd
avcodec/jpeg2000dwt: Fix runtime error: left shift of negative value -123
...
Fixes: 2208/clusterfuzz-testcase-minimized-5976593765761024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d24043e1a2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-13 19:51:46 +02:00
Michael Niedermayer
0dfda74afc
avcodec/wavpack: Fix runtime error: signed integer overflow: 1886191616 + 277872640 cannot be represented in type 'int'
...
Fixes: 2181/clusterfuzz-testcase-minimized-6314784322486272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c996374d4d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-13 19:48:31 +02:00
Michael Niedermayer
d182bb21ad
avcodec/snowdec: Fix runtime error: left shift of negative value -1
...
Fixes: 2197/clusterfuzz-testcase-minimized-6010716676947968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2e44126363 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-11 15:23:29 +02:00
Michael Niedermayer
295b24643e
avcodec/aacdec_fixed: Fix runtime error: left shift of negative value -1297616
...
Fixes: 2195/clusterfuzz-testcase-minimized-4736721533009920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6d499ecef9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-11 15:23:23 +02:00
Michael Niedermayer
f0f9fa2184
avcodec/tiff: Fix leak of geotags[].val
...
Fixes: 2176/clusterfuzz-testcase-minimized-5908197216878592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 22a25ab389 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-11 03:16:55 +02:00
Michael Niedermayer
e3a75af708
avcodec/ra144: Fix runtime error: signed integer overflow: -2200 * 1033073 cannot be represented in type 'int'
...
Fixes: 2175/clusterfuzz-testcase-minimized-5809657849315328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 71da0a5c97 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-11 03:16:23 +02:00
Michael Niedermayer
5dc0393d96
avcodec/flicvideo: Fix runtime error: signed integer overflow: 4864 * 459296 cannot be represented in type 'int'
...
Fixes: 2174/clusterfuzz-testcase-minimized-5739234533048320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 90e8317b3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-11 03:15:13 +02:00
Michael Niedermayer
f4dae48790
avcodec/indeo4: Check remaining data in Pic hdr extension parsing code
...
Fixes: Timeout
Fixes: 2115/clusterfuzz-testcase-minimized-6594111748440064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a3b5b60bdf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-08 17:38:52 +02:00
Michael Niedermayer
bcdd5463f3
avcodec/ac3dec_fixed: Fix multiple runtime error: signed integer overflow: -39271008 * 59 cannot be represented in type 'int'
...
Fixes: 2113/clusterfuzz-testcase-minimized-6510704959946752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4e3ab1a5c1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-08 17:38:41 +02:00
Michael Niedermayer
e9c8fdbbcb
avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: 53098 * 40448 cannot be represented in type 'int'
...
Fixes: 2106/clusterfuzz-testcase-minimized-6136503639998464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 18bca25adb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 16:56:49 +02:00
Michael Niedermayer
e3d4321739
avcodec/pafvideo: Fix assertion failure
...
Fixes: 2100/clusterfuzz-testcase-minimized-4522961547558912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4360559ee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 16:56:40 +02:00
Michael Niedermayer
8dc06a1cb1
avcodec/takdec: Fix multiple runtime error: signed integer overflow: 637072 * 4096 cannot be represented in type 'int'
...
Fixes: 2079/clusterfuzz-testcase-minimized-5345861779324928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e4efd41b83 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-06 16:56:25 +02:00
Michael Niedermayer
ffab459e4e
Update for 2.8.12
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:52:03 +02:00
Michael Niedermayer
fb95f1d9d6
avcodec/mjpegdec: Check that reference frame matches the current frame
...
Fixes: out of array read
Fixes: 2097/clusterfuzz-testcase-minimized-5036861833609216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4705edbbb9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
05d7c10fd3
avcodec/tiff: Avoid loosing allocated geotag values
...
Fixes memleak
Fixes: 2076/clusterfuzz-testcase-minimized-6542640243802112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d7cbeab4c1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
dbe771e50d
avcodec/cavs: Fix runtime error: signed integer overflow: -12648062 * 256 cannot be represented in type 'int'
...
Fixes: 2067/clusterfuzz-testcase-minimized-5578430902960128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e6ee86d92 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
e447d3143f
avformat/hls: Check local file extensions
...
This reduces the attack surface of local file-system
information leaking.
It prevents the existing exploit leading to an information leak. As
well as similar hypothetical attacks.
Leaks of information from files and symlinks ending in common multimedia extensions
are still possible. But files with sensitive information like private keys and passwords
generally do not use common multimedia filename extensions.
It does not stop leaks via remote addresses in the LAN.
The existing exploit depends on a specific decoder as well.
It does appear though that the exploit should be possible with any decoder.
The problem is that as long as sensitive information gets into the decoder,
the output of the decoder becomes sensitive as well.
The only obvious solution is to prevent access to sensitive information. Or to
disable hls or possibly some of its feature. More complex solutions like
checking the path to limit access to only subdirectories of the hls path may
work as an alternative. But such solutions are fragile and tricky to implement
portably and would not stop every possible attack nor would they work with all
valid hls files.
Developers have expressed their dislike / objected to disabling hls by default as well
as disabling hls with local files. There also where objections against restricting
remote url file extensions. This here is a less robust but also lower
inconvenience solution.
It can be applied stand alone or together with other solutions.
limiting the check to local files was suggested by nevcairiel
This recommits the security fix without the author name joke which was
originally requested by Nicolas.
Found-by: Emil Lerner and Pavel Cheremushkin
Reported-by: Thierry Foucu <tfoucu@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 189ff42196 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
a20e708352
avcodec/qdrw: Fix null pointer dereference
...
The RGB555 PACKBITSRGN case tries to read a palette, if such
palette is actually stored then it accesses a null pointer.
All 16bit samples i could find use DIRECTBITSRGN.
Fixes: 2065/clusterfuzz-testcase-minimized-6298930457346048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 46b865ea9f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
591a3d2632
avutil/softfloat: Fix sign error in and improve documentation of av_int2sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6019d721d4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
268d84a742
avcodec/hevc_ps: Fix runtime error: index 32 out of bounds for type 'uint8_t [32]'
...
Fixes: 2010/clusterfuzz-testcase-minimized-6209288450080768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 29808fff33 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
6636b35ef0
avcodec/pafvideo: Check packet size and frame code before ff_reget_buffer()
...
Fixes 1745/clusterfuzz-testcase-minimized-6160693365571584
Fixes: Timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit faa5a2181d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
195b5b6cea
avcodec/ac3dec_fixed: Fix runtime error: left shift of 419 by 23 places cannot be represented in type 'int'
...
Fixes: 1352/clusterfuzz-testcase-minimized-5757565017260032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 136ce8baa4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
ad600ec886
avcodec/aacps: Fix runtime error: left shift of 1073741824 by 1 places cannot be represented in type 'INTFLOAT' (aka 'int')
...
Fixes: 2005/clusterfuzz-testcase-minimized-5744226438479872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9faf098163 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
6ebdffe73c
avcodec/wavpack: Fix runtime error: shift exponent 32 is too large for 32-bit type 'int'
...
Fixes: 1967/clusterfuzz-testcase-minimized-5757031199801344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b3e580b7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
d1390a8670
avcodec/wavpack: Fix runtime error: signed integer overflow: 2013265955 - -134217694 cannot be represented in type 'int'
...
Fixes: 1922/clusterfuzz-testcase-minimized-5561194112876544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a47273c803 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
653de8249d
avcodec/cinepak: Check input packet size before frame reallocation
...
Reduces time spend decoding 1917/clusterfuzz-testcase-minimized-5023221273329664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e47057e932 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
041ad6d2bb
avcodec/hevc_ps: Fix runtime error: signed integer overflow: 2147483628 + 256 cannot be represented in type 'int'
...
Fixes: 1909/clusterfuzz-testcase-minimized-6732072662073344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6726328f79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
368aa6aac7
avcodec/ra144: Fixes runtime error: signed integer overflow: 7160 * 327138 cannot be represented in type 'int'
...
Fixes: 1908/clusterfuzz-testcase-minimized-5392712477966336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 08cb69e870 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
9c0c749c33
avcodec/pnm: Use ff_set_dimensions()
...
Fixes: OOM
Fixes: 1906/clusterfuzz-testcase-minimized-4599315114754048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1c0d1d906 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
b62a5c83fc
avcodec/cavsdec: Fix runtime error: signed integer overflow: 59 + 2147483600 cannot be represented in type 'int'
...
Fixes: 1903/clusterfuzz-testcase-minimized-5359318167715840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 58f8cd4ac5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
bb7df22328
avformat/avidec: Limit formats in gab2 to srt and ass/ssa
...
This prevents part of one exploit leading to an information leak
Found-by: Emil Lerner and Pavel Cheremushkin
Reported-by: Thierry Foucu <tfoucu@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5d849b149 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
464288cc5e
avcodec/acelp_pitch_delay: Fix runtime error: value 4.83233e+39 is outside the range of representable values of type 'float'
...
Fixes: 1902/clusterfuzz-testcase-minimized-4762451407011840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 87bddba43b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
3a56bbe001
avcodec/wavpack: Check float_shift
...
Fixes: runtime error: shift exponent 40 is too large for 32-bit type 'unsigned int'
Fixes: 1898/clusterfuzz-testcase-minimized-5970744880136192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4020b009d1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
9a92478556
avcodec/wavpack: Fix runtime error: signed integer overflow: 24 * -2147483648 cannot be represented in type 'int'
...
Fixes: 1894/clusterfuzz-testcase-minimized-4716739789062144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d90c5bf105 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
8d1cd5fa08
avcodec/ansi: Fix frame memleak
...
Fixes: 1892/clusterfuzz-testcase-minimized-4519341733183488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e091b9b3c7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
20b9b1fd77
avcodec/jpeg2000dec: Use ff_set_dimensions()
...
Fixes: OOM
Fixes: 1890/clusterfuzz-testcase-minimized-6329019509243904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f3da6fbff8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
bbc6bfae37
avcodec/truemotion2: Fix passing null pointer to memset()
...
Fixes part of: 1888/clusterfuzz-testcase-minimized-5237704826552320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c901627918 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
b1777d92f9
avcodec/truemotion2: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
...
Fixes part of: 1888/clusterfuzz-testcase-minimized-5237704826552320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9e884f3d9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
33aed7bb76
avcodec/ra144: Fix runtime error: signed integer overflow: -2449 * 1398101 cannot be represented in type 'int'
...
Fixes: 1885/clusterfuzz-testcase-minimized-5336328549957632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7c845450d2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
a7878fe247
avcodec/ra144: Fix runtime error: signed integer overflow: 11184810 * 404 cannot be represented in type 'int'
...
Fixes: 1884/clusterfuzz-testcase-minimized-4637425835966464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4c472c5252 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
ba3bc22940
avcodec/aac_defines: Add missing () to AAC_HALF_SUM() macro
...
Fixes: runtime error: shift exponent 1073741848 is too large for 32-bit type 'INTFLOAT' (aka 'int')
Fixes: 1880/clusterfuzz-testcase-minimized-4900645322620928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 872bac8159 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
3fe7d4c403
avcodec/webp: Fixes null pointer dereference
...
Fixes: 1470/clusterfuzz-testcase-minimized-5404421666111488
Fixes: 1472/clusterfuzz-testcase-minimized-5677426430443520
Fixes: 1875/clusterfuzz-testcase-minimized-5536474562822144
Approved-by: BBB
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 67020711b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
5ee31596fa
avcodec/aacdec_fixed: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
...
Fixes: 1878/clusterfuzz-testcase-minimized-6441918630199296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6b9cb5d26a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
1d88ec2fb0
avcodec/snow: Fix runtime error: signed integer overflow: 1086573993 + 1086573994 cannot be represented in type 'int'
...
Fixes: 1871/clusterfuzz-testcase-minimized-5719950331215872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b9c032ebc0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
65f38d1285
avcodec/jpeg2000: Fix runtime error: signed integer overflow: 4185 + 2147483394 cannot be represented in type 'int'
...
Fixes: 1870/clusterfuzz-testcase-minimized-4686788029317120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 781f88bb26 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
0103b3ea92
avcodec/jpeg2000dec: Check tile offsets more completely
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c1812491f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
7b1d93ce9c
avcodec/aacdec_fixed: Fix multiple runtime error: shift exponent 127 is too large for 32-bit type 'int'
...
Fixes: 1851/clusterfuzz-testcase-minimized-5692607495667712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6c3a63fc3d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
19556586d5
avcodec/wnv1: More strict buffer size check
...
This requires at least 25% of a picture to allocate and decode it
Fixes: Timeout
Fixes: 1845/clusterfuzz-testcase-minimized-5075974343360512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f50c25124 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
8fbe1f634f
avcodec/libfdk-aacdec: Correct buffer_size parameter
...
the timeDataSize argument to aacDecoder_DecodeFrame() seems undocumented and until
2016 04 (203e3f28fbebec7011342017fafc2a0bda0ce530) unused.
after that commit libfdk-aacdec interprets it as size in sample units and memsets that on error.
FFmpeg as well as others (like GStreamer) did interpret it as size in bytes
Fixes: 1442/clusterfuzz-testcase-minimized-4540199973421056 (This requires recent libfdk to reproduce)
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ca6776a993 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
492099f9c4
avcodec/sbrdsp_template: Fix: runtime error: signed integer overflow: 849815297 + 1315389781 cannot be represented in type 'int'
...
Fixes: 1770/clusterfuzz-testcase-minimized-5285511235108864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7c36ee216f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
259582feaa
avcodec/ivi_dsp: Fix runtime error: left shift of negative value -2
...
Fixes: 1839/clusterfuzz-testcase-minimized-6238490993885184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 357f2316a0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Kevin Mark
fde04ca718
doc/filters: Clarify scale2ref example
...
Signed-off-by: Kevin Mark <kmark937@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 114e871621 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
59436dc8f8
avcodec/mlpdec: Do not leave invalid values in matrix_out_ch[] on error
...
Fixes: runtime error: index 12 out of bounds for type 'uint8_t [8]'
Fixes: 1832/clusterfuzz-testcase-minimized-6574546079449088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ac8dfcbd89 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
50fb6addc9
avcodec/ra144dec: Fix runtime error: left shift of negative value -17
...
Fixes: 1830/clusterfuzz-testcase-minimized-5828293733384192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53c0c637d3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
fc449d70cf
avformat/mux: Fix copy an paste typo
...
Found-by: Roger Scott <rscott@grammatech.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1a36354698 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
6025edc0c7
avutil/internal: Do not enable CHECKED with DEBUG
...
This avoids potential undefined behavior in debug mode while still allowing
developers which want to check for potential additional overflows to do so
by manually enabling this.
Reviewed-by: wm4
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a44b3abb4c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
1341713550
avcodec/aacdec_fixed: Fix runtime error: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
...
Fixes: 1825/clusterfuzz-testcase-minimized-6002833050566656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e87d146d7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
5529a67817
avcodec/smc: Check remaining input
...
Fixes: Timeout
Fixes: 1818/clusterfuzz-testcase-minimized-5039166473633792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 356194fcb1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
345f296135
avcodec/jpeg2000dec: Fix copy and paste error
...
Found-by: jamrial
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5782e0ba8c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
75d32ff24d
avcodec/jpeg2000dec: Check tile offsets
...
Fixes: runtime error: signed integer overflow: 4096 - -2147483648 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 89325417e7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Max Justicz
87c13e4e88
avcodec/sanm: Fix uninitialized reference frames
...
Fixes: poc.snm
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ca616b0f72 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
52e470097a
avcodec/jpeglsdec: Check get_bits_left() before decoding a picture
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4bc3008d04 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
5148395e86
avcodec/ivi_dsp: Fix multiple runtime error: left shift of negative value -71
...
Fixes: 1734/clusterfuzz-testcase-minimized-5385630815092736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8fb00b3e85 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
32ac3f1b1f
avcodec/mjpegdec: Fix runtime error: signed integer overflow: -32767 * 130560 cannot be represented in type 'int'
...
Fixes: 1724/clusterfuzz-testcase-minimized-4842395432648704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 40fa6a2fa2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
dd373b4027
avcodec/aacdec_fixed: Fix runtime error: shift exponent 34 is too large for 32-bit type 'int'
...
Fixes: 1721/clusterfuzz-testcase-minimized-4719352135811072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5228e44c7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
8bc5e90bb2
avcodec/mpeg4videodec: Check for multiple VOL headers
...
Fixes multiple: runtime error: signed integer overflow: 2147115008 + 413696 cannot be represented in type 'int'
Fixes: 1723/clusterfuzz-testcase-minimized-5309409372667904
Fixes: 1727/clusterfuzz-testcase-minimized-5900685306494976
Fixes: 1737/clusterfuzz-testcase-minimized-5922321338466304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit efeb47fd5d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
5ceb27b0eb
avcodec/vmnc: Check location before use
...
Fixes: runtime error: signed integer overflow: 65535 * 64256 cannot be represented in type 'int'
Fixes: 1717/clusterfuzz-testcase-minimized-5491696676634624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec2b76aab4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
ea4b807c0a
avcodec/takdec: Fix runtime error: signed integer overflow: 8192 * 524308 cannot be represented in type 'int'
...
Fixes: 1630/clusterfuzz-testcase-minimized-6326111917047808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 955db41192 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
0155d1c1cb
avcodec/aac_defines: Fix: runtime error: left shift of negative value -2
...
Fixes: 1716/clusterfuzz-testcase-minimized-4691012196761600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c3547dcbc3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
45c9fe61d9
avcodec/takdec: Fix runtime error: left shift of negative value -63
...
Fixes: 1713/clusterfuzz-testcase-minimized-5791887476654080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d66193252b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
11e2bdd53e
avcodec/mlpdsp: Fix runtime error: signed integer overflow: -24419392 * 128 cannot be represented in type 'int'
...
Fixes: 1711/clusterfuzz-testcase-minimized-5248503515185152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1d04fc94e1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
7d61e21953
avcodec/sbrdsp_fixed: fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
...
Fixes: part of 1709/clusterfuzz-testcase-minimized-4513580554649600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 384508b2ff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
Michael Niedermayer
88fabd8016
avcodec/aacsbr_fixed: Fix multiple runtime error: shift exponent 170 is too large for 32-bit type 'int'
...
Fixes part of 1709/clusterfuzz-testcase-minimized-4513580554649600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6310fc714d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 23:16:54 +02:00
James Almer
24d744cabe
avcodec/hevc_sei: fix amount of bits skipped when reading picture timing SEI message
...
The code was skipping the entire reported SEI message size regardless of
the amount of bits read.
While in theory safe for NALU where the picture timing SEI message is alone
or at the end as we're using the checked bitstream reader, it isn't in any
other situation, where every SEI message in the NALU after the picture
timing one would potentially fail to parse.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit f738140807 )
Conflicts:
libavcodec/hevc_sei.c
2017-05-19 23:38:04 -03:00
James Almer
870f1e3836
avformat/concatdec: fix the h264 annexb extradata check
...
The start code can be either in the first three or four bytes.
(cherry picked from commit b4330a0e02 )
2017-05-19 23:37:59 -03:00
Aaron Levinson
0109a152a1
avformat/utils: free AVStream.codec properly in free_stream()
...
Fixes memory leaks.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit b9d2005ea5 )
2017-05-19 23:37:49 -03:00
James Almer
1c302b606e
avcodec/options: do a more thorough clean up in avcodec_copy_context()
...
Free coded_frame to prevent potential leaks.
Reviewed-by: Aaron Levinson <alevinsn@aracnet.com >
Tested-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit cac8de2da5 )
2017-05-19 23:37:03 -03:00
James Almer
4122e5fcb3
avcodec/options: factorize avcodec_copy_context() cleanup code
...
Reviewed-by: Aaron Levinson <alevinsn@aracnet.com >
Tested-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 54a4c9b4e9 )
2017-05-19 23:22:23 -03:00
Michael Niedermayer
4117f19f2f
avcodec/mlpdec: Do not leave a invalid num_primitive_matrices in the context
...
Fixes: runtime error: index 8 out of bounds for type 'uint8_t [8]'
Fixes: 1699/clusterfuzz-testcase-minimized-6327177438035968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 64ea4d102a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
3ecff1b7e5
avcodec/aacsbr_fixed: Fix multiple runtime error: shift exponent 150 is too large for 32-bit type 'int'
...
Fixes: 1681/clusterfuzz-testcase-minimized-5970545365483520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3fb104f447 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
860ff3c447
avcodec/mimic: Use ff_set_dimensions() to set the dimensions
...
Fixes: OOM
Fixes: 1671/clusterfuzz-testcase-minimized-4759078033162240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e434840fd4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
1397c7f616
avcodec/fic: Fix multiple runtime error: signed integer overflow: 5793 * 419752 cannot be represented in type 'int'
...
Fixes: 1669/clusterfuzz-testcase-minimized-5287529198649344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a173f484b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
346e2d1663
avcodec/mlpdec: Fix: runtime error: left shift of negative value -8
...
Fixes: 1658/clusterfuzz-testcase-minimized-4889937130291200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 25c81e4b73 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
9e62e1cded
avcodec/dfa: Fix: runtime error: signed integer overflow: -14202 * 196877 cannot be represented in type 'int'
...
Fixes: 1657/clusterfuzz-testcase-minimized-4710000079405056
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 58ac7fb9c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
afc0b559f6
avcodec/aacdec: Fix runtime error: signed integer overflow: 2147483520 + 255 cannot be represented in type 'int'
...
Fixes: 1656/clusterfuzz-testcase-minimized-5900404925661184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 94d05ff159 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
f76c1554f6
avcodec/aacdec_template: Fix fixed point scale in decode_cce()
...
Fixes: runtime error: shift exponent 1073741824 is too large for 32-bit type 'int'
Fixes: 1654/clusterfuzz-testcase-minimized-5151903795118080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53a502206a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
209124a944
avcodec/flicvideo: Check frame_size before decrementing
...
Fixes: runtime error: signed integer overflow: -2147483627 - 22 cannot be represented in type 'int'
Fixes: 1637/clusterfuzz-testcase-minimized-5376582493405184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 355e27e24d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
f5d0960872
avcodec/mlpdec: Fix runtime error: left shift of negative value -1
...
Fixes: 1636/clusterfuzz-testcase-minimized-5310494757879808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 552adf1dd3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
07ca48cecf
avcodec/takdec: Fix runtime error: left shift of negative value -42
...
Fixes: 1635/clusterfuzz-testcase-minimized-4992749856096256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 99c4c76cfb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
28d7c43d0f
avcodec/hq_hqa: Fix: runtime error: signed integer overflow: -255 * 10180917 cannot be represented in type 'int'
...
Fixes: 1626/clusterfuzz-testcase-minimized-6416580571299840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d9cb583c8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
9dcd02a5a5
avcodec/truemotion1: Fix multiple runtime error: signed integer overflow: 1246906962 * 2 cannot be represented in type 'int'
...
Fixes: 1616/clusterfuzz-testcase-minimized-5119196578971648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5ea6bc2a166edac37042f2bbc28eb603a0fbeccb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
c90ad2b5cc
avcodec/svq3: Fix runtime error: left shift of negative value -6
...
Fixes: 1604/clusterfuzz-testcase-minimized-5312060206350336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6eb006ad4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
a1778b8cdd
avcodec/tiff: reset sampling[] if its invalid
...
Fixes divission by 0
Fixes: clusterfuzz-testcase-minimized-5592896440893440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f08122fbe0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
aa941e9aa9
avcodec/aacps: Fix undefined behavior
...
Fixes: 1337/clusterfuzz-testcase-minimized-5212314171080704
Fixes the existence of a potentially invalid pointer intermediate
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 527f89e059 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
53567e573b
avcodec/opus_silk: Fix integer overflow and out of array read
...
Fixes: 1362/clusterfuzz-testcase-minimized-6097275002552320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4654baff12 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
ec70017f9f
avcodec/flacdec: Return error code instead of 0 for failures
...
Fixes: infinite loop
Fixes: 1418/clusterfuzz-testcase-minimized-5934472438480896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3f5a68533d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
eca9c51090
avcodec/snowdec: Check width
...
Fixes: out of array read
Fixes: 1419/clusterfuzz-testcase-minimized-6108700873850880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 78aa93807b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
ef94fb391f
avcodec/webp: Update canvas size in vp8_lossy_decode_frame() as in vp8_lossless_decode_frame()
...
