Michael Niedermayer
76ee3e41df
avcodec/noise_bsf: Check for wrapped frames
...
Wrapped frames contain pointers so they need specific code to
noise them, the generic code would lead to segfaults
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0889ebc577 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-07 01:33:16 +02:00
Michael Niedermayer
a957d604a2
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 18:35:46 +02:00
Jiasheng Jiang
08f0a18c34
avformat/nutdec: Add check for avformat_new_stream
...
Check for failure of avformat_new_stream() and propagate
the error code.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-27 22:38:20 -03:00
Michael Niedermayer
e14e7579f9
Update for 4.1.11
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 18:18:40 +02:00
Michael Niedermayer
4e377ec8dc
avformat/wavdec: Check that smv block fits in available space
...
Fixes: OOM
Fixes: 56271/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-5290810045497344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a76efafdb9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 14:45:28 +02:00
Michael Niedermayer
bb34d18e33
avcodec/tak: Check remaining bits in ff_tak_decode_frame_header()
...
Fixes: out of array access
Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-6682195323650048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 19b66b89da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 14:45:28 +02:00
Michael Niedermayer
1cf4afaeab
avcodec/utils: the IFF_ILBM implementation assumes that there are a multiple of 16 allocated
...
Fixes: out of array access
Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5124452659888128
Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-6362836707442688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 34056a94ea )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 14:45:28 +02:00
Michael Niedermayer
a207fbcdff
avcodec/pngdec: Do not pass AVFrame into global header decode
...
The global header should not contain a frame, and decoding it
would result in leaks
Fixes: memleak
Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-6603443149340672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d31d4f3228 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 14:45:28 +02:00
Michael Niedermayer
4443cdbc92
avcodec/vorbisdec: Check codebook float values to be finite
...
Fixes: Timeout
Fixes: 55116/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-4572159970508800
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cadd7e7a75 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:44 +02:00
Michael Niedermayer
67128a952c
avcodec/g2meet: Replace fake allocation avoidance for framebuf
...
framebuf is only allocated when the new width/height are larger than the old
but nothing sets the old so its always allocated.
Use av_fast_mallocz() instead.
Fixes: Timeout
Fixes: 55094/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5116909932904448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38adbc6eeb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:44 +02:00
Michael Niedermayer
3b5c0f75ef
avcodec/lcldec: More space for rgb24
...
Fixes: Ticket 10239
Fixes: zlib_306_306_rgb24.av
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e2c3aa8e2b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:43 +02:00
Michael Niedermayer
60b30ede05
avcodec/lcldec: Support 4:1:1 and 4:2:2 with odd width
...
Fixes: Ticket10240
Fixes: zlib_306_306_yuv422.avi
Fixes: zlib_306_306_yuv411.avi
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0cf1ac905d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:43 +02:00
Michael Niedermayer
161740d99f
libavcodec/lcldec: width and height should not be unsigned
...
Computations like col < width - 3 will not work with unsigned width=1
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3eb4e28c26 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:43 +02:00
Michael Niedermayer
c536ee212a
avcodec/escape124: Check that blocks are allocated before use
...
Fixes: NULL pointer dereference
Fixes: 57819/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-5077280228769792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5366ae12b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:43 +02:00
Michael Niedermayer
17163b57bd
avcodec/huffyuvdec: Fix undefined behavior with shift
...
Fixes: left shift of negative value -1
Fixes: 57554/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFVHUFF_fuzzer-4853603839115264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 27e7857bd1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:42 +02:00
Michael Niedermayer
a6676288e4
avcodec/j2kenc: Replace RGB24 special case by generic test
...
This fixes RGB48 with libavcodec as decoder
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ad4d647591 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:42 +02:00
Michael Niedermayer
78efab9bed
avcodec/j2kenc: remove misleading pred value
...
This field is only checked for being 0 or not and not zero means 5/3
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0adb375377 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:42 +02:00
Michael Niedermayer
008e01a2de
avcodec/j2kenc: fix 5/3 DWT identifer
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f6955b6df4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:41 +02:00
Michael Niedermayer
d82fb8b689
avcodec/vp3: Check width to avoid assertion failure
...
Fixes: Assertion failure on x86-32
av_assert2(block_w * sizeof(pixel) <= FFABS(buf_linesize)); in ff_emulated_edge_mc()
Fixes: 39641/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-5925660741206016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dab1cd2dc0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:41 +02:00
Michael Niedermayer
477c5cf023
avcodec/g729postfilter: Limit shift in long term filter
...
Fixes: shift exponent 34 is too large for 32-bit type 'int'
Fixes: 57389/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-6229522659016704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6d1d8609ac )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:41 +02:00
Lynne
70189b9ecb
configure: update copyright year
...
(cherry picked from commit 62da0b4a74 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:40 +02:00
Michael Niedermayer
b06620b9be
avcodec/tests/snowenc: Fix 2nd test
...
(cherry picked from commit 163013c724 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:40 +02:00
Michael Niedermayer
75c8967329
avcodec/tests/snowenc: return a failure if DWT/IDWT mismatches
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 771c266c0b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:40 +02:00
Michael Niedermayer
a9e8b170a8
avcodec/snowenc: Fix visual weight calculation
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5b5fcadea0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:39 +02:00
Michael Niedermayer
55d2d09a1e
avcodec/tests/snowenc: unbreak DWT tests
...
the IDWT data type mismatched current code
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b3351bbea )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:39 +02:00
Michael Niedermayer
cff7e3636e
avcodec/escape124: Fix some return codes
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 98df605f7a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:39 +02:00
Michael Niedermayer
31206a077f
avcodec/escape124: fix signdness of end of input check
...
Fixes: Timeout
Fixes: 56561/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-5560363635834880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 87ad0a5dd7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:38 +02:00
Michael Niedermayer
c02752bf7c
Use https for repository links
...
Reviewed-by: Stefano Sabatini <stefasab@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 011f30fc82 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:38 +02:00
Michael Niedermayer
d8e1d8063e
avcodec/motionpixels: Mask pixels to valid values
...
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOTIONPIXELS_fuzzer-6724203352555520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ac6eec1fc2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:38 +02:00
Michael Niedermayer
3c982fc61c
avcodec/xpmdec: Check size before allocation to avoid truncation
...
Fixes:OOM
Fixes:out of array access (no testcase)
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XPM_fuzzer-6573323838685184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 95f0f84dae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:37 +02:00
Michael Niedermayer
e82a3c05a4
avcodec/bink: Avoid undefined out of array end pointers in binkb_decode_plane()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea9deafd3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:37 +02:00
Michael Niedermayer
abe5bab7b5
avcodec/bink: Fix off by 1 error in ref end
...
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6657932926517248
Alterantivly to this it is possibly to allocate a bigger array
Note: oss-fuzz assigned this issue to a unrelated theora bug so the bug number matches that
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 49487045dd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:37 +02:00
Michael Niedermayer
fd6043ac28
avcodec/utils: Ensure linesize for SVQ3
...
Fixes: Assertion block_w * sizeof(uint8_t) <= ((buf_linesize) >= 0 ? (buf_linesize) : (-(buf_linesize))
Fixes: 54861/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-5352418248622080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4eef658ca5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:36 +02:00
Michael Niedermayer
ca1b6608f5
avcodec/utils: allocate a line more for VC1 and WMV3
...
Fixes: out of array read on 32bit
Fixes: 54857/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5840588224462848
The chroma MC code reads over the currently allocated frame.
Alternative fixes would be allocating a few bytes more at the end instead of a whole
line extra or to adjust the threshold where the edge emu code is activated
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 01636a63d4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:36 +02:00
Michael Niedermayer
fc682a1077
avcodec/videodsp_template: Adjust pointers to avoid undefined pointer things
...
Fixes: subtraction of unsigned offset from 0xf6602770 overflowed to 0xf6638c80
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-495074400600064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f0150cd41c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:36 +02:00
Michael Niedermayer
205c8feeef
avcodec/pngdec: Check deloco index more exactly
...
Fixes: out of array access:
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PNG_fuzzer-6716193709096960
Alternatively it should be possible to limit this to 3 plane RGB 8 /16bit to ensure the size is what it should be
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d5bae70406 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:35 +02:00
Michael Niedermayer
d5eef2fb85
avcodec/ffv1dec: Check that num h/v slices is supported
...
Fixes: out of array access
Fixes: 55597/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-4898293416329216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ead0ae68e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:35 +02:00
Michael Niedermayer
042e207e9b
avformat/mov: Check samplesize and offset to avoid integer overflow
...
Fixes: signed integer overflow: 9223372036854775584 + 536870912 cannot be represented in type 'long'
Fixes: 55844/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-510613920664780
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53c1f5c2e2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:35 +02:00
Michael Niedermayer
3b7a0e2b8f
avcodec/pictordec: Remove mid exit branch
...
This causes the RLE decoder to exit before applying the last RLE run
All images i tested with are unchanged, this makes the special case
for handling the last run unused for non truncated images.
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 88f0e05c72 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:34 +02:00
Michael Niedermayer
ee9cec2566
avcodec/eac3dec: avoid float noise in fixed mode addition to overflow
...
Fixes: 2.28595e+09 is outside the range of representable values of type 'int'
Fixes: 54644/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AC3_FIXED_fuzzer-4816961584627712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f48d227c1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:34 +02:00
Michael Niedermayer
9fc2c82006
avcodec/utils: use 32pixel alignment for bink
...
bink supports 16x16 blocks in chroma planes thus we need to allocate enough.
Fixes: out of array access
Fixes: 55026/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6013915371012096
Reviewed-by: Peter Ross <pross@xvid.org >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b95b2c8492 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:34 +02:00
Michael Niedermayer
306e38ae90
avcodec/012v: Order operations for odd size handling
...
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZERO12V_fuzzer-6714182078955520.fuzz
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZERO12V_fuzzer-6698145212137472.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4d42d82563 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:33 +02:00
Michael Niedermayer
c23ef5b345
avcodec/eatgq: : Check index increments in tgq_decode_block()
...
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATGQ_fuzzer-6743211456724992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e7755b433e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:33 +02:00
Michael Niedermayer
dd507e4c8f
avcodec/scpr: Test bx before use
...
Fixes: out of array access on 32bit
Fixes: 54850/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-5302669294305280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b59de3770 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:33 +02:00
Michael Niedermayer
cae611f864
avcodec/sunrast: Fix maplength check
...
Fixes: out of bounds read
Found-by: Ibrahim Mohamed <ielsayed@meta.com >
Reviewed-by; Ibrahim Mohamed <ielsayed@meta.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f8a2a65078 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:32 +02:00
Michael Niedermayer
662c3060b9
avcodec/wavpack: Avoid undefined shift in get_tail()
...
Fixes: left shift of 1208485947 by 1 places cannot be represented in type 'int'
Fixes: 54058/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5827521084260352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8374a747af )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:32 +02:00
Michael Niedermayer
ba9e8fa53a
avformat/id3v2: Check taglen in read_uslt()
...
Fixes: Timeout (read mostly the same data repeatly)
Fixes: 52457/clusterfuzz-testcase-minimized-ffmpeg_dem_ALP_fuzzer-6610706313379840
Fixes: 53098/clusterfuzz-testcase-minimized-ffmpeg_dem_SOL_fuzzer-6481382981632000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a798af91d7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:32 +02:00
Michael Niedermayer
6c4135ae35
avcodec/ffv1dec: restructure slice coordinate reading a bit
...
Fixes: signed integer overflow: -1094995528 * 8224 cannot be represented in type 'int'
Fixes: 53508/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-474551033462784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 74b6ac7ebb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:31 +02:00
Michael Niedermayer
82dc3224b7
avcodec/mlpdec: Check max matrix instead of max channel in noise check
...
This is a regression since: adaa06581c
Before this, max_channel and max_matrix_channel where compared for equality
Fixes: out of array access
Fixes: 53340/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-514959011885875
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa79560de5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:31 +02:00
Michael Niedermayer
1818f9f4dc
swscale/input: Use more unsigned intermediates
...
Same principle as previous commit, with sufficiently huge rgb2yuv table
values this produces wrong results and undefined behavior.
The unsigned produces the same incorrect results. That is probably
ok as these cases with huge values seem not to occur in any real
use case.
Fixes: signed integer overflow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ba209e3d51 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:31 +02:00
Michael Niedermayer
ae61a4ca68
avcodec/alsdec: The minimal block is at least 7 bits
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5280947fb6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:30 +02:00
Michael Niedermayer
ffeb46560f
avformat/replaygain: avoid undefined / negative abs
...
Fixes: signed integer overflow: -2147483648 * 100000 cannot be represented in type 'int'
Fixes: 52060/clusterfuzz-testcase-minimized-ffmpeg_dem_MP3_fuzzer-5131616708329472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2532b20b17 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:30 +02:00
Michael Niedermayer
5da206d3a5
swscale/output: Bias 16bps output calculations to improve non overflowing range
...
Fixes: integer overflow
Fixes: ./ffmpeg -f rawvideo -video_size 66x64 -pixel_format yuva420p10le -i ~/videos/overflow_input_w66h64.yuva420p10le -filter_complex "scale=flags=bicubic+full_chroma_int+full_chroma_inp+bitexact+accurate_rnd:in_color_matrix=bt2020:out_color_matrix=bt2020:in_range=full:out_range=full,format=rgba64[out]" -pixel_format rgba64 -map '[out]' -y overflow_w66h64.png
Found-by: Drew Dunne <asdunne@google.com >
Tested-by: Drew Dunne <asdunne@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0f0afc7fb5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:30 +02:00
Michael Niedermayer
0bc8a2c295
avcodec/speedhq: Check buf_size to be big enough for DC
...
Fixes: Timeout
Fixes: 51919/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-6023716480090112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9184d3d7b6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:29 +02:00
Michael Niedermayer
03758674e2
avcodec/ffv1dec: Fail earlier if prior context is corrupted
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4df91e2215 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-05-26 00:04:29 +02:00
Hendrik Leppkes
d12e316dbd
avcodec/vdpau_mpeg4: fix order of quant matrix coefficients
...
The matrix coefficients are stored permutated for the IDCT,
rather then in plain raster order, and need to be un-permutated
for the hardware.
2023-05-15 18:50:36 +02:00
Hendrik Leppkes
419248dd19
avcodec/vdpau_mpeg12: fix order of quant matrix coefficients
...
The matrix coefficients are stored permutated for the IDCT,
rather then in plain raster order, and need to be un-permutated
for the hardware.
2023-05-15 18:50:36 +02:00
Hendrik Leppkes
ab9b4ea207
avcodec/nvdec_mpeg4: fix order of quant matrix coefficients
...
The matrix coefficients are stored permutated for the IDCT,
rather then in plain raster order, and need to be un-permutated
for the hardware.
2023-05-15 18:50:36 +02:00
Hendrik Leppkes
97c9af0cc9
avcodec/nvdec_mpeg2: fix order of quant matrix coefficients
...
The matrix coefficients are stored permutated for the IDCT,
rather then in plain raster order, and need to be un-permutated
for the hardware.
2023-05-15 18:50:36 +02:00
Jiasheng Jiang
51efa68ec0
avcodec/vp3: Add missing check for av_malloc
...
Since the av_malloc() may fail and return NULL pointer,
it is needed that the 's->edge_emu_buffer' should be checked
whether the new allocation is success.
Fixes: d14723861b ("VP3: fix decoding of videos with stride > 2048")
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn >
(cherry picked from commit 656cb0450a )
2022-12-18 07:53:04 -03:00
James Almer
a8a208b123
avcodec/mjpegenc: take into account component count when writing the SOF header size
...
Fixes ticket #10069
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 1009396953 )
2022-11-28 08:48:42 -03:00
Martin Storsjö
f442a376a1
checkasm: float_dsp: Scale FLT/DBL_EPSILON sufficiently when comparing
...
As the values generated by av_bmg_get can be arbitrarily large
(only the stddev is specified), we can't use a fixed tolerance.
This matches what was done for test_vector_dmul_scalar in
38f966b222 .
This fixes the float_dsp checkasm test for some seeds, when built
with clang for mingw/x86_32.
Signed-off-by: Martin Storsjö <martin@martin.st >
(cherry picked from commit 8f70e261fa )
Fixes ticket #10010
2022-11-06 20:50:26 +01:00
Martin Storsjö
a4ba6e7d2c
swscale: aarch64: Fix yuv2rgb with negative strides
...
Treat the 32 bit stride registers as signed.
Alternatively, we could make the stride arguments ptrdiff_t instead
of int, and changing all of the assembly to operate on these
registers with their full 64 bit width, but that's a much larger
and more intrusive change (and risks missing some operation, which
would clamp the intermediates to 32 bit still).
Fixes: https://trac.ffmpeg.org/ticket/9985
Signed-off-by: Martin Storsjö <martin@martin.st >
(cherry picked from commit cb803a0072 )
Signed-off-by: Martin Storsjö <martin@martin.st >
2022-11-04 14:32:53 +02:00
Michael Niedermayer
a2e14839dc
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-10 16:05:50 +02:00
Michael Niedermayer
c814c2a1ff
avcodec/dstdec: Check for overflow in build_filter()
...
Fixes: signed integer overflow: 1917019860 + 265558963 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-4833165046317056
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8008940da5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:52 +02:00
Michael Niedermayer
056695bf43
avformat/spdifdec: Use 64bit to compute bit rate
...
Fixes: signed integer overflow: 32 * 553590816 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-6564974517944320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4075f0cec1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:52 +02:00
Michael Niedermayer
ae5b1998e3
avformat/xwma: Use av_rescale() for duration computation
...
Fixes: signed integer overflow: 34242363648 * 538976288 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6577923913547776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c789f753c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:52 +02:00
Michael Niedermayer
02402b49af
avformat/sdsdec: Use av_rescale() to avoid intermediate overflow in duration calculation
...
Fixes: signed integer overflow: 72128794995445727 * 240 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_SDS_fuzzer-6628185583779840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa8eb1bed0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:51 +02:00
Michael Niedermayer
74b61efa91
avformat/rmdec: check tag_size
...
Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6598073725353984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2cb7ee8a36 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:51 +02:00
Michael Niedermayer
e474173f47
avformat/nutdec: Check fields
...
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6566001610719232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c146406ea )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:51 +02:00
Michael Niedermayer
167c0dcfdc
avformat/dxa: avoid bpc overflows
...
Fixes: signed integer overflow: 2147483647 + 32 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-6639823726706688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93db0f0740 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:50 +02:00
Michael Niedermayer
9fb728dd1c
avformat/cafdec: Check that nb_frasmes fits within 64bit
...
Fixes: signed integer overflow: 1099511693312 * 538976288 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6565048815845376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d4bb4e3759 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:50 +02:00
Michael Niedermayer
955ed9b641
avformat/asfdec_o: Limit packet offset
...
avoids overflows with it
Fixes: signed integer overflow: 9223372036846866010 + 4294967047 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6538296768987136
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-657169555665715
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 736e9e69d5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:50 +02:00
Michael Niedermayer
3e208ef088
avformat/ape: Check frames size
...
Fixes: signed integer overflow: 9223372036854775806 + 3 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_APE_fuzzer-6389264140599296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d0349c9929 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:49 +02:00
Michael Niedermayer
80ec0ca973
avformat/icodec: Check nb_pal
...
Fixes: signed integer overflow: 538976288 * 4 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-6690068904935424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit db73ae0dc1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:49 +02:00
Michael Niedermayer
d52ed1be9e
avformat/aiffdec: Use 64bit for block_duration use
...
Fixes: signed integer overflow: 3 * -2147483648 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6668935979728896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9303ba272e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:49 +02:00
Michael Niedermayer
9959b6e2eb
avformat/aiffdec: Check block_duration
...
Fixes: signed integer overflow: 3 * -2147483648 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6668935979728896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1c2b6265c8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:48 +02:00
Michael Niedermayer
e55980d3bf
avformat/mxfdec: only probe max run in
...
Suggested-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1182bbb2c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:48 +02:00
Michael Niedermayer
045ed347fb
avformat/mxfdec: Check run_in is within 65536
...
Fixes: signed integer overflow: 9223372036854775807 - -2146905566 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6570996594769920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7786097825 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:48 +02:00
Michael Niedermayer
a101c97782
avcodec/apedec: Fix integer overflow in filter_3800()
...
Fixes: signed integer overflow: -2147448926 + -198321 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5739619273015296
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6744428485672960
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f05247f6a4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:47 +02:00
Michael Niedermayer
7d5e8bdb0a
avcodec/tta: Check 24bit scaling for overflow
...
Fixes: signed integer overflow: -8427924 * 256 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5409428670644224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3993345f91 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:47 +02:00
Michael Niedermayer
53f3a25107
libavformat/hls: Free keys
...
Fixes: memleak
Fixes: 50703/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-6399058578636800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Steven Liu <lingjiujianke@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d32a9f3137 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:47 +02:00
Michael Niedermayer
f0fb070286
avcodec/fmvc: Move frame allocation to a later stage
...
This way more things are checked before allocation
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9783749c66 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:46 +02:00
Michael Niedermayer
c263380558
avcodec/speedhq: Check width
...
Fixes: out of array access
Fixes: 50014/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-4748914632294400
Alternatively the buffer size can be increased
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f0395f9ef6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:46 +02:00
Michael Niedermayer
b222272124
avcodec/bink: disallow odd positioned scaled blocks
...
Fixes: out of array access
Fixes: 47911/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6194020855971840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b14104a637 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:46 +02:00
Michael Niedermayer
bf29c080b1
avformat/asfdec_o: limit recursion depth in asf_read_unknown()
...
The threshold of 5 is arbitrary, both smaller and larger should work fine
Fixes: Stack overflow
Fixes: 50603/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6049302564175872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f1a368169 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:45 +02:00
Michael Niedermayer
8f443328c0
doc/git-howto.texi: Document commit signing
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ced0dc807e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:45 +02:00
Michael Niedermayer
82e77e0dec
libavcodec/8bps: Check that line lengths fit within the buffer
...
Fixes: Timeout
Fixes: undefined pointer arithmetic
Fixes: 50330/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EIGHTBPS_fuzzer-5436287485607936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2316d5ec1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:45 +02:00
Michael Niedermayer
37139adfbf
libavformat/iff: Check for overflow in body_end calculation
...
Fixes: signed integer overflow: -6322983228386819992 - 5557477266266529857 cannot be represented in type 'long'
Fixes: 50112/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6329186221948928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bcb4690304 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:44 +02:00
Michael Niedermayer
2f2a3397cc
avformat/avidec: Prevent entity expansion attacks
...
Fixes: Timeout
Fixes no testcase, this is the same idea as similar attacks against XML parsers
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f3e823c2aa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:44 +02:00
Michael Niedermayer
4d537913e5
avcodec/h263dec: Sanity check against minimal I/P frame size
...
Fixes: Timeout
Fixes: 49718/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4874987894341632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ca4ff9c21c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:44 +02:00
Michael Niedermayer
ec9af84dc5
avcodec/hevcdec: Check s->ref in the md5 path similar to hwaccel
...
This is somewhat redundant with the is_decoded check. Maybe
there is a nicer solution
Fixes: Null pointer dereference
Fixes: 49584/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5297367351427072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3b51e19922 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:43 +02:00
Michael Niedermayer
8229f4327f
MAINTAINERS: Add ED25519 key for signing my commits in the future
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 05225180be )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:43 +02:00
Michael Niedermayer
0bea6b5d50
avcodec/hevc_filter: copy_CTB() only within width&height
...
Fixes: out of array access
Fixes: 49271/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5424984922652672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 009ef35d38 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:43 +02:00
Michael Niedermayer
f198ffcf38
avformat/flvdec: Check for EOF in index reading
...
Fixes: Timeout
Fixes: 47992/clusterfuzz-testcase-minimized-ffmpeg_dem_LIVE_FLV_fuzzer-6020443879899136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ceff5d7b74 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:42 +02:00
Michael Niedermayer
5cefe5d304
avformat/nutdec: Check get_packetheader() in mainheader
...
Fixes; Timeout
Fixes: 48794/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6524604713140224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5de084aa6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:42 +02:00
Michael Niedermayer
c9d8271274
avformat/asfdec_f: Use 64bit for packet start time
...
Fixes: signed integer overflow: 2147483647 + 32 cannot be represented in type 'int'
Fixes: 49014/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-6314973315334144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ed78486fc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:42 +02:00
Michael Niedermayer
85d59a6a98
avcodec/lagarith: Check dst/src in zero run code
...
Fixes: out of array access
Fixes: 48799/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LAGARITH_fuzzer-4764457825337344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9450f75974 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:41 +02:00
Michael Niedermayer
99f1f07b78
avcodec/h264dec: Skip late SEI
...
Fixes: Race condition
Fixes: clusterfuzz-testcase-minimized-mediasource_MP2T_AVC_pipeline_integration_fuzzer-6282675434094592
Found-by: google ClusterFuzz
Tested-by: Dan Sanders <sandersd@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f7dd408d64 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:41 +02:00
Michael Niedermayer
5deba24c22
avcodec/sbrdsp_fixed: Fix integer overflows in sbr_qmf_deint_neg_c()
...
Fixes: signed integer overflow: 2147483645 + 16 cannot be represented in type 'int'
Fixes: 46993/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-4759025234870272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1537f40516 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:41 +02:00
Michael Niedermayer
b3fdcaca7b
avfilter/vf_signature: Fix integer overflow in filter_frame()
...
Fixes: CID1403233
The second of the 2 changes may be unneeded but will help coverity
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dd6040675e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:40 +02:00
Michael Niedermayer
6c1a7a829d
avformat/rtsp: break on unknown protocols
...
This function needs more cleanup and it lacks error handling
Fixes: use of uninitialized memory
Fixes: CID700776
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73c0fd27c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:40 +02:00
Michael Niedermayer
8a4e3bc1c5
avcodec/hevcdsp_template: stay within tables in sao_band_filter()
...
Fixes: out of array read
Fixes: 47875/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5719393113341952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c5250a561 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:40 +02:00
Michael Niedermayer
f9afd5cacc
avcodec/qpeldsp: copy less for the mc0x cases
...
Fixes: out of array access
Fixes: 47936/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5745039940124672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e690d4edf5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:39 +02:00
Michael Niedermayer
f7b403bba6
avcodec/ffv1dec: Limit golomb rice coded slices to width 8M
...
This limit is possibly not reachable due to other restrictions on buffers but
the decoder run table is too small beyond this, so explicitly check for it.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b4431399ec )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:39 +02:00
Michael Niedermayer
aedff4dc8b
avformat/iff: simplify duration calculation
...
Fixes: signed integer overflow: 315680096256 * 134215943 cannot be represented in type 'long long'
Fixes: 48713/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5886272312311808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0740641e93 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:39 +02:00
Michael Niedermayer
c065971bf8
avcodec/wnv1: Check for width =1
...
The decoder only outputs pixels for width >1 images, fail early
Fixes: Timeout
Fixes: 48298/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WNV1_fuzzer-6198626319204352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d98d5a436a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:38 +02:00
Michael Niedermayer
2bfc334441
avformat/sctp: close socket on errors
...
This is untested as i have no testcase
Fixes: CID1302709
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9a2996544 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:38 +02:00
Michael Niedermayer
0e8b1a8b44
avcodec/aasc: Fix indention
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit af2ed09220 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:38 +02:00
Michael Niedermayer
9be645c544
avcodec/qdrw: adjust max colors to array size
...
Fixes: out of array access
Fixes: 48429/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDRAW_fuzzer-4608329791438848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cd847f86d3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:37 +02:00
Michael Niedermayer
b6c471ab4e
avcodec/alacdsp: Make intermediates unsigned
...
Fixes: signed integer overflow: -14914387 + -2147418648 cannot be represented in type 'int'
Fixes: 46464/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-474307197311385
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8709f4c10a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:37 +02:00
Michael Niedermayer
cc2357f36f
avformat/aiffdec: cleanup size handling for extreem cases
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c6f1e48b86 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:37 +02:00
Michael Niedermayer
36fdafb16d
avcodec/jpeglsdec: fix end check for xfrm
...
Fixes: out of array access
Fixes: 47871/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMV_fuzzer-5646305956855808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6a82412bf3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:36 +02:00
Michael Niedermayer
d5d3f80e17
avcodec/cdgraphics: limit scrolling to the line
...
Fixes: out of array access
Fixes: 47877/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CDGRAPHICS_fuzzer-5690504626438144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b7e30a13d4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:36 +02:00
Michael Niedermayer
4d7a4f66f8
avformat/aiffdec: avoid integer overflow in get_meta()
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 45891/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6159183893889024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6a02de2127 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:36 +02:00
Michael Niedermayer
93145eaeba
avformat/ape: more bits in size for less overflows
...
Fixes: signed integer overflow: 2147483647 + 3 cannot be represented in type 'int'
Fixes: 46184/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-4678059519770624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e5f6707a7b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:35 +02:00
Michael Niedermayer
0487f8e95e
avformat/bfi: Check offsets better
...
Fixes: signed integer overflow: -2145378272 - 538976288 cannot be represented in type 'int'
Fixes: 45690/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5015496544616448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 35dc93ab44 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:35 +02:00
Michael Niedermayer
12794ff1e4
avformat/asfdec_f: Check packet_frag_timestamp
...
Fixes: signed integer overflow: -9223372036854775808 - 4607 cannot be represented in type 'long'
Fixes: 45685/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5280102802391040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ffc8772150 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:35 +02:00
Michael Niedermayer
dc4d0f630b
avcodec/texturedspenc: Fix indexing in color distribution determination
...
Fixes CID1396405
MSE and PSNR is slightly improved, and some noticable corruptions disappear as
well.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit ade36d61de )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:34 +02:00
Michael Niedermayer
62dab58b94
avformat/act: Check ff_get_wav_header() for failure
...
Fixes: missing error check
Fixes: CID717495
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5982da87e3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:34 +02:00
Michael Niedermayer
7315e3ced5
avfilter/vsrc_mandelbrot: Check for malloc failure
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fbd22504c4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:34 +02:00
Michael Niedermayer
3ba5221129
avfilter/vf_frei0r: Copy to frame allocated according to frei0r requirements
...
Fixes: issues with non trivial linesize
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d353909e77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:34 +02:00
Michael Niedermayer
504a2bc6d9
avfilter/video: Add ff_default_get_video_buffer2() to set specific alignment
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d740782701 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:33 +02:00
Michael Niedermayer
ffea4ba051
avformat/genh: Check sample rate
...
Fixes: signed integer overflow: -2515507630940093440 * 4 cannot be represented in type 'long'
Fixes: 46318/clusterfuzz-testcase-minimized-ffmpeg_dem_GENH_fuzzer-5009637474172928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a3d790f197 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:15:33 +02:00
Christopher Degawa
dcf25ec885
configure: extend SDL check to accept all 2.x versions
...
sdl2 recently changed their versioning, moving the patch level to minor level
cd7c2f1de7
and have said that they will instead ship sdl3.pc for 3.0.0
Fixes ticket 9768
Signed-off-by: Christopher Degawa <ccom@randomderp.com >
Signed-off-by: Gyan Doshi <ffmpeg@gyani.pro >
2022-06-10 13:59:12 +02:00
Michael Niedermayer
742e66f442
FFmpeg 4.1.10 release
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-14 01:29:47 +02:00
Paul B Mahol
e7dbee00f0
avfilter/vf_colorspace: fix memmory leaks
...
Fixes #8303
(cherry picked from commit fddef964e8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 20:20:30 +02:00
Andreas Rheinhardt
4872230633
avcodec/ac3enc: Fix memleak
...
Fixes ticket #8294 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 097c917c14 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 20:20:30 +02:00
James Almer
525d855c60
avformat/nutenc: don't allocate a dynamic AVIOContext if no index is going to be written
...
Fixes ticket #8295
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 1d479300cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 20:20:30 +02:00
Paul B Mahol
a0307736e7
avfilter/vf_random: fix memory leaks
...
Fixes #8296
(cherry picked from commit 3488e0977c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 20:20:30 +02:00
Andreas Rheinhardt
2ce2537088
fftools/ffmpeg_opt: Fix leak of options when parsing options fails
...
Fixes #8094 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 21265f42ec )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 20:20:30 +02:00
Timo Rothenpieler
456988fe2b
lavf/tls_mbedtls: add support for mbedtls version 3
...
- certs.h is gone. Only contains test data, and was not used at all.
- config.h is renamed. Was seemingly not used, so can be removed.
- MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE is gone, instead
MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE will be thrown.
- mbedtls_pk_parse_keyfile now needs to be passed a properly seeded
RNG. Hence, move the call to after RNG seeding.
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2022-04-27 18:50:31 +02:00
Gyan Doshi
d841684332
configure: bump year
...
(cherry picked from commit 2f6360ff21 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-16 10:49:13 +02:00
Michael Niedermayer
6506a60eb0
Update for FFmpeg 4.1.9
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:22:41 +02:00
Paul B Mahol
293f75b581
avfilter/vf_lenscorrection: make width/height int
...
Somehow previous correct fix broke usage.
(cherry picked from commit 79522411fa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:41 +02:00
Michael Niedermayer
c8ca479572
avcodec/diracdec: avoid signed integer overflow in global mv
...
Fixes: signed integer overflow: -128275513086 * -76056576 cannot be represented in type 'long'
Fixes: 45818/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5129799149944832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f1279684e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:41 +02:00
Michael Niedermayer
61f4c4fc42
avcodec/takdsp: Fix integer overflow in decorrelate_sf()
...
Fixes: signed integer overflow: -101 * 71041254 cannot be represented in type 'int'
Fixes: 45938/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-4687974320701440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 01d8c887f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:41 +02:00
Michael Niedermayer
b3843ee24e
avcodec/apedec: fix a integer overflow in long_filter_high_3800()
...
Fixes: signed integer overflow: -2146549696 - 3923884 cannot be represented in type 'int'
Fixes: 45907/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5992380584558592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b085b400be )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:41 +02:00
Oneric
d985ec070c
avfilter/vf_subtitles: pass storage size to libass
...
Due to a quirk of the ASS format some tags depend on the exact storage
resolution of the video, so tell libass via ass_set_storage_size.
2022-04-09 22:19:41 +02:00
Michael Niedermayer
d09beec591
avformat/aqtitledec: Skip unrepresentable durations
...
Fixes: signed integer overflow: -5 - 9223372036854775807 cannot be represented in type 'long'
Fixes: 45665/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-475618463934054
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c2d1597a8a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:41 +02:00
Michael Niedermayer
bbdb02a73c
avformat/cafdec: Do not store empty keys in read_info_chunk()
...
Fixes: Timeout
Fixes: 45543/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5684953164152832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ec28e1d4c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:41 +02:00
Michael Niedermayer
0402ac6f59
avformat/hls: Check target_duration
...
Fixes: signed integer overflow: 77777777777777 * 1000000 cannot be represented in type 'long long'
Fixes: 45545/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-6438101247983616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Steven Liu <lingjiujianke@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8fd3f7fab )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:41 +02:00
Michael Niedermayer
ab70bfcbdd
avcodec/pixlet: Avoid signed integer overflow in scaling in filterfn()
...