Fixes: 1407/clusterfuzz-testcase-minimized-6044604124102656
Fixes: 1420/clusterfuzz-testcase-minimized-6059927359455232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 72810d20b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
4ad139ba23
avcodec/webp: Factor update_canvas_size() out
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4f63b78b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
b3e3cdc0fd
avcodec/cllc: Check prefix
...
Fixes: runtime error: left shift of 1610706944 by 1 places cannot be represented in type 'int'
Fixes: 1421/clusterfuzz-testcase-minimized-6239947507892224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 62c5949bec )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
5b809f53c2
avcodec/dds: Fix runtime error: left shift of 210 by 24 places cannot be represented in type 'int'
...
Fixes: 1510/clusterfuzz-testcase-minimized-5826231746428928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit afb4632cc3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
ab56c64835
avcodec/mpeg4videodec: Clear sprite wraping on unsupported cases in VOP decode
...
Fixes: Integer overflow
Fixes: 1572/clusterfuzz-testcase-minimized-4578773729017856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 467677769a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:34 +02:00
Michael Niedermayer
b17779fc14
avcodec/ac3dec: Fix: runtime error: index -1 out of bounds for type 'INTFLOAT [2]'
...
It seems dual mono with a LFE channel is not forbidden
Fixes: 1570/clusterfuzz-testcase-minimized-6455337349545984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c55e637072 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
12f969bd2c
avcodec/hqxdsp: Fix runtime error: signed integer overflow: -196264 * 11585 cannot be represented in type 'int'
...
Fixes: 1568/clusterfuzz-testcase-minimized-5944868608147456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b923213276 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
42f2cf1597
libswscale/tests/swscale: Fix uninitialized variables
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7796f29065 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
bfc1534362
avcodec/ffv1dec: Fix runtime error: signed integer overflow: 1550964438 + 1550964438 cannot be represented in type 'int'
...
Fixes: 1559/clusterfuzz-testcase-minimized-5048096079740928
Fixes: 1560/clusterfuzz-testcase-minimized-6011037813833728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8630b2cd36 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
35ed8aa76f
avcodec/webp: Fix signedness in prefix_code check
...
Fixes: out of array read
Fixes: 1557/clusterfuzz-testcase-minimized-6535013757616128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c5cd1c9d3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
4ed535d79b
avcodec/svq3: Fix runtime error: signed integer overflow: 169 * 12717677 cannot be represented in type 'int'
...
Fixes: 1556/clusterfuzz-testcase-minimized-5027865978470400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 86b1b0d33d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
6e46f19cc8
avcodec/mlpdec: Check that there is enough data for headers
...
Fixes: out of array access
Fixes: 1541/clusterfuzz-testcase-minimized-6403410590957568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e3e51f8c14 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
0c92adda48
avcodec/ac3dec: Keep track of band structure
...
It is needed in some corner cases that seem not to be forbidden
Fixes: out of array index
Fixes: 1538/clusterfuzz-testcase-minimized-4696904925446144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9351a156de )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
2ec60b919f
avcodec/webp: Add missing input padding
...
Fixes: 1536/clusterfuzz-testcase-minimized-5973925404082176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a3508cc3fe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
c853966783
avcodec/aacdec_fixed: Fix runtime error: left shift of negative value -1
...
Fixes: 1535/clusterfuzz-testcase-minimized-5826695535788032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 26227d9186 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
699ca0075a
avcodec/aacsbr_template: Do not change bs_num_env before its checked
...
Fixes: 1489/clusterfuzz-testcase-minimized-5075102901207040
Fixes: out of array access
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 87b08ee6d2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
cb45926aa9
avcodec/mlp: Fix multiple runtime error: left shift of negative value -1
...
Fixes: 1512/clusterfuzz-testcase-minimized-4713846423945216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 74dc728a2c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
b198bd75bf
avcodec/vp8dsp: vp7_luma_dc_wht_c: Fix multiple runtime error: signed integer overflow: -1366381240 + -1262413604 cannot be represented in type 'int'
...
Fixes: 1440/clusterfuzz-testcase-minimized-5785716111966208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ccce2248bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
dccd62dc89
avcodec/avcodec: Limit the number of side data elements per packet
...
Fixes: 1293/clusterfuzz-testcase-minimized-6054752074858496
See: [FFmpeg-devel] [PATCH] avcodec/avcodec: Limit the number of side data elements per packet
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d5711cb891 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
4ea880c55e
avcodec/texturedsp: Fix runtime error: left shift of 255 by 24 places cannot be represented in type 'int'
...
Fixes: 1505/clusterfuzz-testcase-minimized-4561688818876416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f225003d17 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
4ce0554daa
avcodec/wmv2dsp: Fix runtime error: signed integer overflow: 181 * -17047030 cannot be represented in type 'int'
...
Fixes: 1503/clusterfuzz-testcase-minimized-5369271855087616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df640dbbc9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
53d5e655c7
avcodec/diracdec: Fix Assertion frame->buf[0] failed at libavcodec/decode.c:610
...
Fixes: 1487/clusterfuzz-testcase-minimized-6288036495097856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6899e6e560 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
f2bdef4f2a
avcodec/msmpeg4dec: Check for cbpy VLC errors
...
Fixes: runtime error: left shift of negative value -1
Fixes: 1480/clusterfuzz-testcase-minimized-5188321007370240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 15e892aad1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
f05cd37d51
avcodec/cllc: Check num_bits
...
Fixes: runtime error: shift exponent -2 is negative
Fixes: 1479/clusterfuzz-testcase-minimized-6638493360979968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2bfd0a9758 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
d6e7a96fc4
avcodec/cllc: Factor VLC_BITS/DEPTH out, do not use repeated literal numbers
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e717fa1f0a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
680157adb2
avcodec/dvbsubdec: Check entry_id
...
Fixes: randomly writing over the array end
Fixes: 1473/clusterfuzz-testcase-minimized-5768907824562176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8a69f2602f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
1f8047adb8
avcodec/aacdec_fixed: Fix multiple shift exponent 33 is too large for 32-bit type 'int'
...
Fixes: 1471/clusterfuzz-testcase-minimized-6376460543590400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a0ff78168 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
df84fb2304
avcodec/mpeg12dec: Fixes runtime error: division by zero
...
Fixes: 1464/clusterfuzz-testcase-minimized-4925445571084288
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c0ece1f4ad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
e7568a4352
avcodec/webp: Always set pix_fmt
...
Fixes: out of array access
Fixes: 1434/clusterfuzz-testcase-minimized-6314998085189632
Fixes: 1435/clusterfuzz-testcase-minimized-6483783723253760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6b5d3fb26f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
60bc8b6282
avfilter/vf_uspp: Fix currently unused input frame dimensions
...
Found-by: Nicolas
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 942036e97c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
79905e0dff
avcodec/truemotion1: Fix multiple runtime error: left shift of negative value -1
...
Fixes: 1446/clusterfuzz-testcase-minimized-5577409124368384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit db5fae3229 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
85d4892cb9
avcodec/eatqi: Fix runtime error: signed integer overflow: 4466147 * 1075 cannot be represented in type 'int'
...
Fixes: 1443/clusterfuzz-testcase-minimized-4826998612426752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8de60ba27 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
507ed0ab52
avcodec/dss_sp: Fix runtime error: signed integer overflow: 2147481189 + 4096 cannot be represented in type 'int'
...
Fixes: 1441/clusterfuzz-testcase-minimized-6223152357048320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ea4287893 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
李赞
37f59340bb
avformat/wavdec: Check chunk_size
...
Fixes integer overflow and out of array access
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d23219637 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
7bbd92f69d
avcodec/cavs: Check updated MV
...
Fixes: runtime error: signed integer overflow: 251 + 2147483647 cannot be represented in type 'int'
Fixes: 1438/clusterfuzz-testcase-minimized-4917542646710272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5871adc90f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
a98d82b13d
avcodec/y41pdec: Fix width in input buffer size check
...
Fixes: out of array read
Fixes: 1437/clusterfuzz-testcase-minimized-4569970002362368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d8d372947 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
4dacf6bc4a
avcodec/svq3: Fix multiple runtime error: signed integer overflow: -237341 * 24552 cannot be represented in type 'int'
...
Fixes: 1429/clusterfuzz-testcase-minimized-5959951610544128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ae6fd1790f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
43bdff201d
avcodec/texturedsp: Fix runtime error: left shift of 218 by 24 places cannot be represented in type 'int'
...
Fixes: 1428/clusterfuzz-testcase-minimized-5263281793007616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2bd8eb05d2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
1c75d1b54b
avcodec/lagarith: Check scale_factor
...
Fixes: 1425/clusterfuzz-testcase-minimized-6295712339853312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ed3c9b5b0d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
5380abf785
avcodec/lagarith: Fix runtime error: left shift of negative value -1
...
Fixes: 1424/clusterfuzz-testcase-minimized-6088327159611392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ddb2dd7edb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
db3d3ced15
avcodec/takdec: Fix multiple runtime error: left shift of negative value -1
...
Fixes: 1423/clusterfuzz-testcase-minimized-5063889899225088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c5d2fa2fdf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
2dcdf145f5
avcodec/indeo2: Check for invalid VLCs
...
Fixes: timeout
Fixes: 1416/clusterfuzz-testcase-minimized-5536862435278848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 159fb8ff7e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
bd908055c8
avcodec/htmlsubtitles: Check for string truncation and return error
...
Fixes out of array access
Fixes: 1354/clusterfuzz-testcase-minimized-5520132195483648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f4ae3cce64 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
6db01ccde7
avcodec/bmvvideo: Fix runtime error: left shift of 137 by 24 places cannot be represented in type 'int'
...
Fixes: 1411/clusterfuzz-testcase-minimized-5776085184675840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 29692023b2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
fbeb8c760c
avcodec/dss_sp: Fix multiple runtime error: signed integer overflow: -15699 * -164039 cannot be represented in type 'int'
...
Fixed: 1409/clusterfuzz-testcase-minimized-5237365020819456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea59ef0c03 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
e7d36d262e
avcodec/dvbsubdec: check region dimensions
...
Fixes: 1408/clusterfuzz-testcase-minimized-6529985844084736
Fixes: integer overflow
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0075d9eced )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
ea10865d78
avcodec/vp8dsp: Fixes: runtime error: signed integer overflow: 1330143360 - -1023040530 cannot be represented in type 'int'
...
Fixes: 1406/clusterfuzz-testcase-minimized-5064865125236736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8824b7370a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
6606445c85
avcodec/hqxdsp: Fix multiple runtime error: signed integer overflow: 248220 * 21407 cannot be represented in type 'int' in idct_col()
...
Fixes: 1405/clusterfuzz-testcase-minimized-5011491835084800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d5118f81b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
ab494a84dd
avcodec/cavsdec: Check sym_factor
...
Fixes: runtime error: signed integer overflow: 25984 * 130560 cannot be represented in type 'int'
Fixes: 1404/clusterfuzz-testcase-minimized-5000441286885376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 279420b5a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
ff342d0587
avcodec/cdxl: Check format for BGR24
...
Fixes: out of array access
Fixes: 1427/clusterfuzz-testcase-minimized-5020737339392000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e42736b95 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
1116de7ba7
avcodec/ffv1dec: Fix copying planes of paletted formats
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a4d387195 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
2474b81eca
avcodec/wmv2dsp: Fix runtime error: signed integer overflow: 181 * -12156865 cannot be represented in type 'int'
...
Fixes: 1401/clusterfuzz-testcase-minimized-6526248148795392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b1f66cf5c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
39108a4724
avcodec/xwddec: Check bpp more completely
...
Fixes out of array access
Fixes: 1399/clusterfuzz-testcase-minimized-4866094172995584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 441026fcb1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
73e68fbe86
avcodec/s302m: Fix left shift of 8 by 28 places cannot be represented in type 'int'
...
Fixes: 1395/clusterfuzz-testcase-minimized-5330939741732864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a38e9797cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
89b2c24931
avcodec/eamad: Fix runtime error: signed integer overflow: 49674 * 49858 cannot be represented in type 'int'
...
Fixes: 1394/clusterfuzz-testcase-minimized-6493376885030912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ac1c87194 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
fc99e4c972
avcodec/g726: Fix runtime error: left shift of negative value -2
...
Fixes: 1393/clusterfuzz-testcase-minimized-5948366791901184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c04aa14882 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
c9cdea2a24
avcodec/ra144: Fix runtime error: left shift of negative value -798
...
Fixes: 1388/clusterfuzz-testcase-minimized-6680800936329216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 78bf446852 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
6856a8f0ad
avcodec/mss34dsp: Fix multiple signed integer overflow
...
Fixes: 1387/clusterfuzz-testcase-minimized-4802757766676480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 464c4b86ee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
d2dba39204
avcodec/targa_y216dec: Fix width type
...
Fixes out of array access
Fixes: 1376/clusterfuzz-testcase-minimized-6361794975105024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3e56db8926 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
91394cc4da
avcodec/ivi_dsp: Fix multiple left shift of negative value -2
...
Fixes: 1385/clusterfuzz-testcase-minimized-5552882663292928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e88cc94e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
833a759d40
avcodec/svq3: Fix multiple runtime error: signed integer overflow: 44161 * 61694 cannot be represented in type 'int'
...
Fixes: 1382/clusterfuzz-testcase-minimized-6013445293998080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 669419939c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
906c9d0804
avcodec/msmpeg4dec: Correct table depth
...
Fixes undefined shift
Fixes: 1381/clusterfuzz-testcase-minimized-5513944540119040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1121d92707 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
5b56c2d83a
avcodec/dds: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
...
Fixes: 1380/clusterfuzz-testcase-minimized-650122545122508
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8a8335de03 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
191e0f7e2b
avcodec/cdxl: Check format parameter
...
Fixes out of array access
Fixes: 1378/clusterfuzz-testcase-minimized-5715088008806400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e1b60aad77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
224ed78e72
avutil/softfloat: Fix overflow in av_div_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 277e397eb5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
d68870a606
avcodec/hq_hqa: Fix runtime error: left shift of negative value -207
...
Fixes: 1375/clusterfuzz-testcase-minimized-6070134701555712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1283c42447 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
afbe970534
avcodec/mss3: Change types in rac_get_model_sym() to match the types they are initialized from
...
Fixes integer overflow
Fixes: 1372/clusterfuzz-testcase-minimized-5712192982745088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ef0f39271 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
b9289fad4b
avcodec/shorten: Check k in get_uint()
...
Fixes: undefined shift
Fixes: 1371/clusterfuzz-testcase-minimized-5770822591447040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b6a51f59c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
ff27d17348
avcodec/webp: Fix null pointer dereference
...
Fixes: 1369/clusterfuzz-testcase-minimized-5048908029886464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9bf4523e40 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
1951a44d77
avcodec/dfa: Fix signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
...
Fixes: 1368/clusterfuzz-testcase-minimized-4507293276176384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 12936a4585 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
54368ac9b3
avcodec/mimic: Fix runtime error: left shift of negative value -1
...
Fixes: 1365/clusterfuzz-testcase-minimized-5624158450876416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fc2c420b82 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
ce0db291c6
avcodec/fic: Fix multiple left shift of negative value -15
...
Fixes: 1356/clusterfuzz-testcase-minimized-6008489086287872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b20c71409b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
00371aff3d
avcodec/mlpdec: Fix runtime error: left shift of negative value -22
...
Fixes: 1355/clusterfuzz-testcase-minimized-6662205472768000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c535436cbe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
acb589b12d
avcodec/snowdec: Check qbias
...
Fixes: signed integer overflow: -1094995529 * 131 cannot be represented in type 'int'
Fixes: 1353/clusterfuzz-testcase-minimized-5208180449607680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 523205ce1e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
5dec065a4d
avutil/softfloat: Fix multiple runtime error: left shift of negative value -8
...
Fixes: 1352/clusterfuzz-testcase-minimized-5757565017260032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 35f3df0d76 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
ddab43d3a8
avcodec/aacsbr_template: Do not leave bs_num_env invalid
...
Fixes out of array read
Fixes: 1349/clusterfuzz-testcase-minimized-5370707196248064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8ad83b793 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
51b8a78851
avcodec/mdec: Fix signed integer overflow: 28835400 * 83 cannot be represented in type 'int'
...
Fixes: 1346/clusterfuzz-testcase-minimized-5776732600664064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a234b5ade3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
1e9fa7c69f
avcodec/dfa: Fix off by 1 error
...
Fixes out of array access
Fixes: 1345/clusterfuzz-testcase-minimized-6062963045695488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f52fbf4f3e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
cd6c4082db
avcodec/nellymoser: Fix multiple left shift of negative value -8591
...
Fixes: 1342/clusterfuzz-testcase-minimized-5490842129137664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0953736b7e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
3366d18c29
avcodec/cdxl: Fix signed integer overflow: 14243456 * 164 cannot be represented in type 'int'
...
Fixes: 1341/clusterfuzz-testcase-minimized-5441502618583040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1002932a3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
cacae0656f
avcodec/g722: Fix multiple runtime error: left shift of negative value -1
...
Fixes: 1340/clusterfuzz-testcase-minimized-4669892148068352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f55df62998 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
a6e7636dac
avcodec/dss_sp: Fix multiple left shift of negative value -466
...
Fixes: 1339/clusterfuzz-testcase-minimized-4614671485108224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38152d9368 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
2197423ec9
avcodec/wnv1: Fix runtime error: left shift of negative value -1
...
Fixes: 1338/clusterfuzz-testcase-minimized-6485546354343936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9fac508ca4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
e924213492
avcodec/tiertexseqv: set the fixed dimenasions, do not depend on the demuxer doing so
...
Fixes: out of array access
Fixes: 1348/clusterfuzz-testcase-minimized-6195673642827776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ce551a3925 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
7ab6224083
avcodec/mjpegdec: Fix runtime error: signed integer overflow: -24543 * 2031616 cannot be represented in type 'int'
...
Fixes: 943/clusterfuzz-testcase-5114865297391616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a78ae465fd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
e45de9d279
avcodec/cavsdec: Fix undefined behavior from integer overflow
...
Fixes: 1335/clusterfuzz-testcase-minimized-5566961566089216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a0e5f7f363 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
65bc41b857
avcodec/dvdsubdec: Fix runtime error: left shift of 242 by 24 places cannot be represented in type 'int'
...
Fixes: 1080/clusterfuzz-testcase-5353236754071552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ce7098b8f2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
7dc7d70644
libavcodec/mpeg4videodec: Convert sprite_offset to 64bit
...
This avoids intermediates from overflowing (the final values are checked)
Fixes: runtime error: signed integer overflow: -167712 + -2147352576 cannot be represented in type 'int'
Fixes: 1298/clusterfuzz-testcase-minimized-5955580877340672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1c3a14073 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
4ea21dd574
avcodec/pngdec: Use ff_set_dimensions()
...
Fixes OOM
Fixes: 1314/clusterfuzz-testcase-minimized-4621997222920192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a0296fc056 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
0a391b738e
avcodec/msvideo1: Check buffer size before re-getting the frame
...
Fixes timeout
Fixes: 1306/clusterfuzz-testcase-minimized-6152296217968640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cabfed6895 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
533999aaad
avcodec/h264_cavlc: Fix undefined behavior on qscale overflow
...
Fixes: 1214/clusterfuzz-testcase-minimized-6130606599569408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fc8cff96ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
9d2939a791
avcodec/svq3: Increase offsets to prevent integer overflows
...
Fixes: 1280/clusterfuzz-testcase-minimized-6102353767825408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 382b4fc9b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
97458a040f
avcodec/indeo2: Check remaining bits in ir2_decode_plane()
...
Fixes: 1290/clusterfuzz-testcase-minimized-5815578902134784
Fixes: timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b29feec982 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
7f5c9250de
avcodec/vp3: Check remaining bits in unpack_dct_coeffs()
...
Decreases the time spend decoding junk.
May fix: 1283/clusterfuzz-testcase-minimized-6221126759874560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f00300b77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
37f5bfaa2b
avcodec/mdec: Fix runtime error: left shift of negative value -127
...
Fixes undefined behavior
Fixes: 1275/clusterfuzz-testcase-minimized-6718162017976320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ca82975b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Martin Vignali
d1b23e5c0c
libavcodec/exr : fix float to uint16 conversion for negative float value
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e46d637452 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Derek Buitenhuis
77dd220385
avformat/webmdashenc: Validate the 'streams' adaptation sets parameter
...
It should not be a value larger than the number of streams we have,
or it will cause invalid reads and/or SIGSEGV.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec07efa700 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Derek Buitenhuis
436f1d4562
avformat/webmdashenc: Require the 'adaptation_sets' option to be set
...
This seems to be non-optional, and if the muxer is run without it,
strlen() is run on NULL, causing a segfault.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cbd3a68f3e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
3fd8e79dc9
avcodec/dvdsubdec: Fixes 2 runtime error: left shift of 170 by 24 places cannot be represented in type 'int'
...
Fixes: 619/clusterfuzz-testcase-5803914534322176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 61ee2ca775 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
cbd0036856
avfilter/avfiltergraph: Add assert to write down in machine readable form what is assumed about sample rates in swap_samplerates_on_filter()
...
Fixes CID1397292
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f2b360fc0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
344e5de993
avcodec/tiff: Perform multiply in tiff_unpack_lzma() as 64bit
...
This should make no difference as the value should not be able to be that large
but its more correct this way
Fixes CID1348138
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f48b6b8b91 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Philip Langdale
9c7730417d
avcodec/vdpau_hevc: Fix potential out-of-bounds write
...
The maximum number of references is 16, so the index value cannot
exceed 15.
Fixes Coverity CID 1348139, 1348140, 1348141
(cherry picked from commit 4e6d1c1f4e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
95594b9815
avcodec/tiff: Check geotag count for being non zero
...
Fixes memleak
Fixes: 874/clusterfuzz-testcase-5252796175613952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3182e19c1c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
a2a028af6e
avcodec/vp56: Check avctx->error_concealment before enabling EC
...
Fixes timeout with 847/clusterfuzz-testcase-5291877358108672
Fixes timeout with 850/clusterfuzz-testcase-5721296509861888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 98da63b3f5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
26b2b2d052
avcodec/tiff: Check stripsize strippos for overflow
...
Fixes: 861/clusterfuzz-testcase-5688284384591872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d996b5649 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
17624e4156
avcodec/mpegaudiodec_template: Make l3_unscale() work with e=0
...
Fixes undefined behavior
Fixes: 830/clusterfuzz-testcase-6253175327686656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ebed703f1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
b34ca8295d
avcodec/tiff: Check for multiple geo key directories
...
Fixes memleak
Fixes: 826/clusterfuzz-testcase-5316921379520512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 108b02e547 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
922013c983
avcodec/wavpack: Fix runtime error: shift exponent 32 is too large for 32-bit type 'int'
...
Fixes: 822/clusterfuzz-testcase-4873433189974016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7cebc5a9cc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
36c314e76a
avcodec/rv34: Fix runtime error: signed integer overflow: 36880 * 66288 cannot be represented in type 'int'
...
Fixes: 768/clusterfuzz-testcase-4807444305805312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a66c6e28b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
4e2c1055a0
avcodec/amrwbdec: Fix runtime error: left shift of negative value -1
...
Fixes: 763/clusterfuzz-testcase-6007567320875008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 44e2105189 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
e83d6c6819
avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: -135088512 * 16 cannot be represented in type 'int'
...
Fixes: 736/clusterfuzz-testcase-5580263943831552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e2a4f1a9eb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
96cc855c1a
avcodec/h264_mvpred: Fix runtime error: left shift of negative value -1
...
Fixes: 734/clusterfuzz-testcase-4821293192970240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 222c9f031d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
bf37f12f40
avcodec/mjpegdec: Fix runtime error: left shift of negative value -127
...
Fixes: 733/clusterfuzz-testcase-4682158096515072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 800d02abe0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
4d4ce42f0b
avcodec/wavpack: Fix runtime error: left shift of negative value -5
...
Fixes: 729/clusterfuzz-testcase-5154831595470848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3016e919d4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
f31e43175c
avcodec/wavpack: Fix runtime error: left shift of negative value -2
...
Fixes: 723/clusterfuzz-testcase-6471394663596032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ba15005132 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
5cb5e2550e
avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: 134527392 * 16 cannot be represented in type 'int'
...
This checks the sprite delta intermediates for overflow
Fixes: 716/clusterfuzz-testcase-4890287480504320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fab13bbbcd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
c41ce74c8a
avcodec/mpeg12dec: Fix runtime error: left shift of negative value -13
...