Fixes: signed integer overflow: 11494 * 1073741824000000 cannot be represented in type 'long'
Fixes: 26586/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PIXLET_fuzzer-5752633970917376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c1f20c6c8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:41 +02:00
Michael Niedermayer
4fcf69dd9e
avformat/matroskadec: Check pre_ns
...
Fixes: division by 0
Fixes: 44615/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6681108677263360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 710e51677a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:41 +02:00
Michael Niedermayer
12e26cffcf
avcodec/sonic: Use unsigned for predictor_k to avoid undefined behavior
...
Fixes: signed integer overflow: -1094995529 * 24 cannot be represented in type 'int'
Fixes: 44436/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-4874459459223552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 28008bf95e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:41 +02:00
Michael Niedermayer
a8a8fda5cf
avformat/matroskadec: Use rounded down duration in get_cue_desc() check
...
Floating point is evil, it would be better if duration was not a double
Fixes: Infinite loop
Fixes: 45123/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6725052291219456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bd3a03db9a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:41 +02:00
Michael Niedermayer
362f55733b
avformat/avidec: Check height
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: Ticket8486
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec8ff659f5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
7f094e829e
avformat/rmdec: Better duplicate tags check
...
Fixes: memleaks
Fixes: 44810/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5619494647627776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 15a646e501 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
5a67ee5797
avformat/mov: Disallow empty sidx
...
It appears this is not allowed "Each Segment Index box documents how a (sub)segment is divided into one or more subsegments
(which may themselves be further subdivided using Segment Index boxes)."
Fixes: Null pointer dereference
Fixes: Ticket9517
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4419433d77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
34b6731e78
avformat/matroskadec: Check duration
...
Fixes: -nan is outside the range of representable values of type 'long'
Fixes: 44614/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6216204841254912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 36680078ca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
b7a305ab6b
avformat/mov: Corner case encryption error cleanup in mov_read_senc()
...
Fixes: memleak
Fixes: 42341/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4566632823914496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ee0e4abcb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
76e56f0006
avcodec/jpeglsdec: Fix if( code style
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f306b8e80a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
b6061e3d8e
avcodec/jpeglsdec: Check get_ur_golomb_jpegls() for error
...
Fixes: Timeout
Fixes: Invalid shift
Fixes: 44548/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-556487680891289
Fixes: 44569/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMV_fuzzer-6302543246917632
Fixes: 44570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-4550196556595200
Fixes: 44592/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5651610385121280
Fixes: 44571/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5094698987945984
Fixes: 44607/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5341352013987840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 151f83584e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
87297d5021
avcodec/motion_est: fix indention of ff_get_best_fcode()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ce43e1c581 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
2262e53f96
avcodec/motion_est: Fix xy indexing on range violation in ff_get_best_fcode()
...
This codepath seems untested, no testcases change
Found-by: <mkver>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 634312a70f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
c7c714719e
avcodec/jpeglsdec: Increase range for N in ls_get_code_runterm() by using unsigned
...
Fixes: left shift of 32768 by 16 places cannot be represented in type 'int'
Fixes: Timeout
Fixes: 44219/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-4679455379947520
Fixes: 44088/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-4885976600674304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ee283d7d0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
7eebf00ff0
avformat/matroskadec: Check desc_bytes
...
Fixes: Division by 0
Fixes: 44035/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4826721386364928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5038933977 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
2edb753825
avformat/utils: Fix invalid NULL pointer operation in ff_parse_key_value()
...
Fixes: pointer index expression with base 0x000000000000 overflowed to 0xffffffffffffffff
Fixes: 44012/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-5670607746891776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 59328aabd2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
893c4f1151
avformat/matroskadec: Fix infinite loop with bz decompression
...
The same check is added to zlib too, it seems not needed there though
Fixes: Infinite loop
Fixes: 43932/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-6175167573786624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c3d2cbb51 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
423a3b685f
avformat/mov: Check size before subtraction
...
Fixes: signed integer overflow: -9223372036854775808 - 8 cannot be represented in type 'long'
Fixes: 43542/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5237670148702208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d8d9d506a3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
210b4b9871
avcodec/apedec: Fix integer overflows in predictor_update_3930()
...
Fixes: signed integer overflow: 1074134419 - -1075212485 cannot be represented in type 'int'
Fixes: 43273/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-4706880883130368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c9c9bbd01 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
254ebed4d5
avcodec/apedec: fix integer overflow in 8bit samples
...
Fixes: signed integer overflow: 2147483542 + 128 cannot be represented in type 'int'
Fixes: 42812/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6344057861832704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7cee3b3718 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
a5b213a89e
avformat/flvdec: timestamps cannot use the full int64 range
...
We do not support this as we multiply by 1000
Fixes: signed integer overflow: -45318575073853696 * 1000 cannot be represented in type 'long'
Fixes: 42804/clusterfuzz-testcase-minimized-ffmpeg_dem_LIVE_FLV_fuzzer-4630325425209344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c217ca7718 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
7caa166ac3
avcodec/vqavideo: reset accounting on error
...
Fixes: Timeout (same growing chunk is decoded to failure repeatedly)
Fixes: 42582/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-6531195591065600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d8ea7a67ba )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
e546e9c5b4
avcodec/alacdsp: fix integer overflow in decorrelate_stereo()
...
Fixes: signed integer overflow: -16777216 * 131 cannot be represented in type 'int'
Fixes: 23835/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5669943160078336
Fixes: 41101/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-4636330705944576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 68457c1e85 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
0e6f3166ce
avformat/4xm: Check for duplicate track ids
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dd94912479 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
ea318a1fcd
avformat/4xm: Consider max_streams on reallocating tracks array
...
Fixes: OOM
Fixes: 41595/clusterfuzz-testcase-minimized-ffmpeg_dem_FOURXM_fuzzer-6355979363549184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0dcd95ef8a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
f80d5425ae
avformat/mov: Check next offset in mov_read_dref()
...
Fixes: signed integer overflow: 9223372036200463215 + 1109914409 cannot be represented in type 'long'
Fixes: 41480/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6553086177443840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 562021e2fd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
f433faed1e
avformat/mxfdec: Check for duplicate mxf_read_index_entry_array()
...
Fixes: memleak
Fixes: 41596/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6439060204290048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f44a218e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
531eeb81ce
avcodec/apedec: Change avg to uint32_t
...
Fixes: Integer overflow
Fixes: 40973/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6739312704618496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ec75723a4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
b4392d045e
avformat/mov: Disallow duplicate smdm
...
Fixes: memleak
Fixes: 39879/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5327819907923968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5ba74053c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
0d8300a960
avformat/mov: Check for EOF in mov_read_glbl()
...
Fixes: Infinite loop
Fixes: 41351/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5433895854669824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 59b4e7cbd8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
12d125e787
avformat/mov: Check channels for mov_parse_stsd_audio()
...
Fixes: signed integer overflow: -776522110086937600 * 16 cannot be represented in type 'long'
Fixes: 40563/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6644829447127040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a64a4c582 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
0afc4fb2e9
avformat/avidec: Check read_odml_index() for failure
...
Fixes: Timeout
Fixes: 40950/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6478873068437504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 57adb26d05 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
9a44dc209b
avformat/aiffdec: Use av_rescale() for bitrate
...
Fixes: integer overflow
Fixes: 40313/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-4814761406103552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 905588df97 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
8876c70ee8
avformat/aiffdec: sanity check block_align
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93f7776921 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
078bbcde0e
avformat/aiffdec: Check sample_rate
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b04836dff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Paul B Mahol
d5cb859665
avfilter/vf_gblur: fix heap-buffer overflow
...
Fixes #8282
(cherry picked from commit 64a805883d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Paul B Mahol
439645004b
avfilter/vf_lenscorrection: fix division by zero
...
Fixes #8265
(cherry picked from commit 19587c9332 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
James Almer
6fe33489be
avformat/latmenc: abort if no extradata is available
...
Fixes ticket #8273 .
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit dd01947397 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
d38c8064d4
avcodec/g729dec: Avoid computing invalid temporary pointers for ff_acelp_weighted_vector_sum()
...
Fixes: Ticket8176
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c78a76cb0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Paul B Mahol
97ee4a451b
avformat/tty: add probe function
...
(cherry picked from commit 3bce9e9b3e )
2022-04-09 22:19:40 +02:00
Michael Niedermayer
422cec5088
avcodec/flac_parser: Consider AV_INPUT_BUFFER_PADDING_SIZE
...
Fixes: out if array read
Fixes: 40109/clusterfuzz-testcase-minimized-ffmpeg_dem_FLAC_fuzzer-4805686811295744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Mattias Wadman <mattias.wadman@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
f3f575e395
avcodec/ttadsp: Fix integer overflows in tta_filter_process_c()
...
Fixes: signed integer overflow: 822841647 + 1647055738 cannot be represented in type 'int'
Fixes: 39935/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-4592657142251520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f24028c798 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
Michael Niedermayer
fbdeea9102
avutil/mathematics: Document av_rescale_rnd() behavior on non int64 results
...
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e154353fdb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-09 22:19:40 +02:00
James Almer
746f3fc165
fate: update reference files after the recent dash manifest muxer changes
...
Missed in 487b49d8f2 .
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit aa0829d834 )
2022-04-08 16:12:03 -03:00
James Almer
ad26796f4e
avformat/webmdashenc: fix on-demand profile string
...
Fixes ticket #9596
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 487b49d8f2 )
2022-04-08 00:16:08 -03:00
Andreas Rheinhardt
aa3b2c3883
configure: Add missing libshine->mpegaudioheader dependency
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com >
(cherry picked from commit e228d7b0db )
2022-01-06 08:49:01 +01:00
Andreas Rheinhardt
010281ed23
avformat/mpegenc: Ensure packet queue stays valid
...
The MPEG-PS muxer uses a custom queue of custom packets. To keep track
of it, it has a pointer (named predecode_packet) to the head of the
queue and a pointer to where the next packet is to be added (it points
to the next-pointer of the last element of the queue); furthermore,
there is also a pointer that points into the queue (called premux_packet).
The exact behaviour was as follows: If premux_packet was NULL when a
packet is received, it is taken to mean that the old queue is empty and
a new queue is started. premux_packet will point to the head of said
queue and the next_packet-pointer points to its next pointer. If
predecode_packet is NULL, it will also made to point to the newly
allocated element.
But if premux_packet is NULL and predecode_packet is not, then there
will be two queues with head elements premux_packet and
predecode_packet. Yet only elements reachable from predecode_packet are
ever freed, so the premux_packet queue leaks.
Worse yet, when the predecode_packet queue will be eventually exhausted,
predecode_packet will be made to point into the other queue and when
predecode_packet will be freed, the next pointer of the preceding
element of the queue will still point to the element just freed. This
element might very well be still reachable from premux_packet which
leads to use-after-frees lateron. This happened in the tickets mentioned
below.
Fix this by never creating two queues in the first place by checking for
predecode_packet to know whether the queue is empty. If premux_packet is
NULL, then it is set to the newly allocated element of the queue.
Fixes tickets #6887 , #8188 and #8266 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit cfce16449c )
2021-10-19 19:05:16 -03:00
Andreas Rheinhardt
f7c9b1ed56
avformat/movenc: Fix segfault when remuxing rtp hint stream
...
When remuxing an rtp hint stream (or any stream with the tag "rtp "),
the mov muxer treats this as one of the rtp hint tracks it creates
internally when ordered to do so; yet this track lacks the
AVFormatContext for the hinting rtp muxer, leading to segfaults in
mov_write_udta_sdp() if a "trak" atom is written for this stream; if not,
the stream's codecpar is freed by mov_free() as if the mov muxer owned
it (it does for the internally created "rtp " tracks), but without
resetting st->codecpar, leading to double-frees lateron. This commit
therefore ignores said tag which makes rtp hint streams unremuxable.
This fixes tickets #8181 and #8186 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 22c3cd1760 )
2021-10-19 19:03:19 -03:00
Baptiste Coudurier
3c4e1a56e3
avformat/mxfenc: fix index byte count in partition header
2021-10-19 19:01:36 -03:00
Michael Niedermayer
a5d2008e2a
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-17 19:42:14 +02:00
Lynne
d7bd4f73a7
configure: update copyright year
...
(cherry picked from commit 63505fc60a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-16 21:19:24 +02:00
Michael Niedermayer
9d8945bd49
avformat/wavdec: Check smv_block_size
...
Fixes: Timeout
Fixes: 39554/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-4915221701984256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 849138f476 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-16 21:19:24 +02:00
Michael Niedermayer
770b4de8d1
avformat/rmdec: Check for multiple audio_stream_info
...
Fixes: memleak
Fixes: 39166/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5153276690038784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8fe3566b8f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-16 21:19:24 +02:00
Michael Niedermayer
3c81d7025e
avcodec/apedec: Use 64bit to avoid overflow
...
Fixes: runtime error: signed integer overflow: 727298502 * 3 cannot be represented in type 'int'
Fixes: 39172/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-638602483033702
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f059b56195 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-16 21:19:24 +02:00
Michael Niedermayer
9236882745
avcodec/apedec: Fix undefined integer overflow in long_filter_ehigh_3830()
...
Fixes: signed integer overflow: -2145648640 - 3357696 cannot be represented in type 'int'
Fixes: 38899/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5358815017566208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ad517ee6e4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-16 21:19:24 +02:00
Michael Niedermayer
186222fa56
oavformat/avidec: Check offset in odml
...
Fixes: signed integer overflow: 9223372036854775807 + 8 cannot be represented in type 'long'
Fixes: 38787/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-4859845799444480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 255a7b423e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-16 21:19:24 +02:00
Michael Niedermayer
e295b5f3d3
avformat/mpegts: use actually read packet size in mpegts_resync special case
...
Fixes: infinite loop
Fixes: 37986/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5292311517462528 -
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 83b2e4c8f1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-16 21:19:24 +02:00
Timo Rothenpieler
0699b0836d
avfilter/scale_npp: fix non-aligned output frame dimensions
2021-10-07 18:31:41 +02:00
Michael Niedermayer
ef2efaa78b
Update for 4.1.8
2021-10-06 13:43:40 +02:00
Michael Niedermayer
ff48f4aad7
swscale/alphablend: Fix slice handling
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 06d6726588 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 12:06:15 +02:00
Michael Niedermayer
c59e2d2f03
avcodec/mxpegdec: Check for AVDISCARD_ALL
...
Fixes: Fixes NULL pointer dereference
Fixes: 36610/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-6052641783283712
Fixes: 37907/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-4725170850365440
Fixes: 37904/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-6367889262247936
Fixes: 38085/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-5175270823297024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 20afd3a63a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 12:06:15 +02:00
Michael Niedermayer
800e7d83e8
avcodec/flicvideo: Check remaining bytes in FLI*COPY
...
Fixes: Timeout
Fixes: 37795/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-4846536543043584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f835efbca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 12:06:15 +02:00
Michael Niedermayer
512a132e4c
avcodec/cbs_h265_syntax_template: Limit sps_num_palette_predictor_initializer_minus1 to 127
...
Fixes: index 128 out of bounds for type 'uint16_t [128]'
Fixes: 38651/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-6296416058736640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 85413a5ae6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 12:06:15 +02:00
Michael Niedermayer
448e9ce5e5
avcodec/mpeg12dec: Do not put mpeg_f_code into an invalid state on error return
...
Fixes: invalid shift
Fixes: 37018/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG2VIDEO_fuzzer-5290280902328320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5a95abcce4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 12:06:15 +02:00
Michael Niedermayer
552430993d
avcodec/mpegvideo_enc: Limit bitrate tolerance to the representable
...
Fixes: error: 1.66789e+11 is outside the range of representable values of type 'int'
Fixes: Ticket8201
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 245017ec8a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 12:06:15 +02:00
Michael Niedermayer
25f9794e56
avcodec/apedec: Fix integer overflow in intermediate
...
Fixes: signed integer overflow: 559334865 * 4 cannot be represented in type 'int'
Fixes: 37929/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6751932295806976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 90da43557f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 12:06:15 +02:00
Michael Niedermayer
ea9fc9676c
avformat/mvdec: Do not set invalid sample rate
...
Fixes: signed integer overflow: -682581959642593728 * 16 cannot be represented in type 'long'
Fixes: 37883/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5311691517198336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 737e6bf216 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 12:06:15 +02:00
Michael Niedermayer
a214f6e238
avformat/rmdec: Use 64bit for intermediate for DEINT_ID_INT4
...
Fixes: runtime error: signed integer overflow: 65312 * 65535 cannot be represented in type 'int'
Fixes: 32832/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-4817710040088576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e2c2872393 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 12:06:15 +02:00
Michael Niedermayer
ecb7f15b7b
avformat/mov: Check for duplicate clli
...
Fixes: memleak
Fixes: 35261/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4869656287510528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9a222f140e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 11:44:12 +02:00
Michael Niedermayer
f997f89071
avformat/jacosubdec: Check for min in t overflow in get_shift()
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 34651/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-5157941012463616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 989febfbd0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 11:44:12 +02:00
Michael Niedermayer
6992f5f665
avformat/mxfdec: check channel number in mxf_get_d10_aes3_packet()
...
Fixes: Out of array access
Fixes: 37030/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5387719147651072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3dd5a8a135 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 11:44:12 +02:00
Paul B Mahol
d7490ef341
avfilter/vf_bwdif: fix heap-buffer overflow
...
Fixes #8261
(cherry picked from commit 8c3166e1c3 )
Signed-off-by: James Almer <jamrial@gmail.com >
2021-09-13 16:51:43 -03:00
Paul B Mahol
8c9ff740a3
avfilter/vf_bm3d: fix heap-buffer overflows
...
Fixes #8262
(cherry picked from commit 0749082eb9 )
Signed-off-by: James Almer <jamrial@gmail.com >
2021-09-13 16:51:43 -03:00
Paul B Mahol
f1fc3fe317
avfilter/vf_floodfill: finish early if source and destination fill matches
...
Fixes #8236
(cherry picked from commit 1331e00179 )
Signed-off-by: James Almer <jamrial@gmail.com >
2021-09-13 16:51:43 -03:00
Paul B Mahol
ac5a7d5a67
avfilter/vf_edgedetect: fix heap-buffer overflow
...
Fixes #8275
(cherry picked from commit de598f82f8 )
Signed-off-by: James Almer <jamrial@gmail.com >
2021-09-13 16:51:43 -03:00
Paul B Mahol
da3d6068f3
avfilter/vf_w3fdif: deny processing small videos
...
Fixes #8243
(cherry picked from commit 0e68e8c93f )
Signed-off-by: James Almer <jamrial@gmail.com >
2021-09-13 16:51:43 -03:00
Paul B Mahol
df5e017709
avfilter/af_afade: fix heap-buffer overflow
...
Fixes #8276
(cherry picked from commit e1b89c76f6 )
Signed-off-by: James Almer <jamrial@gmail.com >
2021-09-13 16:50:46 -03:00
Paul B Mahol
29f1cf0c0f
avfilter/vf_colorconstancy: fix overreads in gauss array
...
Fixes #8250
(cherry picked from commit a7fd127970 )
Signed-off-by: James Almer <jamrial@gmail.com >
2021-09-13 16:50:33 -03:00
Paul B Mahol
e06e89f627
avcodec/pngenc: remove monowhite from apng formats
...
Monowhite pixel format is not supported, and it does not make sense
to add support for it.
Fixes #7989
(cherry picked from commit 5d9f44da46 )
Signed-off-by: James Almer <jamrial@gmail.com >
2021-09-13 16:50:33 -03:00
Paul B Mahol
aef4cbec69
avfilter/vf_datascope: fix heap buffer overflow
...
Fixes #8309
(cherry picked from commit d4d6b7b035 )
Signed-off-by: James Almer <jamrial@gmail.com >
2021-09-13 16:50:33 -03:00
Paul B Mahol
d60effdf83
avfilter/vf_fieldmatch: fix heap-buffer overflow
...
Also fix use of uninitialized values.
Fixes #8239
(cherry picked from commit ce5274c138 )
Signed-off-by: James Almer <jamrial@gmail.com >
2021-09-13 16:50:33 -03:00
Paul B Mahol
c79606f233
avfilter/vf_fieldorder: fix heap-buffer overflow
...
Fixes #8264
(cherry picked from commit 07050d7bdc )
Signed-off-by: James Almer <jamrial@gmail.com >
2021-09-13 16:50:32 -03:00
Paul B Mahol
69f5d4b7fd
avfilter/vf_bitplanenoise: fix overreads
...
Fixes #8244
(cherry picked from commit 0b56723874 )
Signed-off-by: James Almer <jamrial@gmail.com >
2021-09-13 16:50:32 -03:00
Paul B Mahol
540047eda8
avfilter/vf_edgedetect: check if height is big enough
...
Fixes #8260
(cherry picked from commit ccf4ab8c9a )
Signed-off-by: James Almer <jamrial@gmail.com >
2021-09-13 16:50:32 -03:00
Paul B Mahol
3a9f384225
avfilter/af_tremolo: fix heap-buffer overflow
...
Fixes #8317
(cherry picked from commit 58bb9d3a3a )
Signed-off-by: James Almer <jamrial@gmail.com >
2021-09-13 16:50:32 -03:00
Paul B Mahol
f5da6cff35
avfilter/vf_neighbor: check if width is 1
...
Fixes #8242
(cherry picked from commit e787f8fd7e )
Signed-off-by: James Almer <jamrial@gmail.com >
2021-09-13 16:49:27 -03:00
Paul B Mahol
01f3824f6c
avfilter/vf_avgblur: fix heap-buffer overflow
...
Fixes #8274
(cherry picked from commit f069a9c2a6 )
Signed-off-by: James Almer <jamrial@gmail.com >
2021-09-13 16:49:13 -03:00
Michael Niedermayer
fbb83f3d41
Revert "avformat/wvdec: Check rate for overflow"
...
The code this fixes is not in release/4.1
Found-by: <mkver>
This reverts commit b81d1379c2 .
2021-09-10 16:04:39 +02:00
Michael Niedermayer
add3d4048d
Update for 4.1.7
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 21:03:35 +02:00
James Almer
dfb9a3f7f3
avcodec/utils: don't return negative values in av_get_audio_frame_duration()
...
In some extrme cases, like with adpcm_ms samples with an extremely high channel
count, get_audio_frame_duration() may return a negative frame duration value.
Don't propagate it, and instead return 0, signaling that a duration could not
be determined.
Fixes ticket #9312
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit e01d306c64 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:59:05 +02:00
Michael Niedermayer
608be8437b
avcodec/jpeg2000dec: Check that atom header is within bytsetream
...
Fixes: Infinite loop
Fixes: 36666/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5912760671141888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3c659f8618 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:59:05 +02:00
Michael Niedermayer
5240beb4c5
avcodec/apedec: Fix 2 integer overflows in filter_3800()
...
Fixes: signed integer overflow: 1683879955 - -466265224 cannot be represented in type 'int'
Fixes: 37419/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6074294407921664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 33feb527ff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:59:05 +02:00
Michael Niedermayer
29d6be42d1
avcodec/xpmdec: Move allocations down after more error checks
...
Fixes: Timeout
Fixes: 37035/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XPM_fuzzer-5142718576721920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e58692837c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:59:05 +02:00
Martin Storsjö
feba3d29be
network: Define ENOTCONN as WSAENOTCONN if not defined
...
This fixes compilation with old mingw.org toolchains, which has got
much fewer errno.h entries.
Signed-off-by: Martin Storsjö <martin@martin.st >
(cherry picked from commit 6569e9505c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:59:05 +02:00
Michael Niedermayer
3837ebef6e
avformat/avidec: Use 64bit for frame number in odml index parsing
...
Fixes: signed integer overflow: 1179337772 + 1392508928 cannot be represented in type 'int'
Fixes: 34088/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5846945303232512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a4c98c507e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:59:05 +02:00
Michael Niedermayer
772e8bf0e7
avcodec/mjpegdec: Check for bits left in mjpeg_decode_scan_progressive_ac()
...
Fixes: Timeout
Fixes: 36262/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-4969052454912000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 909faca929 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:59:05 +02:00
maryam ebrahimzadeh
db3dd0545c
avformat/adtsenc: return value check for init_get_bits in adts_decode_extradata
...
As the second argument for init_get_bits (buf) can be crafted, a return value check for this function call is necessary.
'buf' is part of 'AVPacket pkt'.
replace init_get_bits with init_get_bits8.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9ffa49496d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:59:05 +02:00
Michael Niedermayer
ad3df92f53
avcodec/webp: Check available space in loop in decode_entropy_coded_image()
...
Fixes: Timeout
Fixes: 35401/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WEBP_fuzzer-5714401821851648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5e00eab611 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:59:05 +02:00
Michael Niedermayer
d6d46907c6
avcodec/vc1dec: ff_print_debug_info() does not support WMV3 field_mode
...
Fixes: out of array read
Fixes: 36331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-5140494328922112.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c59b5e3d1e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
51292064a2
avcodec/frame_thread_encoder: Free AVCodecContext structure on error during init
...
Fixes: MemLeak
Fixes: 8281
Fixes: PoC_option158.jpg
Fixes: CVE-2020-22037
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7bba0dd638 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
907273ca20
avcodec/faxcompr: Check for end of input in cmode == 1 in decode_group3_2d_line()
...
Fixes: Infinite loop
Fixes: 35591/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4503764022198272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f803635c4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
0b63cee7a0
avcodec/vc1dec: Disable error concealment for *IMAGE
...
The existing error concealment makes no sense for the image formats, they
use transformed source images which is different from keyframe + MC+difference
for which the error concealment is designed.
Of course feel free to re-enable this if you have a case where it works and
improves vissual results
Fixes: Timeout
Fixes: 36234/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-6300306743885824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 643b2d49bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
8c9f389083
avcodec/sbrdsp_fixed: Fix negation overflow in sbr_neg_odd_64_c()
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 35593/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5182217725804544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8f2856a1da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
f32abd61b9
avformat/wtvdec: Check for EOF before seeking back in parse_media_type()
...
Fixes: Infinite loop
Fixes: 36311/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-4889181296918528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 89505d38de )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
cb253316a8
avformat/wavdec: Use 64bit in new_pos computation
...
Fixes: signed integer overflow: 129 * 16711680 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-6742285317439488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9b57d2f0a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
55922a70d9
avformat/sbgdec: Check for overflow in timestamp preparation
...
Fixes: signed integer overflow: 9223372036854775807 + 86400000000 cannot be represented in type 'long'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6731040263634944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9dbed90840 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
d92939f984
avformat/dsicin: Check packet size for overflow
...
Fixes: signed integer overflow: 24672 + 2147483424 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_DSICIN_fuzzer-6731325979623424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d1c47ec03 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
8cacdaf819
avformat/bfi: check nframes
...
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_BFI_fuzzer-6737028768202752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b4e77dfca1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
a7c6df6df0
avformat/avidec: fix position overflow in avi_load_index()
...
Fixes: signed integer overflow: 9223372033098784808 + 4294967072 cannot be represented in type 'long'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6732488912273408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 527821a2dd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
c064645bdf
avformat/asfdec_f: Check sizeX against padding
...
Fixes: signed integer overflow: 2147483607 + 64 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-6753897878257664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f034c2e36a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
150642566c
avformat/aiffdec: Check for size overflow in header parsing
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6723467048255488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bae2e19777 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
7cf552af04
avcodec/aaccoder: Add minimal bias in search_for_ms()
...
Fixes: floating point division by 0
Fixes: Ticket8218
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 75a099fc73 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
d71d3cc9f6
avfilter/af_drmeter: Check that there is data
...
Fixes: floating point division by 0
Fixes: -nan is outside the range of representable values of type 'int'
Fixes: Ticket8307
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f49fa6abe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
6ce4989432
avfilter/vf_mestimate: Check b_count
...
Fixes: left shift of negative value -1
Fixes: Ticket8270
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 06af6e101b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
fb7379f7ef
avformat/mov: do not ignore errors in mov_metadata_hmmt()
...
Fixes: Timeout
Fixes: 35637/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6311060272447488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c52c99a18f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
c9784a783b
avformat/mxfdec: Check size for shrinking
...
av_shrink_packet() takes int size, so size must fit in int
Fixes: out of array access
Fixes: 35607/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4875541323841536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65b862ab59 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
maryam ebr
ff3ae69999
avcodec/dnxhddec: check and propagate function return value
...
Similar to CVE-2013-0868, here return value check for 'init_vlc' is needed.
crafted DNxHD data can cause unspecified impact.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 7150f95756 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
ffc6af3157
swscale/slice: Fix wrong return on error
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7874d40f10 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
3908552840
swscale/slice: Check slice for allocation failure
...
Fixes: null pointer dereference
Fixes: alloc_slice.mp4
Found-by: Rafael Dutra <rafael.dutra@cispa.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 997f9cfc12 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
eed7a662af
avformat/matroskadec: Fix handling of huge default durations
...
Fixes: negation of -9223372036854775808 cannot be represented in type 'int64_t' (aka 'long'); cast to an unsigned type to negate this value to itself
Fixes: 33997/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6752039691485184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 343d950a4a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
3631197f67
avcodec/lpc: check for zero err in normalization in compute_lpc_coefs()
...
Fixes: floating point division by 0
Fixes: Ticket8213
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 70874e024a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
fdff986dc4
avformat/ftp: Check for av_strtok() failure
...
Fixes: CID1396258 Dereference null return value
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d40782088 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
5878ac1007
tools/cws2fws: Check read() for failure
...
Fixes: CID1452579 Argument cannot be negative
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0b3cdd7cc2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
5246201182
avcodec/cpia: Fix missing src_size update
...
Fixes: out of array read
Fixes: 35210/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CPIA_fuzzer-5669199688105984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cea05864e6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
9b6158958c
avcodec/clearvideo: Check tile_size to be not too large
...
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 35023/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CLEARVIDEO_fuzzer-6740166587842560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 11fac9613e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
2beb60777f
avcodec/utils: Use 64bit for intermediate in AV_CODEC_ID_ADPCM_THP* duration calculation
...
Fixes: signed integer overflow: 486539264 * 14 cannot be represented in type 'int'
Fixes: 35281/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-6068262742917120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 00ae9b77ef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
fd21f6a0cc
avformat/rmdec: Check old_format len for overflow
...
Maybe such large values could be disallowed earlier and closer to where
they are set.
Fixes: signed integer overflow: 538976288 * 8224 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6704350354341888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 06d174e289 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
c7678193cf
avformat/realtextdec: Check the pts difference before using it for the duration computation
...
Fixes: signed integer overflow: 5404200000 - -9223372031709351616 cannot be represented in type 'long'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_REALTEXT_fuzzer-6737340551790592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fe12aa6890 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
14b04b9fd6
avformat/qcp: Avoid negative nb_rates
...
Fixes: signed integer overflow: 2 * -1725947872 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_QCP_fuzzer-6726807632084992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b865cc703 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
2c9e43e7f8
avformat/nutdec: Check tmp_size
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6739990530883584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1ca00b5e44 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
2b11977c9e
avformat/msf: Check that channels doesnt overflow during extradata construction
...
Fixes: signed integer overflow: 2048 * 1122336 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_MSF_fuzzer-6726959600107520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1a277926b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
dea3933dd5
avformat/mpc8: Check for position overflow in mpc8_handle_chunk()
...
Fixes: signed integer overflow: 15 + 9223372036854775796 cannot be represented in type 'long'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6723520756318208
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6739833034768384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ef25d1182 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
b38d513080
avformat/iff: Use 64bit in duration computation
...
Fixes: signed integer overflow: 588 * 16719904 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6748331936186368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93d964689c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
a059124e84
avformat/dxa: Check fps to be within the supported range more precissely
...
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: assertion failure
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-6744985740378112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ea494befc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
459a60c3b1
avcodec/iff: Only write palette to plane 1 if its PAL8
...
Fixes: null pointer passed as argument 1, which is declared to never be null
Fixes: 33791/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5107575256383488.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 216eb60b85 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
d358379349
avformat/tta: Check for EOF in index reading loop
...
Fixes: OOM
Fixes: 33585/clusterfuzz-testcase-minimized-ffmpeg_dem_TTA_fuzzer-4564665830080512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b72d657b73 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
37449dfb92
Update missed irc links
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c067d20177 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
81a32fe24e
avformat/rpl: The associative law doesnt hold for signed integers in C
...
Add () to avoid undefined behavior
Fixes: signed integer overflow: 9223372036854775790 + 57 cannot be represented in type 'long'
Fixes: 34983/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-5765822923538432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 480f11bdd7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
386190d873
avcodec/faxcompr: Check available bits in decode_uncompressed()
...
Fixes: Timeout
Fixes: 34950/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5686764151898112
Fixes: 34966/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4587409334468608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ff56c139e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
791d33c57a
avcodec/faxcompr: Check if bits are available before reading in cmode == 9 || cmode == 10
...
Fixes: Timeout
Fixes: 34950/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5686764151898112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d8421e3d5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
b2c565a40c
avcodec/utils: do "calc from frame_bytes, channels, and block_align" in 64bit
...
Fixes: signed integer overflow: 104962766 * 32 cannot be represented in type 'int'
Fixes: 33614/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-6252129036664832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3447979d08 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
e6799156d8
avcodec/ttadata: Add sentinel at the end of ff_tta_shift_1
...
Fixes: out of array access
Fixes: 34933/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5629322560929792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dbbcfbcc4e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
c9b39340f9
avformat/mov: Check for duplicate mdcv
...
Fixes: memleak
Fixes: 34932/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5456227658235904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f54d85cee6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
5498836d7d
avfilter/vf_dctdnoiz: Check threads
...
Fixes: floating point division by 0
Fixes: Ticket 8269
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a3917c02c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
5625dc1f32
avfilter/vf_ciescope: Fix undefined behavior in rgb_to_xy() with black
...
Fixes: floating point division by 0
Fixes: undefined behavior in handling NaN
Fixes: Ticket 8268
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d500e62f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
d9c4cfba9f
avformat/rpl: Check for EOF and zero framesize
...
Fixes: Infinite loop
Fixes: 34751/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-5439330800762880
Fixes: 34774/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-5851571660390400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a0a4a527c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
68765c25cd
avcodec/vc2enc: Check for non negative slice bounds
...
Fixes: invalid shifts
Fixes: Ticket 8221
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f7862e8268 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
97d0d3ae61
avformat/rpl: Use 64bit in bitrate computation and check it
...
Fixes: signed integer overflow: 777777776 * 4 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-6726188921913344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 29b244ffc1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
d2e90cde29
avcodec/svq1enc: Do not print debug RD value before it has been computed
...
Avoids floating point division by 0
Fixes: Ticket8191
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c297f7e57a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
b2094c5415
avcodec/aacpsy: Check bandwidth
...
Fixes: Ticket8011
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 36dead4bc2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
8b67497df0
avcodec/aacenc: Do not divide by lambda_count if it is 0
...
Avoids Floating point division by 0
Fixes: Ticket8011
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c520b98691 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
9546b0a9d3
avcodec/aacenc: Use FLT_EPSILON for lambda minimum
...