Fixes: 709/clusterfuzz-testcase-4789836449841152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d757ddbaab )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
8ca5f502ac
avcodec/h264_mvpred: Fix multiple runtime error: left shift of negative value
...
Fixes: 710/clusterfuzz-testcase-5091051431788544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab998f4c7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
1a8f1ae223
avcodec/adxdec: Fix runtime error: left shift of negative value -1
...
Fixes: 705/clusterfuzz-testcase-5129572590813184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d23727e042 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
66d81c5926
avcodec/mpeg4videodec: Improve the overflow checks in mpeg4_decode_sprite_trajectory()
...
Also clear the state on errors
Fixes integer overflows in 701/clusterfuzz-testcase-6594719951880192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eb41956636 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
718c1433d9
avcodec/mjpegdec: Fix runtime error: left shift of negative value -511
...
Fixes: 693/clusterfuzz-testcase-6109776066904064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4b72d5cd6f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
b9cc73fafb
avcodec/h264_direct: Fix runtime error: left shift of negative value -14
...
Fixes: 682/clusterfuzz-testcase-4799120021651456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4bd3f1ce3e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
e65462291e
avcodec/pictordec: Check plane value before doing value/mask computations
...
Fixes integer overflow
Fixes: 675/clusterfuzz-testcase-6722971232108544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 63e400a880 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
09e51a464c
avcodec/mpeg4videodec: Fix runtime error: left shift of negative value -2650
...
Fixes: 674/clusterfuzz-testcase-6713275880308736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 25e93aacc2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
5453ac597e
avcodec/eac3dec: Fix runtime error: left shift of negative value -3
...
Fixes: 672/clusterfuzz-testcase-5595018867769344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 87eb374970 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
d782b0b2ad
avcodec/mpeg12dec: Fix runtime error: left shift of negative value -2
...
671/clusterfuzz-testcase-4990381827555328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aff8cf18cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
e5c39ad0e9
avcodec/mpeg4videodec: Check the other 3 sprite points for intermediate overflows
...
This is not necessarily specific to fuzzed files
Fixes: Multiple integer overflows
Fixes: 656/clusterfuzz-testcase-6463814516080640
Fixes: 658/clusterfuzz-testcase-6691260146384896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 76ba09d182 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
a50259df79
avcodec/mpeg4videodec: Check sprite_offset in addition to shifts
...
Fixes: 651/clusterfuzz-testcase-5710668915277824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6871df02d9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
bccc669fb1
avcodec/mpeg4video: Fix runtime error: left shift of negative value
...
Fixes: 644/clusterfuzz-testcase-4726434209726464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6179dc8aa7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
38e34f5015
avcodec/ituh263dec: Fix runtime error: left shift of negative value -22
...
Fixes: 639/clusterfuzz-testcase-5143866241974272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 631f748491 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
12a4a93b40
avcodec/rv40: Fix runtime error: left shift of negative value
...
Fixes: 630/clusterfuzz-testcase-6608718928019456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 956472a323 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
00870c248e
avcodec/h264_cabac: runtime error: signed integer overflow: 2147483647 + 14 cannot be represented in type 'int'
...
Fixes: 614/clusterfuzz-testcase-4931860079575040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 258763ad0e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
016a8e7772
avcodec/mpeg4videodec: Fix runtime error: shift exponent -2 is negative
...
Fixes: 612/clusterfuzz-testcase-4707817137111040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa2b75263e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
8f64abc5e2
avcodec/mjpegdec: Fix runtime error: left shift of negative value -507
...
Fixes: 611/clusterfuzz-testcase-5613455820193792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c91bdd4524 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
554687bff6
avcodec/eac3dec: Fix runtime error: left shift of negative value
...
Fixes: 610/clusterfuzz-testcase-4831030085156864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 067485b673 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
b1817a23c2
avcodec/vp6: clear dimensions on failed resolution change in vp6_parse_header()
...
Fixes: 807/clusterfuzz-testcase-6470061042696192
Fixes null pointer dereference
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 967feea5eb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
f8769b1a70
avcodec/vp56: Reset have_undamaged_frame on resolution changes
...
Fixes: timeout in 758/clusterfuzz-testcase-4720832028868608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6e913f2129 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Thomas Guilbert
b27bcc32c7
avcodec/vp8: Fix hang with slice threads
...
Fixes: 447860.webm
Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9bbc73ae9f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
678dd7cf20
avcodec/vp8: Check for the bitstream end per MB in decode_mb_row_no_filter()
...
Fixes: timeout in 730/clusterfuzz-testcase-5265113739165696 (part 2 of 2)
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: BBB
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1afd246960 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
45abce9e05
avcodec/vp568: Check that there is enough data for ff_vp56_init_range_decoder()
...
Fixes: timeout in 730/clusterfuzz-testcase-5265113739165696 (part 1 of 2)
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: BBB
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 55d7371fe0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
efa47b5c99
avcodec/vp8: remove redundant check
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5098a6f627 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
4e30560efc
avcodec/vp56: Require a correctly decoded frame before using vp56_conceal_mb()
...
Fixes timeout with 700/clusterfuzz-testcase-5660909504561152
Fixes timeout with 702/clusterfuzz-testcase-4553541576294400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ce4f28431 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
94d1f07c3b
avcodec/vp3: Do not return random positive values but the buf size
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d8094a303b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
b382722972
avcodec/vp8: Check for bitsteam end in decode_mb_row_no_filter()
...
Fixes timeout with 686/clusterfuzz-testcase-5853946876788736
this shortcuts (i.e. speeds up) the error and
return-to-user when decoding a truncated frame
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Previous version reviewed by: "Ronald S. Bultje" <rsbultje@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b5ff7d573 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
d19550189f
avcodec/vp56: Factorize vp56_render_mb() out
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4c0139463c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
5c764f0625
avcodec/vp3dsp: Fix multiple signed integer overflow: 46341 * 47523 cannot be represented in type 'int'
...
Fixes: 664/clusterfuzz-testcase-4917047475568640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b8b7921c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
3b067c9edc
Add CHECK/SUINT code
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4614bf2caf )
(cherry picked from commit e8d4eacc07 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3f2a09a43f6fade53227804459e6babb1c7248b3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
0b0f58d462
avcodec/mpeg12dec: Fix runtime error: left shift of negative value -1
...
Fixes: 764/clusterfuzz-testcase-6273034652483584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a720b854b0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
2219045914
avcodec/vp56: Clear dimensions in case of failure in the middle of a resolution change
...
Similar code is used elsewhere in vp56 to force a more complete reinit in the future.
Fixes null pointer dereference
Fixes: 707/clusterfuzz-testcase-4717453097566208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4bed066377 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
ae82d4f0fa
avcodec/vp56: Implement very basic error concealment
...
This should fix the fate failure due to a truncated last frame.
Alternatively the frame could be dropped.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d34bf886e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
18eb359953
avcodec/amrwbdec: Fix 2 runtime errors: left shift of negative value -1
...
Fixes: 669/clusterfuzz-testcase-4847965409640448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6bd79ba59f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
f7e3422a8f
avcodec/pngdec: Fix runtime error: left shift of 152 by 24 places cannot be represented in type 'int'
...
Fixes: 666/clusterfuzz-testcase-6581447227867136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 310d2af319 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
e28c0d4888
avcodec/vp56: Fix sign typo
...
Fixes: 664/clusterfuzz-testcase-4917047475568640
The change to fate is due to a truncated last frames which is now detected as damaged.
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 513a349439 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
68f7ebcd8d
avcodec/mpegaudiodec_template: Correct return code on id3 tag discarding
...
Fixes: 665/clusterfuzz-testcase-4863789881098240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d81616be3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
46828511c2
avcodec/rv34: Simplify and factor get_slice_offset() code
...
This also fixes several integer overflows by checking each value before
use.
Fixes: 662/clusterfuzz-testcase-4898131432964096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8696f25444 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
5eea0562b9
avcodec/pictordec: Do not read more than nb_planes
...
Fixes undefined behavior
Fixes: 622/clusterfuzz-testcase-5745722022428672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 01d196a67d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
34450a86c8
avcodec/srtdec: Fix signed integer overflow: 1811992524 * 384 cannot be represented in type 'int'
...
Fixes: 617/clusterfuzz-testcase-6413875723370496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c11d3634b0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
00a81ed120
avcodec/pngdec: Check bit depth for validity
...
Fixes: runtime error: shift exponent 132 is too large for 32-bit type 'int'
Fixes: 609/clusterfuzz-testcase-4825202619842560
See 11.2.2 IHDR Image header
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4279613a26 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
367222af32
avcodec/mpeg12dec: Fix runtime error: left shift of negative value
...
Fixes: 608/clusterfuzz-testcase-603978286392934
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 706757d26d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
7272eb87df
avcodec/wavpacl: Fix runtime error: left shift of negative value -1
...
Fixes: 607/clusterfuzz-testcase-5108792465293312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 12eebb845a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
Michael Niedermayer
02c51f3232
avformat/http: Check for truncated buffers in http_connect()
...
Reported-by: SleepProgger <security@gnutp.com >
Reviewed-by: Steven Liu <lingjiujianke@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8fa18e042a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 03:41:32 +02:00
James Almer
a1ad585c8e
avformat/apng: fix setting frame delay when max_fps is set to no limit
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 874eb012f7 )
2017-03-21 20:21:12 -03:00
James Almer
31e65eb84d
swresample/resample: free existing ResampleContext on reinit
...
Fixes memleak.
Reviewed-by: wm4 <nfxjfg@googlemail.com >
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit db7a05dab0 )
2017-03-21 12:19:20 -03:00
James Almer
f7f5a52459
swresample/resample: move resample_free() higher in the file
...
Also make it more readable while at it.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 2a8a8a2e98 )
Conflicts:
libswresample/resample.c
2017-03-21 12:19:03 -03:00
Carl Eugen Hoyos
518158693e
lavf/mpeg: Initialize a stack variable used by memcmp().
...
Silence a valgrind warning.
Fixes ticket #6160 .
(cherry picked from commit a5c1c7a8b3 )
2017-02-21 02:16:28 +01:00
Carl Eugen Hoyos
92d8106fa6
lavc/avpacket: Initialize a variable in error path.
...
Fixes ticket #6153 .
Tested-by: Tyson Smith
(cherry picked from commit 1d54be2153 )
2017-02-17 10:44:45 +01:00
Michael Niedermayer
523da8eac1
Update for 2.8.11
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:45:54 +01:00
Michael Niedermayer
912cb27f73
avcodec/h264_slice: Clear ref_counts on redundant slices
...
Fixes reading freed memory
Fixes: 568/clusterfuzz-testcase-6107186067406848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c03029a835 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Matt Wolenetz
4adc99ecb6
lavf/mov.c: Avoid heap allocation wrap in mov_read_uuid
...
Core of patch is from paul@paulmehta.com
Reference https://crbug.com/643951
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
Check value reduced as the code does not support values beyond INT_MAX
Also the check is moved to a more common place and before integer truncation
(cherry picked from commit 2d453188c2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Matt Wolenetz
8be3724e55
lavf/mov.c: Avoid heap allocation wrap in mov_read_hdlr
...
Core of patch is from paul@paulmehta.com
Reference https://crbug.com/643950
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
Check value reduced as the code does not support larger lengths
(cherry picked from commit fd30e4d57f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Michael Niedermayer
142c1737e3
avcodec/pictordec: Fix logic error
...
Fixes: 559/clusterfuzz-testcase-6424225917173760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c2ea3030a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Michael Niedermayer
61b86ae8ce
avcodec/movtextdec: Fix decode_styl() cleanup
...
Fixes: null pointer dereference
Fixes: 555/clusterfuzz-testcase-5986646595993600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e248522d1b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Chris Cunningham
b3ae6cfe11
lavf/matroskadec: fix is_keyframe for early Blocks
...
Blocks are marked as key frames whenever the "reference" field is
zero. This breaks for non-keyframe Blocks with a reference timestamp
of zero.
The likelihood of reference timestamp being zero is increased by a
longstanding bug in muxing that encodes reference timestamp as the
absolute time of the referenced frame (rather than relative to the
current Block timestamp, as described in MKV spec).
Now using INT64_MIN to denote "no reference".
Reported to chromium at http://crbug.com/497889 (contains sample)
(cherry picked from commit ac25840ee3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
James Almer
d053b25b59
configure: bump year
...
Happy new year!
(cherry picked from commit d800d48fc6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Michael Niedermayer
3aa8440baf
avcodec/pngdec: Check trns more completely
...
Fixes out of array access
Fixes: 546/clusterfuzz-testcase-4809433909559296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e477f09d0b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Michael Niedermayer
c9992efd84
avcodec/interplayvideo: Move parameter change check up
...
Fixes out of array read
Fixes: 544/clusterfuzz-testcase-5936536407244800.f8bd9b24_8ba77916_70c2c7be_3df6a2ea_96cd9f14
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b1e2192007 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Michael Niedermayer
87cc0b0474
avcodec/mjpegdec: Check for for the bitstream end in mjpeg_decode_scan_progressive_ac()
...
Fixes timeout
Fixes: 496/clusterfuzz-testcase-5805083497332736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3782656631 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Frank Liberato
d59582a567
avformat/flacdec: Check avio_read result when reading flac block header.
...
Return AVERROR_INVALIDDATA if all four bytes aren't present.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 95bde49982 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Michael Niedermayer
17a9e90d1f
avcodec/utils: correct align value for interplay
...
Fixes out of array access
Fixes: 452/fuzz-1-ffmpeg_VIDEO_AV_CODEC_ID_INTERPLAY_VIDEO_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2080bc3371 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Michael Niedermayer
3aca3f1257
avcodec/vp56: Check for the bitstream end, pass error codes on
...
Fixes timeout
Fixes: 446/fuzz-3-ffmpeg_VIDEO_AV_CODEC_ID_VP6_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e6a242755 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Michael Niedermayer
9f2e4c26a0
avcodec/mjpegdec: Check remaining bitstream in ljpeg_decode_yuv_scan()
...
Fixes timeout
Fixes: 445/fuzz-3-ffmpeg_VIDEO_AV_CODEC_ID_MJPEG_fuzzer
Fixes: 456/fuzz-2-ffmpeg_VIDEO_AV_CODEC_ID_JPEGLS_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 755933cb5c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Michael Niedermayer
1febd817b1
avcodec/pngdec: Fix off by 1 size in decode_zbuf()
...
Fixes out of array access
Fixes: 444/fuzz-2-ffmpeg_VIDEO_AV_CODEC_ID_PNG_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e371f031b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Tobias Rapp
3f3ee3e62f
avformat/avidec: skip odml master index chunks in avi_sync
...
Fixes pts gaps when reading AVI files > 256GiB generated by FFmpeg.
Signed-off-by: Tobias Rapp <t.rapp@noa-archive.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6d579d7c1b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:51 +01:00
Michael Niedermayer
8be687a81f
avcodec/mjpegdec: Check for rgb before flipping
...
Fixes assertion failure due to unsupported case
Fixes: 356/fuzz-1-ffmpeg_VIDEO_AV_CODEC_ID_MJPEG_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 25d9643f11 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:50 +01:00
Michael Niedermayer
1827fe0989
avutil/random_seed: Reduce the time needed on systems with very low precission clock()
...
This should fix issues on BSD
CLOCKS_PER_SEC is 128 on BSD while SUSv2 requires it to be a million
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4152fc42e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:50 +01:00
Michael Niedermayer
02073b5ab1
avutil/random_seed: Improve get_generic_seed() with higher precission clock()
...
Tested-by: Thomas Turner <thomastdt@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit da73d95bad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:50 +01:00
Michael Niedermayer
1825f7670a
avformat/utils: Print verbose error message if stream count exceeds max_streams
...
Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f0bdd53871 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:50 +01:00
Michael Niedermayer
2647ca4581
avformat/options_table: Set the default maximum number of streams to 1000
...
Fixes CVE-2016-9561, Note the security relevance of this is disputed as
running out of memory can happen with valid files
Suggested-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com >
Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 30581c51e7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:50 +01:00
Michael Niedermayer
2e44b10418
avutil: Add av_image_check_size2()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f542b152aa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:50 +01:00
Michael Niedermayer
c6fbff1358
avformat: Add max_streams option
...
This allows user apps to stop OOM due to excessive number of streams
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1296f84495 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:50 +01:00
Michael Niedermayer
774461ea62
avcodec/ffv1enc: Allocate smaller packet if the worst case size cannot be allocated
...
We are checking during encoding if there is enough space as version 4 needs that
check.
Fixes Ticket6005
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38a7834bbb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:50 +01:00
Michael Niedermayer
94a0a484b7
avcodec/mpeg4videodec: Fix undefined shifts in mpeg4_decode_sprite_trajectory()
...
Fixes: part of 670190.ogg
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8258e36385 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:50 +01:00
Michael Niedermayer
a127f51140
avformat/oggdec: Skip streams in duration correction that did not had their duration set.
...
Fixes: part of 670190.ogg
Fixes integer overflow
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ee2a6f5df8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:50 +01:00
Michael Niedermayer
07ca8300a6
avcodec/ffv1enc: Fix size of first slice
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cff1c0edaa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:17:50 +01:00
Andreas Cadhalpun
f7e18dea7a
pgssubdec: reset rle_data_len/rle_remaining_len on allocation error
...
The code relies on their validity and otherwise can try to access a NULL
object->rle pointer, causing segmentation faults.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 842e98b4d8 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2017-02-01 02:29:08 +01:00
Michael Niedermayer
16c0d8aa46
update for ffmpeg 2.8.10
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-06 03:50:50 +01:00
Michael Niedermayer
1ec9fd15b9
avformat/http: Match chunksize checks to master..3.0
...
Fixes warning about impossible condition
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-06 03:30:10 +01:00
Michael Niedermayer
4a947f4385
Changelog: fix typos
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-06 01:19:34 +01:00
Michael Niedermayer
e0cb113f9b
ffserver: Check chunk size
...
Fixes out of array access
Fixes: poc_ffserver.py
Found-by: Paul Cher <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5d25faa3f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-06 00:59:22 +01:00
Michael Niedermayer
15abba737b
Avoid using the term "file" and prefer "url" in some docs and comments
...
This should make it less ambigous that these are URLs
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5f27a9c3a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-06 00:59:22 +01:00
Michael Niedermayer
5bfb0b02b6
avformat/rtmppkt: Check for packet size mismatches
...
Fixes out of array access
Found-by: Paul Cher <paulcher@icloud.com >
Reviewed-by: Paul Cher <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d57ca4d9a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-06 00:59:22 +01:00
Timothy Gu
c472c1b3e7
zmqsend: Initialize ret to 0
...
Fixes CID1396857.
(cherry picked from commit d903b4e3ad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-06 00:59:22 +01:00
James Almer
e8dfe3f34a
configure: check for strtoull on msvc
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit b52d3574d4 )
2016-12-05 19:19:11 -03:00
Ronald S. Bultje
d3fc5c17de
http: move chunk handling from http_read_stream() to http_buf_read().
...
(cherry picked from commit 845bb40178 )
2016-12-05 16:20:58 -05:00
Ronald S. Bultje
606b21353d
http: make length/offset-related variables unsigned.
...
Fixes #5992 , reported and found by Paul Cher <paulcher@icloud.com >.
(cherry picked from commit 2a05c8f813 )
2016-12-05 16:20:40 -05:00
Michael Niedermayer
fb93771072
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 01:42:53 +01:00
Michael Niedermayer
3f8bb78f3e
avcodec/flacdec: Fix undefined shift in decode_subframe()
...
Fixes undefined behavior
Fixes: 639961-media
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f5630af51 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 01:05:02 +01:00
Michael Niedermayer
a5989651f0
avcodec/get_bits: Fix get_sbits_long(0)
...
Fixes undefined behavior
Fixes: 640889-media
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c72fa43234 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 01:03:53 +01:00
Michael Niedermayer
1e512388ee
avformat/ffmdec: Check media type for chunks
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e706e2e775 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-03 17:46:37 +01:00
Michael Niedermayer
31d46dc97d
avcodec/flacdec: Fix signed integer overflow in decode_subframe_fixed()
...
Fixes undefined behavior
Fixes: 640912-media
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 83a75bf6c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-03 17:32:54 +01:00
Michael Niedermayer
5790ce6273
avcodec/flacdsp_template: Fix undefined shift in flac_decorrelate_indep_c
...
Fixes: left shift of negative value
Fixes: 668346-media
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit acc163c6ab )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-03 17:32:33 +01:00
Michael Niedermayer
f202fefdb0
avformat/oggparsespeex: Check frames_per_packet and packet_size
...
The speex specification does not seem to restrict these values, thus
the limits where choosen so as to avoid multiplicative overflow
Fixes undefined behavior
Fixes: 635422.ogg
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit afcf15b0db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-03 04:10:31 +01:00
Michael Niedermayer
3af916db37
avformat/utils: Check start/end before computing duration in update_stream_timings()
...
Fixes undefined behavior
Fixes: 637428.ogg
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 90da187f1d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-03 04:10:19 +01:00
Michael Niedermayer
518beeb72f
Changelog: Update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-02 00:47:39 +01:00
Michael Niedermayer
46edc6d5ef
avcodec/flac_parser: Update nb_headers_buffered
...
Fixes infinite loop
Fixes: fuzz.flac
Found-by: Frank Liberato <liberato@google.com >
Reviewed-by: Frank Liberato <liberato@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2475858889 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-01 23:50:40 +01:00
Michael Niedermayer
046cc06f5a
avformat/idroqdec: Check chunk_size for being too large
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 744a0b5206 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-01 23:50:40 +01:00
Andreas Cadhalpun
970781f5f2
Update Changelog
2016-11-27 00:47:03 +01:00
Andreas Cadhalpun
d8ec9e97b9
filmstripdec: correctly check image dimensions
...
This prevents a division by zero in read_packet.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 25012c5644 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:36 +01:00
Andreas Cadhalpun
028c87be95
mss2: only use error correction for matching block counts
...
This fixes a heap-buffer-overflow in ff_er_frame_end when decoding mss2
with coded_width/coded_height larger than width/height.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 2566ad98b0 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:36 +01:00
Andreas Cadhalpun
b45e112bbd
softfloat: decrease MIN_EXP to cover full float range
...
floats are not necessarily normalized, so a normalized softfloat needs
MIN_EXP lowered by 23 to cover that range.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 2d6f46d801 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:35 +01:00
Andreas Cadhalpun
56b120630f
libopusdec: default to stereo for invalid number of channels
...
This fixes an out-of-bounds read if avc->channels is 0.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 8c8f543b81 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:35 +01:00
Andreas Cadhalpun
22cd4aa221
sbgdec: prevent NULL pointer access
...
Reviewed-by: Josh de Kock <josh@itanimul.li >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit dbefbb61b7 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:35 +01:00
Andreas Cadhalpun
8a7b2fbf6f
smacker: limit recursion depth of smacker_decode_bigtree
...
This fixes segmentation faults due to stack-overflow caused by too deep
recursion.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 946ecd19ea )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:35 +01:00
Andreas Cadhalpun
8f27508f1c
mxfdec: fix NULL pointer dereference in mxf_read_packet_old
...
Metadata streams have priv_data set to NULL.
Reviewed-by: Josh de Kock <josh@itanimul.li >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit fdb8c455b6 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:35 +01:00
Andreas Cadhalpun
7552f6fc1b
libschroedingerdec: fix leaking of framewithpts
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 3c0328d58d )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:35 +01:00
Andreas Cadhalpun
70ca4ce17a
libschroedingerdec: don't produce empty frames
...
They are not valid and can cause problems/crashes for API users.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit a86ebbf7f6 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:35 +01:00
Andreas Cadhalpun
ccda73a711
softfloat: handle -INT_MAX correctly
...
This is similar to commit 9ac61e73d0 .
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 0edd569466 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:35 +01:00
Andreas Cadhalpun
0b948b1b8d
pnmdec: make sure v is capped by maxval
...
Otherwise put_bits can be called with a value that doesn't fit in the
sample_len, causing an assertion failure.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit cdb5479c9d )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:35 +01:00
Andreas Cadhalpun
f76947fd56
smvjpegdec: make sure cur_frame is not negative
...
This fixes a heap-buffer-overflow detected by AddressSanitizer.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 360bc0d90a )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:34 +01:00
Andreas Cadhalpun
71fa32bbb7
icodec: correctly check avio_read return value
...
It can read less than the requested amount, in which case buf contains
uninitialized data, causing problems like segmentation faults later on.
Also make sure that image->size is positive, so that it can't match a
negative error code.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 89eb398c7f )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:34 +01:00
Andreas Cadhalpun
8a56b31e7c
icodec: fix leaking pkt on error
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 467eece1be )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:34 +01:00
Andreas Cadhalpun
2260c0776a
dvbsubdec: fix division by zero in compute_default_clut
...
This problem was introduced in commit
4b90dcb849 .
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit c82b8ef0e4 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:34 +01:00
Andreas Cadhalpun
5c55f9881e
proresdec_lgpl: explicitly check coff[3] against slice_data_size
...
The implicit checks via v_data_size and a_data_size don't work in the case
'(hdr_size > 7) && !ctx->alpha_info'.
This fixes segmentation faults due to invalid reads.
This problem was introduced in commit
547c2f002a .
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 1e33035ee7 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:34 +01:00
Andreas Cadhalpun
dc821d42a2
escape124: reject codebook size 0
...
It causes a cb_depth of 32, leading to assertion failures in get_bits.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 226d35c845 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:34 +01:00
Andreas Cadhalpun
b3ac458a5a
mpegts: prevent division by zero
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 1bbb18fe82 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:34 +01:00
Andreas Cadhalpun
3148d1c25f
matroskadec: fix NULL pointer dereference in webm_dash_manifest_read_header
...
The code assumes that s->streams[0] is valid.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit ff100c9dd9 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:34 +01:00
Andreas Cadhalpun
f964046c58
mpegaudio_parser: don't return AVERROR_PATCHWELCOME
...
The API does not allow returning AVERROR codes.
It triggers an assert in av_parser_parse2.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 5249706e9d )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:33 +01:00
Andreas Cadhalpun
0cc619e0d7
mxfdec: fix NULL pointer dereference
...
Metadata streams have priv_data set to NULL.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 0efb610611 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:33 +01:00
Andreas Cadhalpun
0e8c44076d
diracdec: check return code of get_buffer_with_edge
...
If it fails, buffers aren't allocated, causing NULL pointer dereferencing.
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit db79dedb1a )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:33 +01:00
Andreas Cadhalpun
a94f846e2d
ppc: pixblockdsp: do unaligned block accesses correctly again
...
This was broken by the following Libav commit:
4c387c7 ppc: dsputil: do unaligned block accesses correctly
The following tests fail due to this:
fate-checkasm
fate-vsynth1-dnxhd-2k-hr-hq fate-vsynth1-dnxhd-edge1-hr
fate-vsynth1-dnxhd-edge2-hr fate-vsynth1-dnxhd-edge3-hr
fate-vsynth1-dnxhd-hr-sq-mov fate-vsynth1-dnxhd-hr-hq-mov
fate-vsynth2-dnxhd-2k-hr-hq fate-vsynth2-dnxhd-edge1-hr
fate-vsynth2-dnxhd-edge2-hr fate-vsynth2-dnxhd-edge3-hr
fate-vsynth2-dnxhd-hr-sq-mov fate-vsynth2-dnxhd-hr-hq-mov
fate-vsynth3-dnxhd-2k-hr-hq fate-vsynth3-dnxhd-edge1-hr
fate-vsynth3-dnxhd-edge2-hr fate-vsynth3-dnxhd-edge3-hr
fate-vsynth3-dnxhd-hr-sq-mov fate-vsynth3-dnxhd-hr-hq-mov
Fixes trac ticket #5508 .
Reviewed-by: Carl Eugen Hoyos <ceffmpeg@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 3932ccc472 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:33 +01:00
Andreas Cadhalpun
c5fb9df38a
mpeg12dec: unref discarded picture from extradata
...
Otherwise another frame gets referenced into picture, triggering an assert
(from commit 13aae8) in av_frame_ref.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit a92f8edf0c )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:33 +01:00
Andreas Cadhalpun
51ff17d6b9
cavsdec: unref frame before referencing again
...
This fixes asserts (from commit 13aae8) in av_frame_ref and
av_frame_move_ref.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 1966ea012f )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:33 +01:00
Andreas Cadhalpun
e14da0578c
avformat: prevent triggering request_probe assert in ff_read_packet
...
If probe_codec is called with pkt == NULL, it sets probe_packets to 0
and request_probe to -1.
However, request_probe can change when calling s->iformat->read_packet
and thus a probe_packets value of 0 doesn't guarantee a request_probe
value of -1.
In that case calling probe_codec again is necessary to prevent
triggering the assert.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit a5b4476a60 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:46:30 +01:00
Michael Niedermayer
afd0f8f775
Update for 2.8.9
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:27 +01:00
Michael Niedermayer
13c249e2b5
avformat/mpeg: Adjust vid probe threshold to correct mis-detection
...
Fixes: _ij.mp3
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4e5049a230 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:27 +01:00
Michael Niedermayer
698528207a
avcodec/rv40: Test remaining space in loop of get_dimension()
...
Fixes infinite loop
Fixes: 178/fuzz-3-ffmpeg_VIDEO_AV_CODEC_ID_RV40_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1546d487cf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:27 +01:00
Michael Niedermayer
1e86f1a646
avcodec/ituh263dec: Avoid spending a long time in slice sync
...
Fixes: 177/fuzz-3-ffmpeg_VIDEO_AV_CODEC_ID_FLV1_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2baf36caed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:27 +01:00
Michael Niedermayer
ecc5bada26
avcodec/movtextdec: Add error message for tsmb_size check
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0eb3198005 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:27 +01:00
Michael Niedermayer
b0a5794e30
avcodec/movtextdec: Fix tsmb_size check==0 check
...
Fixes: 173/fuzz-3-ffmpeg_SUBTITLE_AV_CODEC_ID_MOV_TEXT_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a609905723 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:27 +01:00
Michael Niedermayer
63504a2d44
avcodec/movtextdec: Fix potential integer overflow
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ea2715768 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:27 +01:00
Michael Niedermayer
f9e76d3304
avcodec/sunrast: Fix input buffer pointer check
...
Fixes: out of array read
Fixes: poc.dat
Found-by: Bingchang, Liu @VARAS of IIE
Tested-by: bc L <l.bing.chang.bc@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 37138338ff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
3213adceb2
avcodec/tscc: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 979bca5134 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
744f78ce0d
avcodec/rawdec: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f0bc0215a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
147a387fba
avcodec/msvideo1: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 161ccdaa06 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
2312d1d979
avcodec/qpeg: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 16793504df )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
1604a2b1e6
avcodec/qtrle: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d196f2a5a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
f39522b6e7
avcodec/msrle: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6330119a0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
09411a7d5e
avcodec/kmvc: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d99101d09 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
ef32b162e8
avcodec/idcinvideo: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a2b8dde659 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
41b1ec0810
avcodec/cinepak: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 121be31060 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
e3f8b32279
avcodec/8bps: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 042faa847f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
fe4c6aeb99
avcodec/dvdsubdec: Fix off by 1 error
...
Fixes out of array read
Found-by: Thomas Garnier using libFuzzer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c92f55847a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
3177ea512f
avcodec/dvdsubdec: Fix buf_size check
...
Fixes out of array access
Found-by: Thomas Garnier using libFuzzer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 25ab1a65f3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Ronald S. Bultje
e25441912b
vp9: change order of operations in adapt_prob().
...
This is intended to workaround bug "665 Integer Divide Instruction May
Cause Unpredictable Behavior" on some early AMD CPUs, which causes a
div-by-zero in this codepath, such as reported in Mozilla bug #1293996 .
Note that this isn't guaranteed to fix the bug, since a compiler is free
to reorder instructions that don't depend on each other. However, it
appears to fix the bug in Firefox, and a similar patch was applied to
libvpx also (see Chrome bug #599899 ).
(cherry picked from commit be885da342 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
abe16359ba
avcodec/interplayvideo: Check side data size before use
...
Fixes out of array read
Found-by: Thomas Garnier using libFuzzer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 85d23e5cbc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:26 +01:00
Michael Niedermayer
b9ab4db9f9
avformat/mxfdec: Check size to avoid integer overflow in mxf_read_utf16_string()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fecb3e82a4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:25 +01:00
Michael Niedermayer
8328c07fb1
avcodec/mpegvideo_enc: Clear mmx state in ff_mpv_reallocate_putbitbuffer()
...
This function must be called from the mb or slice encoding loop and MMX state may not
be clean there
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 03ec6b780c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:25 +01:00
Michael Niedermayer
865e3f5553
avcodec/utils: Clear MMX state before returning from avcodec_default_execute*()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f96f9d111 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:25 +01:00
Moritz Barsnick
d1c87a4a6f
cmdutils: fix typos
...
Signed-off-by: Moritz Barsnick <barsnick@gmx.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3e5d27d7a7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:25 +01:00
Moritz Barsnick
b480ca4dbd
lavfi: fix typos
...
Signed-off-by: Moritz Barsnick <barsnick@gmx.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f4e4bde1f4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:25 +01:00
Moritz Barsnick
bb83ff8b41
lavc: fix typos
...
Signed-off-by: Moritz Barsnick <barsnick@gmx.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3305f71025 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:25 +01:00
Moritz Barsnick
d609986f39
tools: fix grammar error
...
Signed-off-by: Moritz Barsnick <barsnick@gmx.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f71c98ee12 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:25 +01:00
Shivraj Patil
b9ec80322b
avutil/mips/generic_macros_msa: rename macro variable which causes segfault for mips r6
...
Signed-off-by: Shivraj Patil <shivraj.patil@imgtec.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1cc13cd2a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-11-26 15:12:25 +01:00
Ronald S. Bultje
62b2b2195b
videodsp: fix 1-byte overread in top/bottom READ_NUM_BYTES iterations.
...
This can overread (either before start or beyond end) of the buffer in
Nx1 (i.e. height=1) images.
Fixes mozilla bug 1240080.
(cherry picked from commit 0f88b3f82f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-10-05 03:06:45 +02:00
Michael Niedermayer
239f75d6c3
avformat/avidec: Check nb_streams in read_gab2_sub()
...
Fixes null pointer dereference
Fixes: 1/null_point.avi
Found-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2679ad4773 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-10-05 03:06:45 +02:00
Michael Niedermayer
a772613100
avformat/avidec: Remove ancient assert
...
This assert can with crafted files fail, a warning is already printed
for this case.
Fixes assertion failure
Fixes:1/assert.avi
Found-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 14bac7e00d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-10-05 03:06:45 +02:00
Sasi Inguva
ca216c71c7
lavc/movtextdec.c: Avoid infinite loop on invalid data.
...
Signed-off-by: Sasi Inguva <isasi@google.com >
(cherry picked from commit 7e9e1b7070 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-28 11:12:20 +02:00
Michael Niedermayer
ab737ab31d
avcodec/ansi: Check dimensions
...
Fixes: 1.avi
Found-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 69449da436 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-26 21:43:04 +02:00
Michael Niedermayer
69b00a7fb6
avcodec/cavsdsp: use av_clip_uint8() for idct
...
Fixes out of array read
Fixes: 1.swf
Found-by: 连一汉 <lianyihan@360.cn >
Tested-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e318f110b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-23 18:19:56 +02:00
Michael Niedermayer
d828aabf03
Changelog: Update
2016-09-18 01:18:35 +02:00
Michael Niedermayer
0ffdabb58d
avformat/movenc: Check packet in mov_write_single_packet() too
...
Fixes assertion failure
Found-by: durandal117
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2834313933 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-18 00:18:11 +02:00
Michael Niedermayer
e1ab851da6
avformat/movenc: Factor check_pkt() out
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit deabcd2c05 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-18 00:18:11 +02:00
Xinzheng Zhang
0bdfdd6d2f
avformat/utils: fix timebase error in avformat_seek_file()
...
When there is only one stream and stream_index has not specified,
The ts has been transferd by the timebase of stream0 without modifying the stream_index
In this condation it cause seek failure.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ecc04b4f2f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-18 00:18:11 +02:00
Michael Niedermayer
f8dcc9e718
avcodec/g726: Add missing ADDB output mask
...
Fixes: 1.poc
Fixes out of array read
Found-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5af1240fc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-18 00:18:11 +02:00
Michael Niedermayer
175a95bfdd
avcodec/avpacket: clear side_data_elems
...
Fixes null pointer dereference
Found-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5e1bf9d8c0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-18 00:18:11 +02:00
Michael Niedermayer
ac60619acd
avcodec/ccaption_dec: Use simple array instead of AVBuffer
...
This is simpler and fixes an out of array read, fixing it with AVBuffers
would be more complex
Fixes: e00d9e6e50e5495cc93fea41147b97bb/asan_heap-oob_12dcdbb_8798_b32a97ea722dd37bb5066812cc674552.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 752e6dfa3e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-18 00:18:11 +02:00
Michael Niedermayer
48c51b796a
swscale/swscale_unscaled: Try to fix Rgb16ToPlanarRgb16Wrapper() with slices
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e57d99dd4e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-18 00:18:11 +02:00
Michael Niedermayer
26eccf4bd8
swscale/swscale_unscaled: Fix packed_16bpc_bswap() with slices
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47bc1bdafb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-18 00:18:11 +02:00
Michael Niedermayer
8ddeae57ae
avformat/avidec: Fix infinite loop in avi_read_nikon()
...
Fixes: 360/test.poc
Found-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e4e4a9cad7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-18 00:18:11 +02:00
Tobias Rapp
c32ce247a0
cmdutils: fix implicit declaration of SetDllDirectory function
...
Pre-processor check changed by commiter.
Signed-off-by: James Almer <jamrial@gmail.com >
2016-08-29 20:02:24 -03:00
James Almer
2f9bc30956
cmdutils: check for SetDllDirectory() availability
...
It's only available on Windows XP or newer.
Should fix compilation with mingw32 using the default OS target.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
2016-08-26 13:12:02 +02:00
Michael Niedermayer
562f2ba4ed
avcodec/aacenc: Tighter input checks
...
Fixes occurance of NaN/Inf leading to assertion failures and out of array access
Fixes: d1c38a09acc34845c6be3a127a5aacaf/signal_sigsegv_3982225_6121_d18bd5451d4245ee09408f04badd1b83.wmv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 77bf96b047 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-23 12:36:25 +02:00
Michael Niedermayer
5a96b4b443
libavcodec/wmalosslessdec: Check the remaining bits
...
Fixes assertion failure
Fixes: 24ebfda03228b5cc1ef792608cfba458/signal_sigabrt_7ffff6ae7c37_6473_3fa8a111dbc752b1a7c411c5ab79aaa4.wma
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 67318187fb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-21 21:11:47 +02:00
Michael Niedermayer
33ec0280f3
avcodec/diracdec: Check numx/y
...
Fixes division by 0
Fixes: 60261c4469ba3e11059890fb2832a515/asan_generic_135e694_2790_beb94eaa0aeb7d11c0437375a8964a99.drc
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a31e08fa1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-20 19:40:26 +02:00
Michael Niedermayer
2b135f266d
avcodec/indeo2: check ctab
...
Fixes out of array access
Fixes: 6b73fa392ac808f02e95a4e0a5770026/asan_static-oob_1b15f9a_1969_e7778535e5f27225fe0d6ded14721430.AVI
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9ffe44c5c7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-19 14:47:39 +02:00
Michael Niedermayer
e965fedf7e
avformat/swfdec: Fix inflate() error code check
...
Fixes infinite loop
Fixes endless.poc
Found-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a453bbb68f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-19 11:03:50 +02:00
Michael Niedermayer
7132e71a84
Update for FFmpeg 2.8.8
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 22:26:37 +02:00
Michael Niedermayer
7a2329fac1
avcodec/h264: Put context_count check back
...
Fixes assertion failure
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f883f0b0bd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:14 +02:00
Hendrik Leppkes
65fff8e71a
cmdutils: remove the current working directory from the DLL search path on win32
...
Reviewed-by: Matt Oliver <protogonoi@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3bf142c773 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:13 +02:00
Michael Niedermayer
3988470ee3
avcodec/raw: Fix decoding of ilacetest.mov
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bbec14de31 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:13 +02:00
Michael Niedermayer
3a6b27caf8
avcodec/ffv1enc: Fix assertion failure with non zero bits per sample
...
Fixes Ticket5736
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1bfeda5a3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:13 +02:00
Michael Niedermayer
942c3bfbdf
avformat/oggdec: Fix integer overflow with invalid pts
...
If negative pts are possible for some codecs in ogg then the code needs to be
changed to use signed values.
Found-by: Thomas Guilbert <tguilbert@google.com >
Fixes: clusterfuzz_usan-2016-08-02
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c5cc3b08e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:13 +02:00
Michael Niedermayer
486aa4fe39
ffplay: Fix invalid array index
...
Found-by: Thomas Guilbert <tguilbert@google.com >
Fixes: clusterfuzz_usan-2016-08-02
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6cd9a8b67a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:13 +02:00
Michael Niedermayer
da12d544bf
avcodec/vp9_parser: Check the input frame sizes for being consistent
...
Suggested-by: BBB
Fixed-by: BBB
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 77b0f3f26d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:13 +02:00
Kacper Michajłow
73e09e371b
libavformat/rtpdec_asf: zero initialize the AVIOContext struct
...
This fixes crash in avformat_open_input() when accessing
protocol_whitelist field.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e947b75b1c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:13 +02:00
Kacper Michajłow
d3ecb24539
libavutil/opt: Small bugfix in example.
...
Fix const corectness and zero init the struct. This example code would actually crash when initializing string.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 69630f4d30 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:13 +02:00
Sasi Inguva
0f6e244bb0
libx264: Increase x264 opts character limit to 4096
...
Signed-off-by: Sasi Inguva <isasi@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 282477bf45 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:13 +02:00
Michael Niedermayer
054db63120
avformat/mov: Check sample size
...
Fixes integer overflow
Fixes: poc.mp4
Found-by: ajax secure <ajax4sec@hotmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8a3221cc67 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:13 +02:00
Michael Niedermayer
4a0b0cffc1
avformat/format: Fix registering a format more than once and related races
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4cc896ea5f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 20:25:13 +02:00
Michael Niedermayer
9fefd76eec
avcodec/flac_parser: Raise threshold for detecting invalid data
...
Fixes regression from Ticket5428
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b0b3676e13 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
087bd8fbdf
avfilter/vf_telecine: Make frame writable before writing into it
...
Fixes Ticket 5627
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fa0097e008 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
40ffbe7678
avcodec/mpc8: Correct end truncation
...
Fixes Ticket5478
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b21f674876 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
ed7fe48445
avcodec/mpegvideo: Do not clear the parse context during init
...
It is allocated before, this cannot work
Fixes Ticket5613
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 24f5136196 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
d9ad05abce
MAINTAINERs cleanup (remove myself from things i de facto dont maintain)
...
x86 is maintained entirely by others these days
ML, mostly too
remove myself from a few spots that have other maintainers and where i
just dont know the code that well anyway to do an ideal job
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bb5bc08ba6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
bfca58ee2f
avcodec/h264: Fix off by 1 context count
...
Fixes fate-h264-xavc-4389 with slice threads
(cherry picked from commit 27c1eae55f )
Conflicts:
libavcodec/h264.c
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
8a32f19d5b
avcodec/alsdec: Check r to prevent out of array read
...
No testcase known
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c36fc857b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Umair Khan
1dd34bdb09
avcodec/alsdec: fix max bits in ltp prefix code
...
The maximum number of bits int the prefix code for
p(0) is 4. By setting it as 3, we were missing the
last 0 bit.
This fixes bug #4715 present on the trac.
Signed-off-by: Umair Khan <omerjerk@gmail.com >
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d64ba9d18 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
04987035ff
avcodec/utils: check skip_samples signedness
...
Fixes Ticket5528
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 153ab83bd3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
a4484854db
avformat/mpegts: Do not trust BSSD descriptor, it is sometimes not an S302M stream
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5eb70ad95 )
Conflicts:
libavformat/mpegts.c
2016-08-15 18:54:34 +02:00
Michael Niedermayer
003fa5c3e3
avcodec/bmp_parser: Check fsize
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 43a4276c69 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
166921c23e
avcodec/bmp_parser: reset state
...
Fixes part of ticket 5598
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 37005e65eb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
591c0b527c
avcodec/bmp_parser: Fix remaining size
...
Fixes part of ticket 5598
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 250b620d29 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
731848ef80
avcodec/bmp_parser: Fix frame_start_found in cross frame cases
...
Fixes part of ticket 5598
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bfe945ac3a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
76fd8145a1
avfilter/af_amix: dont fail if there are no samples in output_frame()
...
Fixes Ticket5326
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit abc957e896 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Vivekanand
5af0ada442
avformat/allformats: Making av_register_all() thread-safe.
...
When multiple threads tries to call av_register_all(), the first thread sets
initialized to 1 and do the register process. At the same time, other thread might
also call av_register_all(), which returns immediately because initialized is set to 1
(even when it has not completed registering codecs). We can avoid this problem
if we set initialised to 1 while exiting from function.
Github: Closes #196
(cherry picked from commit b092ee701f )
Conflicts:
libavformat/allformats.c
2016-08-15 18:54:34 +02:00
Michael Niedermayer
ffb503c9a1
avcodec/mpegvideo: Deallocate last/next picture earlier
...
Fixes regression with mplayers direct rendering and reduces buffer count
pressure in some cases
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 39c0b22df4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
2bbbd3e50a
avcodec/bmp_parser: Fix state
...
Fixes Ticket5598
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d0388bd32e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Thomas Guilbert
669fc1338f
avformat/oggparseopus: Fix Undefined behavior in oggparseopus.c and libavformat/utils.c
...
Fixes: usan_granule_overflow
constant type fix by commiter
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1a82d2cf8f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
9fe1012910
doc/developer.texi: Add a code of conduct
...
See: [FFmpeg-devel] [Vote] Code of Conduct
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 89e9393022 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
90b27febc6
avformat/avidec: Detect index with too short entries
...
Fixes Ticket5498
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d08f2c172f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Chris Cunningham
c1c6cb21b7
avformat/utils: Check negative bps before shifting in ff_get_pcm_codec_id()
...
Fixes: undefined shift.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2875745d35 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
2e0af764b3
avformat/utils: Do not compute the bitrate from duration == 0
...
Fixes division by 0 in fate-acodec-ra144
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 635b2ec5f2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
8857dc6cd8
ffmpeg: Check that r_frame_rate is set before attempting to use it
...
Avoids unexpected occurance and dependency on NaN behavior and divisions by 0
Testcase: fate-lavf-fate-avi_cram
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6085d6b2ae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
67c7f8ca14
swresample/rematrix: Use clipping s16 rematrixing if overflows are possible
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f76157eb0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
500cf2e159
swresample/rematrix: Use error diffusion to avoid error in the DC component of the matrix
...
This fixes the sum of the integer coefficients ending up summing to a value
larger than the value representing unity.
This issue occurs with qN0.dts when converting to stereo
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7fe81bc4f8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Chris Cunningham
345231336f
libavformat/oggdec: Free stream private when header parsing fails.
...
Leaking this private structure opens up the possibility that it may
be re-used when parsing later packets in the stream. This is
problematic if the later packets are not the same codec type (e.g.
private allocated during Vorbis parsing, but later packets are Opus
and the private is assumed to be the oggopus_private type in
opus_header()).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 542f725964 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
fc6f314838
avformat/utils: Check bps before using it in a shift in ff_get_pcm_codec_id()
...
Fixes undefined shift
Fixes: usan_shift
Found-by: Thomas Guilbert <tguilbert@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea791c080d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
3bbef6082a
avformat/oggparseopus: Check that granule pos is within the supported range
...
Larger values would imply file durations of astronomic proportions and cause
overflows
Fixes integer overflow
Fixes: usan_int64_overflow
Found-by: Thomas Guilbert <tguilbert@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8efaee3710 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
0aaf66fb2e
avcodec/mjpegdec: Do not try to detect last scan but apply idct after all scans for progressive jpeg
...
Fixes: IMG-20160418-WA0002.jpg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit deaf58abf2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Michael Niedermayer
330f4ef48c
avformat/options_table: Add missing identifier for very strict compliance
...
Fixes Ticket5443
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 11db7eee9b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-15 18:54:34 +02:00
Luca Barbato
8887dafda1
librtmp: Avoid an infiniloop setting connection arguments
...
The exit condition was missing.