(cherry picked from commit 4b89cf7aa4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
5b15e02fa4
avformat/cinedec: Fix index_entries size check
...
Fixes: out of array access
Fixes: 29868/clusterfuzz-testcase-minimized-ffmpeg_dem_CINE_fuzzer-5692001957445632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
b5ffefdd61
avfilter/vf_yadif: Fix handing of tiny images
...
Fixes: out of array access
Fixes: Ticket8240
Fixes: CVE-2020-22021
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7971f62120 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
c7da0dad1f
avfilter/vf_vmafmotion: Check dimensions
...
Fixes: out of array access
Fixes: Ticket8241
Fixes: Ticket8246
Fixes: CVE-2020-22019
Fixes: CVE-2020-22033
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 82ad1b7675 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
14e172600e
avformat/movenc: Check pal_size before use
...
Fixes: assertion failure
Fixes: out of array read
Fixes: Ticket8190
Fixes: CVE-2020-22015
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4c1afa2925 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
9dd54c28df
avcodec/lpc: Avoid floating point division by 0
...
Fixes: Ticket7996
Fixes: CVE-2020-20445
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38d18fb578 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
b290d6b41e
avcodec/aacpsy: Avoid floating point division by 0 of norm_fac
...
Fixes: Ticket7995
Fixes: CVE-2020-20446
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 223b5e8ac9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
e431babf71
avcodec/aacenc: Avoid 0 lambda
...
Fixes: Ticket8003
Fixes: CVE-2020-20453
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a7a7f32c8a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
892f0ac5b2
avcodec/exr: x/ymax cannot be INT_MAX
...
The code uses x/ymax + 1 so the maximum is INT_MAX-1
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 33158/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5545462457303040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 48342aa075 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
69ef25f012
avformat/avio: Check av_opt_copy() for failure
...
Fixes: CID1477416 Unchecked return value
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f8611ae1ef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
f2685c9ec3
avcodec/clearvideo: Check for 0 tile_shift
...
Fixes: shift exponent -1 is negative
Fixes: 33401/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CLEARVIDEO_fuzzer-5908683596890112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 63e75e09ae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
9ce7856341
avcodec/vc1: Check remaining bits in ff_vc1_parse_frame_header()
...
Fixes: Timeout
Fixes: 33156/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-6259655027326976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38c4761588 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
ed99d350bc
avformat/mov: Ignore duplicate CoLL
...
Fixes: memleak
Fixes: 32146/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5377612845285376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9548dc74d8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
e7dc9e1d25
avformat/mov: Limit nb_chapter_tracks to input size
...
Fixes: Timeout (15k loop iterations instead of 400m)
Fixes: 31368/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6601583174483968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 299a56c900 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
3dd661bf7b
avformat/utils: Use 64bit earlier in r_frame_rate check
...
Fixes: signed integer overflow: 1406796319 * 2 cannot be represented in type 'int'
Fixes: 32777/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5632576913014784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 578633fc1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
80937873d5
avformat/mvdec: Check sample rate in parse_audio_var()
...
Fixes: signed integer overflow: -635424002382840000 * 16 cannot be represented in type 'long'
Fixes: 33612/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5704741108711424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ff60249a5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
0d633d2fd4
avcodec/faxcompr: Check for end of bitstream in decode_group3_1d_line() and decode_group3_2d_line()
...
Fixes: infinite loop
Fixes: 33674/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4816457818046464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 08d2df4153 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
3767b14c7e
avcodec/utils: treat PAL8 for jpegs similar to other colorspaces
...
Fixes: out of array access
Fixes: 33713/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5778775641030656
Fixes: 33717/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-4960397238075392
Fixes: 33718/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-5314270096130048.fuzz
Fixes: 33719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5352721864589312
Fixes: 33721/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-5938892055379968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f0ce023ddb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
93506a7bf7
avcodec/jpeglsdec: Set alpha plane in PAL8 so image is not 100% transparent
...
Fixes: tickets/3933/128.jls
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 011006874c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
c1d8652b5b
avformat/asfdec_o: Use ff_get_extradata()
...
Fixes: OOM
Fixes: 27240/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-5937469859823616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 098314e1e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
588c22d057
avformat/id3v2: Check end for overflow in id3v2_parse()
...
Fixes: signed integer overflow: 9223372036840103978 + 67637280 cannot be represented in type 'long'
Fixes: 33341/clusterfuzz-testcase-minimized-ffmpeg_dem_DSF_fuzzer-6408154041679872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit efdb564504 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
06342bca35
avformat/wtvdec: Improve size overflow checks in parse_chunks()
...
Fixes: signed integer overflow: 32 + 2147483647 cannot be represented in type 'int
Fixes: 32967/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5132856218222592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f8ec1da8ac )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
b655cebd91
avcodec/faxcompr: Check remaining bits on error in decode_group3_1d_line()
...
Fixes: Timeout
Fixes: 32886/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4779761466474496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b3881f0da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
dcdb7d2dab
avcodec/utils: Check ima wav duration for overflow
...
Fixes: signed integer overflow: 44331634 * 65 cannot be represented in type 'int'
Fixes: 32120/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-5760221223583744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f40e9b1355 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:54:52 +02:00
Michael Niedermayer
05954971ba
avformat/cafdec: Check channels
...
Fixes: signed integer overflow: -1184429040541376544 * 32 cannot be represented in type 'long'
Fixes: 31788/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6236746338664448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 641c1db22b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
1630c9e0b6
avcodec/dpx: Check bits_per_color earlier
...
Fixes: shift exponent 251 is too large for 32-bit type 'int'
Fixes: 32147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DPX_fuzzer-5519111675314176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c093eb3031 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
5213143514
avcodec/pnm_parser: Check image size addition for overflow
...
Fixes: assertion failure
Fixes: out of array access
Fixes: 32664/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-6533642202513408.fuzz
Fixes: 32669/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-6001928875147264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 79ac8d5546 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
54d921f159
avcodec/h265_metadata_bsf: Check nb_units before accessing the first in h265_metadata_update_fragment()
...
Fixes: null pointer dereference
Fixes: 32113/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-4803262287052800
Same as 0c48c332ee
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 497ea04dbd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
7274684a29
avformat/rmdec: use larger intermediate type for audio_framesize * sub_packet_h check
...
Fixes: signed integer overflow: 65535 * 65535 cannot be represented in type 'int'
Fixes: 31406/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5024692843970560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf2fd9204b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
3d7e6dbaf3
avcodec/h264_slice: Check input SPS in ff_h264_update_thread_context()
...
Fixes: crash
Fixes: check_pkt.mp4
Found-by: Rafael Dutra <rafael.dutra@cispa.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ceae92cb29 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
f46a15a82d
avcodec/mpegvideo: Update chroma_?_shift in ff_mpv_common_frame_size_change()
...
Fixes: out of array access
Fixes: 31201/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4627865612189696.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 87d87e6587 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
cf8fa41490
avformat/mov: Ignore multiple STSC / STCO
...
Fixes: STSC / STCO inconsistency and assertion failure
Fixes: crbug1184666.mp4
Found-by: Chromium ASAN fuzzer
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2611d20d35 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
930f1fcccd
avformat/utils: Extend overflow check in dts wrap in compute_pkt_fields()
...
Fixes: signed integer overflow: -9223372032574480351 - 4294967296 cannot be represented in type 'long long'
Fixes: 30022/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5568610275819520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b37ff29e0e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
2d99005df7
avfilter/vf_scale: Fix adding 0 to NULL (which is UB) in scale_slice()
...
Found-by: Jeremy Leconte <jleconte@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1cf96ce269 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
fb9905d7eb
avutil/common: Add FF_PTR_ADD()
...
Suggested-by: Andreas Rheinhardt
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 522a5259e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
4779c0ea92
avformat/wtvdec: Check size in SBE2_STREAM_DESC_EVENT / stream2_guid
...
Fixes: signed integer overflow: 539033600 - -1910497124 cannot be represented in type 'int'
Fixes: 30928/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5922630966312960
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f74661543 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
0a8717e4b3
avformat/cafdec: Do not build an index if all packets are the same
...
Fixes: Timeout
Fixes: 28214/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6495999421579264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea12590c8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
7d5b285e73
avcodec/sonic: Use unsigned temporary in predictor_calc_error()
...
Fixes: signed integer overflow: -2147471366 - 18638 cannot be represented in type 'int'
Fixes: 30157/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5171199746506752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 075d793ba8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
a8cfab28cb
avformat/flvdec: Check array entry number
...
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 30209/clusterfuzz-testcase-minimized-ffmpeg_dem_FLV_fuzzer-5724831658147840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5d8fe1c87 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
322a0a6dd2
avcodec/h264_slice: Check sps in h264_slice_header_init()
...
Fixes: null pointer dereference
Fixes: h264_slice_header_init.mp4
Found-by: Rafael Dutra <rafael.dutra@cispa.de >
Tested-by: Rafael Dutra <rafael.dutra@cispa.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8047243899 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
61f87c7207
avformat/movenc: Avoid loosing cluster array on failure
...
Fixes: crash
Fixes: check_pkt.mp4
Found-by: Rafael Dutra <rafael.dutra@cispa.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c2ff44f91 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
d4d9c117eb
avformat/avidec: Check for dv streams before using priv_data in parse ##dc/##wb
...
Fixes: null pointer dereference
Fixes: 31588/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6165716135968768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f733688d30 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
c450dcc5e2
avformat/mov: Check sample size for overflow in mov_parse_stsd_audio()
...
Fixes: signed integer overflow: 2 * 1914708000 cannot be represented in type 'int'
Fixes: 31639/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6303428239294464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d35677736a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
64a715b5ed
avcodec/ffwavesynth: Avoid signed integer overflow in phi_at()
...
Fixes: signed integer overflow: 2314885530818453536 - -9070214327174160352 cannot be represented in type 'long'
Fixes: 31000/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-6558389742206976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be08b84f8b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
6bb271c526
avcodec/mpeg4videoenc: Check extradata malloc()
...
Fixes: Null pointer dereference
Fixes: any mpeg4 testcase which fails the malloc at that exact spot
Found-by: Rafael Dutra <rafael.dutra@cispa.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 33a1687bf6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
4760b9d048
avcodec/speedhq: Width < 8 is not supported
...
Fixes: out of array access
Fixes: 31733/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-4704307963363328
Fixes: 31736/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-6190960292790272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 462b8261aa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
7b660aa875
avformat/matroskadec: Check for EOF in resync loop
...
Fixes: Timeout (too long -> instantly)
Fixes: 29136/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4586141227548672
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5282147d0c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
727711d842
avcodec/utils: Use more bits for intermediate for AV_CODEC_ID_ADPCM_MS
...
Fixes: signed integer overflow: 1172577312 * 2 cannot be represented in type 'int'
Fixes: 29924/clusterfuzz-testcase-minimized-ffmpeg_dem_BOA_fuzzer-4882912874594304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0f441b9063 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
4c09316886
avcodec/jpegls: Check A[Q] for overflow in ff_jpegls_update_state_regular()
...
Fixes: Timeout
Fixes: 30912/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5556235476795392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8a3fea802a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
6f711672d6
avformat/voc_packet: prevent remaining size from becoming negative in ff_voc_get_packet()
...
Fixes: memleak
Fixes: 30909/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS_fuzzer-4886284057313280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 337984c133 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
4f813f7f13
avutil/timecode: Avoid fps overflow
...
Fixes: Integer overflow and division by 0
Fixes: poc-202102-div.mov
Found-by: 1vanChen of NSFOCUS Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c94875471e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
7560bd30ba
avformat/mvi: Check audio size for more overflows
...
Fixes: left shift of negative value -352256000
Fixes: 30837/clusterfuzz-testcase-minimized-ffmpeg_dem_MVI_fuzzer-5755626262888448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 403b35e16e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
161717ee5a
avcodec/flacdec: Avoid undefined shift in error case
...
Fixes: flac_1040988
Reported-by: Thomas Guilbert <tguilbert@google.com >
Reviewed-by: Thomas Guilbert <tguilbert@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bd525e2876 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
4393c27e19
avcodec/ffv1dec: Check if trailer is available
...
Fixes: out of array read
Fixes: 29750/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-4808377272238080.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 36ad2f41e3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
6505b2f7a8
avcodec/4xm: Check pre_gb in decode_i_block()
...
Fixes: Timeout
Fixes: 31257/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5150866229297152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b87781649e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
a0bda2923b
avcodec/dcadsp: Fix integer overflow in dmix_add_c()
...
Fixes: signed integer overflow: 1515225320 + 759416059 cannot be represented in type 'int'
Fixes: 29256/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DCA_fuzzer-5719088561258496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b4ebf483bc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
b2c3461b57
avformat/flvdec: Check double before cast in parse_keyframes_index()
...
Fixes: -2.21166e+304 is outside the range of representable values of type 'long'
Fixes: 29169/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5725452796821504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 09e5e406c7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
c747637919
avformat/paf: Check for EOF before allocation in read_header()
...
Fixes: OOM
Fixes: 26584/clusterfuzz-testcase-minimized-ffmpeg_dem_PAF_fuzzer-5172661183053824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bcb1e9d3b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
90205d2107
avcodec/aacdec_template: Avoid undefined negation in imdct_and_windowing_eld()
...
Fixes: negation of -2147483648 cannot be represented in type 'INTFLOAT' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: 29057/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5642758933053440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 633924539a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
d958e1bd1c
avformat/lxfdec: Fix multiple integer overflows related to track_size
...
Fixes: signed integer overflow: 538976288 * 8 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_LXF_fuzzer-6634030636335104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7819412f44 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
183fca09b0
avcodec/exr: skip bottom clearing loop when its outside the image
...
Fixes: signed integer overflow: 1633771809 * 32960 cannot be represented in type 'int'
Fixes: 26532/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5613925708857344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
3366136aeb
avutil/parseutils: Check sign in av_parse_time()
...
Fixes: signed integer overflow: -9223372053736 * 1000000 cannot be represented in type 'long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-6607924558430208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d7f17e885 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
584afd3678
avformat/aiffdec: Check that SSND is at least 8 bytes
...
Fixes: Infinite loop
Fixes: 30874/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-5933710488764416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 460d3dc41f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
f48e4903fb
avformat/dcstr: Check sample rate
...
Fixes: signed integer overflow: -1300248894420254720 * 16 cannot be represented in type 'long'
Fixes: 30879/clusterfuzz-testcase-minimized-ffmpeg_dem_DCSTR_fuzzer-5094464215449600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fdcb966f4a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
b14418c0cb
avcodec/alsdec: Check bitstream input in read_block()
...
Fixes: Timeout
Fixes: 28110/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5036338973507584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53d739db4e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
9a797b31d0
avformat/mov: Extend data_size check in mov_read_udta_string()
...
Fixes: signed integer overflow: -2147483634 - 16 cannot be represented in type 'int'
Fixes: 28322/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5711888402612224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 74c4c53953 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
ec231f9662
avformat/aadec: Check for EOF while reading chapters
...
Fixes: timeout
Fixes: 28199/clusterfuzz-testcase-minimized-ffmpeg_dem_AA_fuzzer-4896162657861632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bcc7d14453 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
0fb1a9f6ec
avformat/voc_packet: Add a basic check on max_size
...
Fixes: signed integer overflow: -2147483648 - 4 cannot be represented in type 'int'
Fixes: 28127/clusterfuzz-testcase-minimized-ffmpeg_dem_VOC_fuzzer-4880586455646208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 52f75181bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
1506eb092b
avformat/microdvddec: use 64bit for durations
...
Fixes: signed integer overflow: 7 - -2147483647 cannot be represented in type 'int'
Fixes: 28036/clusterfuzz-testcase-minimized-ffmpeg_dem_MICRODVD_fuzzer-5171698751766528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f569ac4ce0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
a53c0d14ae
avcodec/hapdec: Change compressed_offset to unsigned 32bit
...
Fixes: out of array access
Fixes: 29345/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5401813482340352
Fixes: 30745/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5762798221131776
Suggested-by: Anton
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 89fe1935b1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
2273d721f5
avformat/rmdec: Check codec_length without overflow
...
Fixes: signed integer overflow: 2147483647 + 64 cannot be represented in type 'int'
Fixes: 30333/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-5175286983426048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d558c9f237 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
7b9e1a5fcf
avformat/mov: Check element count in mov_metadata_hmmt()
...
Fixes: Timeout
Fixes: 30325/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6048395703746560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1d277b92fa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
3b6a33b660
avcodec/fits: Check gcount and pcount being non negative
...
Fixes: signed integer overflow: 9223372036854775807 - -30069403896 cannot be represented in type 'long'
Fixes: 30046/clusterfuzz-testcase-minimized-ffmpeg_dem_FITS_fuzzer-5807144773484544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c000a91288 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
245b7cd4c9
avformat/nutdec: Check timebase count against main header length
...
Fixes: Timeout (long -> 3ms)
Fixes: 28514/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6078669009321984
Fixes: 30095/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-5074433016463360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c425198558 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
3d2dd0eaa7
avformat/electronicarts: Clear partial_packet on error
...
Fixes: Infinite loop
Fixes: 30165/clusterfuzz-testcase-minimized-ffmpeg_dem_EA_fuzzer-6224642371092480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 59bb9dc2a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
a32db8ce15
avformat/r3d: Check samples before computing duration
...
Fixes: signed integer overflow: -4611686024827895807 + -4611686016279904256 cannot be represented in type 'long'
Fixes: 30161/clusterfuzz-testcase-minimized-ffmpeg_dem_R3D_fuzzer-5694406713802752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7a2aa5dc2a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
b713f01bb3
avcodec/pnm_parser: Check av_image_get_buffer_size() for failure
...
Fixes: out of array access
Fixes: 30135/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PBM_fuzzer-4997145650397184
Fixes: 30208/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-5605891665690624.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5314a4996c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
d4dc6d2041
avformat/wavdec: Consider AV_INPUT_BUFFER_PADDING_SIZE in set_spdif()
...
The buffer is read by using the bit reader
Fixes: out of array read
Fixes: 27539/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-5650565572591616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a7c648e2d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
47047bf685
avformat/rmdec: Check remaining space in debug av_log() loop
...
Fixes: Timeout (long -> 2 ms)
Fixes: 26709/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5665833403285504
Fixes: 27522/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-6321071221112832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8fe78decd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
b4317e0a2b
avformat/flvdec: Treat high ts byte as unsigned
...
Fixes: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 27516/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5152854660349952
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f514113cfa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
fa4ee86008
avformat/samidec: Sanity check pts
...
Fixes: signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'long'
Fixes: 29743/clusterfuzz-testcase-minimized-ffmpeg_dem_SAMI_fuzzer-5499256859394048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2014b01352 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
b79830a53a
avcodec/jpeg2000dec: Check atom_size in jp2_find_codestream()
...
Fixes: Infinite loop
Fixes: 29722/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-6412228041506816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2a2082a41b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
1d6055972e
avformat/avidec: Use 64bit in get_duration()
...
Fixes: signed integer overflow: 2147483424 + 8224 cannot be represented in type 'int'
Fixes: 29619/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5191424373030912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a0ceb0cdd4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
3c20077e75
avformat/mov: Check for duplicate st3d
...
Fixes: memleak
Fixes: 29585/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6594188688490496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 658f0606cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
4d977e643d
avformat/mvdec: Check for EOF in read_index()
...
Fixes: Timeout
Fixes: 29550/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5094307193290752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6c64351bb1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
eb1dc002c6
avcodec/jpeglsdec: Fix k=16 in ls_get_code_regular()
...
Fixes: Timeout
Fixes: left shift of 33046 by 16 places cannot be represented in type 'int'
Fixes: 29258/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-4889231489105920
Fixes: 29515/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-6161940391002112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 980900d991 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
9ab85e03ca
avformat/id3v2: Check the return from avio_get_str()
...
Fixes: out of array access
Fixes: 29446/clusterfuzz-testcase-minimized-ffmpeg_dem_AAC_fuzzer-5096222622875648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 25f240fcb3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
fec6a5d940
avcodec/hevc_sei: Check payload size in decode_nal_sei_message()
...
Fixes: out of array access
Fixes: 29392/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4821602850177024.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0791a515d3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
afc9f2c236
libavutil/eval: Remove CONFIG_TRAPV special handling
...
Fixes: division by zero
Fixes: 29555/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVO_fuzzer-5149951447400448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8574fcbfc7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
f083f20fd2
avformat/wtvdec: Check len in parse_chunks() to avoid overflow
...
Fixes: signed integer overflow: 2147483647 + 7 cannot be represented in type 'int'
Fixes: 30084/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-6192261941559296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5552ceaf56 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
a4c627df67
avformat/asfdec_f: Add an additional check for the extradata size
...
Fixes: OOM
Fixes: 30066/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-6182309126602752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c8cd4490a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
99a5e67fe3
avformat/3dostr: Check sample_rate
...
Fixes: signed integer overflow: -1268324762623155200 * 8 cannot be represented in type 'long'
Fixes: 30123/clusterfuzz-testcase-minimized-ffmpeg_dem_THREEDOSTR_fuzzer-6710765123928064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7e5034f97e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
8bcf54cf72
avformat/4xm: Make audio_frame_count 64bit
...
Fixes: signed integer overflow: 2099257366 * 2 cannot be represented in type 'int'
Fixes: 27486/clusterfuzz-testcase-minimized-ffmpeg_dem_FOURXM_fuzzer-5112179134824448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 842c268c64 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
7186342a50
avformat/mov: Use av_mul_q() to avoid integer overflows
...
Fixes: signed integer overflow: 538976288 * 538976288 cannot be represented in type 'int'
Fixes: 27473/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5758978289827840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f70e1ec0c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
b8b7cf353e
avcodec/vp9dsp_template: Fix integer overflows in itxfm_wrapper
...
Fixes: signed integer overflow: 2147483641 + 32 cannot be represented in type 'int'
Fixes: 27452/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5078752576667648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4dfb7ff528 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
7d3c6b4f05
avformat/rmdec: Reorder operations to avoid overflow
...
Fixes: signed integer overflow: -2147483648 - 14 cannot be represented in type 'int'
Fixes: 27659/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-5697250168406016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b12e713b80 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
16f0553a56
avcodec/mxpegdec: fix SOF counting
...
Fixes: Timeout (>10sec -> 15ms)
Fixes: 27652/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-5125920868007936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 401495def6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
95ffb56c6c
avcodec/rscc: Check inflated_buf size whan it is used
...
Fixes: out of array access
Fixes: 27434/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RSCC_fuzzer-5196757675540480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit a5ed6da9bd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
26e5301458
avformat/mvdec: Sanity check SAMPLE_WIDTH
...
Fixes: signed integer overflow: 999999999 * 8 cannot be represented in type 'int'
Fixes: 30048/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5864289917337600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab82c10578 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
5267cf2084
avformat/rmdec: Fix codecdata_length overflow check
...
Fixes: signed integer overflow: 2147483647 + 64 cannot be represented in type 'int'
Fixes: 28509/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-6310969680723968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3c41d0bfd6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
2e26851dcd
avcodec/simple_idct: Fix undefined integer overflow in idct4row()
...
Fixes: signed integer overflow: -1498310196 - 902891776 cannot be represented in type 'int'
Fixes: 28445/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5075163389493248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 57f7e5caa3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
305ae7fc02
avformat/tta: Use 64bit intermediate for index
...
Fixes: signed integer overflow: 42032 * 51092 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_TTA_fuzzer-6679539648430080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fd61b42b4c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
9bb8a4f773
avformat/soxdec: Check channels to be positive
...
Fixes: signed integer overflow: 32 * -1795162112 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_SOX_fuzzer-6724151473340416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b0588b73da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
ef8ece49ac
avcodec/cscd: Check output len in zlib as in lzo
...
Fixes: Timeout (>10sec -> 134ms)
Fixes: 27245/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CSCD_fuzzer-575318210772992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6de039823c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
4a7cfa5a89
avcodec/vp3: Check input amount in theora_decode_header()
...
Fixes: Timeout
Fixes: 29226/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-6195092572471296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 869fe41d10 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
624afab90a
avformat/wavdec: Check avio_get_str16le() for failure
...
Fixes: out of array access
Fixes: 29195/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5037853281222656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d7594ee751 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
dcd5b364fb
avformat/flvdec: Check for EOF in amf_skip_tag()
...
Fixes: Timeout
Fixes: 29070/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5650106766458880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9725d07a17 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
67dff50ad8
avformat/aiffdec: Check size before subtraction in get_aiff_header()
...
Fixes: Infinite loop
Fixes: 27235/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-5761398380167168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8af299acde )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
4db70e2139
avformat/electronicarts: More chunk_size checks
...
Fixes: Timeout
Fixes: 26909/clusterfuzz-testcase-minimized-ffmpeg_dem_EA_fuzzer-6489496553783296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d03f0ec9a1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
20b13122ec
avcodec/cfhd: check peak.offset
...
Fixes: signed integer overflow: -2147483648 - 4 cannot be represented in type 'int'
Fixes: 26907/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-5746202330267648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 386faeda5f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
0dcc435972
avformat/tedcaptionsdec: Check for overflow in parse_int()
...
Fixes: signed integer overflow: 1111111111111111111 * 10 cannot be represented in type 'long'
Fixes: 26892/clusterfuzz-testcase-minimized-ffmpeg_dem_TEDCAPTIONS_fuzzer-5756045055754240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b0f8586ca9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
aff85abab4
avformat/nuv: Check channels
...
Fixes: signed integer overflow: -3468545475927866368 * 4 cannot be represented in type 'long'
Fixes: 28879/clusterfuzz-testcase-minimized-ffmpeg_dem_NUV_fuzzer-6303367307591680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fc45d924d7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
c79401d76e
avformat/mpc8: Check size before implicitly converting to int
...
Fixes: Timeout
Fixes: 28551/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6229183210586112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 78d6d8ddb5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
b9b7d76f8c
avformat/nutdec: Fix integer overflow in count computation
...
Note, the value is checked a few lines later already
Fixes: signed integer overflow: -440402016 - 1879048064 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6603876618469376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0014249fd9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
51cd408442
avformat/mvi: Use 64bit for testing dimensions
...
Fixes: signed integer overflow: 65535 * 65535 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_MVI_fuzzer-6649291124899840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 48fb752767 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
6202f716dc
avformat/utils: Check dts in update_initial_timestamps() more
...
Fixes: signed integer overflow: -9223372036853488158 - 90000000 cannot be represented in type 'long long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_MPSUB_fuzzer-6696625298866176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 29851cb840 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
2f0ae56460
avformat/flvdec: Check for avio_read() failure in amf_get_string()
...
Suggested-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cb31667611 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
6a3f5c9d76
avformat/flvdec: Check for nesting depth in amf_skip_tag()
...
Fixes: out of array access
Fixes: 29440/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5985279812960256.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ef522c918 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
a280136c7a
avformat/flvdec: Check for nesting depth in amf_parse_object()
...
Fixes: out of array access
Fixes: 29202/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5112845840809984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 074e204b42 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
0f5f93d498
avformat/asfdec_o: Check for EOF in asf_read_marker()
...
Fixes: Timeout
Fixes: 26460/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-5710884393189376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e3d09f435 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
b53629bef1
avformat/utils: Check dts - (1<<pts_wrap_bits) overflow
...
Fixes: signed integer overflow: -9223372036842389247 - 2147483648 cannot be represented in type 'long long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_FLV_fuzzer-4845007531671552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d82ee907d6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
268f25c774
avformat/bfi: Check chunk_header
...
Fixes: signed integer overflow: -2147483648 - 3 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_BFI_fuzzer-6665764123836416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 638a151a87 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
d72a06402c
avformat/ads: Check size
...
Fixes: signed integer overflow: -2147483616 - 64 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_ADS_fuzzer-6617769344892928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c78b2b138c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
a39c4ce6b1
avformat/iff: Check block align also for ID_MAUD
...
Fixes: Timeout & OOM
Fixes: 28701/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5185094964871168
Fixes: 29116/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4874284795297792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b17ffe8f8f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
567c02a19a
avcodec/utils: Check for integer overflow in get_audio_frame_duration() for ADPCM_DTK
...
Fixes: signed integer overflow: 131203586 * 28 cannot be represented in type 'int'
Fixes: 26817/clusterfuzz-testcase-minimized-ffmpeg_dem_MSF_fuzzer-6296902548848640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2488ba85a0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
8f5cce4b17
avformat/fitsdec: Better size checks
...
Fixes: out of array access
Fixes: 26819/clusterfuzz-testcase-minimized-ffmpeg_dem_FITS_fuzzer-5634559355650048
Fixes: 26820/clusterfuzz-testcase-minimized-ffmpeg_dem_FITS_fuzzer-5760774955597824
Fixes: 27379/clusterfuzz-testcase-minimized-ffmpeg_dem_FITS_fuzzer-5129775942991872.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 14bbb6bb30 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
b0edf37cb2
avformat/mxfdec: Fix integer overflow in next position in mxf_read_local_tags()
...
Fixes: signed integer overflow: 9223372036854775723 + 8192 cannot be represented in type 'long'
Fixes: 29072/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4812604904177664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d3d9b1fc8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
661d36175b
avformat/avidec: dv does not support palettes
...
Fixes: memleak
Fixes: 26937/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5763003338981376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b373b41d9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
387e0b3359
libavformat/utils: consider avio_size() failure in ffio_limit()
...
Fixes: Timeout (>20sec -> 3ms)
Fixes: 26918/clusterfuzz-testcase-minimized-ffmpeg_dem_THP_fuzzer-5750425191710720
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b1dac2716 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
32e5b0ab99
avformat/nistspheredec: Check bits_per_coded_sample and channels
...
Fixes: signed integer overflow: 80 * 92233009 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_NISTSPHERE_fuzzer-6669100654919680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 60770a50fb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
d31c6fdf35
avformat/asfdec_o: Check size vs. offset in detect_unknown_subobject()
...
Fixes: signed integer overflow: 2314885530818453566 + 7503032301549264928 cannot be represented in type 'long'
Fixes: 26639/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6024222100684800
Alternatively this could be ignored but then the end condition of the loop
would be hard to reach as avio_tell() is int64_t
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0bee216ad4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
b9570ed6f3
avformat/utils: check for integer overflow in av_get_frame_filename2()
...
Fixes: signed integer overflow: 317316873 * 10 cannot be represented in type 'int'
Fixes: 24708/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5731180885049344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 03c479ce23 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
a8d260b66a
avutil/timecode: Avoid undefined behavior with large framenum
...
Fixes: signed integer overflow: 2147462079 + 2149596 cannot be represented in type 'int'
Fixes: 27565/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5091972813160448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b19057396 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
0c45348bef
avformat/mov: Check a.size before computing next_root_atom
...
Fixes: signed integer overflow: 64 + 9223372036854775799 cannot be represented in type 'long'
Fixes: 27563/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6244650163372032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c9a5a0fe9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
3df814c735
avformat/sbgdec: Reduce the amount of floating point in str_to_time()
...
Fixes: 1e+75 is outside the range of representable values of type 'long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6626834808700928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ac6c8993f7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
d7566366ff
avformat/mxfdec: Free all types for both Descriptors
...
Fixes: memleak
Fixes: 26352/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5201158714687488
Suggested-by: Tomas Härdin <tjoppen@acc.umu.se >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 88519be8db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
4520a4efa4
uavformat/rsd: check for EOF in extradata
...
Fixes: OOM
Fixes: 26503/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-6530816735444992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7186ec88b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
35729e0fdb
avcodec/wmaprodec: Check packet size
...
Fixes: left shift of negative value -25824
Fixes: 27754/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA2_fuzzer-5760255962906624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 69aeba8a19 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
62dd7e3dc0
avcodec/rasc: Check frame before clearing
...
Fixes: null pointer dereference
Fixes: 27737/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RASC_fuzzer-5769028685266944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 380a3a0adf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
f8940d5104
avcodec/alsdec: Fix integer overflow with quant_cof
...
Fixes: signed integer overflow: -210824 * 16384 cannot be represented in type 'int'
Fixes: 28670/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5682310846480384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ce40dde03 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
94fbe523ee
avformat/mpegts: Fix argument type for av_log
...
Reviewed-by: Marton Balint <cus@passwd.hu >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 654b21ef17 )
2021-09-09 13:53:29 +02:00
Michael Niedermayer
1e015c01a2
avformat/cafdec: clip sample rate
...
Fixes: 1.21126e+111 is outside the range of representable values of type 'int'
Fixes: 27398/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5412960339755008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 684aec6a68 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
ed4e706190
avcodec/ffv1dec: Fix off by 1 error with quant tables
...
Fixes: assertion failure
Fixes: 28447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-5369575948550144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5cae71d2b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
5d4d2910a5
avformat/mpegts: Increase pcr_incr width to 64bit
...
Fixes: division by zero
Fixes: 26459/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5666350112178176
Fixes: 28154/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5195728439476224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ef7b117b7b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
85cdb58efb
avcodec/utils: Check bitrate for overflow in get_bit_rate()
...
Fixes: signed integer overflow: 617890810133996544 * 16 cannot be represented in type 'long'
Fixes: 26565/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5092054700654592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8aadae670f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
7c36b94966
avformat/mov: Check if hoov is at the end
...
Fixes: Timeout, probably infinite loop
Fixes: 26559/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5391165484171264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0afbaabdca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
cb1f3b5fc6
avcodec/hevc_ps: check scaling_list_dc_coef
...
Fixes: signed integer overflow: 2147483640 + 8 cannot be represented in type 'int'
Fixes: 28449/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5686013259284480
Reviewed-by: James Almer <jamrial@gmail.com >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f1700bd8bb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
6c57a7ce4d
avformat/iff: Check data_size
...
Fixes: infinite loop
Fixes: 27834/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5694930919620608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 001bc594d8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
b12ef6f7ac
avformat/matroskadec: Sanity check codec_id/track type
...
Fixes: memleak
Fixes: 27766/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-5198300814508032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b88dd8f0c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
9ca2abb90c
avformat/rpl: Check the number of streams
...
Fixes: out of memory access
Fixes: 27787/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-4743666463408128.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0677bdb1f5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
57c8136d6c
avcodec/h264idct_template: Fix integer overflow in ff_h264_chroma422_dc_dequant_idct()
...
Fixes: signed integer overflow: -2105540608 - 2105540608 cannot be represented in type 'int'
Fixes: 26870/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5656647567147008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 51dfd6f1bd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
471c8ae5b6
avformat/dsfdec: Check block_align more completely
...
Fixes: infinite loop
Fixes: 26865/clusterfuzz-testcase-minimized-ffmpeg_dem_DSF_fuzzer-5649473830912000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65b8974d54 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
6eba6551b8
avformat/mpc8: Check remaining space in mpc8_parse_seektable()
...
Fixes: Fixes infinite loop
Fixes: 26704/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6327056939614208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f66dd13d0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
1e4a9d64d1
avformat/id3v2: Sanity check tlen before alloc and uncompress
...
Fixes: Timeout (>20sec -> 65ms)
Fixes: 26896/clusterfuzz-testcase-minimized-ffmpeg_dem_DAUD_fuzzer-5691024049176576
Fixes: 27627/clusterfuzz-testcase-minimized-ffmpeg_dem_AEA_fuzzer-4907019324358656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d7f87a4b9e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
a290ea5127
avformat/vqf: Check len for COMM chunks
...