Signed-off-by: Timothy Gu <timothygu99@gmail.com >
(cherry picked from commit e85d38c20a )
Signed-off-by: Timothy Gu <timothygu99@gmail.com >
2016-07-26 12:08:58 -07:00
James Almer
e9b7ae08d6
avformat/oggparsevp8: fix pts calculation on pages ending with an invisible frame
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 5adfbd3918 )
2016-07-25 09:59:54 -03:00
Michael Niedermayer
da4ea97161
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-29 13:27:40 +02:00
Michael Niedermayer
4e4afe29b9
avcodec/motion_est: Attempt to fix "short data segment overflowed" on IA64
...
This decreases the MV related encoding table sizes
This should have little effect on real world video encoding performance
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d7c75a5db0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-29 13:04:17 +02:00
Michael Niedermayer
2a15860227
avformat/ffmdec: Check pix_fmt
...
Fixes crash
Fixes Ticket5412
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 78baa450d9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-28 23:26:45 +02:00
Michael Niedermayer
66443b0cf3
update for 2.8.7
2016-04-27 05:43:39 +02:00
Michael Niedermayer
58a7500492
avcodec/ttaenc: Reallocate packet if its too small
...
Fixes assertion failure
Fixes Ticket5394
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 005c61c6b8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:12 +02:00
Jan Ekström
3003277103
pgssubdec: fix subpicture output colorspace and range
...
Functionality used before didn't widen the values from limited to
full range. Additionally, now the decoder uses BT.709 where it
should be used according to the video resolution.
Default for not yet set colorimetry is BT.709 due to most observed
HDMV content being HD.
BT.709 coefficients were gathered from the first two parts of BT.709
to BT.2020 conversion guide in ARIB STD-B62 (Pt. 1, Chapter 6.2.2).
They were additionally confirmed by manually calculating values.
Fixes #4637
(cherry picked from commit 9779b62624 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:12 +02:00
Michael Niedermayer
05b33258e3
avcodec/ac3dec: Reset SPX when switching from EAC3 to AC3
...
Fixes Ticket5319
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9ac154d1fa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:12 +02:00
Michael Niedermayer
c6e3682a0c
avfilter/vf_drawtext: Check return code of load_glyph()
...
Fixes segfault
Fixes Ticket5347
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2e67a99fbc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:12 +02:00
Paul B Mahol
e80a4ce69f
avcodec/takdec: add code that got somehow lost in process of REing
...
Signed-off-by: Paul B Mahol <onemda@gmail.com >
(cherry picked from commit 38797a8033 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:12 +02:00
Paul B Mahol
edc61e3aba
avcodec/apedec: fix decoding of stereo files with one channel full of silence
...
Signed-off-by: Paul B Mahol <onemda@gmail.com >
(cherry picked from commit 9149e9c0ba )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:12 +02:00
Michael Niedermayer
5127cb2e78
avcodec/avpacket: Fix off by 5 error
...
Fixes out of array read
Fixes: mozilla bug 1266129
Found-by: Tyson Smith
Tested-by: Tyson Smith
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9f36ea57ae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:12 +02:00
Ivan
70b3e170f9
avcodec/h264: Fix for H.264 configuration parsing
...
Sometimes video fails to decode if H.264 configuration changes mid stream.
The reason is that configuration parser assumes that nal_ref_idc is equal to 11b
while actually some codecs but 01b there. The H.264 spec is somewhat
vague about this but it looks like it allows any non-zero nal_ref_idc for sps/pps.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a727606c4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:12 +02:00
Michael Niedermayer
4e174d95f5
avcodec/bmp_parser: Ensure remaining_size is not too small in startcode packet crossing corner case
...
Fixes Ticket 5438
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e26bdd59b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Marios Titas
21fb4d1282
avfilter/src_movie: fix how we check for overflows with seek_point
...
Currently, if the movie source filter is used and a seek_point is
specified on a file that has a negative start time, ffmpeg will fail.
An easy way to reproduce this is as follows:
$ ffmpeg -vsync passthrough -filter_complex 'color=d=10,setpts=PTS-1/TB' test.mp4
$ ffmpeg -filter_complex 'movie=filename=test.mp4:seek_point=2' -f null -
The problem is caused by checking for int64_t overflow the wrong way.
In general, to check whether a + b overflows, it is not enough to do:
a > INT64_MAX - b
because b might be negative; the correct way is:
b > 0 && > a > INT64_MAX - b
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1f9734f97 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Aaron Boxer
b5d4b1731e
avcodec/j2kenc: Add attribution to OpenJPEG project:
...
http://ghostscript.com/~tor/gs-browse/gs/openjpeg/libopenjpeg/t1.c
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b6b4b0a65e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Michael Niedermayer
ef54c14425
avcodec/h264_slice: Check PPS more extensively when its not copied
...
Fixes Ticket5371
Fixes null pointer dereference
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c50be7a52b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Michael Niedermayer
a35e6ec1bd
avcodec/libutvideodec: copy frame so it has reference counters when refcounted_frames is set
...
Reviewed-by: maintainer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0cd9ff4e3a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Ico Doornekamp
a286f1a5ff
avformat/rtpdec_jpeg: fix low contrast image on low quality setting
...
Original mail and my own followup on ffmpeg-user earlier today:
I have a device sending out a MJPEG/RTP stream on a low quality setting.
Decoding and displaying the video with libavformat results in a washed
out, low contrast, greyish image. Playing the same stream with VLC results
in proper color representation.
Screenshots for comparison:
http://zevv.nl/div/libav/shot-ffplay.jpg
http://zevv.nl/div/libav/shot-vlc.jpg
A pcap capture of a few seconds of video and SDP file for playing the
stream are available at
http://zevv.nl/div/libav/mjpeg.pcap
http://zevv.nl/div/libav/mjpeg.sdp
I believe the problem might be in the calculation of the quantization
tables in the function create_default_qtables(), the attached patch
solves the issue for me.
The problem is that the argument 'q' is of the type uint8_t. According to the
JPEG standard, if 1 <= q <= 50, the scale factor 'S' should be 5000 / Q.
Because the create_default_qtables() reuses the variable 'q' to store the
result of this calculation, for small values of q < 19, q wil subsequently
overflow and give wrong results in the calculated quantization tables. The
patch below uses a new variable 'S' (same name as in RFC2435) with the proper
range to store the result of the division.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e3e6a2cff4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Michael Niedermayer
d7c15fb25a
avcodec/mjpegenc_common: Store approximate aspect if exact cannot be stored
...
Fixes Ticket5244
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 068026b0f7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Mark Thompson
5c289c932f
lavc/hevc: Allow arbitrary garbage in bytestream as long as at least one NAL unit is found.
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fbec157ea0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Michael Niedermayer
e8b1ce8d1b
avcodec/resample: Remove disabled and faulty code
...
Fixes Ticket5345
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 50ef7361cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Luca Barbato
d77e1c712b
indeo2: Fix banding artefacts
...
Rename luma table to delta table and change how it is used.
CC: libav-stable@libav.org
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com >
Signed-off-by: Diego Biurrun <diego@biurrun.de >
(cherry picked from commit f8c34f4b8d )
(cherry picked from commit 73f3c8f73e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Luca Barbato
d2e473a245
indeo2data: K&R formatting cosmetics
...
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com >
Signed-off-by: Diego Biurrun <diego@biurrun.de >
(cherry picked from commit d4066a7024 )
(cherry picked from commit 522ab0b9a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Przemysław Sobala
4818e074a0
avcodec/imgconvert: Support non-planar colorspaces while padding
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0d097a869c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Michael Niedermayer
7dac928e61
avutil/random_seed: Add the runtime in cycles of the main loop to the entropy pool
...
This should theoretically improve the randomness slightly
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2540d884f3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Martin Cracauer
49fc295612
avutil/channel_layout: AV_CH_LAYOUT_6POINT1_BACK not reachable in parsing
...
Trying to make heads and tails out of DTS 6.1 I can across this typo.
I also noticed that this wiki page is incorrect or misleading, the
channel order for 6.1 given does not match the source code. At the
least it should be clarified that the layout given does not apply to
DTS. https://trac.ffmpeg.org/wiki/AudioChannelManipulation
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73d1398f0c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Michael Niedermayer
d10f4744ff
avformat/concatdec: set safe mode to enabled instead of auto
...
This is safer, as a selected demuxer could still mean that it was auto-detected
by a user application
Reviewed-previously-by: Nicolas George <george@nsup.org >
Reviewed-previously-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 689211d572 )
Conflicts:
libavformat/concatdec.c
2016-04-27 04:40:11 +02:00
Michael Niedermayer
bf76124c51
avformat/utils: fix dts from pts code in compute_pkt_fields() during ascending delay
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit de1de49324 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Boris Nagels
48c25d0512
avformat/rtpenc: Fix integer overflow in NTP_TO_RTP_FORMAT
...
RTCP synchronization packet was broken since commit in ffmpeg version > 2.8.3
(commit: e04b039b15 ) Since this commit (2e814d0329 )
"rtpenc: Simplify code by introducing a macro for rescaling NTP timestamps", NTP_TO_RTP_FORMAT
uses av_rescale_rnd() function to add the data to the packet.
This causes an overflow in the av_rescale_rnd() function and it will return INT64_MIN.
Causing the NTP stamp in the RTCP packet to have an invalid value.
Github: Closes #182
Reverting commit '2e814d0329aded98c811d0502839618f08642685' solves the problem.
(cherry picked from commit 1109ed7973 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Michael Niedermayer
69942c4f6d
avformat/cache: Fix memleak of tree entries
...
Found-by: jamrial
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 554f6e930c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Rodger Combs
7aaab36874
lavf/mov: downgrade sidx errors to non-fatal warnings; fixes trac #5216
...
(cherry picked from commit 22dbc1caaf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Rodger Combs
36e5854801
lavf/mov: fix sidx with edit lists
...
(cherry picked from commit 3617e69d50 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
Michael Niedermayer
82492c3a96
avcodec/mjpegdec: Fix decoding slightly odd progressive jpeg
...
Fixes: ebd58db6-dc86-11e5-91c2-59daeddf50c7.jpg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c6f4720b86 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-27 04:40:11 +02:00
James Almer
175110a041
libwebpenc_animencoder: print library messages in verbose log levels
...
Reviewed-by: James Zern <jzern@google.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit f875ba4873 )
2016-03-17 12:57:23 -03:00
James Almer
76c157cfd7
libwebpenc_animencoder: zero initialize the WebPAnimEncoderOptions struct
...
This zeroes the WebPAnimEncoderOptions.verbose field, silencing library info messages
printed to stderr.
Reviewed-by: James Zern <jzern@google.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 626b6b769c )
2016-03-17 12:57:20 -03:00
Paul B Mahol
f9f9f31c6c
doc/utils: fix typo for min() description
...
Signed-off-by: Paul B Mahol <onemda@gmail.com >
(cherry picked from commit bdf474bcff )
Signed-off-by: Timothy Gu <timothygu99@gmail.com >
2016-03-02 16:44:18 -08:00
Michael Niedermayer
800334947d
avcodec/avpacket: clear priv in av_init_packet()
...
This should fix leaving uninitialized pointers in priv which can confuse
user applications.
See: https://github.com/golang/go/issues/14426
Only for release branches
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-24 16:56:12 +01:00
Michael Niedermayer
4ccb97650a
swscale/utils: Fix chrSrcHSubSample for GBRAP16
...
Fixes part of Ticket5264
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 67e5bd0c50 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-24 00:04:51 +01:00
Michael Niedermayer
a3d698dcb1
swscale/input: Fix GBRAP16 input
...
Fixes part of Ticket5264
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df36257a53 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-24 00:04:17 +01:00
Carl Eugen Hoyos
1e9aa7907e
postproc: fix unaligned access
...
Based on 59074310 by Andreas Cadhalpun.
Fixes ticket #5259 .
(cherry picked from commit 2aa21eec1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-23 18:01:08 +01:00
Michael Niedermayer
23ef5996a5
avutil/pixdesc: Make get_color_type() aware of CIE XYZ formats
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1ec7a70380 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-22 03:50:51 +01:00
Michael Niedermayer
b3a64fc039
avcodec/h264: Execute error concealment before marking the frame as done.
...
Fixes race condition causing artifacts
Fixes Ticket4122
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 98a0053d0f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-19 02:07:46 +01:00
Michael Niedermayer
21a6b7930e
swscale/x86/output: Fix yuv2planeX_16* with unaligned destination
...
Reviewed-by: BBB
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f6492a2ea8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-17 05:17:35 +01:00
Michael Niedermayer
530192b0e0
swscale/x86/output: Move code into yuv2planeX_mainloop
...
Reviewed-by: BBB
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d07f6e5f1c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-17 05:17:18 +01:00
KO Myung-Hun
8dd71d0bd4
MAINTAINERS: add myself as an OS/2 maintainer
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 346ec91764 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-15 13:22:45 +01:00
Michael Niedermayer
536f6c4ec2
avutil/frame: Free destination qp_table_buf in frame_copy_props()
...
Fixes memleak
Fixes: Ticket4899
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4099e4a77d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-13 21:08:23 +01:00
Michael Niedermayer
af21d609a0
Update for 2.8.6
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 16:23:43 +01:00
Michael Niedermayer
b15ae71305
avcodec/jpeg2000dec: More completely check cdef
...
Fixes out of array access
Fixes: j2k-poc.bin
Found-by: Lucas Leong <wmliang.tw@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0aada30510 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
6fec0dbd2e
avutil/opt: check for and handle errors in av_opt_set_dict2()
...
Previously errors could result in random entries to be lost.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f3ace85d88 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Paul B Mahol
0dc379cfa6
avcodec/flacenc: fix calculation of bits required in case of custom sample rate
...
Sample rate of 11025 takes 16 bits but previous code would pick only 8.
Fixes assertion failure.
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com >
Signed-off-by: Paul B Mahol <onemda@gmail.com >
(cherry picked from commit 3e7d684912 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
b432d883e6
avformat: Document urls a bit
...
Spell-checked-by: Moritz Barsnick <barsnick@gmx.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3130556c0e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
736e42bc33
avformat/libquvi: Set default demuxer and protocol limitations
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 15cc98a0f3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
cb88f428b3
avformat/concat: Check protocol prefix
...
Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e32d01432 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
e0d53cbeef
doc/demuxers: Document enable_drefs and use_absolute_path
...
Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9a8034b8bc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
9819998342
avcodec/mjpegdec: Check for end for both bytes in unescaping
...
Fixes assertion failure
Fixes: c40c779601b77dc6e19aaea0b04b9751/signal_sigabrt_7ffff6ae7cb7_5769_b94f6ec70caecb2d3d76b4771b109ac1.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 509c9e74e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
85cfcb87ff
avcodec/mpegvideo_enc: Check for integer overflow in ff_mpv_reallocate_putbitbuffer()
...
Fixes assertion failure
Fixes: 6568d187979ce17878b6fe5fbbb89142/signal_sigabrt_7ffff6ae7cb7_7176_564bbc6741bdcf907f5c4e685c9a77a2.mpg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b65efbc0f4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
971f47f2eb
avformat/avformat: Replace some references to filenames by urls
...
Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 41e07390e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
00393c56da
avcodec/wmaenc: Check ff_wma_init() for failure
...
Fixes null pointer dereference
Fixes: c4faf8280ba366bf00a79d425f2910a8/signal_sigsegv_1f96477_5177_1448ba7e4125faceb966f44ceb69abfa.qcp
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 19e456d48c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
f77b656b6e
avcodec/mpeg12enc: Move high resolution thread check to before initializing threads
...
Cleaner solution is welcome!
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a53fbda9dc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
8ed4b44657
avformat/img2dec: Use AVOpenCallback
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b750b67d13 )
Conflicts:
libavformat/img2dec.c
2016-01-28 15:53:54 +01:00
Michael Niedermayer
642c54270b
avformat/avio: Limit url option parsing to the documented cases
...
This feature is not know much or used much AFAIK, and it might be helpfull in
exploits.
No specific case is known where it can be used in an exploit though
subsequent commits depend on this commit though
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 984d58a344 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
d64ff3a6a9
avformat/img2dec: do not interpret the filename by default if a IO context has been opened
...
With this, user applications which use custom IO and have set a IO context will not have
their already opened IO context ignored and glob/seq being interpreted
Comments and tests from maintainers of user apps are welcome!
Liked-by: wm4 <nfxjfg@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ccedc1c78 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Michael Niedermayer
c6f6829ce6
avcodec/ass_split: Fix null pointer dereference in ff_ass_style_get()
...
Fixes: 55d71971da50365d542ed14b65565fe1/signal_sigsegv_4765a4_8499_f146af090a94f591d6254515c7700ef5.mkv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 158f0545d8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:54 +01:00
Derek Buitenhuis
b9551e71bf
mov: Add an option to toggle dref opening
...
This feature is mostly only used by NLE software, and is
both of dubious value being enabled by default, and a
possible security risk.
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 712d962a6a )
Conflicts:
libavformat/isom.h
libavformat/mov.c
libavformat/version.h
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:53 +01:00
Michael Niedermayer
828d85bf86
avcodec/gif: Fix lzw buffer size
...
Fixes out of array access
Fixes: aaa479088e6fb40b04837b3119f47b04/asan_heap-oob_e38c68_8576_9d653078b2470700e2834636f12ff557.tga
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 03d83ba34b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:53 +01:00
Michael Niedermayer
aa833e1a60
avcodec/put_bits: Assert buf_ptr in flush_put_bits()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ef5de0f19 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:53 +01:00
Michael Niedermayer
61850f1c84
avcodec/tiff: Check subsample & rps values more completely
...
Fixes out of array access
Fixes: 83aedfb29af669c4d6e10f1bfad974d2/asan_heap-oob_1ab42fe_4984_9f6ec14462f8d8a00ea24b320572a963.tif
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 89f464e9c2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:53 +01:00
Michael Niedermayer
6897859b5a
swscale/swscale: Add some sanity checks for srcSlice* parameters
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 321e85e176 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:53 +01:00
Michael Niedermayer
f121ed611e
swscale/x86/rgb2rgb_template: Fix planar2x() for short width
...
Fixes: 451b3e0cf956c0bd2f27ed753ac24050/asan_heap-oob_2873c01_3231_7ed10a9464d15f0d57277f5917c566a8.AVI
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8a9aaab26 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:53 +01:00
Michael Niedermayer
6eb76b34ca
swscale/swscale_unscaled: Fix odd height inputs for bayer_to_yv12_wrapper()
...
Fixes: 372d2df1f04b49e25f109f07f90b1505/asan_heap-oob_2835d2e_8501_99e0114d7ba3a6db885d0b4684d200c1.cine
Fixes out of array read
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 757248ea3c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:53 +01:00
Michael Niedermayer
034edcec6d
swscale/swscale_unscaled: Fix odd height inputs for bayer_to_rgb24_wrapper()
...
Fixes: 372d2df1f04b49e25f109f07f90b1505/asan_heap-oob_2835d2e_8501_99e0114d7ba3a6db885d0b4684d200c1.cine
Fixes out of array read
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ad3b6fa7d8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-28 15:53:53 +01:00
Michael Niedermayer
8008a029ab
avcodec/aacenc: Check both channels for finiteness
...
Fixes null pointer dereference
Fixes: 10412fc52ecc6eab40ed67f82ca7b372/signal_sigsegv_2618c99_2129_f808373959e46afb165593332799ffbc.aif
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 057549a9cc )
Conflicts:
libavcodec/aacenc.c
2016-01-28 15:53:53 +01:00
Andreas Cadhalpun
d640bc7545
asfdec_o: check for too small size in asf_read_unknown
...
This fixes infinite loops due to seeking back.
Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit c29e87ad55 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:45 +01:00
Andreas Cadhalpun
93559adfbf
asfdec_o: break if EOF is reached after asf_read_packet_header
...
asf_read_payload can unset eof_reached, so check it also before calling
that function.
This fixes infinite loops.
Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 0e32153e9c )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:45 +01:00
Andreas Cadhalpun
4679e54388
asfdec_o: make sure packet_size is non-zero before seeking
...
This fixes infinite loops due to seeking back.
Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 3776a72962 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:45 +01:00
Andreas Cadhalpun
782257ba66
asfdec_o: prevent overflow causing seekback
...
This fixes infinite loops.
Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 74474750f1 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:45 +01:00
Andreas Cadhalpun
e188c267c8
asfdec_o: check avio_skip in asf_read_simple_index
...
The loop can be very long, even though the file is very short.
Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 0002d845e8 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:44 +01:00
Andreas Cadhalpun
407ab167c0
asfdec_o: reject size > INT64_MAX in asf_read_unknown
...
Both avio_skip and detect_unknown_subobject use int64_t for the size
parameter.
This fixes a segmentation fault due to infinite recursion.
Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit aa18016996 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:44 +01:00
Andreas Cadhalpun
d7fbd03660
asfdec_o: only set asf_pkt->data_size after sanity checks
...
Otherwise invalid values are used unchecked in the next run.
This can cause NULL pointer dereferencing.
Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 763c572801 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:44 +01:00
Hendrik Leppkes
2cd41c5d52
Merge commit '8375dc1dd101d51baa430f34c0bcadfa37873896'
...
* commit '8375dc1dd101d51baa430f34c0bcadfa37873896':
asfdec: handle the case when the stream index has an invalid value better
Merged-by: Hendrik Leppkes <h.leppkes@gmail.com >
(cherry picked from commit bf67ae3cfa )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:44 +01:00
Andreas Cadhalpun
1272b88d04
dca: fix misaligned access in avpriv_dca_convert_bitstream
...
src and dst are only 8-bit-aligned, so accessing them as uint16_t causes
SIGBUS crashes on architectures like sparc.
This fixes ubsan runtime error: load of misaligned address for type
'const uint16_t', which requires 2 byte alignment
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 44ac13eed4 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:44 +01:00
Andreas Cadhalpun
cf99f0dd0f
brstm: fix missing closing brace
...
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 1cb2331eca )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:44 +01:00
Andreas Cadhalpun
247bb203e4
brstm: also allocate b->table in read_packet
...
This fixes NULL pointer dereferencing if the codec is forced to
adpcm_thp even though a different one was detected.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit bcf4ee26a0 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:44 +01:00
Andreas Cadhalpun
94b9e7caae
brstm: make sure an ADPC chunk was read for adpcm_thp
...
This fixes NULL pointer dereferencing.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit d7d37c479f )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:44 +01:00
Andreas Cadhalpun
6ffaf40c02
vorbisdec: reject rangebits 0 with non-0 partitions
...
This causes non-unique elements in floor_setup->data.t1.list, which
makes the stream undecodable according to the specification.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit e7a7b3135a )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:44 +01:00
Andreas Cadhalpun
e3d7796336
vorbisdec: reject channel mapping with less than two channels
...
It causes the angle channel number to equal the magnitude channel
number, which makes the stream undecodable according to the
specification.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit b4b13848de )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:44 +01:00
Andreas Cadhalpun
667a23a032
ffmdec: reset packet_end in case of failure
...
This fixes segmentation faults caused by passing a packet_ptr of NULL to
memcpy.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 40eb2531b2 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:45:44 +01:00
Paul B Mahol
7b0fb4fdf7
avformat/ipmovie: put video decoding_map_size into packet and use it in decoder
...
The size of decoding map can differ from one calculated
internally, producing artifacts while decoding video.
Signed-off-by: Paul B Mahol <onemda@gmail.com >
(cherry picked from commit c293ef258c )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:28:49 +01:00
Paul B Mahol
40ebeee3fc
avformat/brstm: fix overflow
...
Signed-off-by: Paul B Mahol <onemda@gmail.com >
(cherry picked from commit 3441fef0f8 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-01-27 23:28:43 +01:00
James Almer
b8fa3ff95d
avcodec/wavpackenc: print channel count in av_log call
...
Fixes a warning with -Wformat-extra-args
(cherry picked from commit 17e7fdf61a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 17:53:58 +01:00
James Almer
063928910f
configure: bump copyright year to 2016
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 78129978f0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 16:26:06 +01:00
Michael Niedermayer
e303ca3ac9
Update for 2.8.5
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 16:25:51 +01:00
Michael Niedermayer
28f89bc439
avformat/hls: Even stricter URL checks
...
This fixes a null pointer dereference at least
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cfda1bea4c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 15:49:35 +01:00
Michael Niedermayer
23b903aaf4
avformat/hls: More strict url checks
...
No case is known where these are needed
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ba42b6482 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 14:17:28 +01:00
Michael Niedermayer
4676e20a9d
avcodec/pngenc: Fix mixed up linesizes
...