Fixes: Infinite loop
Fixes: 26696/clusterfuzz-testcase-minimized-ffmpeg_dem_VQF_fuzzer-5648269168082944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a834af133b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
bb81e6eb55
avcodec/hevc_cabac: Limit value in coeff_abs_level_remaining_decode() tighter
...
The max depth is 16bps, the max allowed coefficient depth is depth+6
Fixes: signed integer overflow: 1074266112 + 1073725439 cannot be represented in type 'int'
Fixes: 26493/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5657763331702784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7cf852b03c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
44e692bb0a
avformat/cafdec: Check the return code from av_add_index_entry()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9dc3301745 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
aeef24785a
avformat/cafdec: Check for EOF in index read loop
...
Fixes: OOM
Fixes: 27398/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-541296033975500
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eb46939e3a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
6723d6db9b
avformat/cafdec: Check that bytes_per_packet and frames_per_packet are non negative
...
These fields are not signed in the spec (1.0) so they cannot be negative
Changing bytes_per_packet to unsigned would not solve this as it is exported
as block_align which is signed
Fixes: Infinite loop
Fixes: 26492/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5632087614554112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5eed718087 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
6379a6f343
avformat/mpc8: correct integer overflow in mpc8_parse_seektable()
...
Fixes: signed integer overflow: -4683718486770919638 * 2 cannot be represented in type 'long'
Fixes: 26704/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6327056939614208
Fixes: 27550/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6259212652642304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0897402ac8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
2cb42f5cc0
avformat/mpc8: correct 32bit timestamp truncation
...
Fixes: left shift of 65536 by 15 places cannot be represented in type 'int'
Fixes: 26801/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-5164313092030464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ad3e495657 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
40f056abed
avcodec/exr: Check ymin vs. h
...
Fixes: out of array access
Fixes: 26532/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5613925708857344
Fixes: 27443/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5631239813595136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3e5959b345 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
f149875325
avformat/avs: Use 64bit for the avio_tell() output
...
Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented in type 'long'
Fixes: 26549/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS_fuzzer-4844306424397824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1278f117d7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
56789d3ea3
avformat/wavdec: More complete size check in find_guid()
...
Fixes: signed integer overflow: 9223372036854775807 + 8 cannot be represented in type 'long'
Fixes: 27341/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5442833206738944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a207df2acb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
71411669cd
avformat/iff: Check size before skip
...
Fixes: Infinite loop
Fixes: 27292/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5731168991051776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b50e8bc29 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
680f50938f
avformat/rmdec: Check for EOF in index packet reading
...
Fixes: Timeout(>10sec -> 1ms)
Fixes: 27284/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6304211110985728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ebf4bc629e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
0dc7491879
avformat/icodec: Check for zero streams and stream creation failure
...
Fixes: NULL pointer dereference
Fixes: 26814/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-5758487797432320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b33233bd53 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
2781ce1ea9
avformat/icodec: Factor failure code out in read_header()
...
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 27ee67c00f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
158f357b10
avformat/bintext: Check width
...
Fixes: division by 0
Fixes: 26780/clusterfuzz-testcase-minimized-ffmpeg_dem_ADF_fuzzer-5117945027756032
Fixes: 26998/clusterfuzz-testcase-minimized-ffmpeg_dem_ADF_fuzzer-5119352359354368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f6dc285fb5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
82728dee12
avformat/sbgdec: Check that end is not before start
...
Fixes: signed integer overflow: -9223372036854775808 + -5279949906739200 cannot be represented in type 'long'
Fixes: 26908/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6329610851319808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9ef60a66f1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
a675945380
avformat/lvfdec: Check stream_index before use
...
Fixes: assertion failure
Fixes: 26905/clusterfuzz-testcase-minimized-ffmpeg_dem_LVF_fuzzer-5724267599364096.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b1d99ab14f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
5d0d405d6c
avformat/au: cleanup on EOF return in au_read_annotation()
...
Fixes: memleak
Fixes: 26841/clusterfuzz-testcase-minimized-ffmpeg_dem_AU_fuzzer-5174166309044224
Regression since: e680d50eb4
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d16974c3dd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
f9cde79ca7
avformat/mpegts: Limit copied data to space
...
Fixes: out of array access
Fixes: 26816/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-6282861159907328.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 79cf7c7191 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
c2221da019
avformat/bintext: Check width in idf_read_header()
...
Fixes: division by 0
Fixes: 26802/clusterfuzz-testcase-minimized-ffmpeg_dem_IDF_fuzzer-5180591554953216.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 442d53f409 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
9d2df3050e
avformat/iff: check size against INT64_MAX
...
Bigger sizes are misinterpreted as negative numbers by the API
Fixes: infinite loop
Fixes: 26611/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4890614975692800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f291cd681b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
72a8fb594d
avformat/paf: Check for EOF in read_table()
...
Fixes: OOM
Fixes: 26528/clusterfuzz-testcase-minimized-ffmpeg_dem_PAF_fuzzer-5081929248145408
Fixes: 26584/clusterfuzz-testcase-minimized-ffmpeg_dem_PAF_fuzzer-5172661183053824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 437b7302b0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
da5220bc06
avformat/gxf: Check pkt_len
...
Fixes: Infinite loop
Fixes: 26576/clusterfuzz-testcase-minimized-ffmpeg_dem_GXF_fuzzer-4823080360476672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dad9a86ca7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
5a76224c88
avformat/aiffdec: Check packet size
...
Fixes: Fixes infinite loop
Fixes: 26575/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-5727522236661760
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ba71a72d3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
4ed6695658
avformat/concatdec: use av_strstart()
...
Fixes: out array read
Fixes: 26610/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-5631838049271808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2610acb49a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
26db6eccce
avformat/wavdec: Refuse to read chunks bigger than the filesize in w64_read_header()
...
Fixes: OOM
Fixes: 26414/clusterfuzz-testcase-minimized-ffmpeg_dem_FWSE_fuzzer-5070632544632832
Fixes: 26475/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5770207722995712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b2244565a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
c07f2cfaec
avformat/rsd: Check size and start before computing duration
...
Fixes: signed integer overflow: 100794754 * 28 cannot be represented in type 'int'
Fixes: 26474/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-5181797606096896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c79d8a6851 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
36ff07fd02
avformat/iff: More completely check body_size
...
Fixes: infinite loop
Fixes: 26485/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5126561373880320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3588e2e6b0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
bb88c223d6
avformat/xwma: Check for EOF in dpds_table read code
...
Fixes: Timeout (>30 -> 140ms)
Fixes: 26478/clusterfuzz-testcase-minimized-ffmpeg_dem_XWMA_fuzzer-5918147066200064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 44b18a76b8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
c07661c8cd
avcodec/utils: Check sample rate before use for AV_CODEC_ID_BINKAUDIO_DCT in get_audio_frame_duration()
...
Fixes: shift exponent 95 is too large for 32-bit type 'int'
Fixes: 26590/clusterfuzz-testcase-minimized-ffmpeg_dem_SMACKER_fuzzer-5120609937522688
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec7e0d4288 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
8d46937051
avcodec/dirac_parser: do not offset AV_NOPTS_OFFSET
...
Fixes: signed integer overflow: -9223372036854775807 - 48000 cannot be represented in type 'long long'
Fixes: 26521/clusterfuzz-testcase-minimized-ffmpeg_dem_DIRAC_fuzzer-5635536506847232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 343c3149ab )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
7487e6b6a7
avformat/rmdec: Make expected_len 64bit
...
Fixes: signed integer overflow: 1347551268 * 14 cannot be represented in type 'int'
Fixes: 26458/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-5655364324032512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 728330462c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
d608ea0027
avformat/pcm: Check block_align
...
Fixes: signed integer overflow: 321 * 8746632 cannot be represented in type 'int'
Fixes: 26461/clusterfuzz-testcase-minimized-ffmpeg_dem_PVF_fuzzer-6326427831762944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b23a619c13 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
c7a3dacf53
avformat/lrcdec: Clip timestamps
...
Fixes: signed integer overflow: 7111111111111531010 - -7335632962598013506 cannot be represented in type 'long'
Fixes: 26463/clusterfuzz-testcase-minimized-ffmpeg_dem_LRC_fuzzer-6015558333759488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 80bc2ac3c0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
ce445adcbd
avformat/electronicarts: Check for EOF in each iteration of the loop in ea_read_packet()
...
Fixes: timeout(>20sec -> 1ms)
Fixes: 26526/clusterfuzz-testcase-minimized-ffmpeg_dem_EA_fuzzer-5672328069120000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 857aba7c45 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
57396f97ca
avcodec/vp9dsp_template: Fix some overflows in iadst8_1d()
...
Fixes: signed integer overflow: 190587 * 11585 cannot be represented in type 'int'
Fixes: 26407/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5086348408782848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bca0735be5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
3ce851aab3
avcodec/fits: Check bscale
...
Fixes: division by 0
Fixes: 26208/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-6270472117026816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c2ccd76fd0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
f608e78016
avformat/nistspheredec: Check bps
...
Fixes: left shift of 1111111190 by 3 places cannot be represented in type 'int'
Fixes: 26437/clusterfuzz-testcase-minimized-ffmpeg_dem_NISTSPHERE_fuzzer-4886896091856896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7c144b363e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
b7b6f4c557
avformat/jacosubdec: Use 64bit inside get_shift()
...
Fixes: signed integer overflow: 111111111 * 30 cannot be represented in type 'int'
Fixes: 26448/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-5638440374501376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 715ff75e5d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
a090f4cf0c
avformat/genh: Check block_align
...
Fixes: infinite loop
Fixes: 26440/clusterfuzz-testcase-minimized-ffmpeg_dem_GENH_fuzzer-5632134020333568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 37396e9ba8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
afb0664623
avformat/mvi: Check count for overflow
...
Fixes: left shift of 21378748 by 10 places cannot be represented in type 'int'
Fixes: 26449/clusterfuzz-testcase-minimized-ffmpeg_dem_MVI_fuzzer-5680463374712832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a413ed9863 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
be62e51943
avcodec/magicyuv: Check slice size before reading flags and pred
...
Fixes: heap-buffer-overflow
Fixes: 26487/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_fuzzer-5742553675333632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0dc42147b6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
c7fd8744b5
avformat/asfdec_f: Check for negative ext_len
...
Fixes: Infinite loop
Fixes: 26376/clusterfuzz-testcase-minimized-ffmpeg_dem_PCM_U32LE_fuzzer-6050518830678016
Fixes: 26377/clusterfuzz-testcase-minimized-ffmpeg_dem_TY_fuzzer-4838195726123008
Fixes: 26384/clusterfuzz-testcase-minimized-ffmpeg_dem_G729_fuzzer-5173450337157120
Fixes: 26396/clusterfuzz-testcase-minimized-ffmpeg_dem_PCM_S24BE_fuzzer-5071092206796800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 209b9ff5c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
6cc18dca55
avformat/bethsoftvid: Check image dimensions before use
...
Fixes: signed integer overflow: 55255 * 53207 cannot be represented in type 'int'
Fixes: 26387/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS2_fuzzer-5684222226071552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 50b29f081e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
cb961b2322
avformat/genh: Check block_align for how it will be used in SDX2_DPCM
...
Fixes: signed integer overflow: 19922944 * 1024 cannot be represented in type 'int'
Fixes: 26402/clusterfuzz-testcase-minimized-ffmpeg_dem_VMD_fuzzer-5745470053548032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c95b47e18f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
5be63051e7
avformat/au: Check for EOF in au_read_annotation()
...
Fixes: Timeout (too looong -> 1 ms)
Fixes: 26366/clusterfuzz-testcase-minimized-ffmpeg_dem_SDX_fuzzer-5655584843759616
Fixes: 26391/clusterfuzz-testcase-minimized-ffmpeg_dem_ALP_fuzzer-5484026133217280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e680d50eb4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
5aaf7f4646
avformat/segafilm: Do not assume AV_CODEC_ID_NONE is 0
...
Suggested-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d34e4904cd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
5fc65636a7
avformat/segafilm: Check that there is a stream
...
Fixes: assertion failure
Fixes: 26472/clusterfuzz-testcase-minimized-ffmpeg_dem_SEGAFILM_fuzzer-5759751591559168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c0d7fd269b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
0ee0f51886
avformat/wtvdec: Check dir_length
...
Fixes: Infinite loop
Fixes: 26445/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5125558331244544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1868cb7316 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:53:29 +02:00
Michael Niedermayer
d2cefe21e1
avcodec/decode/ff_get_buffer: Check for overflow in FFALIGN()
...
Fixes: signed integer overflow: 2147483647 + 64 cannot be represented in type 'int'
Fixes: 26218/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CRI_fuzzer-5734075396259840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 939b72b02e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:21 +02:00
Michael Niedermayer
c8c0ed9e2b
avcodec/exr: Check limits to avoid overflow in delta computation
...
Fixes: signed integer overflow: 553590816 - -2145378049 cannot be represented in type 'int'
Fixes: 26315/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5938755121446912
Fixes: 26340/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5644316208529408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6910e0f4e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:21 +02:00
Michael Niedermayer
253b1ed27e
avformat/boadec: Check that channels and block_align are set
...
Fixes: Infinite loop
Fixes: 26381/clusterfuzz-testcase-minimized-ffmpeg_dem_BOA_fuzzer-5745789089087488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 44ff5a1bff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:21 +02:00
Michael Niedermayer
31517647e5
avformat/asfdec_f: Check name_len for overflow
...
Fixes: signed integer overflow: -1172299744 * 2 cannot be represented in type 'int'
Fixes: 26258/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5672758488596480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0d088a47ca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:21 +02:00
Michael Niedermayer
366e5e489d
avcodec/h264idct_template: Fix integer overflow in ff_h264_chroma422_dc_dequant_idct()
...
Fixes: signed integer overflow: 241173056 + 1953511200 cannot be represented in type 'int'
Fixes: 26086/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5068366420901888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d198362839 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:21 +02:00
Michael Niedermayer
92b8c0a8c1
avcodec/aacdec_fixed: Limit index in vector_pow43()
...
Fixes: out of array access
Fixes: 26087/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5724825462767616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f83a53638 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:21 +02:00
Michael Niedermayer
75ce842d7c
avformat/rmdec: sanity check coded_framesize
...
Fixes: signed integer overflow: -14671840 * 8224 cannot be represented in type 'int'
Fixes: 24793/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5101884323659776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aee8477c6b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:21 +02:00
Michael Niedermayer
13de14d44d
avformat/flvdec: Check for EOF in amf_parse_object()
...
Fixes: Timeout (too long -> 1ms)
Fixes: 26108/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5653887668977664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 33624f4f2e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:21 +02:00
Michael Niedermayer
29dade5fea
avcodec/smacker: Check remaining bits in SMK_BLK_FULL
...
Fixes: out of array access
Fixes: 26047/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKER_fuzzer-5083031667474432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 42ded4d1e6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:21 +02:00
Michael Niedermayer
1f8aa084ea
avcodec/cook: Check subpacket index against max
...
Fixes: off by 1 error
Fixes: index 5 out of bounds for type 'COOKSubpacket [5]'
Fixes: 25772/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5762459498184704.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5a2a7604da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:21 +02:00
Michael Niedermayer
6778e41252
avcodec/utils: Check for overflow with ATRAC* in get_audio_frame_duration()
...
Fixes: signed integer overflow: 1024 * 13129048 cannot be represented in type 'int'
Fixes: 26378/clusterfuzz-testcase-minimized-ffmpeg_dem_CODEC2RAW_fuzzer-5634018353348608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 01bb12f883 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:21 +02:00
Michael Niedermayer
85cf812442
avcodec/hevcpred_template: Fix diagonal chroma availability in 4:2:2 edge case in intra_pred
...
Fixes: pixel decode issue.ts
Fixes: raw frame.hevc
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3fbf873792 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:21 +02:00
Michael Niedermayer
d7fd7eb297
avformat/icodec: Change order of operations to avoid NULL dereference
...
Fixes: SEGV on unknown address 0x000000000000
Fixes: 26379/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-5709011753893888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3300f5c133 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:21 +02:00
Michael Niedermayer
8bcad00e41
avcodec/exr: Fix overflow with many blocks
...
Fixes: signed integer overflow: 1073741827 * 8 cannot be represented in type 'int'
Fixes: 25621/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6304841641754624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7265b7d904 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:21 +02:00
Michael Niedermayer
f2025f4ed7
avcodec/vp9dsp_template: Fix integer overflows in idct16_1d()
...
Fixes: signed integer overflow: -190760 * 11585 cannot be represented in type 'int'
Fixes: 25471/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5743354917421056
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 394e8bb385 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:21 +02:00
Michael Niedermayer
c58f0345b8
avcodec/ansi: Check initial dimensions
...
Fixes: Timeout (minutes to less than 1sec)
Fixes: 25682/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ANSI_fuzzer-6320712032452608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 949f0a6be9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:21 +02:00
Michael Niedermayer
4b6bcdd997
avcodec/hevcdec: Check slice_cb_qp_offset / slice_cr_qp_offset
...
Fixes: signed integer overflow: 29 + 2147483640 cannot be represented in type 'int'
Fixes: 25413/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5697909331591168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 106f11f68a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:21 +02:00
Michael Niedermayer
d859b40bf2
avcodec/sonic: Check for overread
...
Fixes: Timeout (too long -> 1.3 sec)
Fixes: 24358/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5107284099989504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eeabdef1bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:21 +02:00
Michael Niedermayer
db94bff826
avformat/subviewerdec: fail on AV_NOPTS_VALUE
...
Such values are not supported by ff_subtitles_queue*
Fixes: signed integer overflow: 10 - -9223372036854775808 cannot be represented in type 'long'
Fixes: 24193/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5714901855895552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b7f51428b1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:21 +02:00
Michael Niedermayer
13a10e107a
avcodec/exr: Check line size for overflow
...
Fixes: signed integer overflow: 570425356 * 6 cannot be represented in type 'int
Fixes: 25929/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5099197739827200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9b72cea446 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:21 +02:00
Michael Niedermayer
8a4aab7f0f
avcodec/exr: Check xdelta, ydelta
...
Fixes: assertion failure
Fixes: 25617/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5648746061496320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6949df35d0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:21 +02:00
Michael Niedermayer
c275fefad9
avcodec/celp_filters: Avoid invalid negation in ff_celp_lp_synthesis_filter()
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 25675/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G729_fuzzer-4786580731199488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 11a6347f9e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:21 +02:00
Michael Niedermayer
dc12287307
avcodec/takdsp: Fix negative shift in decorrelate_sf()
...
Fixes: left shift of negative value -4
Fixes: 25723/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-6250580752990208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f54f53003 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
d8359218a2
avcodec/dxtory: Fix negative stride shift in dx2_decode_slice_420()
...
Fixes: left shift of negative value -640
Fixes: 26044/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXTORY_fuzzer-5631057602543616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3291d994b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
6bbc565af8
avformat/asfdec_f: Change order or operations slightly
...
Fixes: signed integer overflow: 20 * 5184056935931942919 cannot be represented in type 'long'
Fixes: 25466/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4798660247552000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 686f015190 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
5a86c28a73
avformat/dxa: Use av_rescale() for duration computation
...
Fixes: signed integer overflow: 8224000000 * 1629552639 cannot be represented in type 'long'
Fixes: 24908/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4658478506049536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c313089fbe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
cb6cdd3f84
avcodec/vc1_block: Fix integer overflow in ac value
...
Fixes: signed integer overflow: 25488 * 87381 cannot be represented in type 'int'
Fixes: 24765/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5108259565076480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3056e19e68 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
c242e3efe0
avformat/iff: Check data_size not overflowing int64
...
Fixes: Infinite loop
Fixes: 25844/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5660803318153216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 24352ca792 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
8b84fcb78f
avcodec/dxtory: Fix negative shift in dx2_decode_slice_410()
...
Fixes: left shift of negative value -768
Fixes: 25574/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXTORY_fuzzer-6012596027916288
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit abebd87764 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
91f7983a89
avcodec/sonic: Check channels before deallocating
...
Fixes: heap-buffer-overflow
Fixes: 25744/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5172961169113088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f249981976 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
b81d1379c2
avformat/wvdec: Check rate for overflow
...
Fixes: signed integer overflow: 6000 * -2147483648 cannot be represented in type 'int'
Fixes: 25700/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6578316302352384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 688c1175ba )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
f4d75810b4
avcodec/ansi: Check nb_args for overflow
...
Fixes: Integer overflow (no testcase)
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc0e776c9a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
124a433d15
avformat/wc3movie: Move wc3_read_close() up
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c635f2ce6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
6afbda6ce8
avcodec/diracdsp: Fix integer anomaly in dequant_subband_*
...
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: 23760/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-604209011412172
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ca3c6c981a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
d3bbc76f8e
avutil/fixed_dsp: Fix integer overflows in butterflies_fixed_c()
...
Fixes: signed integer overflow: 0 - -2147483648 cannot be represented in type 'int'
Fixes: 23646/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5480991098667008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a02ae49c2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
2fee883f52
avcodec/wmalosslessdec: Check remaining space before padding and channel residue
...
Fixes: Timeout (1101sec -> 0.4sec)
Fixes: 24491/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5725337036783616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c467adf3bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
b9c0480f17
avformat/cdg: Fix integer overflow in duration computation
...
Fixes: signed integer overflow: 8398407 * 300 cannot be represented in type 'int'
Fixes: 23914/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4702539290509312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa8935b395 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
d5e57e7496
avcodec/mpc: Fix multiple numerical overflows in ff_mpc_dequantize_and_synth()
...
Fixes: -2.4187e+09 is outside the range of representable values of type 'int'
Fixes: signed integer overflow: -14512205 + -2147483648 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC7_fuzzer-5747263166480384
Fixes: 23528/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC7_fuzzer-5747263166480384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b9f39689a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
ca56067055
avformat/electronicarts: Check if there are any streams
...
Fixes: Assertion failure (invalid stream index)
Fixes: 25120/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6565251898933248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 39a98623ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
df67250903
avcodec/ffwavesynth: Fix integer overflow in wavesynth_synth_sample / WS_SINE
...
Fixes: signed integer overflow: -1429092 * -32596 cannot be represented in type 'int'
Fixes: 24419/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5157849974702080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a0da95df77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
de79966a44
avcodec/vp9dsp_template: Fix integer overflow in iadst8_1d()
...
Fixes: signed integer overflow: 998938090 + 1169275991 cannot be represented in type 'int'
Fixes: 23411/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-4644692330545152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d182d8f10c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
ca689b0002
avformat/avidec: Fix io_fsize overflow
...
Fixes: signed integer overflow: 7958120835074169528 * 9 cannot be represented in type 'long long'
Fixes: 23382/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6230683226996736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf0c700b0c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
9474d161c2
avcodec/cfhd: Check transform type
...
Fixes: out of array access
Fixes: 24823/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-4855119863349248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 659658d08b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
a4f01dfad9
avcodec/tiff: Restrict tag order based on specification
...
"The entries in an IFD must be sorted in ascending order by Tag. Note that this is
not the order in which the fields are described in this document."
This way various dimensions, sample and bit sizes cannot be changed at
arbitrary times which reduces the potential for bugs.
The tag reading code also on various places assumes that numerically previous
tags have already been parsed, so this needs to be enforced one way or another.
If this commit causes problems with real world files which are not easy to fix
then some other form of checks are needed to ensure the various dependencies
in the tag reading are not violated.
Fixes: out of array access
Fixes: 24825/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-6326925027704832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ad29f9e47c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
2e9d90680d
avformat/siff: Reject audio packets without audio stream
...
Fixes: Assertion failure
Fixes: 24612/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6600899842277376.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8931c55789 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
f13fb1cfb8
avformat/mpeg: Check avio_read() return value in get_pts()
...
Found-by: Thierry Foucu <tfoucu@gmail.com >
Fixes: Use-of-uninitialized-value
Reviewed-by: Thierry Foucu <tfoucu@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e8a88a16f7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
b0fd8d6b15
avcodec/tiff: Check bpp/bppcount for 0
...
Fixes: division by zero
Fixes: 24253/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-6250318007107584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be090da25f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
2dc9462462
avcodec/snowdec: Sanity check hcoeff
...
Fixes: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
Fixes: 24011/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5486376610168832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d51d569cf6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
301801bfd2
avformat/mov: Check comp_brand_size
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 24457/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5760093644390400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ffa6072fc7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
8636ff4bdf
avcodec/alac: Check decorr_shift to avoid invalid shift
...
Later the decorrelate_stereo call is guarded by channels == 2
and non-zero decorr_left_weight. Make sure decorr_shift is in
the expected shift range for that case.
Fixes: shift exponent 128 is too large for 32-bit type 'int'
Fixes: 23860/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5751138914402304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Alexander Strasser <eclipse7@gmx.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4333718b35 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
bd5e97fd6b
avcodec/tdsc: Fix tile checks
...
Fixes: out of array access
Fixes: crash.asf
Found-by: anton listov <greyfarn7@yandex.ru >
Reviewed-by: anton listov <greyfarn7@yandex.ru >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 081e3001ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Andreas Rheinhardt
4646f94b9c
avformat/mm: Check for existence of audio stream
...
No audio stream is created unconditionally and if none has been created,
no packet with stream_index 1 may be returned. This fixes an assert in
ff_read_packet() in libavformat/utils reported in ticket #8782 .
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit ec59dc73f0 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
14a4be8fb4
avcodec/cbs_jpeg: Fix uninitialized end index in cbs_jpeg_split_fragment()
...
Fixes: Out of array read
Fixes: 24043/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5084566275751936.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a10bc8f6f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Zhao Zhili
02fd603a18
avformat/mov: Fix unaligned read of uint32_t and endian-dependance in mov_read_default
...
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 806a4d5187 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
41049b0d76
avcodec/apedec: Fix undefined integer overflow with 24bit
...
Fixes: signed integer overflow: 8683744 * 256 cannot be represented in type 'int'
Fixes: 23527/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5679885932822528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9f7b252cdf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
bf0b15d76a
avcodec/loco: Fix integer overflow with large values from loco_get_rice()
...
Fixes: signed integer overflow: 155 + 2147483647 cannot be represented in type 'int'
Fixes: 23421/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5652849097965568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ddc5e1f3c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
32815740f7
avformat/smjpegdec: Check the existence of referred streams
...
Fixes: Assertion failure
Fixes: 23758/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5160954605338624.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 321ea59dac )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
Michael Niedermayer
34f9c735ad
avcodec/pnmdec: Fix misaligned reads
...
Found-by: "Steinar H. Gunderson" <steinar+ffmpeg@gunderson.no >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea28ce9bc1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-09 13:37:20 +02:00
James Almer
347bcf6054
avcodec/h264_slice: clear old slice POC values on parsing failure
...
If a slice header fails to parse, and the next one uses different Sequence and
Picture parameter sets, certain values may not be read if they are not coded,
resulting in the previous slice values being used.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit ce4a31cd1f )
2021-08-11 12:01:14 -03:00
Timo Rothenpieler
d44da66fac
avcodec/cuviddec: backport extradata fixes
2020-10-01 22:09:25 +02:00
Timo Rothenpieler
7f0db52c53
avcodec/cuviddec: handle arbitrarily sized extradata
2020-09-30 14:14:30 +02:00
Błażej Szczygieł
3dd24b0f70
lavf/tls_gnutls: check for interrupt inside handshake loop
...
fixes #8080
Signed-off-by: Błażej Szczygieł <spaz16@wp.pl >
(cherry picked from commit 561ba15c97 )
2020-09-04 22:06:02 +03:00
Remita Amine
082dfc8bd5
lavf/tls_gnutls: retry gnutls_handshake on non fatal errors
...
fixes #7801
Signed-off-by: Remita Amine <remitamine@gmail.com >
(cherry picked from commit bc1749c6e4 )
2020-09-04 22:06:01 +03:00
Jan Ekström
dce15293da
avformat/tls_schannel: immediately return decrypted data if available
...
Until now, we would have only attempted to utilize already decrypted
data if it was enough to fill the size of buffer requested, that could
very well be up to 32 kilobytes.
With keep-alive connections this would just lead to recv blocking
until rw_timeout had been reached, as the connection would not be
officially closed after each transfer. This would also lead to a
loop, as such timed out I/O request would just be attempted again.
By just returning the available decrypted data, keep-alive based
connectivity such as HLS playback is fixed with schannel.
(cherry picked from commit 6f8826e4aa )
2020-09-04 19:26:16 +03:00
Jan Ekström
0adddc08c6
avformat/tls_schannel: always decrypt all received data
...
The dec_buf seems to be properly managed between read calls,
and we have no logic to decrypt before attempting socket I/O.
Thus - until now - such data would not be decrypted in case of
connections such as HTTP keep-alive, as the recv call would
always get executed first, block until rw_timeout, and then get
retried by retry_transfer_wrapper.
Thus - if data is received - decrypt all of it right away. This way
it is available for the following requests in case they can be
satisfied with it.
(cherry picked from commit 39977fff20 )
2020-09-04 19:26:16 +03:00
Michael Niedermayer
918a41d40e
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 00:31:07 +02:00
Andreas Rheinhardt
3df2eab778
avcodec/hevc_mp4toannexb_bsf: Check NAL size against available input
...
The hevc_mp4toannexb bsf does not explicitly check whether a NAL unit
is so big that it extends beyond the end of the input packet; it does so
only implicitly by using the checked version of the bytestream2 API.
But this has downsides compared to real checks: It can lead to huge
allocations (up to 2GiB) even when the input packet is just a few bytes.
And furthermore it leads to uninitialized data being output.
So add a check to error out early if it happens.
Also check directly whether there is enough data for the length field.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit ea1b71e82f )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 17:11:15 +02:00
Michael Niedermayer
fd43c6dc0e
Update for 4.1.6
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 17:03:14 +02:00
Michael Niedermayer
850bbc0f78
avcodec/dstdec: Replace AC overread check by sample rate check
...
Real files do skip coding 0 bits at the end, thus this kind of check
does not work reliable.
Fixes: Ticket 8770
Fixes: dst-256fs44-6ch-refdstencoder.dff
The samplerate is specified in ISO/IEC 14496-3:2005(E) as one of 3 fixed
values, this also can be used to limit the duration and avoid the timeout
This reverts commit f6df99dba1 .
(cherry picked from commit 1679f23beb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
7b3b3119d5
avformat/utils: reorder duration computation to avoid overflow
...
Fixes: signed integer overflow: 8 * 9223372036854774783 cannot be represented in type 'long'
Fixes: 23381/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4818340509122560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 10cc82c35b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
c095e870d8
avcodec/pngdec: Check for fctl after idat
...
Fixes: out of array access
Fixes: 23554/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-4796622520451072.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65b1ba680f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
7dc5dfad31
avformat/hls: Pass a copy of the URL for probing
...
The segments / url can be modified by the io read when reloading
This may be an alternative or additional fix for Ticket8673
as a further alternative the reload stuff could be disabled during
probing
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5e39880fb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Steven Liu
c229e5e80f
avformat/hls: check segment duration value of EXTINF
...
fix ticket: 8673
set the default EXTINF duration to 1ms if duration is smaller than 1ms
Signed-off-by: Steven Liu <lq@chinaffmpeg.org >
(cherry picked from commit 9dfb19baeb )
2020-07-03 12:10:24 +02:00
Michael Niedermayer
cb438cf889
avutil/common: Fix integer overflow in av_ceil_log2_c()
...
Fixes: left shift of 1913647649 by 1 places cannot be represented in type 'int'
Fixes: 23572/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5082619795734528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e409262837 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
55e76ddb7a
avcodec/wmalosslessdec: fix overflow with pred in revert_cdlms
...
Fixes: signed integer overflow: 2048 + 2147483646 cannot be represented in type 'int'
Fixes: 23538/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5227567073460224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 21598d711d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
2f0a00fb3d
avformat/mvdec: Fix integer overflow with billions of channels
...
Fixes: signed integer overflow: 1394614304 * 2 cannot be represented in type 'int'
Fixes: 23491/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5697377020411904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b6fbbe08c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
f62bbddde2
avformat/microdvddec: skip malformed lines without frame number.
...
Fixes: signed integer overflow: 1 - -9223372036854775808 cannot be represented in type 'long'
Fixes: 23490/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5133490093031424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8fb7612a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
1f7af6a946
avformat/mxfdec: free duplicated utf16 strings
...
Fixes: memleak
Fixes: 23415/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5124814510751744
Suggested-by: Marton Balint <cus@passwd.hu >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0aa2768cb2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
0b124172d8
avformat/4xm: Check that a video stream was created before returning packets for it
...
Fixes: assertion failure
Fixes: 23434/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5227750851084288.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c517c3f474 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
1f64119c8a
avcodec/ffwavesynth: Avoid undefined operation on ts overflow
...
Alternatively these conditions could be treated as errors
Fixes: 23147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5639254549200896
Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'int64_t' (aka 'long')
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 584d334afd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
0e5ac35745
avcodec/mpeg4videodec: Fix 2 integer overflows in get_amv()
...
Fixes: signed integer overflow: -144876608 * 16 cannot be represented in type 'int'
Fixes: 22782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-6039584977977344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e361785ee0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
0c0c9d15ce
avcodec/lossless_audiodsp: Fix undefined overflows in scalarproduct_and_madd_int16_c()
...
Fixes: signed integer overflow: 2142077091 + 6881070 cannot be represented in type 'int'
Fixes: 22737/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5958388889681920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c0dfe134be )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
ba6fc75d5a
avcodec/sonic: Fix several integer overflows
...
Fixes: signed integer overflow: 2129689466 + 2129689466 cannot be represented in type 'int'
Fixes: 20715/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5155263109922816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 75d520e337 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
f1e0ca3709
avcodec/mpeg4videodec: avoid invalid values and reinitialize in format changes for studio profile
...
Fixes: out of array access
Fixes: 23327/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5134822992510976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e53235f06c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
b02ff15402
avcodec/pixlet: Fix log(0) check
...
Fixes: passing zero to clz(), which is not a valid argument
Fixes: 23337/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PIXLET_fuzzer-5179131989065728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bd0f81526d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
99d2024b18
avcodec/iff: Fix off by x error
...
Fixes: out of array access
Fixes: 23245/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5723121327013888.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 51225dee0a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
c15b6bfd79
avcodec/wmalosslessdec: Check block_align maximum
...
Fixes: Assertion failure
Fixes: 22737/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5958388889681920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 314d10f7a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
24fd6136df
avcodec/loco: Fix signed integer overflow in loco_get_rice()
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 22975/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5658160970072064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa88cdfd90 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
d31345a880
avformat/thp: Check fps
...
Fixes: division by zero
Fixes: 23162/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4856420817436672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e15b01b4e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
38af60a454
avformat/mpl2dec: Fix integer overflow with duration
...
Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented in type 'long'
Fixes: 23167/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6425051741290496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9a42a67c5c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
c5535532f8
avcodec/mpeg12dec: remove outdated comments
...
Found-by: Kieran
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 48de8f5816 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
86ae1ff10f
avcodec/snowdec: Avoid integer overflow with huge qlog
...
Fixes: integer overflow
Fixes: 22285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5682428762128384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38fbf33c72 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Dale Curtis
f377de6413
avformat/mov: Check if DTS is AV_NOPTS_VALUE in mov_find_next_sample().
...
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf446711bc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
4fdf23df7d
avcodec/mpeg12dec: Fix got_output
...
This makes got_output consistent with the code in slice_end() which sets the output
in slice_end()
if (s->pict_type == AV_PICTURE_TYPE_B || s->low_delay) {
int ret = av_frame_ref(pict, s->current_picture_ptr->f);
...
} else {
Fixes: assertion failure
Fixes: 22178/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5664234440753152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f33a9803a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
a621600f66
avformat/4xm: Cleanup on GET_LIST_HEADER() failure
...
Fixes: memleak
Fixes: 23142/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5932860820422656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5313ce654 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
c3eaff820a
avcodec/lzf: Consider the needed size in reallocation
...
Fixes: NULL pointer dereference
Fixes: 22381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-5659879921680384.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 292b9b93a5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
e01d07c781
avformat/mlvdec: fail reading a packet with 0 streams
...
Fixes: NULL pointer dereference
Fixes: 22604/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5667739074297856.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5bd5c31087 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
be9e89efcd
avformat/thp: Check compcount
...
Fixes: out of array access
Fixes: 22520/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5100297658826752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1ba8484559 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
dd6147888c
avcodec/adpcm: XA: Check shift similar to filter
...
Fixes: negative shift
Fixes: 22499/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_XA_fuzzer-5765452130418688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6d96bae9c4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
8935ae4395
avcodec/huffyuvdec: Test vertical coordinate more often
...
Fixes: out of array access
Fixes: 22892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-5135996772679680.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1223ddc56 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
011c9cfab1
avcodec/hq_hqa: Check info size
...
Fixes: assertion failure
Fixes: 21079/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-5737046523248640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf28521fee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
9ff5fd6537
avcodec/wmalosslessdec: Fix integer overflow in mclms_predict()
...
Fixes: signed integer overflow: 2147483636 + 2048 cannot be represented in type 'int'
Fixes: 22016/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5109395618004992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c42ed06695 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
1ba97da44b
avcodec/vp9dsp_template: Fix integer overflow(s) in iadst16_1d()
...
Fixes: signed integer overflow: 1080285923 - -1130879337 cannot be represented in type 'int'
Fixes: 22002/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-6260237310099456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 071e293723 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
6be68e6994
avcodec/h264dec: Disable forced small_padding on flag2 fast
...
Fixes: 20978/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5746381832847360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
083e0314b5
avformat/oggparsevorbis: Error out on double init of vp
...
Fixes: memleak
Fixes: 19949/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5743636058210304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2a3bbc0086 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
d1eb5516bb
avcodec/pnmdec: Use unsigned for maxval rescaling
...
Fixes: signed integer overflow: 65535 * 55335 cannot be represented in type 'int'
Fixes: 21955/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-5669206981083136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 49459aca47 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
dad19158aa
avcodec/ivi: Clear got_p_frame before decoding a new frame using it
...
Fixes: assertion failure
Fixes: 21666/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-5706468994318336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1d633e6a0a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
e7262c1f19
avcodec/dsddec: Check channels
...
Fixes: division by zero
Fixes: 21677/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DSD_MSBF_fuzzer-5712547983654912
Fixes: 21751/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DSD_LSBF_fuzzer-5197097180856320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2570a8777e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
05e2de8291
avcodec/xvididct: Fix integer overflow in idct_row()
...
Fixes: signed integer overflow: -1238335488 + -1003634688 cannot be represented in type 'int'
Fixes: 21649/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5112005765890048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 620236e4d2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
296d4bf22e
avcodec/wmalosslessdec: Fix integer overflows in revert_inter_ch_decorr()
...
Fixes: signed integer overflow: -717241856 + -1434459904 cannot be represented in type 'int'
Fixes: 21405/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5677143666458624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e9a4c4fe99 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
02656f5570
avcodec/cbs_jpeg: Fix infinite loop in cbs_jpeg_split_fragment()
...
Fixes: Timeout
Fixes: 21104/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5129580475318272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a3dc67c984 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
60b78cd99d
avformat/mpegenc: Fix integer overflow with AV_NOPTS_VALUE
...
Fixes: signed integer overflow: -9223372036854775808 - 45000 cannot be represented in type 'long'
Fixes: ticket8187
Found-by: Suhwan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9874815b1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
6ffdc413d6
avformat/swfenc: Fix integer overflow in frame rate handling
...
Fixes: signed integer overflow: 30000299 * 256 cannot be represented in type 'int'
Fixes: ticket8184
Found-by: Suhwan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 31f956acad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
862801c68c
avformat/aadec: Check toc_size to contain the minimum to demuxer uses
...
Fixes: out of array access
Fixes: stack-buffer-overflow-READ-0x0831fff1
Found-by: GalyCannon <galycannon@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit daa2482871 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
6f582f69df
avcodec/cbs_h265_syntax_template: Limit num_long_term_pics more strictly
...
The limit is based on hevcdec.c
Fixes: 20854/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-5160442882424832
Fixes: out of array access
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 435fa373d1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Dale Curtis
b2116b438e
avformat/mov: Don't allow negative sample sizes.
...
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d8d554f15 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Vitaly Buka
13adaa31a9
mpeg4videoenc: Don't crash with -fsanitize=bounds
...
Also the patch makes this code consistent with mpeg4videodec.c
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f163d30de2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
71fefa15c0
avformat/mpegts: Shuffle avio_seek
...
This avoids accessing an old, no longer valid buffer.
Fixes: out of array access
Fixes: crash_audio-2020
Found-by: le wu <shoulewoba@gmail.com >
Reviewed-by: Marton Balint <cus@passwd.hu >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cd74af1416 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
ddaee77e3c
avcodec/binkaudio: Fix 2Ghz sample_rate
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 19950/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINKAUDIO_DCT_fuzzer-5765514337189888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Paul
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f603d10b1e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
a19dd37e2d
avcodec/adpcm: Fix integer overflow in ADPCM THP
...
The reference (thp.txt) uses floats so wrap around would seem incorrect.
Fixes: signed integer overflow: 1073741824 + 1073741824 cannot be represented in type 'int'
Fixes: 20658/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_THP_fuzzer-5646302555930624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b12b05374f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
1e31295ea2
avcodec/ralf: Check num_blocks before use
...
Fixes: out of array access
Fixes: 20659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5739471895265280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f0c0471075 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
36ea0ddc75
avcodec/iff: Test video_size being non zero
...
Fixes: Out of array access
Fixes: 20659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5658548592967680
Fixes: 20659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5723561177382912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a035fd88ae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
75fb0d8276
avcodec/utvideodec: Fix integer overflow in decode_plane()
...
Fixes: signed integer overflow: 2147483594 + 142 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_fuzzer-5658568101724160
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 876cfa67f3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
d01f5a4dc6
avcodec/ttadsp: Fix several integer overflows in tta_filter_process_c()
...
Fixes: signed integer overflow: 1931744255 + 252497024 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5763348114440192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8627885172 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
c04b6048f5
avcodec/ralf: Fix integer overflow in decode_block()
...
Fixes: signed integer overflow: 289082077 - -2003141111 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5196077752123392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c4330847c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
428c542b45
avcodec/nuv: widen buf_size type
...
Fixes: signed integer overflow: 65312 * 65312 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-5740176118906880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1ac106bf56 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
240b5f73f1
avcodec/iff: Fix several integer overflows
...
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int32_t' (aka 'int')
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5764066459254784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7a92147f87 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
dd83573043
avcodec/g729postfilter: Clip gain before scaling with AGC_FAC1
...
The fixed point integer reference specifies the multiplication used
to have 16bit input and clips so we need to clip the input
The floating point implementation does not seem to do that.
Fixes: signed integer overflow: 6317568 * 410 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G729_fuzzer-5700189272932352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 82d4c7b95e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
5325e60e47
avcodec/alac: Fix integer overflow with 24/20bps samples
...
Fixes: signed integer overflow: 1020048 * 4096 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5753877751660544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 22e51e95ac )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
f65d68abd9
avcodec/dstdec: Check sample rate
...
Fixes: out of array access
Fixes: 20659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5735812071424000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5727b1f13f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
5cdbb2a977
avformat/thp: Require a video stream
...
The demuxer code assumes the existence of a video stream
Fixes: assertion failure
Fixes: 21512/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5699660783288320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 97c78caf3e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
e81e27ffd0
avformat/mpeg: Decrease score by 1 for files with very little valid data
...
Fixes: 8233/PPY6574574605_cut.mp3
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 20f7b4dfc9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
d303f28c57
avcodec/pngdec: Check length in fdAT
...
Fixes: 21089/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-5135981419429888
Fixes: out of array read
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 79e5c2ee2b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
9e8e8a630e
avcodec/g2meet: Check tile_width in epic_jb_decode_tile()
...
Fixes: out of array access
Fixes: 21469/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5199357982015488
Alternatively the arrays can be made bigger or the index can be clipped.
In case a real file with such huge tiles exist we ask the user to upload it.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5501bb28dd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
35af336ccb
avcodec/hapdec: Check tex_size more strictly and before using it
...
Fixes: OOM
Fixes: 20774/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5678608951803904
Fixes: 20956/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5713643025203200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 81fe316ad9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
ff3b195470
avcodec/vp9dsp_template: Fix integer overflows in idct32_1d()
...
Fixes: signed integer overflow: -193177 * 11585 cannot be represented in type 'int'
Fixes: 20557/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5704852816789504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e16e3e63f0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
f5d9e8af89
avcodec/alacdsp: Fix invalid shift in append_extra_bits()
...
Fixes: left shift of negative value -1
Fixes: 21390/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-6242539519868928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 49ae034b42 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
4f0893fefa
libavcodec/wmalosslessdec: prevent sum of positive numbers from becoming negative
...
Fixes: left shift of negative value -8321365
Fixes: 20506/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-4798062906310656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 62e4003780 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
2d7a83457e
avcodec/dstdec: Fix integer overflow in read_table()
...
Fixes: signed integer overflow: -16 * 134217879 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5639509530378240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d465a401d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
778965d30d
avcodec/txd: Check for input size against the header size.
...
Fixes: Timeout (21sec -> 80ms)
Fixes: 20673/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TXD_fuzzer-5177453863763968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aeb4e43584 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
33440bd53b
avcodec/svq1dec: Check that there is data left after the header
...
Fixes: Timeout (21sec -> 255ms)
Fixes: 20709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ1_fuzzer-5085075089915904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 55e344ee5a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
231a5e4528
avcodec/cbs_h265_syntax_template: Check num_negative/positive_pics when inter_ref_pic_set_prediction_flag is set
...
Fixes: out of array access
Fixes: 20446/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-5707770718584832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 588114cea4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
7dc86d9a4d
avcodec/intrax8: Check for end of bitstream in ff_intrax8_decode_picture()
...
Fixes: Timeout (105sec -> 1sec)
Fixes: 20479/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5769846937878528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a9ccc2514 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
1e7bbb3600
avcodec/hevc_mp4toannexb_bsf: Check nalu_size
...
Fixes: Timeout (29sec -> 5ms)
Fixes: 20237/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_MP4TOANNEXB_fuzzer-5165615044362240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ae2537f53e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
fc559ce561
avcodec/iff: Check length before memcpy() in decode_deep_rle32()
...
Fixes: out of array read
Fixes: 20796/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5111364702175232.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b4a33387cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
fac6bc92f7
avcodec/iff: Fix invalid pointer intermediates in decode_deep_rle32()
...
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc41a29a5a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
d55c05368f
avcodec/pngdec: Pass ret from decode_iccp_chunk()
...
Found while reviewing a patch fixing a similar issue
Reviewed-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4c7bcaa385 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
b7124ca342
avcodec/rv40dsp: Fix integer overflows in rv40_weight_func_*()
...
Fixes: signed integer overflow: 40550400 * 128 cannot be represented in type 'int'
Fixes: 20331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV40_fuzzer-5676685725007872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 13171ad2e3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
a5ff87551d
avcodec/ac3dec_fixed: Fix several invalid left shifts in scale_coefs()
...
Fixes: left shift of negative value -14336
Fixes: 20298/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AC3_FIXED_fuzzer-5675484201615360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e30502abe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
9494b1bc91
avcodec/flac_parser: Do not lose header count in find_headers_search()
...
Fixes: Timeout
Fixes: out of array access
Fixes: 20274/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5649631988154368
Fixes: 19275/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5757535722405888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 55f9683cf6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
cde8c90a3d
avcodec/audiodsp: Fix integer overflow in scalarproduct_int16_c()
...
Fixes: signed integer overflow: 2145417478 + 76702564 cannot be represented in type 'int'
Fixes: 20313/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-5734487724130304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit abb5762e98 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
cfc2633c75
avcodec/cbs_jpeg_syntax_template: Check array index in huffman_table()
...
Fixes: index 224 out of bounds for type 'uint8_t [224]'
Fixes: 21534/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-6291612167831552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 18f5256c0d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
20283b395e
avcodec/cbs_jpeg_syntax_template: Check table index before use in dht()
...
Fixes: out of array access
Fixes: 21515/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5766121576988672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d31862c2b1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
a99bcee917
avformat/oggdec: Check for EOF after page header
...
Fixes: Infinite loop
Fixes: Ticket8594
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f1589be9fd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
e55bcedae9
swscale/yuv2rgb: Fix vertical dither offset with slices
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be3c29e379 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
64f6581129
avcodec/dpcm: clip exponent into supported range in XAN DPCM
...
Fixes: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 21200/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XAN_DPCM_fuzzer-5754704894361600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 20ade59d96 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
01167ee6d5
avcodec/flacdsp_template: Fix invalid shifts in decorrelate
...
Fixes: left shift of negative value -2
Fixes: 20303/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5096829297623040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3935c891e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
092f21af2b
avcodec/xvididct: Fix integer overflow in MULT()
...
Fixes: signed integer overflow: 23170 * 95058 cannot be represented in type 'int'
Fixes: 20295/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5800212870463488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ccb576191 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
e5f325a1dd
avcodec/ffwavesynth: Correct undefined overflow of PINK_UNIT
...
Fixes: signed integer overflow: 9223372036854775775 + 128 cannot be represented in type 'long'
Fixes: 20054/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5686385113825280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 187161d62f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
f49374b47d
avcodec/cbs_h264_syntax_template: fix off by 1 error with slice_group_change_cycle
...
Fixes: assertion failure
Fixes: 20390/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_REDUNDANT_PPS_fuzzer-5683400772157440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 741565a1e6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
0a308576bf
swscale/output: Fix integer overflow in yuv2rgb_write_full() with out of range input
...
Fixes: signed integer overflow: 1169365504 + 981452800 cannot be represented in type 'int'
Fixes: ticket8293
Found-by: Suhwan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e057e83a4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:24 +02:00
Michael Niedermayer
4cdf6dc908
swscale/output: Fix integer overflow in alpha computation in yuv2gbrp16_full_X_c()
...
Fixes: signed integer overflow: 524280 * 4432 cannot be represented in type 'int'
Fixes: ticket8322
Found-by: Suhwan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 49ba1879ad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
John Rummell
a09b223cd2
libavformat/amr.c: Check return value from avio_read()
...
If the buffer doesn't contain enough bytes when reading a stream,
fail rather than continuing on with initialized data. Caught by
Chromium fuzzeras (crbug.com/1065731).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5b967f56b6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
John Rummell
7f8e9d9b77
libavformat/mov.c: Free aes_decrypt to avoid leaking memory
...
Found by Chromium fuzzers (crbug.com/1057205).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ad91cf1f2f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
John Rummell
cd655e4c0d
libavformat/oggdec.c: Check return value from avio_read()
...
If the buffer doesn't contain enough bytes when reading a stream,
fail rather than continuing on with unitialized data. Caught by
Chromium fuzzers (crbug.com/1054229).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b7c67b1ae3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
12a53bf673
avformat/asfdec_f: Fix overflow check in get_tag()
...
Fixes: signed integer overflow: 2 * 1210064928 cannot be represented in type 'int'
Fixes: 20873/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5761116909338624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8140fe732 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
dee744a8c4
avformat/nsvdec: Fix memleaks on errors while reading the header
...
Fixes: memleaks
Fixes: 21084/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5655975492321280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 96c0469455 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
e121488dc8
avcodec/ffwavesynth: Fix integer overflow in computation of ddphi
...
Fixes: signed integer overflow: 1302123111085380114 - -8319005078741256972 cannot be represented in type 'long'
Fixes: 20991/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5148554161291264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c85bf16318 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
a3a3730b54
avcodec/cbs_jpeg: Check length for SOS
...
Fixes: out of array access
Fixes: 19734/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5673507031875584
Fixes: 19353/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5703944462663680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1812352d76 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
8640db14e7
avcodec/adpcm: Fix invalid shift in AV_CODEC_ID_ADPCM_PSX
...
Fixes: left shift of negative value -1
Fixes: 20859/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_PSX_fuzzer-5720391507247104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a11ef68f0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
b66f444683
avcodec/mpeg12dec: Fix invalid shift in mpeg2_fast_decode_block_intra()
...
Fixes: left shift of negative value -695
Fixes: 19232/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5702856963522560
Fixes: 19555/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5741218147598336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c40df2166c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Andreas Rheinhardt
73374013ff
avcodec/cbs_h2645: Treat slices without data as invalid
...
Slices that end after their header (meaning slices after the header
without any data before the rbsp_stop_one_bit or possibly without any
rbsp_stop_one_bit at all) are invalid and are now dropped. This ensures
that one doesn't run into two asserts in cbs_h2645_write_slice_data().
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Fixes: 19629/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_METADATA_fuzzer-5676822528524288
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 66fac1ff7c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Andreas Rheinhardt
107345d0a1
avcodec/cbs_h2645: Remove dead code to delete trailing zeroes
...
Trailing zeroes are already discarded when splitting a fragment, which
makes the code to remove them when decomposing slices dead code.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8f701932b3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
f94ca27470
avcodec/cbs_av1_syntax_template: Set seen_frame_header only after successfull uncompressed_header()
...
Fixes: assertion failure
Fixes: 19301/clusterfuzz-testcase-minimized-ffmpeg_BSF_AV1_FRAME_MERGE_fuzzer-5743212006473728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a2e4879432 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
c5419a53ac
avcodec/mpegaudioenc_template: fix invalid shift of sample
...
Fixes: Ticket8010
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a2c97a8342 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
eb64c10a4b
avcodec/motion_est_template: Fix invalid shifts in no_sub_motion_search()
...
Fixes: Ticket8167
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e13eee37ee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
1170ec748b
libavformat/avienc: Check bits per sample for PAL8
...
Fixes: assertion failure
Fixes: Ticket 8172
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3595878281 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
6faa32dd6c
avformat/mpegts: Improve the position determination for avpriv_mpegts_parse_packet()
...
Fixes: assertion failure
Fixes: Ticket 8005
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e5bb48ae59 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
59a4a990fc
avcodec/magicyuv: Check that there are enough lines for interlacing to be possible
...
Fixes: out of array access
Fixes: 20763/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_fuzzer-5759562508664832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f8a0e9f9f7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
366929ab4e
avformat/mvdec: Check stream numbers
...
Fixes: null pointer dereference
Fixes: 20768/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5638648978735104.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 618a9bea65 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
a7dabc18ea
avcodec/pcm: Fix invalid shift in AV_CODEC_ID_PCM_LXF
...
Fixes: left shift of 233 by 24 places cannot be represented in type 'int'
Fixes: 20736/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PCM_LXF_fuzzer-4829212685107200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 051d11f659 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
4e2dd06d27
avcodec/qdm2: Check fft_coefs_index
...
Fixes: out of array access
Fixes: 20660/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5658290216501248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9fc73bf022 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
31098af56d
avformat/utils: Fix integer overflow with complex time bases in avformat_find_stream_info()
...
Fixes: signed integer overflow: 2045163756 * 2 cannot be represented in type 'int'
Fixes: Ticket5132
Found-by: tsmith
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f3d8f517db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
4b7a304b6e
avformat/avidec: Avoid integer overflow in NI switch check
...
Fixes: signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'long'
Fixes: Ticket8149
Found-by: Suhwan
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 347920ca21 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
6a300f6a90
fftools/ffmpeg: Fix integer overflow in duration computation in seek_to_start()
...
Fixes: signed integer overflow: -9223372036854775808 - 9223372036854775807 cannot be represented in type 'long'
Fixes: Ticket8142
Found-by: Suhwan
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f4ad33d96 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
555d2ab5a5
avfilter/vf_aspect: Fix integer overflow in compute_dar()
...
Fixes: signed integer overflow: 1562273630 * 17 cannot be represented in type 'int'
Fixes: Ticket8323
Found-by: Suhwan
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c0ca0f244 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
55f147c2ba
avcodec/apedec: Fix invalid shift with 24 bps
...
Fixes: left shift of negative value -463
Fixes: 20542/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5688714435231744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e27867229 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Dale Curtis
b89759ea54
avformat/utils: Fix undefined behavior in ff_configure_buffers_for_index()
...
When e2_pts == INT64_MIN and e1_pts >= 0 the calculation of
e2_pts - e1_pts will overflow an int64_t.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f15007afa9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
27db9c8288
avcodec/dpcm: Fix integer overflow in AV_CODEC_ID_GREMLIN_DPCM
...
Fixes: signed integer overflow: -2147479324 + -32568 cannot be represented in type 'int'
Fixes: 20103/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_GREMLIN_DPCM_fuzzer-5667667579240448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b1aecad9ea )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
52b9e7f530
avcodec/wmalosslessdec: Fix integer overflow with sliding in padding bits
...
Fixes: signed integer overflow: -53716100 * 256 cannot be represented in type 'int'
Fixes: 20143/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5716604000403456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b8a0be9352 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
3653108a5c
avcodec/wmalosslessdec: Fix loop in revert_acfilter()
...
Fixes: out of array read
Fixes: 20059/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5691776237305856
No testcase except the fuzzed one.
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5584c0bb94 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
c4dccb509d
avcodec/lagarith: Sanity check scale
...
A value of 24 and above can collaps the range to 0 which would not work.
Fixes: Timeout (75sec -> 21sec)
Fixes: 18707/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LAGARITH_fuzzer-5708950892969984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fb3855342b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
d75d754b84
avcodec/apedec: Fix integer overflows in predictor_decode_mono_3950()
...
Fixes: signed integer overflow: -2147407150 + -1871606 cannot be represented in type 'int'
Fixes: 18702/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5679095417667584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eb64a5c6f9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
9f30a1694c
avcodec/ralf: Fix integer overflow in apply_lpc()
...
Fixes: signed integer overflow: 2147482897 + 2048 cannot be represented in type 'int'
Fixes: 19240/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5743240326414336
Fixes: 19869/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5150136636538880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fd313d8cf8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
af1bfe5bc3
avcodec/dca_lbr: Fix some error codes and error passing
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bfea054a75 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
9f30473846
avcodec/wmavoice: Fix rounding and integer anomalies in calc_input_response()
...
Fixes: out of array access
Fixes: inf is outside the range of representable values of type 'int'
Fixes: signed integer overflow: -9223372036854775808 - 1 cannot be represented in type 'long'
Fixes: 19316/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5677369365102592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38d3758444 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
20c0ea160e
avcodec/wmavoice: sanity check block_align
...
This limit is roughly based on the bitreader limit, its likely a much tighter limit
could be used
Fixes: left shift of 1965039647 by 1 places cannot be represented in type 'int'
Fixes: 19545/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5695391899320320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6847e22c8c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
958db2c438
avcodec/pcm: Fix invalid shift in pcm_decode_frame for LXF
...
Fixes: left shift of 32 by 28 places cannot be represented in type 'int'
Fixes: 19472/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PCM_LXF_fuzzer-5704364320096256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 985d3666f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
bc77d29d9e
avcodec/snappy: Sanity check bytestream2_get_levarint()
...
Fixes: left shift of 79 by 28 places cannot be represented in type 'int'
Fixes: 20202/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5719004081815552
Fixes: 20219/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5641738677125120
Fixes: 20389/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5680721517871104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be54da2117 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
5e83098085
avcodec/mlpdsp: Fix a invalid shift in ff_mlp_rematrix_channel()
...
Fixes: left shift of negative value -2
Fixes: 20305/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-5677196618498048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Jai Luthra <me@jailuthra.in >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fcc9f13717 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
51c084bf72
avcodec/avdct: Clear IDCTDSPContext context
...
Fixes use of uninitialized variable and segfault
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b82825eba8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
9ed9c8cc51
avcodec/x86/diracdsp: Fix high bits on Windows x86_64
...
Found-by: james
(cherry picked from commit 24af459d1e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
e1146c8b72
avformat/mov: Check STCO location
...
Fixes: bypassing of checks and assertion failure
Fixes: asan_1003879.mp4
Found-by: Clusterfuzz + asan
Reported-by: Thomas Guilbert <tguilbert@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1cd4184020 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
862c0048ec
avcodec/wmalosslessdec: Fix multiple integer overflows
...
Fixes: left shift of 3329 by 20 places cannot be represented in type 'int'
Fixes: signed integer overflow: -199378355 + -1948950833 cannot be represented in type 'int'
Fixes: 19837/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5752565837070336
Fixes: 19839/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5767483265122304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 422202516c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
109cab1487
avcodec/apedec: Fix undefined integer overflow in decode_array_0000()
...
Fixes: signed integer overflow: -2143289344 - 6246400 cannot be represented in type 'int'
Fixes: 19239/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5173755680915456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a3655bb02c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
b7c2f4d298
avcodec/smacker: Check space before decoding type
...
Fixes: Timeout (232sec -> 280ms)
Fixes: 19682/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKER_fuzzer-5654129649385472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6f5c18da59 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
3f42af0342
avcodec/rawdec: Use linesize in b64a
...
Fixes: out of array access
Fixes: 19750/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RAWVIDEO_fuzzer-5074834119983104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b5b9d5dac )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
57278dac15
avcodec/iff: Over-allocate ham_palbuf for HAM6 IFF-PBM
...
IFF-PBM-HAM6 can read out of array without this overallocation
Fixes: Out of array read
Fixes: 19752/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5675331403120640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8652f4e7a1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
e1bea6d412
avcodec/x86/diracdsp: Fix incorrect src addressing in dequant_subband_32()
...
Fixes: Segfault (not reproducable with asm, which made this hard to debug)
Fixes: decoding errors
Fixes: 19854/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5729372837511168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0694b60b7b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
7a7be53ac5
avfilter/vf_find_rect: Remove assert
...
A score of 0 is possible
Fixes: Ticket8500
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dfc4714886 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
b7b8aeef13
avfilter/vf_find_rect: Increase worst case score
...
score could be 1.0 which lead to uninitialized values
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ff2474e02 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
cfd165dda7
swscale/input: Fix several invalid shifts related to rgb2yuv constants
...
Fixes: Invalid shifts
Fixes : #8140
Fixes : #8146
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d48e510124 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
f541744f73
swscale/output: Fix several invalid shifts in yuv2rgb_full_1_c_template()
...
Fixes: Invalid shifts
Fixes : #8320
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b7f97532b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
0ec11133d9
swscale/swscale: Fix several invalid shifts related to vChrDrop
...
Fixes: Invalid shifts
Fixes : #8166
Fixes: filter-crop_scale_vflip FATE-test
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6ca22c118 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
88326e29dc
avcodec/hevc_mp4toannexb_bsf: check that nalu size doesnt overflow
...
Fixes: Out of array access
Fixes: 19299/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_MP4TOANNEXB_fuzzer-5169193398042624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8ceb2a72f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
a0d0e9b245
avcodec/hevc_mp4toannexb_bsf: Avoid NULL memcpy()
...
Fixes: invalid memcpy use
Fixes: 19299/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_MP4TOANNEXB_fuzzer-5169193398042624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e23b5a706 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
831ac9ad46
avcodec/cbs_av1: Check leb128 values read
...
"It is a requirement of bitstream conformance that the value returned from the leb128 parsing process is less than or equal
to (1 << 32) - 1."
Fixes: assertion failure
Fixes: 19293/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5749508361420800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a70d836364 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
623ecb2ec8
avcodec/wmalosslessdec: move channel check up
...
Fixes: out of array access
Fixes: 2nd part of 18429/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-6210814364614656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 891bcc4acc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
94a1280fb0
avcodec/cbs_h2645: Skip all 0 NAL units
...
Fixes: assertion failure
Fixes: 19286/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_REDUNDANT_PPS_fuzzer-5707990724509696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 285138ef14 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
7be077fcf8
avcodec/adpcm: Fix overflow in FFABS() IMA_EA_EACS
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 19235/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_EA_EACS_fuzzer-5680878952382464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 794352ae9d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
b36592ce07
avcodec/alac: Fix integer overflow in LPC coefficient adaption
...
Fixes: signed integer overflow: 267693597 * 10 cannot be represented in type 'int'
Fixes: 19237/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5755407700328448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6a865cec5e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
84048cf37f
avcodec/g729postfilter: Optimize out overflowing multiplication from apply_tilt_comp()
...
Fixes: signed integer overflow: -1114392282 * 2 cannot be represented in type 'int'
Fixes: 19236/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G729_fuzzer-5741678938030080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c0bd5fa43d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
fabd42043a
avcodec/vc1dec: Check field_mode for sprites
...
Fixes: Out of array read
Fixes: 19263/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5389219325542400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 32fb919836 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
f2a0bde8f3
avcodec/vc1dec: Limit bits by the actual bitstream size
...
Fixes: Timeout (350 ->19sec)
Fixes: 19249/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-6566896438870016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c56a52a82c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Michael Niedermayer
f061fe9aa1
avcodec/vmdaudio: Check block_align more
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 19788/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMDAUDIO_fuzzer-5743379690553344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 06f6857b54 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:10:23 +02:00
Zhao Zhili
5b1270a1f7
avformat/mov: fix memleaks
...
Fix two cases of memleaks:
1. The leak of dv_demux
2. The leak of dv_fctx upon dv_demux allocate failure
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit f3dc38a186 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:32 +02:00
Andreas Rheinhardt
2fdd500efe
libavformat/mov: Fix memleaks when demuxing DV audio
...
The code for demuxing DV audio predates the introduction of refcounted
packets and when the latter was added, changes to the former were
forgotten. This meant that when avpriv_dv_produce_packet initialized the
packet containing the AVBufferRef, the AVBufferRef as well as the
underlying AVBuffer leaked; the actual packet data didn't leak: They
were directly freed, but not via their AVBuffer's free function.
https://samples.ffmpeg.org/ffmpeg-bugs/trac/ticket4671/dir1.tar.bz2
contains samples for this (enable_drefs needs to be enabled for them).
Moreover, errors in avpriv_dv_produce_packet were ignored; this has been
changed, too.
Furthermore, in the hypothetical scenario that the track has a palette,
this would leak, too, so reorder the code so that the palette code
appears after the DV audio code.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 61f5c6ab06 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:32 +02:00
Andreas Rheinhardt
327ec8723d
avformat/mov: Fix reel_name size check
...
Only read str_size bytes from offset 30 of extradata if the extradata is
indeed at least 30 + str_size bytes long.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit ff3fad6b0e )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:31 +02:00
Andreas Rheinhardt
0e36bf6bb5
avformat/mov: Fix memleak upon encountering repeating tags
...
mov_read_custom tries to read three strings belonging to three different
tags. When an already encountered tag is encountered again, a new buffer
for the string to be read is allocated and stored in the pointer
destined for this particular tag. But in this scenario, said pointer
already holds the address of the string read earlier, leading to a leak.
This commit therefore aborts the reading process upon encountering
an already encountered tag.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit dfef1d5e3c )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:31 +02:00
Andreas Rheinhardt
e041c0111f
avformat/matroskaenc: Don't use NULL for %s format string
...
The argument pertaining to a printf %s conversion specifier must not
be NULL, even if the precision (i.e. the number of characters to write)
is zero. If it is NULL, it is undefined behaviour.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 6de6ce7bc8 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:31 +02:00
Andreas Rheinhardt
1f09053c79
avformat/webvttdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit c784fe8b86 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:31 +02:00
Andreas Rheinhardt
db82273368
avformat/vplayerdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 67434afa7f )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:31 +02:00
Andreas Rheinhardt
e7d4683e4b
avformat/tedcaptionsdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if allocating the AVStream for the subtitles fails.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 337783b118 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:31 +02:00
Andreas Rheinhardt
4880156ea4
avformat/subviewerdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit a708f65273 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:31 +02:00
Andreas Rheinhardt
ad723acc43
avformat/subviewer1dec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 9751d75152 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:31 +02:00
Andreas Rheinhardt
2b387fb64b
avformat/stldec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit e13874b9ea )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:31 +02:00
Andreas Rheinhardt
7186f4dd63
avformat/srtdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit c70409957c )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:31 +02:00
Andreas Rheinhardt
572da6c5c0
avformat/sccdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit f3c63e67bb )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:31 +02:00
Andreas Rheinhardt
a7ce7e0978
avformat/samidec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle
or when creating extradata.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit f161f8e4ad )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:30 +02:00
Andreas Rheinhardt
1e13ef6c90
avformat/pjsdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 9df560e898 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:30 +02:00
Andreas Rheinhardt
368aa756c4
avformat/mpsubdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon creating an AVStream.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit a5ed8aeea4 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:30 +02:00
Andreas Rheinhardt
b6986da62c
avformat/mpl2dec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 331799747e )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:30 +02:00
Andreas Rheinhardt
f6b9f7531c
avformat/microdvddec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle
or when allocating extradata.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit b12014a5b8 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:30 +02:00
Andreas Rheinhardt
8201fd9a8a
avformat/lrcdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit d38694cea9 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:30 +02:00
Andreas Rheinhardt
aad3e8af01
avformat/jacosubdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit c13a752733 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:30 +02:00
Andreas Rheinhardt
be57a2ce9e
avformat/assdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle
or if creating the extradata failed.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 5ab39c2d8c )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:30 +02:00
Andreas Rheinhardt
b9be0b6fe8
avformat/aqtitledec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit a86a5d06d8 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:30 +02:00
Andreas Rheinhardt
430cf25553
avformat/mov: Fix memleaks upon read_header failure
...
By default, a demuxer's read_close function is not called automatically
if an error happens when reading the header; instead it is up to the
demuxer to clean up after itself in this case. The mov demuxer did this
by calling its read_close function when it encountered some errors when
reading the header. Yet for other errors (mostly adding side-data to
streams) this has been forgotten, so that all the internal structures
of the demuxer leak.
This commit fixes this by making sure mov_read_close is called when
necessary.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit ac378c535b )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:30 +02:00
Andreas Rheinhardt
33985333ef
avformat/omadec: Fix memleaks upon read_header failure
...
Fixes possible leaks of id3v2 metadata as well as an AVDES struct in
case the content is encrypted and an error happens lateron.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 3d3ba43bc6 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:30 +02:00
Andreas Rheinhardt
1553fe1f72
avformat/matroskadec: Fix memleaks in WebM DASH manifest demuxer
...