Fixes out of array accesses
Fixes: 0cf176e6d3ab9fe924f39738e513f547/asan_generic_4a54aa_3431_aaa28be1cb32e307a9890cad06f84fba.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8f4c3e4b92 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:41 +01:00
Michael Niedermayer
0c5a71fece
avcodec/pngenc: Replace memcpy by av_image_copy()
...
Fixes out of array access
Fixes: 0cf176e6d3ab9fe924f39738e513f547/asan_generic_4a54aa_3431_aaa28be1cb32e307a9890cad06f84fba.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ec9c5ce8a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:41 +01:00
Michael Niedermayer
07da25548f
swscale/vscale: Check that 2 tap filters are bilinear before using bilinear code
...
Fixes: out of array reads
Fixes: 07e8b9c5d348ccdf7add0f37de20cf6c/asan_heap-oob_27e8df7_6849_e56653f768070ec8cb52f587048444c2.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eb7802afef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:41 +01:00
Michael Niedermayer
be9b89314f
swscale: Move VScalerContext into vscale.c
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b6e6895f2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:41 +01:00
Michael Niedermayer
cdac68fbab
swscale/utils: Detect and skip unneeded sws_setColorspaceDetails() calls
...
This avoids running various table inits unnecessarily
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cc538e9dbd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:41 +01:00
Michael Niedermayer
1fd9556062
swscale/yuv2rgb: Increase YUV2RGB table headroom
...
This makes SWS more robust
Fixes: 07650a772d98aa63b0fed6370dc89037/asan_heap-oob_27ddeaf_2657_2c81ff264dee5d9712cb3251fb9c3bbb.264
Fixes: out of array read
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8f3a9a8c27 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
c781a1e14b
swscale/yuv2rgb: Factor YUVRGB_TABLE_LUMA_HEADROOM out
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5e5f82a287 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Maxim Andreev
b7d54d6e07
avformat/hls: forbid all protocols except http(s) & file
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7145e80b4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
90c2256ee5
avformat/aviobuf: Fix end check in put_str16()
...
Fixes out of array read
Fixes: 03c406ec9530e594a074ce2979f8a1f0/asan_heap-oob_7dec26_4664_37c52495b2870a2eaac65f53958e76c1.flac
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 115fb6d03e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
f459afdd72
avformat/asfenc: Check pts
...
Fixes integer overflow
Fixes: 0063df8be3aaa30dd6d76f59c8f818c8/signal_sigsegv_7b7b59_3634_bf418b6822bbfa68734411d96b667be3.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7c0b84d899 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
d408261b65
avcodec/mpeg4video: Check time_incr
...
Fixes assertion failure
Fixes out of memory access
Fixes: test_casex.ivf
Found-by: Tyson Smith <twsmith@mozilla.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7c97946d61 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
d7f7586c3f
avcodec/wavpackenc: Check the number of channels
...
They are stored in a byte, thus more than 255 is not possible
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 59c915a403 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
f05e0e76d6
avcodec/wavpackenc: Headers are per channel
...
Fixes: 1b8b83a53bfa751f01b1daa65a4758db/signal_sigabrt_7ffff6ae7cb7_7488_403f71d1a2565b598d01b6cb110fac8f.aiff
Fixes: assertion failure
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 26757b0279 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
e5567f2f69
avcodec/aacdec_template: Check id_map
...
Fixes index out of bounds error
Fixes: aac_index_out_of_bounds.wmv
Found-by: Piotr Bandurski <ami_stuff@o2.pl >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 590863876d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
b8382a1fae
avcodec/dvdec: Fix "left shift of negative value -254"
...
Fixes: dvdec_left_shift.avi
Found-by: Piotr Bandurski <ami_stuff@o2.pl >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93ac72a98d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
9cad208223
avcodec/g2meet: Check for ff_els_decode_bit() failure in epic_decode_run_length()
...
Fixes invalid shift
Fixes: g2m_left_shift_2.wmv
Found-by: Piotr Bandurski <ami_stuff@o2.pl >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 030c7f0309 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
34e06ce309
avcodec/mjpegdec: Fix negative shift
...
Fixes: mjpeg_left_shift.avi
Found-by: Piotr Bandurski <ami_stuff@o2.pl >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d86d7b2486 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
df4ee166f1
avcodec/mss2: Check for repeat overflow
...
Fixes: mss2_left_shift.wmv
Found-by: Piotr Bandurski <ami_stuff@o2.pl >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e273dade78 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
cb4ba7456a
avformat: Add integer fps from 31 to 60 to get_std_framerate()
...
Fixes Ticket 5106
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2039b3e751 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
d79b6dd9f9
avformat/ivfenc: fix division by zero
...
Fixes Ticket 5115
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c8467a07c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
36861557a7
avcodec/mpegvideo_enc: Clip bits_per_raw_sample within valid range
...
Fixes out of array read
Fixes: test_case-mdc.264 (b47be15a120979f5a1a945c938cbef33)
Found-by: Tyson Smith <twsmith@mozilla.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 13f266b50c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Thomas Mundt
3fb97a01ce
avfilter/vf_scale: set proper out frame color range
...
Prevents that following scalers in the filter chain will do unintentional color range conversions.
Fixes Ticket #5096
Signed-off-by: Thomas Mundt <loudmax@yahoo.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73ce8162f3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
6457cd17be
avcodec/motion_est: Fix mv_penalty table size
...
Fixes out of array read
Found-by: Tyson Smith <twsmith@mozilla.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5b4da8a38a )
Conflicts:
libavcodec/motion_est.h
2016-01-15 12:30:40 +01:00
Michael Niedermayer
aee9aa9216
avcodec/h264_slice: Fix integer overflow in implicit weight computation
...
Fixes mozilla bug 1230423
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7cc01c2572 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
14c63dc9b0
swscale/utils: Use normal bilinear scaler if fast cannot be used due to tiny dimensions
...
Fixes Ticket4960
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1edf129cbc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
709abc74f5
avcodec/put_bits: Always check buffer end before writing
...
This causes a overall slowdown of 0.1 % (tested with mpeg4 single thread encoding of matrixbench at QP=3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cccb0ffccc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Andreas Cadhalpun
83c0df90b0
mjpegdec: extend check for incompatible values of s->rgb and s->ls
...
This can happen if s->ls changes from 0 to 1, but picture allocation is
skipped due to s->interlaced.
In that case ff_jpegls_decode_picture could be called even though the
s->picture_ptr frame has the wrong pixel format and thus a wrong
linesize, which results in a too small zero buffer being allocated.
This fixes an out-of-bounds read in ls_decode_line.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 7ea2db6eaf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
0a6324fe93
swscale/utils: Fix intermediate format for cascaded alpha downscaling
...
Fixes Ticket4926
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b83d8be6bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
Michael Niedermayer
2f65366c11
avformat/mov: Update handbrake_version threshold for full mp3 parsing
...
Fixes: Endangered\ Species\ 1x01\ Collecting\ Merl.mp4
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d3b6a9abac )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-01-15 12:30:40 +01:00
James Almer
3e3aa25afa
x86/float_dsp: zero extend offset from ff_scalarproduct_float_sse
...
Reviewed-by: Christophe Gisquet <christophe.gisquet@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit dc79824deb )
2016-01-08 14:02:27 -03:00
Paul B Mahol
6a1bf98b3a
avfilter/vf_zoompan: do not free frame we pushed to lavfi
...
Signed-off-by: Paul B Mahol <onemda@gmail.com >
(cherry picked from commit 8bcd1997ea )
Fixes ticket #5113 .
2016-01-02 21:21:43 +01:00
Andreas Cadhalpun
79f407b79a
nuv: sanitize negative fps rate
...
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit f6830cf5ba )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-20 13:39:45 +01:00
Andreas Cadhalpun
174ec7d744
nutdec: reject negative value_len in read_sm_data
...
If it is negative, it can cause the byte position to move backwards in
avio_skip, which in turn makes sm_size negative and thus size larger
than the size of the packet buffer, causing invalid writes in avio_read.
Also fix potential overflow of avio_tell(bc) + value_len.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit ce10f572c1 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-20 13:39:41 +01:00
Andreas Cadhalpun
778c8de40f
xwddec: prevent overflow of lsize * avctx->height
...
This is used to check if the input buffer is large enough, so if this
overflows it can cause a false negative leading to a segmentation fault
in bytestream2_get_bufferu.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 9d38f06d05 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-20 13:39:37 +01:00
Andreas Cadhalpun
38f8c80901
nutdec: only copy the header if it exists
...
Fixes ubsan runtime error: null pointer passed as argument 2, which is
declared to never be null
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 9f82506c79 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-20 13:39:33 +01:00
Andreas Cadhalpun
945ae04fab
exr: fix out of bounds read in get_code
...
This macro unconditionally used out[-1], which causes an out of bounds
read, if out is the very beginning of the buffer.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 90b99a8107 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-20 13:39:29 +01:00
Andreas Cadhalpun
6d7b4dbcb4
on2avc: limit number of bits to 30 in get_egolomb
...
More don't fit into the integer output.
Also use get_bits_long, since get_bits only supports reading up to 25
bits, while get_bits_long supports the full integer range.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 4d5c3b02e9 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-20 13:39:24 +01:00
Michael Niedermayer
644179e0d4
Update Changelog
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-20 02:58:41 +01:00
Andreas Cadhalpun
9be3441c31
rawdec: only exempt BIT0 with need_copy from buffer sanity check
...
Otherwise the too samll buffer is directly used in the frame, causing
segmentation faults, when trying to use the frame.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-20 02:58:21 +01:00
Andreas Cadhalpun
63ecbb82fc
mlvdec: check that index_entries exist
...
This fixes NULL pointer dereferencing.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-20 02:42:13 +01:00
Michael Niedermayer
bdc6ba4604
avcodec/mpeg4videodec: also for empty partitioned slices
...
Fixes assertion failure
Fixes: id_acf3e47f864e1ee4c7b86c0653e0ff31e5bde56e.m4v
Found-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 70f13abb4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-19 23:54:47 +01:00
Michael Niedermayer
3a3be02208
avcodec/h264_refs: Fix long_idx check
...
Fixes out of array read
Fixes mozilla bug 1233606
Found-by: Tyson Smith
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b92b4775a0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-19 22:19:21 +01:00
Michael Niedermayer
cabd9ae5be
avcodec/h264_mc_template: prefetch list1 only if it is used in the MB
...
Fixes ubsan warning
Fixes Mozilla bug 1230276
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8ea57664f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-18 00:55:27 +01:00
Michael Niedermayer
cfbf608c0a
avcodec/h264_slice: Simplify ref2frm indexing
...
This also suppresses a ubsan warning
Fixes Mozilla bug 1230247
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ef8f6464a5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-18 00:55:15 +01:00
Michael Niedermayer
1dddd5371a
Revert "avcodec/aarch64/neon.S: Update neon.s for transpose_4x4H"
...
The change was not correct and broke H264
This reverts commit cd83f899c9 .
(cherry picked from commit 95b59bfb9d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-17 21:50:57 +01:00
Michael Niedermayer
e4a6a8553e
avfilter/vf_mpdecimate: Add missing emms_c()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 997de2e810 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-17 21:32:17 +01:00
Andreas Cadhalpun
748d5fa2ed
sonic: make sure num_taps * channels is not larger than frame_size
...
If that is the case, the loop setting predictor_state in
sonic_decode_frame causes out of bounds reads of int_samples, which has
only frame_size number of elements.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 9637c2531f )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-17 20:04:35 +01:00
Andreas Cadhalpun
796f1a24f5
opus_silk: fix typo causing overflow in silk_stabilize_lsf
...
Due to this typo max_center can be too large, causing nlsf to be set to
too large values, which in turn can cause nlsf[i - 1] + min_delta[i] to
overflow to a negative value, which is not allowed for nlsf and can
cause an out of bounds read in silk_lsf2lpc.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit f61d44b74a )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-17 20:04:30 +01:00
Andreas Cadhalpun
0b24a0e0f1
ffm: reject invalid codec_id and codec_type
...
A negative codec_id cannot be handled by the found_decoder API of
AVStream->info: if the codec_id is not recognized, found_decoder is set
to -codec_id, which has to be '<0' according to the API documentation.
This can cause NULL pointer dereferencing in try_decode_frame.
Also make sure the codec_type matches the expected one for codec_id.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit ecf63b7cc2 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-17 20:04:25 +01:00
Andreas Cadhalpun
a79a5c32f9
golomb: always check for invalid UE golomb codes in get_ue_golomb
...
Also correct the check to reject log < 7, because UPDATE_CACHE only
guarantees 25 meaningful bits.
This fixes undefined behavior:
runtime error: shift exponent is negative
Testing with START/STOP timers in get_ue_golomb, one for the first
branch (A) and one for the second (B), shows that there is practically no
slowdown, e.g. for the cavs decoder:
With the check in the B branch:
629 decicycles in get_ue_golomb B, 4194260 runs, 44 skips
433 decicycles in get_ue_golomb A,268434102 runs, 1354 skips
Without the check:
624 decicycles in get_ue_golomb B, 4194273 runs, 31 skips
433 decicycles in get_ue_golomb A,268434203 runs, 1253 skips
Since the B branch is executed far less often than the A branch, this
change is negligible, even more so for the h264 decoder, where the ratio
B/A is a lot smaller.
Fixes: mozilla bug 1230239
Fixes: fbeb8b2c7c996e9b91c6b1af319d7ebc/asan_heap-oob_195450f_2743_e8856ece4579ea486670be2b236099a0.bit
Found-by: Tyson Smith
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 22e960ad47 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-17 20:03:56 +01:00
Andreas Cadhalpun
b9087aa651
sbr_qmf_analysis: sanitize input for 32-bit imdct
...
If the input contains too many too large values, the imdct can overflow.
Even if it didn't, the output would be larger than the valid range of 29
bits.
Note that this is a very delicate limit: Allowing values up to 1<<25
does not prevent input larger than 1<<29 from arriving at
sbr_sum_square, while limiting values to 1<<23 breaks the
fate-aac-fixed-al_sbr_hq_cm_48_5.1 test.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit fdc94db37e )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-17 20:03:48 +01:00
Andreas Cadhalpun
7e94ea3dd1
sbrdsp_fixed: assert that input values are in the valid range
...
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit a9c20e922c )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-17 20:03:44 +01:00
Andreas Cadhalpun
cb44683a8c
aacsbr: ensure strictly monotone time borders
...
This fixes a division by zero in the aac_fixed decoder.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit ff8816f717 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-17 20:03:34 +01:00
Andreas Cadhalpun
dcd837e41c
aacenc: update max_sfb when num_swb changes
...
This fixes out-of-bounds reads in avoid_clipping.
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 5b0da6999f )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-17 20:03:29 +01:00
Andreas Cadhalpun
507e0314c0
aaccoder: prevent crash of anmr coder
...
If minq is negative, the range of sf_idx can be larger than
SCALE_MAX_DIFF allows, causing assertion failures later in
encode_scale_factors.
Reviewed-by: Claudio Freire <klaussfreire@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 7a4652dd5d )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-17 20:03:02 +01:00
Andreas Cadhalpun
76af12f542
ffmdec: reject zero-sized chunks
...
If size is zero, avio_get_str fails, leaving the buffer uninitialized.
This causes invalid reads in av_set_options_string.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit a611375db5 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-12-17 20:02:55 +01:00
Michael Niedermayer
20a48eaaf1
swscale/x86/rgb2rgb_template: Fallback to mmx in interleaveBytes() if the alignment is insufficient for SSE*
...
This also as a sideeffect fixes the non aligned case
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a066ff89bc )
2015-12-15 11:16:22 +01:00
Michael Niedermayer
31aeb96533
swscale/x86/rgb2rgb_template: Do not crash on misaligend stride
...
Fixes Ticket5013
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 80bfce35cc )
2015-12-15 11:16:10 +01:00
Michael Niedermayer
95a144ae62
avformat/mxfenc: Do not crash if there is no packet in the first stream
...
Fixes: Ticket4914
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b51e7554e7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-13 17:27:04 +01:00
Nicolas George
1450a39ad4
lavf/tee: fix side data double free.
...
Similar to 33fefdb44 .
Fix trac ticket #4921 .
Signed-off-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1acc90eaa5 )
Conflicts:
libavformat/tee.c
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-13 10:14:24 +01:00
Michael Niedermayer
d07f658201
avformat/hlsenc: Check the return code of avformat_write_header()
...
Fixes: segfault
Fixes: Ticket5067
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c62d1780ff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-13 02:59:32 +01:00
Michael Niedermayer
07b43fb69a
avformat/mov: Enable parser for mp3s by old HandBrake
...
Fixes Ticket5047
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 861f47ddf4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-13 02:15:36 +01:00
Michael Niedermayer
e3f08d9359
avformat/mxfenc: Fix integer overflow in length computation
...
Fixes: CID1341577
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 537e901fe6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-13 02:15:14 +01:00
Michael Niedermayer
f87d2617d5
Changelog: Update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-12 23:25:12 +01:00
zjh8890
cd83f899c9
avcodec/aarch64/neon.S: Update neon.s for transpose_4x4H
...
The transpose_4x4H is wrong which cost me much time to find this bug. The orders of r2 and r3 are wrong,
this bug waste me much time while I make aarch64 arm instruction which used the function.
(cherry picked from commit c18176bd55 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-12 15:05:06 +01:00
Rainer Hochecker
5e105aca01
avformat/utils: estimate_timings_from_pts - increase retry counter, fixes invalid duration for ts files with hevc codec
...
Fixes a mpegts file with hevc that fails estimating duration. Increasing number of
retries fixes the issue.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d8c2f1a28 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-09 20:46:47 +01:00
Michael Niedermayer
a9c721da12
avformat/matroskaenc: Check codecdelay before use
...
Fixes CID1238790
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e6971db12b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-09 18:27:54 +01:00
Michael Niedermayer
4608cc176b
avutil/mathematics: Fix division by 0
...
Fixes: CID1341571
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc8b1e694c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-09 17:53:44 +01:00
Andreas Cadhalpun
2e54b8c379
mjpegdec: consider chroma subsampling in size check
...
If the chroma components are subsampled, smaller buffers are allocated
for them. In that case the maximal block_offset for the chroma
components is not as large as for the luma component.
This fixes out of bounds writes causing segmentation faults or memory
corruption.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 5adb5d9d89 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-07 01:34:13 +01:00
Michael Niedermayer
913c642c21
Update for 2.8.4
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 10:42:02 +01:00
James Zern
cb4985ea9a
libvpxenc: remove some unused ctrl id mappings
...
VP8E_UPD_ENTROPY, VP8E_UPD_REFERENCE, VP8E_USE_REFERENCE were removed
from libvpx and the remaining values were never used here
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Zern <jzern@google.com >
(cherry picked from commit 6540fe04a3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:28 +01:00
Michael Niedermayer
d27d59fef7
avcodec/vp3: ensure header is parsed successfully before tables
...
Fixes assertion failure
Fixes: 266ee543812e934f7b4a72923a2701d4/signal_sigabrt_7ffff6ae7cc9_7322_85218d61759d461bdf7387180e8000c9.ogg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 26379d4fdd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:28 +01:00
Michael Niedermayer
ea4d9cb3e5
avcodec/jpeg2000dec: Check bpno in decode_cblk()
...
Fixes: undefined shift
Fixes: c409ef86f892335a0a164b5871174d5a/asan_heap-oob_1dff564_2159_162b7234616deab02b544410455eb07b.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a85b02dcf7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
e5a4044771
avcodec/pgssubdec: Fix left shift of 255 by 24 places cannot be represented in type int
...
Fixes: b293a6479bb4b5286cff24d356bfd955/asan_generic_225c3c9_7819_cc526b657450c6cdef1371b526499626.mkv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f2419888b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
af44545613
swscale/utils: Fix for runtime error: left shift of negative value -1
...
Fixes: c106b36fa36db8ff8f3ed0c82be7bea2/asan_heap-oob_32699f0_6321_467b9a1d7e03d7cfd310b7e65dc53bcc.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 325b59368d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
10fc3d690c
avcodec/hevc: Fix integer overflow of entry_point_offset
...
Fixes out of array read
Fixes: d41d8cd98f00b204e9800998ecf8427e/signal_sigsegv_321165b_7641_077dfcd8cbc80b1c0b470c8554cd6ffb.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2140858524 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
0fa92fee43
avcodec/dirac_parser: Check that there is a previous PU before accessing it
...
Fixes out of array read
Fixes: 99d142c47e6ba3510a74b872a1a2ae72/asan_heap-oob_11b36f4_3811_0f5c69e7609a88a580135678de1df844.dxa
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a08681f1e6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
cf79fd0317
avcodec/dirac_parser: Add basic validity checks for next_pu_offset and prev_pu_offset
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c7d6ec947c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
b253035ab2
avcodec/dirac_parser: Fix potential overflows in pointer checks
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 79798f7c57 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
ded0a04153
avcodec/wmaprodec: Check bits per sample to be within the range not causing integer overflows
...
Fixes: 549d5aab1480d10f2a775ed90b0342f1/signal_sigabrt_7ffff6ae7cc9_5643_96bbb0cfe3e28be1dadfce1075016345.wma
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 66e05f6ff5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
16c5da92d9
avcodec/wmaprodec: Fix overflow of cutoff
...
Fixes: 129ca3e28d73af7b1e24a9d4118e7a2d/signal_sigabrt_7ffff6ae7cc9_836_762b310fc3ef6087bd7771e5d8e90b9b.asf
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c56f8303e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
0e3ec7db53
avformat/smacker: fix integer overflow with pts_inc
...
Fixes: ce19e41f0ef1e52a23edc488faecdb58/asan_heap-oob_2504e97_4202_ffa0df1baed14022b9bfd4f8ac23d0cb.smk
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ed47e9729 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
73966b0161
avcodec/vp3: Fix "runtime error: left shift of negative value"
...
Fixes: 5c6129154b356b80bcab86f9e3ee5d29/signal_sigabrt_7ffff6ae7cc9_7322_d26ac6d7cb6567db1b8be0159b387d0b.ogg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 18268f761b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
b8621a2e98
avformat/riffdec: Initialize bitrate
...
Fixes CID1338334
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 32bf6550cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Timo Teräs
aa9ac199b8
mpegencts: Fix overflow in cbr mode period calculations
...
ts->mux_rate is int (signed 32-bit) type. The period calculations
will start to overflow when mux_rate > 5mbps. This fixes overflows
by converting first to 64-bit type.
Fixes #5044 .
Signed-off-by: Timo Teräs <timo.teras@iki.fi >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 64f7db554e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
f2258e9899
avutil/timecode: Fix fps check
...
The fps variable is explicitly set to -1 in case of some errors, the check must
thus be signed or the code setting it needs to use 0 as error code
the type of the field could be changed as well but its in an installed header
Fixes: integer overflow
Fixes: 9982cc157b1ea90429435640a989122f/asan_generic_3ad004a_3799_22cf198d9cd09928e2d9ad250474fa58.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b46dcd5209 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
e04b039b15
avutil/mathematics: return INT64_MIN (=AV_NOPTS_VALUE) from av_rescale_rnd() for overflows
...
Fixes integer overflow
Fixes: mozilla bug 1229167
Found-by: Tyson Smith
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f03c2ceec1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
d295ddffe1
avcodec/apedec: Check length in long_filter_high_3800()
...
Fixes out of array read
Fixes: 0a7ff0c1d93da9cef28a315ec91b692a/asan_heap-oob_4a52e5_3604_9c56dbb20e308f4faeef7b35f688521a.ape
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cd7524fdd1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
aab65146af
avcodec/vp3: always set pix_fmt in theora_decode_header()
...
Fixes assertion failure
Fixes: d0bb0662da342ec65f8f2a081222e6b9/signal_sigabrt_7ffff6ae7cc9_5471_82964f0a9ac2f4d3d59390c15473f6f7.ogg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a814f1d364 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
8cd3def81d
avcodec/mpeg4videodec: Check available data before reading custom matrix
...
Fixes: out of array read
Fixes: 76c515fc3779d1b838667c61ea13ce92/asan_heap-oob_1fc0d07_8913_794a4629a264ebdb25b58d3a94ed1785.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 891dc8f875 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
460710500e
avutil/mathematics: Do not treat INT64_MIN as positive in av_rescale_rnd
...
The code expects actual positive numbers and gives completely wrong
results if INT64_MIN is treated as positive
Instead clip it into the valid range that is add 1 and treat it as
negative
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 25e37f5ea9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
4d9999705f
avutil/integer: Fix av_mod_i() with negative dividend
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a9cb18855 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
3d69716bae
avformat/dump: Fix integer overflow in av_dump_format()
...
Fixes part of mozilla bug 1229167
Found-by: Tyson Smith
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e7f452022 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
2fbf723585
avcodec/h264_refs: Check that long references match before use
...
Fixes out of array read
Fixes: 59bb925e90201fa0f87f0a31945d43b5/asan_heap-oob_4a52e5_3388_66027f11e3d072f1e02401ecc6193361.jvt
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa427537b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
7372b42b18
avcodec/utils: Clear dimensions in ff_get_buffer() on failure
...
Fixes out of array access
Fixes: 482d8f2fd17c9f532b586458a33f267c/asan_heap-oob_4a52b6_7417_1d08d477736d66cdadd833d146bb8bae.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit abee0a1c60 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
fe89682d7c
avcodec/utils: Use 64bit for aspect ratio calculation in avcodec_string()
...
Fixes integer overflow
Fixes: 3a45b2ae02f2cf12b7bd99543cdcdae5/asan_heap-oob_1dff502_8022_899f75e1e81046ebd7b6c2394a1419f4.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f03bebc79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
ce6dd54711
avcodec/hevc: Check max ctb addresses for WPP
...
Fixes out of array read
Fixes: 2f95ddd996db8a6281d2e18c184595a7/asan_heap-oob_192fe91_3330_58e4441181e30a66c19f743dcb392347.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dad354f38d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
d32c9723a6
avcodec/vp3: Clear context on reinitialization failure
...
Fixes null pointer dereference
Fixes: 1536b9b096a8f95b742bae9d3d761cc6/signal_sigsegv_294aaed_2039_8d1797aeb823ea43858d0fa45c9eb899.ogv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6105b7219a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
1cbc2cb508
avcodec/hevc: allocate entries unconditionally
...
Fixes out of array access
Fixes: 08664a2a7921ef48172f26495c7455be/asan_heap-oob_23036c6_3301_523388ef84285a0270caf67a43247b59.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d85aa76115 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:27 +01:00
Michael Niedermayer
e348769544
avcodec/hevc_cabac: Fix multiple integer overflows
...
Fixes: 04ec80eefa77aecd7a49a442cc02baea/asan_heap-oob_19544fa_3303_1905796cd9d8e15f86d664332caabc00.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d5028f61e4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:26 +01:00
Michael Niedermayer
9ce96a688b
avcodec/jpeg2000dwt: Check ndeclevels before calling dwt_encode*()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit feb3f39614 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:26 +01:00
Michael Niedermayer
9d5bdca3d8
avcodec/jpeg2000dwt: Check ndeclevels before calling dwt_decode*()
...
Fixes out of array access
Fixes: 01859c9a9ac6cd60a008274123275574/asan_heap-oob_1dff571_8250_50d3d1611e294c3519fd1fa82198b69b.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 75422280fb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:26 +01:00
Michael Niedermayer
31e54f41a0
avcodec/hevc: Check entry_point_offsets
...
Fixes out of array read
Fixes: 007c4a36608ebdf27ee260ad60a81184/asan_heap-oob_32076b4_2243_116b1cb29d91cc4974d6680e3d10bd91.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ef9f7bbfa4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-12-06 02:51:26 +01:00
Carl Eugen Hoyos
aa3101a9e8
lavf/rtpenc_jpeg: Less strict check for standard Huffman tables.
...
There can be one or more Huffman table segments DHT.
Reported-by: Andrey Utkin
2015-12-02 14:56:53 +01:00
Michael Niedermayer
ff3e717003
avcodec/ffv1dec: Clear quant_table_count if its invalid
...
Fixes deallocation of corrupted pointer
Fixes: 343dfbe142a38b521ed069dc4ea7c03b/signal_sigsegv_421427_4074_ffb11959610278cd40dbc153464aa254.avi
No releases affected
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e04126072e )
Fixes ticket #5052 .
2015-12-02 12:03:17 +01:00
Michael Niedermayer
1c6243228c
avcodec/ffv1dec: Print an error if the quant table count is invalid
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8b254e436 )
2015-12-02 11:57:34 +01:00
Andrey Utkin
482bece29b
doc/filters/drawtext: fix centering example
...
Signed-off-by: Andrey Utkin <andrey.od.utkin@gmail.com >
Signed-off-by: Lou Logan <lou@lrcd.com >
(cherry picked from commit 648b26acc5 )
Signed-off-by: Timothy Gu <timothygu99@gmail.com >
2015-12-01 17:32:05 -08:00
James Almer
644296e736
avutil/softfloat: use abort() instead of av_assert0(0)
...
Fixes compilation of host tool aacps_fixed_tablegen.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 9f4a41bf99 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-27 15:01:22 +01:00
Michael Niedermayer
a353cc44a6
Update for 2.8.3
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-27 14:29:04 +01:00
Michael Niedermayer
4c718691ea
avcodec/cabac: Check initial cabac decoder state
...
Fixes integer overflows
Fixes: 1430e9c43fae47a24c179c7c54f94918/signal_sigsegv_421427_2340_591e9810c7b09efe501ad84638c9e9f8.264
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Found-by: xiedingbao (Ticket4727)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8000d484b8 )
Conflicts:
libavcodec/cabac.h
2015-11-27 14:07:03 +01:00
Michael Niedermayer
24c504bd0a
avcodec/cabac_functions: Fix "left shift of negative value -31767"
...
Fixes: 1430e9c43fae47a24c179c7c54f94918/signal_sigsegv_421427_2340_591e9810c7b09efe501ad84638c9e9f8.264
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Found-by: xiedingbao (Ticket4727)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1f6b05f52 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-27 14:03:01 +01:00
Michael Niedermayer
6b91701de3
avcodec/h264_slice: Limit max_contexts when slice_context_count is initialized
...
Fixes out of array access
Fixes: 1430e9c43fae47a24c179c7c54f94918/signal_sigsegv_421427_2049_f2192b6829ab6e0eefcb035329c03c60.264
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4ea4d2f438 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:06:39 +01:00
Martin Storsjö
1290c85c9d
rtmpcrypt: Do the xtea decryption in little endian mode
...
The XTEA algorithm operates on 32 bit numbers, not on byte sequences.
The XTEA implementation in libavutil is written assuming big endian
numbers, while the rtmpe signature encryption assumes little endian.
This fixes rtmpe communication with rtmpe servers that use signature
type 8 (XTEA), e.g. crunchyroll.
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st >
(cherry picked from commit e7728319b92dbb4fb949155e33de7ff5358ddff3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:06:39 +01:00
Michael Niedermayer
b70f7d20e1
avformat/matroskadec: Check subtitle stream before dereferencing
...
Unrecognized streams are not allocated
Fixes: flicker-1.color1.vp91447030769.08.webm
Found-by: Chris Cunningham <chcunningham@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5034b324c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:06:39 +01:00
Michael Niedermayer
71a3113333
avcodec/pngdec: Replace assert by request for sample for unsupported TRNS cases
...
Fixes assertion failure
Fixes: 7f646252a30ee28b583aac1f82e7985e/signal_sigabrt_7ffff6ae7cc9_7353_62fc077bf2f454d39e188c69807193a6.png
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a62178be80 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:06:39 +01:00
Michael Niedermayer
859a6edaed
avformat/utils: Do not init parser if probing is unfinished
...
Fixes assertion failure
Fixes: 136f8b8d47af7892306625e597dee655/signal_sigabrt_7ffff6ae7cc9_8941_ab11bea57c84796418f481f873dc31ba.dvr_ms
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1ef336e912 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:06:39 +01:00
Michael Niedermayer
2dc1f3a02b
avcodec/jpeg2000dec: Fix potential integer overflow with tile dimensions
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65d3359fb3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:06:39 +01:00
Michael Niedermayer
9a9dda615b
avcodec/jpeg2000: Use av_image_check_size() in ff_jpeg2000_init_component()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 016fd413f9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:42 +01:00
Michael Niedermayer
b3bc05290a
avcodec/wmaprodec: Check for overread in decode_packet()
...
Fixes assertion failure
Fixes: 0256e92df2df7e933b43a2c70e4c8040/signal_sigabrt_7ffff6ae7cc9_1358_999ac18684788221490757582ce9af84.wma
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ad698e24e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:42 +01:00
Michael Niedermayer
093e58228e
avcodec/smacker: Check that the data size is a multiple of a sample vector
...
Fixes out of array access
Fixes: ce19e41f0ef1e52a23edc488faecdb58/asan_heap-oob_2504e97_4202_ffa0df1baed14022b9bfd4f8ac23d0cb.smk
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a9af07a49 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:42 +01:00
Michael Niedermayer
948d93d3f4
avcodec/takdec: Skip last p2 sample (which is unused)
...
Fixes out of array read
Fixes: cb3f38b08b4541523974667c7d1eee9e/asan_heap-oob_2659e18_9838_021fd5cd635bf76cede6398cd9ecbcdd.tak
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 08b520636e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:41 +01:00
Michael Niedermayer
824e72d9b7
avcodec/dxtory: Fix input size check in dxtory_decode_v1_410()
...
Fixes potential out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 76b6f4b7d9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:41 +01:00
Michael Niedermayer
c7a970a3a0
avcodec/dxtory: Fix input size check in dxtory_decode_v1_420()
...
Fixes out of array read
Fixes: c50c4aa6cefda71b19a31ea12302980c/asan_heap-oob_12be5fd_7011_33ebd015a74976215934add72b9c8352.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9caa9414cc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:41 +01:00
Michael Niedermayer
6af38b2718
avcodec/error_resilience: avoid accessing previous or next frames tables beyond height
...
The height of tables can be rounded up for MBAFF but this does not imply that is also true
for the previous frames
Fixes out of array reads
Fixes: c106b36fa36db8ff8f3ed0c82be7bea2/asan_heap-oob_32699f0_6321_467b9a1d7e03d7cfd310b7e65dc53bcc.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a105f52855 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:41 +01:00
Michael Niedermayer
0ce7baa245
avcodec/dpx: Move need_align to act per line
...
Fixes out of array read
Fixes: 61cf123c081ee2bb774d307c75bdb99e/asan_heap-oob_1224f76_5546_bee833ffae73f752b489b9eeaac52db7.dpx
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8aaae8e0f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:41 +01:00
Michael Niedermayer
7f0b58947d
avcodec/flashsv: Check size before updating it
...
Fixes out of array read
Fixes: 3c857d4d90365731524716e6d051e43a/signal_sigsegv_7f4f59bcc29e_1386_20abd2c8e655cb9c75b24368e65fe3b1.flv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 17705f5d4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:41 +01:00
Michael Niedermayer
f64ffbbdc0
avcodec/ivi: Check image dimensions
...
Fixes integer overflow
Fixes: 1e32c6c591d940337c20b197ec1c4d3d/asan_heap-oob_4a52e5_8946_0bb0d9e863def56005e49f1d89bdc94d.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df91aa034b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:41 +01:00
Michael Niedermayer
c0748b9954
avcodec/utils: Better check for channels in av_get_audio_frame_duration()
...
Fixes integer overflow
Fixes: 0c2625f236ced104d402b4a03c0d65c7/asan_generic_274e1ce_5990_9314e7a67c26aecf011b178ade9f217c.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4e16ad2868 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:41 +01:00
Michael Niedermayer
dbfec68d32
avcodec/jpeg2000dec: Check for duplicate SIZ marker
...
Fixes: 0231a17345734228011c6f35a64e4594/asan_heap-oob_1d92a72_3218_1213809a9e3affec77e4c191fdfdc0a9.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 44a7f17d0b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-26 16:05:41 +01:00
Andreas Cadhalpun
34f2d74555
aacsbr: don't call sbr_dequant twice without intermediate read_sbr_data
...
Doing that doesn't make sense, because the only purpose of sbr_dequant
is to process the data from read_sbr_data.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 1c3e43a627 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
Andreas Cadhalpun
22017f7745
hqx: correct type and size check of info_offset
...
It is used as size argument of ff_canopus_parse_info_tag, which uses it
as size argument to bytestream2_init, which only supports sizes up to
INT_MAX.
Changing it's type to unsigned simplifies the check.
Reviewed-by: Vittorio Giovara <vittorio.giovara@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 1ed7fcd42a )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
Andreas Cadhalpun
b372ad819e
mxfdec: check edit_rate also for physical_track
...
Previously only the edit_rate of material_track was checked.
If it's negative, it causes assertion failures in av_rescale_rnd.
Reviewed-by: Tim Nicholson <nichot20-at-yahoo.com@ffmpeg.org >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 047bf82c18 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
Michael Niedermayer
bdbfc12e7f
avcodec/jpeg2000: Change coord to 32bit to support larger than 32k width or height
...
Fixes: 03e0abe721b1174856d41a1eb5d6a896/signal_sigabrt_7ffff6ae7cc9_3813_e71bf3541abed3ccba031cd5ba0269a4.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0eb7de1973 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
Michael Niedermayer
c3a44a2a55
avcodec/jpeg2000dec: Check SIZ dimensions to be within the supported range
...
Fixes potential integer overflows
Fixes: 03e0abe721b1174856d41a1eb5d6a896/signal_sigabrt_7ffff6ae7cc9_3813_e71bf3541abed3ccba031cd5ba0269a4.avi
This fix is choosen to be simple to backport, better solution
for master is planed
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ef819c40b )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
Michael Niedermayer
d1d48d4319
avcodec/jpeg2000: Check comp coords to be within the supported size
...
Fixes assertion failure
Fixes: 03e0abe721b1174856d41a1eb5d6a896/signal_sigabrt_7ffff6ae7cc9_3813_e71bf3541abed3ccba031cd5ba0269a4.avi
This fix is choosen to be simple to backport, better solution
for master is planed
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1a8cbcb35 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
Andreas Cadhalpun
6b0bc64f54
mpegvideo: clear overread in clear_context
...
Otherwise the h263p decoder can try to copy overread bytes, even though
buffer is NULL.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 6a69a175e7 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
Michael Niedermayer
983e63b490
avcodec/avrndec: Use the AVFrame format instead of the context
...
Fixes out of array read
Fixes: 20dd01398dee0f6d83d7e5410a2ae8eb/signal_sigsegv_39eeb1f_4001_62efbdf1c60748dabf1ec310b59525fd.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ccba8aaff2 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
Andreas Cadhalpun
bf2f7115d9
dds: disable palette flag for compressed images
...
Having both is not valid and can cause a NULL pointer dereference of
frame->data[1] later.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com >
(cherry picked from commit 0a8bff788b )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
Andreas Cadhalpun
ef699b4135
dds: validate compressed source buffer size
...
A too small buffer will cause segfaults somewhere below
decompress_texture_thread.
Reviewed-by: Vittorio Giovara <vittorio.giovara@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 9a37d47644 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
Andreas Cadhalpun
a8513826dd
dds: validate source buffer size before copying
...
If it is too small av_image_copy_plane segfaults.
Reviewed-by: Vittorio Giovara <vittorio.giovara@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 1675809d2d )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
Andreas Cadhalpun
df31acda64
dvdsubdec: validate offset2 similar to offset1
...
If it is negative, it causes segmentation faults in decode_rle.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit f621749d11 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:45 +01:00
Andreas Cadhalpun
d09fd0736a
brstm: reject negative sample rate
...
A negative sample rate causes assertion failures in av_rescale_rnd.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 7b67fe20f6 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:45 +01:00
Andreas Cadhalpun
c3f276b608
aacps: avoid division by zero in stereo_processing
...
This fixes a SIGFPE crash in the aac_fixed decoder.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com >
(cherry picked from commit ef7fe9851e )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:45 +01:00
Andreas Cadhalpun
510d88ae93
softfloat: assert when the argument of av_sqrt_sf is negative
...
The correct result can't be expressed in SoftFloat.
Currently it returns a random value from an out of bounds read.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit f3866a14c3 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:45 +01:00
Michael Niedermayer
c4133b25f8
avcodec/takdec: Use memove, avoid undefined memcpy() use
...
Fixes: e214333cbd94c91228e624ff39329ce6/asan_generic_4a5159_6412_96cda2530e80607210ab41ccae3d456d.tak
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7cea3430a5 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:41 +01:00
Michael Niedermayer
c9b3451da3
Update Changelog
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 01:17:17 +01:00
Andreas Cadhalpun
46f83b059b
aacsbr_fixed: check for envelope scalefactors overflowing
...
This prevents various values from getting an insanely huge exponent.
If someone knows a cleaner solution, thats welcome!
This is similar to commit 8978c74 for aacsbr.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 0e36a14a42 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:43:01 +01:00
Andreas Cadhalpun
ce2664f5f7
aacdec: don't return frames without data from aac_decode_er_frame
...
This is similar to commit ec38a1b for aac_decode_frame_int.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d7f29bfa69 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:42:50 +01:00
Michael Niedermayer
8364d607ac
avcodec/aacsbr_fixed: Try to initialize sum[0..1] differently to fix build with VS2012
...
Found-by: Hendrik Leppkes <h.leppkes@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8a024f6a43 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:42:43 +01:00
Michael Niedermayer
21e42d9b0d
avcodec/aacsbr: Use FLOAT_0
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dcf1cf5d24 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:42:35 +01:00
Andreas Cadhalpun
e10c353ca5
softfloat: handle INT_MIN correctly in av_int2sf
...
Otherwise v=INT_MIN doesn't get normalized and thus triggers av_assert2
in other functions.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 9ac61e73d0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
Michael Niedermayer
72be96ac55
avutil/softfloat: Include negative numbers in cmp/gt tests
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 955cdc43a3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
Michael Niedermayer
6581e40e1a
avutil/softfloat: Fix av_gt_sf() with large exponents try #2
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 05b05a7a84 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
Michael Niedermayer
0f9c617979
avutil/softfloat: Add test for av_gt_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 791ea23e57 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
Michael Niedermayer
f9998d1994
avutil/softfloat: Extend the av_cmp_sf() test to cover a wider range of exponents
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ecfb076141 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
Michael Niedermayer
7ad4bf4899
avutil/softfloat: Fix overflows in shifts in av_cmp_sf() and av_gt_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cee3c9d29a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
Michael Niedermayer
43ada90fc5
avutil/softfloat: Add test for av_cmp_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df2a2117d2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
Ganesh Ajjanagadde
476ddffccb
avutil/common: add FFDIFFSIGN macro
...
This is of use for defining comparator callbacks. Common approaches like
return x-y are not safe due to the risks of overflow.
Furthermore, the (x > y) - (x < y) trick is optimized to branchless
code.
This also documents this macro accordingly.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Ganesh Ajjanagadde <gajjanagadde@gmail.com >
(cherry picked from commit 265f83fd35 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
Michael Niedermayer
b533998d0a
avutil/softfloat: Add tests for exponent underflows
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 596dfe7d6c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-11 23:32:58 +01:00
Michael Niedermayer
acd203fc0d
avutil/softfloat: Fix exponent underflow in av_div_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 046218b212 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-11 23:32:54 +01:00
Michael Niedermayer
402c4a9f81
avutil/softfloat: Fix exponent underflow in av_mul_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1e3303fc0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-11 23:32:51 +01:00
Michael Niedermayer
6e4bfbe936
avutil/softfloat: Fix typo in av_mul_sf() doxy
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4135a2bfd6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-11 23:32:48 +01:00
Michael Niedermayer
f38beb47da
avutil/softfloat: Correctly set the exponent for 0.0 in av_sqrt_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 107db5abf3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-11 23:32:32 +01:00
Michael Niedermayer
efa9128556
avutil/softfloat: FLOAT_0 should use MIN_EXP
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a66b243d52 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-11 23:32:27 +01:00
Michael Niedermayer
3de8521667
swresample/resample: increase precision for compensation
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 351e625d60 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-11 18:41:01 +01:00
Rodger Combs
edf5e88eac
lavf/mov: add support for sidx fragment indexes
...
Fixes trac #3842
(cherry picked from commit 4ab5666759 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-11 02:50:39 +01:00
Michael Niedermayer
8d634be4ce
update versions for 2.8.2
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-11 02:50:39 +01:00
Michael Niedermayer
9a6d581076
avformat/mxfenc: Only store user comment related tags when needed
...
Also support disabling them as they seem to cause problems to some
Users. They are also not allowed in IRT D-10 thus the default for
mxf_d10 is not to write them
This also decreases the filesize when no user comment are stored
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d9726893f3 )
Conflicts:
libavformat/mxfenc.c
2015-11-11 02:21:32 +01:00
Michael Niedermayer
84f8157662
tests/fate/avformat: Fix fate-lavf
...
The CMP variable seems to have been inherited from fate-api-seek which set it to null
the mxf reference needed a change due to c7e14a279f
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b83c849e87 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-10 11:20:21 +01:00
Simon Thelen
e5a2f5e74d
doc/ffmpeg: Clarify that the sdp_file option requires an rtp output.
...
Signed-off-by: Simon Thelen <ffmpeg-dev@c-14.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b02201efb5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-09 23:58:05 +01:00
Simon Thelen
dac3598563
ffmpeg: Don't try and write sdp info if none of the outputs had an rtp format.
...
Fixes a segfault when trying to write nonexistent rtp information.
Signed-off-by: Simon Thelen <ffmpeg-dev@c-14.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 70fb5eadc5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-09 23:56:29 +01:00
Andreas Cadhalpun
c0cd8747ef
apng: use correct size for output buffer
...
The buffer needs s->bpp bytes, at maximum currently 10.
Assert that s->bpp is not larger.
This fixes a stack buffer overflow.
Reviewed-by: wm4 <nfxjfg@googlemail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 3e8e1a660e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-07 14:11:12 +01:00
Andreas Cadhalpun
e217224456
jvdec: avoid unsigned overflow in comparison
...
The return type of strlen is size_t, i.e. unsigned, so if pd->buf_size
is 3, the right side overflows leading to a wrong result of the
comparison and subsequently a heap buffer overflow.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit db374790c7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-07 14:10:41 +01:00
Michael Niedermayer
56419053bc
avcodec/jpeg2000dec: Clip all tile coordinates
...
Fixes out of array access
Fixes: b877a6b788a25c70e8b1d014f8628549/asan_heap-oob_1da2c3f_2324_5a1b329b0b3c4bb6b1d775660ac56717.r3d
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 43492ff3ab )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-07 03:02:04 +01:00
Michael Niedermayer
11b4822ddb
avcodec/microdvddec: Check for string end in 'P' case
...
Fixes out of array read
Fixes: a9502b60f4cecc19475382aee255f73c/asan_heap-oob_1e87fba_2548_a8ad47f6dde36644fe9cdc444d4632d0.sub
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c719cd6cf7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-07 01:10:58 +01:00
Michael Niedermayer
2de2959305
avcodec/dirac_parser: Fix undefined memcpy() use
...
Fixes: 9d375e415486edd1a0c826f2307d89a4/asan_generic_4a5159_1577_faa333e83dacdd9e4dd322380aeed537.iss
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit daefd8ab2f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-07 01:10:16 +01:00
Michael Niedermayer
b93a8bd838
avformat/xmv: Discard remainder of packet on error
...
Fixes infinite loop
Fixes: 9c48ae2680c5f23bca3d20ff0f325fd8/asan_generic_4c254d_1374_993f1e5967dd6f844b8d72f978ce2a6c.pss
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 79c4a338e4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-06 02:55:48 +01:00
Michael Niedermayer
2817eb514c
avformat/xmv: factor return check out of if/else
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9b6fac11da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-06 02:55:13 +01:00
Michael Niedermayer
6e085f9a32
avcodec/mpeg12dec: Do not call show_bits() with invalid bits
...
Fixes assertion failure
Fixes: 63e50545709a6440d3d59f6426d58db9/signal_sigabrt_7ffff6ae7cc9_8189_3272a3010fd98ddf947c662bbde1ac13.ts
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 973c3dba27 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-06 01:17:00 +01:00
Michael Niedermayer
a7bbb7fb88
avcodec/faxcompr: Add missing runs check in decode_uncompressed()
...
Fixes out of array access
Fixes: 54e488b9da4abbceaf405d6492515697/asan_heap-oob_32769b0_160_a8755eb08ee8f9579348501945a33955.TIF
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d4a731b84a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-05 21:50:14 +01:00
Michael Niedermayer
1290037626
libavutil/channel_layout: Check strtol*() for failure
...