In certain error scenarios, the underlying Matroska demuxer was not
properly closed, causing leaks.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 0841063ce6 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:29 +02:00
Andreas Rheinhardt
7e8ce331a0
avformat/matroskadec: Use right number of tracks
...
When demuxing a Matroska/WebM file, streams are added for tracks and for
attachments, so that the array containing the former can be NULL even
when the corresponding AVFormatContext has streams. So check for there
to be tracks in the MatroskaDemuxContext instead of just streams in the
AVFormatContext before dereferencing the pointer to the tracks.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 1ef30571a0 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:29 +02:00
Andreas Rheinhardt
325498af97
avformat/matroskadec: Fix handling gigantic durations
...
matroska_parse_block currently asserts that the duration is not equal to
AV_NOPTS_VALUE, but there is nothing that actually guarantees this. It
is easy to create (spec-compliant) files which run into this assert;
so replace it and instead cap the duration to INT64_MAX, as the duration
field of an AVPacket is an int64_t.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 3714d452b8 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:01:29 +02:00
Andreas Rheinhardt
96f18b6427
avcodec/cinepakenc: Fix invalid shifts
...
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'.
Affected the FATE-tests vsynth1-cinepak, vsynth2-cinepak and
vsynth_lena-cinepak. Also fixes ticket #8220 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e3650dcfc9 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 00:27:48 +02:00
Andreas Rheinhardt
946d2893a9
avcodec/cbs_h2645: Fix potential out-of-bounds array access
...
The maximum allowed index for an array access is FF_ARRAY_ELEMS - 1; yet
the current code allowed FF_ARRAY_ELEMS. This wasn't dangerous in practice,
as parameter sets with invalid ids were already filtered out during
reading.
Found via PVS-Studio (see ticket #8156 ).
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit f3333c3c67 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 00:25:46 +02:00
Andreas Rheinhardt
5db4c91ef5
h264_redundant_pps: Fix memleak in case of errors
...
Now the fragment is uninitialized and the input packet freed in case of
errors.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@googlemail.com >
Signed-off-by: Mark Thompson <sw@jkqxz.net >
(cherry picked from commit 40b74abfca )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 00:20:34 +02:00
Andreas Rheinhardt
aec8b1fa0b
avformat/aviobuf: Don't check for overflow after it happened
...
If adding two ints overflows, it doesn't matter whether the result will
be stored in an unsigned or not; and checking afterwards does not make it
retroactively defined.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 28a078eded )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 00:12:49 +02:00
Andreas Rheinhardt
b568b4683e
avformat/matroskaenc: Fix memleak upon encountering bogus chapter
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit cb255b616c )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 00:07:28 +02:00
Andreas Rheinhardt
259edd9293
fftools/ffmpeg_opt: Check attachment filesize
...
The data of an attachment file is put into an AVCodecParameter's
extradata. The corresponding size field has type int, yet there was no
check for the size to fit into an int. As a consequence, it was possible
to create extradata with negative size (by using a big enough max_alloc).
Other errors were also possible: If SIZE_MAX < INT64_MAX (e.g. on 32bit
systems) then the file size might be truncated before the allocation;
and avio_read() takes an int, too, so one would not have read as much
as one desired.
Furthermore, the extradata is now padded as is required.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 889ad93c88 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 00:03:01 +02:00
Andreas Rheinhardt
cd4d57fe1c
avformat/webmdashenc: Check codec types
...
The WebM DASH Manifest muxer only supports VP8, VP9, Vorbis and Opus,
but there was no check for this. The codec type is used to get a pointer
to a string containing the codec name or NULL if it is not one of those
four codecs. Said pointer has then been used without further checks as
string for the %s conversion specifier in an avio_printf()) call which
is undefined behaviour.
This commit adds a check for the supported codec types.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit cbea58b2b3 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 00:01:04 +02:00
Andreas Rheinhardt
ebe90fbb74
avformat/avidec: Fix memleak with embedded GAB2 subtitles
...
The code for GAB2 subtitles predates refcounting AVPackets. So in order
to transfer the ownership of a packet's data pkt->data was simply stored
and the packet zeroed; in the end (i.e. in the read_close-function) this
data was then simply freed with av_freep(). This of course leads to a leak
of an AVBufferRef and an AVBuffer. It has been fixed by keeping and
eventually unreferencing the packet's buf instead.
Additionally, the packet is now reset via av_packet_unref().
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit da44bbefaa )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 23:59:18 +02:00
Andreas Rheinhardt
81e1872b47
avformat/webmdashenc: Fix memleak upon realloc failure
...
The classical ptr = av_realloc(ptr, size).
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 418e468699 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 23:36:08 +02:00
Andreas Rheinhardt
9ad4088674
avformat/matroskadec: Don't discard the upper 32bits of TrackNumber
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit ba36a07734 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 23:34:41 +02:00
Andreas Rheinhardt
deb796ae42
avformat/hnm: Check for extradata allocation failure
...
and also add padding to it; moreover, don't use memcpy to write one byte
to extradata.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e0f3352d1 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 23:32:25 +02:00
Andreas Rheinhardt
f411e3aede
avformat/subtitles: Don't increment packet counter prematurely
...
Do it only if the packet has been successfully allocated in
av_new_packet() -- otherwise on error a completely uninitialized packet
would be unreferenced later.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6bd8bcc2ac )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 23:30:17 +02:00
Andreas Rheinhardt
54d2f95188
avformat/bethsoftvid: Fix potential memleak upon reallocation failure
...
The classical ptr = av_realloc(ptr, size), just with av_fast_realloc().
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5acef12061 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 23:27:46 +02:00
Andreas Rheinhardt
cfb42ce415
avformat/smoothstreaming: Fix memleaks on errors
...
If an AVFormatContext could be allocated, but white-/blacklists couldn't
be copied, the AVFormatContext would leak as it was only accessible
through a local variable that goes out of scope when one goes to fail.
Furthermore, in case writing a header of a submuxer failed, the options
used for said call could leak.
Both of these memleaks have been fixed.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit abbb466368 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 23:25:11 +02:00
Andreas Rheinhardt
190e2cb02b
avformat/matroskaenc: Check BlockAdditional size before use
...
Don't read a 64bit number before having checked that the data is at
least 8 bytes long.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6e9cc96429 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 23:24:10 +02:00
Andreas Rheinhardt
39c249d75e
avformat/utils: Fix memleaks in avformat_open_input()
...
A demuxer might have allocated memory while reading the header. If
reading the header was successfull and an error happens before returning
(e.g. when queueing the attached pictures), the read_close function
would have never been called, so that all those allocations would leak.
This commit changes this.
Furthermore, there would be even more memleaks if the error level was
set to AV_EF_EXPLODE in case there is both metadata and id3v2 metadata.
This has been fixed, too.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit e2307f4ff1 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 23:21:06 +02:00
Andreas Rheinhardt
2b35185006
avcodec/cavsdsp: Fix undefined left shifts of negative numbers
...
Affected the ffmpeg-filter_colorkey FATE-test (but only if the C version
of idct8_add is used and not e.g. the x86 SSE2 version).
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Fixes: left shift of negative value -107
Fixes: 20398/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5725389278412800
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0f0f2ab0c3 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 23:18:20 +02:00
Andreas Rheinhardt
b9a667c00d
avformat/mov: Don't leak MOVFragmentStreamInfo on error
...
Fixes Coverity issue #1441933 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 43f58f2354 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 23:17:46 +02:00
Andreas Rheinhardt
7a13d99e6e
avformat/mov: Free encryption data on error
...
Fixes memleak and Coverity issue #1439587 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3999c4b374 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 23:15:45 +02:00
Andreas Rheinhardt
9b605dcdde
avformat/hevc: Fix potential leak in case of ff_hevc_annexb2mp4_buf failure
...
ff_hevc_annexb2mp4_buf() could indicate an error, yet leave cleaning
after itself to the caller, so that a caller could not simply return the
error, but had to free the buffer first.
(Given that all current callers have set filter_ps = 0, this error can
currently not be triggered.)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 680cd59bb2 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 23:08:24 +02:00
Andreas Rheinhardt
31fa5fb84e
avformat/matroskaenc: Check for reformatting errors
...
This is needed especially for AV1: If a reformatting error happens (e.g.
if the length field of an OBU contained in the current packet indicates
that said OBU extends beyond the current packet), the data pointer is
still NULL, yet the size is unchanged, so that writing the data leads
to a segmentation fault.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 58428bef4b )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 23:08:14 +02:00
Andreas Rheinhardt
d9e4783f06
avcodec/ra144enc: Fix invalid left shift of negative number
...
by replacing it with a multiplication. Said multiplication can't
overflow an int32_t because lpc_coefs is limited to 16 bit precision.
Fixes the FACE-test acodec-ra144 as well as part of #8217 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e3fb9af6f1 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 23:04:12 +02:00
Andreas Rheinhardt
68e67bb187
avcodec/adxenc: Avoid undefined left shift of negative numbers
...
Replace "((a << shift) + b) >> shift" by "a + (b >> shift)". This avoids
a left shift which also happens to trigger undefined behaviour in case "a"
is negative. This affected the FATE-tests acodec-adpcm-adx and
acodec-adpcm-adx-trellis; it also fixes ticket #8008 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 59a9d65e0d )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 23:03:43 +02:00
Andreas Rheinhardt
d620f2eeb4
avcodec/adpcm: Fix undefined left shifts of negative numbers
...
Affected the adpcm-afc, adpcm-ea-1, adpcm-ea-2, adpcm-ea-maxis-xa,
adpcm-thp and ea-cdata FATE-tests. Also fixes ticket #8487 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ad8af51b7 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 23:03:23 +02:00
Andreas Rheinhardt
84abf2ee32
avformat/segafilmenc: Fix undefined left shift of 1 by 31 places
...
by changing the type to unsigned.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ae026d74f )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 23:01:49 +02:00
Andreas Rheinhardt
02368962f5
avcodec/proresenc_anatoliy: Fix invalid left shift of negative number
...
This fixes ticket #7997 as well as the vsynth*-prores_# FATE-tests
(where * ranges over { 1, 2, 3, _lena } and # over { , _int, _444,
_444_int }).
(Given that prev_dc is in the range -0xC000..0x3FFF, no overflow can
happen upon multiplication with 2.)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 198081efb7 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 23:01:29 +02:00
Andreas Rheinhardt
e848b20ef0
avformat/wtvdec: Fix memleak when reading header fails
...
Fixes #8314 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 373c1c9b69 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 23:01:02 +02:00
Andreas Rheinhardt
57dca5213b
avformat/fitsdec: Fix potential leak of string in AVBPrint
...
by freeing it a bit earlier.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bb20f3dd73 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:55:52 +02:00
Andreas Rheinhardt
88a19d6b4d
avformat/matroskadec: Fix use-after-free when demuxing ProRes
...
ProRes in Matroska is supposed to not contain the first atom header
(containing a size field and the tag "icpf") and therefore the Matroska
demuxer has to recreate it; this involves an allocation and copy, of
course. Whether the old buffer (containing the data without the atom
header) needs to be freed or not depends upon whether it is what was
directly read (in which case it is owned by an AVBuffer) or whether it
has been allocated when reversing the track's content compression (e.g.
zlib compression) that Matroska supports.
So there are three pointers involved: The one pointing to the directly
read data (owned by the AVBuffer), the one pointing to the currently
valid data (which coincides with the former if no content compression
needed to be reverted) and the one pointing to the new data with the
first atom header. The check for whether to free the second of these is
simply whether the first two are different.
This works mostly, but there is a complication: Some muxers don't strip
the first atom header away and in this case, it is also not reinserted
and no new buffer is allocated; instead, the second and the third
pointers agree. In this case, one must never free the second buffer.
Yet it is currently done if the track is e.g. zlib compressed.
This commit fixes this.
This is a regression since b8e75a2a .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit af50f0a515 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:45:43 +02:00
Andreas Rheinhardt
901048ad96
avformat/matroskadec: Fix demuxing ProRes
...
The structure of a ProRes frame in mov/mp4 is that of a typical atom:
First a 32 bit BE size field, then a tag detailling the content. Said
size field includes the eight bytes of the atom header.
This header is actually redundant, as the size of the atom is already
known from the containing atom. It is therefore stripped away when muxed
into Matroska and so the Matroska demuxer has to recreate upon demuxing.
But it did not account for the fact that the size field includes the
size of the header and this can lead to problems when a decoder uses the
in-band size field.
Fixes ticket #8210 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 581419ea39 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:44:41 +02:00
Andreas Rheinhardt
26ceb54a28
avformat/av1: Fix leak of dynamic buffer in case of parsing failure
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 27c6c92534 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:34:44 +02:00
Andreas Rheinhardt
d2b434001f
fftools/ffmpeg: Free swresample dictionary during cleanup
...
Freeing this was forgotten in ad899522 .
Fixes #8315 and #8316 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6f2a3958cf )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:33:24 +02:00
Andreas Rheinhardt
63383aaf53
avfilter/vf_xbr: Fix left shift of negative number
...
Affected every usage of vf_xbr, e.g. the FATE-tests filter-2xbr,
filter-3xbr, filter-4xbr.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4294dc3589 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:31:20 +02:00
Andreas Rheinhardt
7cb41481ea
avfilter/vf_hqx: Fix undefined left shifts of negative numbers
...
Affected every usage of this filter; in particular, it affected the
FATE-tests filter-2xbr, filter-3xbr and filter-4xbr.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fa21194326 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:30:54 +02:00
Andreas Rheinhardt
02d9561eab
avcodec/jpeg2000dwt: Fix undefined shifts of negative numbers
...
Affected the vsynth*-jpeg2000 and the vsynth*-jpeg2000-97 FATE tests
(where * ranges over { 1, 2, 3, _lena }) as well as ticket #7983 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5cf593adcd )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:30:42 +02:00
Andreas Rheinhardt
ceed3603e1
avcodec/ituh263dec: Fix undefined left shift of negative number
...
Fixes ticket #8160 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 324487b596 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:30:16 +02:00
Andreas Rheinhardt
ab3b008dad
avcodec/dnxhdenc: Fix undefined left shifts of negative numbers
...
Affected 61 FATE-tests: 60 vsynth tests and lavf-mxf_opatom.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b7f156e8cb )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:29:36 +02:00
Andreas Rheinhardt
1101cf30ec
swscale/utils: Fix invalid left shifts of negative numbers
...
Affected the FATE-tests vsynth_lena-dv-411, vsynth1-dv-411,
vsynth2-dv-411 and hevc-paramchange-yuv420p.yuv420p10.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e2646e23be )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:29:20 +02:00
Andreas Rheinhardt
a79bfc2222
swscale/x86/swscale: Fix undefined left shifts of negative numbers
...
This affected many FATE-tests: The number of failing tests went down
from 663 to 344. (Both numbers exclude tests that failed because of
unaligned accesses in code that is inside #if HAVE_FAST_UNALIGNED.)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 736c7c20e7 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:28:47 +02:00
Andreas Rheinhardt
438773db51
avcodec/exr: Fix undefined left shifts of negative numbers
...
Affected the FATE-tests exr-rgb-scanline-pxr24-half-uint32-13x9 and
exr-rgb-scanline-pxr24-uint32.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b0f949906 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:28:15 +02:00
Andreas Rheinhardt
62df14c7fe
avformat/movenc: Fix undefined shift
...
Fixes the movenc FATE-test.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 646799b42f )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:27:58 +02:00
Andreas Rheinhardt
2b9ddde1d0
avcodec/pcm: Fix undefined shifts
...
Fixes the acodec-pcm-u16[lb]e FATE-tests.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 69473bec6f )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:26:42 +02:00
Andreas Rheinhardt
3497fd2dd7
avcodec/wavpackenc: Fix undefined shifts
...
Fixes ticket #8161 and the acodec-wavpack FATE-test.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 84974c6fb5 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:26:04 +02:00
Andreas Rheinhardt
5dc4b3209f
avutil/encryption_info: Don't pass NULL to memcpy
...
The pointer arguments to memcpy (and several other functions of the
C standard library) are not allowed to be NULL, not even when the number
of bytes to copy is zero. An AVEncryptionInitInfo's data pointer is
explicitly allowed to be NULL and yet av_encryption_init_info_add_side_data
unconditionally used it as a source pointer to copy from. This commit changes
this so that copying is only done if the number of bytes to copy is > 0.
Fixes ticket #8141 as well as a part of ticket #8150 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e6018fda14 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:25:36 +02:00
Andreas Rheinhardt
9083b1054a
avcodec/ac3enc: Fix invalid shift
...
Fixes the FATE-tests unknown_layout-ac3, ac3-fixed-encode, ac3-encode
and eac3-encode. It furthermore fixes the ac3-encoder bugs mentioned in
tickets #7994 , #8144 and #8159 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f289ec914 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:25:21 +02:00
Andreas Rheinhardt
0284b72c8a
avcodec/tdsc: Fix undefined shifts
...
Fixes the tdsc FATE-test.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 86bef10e7a )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:20:51 +02:00
Andreas Rheinhardt
9744ed6e52
fftools/ffmpeg_opt: Fix signed integer overflow
...
Fixes ticket #8154 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b1fcba8dd )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:19:39 +02:00
Andreas Rheinhardt
8ee6b52db0
avformat/mov: Fix memleak
...
When the mov/mp4 demuxer encounters an error during decrypting a packet,
it returns the error, yet doesn't free the packet, so that the packet
leaks. This has been fixed in this commit.
Fixes the memleaks from ticket #8150 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 34bd293b01 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:19:06 +02:00
Andreas Rheinhardt
9a3edef421
avcodec/ttaenc: Fix undefined shift
...
ttaenc contained (1 << unary) - 1 as an argument for a function
expecting an unsigned int. unary can be as big as 31 in this case.
The type of the shift and the whole expression is int, because 1 fits
into an integer, so that the behaviour is undefined if unary == 31
as the result of the shift can't be represented in an int §. Subtraction
by 1 (which makes the result of the whole expression representable in
an int) doesn't change that this is undefined (it usually leads to
signed integer overflow which is undefined, too).
The solution is simple: Make 1 unsigned to change the type of the
whole expression to unsigned int (as the function expects anyway).
Fixes ticket #8153 .
§: This of course presupposes the common int range of -2^31..2^31-1
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ab488a540 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:18:52 +02:00
Andreas Rheinhardt
458d0dea90
lavf/webm_chunk: Fix NULL dereference
...
The earlier version of the webm_chunk muxer had several bugs:
1. If the first packet of an audio stream didn't have a PTS of zero,
then no chunk will be started before a packet is delivered to the
underlying Matroska/WebM muxer, i.e. the AVFormatContext used to write
these packets had a NULL as AVIOContext for output. This is behind the
crash in ticket #5752 .
2. If an error happens during writing a packet, the underlyimg
Matroska/WebM muxer context is freed. This leads to a use-after-free
coupled with a double-free in webm_chunk_write_trailer (which supposes
that the underlying AVFormatContext is still valid).
3. Even when no error occurs at all, webm_chunk_write_trailer is still
buggy: After the underlying Matroska/WebM muxer has written its trailer,
ending the chunk implicitly flushes it again which is illegal at this
point.
These bugs have been fixed.
Fixes #5752 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 8c6ee7626b )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 22:10:02 +02:00
Andreas Rheinhardt
8d90a8cb37
avcodec/cbs_av1: Fix writing uvlc numbers >= INT_MAX
...
Fixes: assertion failure
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 23264/clusterfuzz-testcase-minimized-ffmpeg_BSF_AV1_METADATA_fuzzer-6308429248593920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 6f06c17a55 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 17:16:06 +02:00
Andreas Rheinhardt
0df1210631
avcodec/bitstream: Don't check for undefined behaviour after it happened
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 5e196dac22 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 16:59:01 +02:00
Andreas Rheinhardt
dc84430172
libavcodec/libvpxenc: Don't free user-provided AVPacket
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 26b4509690 )
2020-05-23 20:34:51 +02:00
Andreas Rheinhardt
68f5905f3c
libavcodec/libmp3lame: Don't free user-provided AVPacket
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 7e6941e185 )
2020-05-23 20:34:51 +02:00
Andreas Rheinhardt
8efc398218
avcodec/libopusenc: Don't free user-provided AVPacket
...
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit b803993b6d )
2020-05-23 20:34:51 +02:00
James Almer
6376b6b00b
avcodec/cbs_h265: fix writing extension_data bits
...
We only care about the right most bit.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 38d1815cc6 )
2020-05-03 18:50:22 -03:00
Andreas Rheinhardt
41b03de299
avformat/matroskadec: Fix default value of BlockAddID
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit dbc50f8a93 )
2020-04-03 21:19:05 +02:00
Andreas Rheinhardt
de3d708dbf
avformat/dashdec: Don't allocate and leak strings that are never used
...
Since commit e134c203 strdups of several elements of a manifest are kept
in the DASHContext; but said commit completely forgot to free these
strings again (with xmlFree()). Given that these strings are never used
at all, this commit closes this leak by reverting said commit.
This reverts commit e134c20374 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 3c138e5ceb )
2020-03-30 08:07:26 +02:00
Carl Eugen Hoyos
4521700f29
lavf/hlsenc: Do not mix declarations and code.
...
Fixes the following warnings:
libavformat/hlsenc.c: In function 'hls_write_trailer':
libavformat/hlsenc.c:2364:17: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement]
uint8_t *buffer = NULL;
^~~~~~~
libavformat/hlsenc.c:2372:17: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement]
int byterange_mode = (hls->flags & HLS_SINGLE_FILE) || (hls->max_seg_size > 0);
^~~
libavformat/hlsenc.c:2379:13: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement]
int range_length = 0;
^~~
(cherry picked from commit fc94e9704e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-07 10:53:38 +01:00
Michael Niedermayer
2f54cd9548
Update for FFmpeg 4.1.5
2020-01-06 16:38:20 +01:00
Michael Niedermayer
4062a67d9d
Changelog: Fix formating for 4.1.4
2020-01-06 16:37:21 +01:00
Fei Wang
c96a52b714
avcodec/cbs_av1: avoid reading trailing bits when obu type is OBU_TILE_LIST
...
Signed-off-by: Fei Wang <fei.w.wang@intel.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 1ea44178f5 )
2020-01-06 12:14:02 -03:00
James Almer
3413eb6091
avcodec/av1_parser: skip frames with spatial_id > 0
...
This fixes marking keyframes in svc samples.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 5985ca0436 )
2020-01-06 12:10:44 -03:00
Mark Thompson
07afe2e3ca
cbs_h264: Fix missing inferred colour description fields
...
With video_signal_type_present_flag set but colour_description_present_flag
unset the colour fields would not have had their correct values inferred.
(cherry picked from commit f9b8503639 )
2020-01-06 12:03:38 -03:00
James Almer
1ad3418519
avcodec/cbs_av1: keep separate reference frame state for reading and writing
...
In scearios where a Temporal Unit is written right after reading it using the same
CBS context (av1_metadata, av1_frame_merge, etc), the reference frame state used
by the writer must not be the state that's the result of the reader having already
parsed the current frame in question.
This fixes writing Switch frames, and frames using short ref signaling.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 4e2bef6a82 )
2020-01-06 11:56:04 -03:00
James Almer
8ad03481f3
avcodec/cbs_av1: fix reading reference order hint in skip_mode_params()
...
Reviewed-by: Ronald S. Bultje <rsbultje@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 2703068110 )
2020-01-06 11:51:23 -03:00
Gyan Doshi
9a992aadf0
configure: bump year
...
(cherry picked from commit 7b58702cbd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
d46875ce54
avcodec/pgssubdec: Free subtitle on error
...
Fixes: Assertion failure
Fixes: 19753/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGSSUB_fuzzer-5688461843759104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b0a718923b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
d79db0e0a1
avcodec/ffwavesynth: Fix undefined overflow in wavesynth_synth_sample()
...
Fixes: signed integer overflow: 2147464192 + 21176 cannot be represented in type 'int'
Fixes: 19042/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5719828090585088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fa47f6412d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
36f5f748b7
avcodec/cook: Use 3 stage VLC decoding for channel_coupling
...
Fixes: shift exponent -1 is negative
Fixes: out of array read
Fixes: 19028/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5759766471376896
Fixes: 19037/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5734106625474560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 89fd76db71 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
74ef2ddbdb
avcodec/wmalosslessdec: Fixes undefined overflow in dequantization in decode_subframe()
...
Fixes: signed integer overflow: 47875596 * 45 cannot be represented in type 'int'
Fixes: 19082/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5687766512041984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53efab44a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
7f4c5ede99
avcodec/sonic: Check e in get_symbol()
...
Fixes: signed integer overflow: 1721520852 + 1721520852 cannot be represented in type 'int'
Fixes: 18346/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5709623893426176
Fixes: 18753/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5663299131932672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aea6755611 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
5a485d052a
avcodec/twinvqdec: Correct overflow in block align check
...
Fixes: signed integer overflow: 538976288 * 8 cannot be represented in type 'int'
Fixes: 19126/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TWINVQ_fuzzer-5687464110325760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4dc93ae3d7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
99e424546c
avcodec/vc1dec: Fix "return -1" cases
...
Reviewed-by: "mypopy@gmail.com " <mypopy@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 26f040bcb4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
6f3967255d
avcodec/vc1dec: Free sprite_output_frame on error
...
Fixes: memleaks
Fixes: 19471/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5688035714269184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ee9240be3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
f8dc85589e
avcodec/atrac9dec: Clamp band_ext_data to max that can be read if skipped.
...
Fixes: out of array read
Fixes: 19327/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5679823087468544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 18ff210efb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
332f7a4c00
avcodec/wmadec: Keep track of exponent initialization per channel
...
Fixes: division by 0
Fixes: 19123/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5655493121146880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf5c850b79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
8e75a69850
avcodec/iff: Check that video_size is large enough for the read parameters
...
video is allocated before parameters like bpp are read.
Fixes: out of array access
Fixes: 19084/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5718556033679360
Fixes: 19465/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5759908398235648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f1b97f62f8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
780e8ac273
avcodec/cbs_vp9: Check data_size
...
Fixes: out of array access
Fixes: 19542/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5659498341728256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4fa2d5a692 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
98e15ff21b
avcodec/cbs_vp9: Check index_size
...
Fixes: out of array read
Fixes: 19300/clusterfuzz-testcase-minimized-ffmpeg_BSF_VP9_METADATA_fuzzer-5653911730126848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d6553e2e60 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
8d4ab4e66d
avcodec/adpcm: Clip predictor for APC
...
Fixes: signed integer overflow: -2147483648 - 13 cannot be represented in type 'int'
Fixes: 18893/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_APC_fuzzer-5630760442920960
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9fe07908c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
6537cb9b48
avcodec/targa: Check colors vs. available space
...
Fixes: Timeout (37sec -> 52ms)
Fixes: 18892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TARGA_fuzzer-5739537854889984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 01593278ce )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
bc94b45e94
avcodec/dstdec: Use get_ur_golomb_jpegls()
...
Fixes: shift exponent -4 is negative
Fixes: 17793/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5766088435957760
Fixes: 18989/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5175008116867072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a76690c02b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
a08a0c97a4
avcodec/wmavoice: Check remaining input in parse_packet_header()
...
Fixes: Infinite loop
Fixes: 18914/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5731902946541568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 19c41969b2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
66582e349e
avcodec/wmalosslessdec: Fix 2 overflows in mclms
...
Fixes: signed integer overflow: 2038337026 + 109343477 cannot be represented in type 'int'
Fixes: 18886/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5673660505653248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 92455c8c65 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
8065e60220
avcodec/wmaprodec: Fixes integer overflow with 32bit samples
...
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 18860/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAPRO_fuzzer-5755223125786624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a9cc69c0d5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
6f2f504d3e
avcodec/adpcm: Fix invalid shift in xa_decode()
...
Fixes: left shift of negative value -1
Fixes: 18859/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_XA_fuzzer-5748474213040128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 50db30b47d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
7417d4f908
avcodec/wmalosslessdec: Fix several integer issues
...
Fixes: shift exponent -1 is negative (and others)
Fixes: 18852/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5660855295541248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec3fe67074 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
0de012a9e7
avcodec/wmalosslessdec: Check that padding bits is not more than sample bits
...
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 18817/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5713317180211200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d42826580 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
e6f31fa16c
avcodec/iff: Skip overflowing runs in decode_delta_d()
...
Fixes: Timeout (107sec - 75ms>
Fixes: 18812/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-6295585225441280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 185f441ba2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
4b521929cf
avcodec/pnm: Check that the header is not truncated
...
Fixes: Ticket8430
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c94cb8d9b2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
8bdb8b5689
avcodec/mp3_header_decompress_bsf: Check sample_rate_index
...
Fixes: out of array read
Fixes: 19309/clusterfuzz-testcase-minimized-ffmpeg_BSF_MP3_HEADER_DECOMPRESS_fuzzer-5651002950942720
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f064c7c449 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
627d5ff890
avcodec/cbs_av1_syntax_template: Check num_y_points
...
"It is a requirement of bitstream conformance that num_y_points is less than or equal to 14."
Fixes: index 24 out of bounds for type 'uint8_t [24]'
Fixes: 19282/clusterfuzz-testcase-minimized-ffmpeg_BSF_AV1_FRAME_MERGE_fuzzer-5747424845103104
Note, also needs a23dd33606
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: jamrial
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bbe27890ff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
James Almer
6850c5e4cd
avcodec/cbs_av1: fix array size for ar_coeffs_cb_plus_128 and ar_coeffs_cr_plus_128
...
Taking into account the code
fb(2, ar_coeff_lag);
num_pos_luma = 2 * current->ar_coeff_lag * (current->ar_coeff_lag + 1);
if (current->num_y_points)
num_pos_chroma = num_pos_luma + 1;
else
num_pos_chroma = num_pos_luma;
Max value for ar_coeff_lag is 3 (two bits), for num_pos_luma 24, and for
num_pos_chroma 25.
Both ar_coeffs_cb_plus_128 and ar_coeffs_cr_plus_128 may have up to
num_pos_chroma values.
Reviewed-by: Ronald S. Bultje <rsbultje@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit a23dd33606 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
5ce0c254dd
avformat/rmdec: Initialize and sanity check offset in ivr_read_header()
...
Fixes: signed integer overflow: -9223372036854775808 - 17 cannot be represented in type 'long'
Fixes: 18768/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5674385247830016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7e665e4a81 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
6355dde556
avcodec/apedec: Fix 2 integer overflows
...
Fixes: signed integer overflow: 2119056926 - -134217728 cannot be represented in type 'int'
Fixes: 18728/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5747539563511808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6e15ba2d1f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Andreas Rheinhardt
6770f09066
avformat/id3v2: Fix double-free on error
...
ff_id3v2_parse_priv_dict() uses av_dict_set() with the flags
AV_DICT_DONT_STRDUP_KEY and AV_DICT_DONT_STRDUP_VAL. In this case both
key and value are freed on error (and owned by the destination
dictionary on success), so that freeing them again on error is a
double-free and therefore forbidden. But it nevertheless happened.
Fixes CID 1452489 and 1452421.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 67d4940a77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
caa7f10047
avcodec/wmaprodec: Set packet_loss when we error out on a sanity check
...
Fixes: left shift of negative value -34
Fixes: 18719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAPRO_fuzzer-5642658173419520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a9cbd25d89 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
2b5abf94de
avcodec/wmaprodec: Check offset
...
Fixes: index 33280 out of bounds for type 'float [32768]'
Fixes: 18718/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA2_fuzzer-5635373899710464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5473c7825e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
b26f303865
avcodec/truemotion2: Fix 2 integer overflows in tm2_low_res_block()
...
Fixes: signed integer overflow: 1778647621 + 574372924 cannot be represented in type 'int'
Fixes: 18692/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-6248679635943424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93d52a181e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
745040d269
avcodec/wmaprodec: Check if the channel sum of all internal contexts match the external
...
Fixes: NULL pointer dereference
Fixes: 18689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA1_fuzzer-5715114640015360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 090ac57997 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
53a03d98bd
avcodec/atrac9dec: Check q_unit_cnt more completely before using it to access at9_tab_band_ext_group
...
Fixes: index 8 out of bounds for type 'const uint8_t [8][3]'
Fixes: 19127/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5709394985091072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e1d836d237 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
9c026dd94d
avcodec/fitsdec: Use lrint()
...
Fixes: fate-fitsdec-bitpix-64
Possibly Fixes: -nan is outside the range of representable values of type 'unsigned short'
Possibly Fixes: 17769/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5678314672357376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 37f31f4e50 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 15:03:15 +01:00
Michael Niedermayer
0667c14ad6
avcodec/g729dec: require buf_size to be non 0
...
The 0 case was added with the support for multiple packets. It
appears unintended and causes extra complexity and out of array
accesses (though within padding)
No testcase
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f64be9da4c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
1792310910
avcodec/alac: Fix integer overflow in lpc_prediction() with sign
...
Fixes: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
Fixes: 18643/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5672182449700864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7686ba1f14 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
e9fa01eb60
avcodec/wmaprodec: Fix buflen computation in save_bits()
...
Fixes: Assertion failure
Fixes: 18630/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAPRO_fuzzer-5201588654440448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 589cb44498 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
54c0706a2d
avcodec/vc1_block: Fix integer overflow in AC rescaling in vc1_decode_i_block_adv()
...
Fixes: signed integer overflow: 50176 * 262144 cannot be represented in type 'int'
Fixes: 18629/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5182370286403584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e010e489b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
600e1df9a5
avcodec/vmdaudio: Check chunk counts to avoid integer overflow
...
Fixes: signed integer overflow: 4 * 538976288 cannot be represented in type 'int'
Fixes: 18622/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMDAUDIO_fuzzer-5092166174507008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47d963335e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
3b8512ae09
avformat/mxfdec: Clear metadata_sets_count in mxf_read_close()
...
This avoids problems if the function is called twice
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 13816a1d08 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
ad3c8540f8
avcodec/nuv: Use ff_set_dimensions()
...
Fixes: OOM
Fixes: 18956/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-5766505644163072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1ca978d636 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
03d5c402f0
avcodec/ffwavesynth: Fix integer overflow with pink_ts_cur/next
...
Fixes: signed integer overflow: 6175076100092079360 - -5034989061050195840 cannot be represented in type 'long'
Fixes: 18614/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5704508847423488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d82ab96e76 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
aaec28913f
avcodec/ralf: Fix integer overflows with the filter coefficient in decode_channel()
...
Fixes: signed integer overflow: 1145975808 - -1146173210 cannot be represented in type 'int'
Fixes: 18616/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5121296757424128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 721624c2f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
2f5dbf9b15
avcodec/g729dec: Use 64bit and clip in scalar product
...
The G729 reference decoder clips after each individual operation and keeps track if overflow
occurred (in the fixed point implementation), this here is
simpler and faster but not 1:1 the same what the reference does.
Non fuzzed samples which trigger any such overflow are welcome, so
the need and impact of different clipping solutions can be evaluated.