Fixes assertion failure
Fixes: 4f5814bb15d2dda6fc18ef9791b13816/signal_sigabrt_7ffff6ae7cc9_65_7209d160d168b76f311be6cd64a548eb.wv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9bfd6a8c3 )
Conflicts:
libavutil/channel_layout.c
2015-11-05 20:47:15 +01:00
Michael Niedermayer
c7174d5204
avformat/mpegts: Only start probing data streams within probe_packets
...
Fixes assertion failure
Fixes: 4321db8ac331f5967ebfbfe80ce5eb78/signal_sigabrt_7ffff6ae7cc9_7213_0d6457b9d6897fa7c78507fa5de53510.ts
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3692d859f4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-05 18:23:11 +01:00
Michael Niedermayer
ff30907205
avcodec/hevc_ps: Check chroma_format_idc
...
Fixes out of array access
Fixes: 24d05e8b84676799c735c9e27d97895e/asan_heap-oob_1b70f6a_2955_7c3652a7f370f9f3ef40642bc2c99bb2.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93f30f825c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-05 15:17:56 +01:00
Michael Niedermayer
a6ae88bb25
avcodec/ffv1dec: Check for 0 quant tables
...
Fixes assertion failure
Fixes: 07ec1fc3c1cbf2d3edcd7d9b52ca156c/asan_heap-oob_13624c5_491_ecd4720a03e697ba750b235690656c8f.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5745cf799a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-05 01:49:09 +01:00
Michael Niedermayer
4567cba0b8
avcodec/mjpegdec: Reinitialize IDCT on BPP changes
...
Fixes misaligned access
Fixes: dc9262a469f6f315f74c087a7b3a7f35/signal_sigsegv_2e95bcd_9_9c0f9f4a9ba82aa9b3ab2b91ce4d5277.jpg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cc35f6f476 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-04 22:16:38 +01:00
Michael Niedermayer
fdb8842639
avcodec/mjpegdec: Check index in ljpeg_decode_yuv_scan() before using it
...
Fixes: 04715144ba237443010554be0d05343f/asan_heap-oob_1eafc76_1737_c685b48041a563461839e4e7ab97abb8.jpg
Fixes out of array access
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d24888ef19 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-04 19:42:29 +01:00
Tobias Rapp
c6c801d993
avutil/file_open: avoid file handle inheritance on Windows
...
Avoids inheritance of file handles on Windows systems similar to the
O_CLOEXEC/FD_CLOEXEC flag on Linux.
Fixes file lock issues in Windows applications when a child process
is started with handle inheritance enabled (standard input/output
redirection) while a FFmpeg transcoding is running in the parent
process.
Links relevant to the subject:
https://msdn.microsoft.com/en-us/library/w7sa2b22.aspx
Describes the _wsopen() function and the O_NOINHERIT flag. File handles
opened by _wsopen() are inheritable by default.
https://msdn.microsoft.com/en-us/library/windows/desktop/ms682425%28v=vs.85%29.aspx
Describes handle inheritance when creating new processes. Handle
inheritance must be enabled (bInheritHandles = TRUE) e.g. when you want
to pass handles for stdin/stdout via lpStartupInfo.
Signed-off-by: Tobias Rapp <t.rapp@noa-audio.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4746653466 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-02 19:15:32 +01:00
Michael Niedermayer
aa34146e41
avcodec/h264_slice: Disable slice threads if there are multiple access units in a packet
...
Fixes null pointer dereference
Fixes part of Ticket4977
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9368d2da3d33cac845f2fdf663df500b53625c5e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-31 22:57:52 +01:00
Lucas de Andrade
fcb8ee98f6
avformat/hls: update cookies on setcookie response
...
Context cookies must be updated when a playlist response return Setcookie header.
See: 770dd10504
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-30 18:12:30 +01:00
Kieran Kunhya
2f5f940bef
opusdec: Don't run vector_fmul_scalar on zero length arrays
...
Fixes crashes on fuzzed files
Fixes Ticket4969 part2
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b3e5f15b95 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-30 17:55:31 +01:00
Michael Niedermayer
6ac9d6303f
avcodec/opusdec: Fix extra samples read index
...
Fixes crash
Fixes Ticket4969 part 1
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 07225fa74f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-30 17:55:31 +01:00
Michael Niedermayer
81a2ad762b
avcodec/ffv1: Initialize vlc_state on allocation
...
This ensures that they are always set to valid values
Fixes Ticket4939
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a878dfa4f5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-30 17:55:31 +01:00
Michael Niedermayer
c8a1324d1e
avcodec/ffv1dec: update progress in case of broken pointer chains
...
Fixes deadlock
Fixes Ticket4932
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5063a18f56 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-30 17:55:31 +01:00
Michael Niedermayer
6a0e10ae0d
avcodec/ffv1dec: Clear slice coordinates if they are invalid or slice header decoding fails for other reasons
...
Fixes Ticket4931
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4c2d4e8700 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-30 17:55:31 +01:00
Martin Storsjö
3f3e12c768
rtsp: Allow $ as interleaved packet indicator before a complete response header
...
Some RTSP servers ("HiIpcam/V100R003 VodServer/1.0.0") respond to
our keepalive GET_PARAMETER request by a truncated RTSP header
(lacking the final empty line to indicate a complete response
header). Prior to 764ec70149 , this worked just fine since we
reacted to the $ as interleaved packet indicator anywhere.
Since $ is a valid character within the response header lines,
764ec70149 changed it to be ignored there. But to keep
compatibility with such broken servers, we need to at least
allow reacting to it at the start of lines.
Fixes ticket #4952 .
Signed-off-by: Martin Storsjö <martin@martin.st >
(cherry picked from commit e02dcdf6bb )
2015-10-27 13:40:06 +01:00
Ronald S. Bultje
6616762134
videodsp: don't overread edges in vfix3 emu_edge.
...
Fixes trac ticket 3226. Also see Andreas' analysis in
https://bugs.debian.org/801745 , which was very helpful.
(cherry picked from commit 52f84d82bd )
2015-10-25 01:05:31 +02:00
wm4
96b87d5cfa
avformat/mp3dec: improve junk skipping heuristic
...
Commit 2b3e9bbfb5 caused problems for a
certain API user:
https://code.google.com/p/chromium/issues/detail?id=537725
https://code.google.com/p/chromium/issues/detail?id=542032
The problem seems rather arbitrary, because if there's junk, anything
can happen. In this case, the imperfect junk skipping just caused it to
read different junk, from what I can see.
We can improve the accuracy of junk detection by a lot by checking if 2
consecutive frames use the same configuration. While in theory it might
be completely fine for the 1st frame to have a different format than the
2nd frame, it's exceedingly unlikely, and I can't think of a legitimate
use-case.
This is approximately the same mpg123 does for junk skipping. The
set of compared header bits is the same as the libavcodec mp3 parser
uses for similar purposes.
(cherry picked from commit de1b1a7da9 )
2015-10-20 12:35:43 +02:00
Marton Balint
e0e28dad90
concatdec: fix file_start_time calculation regression
...
Fixes ticket #4924 .
Found-by: Jaroslav Šnajdr <jsnajdr@gmail.com >
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit df239b7619 )
2015-10-17 22:36:33 +02:00
周晓勇
1a67b0f9ae
avcodec: loongson optimize h264dsp idct and loop filter with mmi
...
Change-Id: Ic87fb8f5cd22a502ff9dbbc5a5a8ea97cfc8a1dd
Signed-off-by: ZhouXiaoyong <zhouxiaoyong@loongson.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-16 14:47:56 +02:00
Michael Niedermayer
e3fcd88f08
avcodec/jpeg2000dec: Clear properties in jpeg2000_dec_cleanup() too
...
Fixes: Ticket4878
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c980c5e54d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-16 14:47:56 +02:00
Anssi Hannula
68a6178ef0
avformat/hls: add support for EXT-X-MAP
...
Without EXT-X-MAP support we miss the first bytes of some streams.
These streams worked by luck before byte-ranged segment support was added in
da7759b357
Fixes ticket #4797 .
(cherry picked from commit 9099079488 )
Conflicts:
libavformat/hls.c
2015-10-15 14:27:20 +02:00
Anssi Hannula
d51ddd45b2
avformat/hls: fix segment selection regression on track changes of live streams
...
Commit ad701326b4 ("avformat/hls: open playlists immediately when
AVDISCARD_ALL is dropped") inadvertently caused first_packet to never be
cleared, causing select_cur_seq_no() to not use the specific code for
live streams.
In practice this means that when the user selects a different audio
track during live stream (i.e. non-VOD) playback, there may be some
additional delay as the code might select an incorrect segment at first,
and we have to wait for video to catch audio (if too late segment was
selected) or to download more following audio segments (if too early
segment was selected).
Fix that by restoring the zeroing of first_packet.
(cherry picked from commit fd74d45d51 )
2015-10-15 14:21:29 +02:00
Carl Eugen Hoyos
c2db8ebc08
configure: Require libkvazaar < 0.7.
...
Fixes ticket #4925 .
Reviewed-by: Arttu Ylä-Outinen
2015-10-14 14:15:30 +02:00
Michael Niedermayer
b46efcb293
avcodec/vp8: Do not use num_coeff_partitions in thread/buffer setup
...
The variable is not a constant and can lead to race conditions
Fixes: repro.webm (not reproducable with FFmpeg alone)
Found-by: Dale Curtis <dalecurtis@google.com >
Tested-by: Dale Curtis <dalecurtis@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dabea74d0e )
2015-10-14 14:15:11 +02:00
Michael Niedermayer
40934e0e9b
Update for 2.8.1
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-13 20:44:52 +02:00
Pedro Arthur
bb3b4ad460
swscale: fix ticket #4881
...
When scaling only a slice of a frame the output was written always
in the first lines leaving the rest of the frame black.
(cherry picked from commit 5bd62a1b3c )
2015-10-13 20:11:42 +02:00
Andreas Cadhalpun
13d3749424
doc: fix spelling errors
...
Reviewed-by: Lou Logan <lou@lrcd.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 8d6625642d )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-10-12 21:46:54 +02:00
Andreas Cadhalpun
173053a125
hls: only seek if there is an offset
...
If there is no #EXT-X-BYTERANGE specified, there is no need to seek.
Seeking fails anyway for rtmp, because this protocol does not support
url_seek.
This fixes CNN.m3u from trac ticket 4797 (i.e. Debian bug #798189 ).
Reviewed-by: wm4 <nfxjfg@googlemail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit f9f0b4c08e )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-10-12 21:46:54 +02:00
Alexandra Hájková
8118fdf8bb
asfdec: add more checks for size left in asf packet buffer
...
Signed-off-by: Luca Barbato <lu_zero@gentoo.org >
(cherry picked from commit c0a49077ea )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-10-12 21:46:54 +02:00
Alexandra Hájková
f235f511a0
asfdec: alloc enough space for storing name in asf_read_metadata_obj
...
Signed-off-by: Luca Barbato <lu_zero@gentoo.org >
(cherry picked from commit 77cf236689 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2015-10-12 21:46:54 +02:00
Michael Niedermayer
c149a4afee
avcodec/pngdec: Check blend_op.
...
Fixes CID1322359, CID1322358
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e7e4f13f9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-12 02:23:36 +02:00
赵宇龙
02d8abf0f5
h264_mp4toannexb: fix pps offfset fault when there are more than one sps in avcc
...
the pps offset is used to locate pps in the spspps_buf; however, the
current calc method is wrong because it is the offset of the original
avctx->extradata;
when there is only one sps in the avcc; the value is correct by
coincidence, however, it will
fail in avcc with multi sps
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6b32d0d86b6bec2b5cb565d6ab4556f8cd66214a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-12 02:23:36 +02:00
Michael Niedermayer
9579550b2b
avcodec/h264_mp4toannexb_bsf: Use av_freep() to free spspps_buf
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d126ef188 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-12 02:23:36 +02:00
Michael Niedermayer
7ec05ae969
avformat/avidec: Workaround broken initial frame
...
Fixes Ticket4851
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3e2ef00394 )
2015-10-09 21:15:15 +02:00
wm4
b9841ba98c
avformat/hls: fix some cases of HLS streams which require cookies
...
Broken by commit ba12ba859a . This only
happens with HLS streams which use encryption and require preserving
cookies sent by the server.
Fixes trac issue #4846 .
(cherry picked from commit 26eb294007 )
2015-10-09 21:14:23 +02:00
Paul B Mahol
39df4d2475
avcodec/pngdec: reset has_trns after every decode_frame_png()
...
Fixes #4887 .
Signed-off-by: Paul B Mahol <onemda@gmail.com >
(cherry picked from commit 1d0487f77f )
2015-10-09 21:14:02 +02:00
Przemysław Sobala
635831c087
lavf/img2dec: Fix memory leak
...
Fixes #4886
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 01dd7e025c )
2015-10-09 21:13:49 +02:00
wm4
291a2f1ea7
avcodec/mp3: fix skipping zeros
...
Commits 43bc5cf9 and c5371f77 add code for skipping initial zeros in mp3
packets. This code forgot to report to the user that data was skipped at
all.
Since audio codecs allow partial packet decoding, the user application
has to rely on the return value. It will remove the data reported as
consumed by the decoder, and feed it to the decoder again. This resulted
in the mp3 frame after the zero region to be decoded over and over
again, until the zero region was finally skipped by the application.
Fix this by including the amount of skipped bytes to the number of
consumed bytes returned by the decode call.
Fixes trac ticket #4890 .
(cherry picked from commit cb1da9fb8d )
2015-10-09 21:12:30 +02:00
Clément Bœsch
ee1bcd3436
avformat/srtdec: make sure we probe a number
...
Fixes regression since 7218352e02 : WebVTT
files were matching the SRT probing.
(cherry picked from commit 40d9d6de90 )
2015-10-09 10:56:31 +02:00
James Almer
408240267a
configure: check for ID3D11VideoContext
...
Should fix compilation with mingw-w64 trunk, where ID3D11VideoDecoder is available
but ID3D11VideoContext still isn't.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit b8e4df46ab )
2015-10-08 17:08:04 -03:00
wm4
eca7b0dcce
avformat/vobsub: compare correct packet stream IDs
...
The stream ID is essentially an arbitrary number defined by the .idx
file headers. They have to match the IDs in the .sub stream. The vobsub
demuxer assumed the IDs would just start from 0, increassing by 1 for
each stream. This is not correct. In the sample I had, the IDs were
starting from 1, leading to no subtitles being displayed at all.
Fix this by using the correct stream ID.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a47ad06baf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 15:21:45 +02:00
Clément Bœsch
64b659673a
avformat/srtdec: more lenient first line probing
...
Fixes Ticket #4898
(cherry picked from commit 7218352e02 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 15:21:39 +02:00
Clément Bœsch
1d9d300d65
avformat/srtdec: fix number check for the first character
...
(cherry picked from commit d161a2a72b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 15:21:24 +02:00
Shivraj Patil
a931ad554d
avcodec/mips: build fix for MSA 64bit
...
Modified datatype of function argument (pitch from int32_t to ptrdiff_t).
Signed-off-by: Shivraj Patil <shivraj.patil@imgtec.com >
Commit in master: 322e960dbf
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 14:32:05 +02:00
Shivraj Patil
7236080d27
avcodec/mips: build fix for MSA
...
Modified sps and pps access from old HEVCContext(s) structure to newly introduced HEVCParamSets(ps).
Signed-off-by: Shivraj Patil <shivraj.patil@imgtec.com >
Commit in master: b0732b0214
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 14:31:49 +02:00
Andrey Utkin
6dcd2ebd34
avformat/httpauth: Add space after commas in HTTP/RTSP auth header
...
This fixes access to Grandstream cameras, which return 401 to ffmpeg
otherwise.
VLC sends Authorization: header with spaces between parameters, and it
is known to work with Grandstream devices and broad range of other HTTP
and RTSP servers, so author considers switching to such behaviour safe.
Just for record - RFC 2617 (HTTP Auth) does not specify the need in
spaces, so this is not a bug of FFmpeg.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fdb3283872 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
DHE
83d75c70df
libavformat/hlsenc: Use of uninitialized memory unlinking old files
...
Fixes ticket#4900
Signed-off-by: DHE <git@dehacked.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 76e3f8242d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Michael Niedermayer
818ebcbf5c
avcodec/x86/sbrdsp: Fix using uninitialized upper 32bit of noise
...
Fixes crash
Fixes: flicker-1.scout3d21443372922.28.m4a
Found-by: Dale Curtis <dalecurtis@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b82b934a1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Michael Niedermayer
837113ab5f
avcodec/ffv1dec: Fix off by 1 error in quant_table_count check
...
Fixes: invalid_read.nut
Found-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d221d9e06 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Michael Niedermayer
97340bdfa3
avcodec/ffv1dec: Explicitly check read_quant_table() return value
...
Forwards the error code, avoids potential integer overflow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 10bbf6cf62 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Jeremy James
61fd5a3072
dnxhddata: correct weight tables
...
CID 1260 (as evidenced by incorrect decoding of a sample from ticket
4876) seems to use incorrect weight tables. It appears those tables
were not zigzag-scanned.
Apply zigzag on weight tables for new CIDs 1258, 1259, and 1260, and
fix an incorrect chroma table for CID 1256.
Fixes last issue from ticket #4876 .
Found-by: Christophe Gisquet <christophe.gisquet@gmail.com >
Signed-off-by: Christophe Gisquet <christophe.gisquet@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 428424fe75 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Christophe Gisquet
f5f9c166a1
dnxhddec: decode and use interlace mb flag
...
This bit is 1 in some samples, and seems to coincide with interlaced
mbs and CID1260. 2008 specs do not know about it, and maintain qscale
is 11 bits. This looks oversized, but may help larger bitdepths.
Currently, it leads to an obviously incorrect qscale value, meaning
its syntax is shifted by 1. However, reading 11 bits also leads to
obviously incorrect decoding: qscale seems to be 10 bits.
However, as most profiles still have 11bits qscale, the feature is
restricted to the CID1260 profile.
The encoder writes 12 bits of syntax, last and first bits always 0,
which is now somewhat inconsistent with the decoder, but ends up with
the same effect (progressive + reserved bit).
Partially fixes ticket #4876 .
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2801a1352d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Pedro Arthur
01bf0a178d
swscale: fix ticket #4877
...
(cherry picked from commit a8602dde5e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Michael Niedermayer
3cd1be9702
avcodec/rangecoder: Check e
...
Fixes hang.nut
Found-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b2955b6c5a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Michael Niedermayer
d4b1fe72c2
avcodec/ffv1: seperate slice_count from max_slice_count
...
Fix segfault with too large slice_count
Fixes Ticket4879
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa6c43f3fd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Pedro Arthur
a8d0dcbafa
swscale: fix ticket 4850
...
(cherry picked from commit 77367f61b3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Michael Niedermayer
2a6103a082
cmdutils: Filter dst/srcw/h
...
Dimensions / pixel formats for scaling must be set through the -s / pix_fmt options
or the scale / format filters. Otherwise there are mismatches between whet is
in/output to the scaler and for what the scaler is configured
Fixes Ticket4856
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a0af9fd954 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Ganesh Ajjanagadde
3fedd64d4b
avutil/log: fix zero length gnu_printf format string warning
...
This should fix warning reported by fate client:
http://fate.ffmpeg.org/report.cgi?time=20150917113121&slot=x86_32-linux-gnu-gcc-4.5.1-have_6regs .
Untested.
Signed-off-by: Ganesh Ajjanagadde <gajjanagadde@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 63cdb6e4a5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Simon Thelen
9bbcd1cc7b
lavf/webvttenc: Require webvtt file to contain exactly one WebVTT stream.
...
Not requiring this can end up producing hilariously broken files
together with -c:s copy (e.g. a webvtt file containing binary subtitle data).
Signed-off-by: Simon Thelen <ffmpeg-dev@c-14.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b84232694e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Michael Niedermayer
9801c9524a
swscale/swscale: Fix "unused variable" warning
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ae40c5a70 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Michael Niedermayer
08fc0d771a
avcodec/mjpegdec: Fix decoding RGBA RCT LJPEG
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 055e56e9f7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
Michael Niedermayer
a3db85581e
MAINTAINERS: add 2.8, drop 2.2
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-10-08 13:15:42 +02:00
James Almer
ddbb8d5eda
doc: mention libavcodec can decode Opus natively
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit fd9ac48dc8 )
2015-09-20 23:30:50 -03:00
Hendrik Leppkes
41aa6b2095
hevc: properly handle no_rasl_output_flag when removing pictures from the DPB
...
Fixes ticket #4185 .
Reviewed-By: Mickael Raulet <Mickael.Raulet@insa-rennes.fr >
Signed-off-by: Hendrik Leppkes <h.leppkes@gmail.com >
2015-09-20 00:18:57 +02:00
Paul B Mahol
fb0d41932d
avfilter/af_ladspa: process all channels for nb_handles > 1
...
Signed-off-by: Paul B Mahol <onemda@gmail.com >
(cherry picked from commit dc1050a3e8 )
2015-09-16 12:50:13 +00:00
Ricardo Constantino
aa46ae8848
configure: add libsoxr to swresample's pkgconfig
...
Fixes linking in FFMS and f265 at least, when ffmpeg is compiled with
libsoxr.
Signed-off-by: Ricardo Constantino <wiiaboo@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2641eeeefe )
Signed-off-by: Timothy Gu <timothygu99@gmail.com >
2015-09-09 07:41:33 -07:00
Hendrik Schreiber
c3021738fc
lavc: Fix compilation with --disable-everything --enable-parser=mpeg4video.
...
(cherry picked from commit 9d742d23d2 )
2015-09-09 16:23:26 +02:00
Michael Niedermayer
b72c184194
avcodec/h264_sei: Remove "Subtitles with data type 0x%02x" sample request
...
Suggested-by: Carl and Hendrik
2015-09-08 23:02:00 +02:00
Michael Niedermayer
d86c5f8de8
RELEASE_NOTES based on 2.7
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-09-08 22:33:04 +02:00
周晓勇
0752e44b1f
avcodec: loongson delete invalid simple idct put and add optimization
...
Change-Id: I23a36c65915f01a1cf20e317c14b8eaaa62958b4
Signed-off-by: ZhouXiaoyong <zhouxiaoyong@loongson.cn >
Fixes Decoding of http://loongnix.org/ftp/multimedia/testing/nanocore_720p_24fps_mpeg4_ac3_short.avi
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a78656a187 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-09-08 22:31:44 +02:00
Michael Niedermayer
1d42df7292
Add NOA credits
2015-09-08 22:31:44 +02:00
Gwenole Beauchesne
eaabfe8ef8
vaapi: fix local header include.
...
Signed-off-by: Gwenole Beauchesne <gwenole.beauchesne@intel.com >
(cherry picked from commit aea611dc3e )
2015-09-07 15:32:56 +02:00
Michael Niedermayer
90d29c3d04
Changelog: Add 2.8
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-09-06 16:00:01 +02:00
Michael Niedermayer
48211b0c0d
set version to 2.8
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-09-06 15:48:55 +02:00
Ganesh Ajjanagadde
aa661d3672
avfilter/af_asyncts: use llabs for int64_t
...
long may not be 64 bit on all platforms; so labs on int64_t is unsafe.
This fixes a warning reported in:
http://fate.ffmpeg.org/log.cgi?time=20150905071512&log=compile&slot=i386-darwin-clang-polly-3.7
Signed-off-by: Ganesh Ajjanagadde <gajjanagadde@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d74123d03e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-09-06 12:11:23 +02:00
Zhang Rui
8cd24f8fe7
avformat/async: replace strerror with av_err2str
...
Fixes CID1322337
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 929451c5cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-09-06 11:56:54 +02:00
Rostislav Pehlivanov
7e853879ce
fate: increase the fuzz of the AAC encoder aref test
...
Almost fine on SunOS without yasm but 5 wasn't enough.
Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com >
2015-09-06 00:27:08 +02:00
Michael Niedermayer
f598ca088e
doc/APIchanges: Fill in missing fields and correct one lavu version
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0acd4e75fd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-09-05 18:34:01 +02:00
Michael Niedermayer
2710c14a83
doc/APIchanges: add 2.8 cut line
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 982e235d76 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-09-05 18:33:58 +02:00
James Almer
1a56be9cdc
avutil: undo FF_API_CRYPTO_CONTEXT deprecation for 2.8 release
...
There's no consensus yet if this deprecation is desired, so it's removed
from this release for the time being
Signed-off-by: James Almer <jamrial@gmail.com >
2015-09-05 13:02:29 -03:00