Fixes: signed integer overflow: 1271483721 + 1073676289 cannot be represented in type 'int'
Fixes: 18617/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5137705679978496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf9c4a1275 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
34e6544424
avcodec/mxpegdec: Check for multiple SOF
...
Fixes: Timeout (14sec -> 9ms)
Fixes: 18598/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-5726095261564928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 75b64e5aa3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
132344fcba
avcodec/nuv: Move comptype check up
...
Fixes: Timeout (23sec -> 5ms)
Fixes: 18517/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-5753135536013312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1138cdecbe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
4edd992a65
avcodec/wmavoice: Fix integer overflow in synth_frame()
...
Fixes: left shift of negative value -3
Fixes: 18518/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-6560514359951360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf323f4d38 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
5574daa690
avcodec/rawdec: Check bits_per_coded_sample more pedantically for 16bit cases
...
Fixes: shift exponent -14 is negative
Fixes: 18335/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RAWVIDEO_fuzzer-5723267192586240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5634e20525 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
1109a736ef
avutil/lfg: Correct index increment type to avoid undefined behavior
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 18333/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COMFORTNOISE_fuzzer-5668481831272448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6014bcf1b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
084a3e582b
avcodec/cngdec: Remove AV_CODEC_CAP_DELAY
...
As is the decoder will never stop, it will cause an infinite loop. The RFC seems only
to speak of non empty packets so endlessly generating noise from the last empty flush
packets seems wrong.
Fixes: infinite loop
Fixes: 18333/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COMFORTNOISE_fuzzer-5668481831272448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 327a968817 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
6783232dfe
avcodec/iff: Move index use after check in decodeplane8()
...
Fixes: index 9 out of bounds for type 'const uint64_t [8][256]'
Fixes: 18409/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5767030560522240
Fixes: 18720/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5651995784642560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1f8b36cc4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
71d17a2827
avcodec/atrac3: Check for huge block aligns
...
The largest documented frame size = block align is 1024 bytes
(https://wiki.multimedia.cx/index.php/ATRAC3 )
Without a limit this can allocate arbitrary memory and trigger OOM
Fixes: OOM
Fixes: 18337/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3_fuzzer-5763861478637568
Fixes: 18556/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3AL_fuzzer-5646183334936576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f09151fff9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
4d53c962ed
avcodec/ralf: use multiply instead of shift to avoid undefined behavior in decode_block()
...
Fixes: left shift of negative value -249
Fixes: 18566/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5649394561187840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b7d02642b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
7b81868a25
avcodec/wmadec: Require previous exponents for reuse
...
Fixes: division by zero
Fixes: 18474/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5764986962182144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c54b9fc42f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
864649067b
avcodec/vc1_block: Fix undefined behavior in ac prediction rescaling
...
The intermediates are required to fit in 12bit (8.1.3.9 Coefficient Scaling)
See SMPTE 421M-2006 and Amendment 1-2007
Fixes: signed integer overflow: -20691 * 262144 cannot be represented in type 'int'
Fixes: 18479/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5128912371187712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7fc1baf0ca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
65cda31ace
avcodec/qdm2: The smallest header seems to have 2 bytes so treat 1 as invalid
...
Fixes: Timeout (217sec -> 2ms)
Fixes: 18488/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5708293662310400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e36ccb5048 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
1baae1c8f1
avcodec/apedec: Fixes integer overflow of res+*data in do_apply_filter()
...
Fixes: signed integer overflow: 7400 + 2147482786 cannot be represented in type 'int'
Fixes: 18405/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5708834760294400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dc3f327e74 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
6778b3c927
avcodec/sonic: Fix integer overflow in predictor_calc_error()
...
Fixes: signed integer overflow: 5 * -1094995529 cannot be represented in type 'int'
Fixes: 18346/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5709623893426176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8c17b8cef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
3ba7629104
avcodec/atrac9dec: Check precision_fine/coarse
...
Clipping is done as it was preferred in review
See: [FFmpeg-devel] [PATCH 1/5] avcodec/atrac9dec: Check precision_fine/coarse
Fixes: out of array access
Fixes: 18330/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5641113058148352
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 19b8db2908 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
cf6f4e0d68
avformat/mp3dec: Check that the frame fits within the probe buffer
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e9a335150a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
88c8195526
avcodec/wmaprodec: get frame during frame decode
...
Fixes: memleak
Fixes: 17615/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA2_fuzzer-5681306024804352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0f89a2293e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
fdc350ec5f
avcodec/interplayacm: Fix overflow of last unused value
...
Fixes: signed integer overflow: -2147450880 - 65535 cannot be represented in type 'int'
Fixes: 18393/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5667520110919680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 10eabb8e40 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
a5636c1d4c
avcodec/adpcm: Fix undefined behavior with negative predictions in IMA OKI
...
Fixes: left shift of negative value -30
Fixes: 18392/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_OKI_fuzzer-5631771831435264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7786f6c30e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
b7d552e222
avcodec/cook: Move up and extend block_align check
...
Fixes: signed integer overflow: 2046820356 * 8 cannot be represented in type 'int'
Fixes: 18391/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5631674666188800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1c63edcdd2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
8a52366349
avcodec/sbcdec: Fix integer overflows in sbc_synthesize_four()
...
Fixes: signed integer overflow: 1494495519 + 1494495519 cannot be represented in type 'int'
Fixes: 18347/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SBC_fuzzer-5711714661695488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 00e469fb61 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
96e6ef9abe
avcodec/twinvq: Check block_align
...
Fixes: signed integer overflow: 538976288 * 8 cannot be represented in type 'int'
Fixes: 18348/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_METASOUND_fuzzer-6681325716635648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 97f778e9c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
a2b7e3bacc
avcodec/cook: Enlarge gain table
...
Fixes: index 25 out of bounds for type 'float [23]'
Fixes: 18355/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5641398941908992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 50001cd440 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
a85bfe3a4f
avcodec/cook: Check samples_per_channel earlier
...
Fixes: division by zero
Fixes: 18362/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5653727679086592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 57750bb629 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
27b1e6cd86
avcodec/atrac3plus: Check split point in fill mode 3
...
Fixes: index 32 out of bounds for type 'int [32]'
Fixes: 18350/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3P_fuzzer-5643794862571520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit de5102fd92 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
d05aa7459f
avcodec/wmavoice: Check sample_rate
...
Fixes: left shift of 538976288 by 8 places cannot be represented in type 'int'
Fixes: 18376/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5741645391200256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 55c97a7637 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
dfa089ccb3
avcodec/xsubdec: fix overflow in alpha handling
...
Fixes: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 18368/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XSUB_fuzzer-5702665442426880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9ea9973959 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
960f93f364
avcodec/iff: Check available space before entering loop in decode_long_vertical_delta2() / decode_long_vertical_delta()
...
Fixes: Timeout (31sec -> 41ms)
Fixes: 18380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5645210121404416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 32b3c8ce7d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
585c67b024
avcodec/apedec: Fix integer overflow in filter_3800()
...
Fixes: signed integer overflow: 2117181180 + 60483298 cannot be represented in type 'int'
Fixes: 18344/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5685327791915008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1c038c5c63 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
20459d3b10
avutil/lfg: Document the AVLFG struct
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d6fea2ef22 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
456faf0ddf
avcodec/ffv1dec: Use a different error message for the slice level CRC
...
This way they can be told apart easily
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df498cf544 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
284680576c
avcodec/apedec: Fix undefined integer overflow in long_filter_ehigh_3830()
...
Fixes: signed integer overflow: -1094995529 * 2 cannot be represented in type 'int'
Fixes: 18281/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5692589180715008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1d1719a44d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
8d5bde96ba
avcodec/dstdec: Check that AC probabilities are within range
...
ISO/IEC 14496-3:2005(E): "Each entry of P_one[ ][ ] is in the range of 1 to
128, corresponding to a probability of 1/256 to 128/256 of the next error bit (bit E, See Figure 10.5)..."
Fixes: Timeout (42sec ->1sec)
Fixes: 18181/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5736646250594304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c3e1b395b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
f4bdb532fc
avcodec/dstdec: Check read_table() for failure
...
Fixes: Timeout (too long -> 42sec)
Fixes: 18181/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5736646250594304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 03ea8d8cd4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
22e645c56a
avcodec/snowenc: Set mb_num to avoid ratecontrol floating point divisions by 0.0
...
Fixes: Ticket7990
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 55279d699f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
1b375b5036
avcodec/snowenc: Fix 2 undefined shifts
...
Fixes: Ticket7990
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8802e329c8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
590c951857
avformat/nutenc: Do not pass NULL to memcmp() in get_needed_flags()
...
This compared to the other suggestions is cleaner and easier to understand
keeping the condition in the if() simple.
This affects alot of fate tests.
See: [FFmpeg-devel] [PATCH 05/11] avformat/nutenc: Don't pass NULL to memcmp
See: [FFmpeg-devel] [PATCH]lavf/nutenc: Do not call memcmp() with NULL argument
Fixes: Ticket 7980
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e4fdeb3fce )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:44 +01:00
Michael Niedermayer
ec1c42405f
avcodec/aptx: Check the number of channels
...
Fixes: store to null pointer of type 'uint32_t' (aka 'unsigned int')
Fixes: 18021/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APTX_HD_fuzzer-5761738313564160
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 98a257c323 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
e7999e95ec
avcodec/aacdec_template: Check samplerate
...
Fixes: signed integer overflow: 2 * 1881153568 cannot be represented in type 'int'
Fixes: 17996/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5687126468853760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7730bacb41 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
80f74d043b
avcodec/truemotion2: Fix several integer overflows in tm2_low_res_block()
...
Fixes: signed integer overflow: 1077952576 + 1355863565 cannot be represented in type 'int'
Fixes: 16196/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5679842317565952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b655f55ea )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
e0571d455b
avcodec/utils: Check block_align
...
Fixes: out of array access
Fixes: 18432/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5675574936207360
Fixes: 18326/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5071752362721280
Fixes: 18384/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV1_fuzzer-5769439500304384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f011572e66 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
873422489d
avcodec/wmalosslessdec: Fix some integer anomalies
...
Fixes: left shift of negative value -341180
Fixes: 18401/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5686380134400000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d3dee676b8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
43988fffd9
avcodec/adpcm: Fix invalid shifts in ADPCM DTK
...
Fixes: left shift of negative value -1
Fixes: 18397/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_DTK_fuzzer-5675653487132672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 34e701ff93 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
2221f613eb
avcodec/apedec: Only clear the needed buffer space, instead of all
...
Fixes: Timeout (15sec -> 0.4sec)
Fixes: 18396/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5730080487112704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f17ea02001 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
a0d5f0ee3b
avcodec/libvorbisdec: Fix insufficient input checks leading to out of array reads
...
Fixes: 16144/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVORBIS_fuzzer-5638618940440576
Fixes: out of array read
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 069be4aa5d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
f860df25cc
avcodec/g723_1dec: fix invalid shift with negative sid_gain
...
Fixes: left shift of negative value -1
Fixes: 18395/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G723_1_fuzzer-5710313034350592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1850c3feaa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
56d708c57f
avcodec/vp5: Check render_x/y
...
Fixes: Timeout (15sec -> 91ms)
Fixes: 18353/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP5_fuzzer-5704150326706176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 698e042c77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
7358e165c6
avcodec/qdrw: Check input for header/skiped space before get_buffer()
...
Fixes: Timeout (21sec -> 0.8sec)
Fixes: 17990/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDRAW_fuzzer-5200374436200448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b63fbc19c0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
385e715138
avcodec/ralf: Skip initializing unused filter variables
...
Fixes: left shift of negative value -1
Fixes: 17890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5643307467669504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f4ecf6c39d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
e804321367
avcodec/takdec: Fix overflow with large sample rates
...
Fixes: signed integer overflow: 2147483647 + 511 cannot be represented in type 'int'
Fixes: 17899/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5719753322135552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 42eb78059d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
dfb5dc4073
avcodec/atrac9dec: Set channels
...
Fixes: null pointer dereference
Fixes: 18341/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5681203490848768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e85eb7cb04 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
d47c4185d5
avcodec/alsdec: Check that input space for header exists in read_diff_float_data()
...
Fixes: Timeout (21sec -> 8sec)
Fixes: 17832/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5737092172218368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 09581f7923 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
551f84689f
avformat/pjsdec: Check duration for overflow
...
Fixes: signed integer overflow: -3 - 9223372036854775807 cannot be represented in type 'long'
Fixes: 17828/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5645915116797952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1efaac6932 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
2c6beca3dc
avcodec/ptx: Check that the input contains at least one line
...
Fixes: Timeout (19sec -> 44ms)
Fixes: 17816/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PTX_fuzzer-5704459950227456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6ad328256 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
d08362ecbc
avcodec/alac: Fix integer overflow in LPC
...
Fixes: signed integer overflow: 2147483628 + 128 cannot be represented in type 'int'
Fixes: 17783/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5146470595952640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 44b73a0568 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
c9be168ac1
avcodec/smacker: Fix integer overflows in pred[] in smka_decode_frame()
...
Fixes: signed integer overflow: -2147481503 + -32732 cannot be represented in type 'int'
Fixes: 17782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKAUD_fuzzer-5769672225456128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a76897e19c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
b30d2683c4
avcodec/aliaspixdec: Check input size against minimal picture size
...
Fixes: Timeout (15sec -> 72ms)
Fixes: 17774/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALIAS_PIX_fuzzer-5193929107963904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c69310477 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
a62cb90385
avcodec/ffwavesynth: Fix integer overflows in pink noise addition
...
Fixes: signed integer overflow: -1795675744 + -1926578528 cannot be represented in type 'int'
Fixes: 17741/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5131336402075648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7916b6863c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
15e0e6e873
avcodec/vc1_block: Fixes integer overflow in vc1_decode_i_block_adv()
...
Fixes: signed integer overflow: 62220 * 262144 cannot be represented in type 'int'
Fixes: 17145/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5667394743173120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6fdeb20817 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
a705362dbd
avcodec/wmalosslessdec: Check block_align
...
Fixes: NULL pointer dereference
Fixes: 18331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5652847445671936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1c799271e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
a0c91fb0f0
avcodec/g729postfilter: Fix left shift of negative value
...
Fixes: Ticket8176
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f0acc5064 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
7bf2546301
avcodec/binkaudio: Check sample rate
...
Fixes: signed integer overflow: 1092624416 * 2 cannot be represented in type 'int'
Fixes: 18045/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINKAUDIO_RDFT_fuzzer-5718519492116480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2fca09bce4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
c7520f4825
avcodec/sbcdec: Fix integer overflows in sbc_synthesize_eight()
...
Fixes: signed integer overflow: 518484152 + 1868182638 cannot be represented in type 'int'
Fixes: 17732/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SBC_fuzzer-5663738132168704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c70d547751 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
c5ecfccb5f
avcodec/adpcm: Check initial predictor for ADPCM_IMA_EA_EACS
...
Fixes: signed integer overflow: -2147483360 - 631 cannot be represented in type 'int'
Fixes: 17701/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_EA_EACS_fuzzer-5711517319692288
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f66e8436d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
dfcd3ad2bc
avcodec/g723_1dec: Fix overflow in shift
...
Fixes: shift exponent 1008 is too large for 32-bit type 'int'
Fixes: 17700/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G723_1_fuzzer-5707633436131328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 07732f12a4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
4d392fc27c
avcodec/apedec: Fix integer overflow in predictor_update_3930()
...
Fixes: signed integer overflow: -69555262 * 31 cannot be represented in type 'int'
Fixes: 17698/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5728970447781888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c072c9ed7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
fa9ca0b663
avcodec/g729postfilter: Fix undefined intermediate pointers
...
Fixes: index -49 out of bounds for type 'int16_t [192]'
Fixes: 17689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5756275014500352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c61661a2c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
45e31d6dd0
avcodec/g729postfilter: Fix undefined shifts
...
Fixes: left shift of negative value -12
Fixes: 17689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5756275014500352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6a4fdbf112 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
b977836eda
avcodec/lsp: Fix undefined shifts in lsp2poly()
...
Fixes: left shift of negative value -30635
Fixes: 17689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5756275014500352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b93f52cd6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
17e3552008
avcodec/adpcm: Fix left shifts in AV_CODEC_ID_ADPCM_EA
...
Fixes: left shift of negative value -1
Fixes: 17683/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_EA_R2_fuzzer-5111690013704192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8695fbec57 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
881b3de55a
avformat/shortendec: Check k in probe
...
Fixes: Assertion failure
Fixes: 17640/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5708767475269632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea770eb559 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
f238fcdb3e
avfilter/vf_geq: Use av_clipd() instead of av_clipf()
...
With floats we cannot represent all 32bit integer dimensions
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8813b1a98 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
6247243e07
avcodec/wmaprodec: Check that the streams channels do not exceed the overall channels
...
Fixes: NULL pointer dereference
Fixes: 18075/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA1_fuzzer-5708262036471808
Fixes: 18087/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA1_fuzzer-5740627634946048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e418b315dd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
0240d56daf
avcodec/qdmc: Check input space in qdmc_get_vlc()
...
Fixes: Timeout (125sec -> 0.4sec)
Fixes: 18059/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDMC_fuzzer-5656195825664000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c7975fe6f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
3088c82476
avcodec/pcm: Check bits_per_coded_sample
...
Fixes: shift exponent -2 is negative
Fixes: 17736/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PCM_F16LE_fuzzer-5742815929171968
Fixes: 17998/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PCM_F24LE_fuzzer-5716980383875072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5de19160a3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
25a7110651
avcodec/exr: Allow duplicate use of channel indexes
...
Fixes: Ticket #8203
Reported-by: durandal_1707
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 080819b3b4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
9c2659f4ab
avcodec/fitsdec: Fail on 0 naxisn
...
Fixes: Timeout (100+ sec -> 23ms)
Fixes: 17769/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5678314672357376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a3303d520 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
39183277ef
avcodec/dxv: Subtract 12 earlier in dxv_decompress_cocg()
...
the data_start is after reading 12 bytes and if its subtracted
at the very end the intermediate might overflow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dd9e6d077e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
97244c8c62
libavcodec/dxv: Remove redundant seek
...
This seeks to the position the previous call to dxv_decompress_opcodes()
positioned us in case of success
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c371e50b4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
71e56b44ed
avcodec/ituh263dec: Check input for minimal frame size
...
Fixes: Timeout (28sec -> 3sec)
Fixes: 17559/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H263_fuzzer-5681050776240128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f0498ed46 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
cc2a919086
avcodec/truemotion1: Check that the input has enough space for a minimal index_stream
...
Fixes: Timeout (18sec -> 0.4sec)
Fixes: 17585/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION1_fuzzer-5117015135617024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a660fac98 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
e8206b63ad
avformat/mpsubdec: Clear queue on error
...
Fixes: Memleaks
Fixes: 17219/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5720539124989952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9a0d36e562 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
3a661be4c4
avcodec/sunrast: Check that the input is large enough for the maximally compressed image
...
Fixes: Timeout (17sec -> 15ms)
Fixes: 17224/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SUNRAST_fuzzer-5663218491457536
Fixes: 17224/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SUNRAST_fuzzer-5735590015795200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf0ba75c4a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
b1ae124919
avcodec/sunrast: Check for availability of maplength before allocating image
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 711ad71aea )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
1da6cfeccb
avformat/subtitles: Check nb_subs in ff_subtitles_queue_finalize()
...
Fixes: null pointer dereference
Fixes: 17828/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5645915116797952
Fixes: Ticket8147
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 81b53913bb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
317c63d3f4
avcodec/vc1_block: Fix invalid left shift in vc1_decode_p_mb()
...
Fixes: left shift of negative value -6
Fixes: 17810/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5638541240958976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f588ccfb7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
3ae6eee2a7
avcodec/wmaprodec: Check if there is a stream
...
Fixes: null pointer dereference
Fixes: signed integer overflow: 512 * 2147483647 cannot be represented in type 'int'
Fixes: 17809/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA1_fuzzer-5634409947987968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9b533de28e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
c8823d4957
avcodec/g2meet: Check for end of input in jpg_decode_block()
...
Fixes: Timeout (100sec -> 0.7sec)
Fixes: 8668/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5174143888130048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 61dd2e07be )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
a547d59079
avcodec/g2meet: Check if adjusted pixel was on the stack
...
This basically checks if a pixel that was coded with prediction
and residual could have been stored using a previous case.
This avoids basically a string of 0 symbols stored in less than
50 bytes to hit a O(n²) codepath.
Fixes: Timeout (too slow to wait -> immediately)
Fixes: 8668/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-4895946310680576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c84c162e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
e644b74074
avformat/electronicarts: If no packet has been read at the end do not treat it as if theres a packet
...
Fixes: Assertion failure
Fixes: 17770/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5700606668308480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4de49edc4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
45836a60f5
avcodec/dxv: Check op_offset in dxv_decompress_yo()
...
Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type 'int'
Fixes: 17745/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_fuzzer-5734628463214592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 97450d2b6a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
5e3a827e9d
avcodec/utils: Check sample_rate before opening the decoder
...
Fixes: signed integer overflow: 2 * -1306460384 cannot be represented in type 'int'
Fixes: 17685/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_fuzzer-5747390337777664
Fixes: 17688/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5739287210885120
Fixes: 17699/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5678394531905536
Fixes: 17738/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5763415733174272
Fixes: 17746/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINKAUDIO_RDFT_fuzzer-5703008159006720
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 75fefb1fb7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
f5636c5b20
avcodec/aptx: Fix multiple shift anomalies
...
Fixes: left shift of negative value -24576
Fixes: 17719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APTX_fuzzer-5710508002377728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 675f62a202 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
James Almer
781a4a43b5
avcodec/fitsdec: fix use of uninitialised values
...
header.data_max and header.data_min are not necessarely set on all decoding scenarios.
Fixes a Valgrind reported regression since cfa1937791 .
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit e3f0ecfc57 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
dc5760a909
avcodec/motionpixels: Mark 2 functions as always_inline
...
Fixes: Timeout (30sec -> 25sec)
Fixes: 17050/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOTIONPIXELS_fuzzer-5719149803732992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 017884bdc3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
20a923a3ae
avcodec/ituh263dec: Make the condition for the studio slice start code match between ff_h263_resync() and ff_mpeg4_decode_studio_slice_header()
...
If they mismatch an infinite loop can occur
Fixes: Timeout (infinite loop)
Fixes: 17043/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5695051748868096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8335ba8ae9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
6b9a6088d6
avcodec/ralf: Fix integer overflow in decode_channel()
...
Fixes: signed integer overflow: -1094995519 * 64 cannot be represented in type 'int'
Fixes: 17030/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5640695838146560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fbb314b6f2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
d3f8892249
vcodec/vc1: compute rangex/y only for P/B frames
...
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int'
Fixes: 16976/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-4847262047404032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e75e7fe160 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
26db773767
avcodec/vc1_pred: Fix invalid shifts in scaleforopp()
...
Fixes: left shift of negative value -2
Fixes: 16964/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5757853565976576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ced9a1cd0a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
a9788d00ee
avcodec/vc1_block: Fix invalid shift with rangeredfrm
...
Fixes: left shift of negative value -7
Fixes: 16959/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-5200360825683968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c722a69253 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
cd949baefd
avcodec/vc1: Check for excessive resolution
...
Fixes: overflow in aspect ratio calculation
Fixes: signed integer overflow: 393215 * 14594 cannot be represented in type 'int'
Fixes: 15728/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5661588893204480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 181e138da7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
79dffb7f2c
avcodec/vc1: check REFDIST
...
"9.1.1.43 P Reference Distance (REFDIST)"
"The value of REFDIST shall be less than, or equal to, 16."
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f7af9e294 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
fe51b4d5a0
avcodec/apedec: Fix several integer overflows in predictor_update_filter() and do_apply_filter()
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: signed integer overflow: -14527961 - 2147483425 cannot be represented in type 'int'
Fixes: 16380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5645957131141120
Fixes: 16968/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5716169901735936
Fixes: 17074/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5198710497083392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e95a3e8a7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
588c735ce5
avcodec/hevc_cabac: Tighten the limit on k in ff_hevc_cu_qp_delta_abs()
...
Values larger would fail subsequent tests.
Fixes: signed integer overflow: 5 + 2147483646 cannot be represented in type 'int'
Fixes: 16966/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5695709549953024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f63cd1963e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
9691f42ae9
avcodec/4xm: Check index in decode_i_block() also in the path where its not used.
...
Fixes: Infinite loop
Fixes: signed integer overflow: 2147483644 + 16 cannot be represented in type 'int'
Fixes: 16169/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5662570416963584
Fixes: 16782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5743163859271680
Fixes: 17641/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5711603562971136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 87ddf9f1ef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
b0c5ec9ab4
avcodec/loco: Check for end of input in the first line
...
Fixes: Timeout (85sec -> 0.1sec)
Fixes: 17634/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5666410809786368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c5a52eb5cd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
ba148f2329
avcodec/atrac3: Check block_align
...
Fixes: Infinite loop
Fixes: 17620/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3_fuzzer-5086123012915200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2acbbe2623 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
559280043d
avcodec/alsdec: Avoid dereferencing context pointer in inner interleave loop
...
This makes the decoder faster
Improves/Fixes: Timeout (22sec -> 20sec)
Testcase: 17619/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5078510820917248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 581a895c5c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
7e4d850a9f
avcodec/fitsdec: Prevent division by 0 with huge data_max
...
Fixes: division by 0
Fixes: 15657/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5738154838982656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cfa1937791 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
2567675f00
avcodec/dstdec: Fix integer overflow in samples_per_frame computation
...
Fixes: Timeout (? -> 2ms)
Fixes: 17616/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5198057947267072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7dc0943d4a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
86acbb0350
avcodec/g729_parser: Check block_size
...
Fixes: Infinite loop
Fixes: 17611/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5765134928052224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 972a0a818f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
a3f6f21506
avcodec/sbcdec: Initialize number of channels
...
Fixes: out of array access
Fixes: 17609/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SBC_fuzzer-5758729319874560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Reviewed-by: Moritz Barsnick <barsnick@gmx.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 02fb6a2147 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
18e5ce4d0d
avcodec/utils: Optimize ff_color_frame() using memcpy()
...
4650975 -> 4493240 dezicycles
This optimizes lines 2 and later. Line 1 still uses av_memcpy_backptr()
This change originally fixed ossfuzz 10790 but this is now fixed by other
optimizations already
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 95e5396919 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
e6cff05bef
avcodec/aacdec: Check if we run out of input in read_stream_mux_config()
...
Fixes: Infinite loop
Fixes: 16920/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5653421289373696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3dce4d03d5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
5d49cf9ac2
avcodec/utils: Use av_memcpy_backptr() in ff_color_frame()
...
Fixes: Timeout (191sec -> 53sec)
Fixes: 16908/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5711207859748864
Fixes: 10709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5630617975259136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 340ab13504 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
d07669ebc6
avcodec/smacker: Fix integer overflow in signed int multiply in SMK_BLK_FILL
...
Fixes: signed integer overflow: 238 * 16843009 cannot be represented in type 'int'
Fixes: 16958/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKER_fuzzer-5193905355620352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 033d2c4884 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
24b0e33b8b
avcodec/alac: Fix invalid shifts in 20/24 bps
...
Fixes: left shift of negative value -256
Fixes: 16892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-4880802642395136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b30c07cc2b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
60993e367f
avcodec/alac: fix undefined behavior with INT_MIN in lpc_prediction()
...
Fixes: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
Fixes: 16786/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5632818851348480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0831cbfe09 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
718eab1733
avcodec/ffwavesynth: Fix integer overflow in timestamps
...
Fixes: signed integer overflow: 9223371075321077760 * 2 cannot be represented in type 'long'
Fixes: 16447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5698937431785472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c7ccbf40ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
07b6caa309
avcodec/dxv: Check op_offset in both directions
...
Fixes: signed integer overflow: 61 + 2147483647 cannot be represented in type 'int'
Fixes: 15311/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_fuzzer-5742552826773504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c7d5fcfc3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
3f2f2b18c8
avcodec/adpcm: Check number of channels for MTAF
...
Fixes: out of array access
Fixes: 17608/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_MTAF_fuzzer-5074936267276288
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 74bbf9bc82 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
c526fc591a
avcodec/sunrast: Fix indention
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0728d64497 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
6579f1ac27
avcodec/sunrast: Fix return type for "unsupported (compression) type"
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e8b7709a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
f34c2a9f94
avcodec/utils: Check channels fully earlier
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 83f2555e5f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
a600c6fa02
avformat/mov: Check for EOF in mov_read_meta()
...
Fixes: Timeout (195sec -> 2ms)
Fixes: 16735/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5090676403863552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 093d1f4250 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
9365608099
avcodec/hevcdec: Fix memleak of a53_caption
...
Fixes: 15295/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5675655187922944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ef50cf7b32 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
0801d3cfa2
avformat/cdxl: Fix integer overflow in intermediate
...
Fixes: signed integer overflow: 65535 * 65312 cannot be represented in type 'int'
Fixes: 16704/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6294115603447808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c5575c8dc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
b91ee0ce18
avcodec/hevcdec: repeat character in skiped
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d2d8e797cc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
1a224677d3
avcodec/gdv: Replace assert() checking bitstream by if()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a9fae76370 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
3b61a7732d
libavcodec/utils: Free threads on init failure
...
Fixes: Multiple memleaks
Fixes: ffmpeg-memory-leak
Found-by: Francis Provencher <francis@protekresearchlab.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 61b055bed0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
ccad8e7175
avcodec/htmlsubtitles: Avoid locale dependant isdigit()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b94cf549e2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
81c2cf8646
avcodec/alsdec: Check k from being outside what our implementation can handle
...
The specification does not seem to list what the maximum valid
value is
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 16268/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5638164544225280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e125578994 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
eec70d9fbe
avcodec/takdec: Fix integer overflow in decorrelate()
...
Fixes: signed integer overflow: -2424832 - 2145653689 cannot be represented in type 'int'
Fixes: 16138/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5643451346976768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f119273649 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
2348a24c36
avcodec/aacps: Fix integer overflows in hybrid_synthesis()
...
Fixes: signed integer overflow: -822667928 + -1399761199 cannot be represented in type 'int'
Fixes: 15756/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5645182051024896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec749ed222 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
12e035b6fa
avcodec/mpeg4videodec: Fix integer overflow in mpeg4_decode_studio_block()
...
Fixes: signed integer overflow: 24023040 * 112 cannot be represented in type 'int'
Fixes: 16570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5173275211071488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Kieran Kunhya <kierank@obe.tv >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e4a0e962c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
77c60f16d7
avcodec/vp56rac: delay signaling an error on truncated input
...
A threshold of 1 is sufficient for simple_dump_cut.webm, 10 is used
just to be sure the next truncated file doesnt cause the same issue
Obvious alternative fixes are to simply accept that the file is broken or to
write some advanced error concealment or to
simply accept that the decoder wont stop at the end of input.
Fixes: Ticket 8069 (artifacts not the differing md5 which was there before 1afd246960 )
Fixes: simple_dump_cut.webm
Fixes: regression of 1afd246960
fate-vp5 changes because the last frame is truncated and now handled
differently.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b6b9ac5698 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
7a3223ebef
avcodec/qdm2: Check frame size
...
Fixes: index 2304 out of bounds for type 'float [2304]'
Fixes: 16332/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5679142481166336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 12b909ba31 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
5e4d9b6bf0
avcodec/vc1_pred: Fix refdist in scaleforopp()
...
Fixes: out of array access
Fixes: 16601/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5656105392275456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 413e0f2516 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
d4442a25e1
avcodec/vorbisdec: fix FASTDIV usage for vr_type == 2
...
This reverts a hunk from f1ca40ee00
Fixes: out of array read
Fixes: 16924/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5157893162139648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 722fd46965 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
6e0d6e373a
avcodec/iff: Check for overlap in cmap_read_palette()
...
Fixes: undefined memcpy() use
Fixes: 16302/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5678750575886336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dfa5d1a366 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
b7290b87ce
avcodec/apedec: Fix 32bit int overflow in do_apply_filter()
...
Fixes: signed integer overflow: 2147480546 + 4096 cannot be represented in type 'int'
Fixes: 16280/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5123442566758400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d3ddef519 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
e1a3eda6cc
avcodec/ralf: fix undefined shift in extend_code()
...
Fixes: left shift of negative value -3
Fixes: 16147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5658392722407424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4778407ab3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
544ad51ad6
avcodec/ralf: fix undefined shift
...
Fixes: left shift of negative value -2
Fixes: 16145/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5146671058518016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ee886988e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:43 +01:00
Michael Niedermayer
a78128bf0a
avcodec/bgmc: Check input space in ff_bgmc_decode_init()
...
Fixes: Infinite loop
Fixes: 16608/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5636229827133440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b54031a6e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
422d57feb2
avcodec/truemotion2: Fix multiple integer overflows in tm2_null_res_block()
...
Fixes: signed integer overflow: 1795032576 + 598344192 cannot be represented in type 'int'
Fixes: 16196/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5636723419119616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cc78783ce5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
74836bb41b
avcodec/vc1_block: Check the return code from vc1_decode_p_block()
...
Fixes: left shift of negative value -1
Fixes: 16424/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-5656579055026176
Fixes: 16358/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5714436358144000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fe536b6d99 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
4b4586db12
avcodec/vc1dec: Require res_sprite for wmv3images
...
non res_sprite leads to decoder delay which leads to assertion failure
Fixes: Assertion failure
Fixes: 16402/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5704510034411520
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int'
Fixes: 16425/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5692858838810624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c6b400492 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
58a7f109a9
avcodec/vc1_block: Check for double escapes
...
Fixes: out of array read
Fixes: 16331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5672735195267072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6962fd586e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
586a79190c
avcodec/vorbisdec: Check get_vlc2() failure
...
Fixes: out of array read
Fixes: 16510/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5754510382727168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 07b948fe60 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
70255c1e48
avcodec/tta: Fix integer overflow in prediction
...
Fixes: signed integer overflow: -395281576 + -1827578048 cannot be represented in type 'int'
Fixes: 16038/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5646109705240576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7e9aecc9f3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
db421282be
avcodec/vb: Check input packet size to be large enough to contain flags
...
Fixes: Timeout (->9sec)
Fixes: 16292/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VB_fuzzer-5747063496638464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dea2591d4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
f4431b6b0c
avcodec/cavsdec: Limit the number of access units per packet to 2
...
Fixes: Timeout (122sec -> 13ms)
Fixes: 15978/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5148925004087296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 37bc8e3249 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
14616c63df
avcodec/atrac9dec: Check block_align
...
Fixes: Infinite loop
Fixes: 16260/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5676365617037312
Fixes: 16260/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5768093879500800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dead949a1f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
95e414dc5d
avcodec/alac: Check for bps of 0
...
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 15764/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5102101203517440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8f49176e84 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
d0563bdf5f
avcodec/alac: Fix multiple integer overflows in lpc_prediction()
...
Fixes: signed integer overflow: 2088795537 + 2147254401 cannot be represented in type 'int'
Fixes: signed integer overflow: -1500363496 + -1295351808 cannot be represented in type 'int'
Fixes: signed integer overflow: -79560 * 32640 cannot be represented in type 'int'
Fixes: signed integer overflow: 2088910005 + 2088796058 cannot be represented in type 'int'
Fixes: signed integer overflow: -117258064 - 2088725225 cannot be represented in type 'int'
Fixes: signed integer overflow: 2088725225 - -117258064 cannot be represented in type 'int'
Fixes: 15739/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5630664122040320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ae3d6a337a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
f4319997ad
avcodec/rl2: set dimensions
...
The dimensions are always 320x200 they are hardcoded in the demuxer.
Hardcode them instead in the decoder.
Fixes: Timeout (16sec -> 400ms)
Fixes: 15574/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RL2_fuzzer-5158614072819712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 965e766e48 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
a05d292756
avcodec/aacdec: Add FF_CODEC_CAP_INIT_CLEANUP
...
Fixes: memleaks
Fixes: 16289/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5200695692623872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 48b86dd8a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
f3bb030fb9
avcodec/idcinvideo: Add 320x240 default maximum resolution
...
Fixes: Timeout (128sec -> 2ms)
Fixes: 16568/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IDCIN_fuzzer-5675004095627264
See: [FFmpeg-devel] [PATCH 4/4] tools/target_dec_fuzzer: Adjust max_pixels for IDCIN
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9fcf881e6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
4400d1b6e5
avformat/realtextdec: free queue on error
...
Fixes: memleak
Fixes: 16277/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5696629440512000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 493438fafc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
0f0d00e96e
avcodec/vp5/6/8: use vpX_rac_is_end()
...
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab56e62e8f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
4e3e2788da
avcodec/alsdec: Fix integer overflow in decode_var_block_data()
...
Fixes: signed integer overflow: 1927975249 - -514719744 cannot be represented in type 'int'
Fixes: 16413/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5651206856245248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 661a9b274b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
600675e11b
avcodec/alsdec: Limit maximum channels to 512
...
There seems to be no limit in the specification and upto 64k could be stored
512 is choosen as limit as thats the maximum in a conformance sample
An alternative to this patch would be a max_channels variable
Fixes: OOM
Fixes: 16200/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5764788793114624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Thilo Borgmann <thilo.borgmann@mail.de >
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f51e4d026c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
e31e1d75d1
avcodec/anm: Check input size for a frame with just a stop code
...
Fixes: Timeout (11sec -> 6sec)
Fixes: 16344/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ANM_fuzzer-5673032000995328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1965161ef6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
3760c85b88
avcodec/flicvideo: Optimize and Simplify FLI_COPY in flic_decode_frame_24BPP() by using bytestream2_get_buffer()
...
Fixes: Timeout (31sec -> 22sec)
Fixes: 16217/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-5658084189405184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e301736862 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
ec72482fc0
avcodec/loco: Check left column value
...
Fixes: Timeout (42sec -> 379 ms)
Fixes: 16323/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5679178099195904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c812db814e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
9c6c85f539
avcodec/ffwavesynth: Fixes invalid shift with pink noise seeking
...
Fixes: left shift of negative value -961533698048
Fixes: 16242/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5738550670131200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cdea0206ef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
3b011b34dc
avcodec/ffwavesynth: Fix integer overflow for some corner case values
...
Fixes: left shift of negative value -14671840
Fixes: 16000/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5145977817661440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4a88fb546 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
28efd41bbc
avcodec/indeo2: Check remaining input more often
...
Fixes: Timeout (95sec -> 30ms)
Fixes: 14765/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO2_fuzzer-5692455527120896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpe
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 52939a2c57 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
15219e3692
avcodec/diracdec: Check that slices are fewer than pixels
...
Fixes: Timeout (197sec ->144ms)
Fixes: 15034/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5733549405110272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fbbc8ba67f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
9a4cec81dc
avcodec/vp56: Consider the alpha start as end of the prior header
...
Fixes: Timeout (23sec -> 71ms)
Fixes: 15661/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP6A_fuzzer-6257865947348992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit db78bc1297 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
4d523742e3
avcodec/4xm: Check for end of input in decode_p_block()
...
Fixes: Timeout (81sec -> 0.2sec)
Fixes: 16169/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5662570416963584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8f92eb05e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
a2be37ac9d
avcodec/hevcdec: Check delta_luma_weight_l0/1
...
Fixes: signed integer overflow: 1 + 2147483647 cannot be represented in type 'int'
Fixes: 16041/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5685680656613376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 021f29506b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
cc0e1474f1
avcodec/hnm4video: Optimize postprocess_current_frame()
...
Improves: Timeout (220sec -> 108sec)
Improves: 15570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HNM4_VIDEO_fuzzer-5085482213441536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cd460f4da0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
7d4e27ca90
avcodec/hevc_refs: Optimize 16bit generate_missing_ref()
...
Fixes: Timeout (86sec -> 8sec) [these numbers assume also "[FFmpeg-devel] [PATCH 2/5] [RFC] avcodec/hevcdec: Check for overread in hls_decode_entry()"]
Fixes: 15702/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5657764929470464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit da8936969f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
21b72d8f6c
avcodec/scpr: Use av_memcpy_backptr() in type 17 and 33
...
This makes the changed code-path faster.
Change not tested except with the fuzzer testcase as I found no other testcase.
Improves: Timeout (136sec -> 74sec)
Improves: 16040/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-5705876062601216
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit 950a21e83c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
40c0a5a5fa
avcodec/dds: Use ff_set_dimensions()
...
Fixes: signed integer overflow: 2082471995 * 36 cannot be represented in type 'int'
Fixes: 16025/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DDS_fuzzer-5136663778426880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9cd1e939cf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
ffe4a51e0d
avcodec/mpc8: Fix 32bit mask/enum
...
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 15817/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC8_fuzzer-5636626409062400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e8bb949ade )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
2dcf33b9a9
avcodec/alsdec: Fix integer overflows of raw_samples in decode_var_block_data()
...
This also makes the code consistent with the existing similar MUL64()
in decode_var_block_data()
Fixes: signed integer overflow: -7277630735906765035 + -3272193951413647896 cannot be represented in type 'long'
Fixes: 16015/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5666552818434048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fad3ec89b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
8b156fe229
avcodec/alsdec: Fix integer overflow of raw_samples in decode_blocks()
...
Fixes: signed integer overflow: 2147483424 - -1772303236 cannot be represented in type 'int'
Fixes: 15708/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5067890362941440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ce65232406 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
e4ec2f5ab5
avcodec/alsdec: fix mantisse shift
...
Fixes: shift exponent -1 is negative
Fixes: 16039/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5656825657032704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 02346292a3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
bfbe5fbda8
avcodec/vc1_block: Fix invalid shifts in vc1_decode_i_blocks()
...
Fixes: left shift of negative value -9
Fixes: 15299/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSS2_fuzzer-5660922678345728
Fixes: 15557/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5673351911047168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9415e815a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
62bcdd07b2
avcodec/vc1_block: fix invalid shift in vc1_decode_p_mb()
...
Fixes: left shift of negative value -5
Fixes: 15294/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5733921754447872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b153ba1c2e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
29ebbe8cfe
avcodec/aacdec_template: fix integer overflow in imdct_and_windowing()
...
Fixes: signed integer overflow: 2147483645 + 4 cannot be represented in type 'int'
Fixes: 15418/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5685269069561856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit da93e2b142 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Andreas Rheinhardt
f482c38273
libavcodec/iff: Use unsigned to avoid undefined behaviour
...
The initialization of the uint32_t plane32_lut matrix uses left shifts
of the form 1 << plane; plane can be as big as 31 which means that this
is undefined behaviour as 1 will be simply an int. So make it unsigned
to avoid this.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f12e662a3d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
0d019e2379
avcodec/alsdec: Check for block_length <= 0 in read_var_block_data()
...
Fixes: left shift of negative value -1
Fixes: 15719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5685731105701888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be4fb282f9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
731b4f7414
avcodec/vqavideo: Set video size
...
Fixes: out of array access
Fixes: 15919/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-5657368257363968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 02f909dc24 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
e7c8bc5ae0
avcodec/sanm: Check extradata_size before allocations
...
Fixes: Leaks
Fixes: 15349/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5102530557640704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 172a43ce36 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
1bc9b64cf4
avcodec/mss1: check for overread and forward errors
...
Fixes: Timeout (106sec -> 14ms)
Fixes: 15576/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSS1_fuzzer-5688080461201408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 43015afd7c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
145c923bfe
avcodec/loco: Check for end of input in pixel decode
...
Fixes: Timeout (100sec -> 5sec)
Fixes: 15509/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5724297261219840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8305a4509a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
7235bd1008
avcodec/dirac_parser: Fix overflow in dts
...
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 15568/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5634719611355136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 549fcba8fc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
9aa632c530
avcodec/ralf: Fix undefined pointer in decode_channel()
...
Fixes: 16203/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5086088934195200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3c06ba1716 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
092bc6201f
avcodec/ralf: Fix integer overflow in apply_lpc()
...
Fixes: signed integer overflow: 1603085316 + 1238786562 cannot be represented in type 'int'
Fixes: 16203/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5086088934195200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ccca484324 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
55df48d776
avcodec/vorbisdec: Implement vr->classifications = 1
...
It appears no valid file uses this, so this is not testable with
a valid file.
Fixes: assertion failure
Fixes: 16187/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5638880618872832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5a5f12e3b3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
c05d5ca80b
avcodec/vorbisdec: Check parameters in vorbis_floor0_decode() before divide
...
Fixes: division by zero
Fixes: 16183/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5688966782648320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aecc9b96d6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
8108273941
avformat/realtextdec: Check for duplicate extradata in realtext_read_header()
...
Fixes: memleak
Fixes: 16140/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5684008052064256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 652ea23cb3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
3f57ece8e6
avcodec/cbs_av1_syntax_template: Check ref_frame_idx before use
...
Fixes: index -1 out of bounds for type 'AV1ReferenceFrameState [8]'
Fixes: 16079/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5758807440883712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
See: [FFmpeg-devel] [PATCH 05/13] avcodec/cbs_av1_syntax_template: Check ref_frame_idx before use
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8174e5c77d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
10198572ce
avcodec/apedec: Fix 2 signed overflows
...
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int'
Fixes: signed integer overflow: 2049431315 + 262759074 cannot be represented in type 'int'
Fixes: 16012/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5719016003338240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 392c028cd2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
747c23e4fe
avcodec/mss3: Check for the rac stream being invalid in rac_normalize()
...
Fixes: out of array read
Fixes: 15982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSA1_fuzzer-5630676251967488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 99a172f3f4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
74788efadd
avcodec/vc1_block: Check get_vlc2() return before use
...
Fixes: index -1 out of bounds for type 'const uint8_t [185][2]'
Fixes: 15720/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSS2_fuzzer-5666071933091840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2cb1f79735 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
1c5b4460b7
avcodec/apedec: Do not partially clear data array
...
Fixes: Assertion failure and memleak
Fixes: 15709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5182435093905408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e4b522c91 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
c1e67ca966
avcodec/atrac9dec: Check grad_range[1] more tightly
...
Alternatively the array could be made bigger but the extra values
would not be read without other changes.
Fixes: Out of array access
Fixes: 15658/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5738260074070016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 208225bd78 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
73302b0d97
avcodec/hnm4video: Forward errors of decode_interframe_v4()
...
Fixes: Timeout (108sec -> 160ms)
Fixes: 15570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HNM4_VIDEO_fuzzer-5085482213441536
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9af8ce754b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
4b335031d0
avcodec/clearvideo: fix invalid shift in tile size check
...
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 15631/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CLEARVIDEO_fuzzer-5690110605000704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5dc94924d0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
14df7f8cbc
avcodec/vp3: Check that theora is theora
...
Theora is forced to be non zero if it is zero and a sample
is asked for, as suggested by reimar
Fixes: Timeout (2min -> 600ms)
Fixes: 15366/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-5737849938247680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b4bf7226af )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
46a1b4e8ac
avcodec/vc1_pred: Fix invalid shift in scaleforsame()
...
Fixes: left shift of negative value -1
Fixes: 15531/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5759556258365440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6dfda35dd2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
38de5403c8
avcodec/vc1_block: Fix integer overflow in ff_vc1_pred_dc()
...
Fixes: signed integer overflow: 32796 * 65536 cannot be represented in type 'int'
Fixes: 15430/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5735424087031808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f31ed8f3b0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
9431f39c91
avcodec/truemotion2: Fix several integer overflows in tm2_motion_block()
...
Fixes: 15524/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5173148372172800
Fixes: signed integer overflow: 13701388 - -2134868270 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9a353ea876 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
7dbc888de6
avcodec/apedec: make left/right unsigned to avoid undefined behavior
...
Fixes: signed integer overflow: 755176387 + 1515360583 cannot be represented in type 'int'
Fixes: 15506/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5706859232624640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf778af149 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
102bc56731
avcodec/apedec: Fix multiple integer overflows and undefined behaviorin filter_3800()
...
Fixes: left shift of negative value -4
Fixes: signed integer overflow: -15091694 * 167 cannot be represented in type 'int'
Fixes: signed integer overflow: 1898547155 + 453967445 cannot be represented in type 'int'
Fixes: 15258/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5759095564402688
Fixes: signed integer overflow: 962196438 * 31 cannot be represented in type 'int'
Fixes: 15364/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5718799845687296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 267eb2ab7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
7431c6224b
avformat/mpc: deallocate frames array on errors
...
Fixes: memleak on error path
Fixes: 15984/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5679918412726272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit da5039415c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
09d321d711
avcodec/eatqi: Check for minimum frame size
...
The minimum header is 8 bytes, the smallest bitstream that is passed to
the MB decode code is 4 bytes
Fixes: Timeout (35sec -> 18sec)
Fixes: 15800/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATQI_fuzzer-5684154517159936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5ffb8e8793 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
9738f204ce
avcodec/eatgv: Check remaining size after the keyframe header
...
The minimal size which unpack() will not fail on is 5 bytes
Fixes: Timeout (14sec -> 77ms) (testcase 15508)
Fixes: 15508/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATGV_fuzzer-5700053513011200
Fixes: 15996/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATGV_fuzzer-5751353223151616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 009ec8dc33 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
16f98b9c29
avcodec/assdec: undefined use of memcpy()
...
Fixes: null pointer passed as argument 2, which is declared to never be null
Fixes: 16008/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SSA_fuzzer-5650582821404672 (this is a separate issue found in this testcase)
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47b6ca0b02 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
904a8616a5
avcodec/brenderpix: Check input size before allocating image
...
An incomplete image is not supported prior to this and will
not produce any output. This commit moves the failure before
time consuming operations.
Fixes: Timeout (81sec -> 76ms)
Fixes: 15723/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BRENDER_PIX_fuzzer-5147265653538816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38b6c48c43 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Matt Wolenetz
b68589b40a
lafv/wavdec: Fail bext parsing on incomplete reads
...
avio_read can successfully return even when less than the requested
amount of input was read. wavdec's bext parsing mistakenly assumed a
successful avio_read always read the full amount that was requested.
The result could be dictionary tags populated with partially
uninitialized values.
This change also fixes a broken assertion in wav_parse_bext_string that
was off-by-one, though no known current usage of that method hits that
broken case.
Chromium bug: 987270
Signed-off-by: Matt Wolenetz <wolenetz@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 052d41377a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
bf28f5f367
avcodec/utils: fix leak of subtitle_header on error path
...
Fixes: memleak
Fixes: 15528/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_STL_fuzzer-5735993371525120
Fixes: 15792/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SAMI_fuzzer-5737754232619008
Fixes: 16008/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SSA_fuzzer-5650582821404672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 923d5c489f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
f2c01cc90b
avcodec/utils: Check close before calling it
...
Fixes: NULL pointer dereference
Fixes: 15733/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IDF_fuzzer-5658616977162240
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8df6884832 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
7cfc42151e
tools/target_dec_fuzzer: Free parser in case of avcodec_open2() failure
...
Fixes: memleak
Fixes: part of 15529/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVPX_VP8_fuzzer-5140143700180992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 508ce5839e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
c24ff0743f
avcodec/vorbisdec: Check vlc for floor0 dec vector offset
...
Fixes: out of array access
Fixes: 15649/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5729191309344768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 99f95f39c6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
19866e4d63
avcodec/vorbisdec: amplitude bits can be more than 25 bits
...
Fixes: assertion failure, invalid shift
Fixes: 15583/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5640157484548096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 308771a738 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
61632a78db
avutil/softfloat_ieee754: Fix odd bit position for exponent and sign in av_bits2sf_ieee754()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 82e389d066 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
f02de2f599
avcodec/apedec: Fix various integer overflows
...
Fixes: signed integer overflow: -538976267 * 31 cannot be represented in type 'int'
Fixes: left shift of 65312 by 16 places cannot be represented in type 'int'
Fixes: 15255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5718831688843264
Fixes: 15547/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5691384901664768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 240bf0e596 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
14b5fa9e4e
avcodec/apedec: Fix multiple integer overflows in predictor_update_filter()
...
Fixes: signed integer overflow: -829262115 + -1410750414 cannot be represented in type 'int'
Fixes: 15251/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5651742252859392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0af08cb803 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
aee5c9494d
avcodec/alsdec: fix undefined shift in multiply()
...
Fixes: left shift of negative value -6
Fixes: 15564/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5701655938465792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b880b3b236 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
882dee37cc
avcodec/alsdec: Fix 2 integer overflows
...
Fixes: signed integer overflow: 1270564968 + 904828220 cannot be represented in type 'int'
Fixes: 15402/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5755426823471104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9cd0d94f59 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
6a7e27f675
avcodec/flicvideo: Make line_packets int
...
Fixes: signed integer overflow: -32768 * 196032 cannot be represented in type 'int'
Fixes: 15300/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-5733319519502336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 54bd47f861 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
ee2abfe7d4
avcodec/dvbsubdec: Use ff_set_dimensions()
...
Fixes: signed integer overflow: 65313 * 65313 cannot be represented in type 'int'
Fixes: 15740/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVBSUB_fuzzer-5641749164195840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5941b7f615 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
dda10a2995
avcodec/ffwavesynth: Check if there is enough extradata before allocation
...
Fixes: OOM
Fixes: 15750/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5702090367696896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65bac4a782 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
8e2a5f951f
avcodec/ffwavesynth: More correct cast in wavesynth_seek()
...
Fixes: signed integer overflow: 553590816 - -9223372036315799520 cannot be represented in type 'long'
Fixes: 15743/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5705835377852416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f4605770af )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
d69822bd9a
avcodec/ffwavesynth: Check sample rate before use
...
Fixes: division by zero
Fixes: 15725/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5641231956180992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c95857a423 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
cacf998071
avcodec/dnxhd_parser: Fix parser when input does not have nicely sized packets
...
Fixes: out of array access
Fixes: 15522/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DNXHD_fuzzer-5747756078989312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d900d8fe0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
01f9c1540a
avcodec/dnxhd_parser: remove unneeded code
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1707dbdf49 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
b60455c715
avformat/utils: Check rfps_duration_sum for overflow
...
Fixes: signed integer overflow: 9151595917793558550 + 297519050751678697 cannot be represented in type 'long'
Fixes: 15496/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5722866475073536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c46fdf305 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
6c821c1dee
avcodec/h264_refs: Also check reference in ff_h264_build_ref_list()
...
Fixes: out of array read
Fixes: 15409/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5758846959616000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d3581e6bb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
6d3c6e8b96
avcodec/atrac9dec: Check conditions before apply_band_extension() to avoid out of array read in initialization of unused variables
...
Fixes: global-buffer-overflow
Fixes: 15247/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5671602181636096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c5f265bb24 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
a6d1e2c40a
avcodec/parser: Check next index validity in ff_combine_frame()
...
Fixes: out of array access
Fixes: 15522/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DNXHD_fuzzer-5747756078989312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 15008db0fa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
5c2cbf36dd
avcodec/ivi: Ask for samples with odd tiles
...
Fixes: Assertion failure
Fixes: 15422/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO5_fuzzer-5676625481433088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a7e02cf3ad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
24ed399e57
avformat/xmv: Make bitrate 64bit
...
Fixes: signed integer overflow: 32 * 538976288 cannot be represented in type 'int'
Fixes: 15633/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5752273981931520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 39a6a79bcb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
fe36a3005b
avcodec/pngdec: Check that previous_picture has same w/h/format
...
Fixes: out of array access
Fixes: 15540/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-5684905029140480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 18c808ffbe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
ec806c3da8
avcodec/huffyuv: remove gray8a (the format is listed but not supported by the implementation)
...
Fixes: null pointer dereference
Fixes: 15464/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-5681391150301184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6aaa01afe4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Michael Niedermayer
41c9e6128c
avcodec/mpc8: Fixes invalid shift in mpc8_decode_frame()
...
Fixes: left shift of negative value -456
Fixes: 15561/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC8_fuzzer-5758130404720640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1dbb67d39b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
James Zern
e8b0f20e51
avcodec/utils, avcodec_open2: close codec on failure
...
after a successful init if the function fails for another reason close
the codec without requiring FF_CODEC_CAP_INIT_CLEANUP which is meant to
cover init failures themselves. fixes a memory leak in those cases.
BUG=oss-fuzz:15529
Signed-off-by: James Zern <jzern@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b1febda061 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
Cameron Cawley
7c1b403365
avformat/rpl: Replace strcpy with av_strlcpy
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 94d45a13c7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-01-06 11:30:42 +01:00
James Almer
08d3cc2f1d
avcodec/amfnec: allocate packets using av_new_packet()
...
This ensures they will be reference counted, as required by the AVCodec.receive_packet()
API.
Should fix ticket #8386 .
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit fdf46b4a6b )
2019-11-19 19:49:09 -03:00
Timo Rothenpieler
4df5dfabcc
avcodec/nvenc: make sure newly allocated packets are refcounted
...
Fixes ticket 8383
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2019-11-17 01:47:49 +01:00
Jun Zhao
4fbeaaa220
lavc/mpeg4audio: add chan_config check to avoid indeterminate channels
...
add chan_config check to avoid indeterminate channels.
Signed-off-by: Jun Zhao <barryjzhao@tencent.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 333109f469 )
2019-09-27 22:25:13 -03:00
James Almer
3ecbb180ef
aformat/movenc: add missing padding to output track extradata
...
Fixes ticket #8183 .
Tested-by: Thierry Foucu <tfoucu@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 58aa0ed8f1 )
2019-09-27 22:22:01 -03:00
Timo Rothenpieler
fe1064f779
avcodec/nvenc: add driver version info for latest SDKs
...
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2019-09-24 12:07:39 +02:00
James Almer
11cce24e04
avcodec/bsf: check that AVBSFInternal was allocated before dereferencing it
...
This can happen when av_bsf_free() is called on av_bsf_alloc() failure.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit d889ae3396 )
2019-09-23 10:11:02 -03:00
Carl Eugen Hoyos
60094fc2f5
lavf/rawenc: Only accept the appropriate stream type for raw muxers.
...
This does not affect the rawvideo muxer.
Fixes ticket #7979 .
(cherry picked from commit aef24efb0c )
2019-09-06 16:26:57 -03:00
Carl Eugen Hoyos
0253771953
lavc/tableprint_vlc: Remove avpriv_request_sample() from included files.
...
Fixes compilation with --enable-hardcoded-tables.
Fixes ticket #7962 .
(cherry picked from commit c8232e5007 )
2019-08-09 10:20:20 +02:00
Stefan Schoenefeld
a12e40e021
avcodec/h263dec: fix hwaccel decoding
...
Recently we encountered an issue when decoding a h.263 file:
FFmpeg will freeze when decoding h.263 video with NVDEC. Turns out this is not directly related to NVDEC but is a problem that shows with several other HW decoders like VDPAU, though the exact kind of error is different (either error messages or freezing[1]). The root cause is that ff_thread_finish_setup() is called twice per frame from ff_h263_decode_frame(). This is not supported by ff_thread_finish_setup() and specifically checked for and warned against in the functions code. The issue is also specific to hw accelerated decoding only as the second call to ff_thread_finish_setup() is only issued when hw acceleration is on. The fix is simple: add a check that the first call is only send when hw acceleration is off, and the second call only when hw acceleration is on (see attached patch). This works fine as far as I was able to test with vdpau and nvdec/nvcuvid hw decoding. The patch also adds NVDEC to the hw config list if available.
I also noticed a secondary issue when browsing through the code which is that, according to documentation, ff_thread_finish_setup() should only be called if the codec implements update_thread_context(), which h263dec does not. The patch does not address this and I'm not sure any action needs to be taken here at all.
[1] This is depending on whether or not the hw decoder sets the HWACCEL_CAPS_ASYNC_SAFE flag
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2019-08-04 16:21:11 +02:00
Mark Harris
0c904c0d3f
avutil/mem: Fix invalid use of av_alloc_size
...
The alloc_size attribute is valid only on functions that return a
pointer. GCC 9 (not yet released) warns about invalid usage:
./libavutil/mem.h:342:1: warning: 'alloc_size' attribute ignored on a function returning int' [-Wattributes]
342 | av_alloc_size(2, 3) int av_reallocp_array(void *ptr, size_t nmemb, size_t size);
| ^~~~~~~~~~~~~
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4361293fcf )
2019-07-23 01:18:52 -03:00
Andreas Rheinhardt
6e0cf9a9df
cbs_h2645: Fix infinite loop in more_rbsp_data
...
cbs_h2645_read_more_rbsp_data does not handle malformed input very well:
1. If there were <= 8 bits left in the bitreader, these bits were read
via show_bits. But show_bits requires the number of bits to be read to
be > 0 (internally it shifts by 32 - number of bits to be read which is
undefined behaviour if said number is zero; there is also an assert for
this, but it is only an av_assert2). Furthermore, in this case a shift
by -1 was performed which is of course undefined behaviour, too.
2. If there were > 0 and <= 8 bits left and all of them were zero
(this can only happen for defective input), it was reported that there
was further RBSP data.
This can lead to an infinite loop in H.265's cbs_h265_read_extension_data
corresponding to the [vsp]ps_extension_data_flag syntax elements. If the
relevant flag indicates the (potential) occurence of these syntax elements,
while all bits after this flag are zero, cbs_h2645_read_more_rbsp_data
always returns 1 on x86. Given that a checked bitstream reader is used,
we are also not "saved" by an overflow in the bitstream reader's index.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit d4035ca849 )
2019-07-21 11:07:21 -03:00
James Almer
a21a9c7863
avformat/aacdec: resync to the next adts frame on invalid data instead of aborting
...
Should fix ticket #6634
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 881e1f5a62 )
2019-07-21 01:06:29 -03:00
James Almer
1fbe0286e4
avformat/aacdec: factorize the adts frame resync code
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit a38eab8b75 )
2019-07-21 01:06:20 -03:00
Andreas Rheinhardt
1b6bcee9fe
cbs_mpeg2: Fix storage type for frame_centre_*_offset
...
The frame_centre_horizontal/vertical_offset values contained in picture
display extensions are actually signed values (i.e. it is possible to
indicate that the display device should add black bars/pillars).
The files sony-ct3.bs and tcela-6.bits (which are both used in fate
tests for mpeg2_metadata) contain picture display extensions; the former
even contains a negative frame_centre_vertical_offset. Fortunately, the
old code did not damage the picture display extensions when one did a
cycle of reading and writing. For the same reason the fate tests needn't
be updated either.
Furthermore these fields now use the trace output for matrices.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit de58803839 )
2019-07-21 01:05:39 -03:00
Andreas Rheinhardt
b010caa6c9
cbs_mpeg2: Improve checks for invalid values
...
MPEG-2 contains several elements that mustn't be zero according to the
specifications: horizontal/vertical_size_value, aspect_ratio_information,
frame_rate_code, the quantiser matrices, the colour_description
elements, picture_coding_type, the f_code[r][s] values and
quantiser_scale_code. It is now checked that the invalid values don't
occur.
The colour_description elements are treated specially in this regard:
Given that there are files in the wild which use illegal values for the
colour_description elements (some of them created by mpeg2_metadata),
they will be corrected to the value meaning "unknown" (namely 2) during
reading. This has been done in such a way that trace_headers will
nevertheless report the original value, together with a message about
the fixup.
Furthermore, the trace_headers output of user_data has been beautified.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 9c3f2a8894 )
2019-07-21 01:05:24 -03:00
James Almer
ae5c80b9ca
avcodec/cbs_mpeg2: fix leak of extra_information_slice buffer in cbs_mpeg2_read_slice_header()
...
cbs_mpeg2_free_slice() calls av_buffer_unref() on extra_information_ref,
meaning allocating with av_malloc() was not the intention.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit d903c09d9a )
2019-07-21 01:04:42 -03:00
Carl Eugen Hoyos
b3b5941ec7
lavc/cbs: Do not use format specifier "z" on Windows.
...
(cherry picked from commit 0b7269e62d )
2019-07-21 01:04:34 -03:00
Carl Eugen Hoyos
84b94fdd05
lavc/cbs_vp9: Make variable prob unsigned.
...
Silences a warning with clang:
libavcodec/cbs_vp9_syntax_template.c:220:17: warning: implicit conversion from 'int' to 'int8_t' (aka 'signed char')
changes value from 255 to -1
(cherry picked from commit de441ad52a )
2019-07-21 01:04:28 -03:00
James Almer
a213213985
avcodec/cbs_h264: fix storage type for time_offset in Pic Timing SEI
...
The spec defines it as a signed value.
Reviewed-by: Mark Thompson <sw@jkqxz.net >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 9bf520d04d )
2019-07-21 01:04:23 -03:00
James Almer
94b1630b7c
avcodec/cbs_h2645: add helper macros for signed values
...
Reviewed-by: Mark Thompson <sw@jkqxz.net >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 3dc6adf326 )
2019-07-21 01:04:15 -03:00
James Almer
7dc2366533
avcodec/cbs: add helper functions and macros to read and write signed values
...
Reviewed-by: Mark Thompson <sw@jkqxz.net >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 5006dcdf9a )
2019-07-21 01:04:10 -03:00
Andreas Rheinhardt
2ac6315c7c
cbs_h264: Fix handling of auxiliary pictures
...
The earlier code used the most recent non-auxiliary slice to determine
whether an auxiliary slice has the syntax of an IDR slice, even when
the most recent slice was from a slice of a redundant frame. Now only
slices of the primary coded picture are used, as the specifications
mandate.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@googlemail.com >
(cherry picked from commit 8d1cf2d894 )
2019-07-21 01:04:04 -03:00
Michael Niedermayer
9d06c1f95e
Changelog: fix typo
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-08 20:10:55 +02:00
Michael Niedermayer
7d4e9074c6
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-08 11:53:46 +02:00
Michael Niedermayer
7654e5aa3b
avcodec/ilbcdec: Simplify use of unsigned and fix more undefined overflows
...
Fixes: signed integer overflow: 2147475672 + 8192 cannot be represented in type 'int'
Fixes: 15415/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ILBC_fuzzer-5712074128228352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 019d729039 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-08 11:52:25 +02:00
Michael Niedermayer
6ddb253f79
avcodec/golomb: Correct the doxy about get_ue_golomb() and errors
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1bb3b3f11c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-08 11:52:09 +02:00
Michael Niedermayer
a1416c6c8d
avformat/utils: Check timebase before use in estimate_timings()
...
Fixes: division by 0
Fixes: 15480/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5746727434321920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f57e97dfd9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-08 11:51:59 +02:00
Michael Niedermayer
3e3db69193
avcodec/hq_hqa: Use ff_set_dimensions()
...
Fixes: 15530/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-5637370344374272
Fixes: signed integer overflow: 65312 * 65312 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6229fcd40 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-08 11:51:38 +02:00
Michael Niedermayer
16f8e50f86
avcodec/rv10: Fix integer overflow in aspect ratio compare
...
Fixes: signed integer overflow: 2040 * 1187872 cannot be represented in type 'int'
Fixes: 15368/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV20_fuzzer-5681657136283648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 14fcf42958 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-08 11:51:09 +02:00
Michael Niedermayer
4db3ec5e7b
avcodec/4xm: Fix signed integer overflows in idct()
...
Fixes: signed integer overflow: 20242 * 121095 cannot be represented in type 'int'
Fixes: 15310/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5737051745419264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2bbea155bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-08 11:49:51 +02:00
Michael Niedermayer
2424d0096e
avcodec/qdm2: Check checksum_size for 0
...
Fixes: Infinite loop
Fixes: 15337/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5757428949319680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b2ebf89a4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-08 11:46:47 +02:00
Michael Niedermayer
07975e89d3
avcodec/qdm2: error out of qdm2_fft_decode_tones() before entering endless loop
...
Fixes: signed integer overflow: 2147483646 + 2 cannot be represented in type 'int'
Fixes: infinite loop
Fixes: 15396/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5116605501014016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 694be24bd6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-08 11:46:09 +02:00
Michael Niedermayer
e5c21ed6e3
avcodec/qdm2: Do not read out of array in fix_coding_method_array()
...
Instead we ask for a sample, its unclear what to do in this case.
Fixes: index 30 out of bounds for type 'int8_t [30][64]'
Fixes: 15339/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5749441484554240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ae021c1239 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-08 11:45:48 +02:00
Michael Niedermayer
dd59d92e94
avcodec/svq3: Use ff_set_dimension()
...
Fixes: OOM
Fixes: 15410/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-5659464805384192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b114d7687 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-08 11:44:52 +02:00
Michael Niedermayer
d534cb8345
avcodec/iff: Check ham vs bpp
...
This checks the ham value much stricter and avoids hitting cases which cannot be reached
with data from the libavformat demuxer.
Fixes: out of array access
Fixes: 15320/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5080476840099840
Fixes: 15423/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5630765833912320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f76d7352e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-08 11:44:24 +02:00
Michael Niedermayer
074f40608e
avcodec/ffwavesynth: use uint32_t to compute difference, it is enough
...
Fixes: signed integer overflow: 6494225984479297536 - -6043795377581187040 cannot be represented in type 'long'
Fixes: 15285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5632780307791872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e9dd3c7126 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-08 11:43:56 +02:00
Michael Niedermayer
73885bf3e1
avcodec/ffwavesynth: Simplify lcg_seek(), avoid negative case
...
Fixes: negation of -9223372036854775808 cannot be represented in type 'int64_t' (aka 'long'); cast to an unsigned type to negate this value to itself
Fixes: 15289/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5709034499342336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c02209935 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-08 11:43:31 +02:00
Michael Niedermayer
24ea2679e2
avcodec/ffwavesynth: Fix backward lcg_seek()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf2bd3ce79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-08 11:43:06 +02:00
Michael Niedermayer
10880dd695
avcodec/flicvideo: Fix off by 1 error in flic_decode_frame_24BPP()
...
Fixes: out of array access
Fixes: 15360/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-5653837190266880
Fixes: 15412/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-5740537648250880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 37708cbae8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-08 11:42:38 +02:00
Michael Niedermayer
4d7ee3b0ff
avcodec/vc1_block: Check for vlc error in vc1_decode_ac_coeff()
...
Fixes: index -1 out of bounds for type 'const uint8_t [185][2]'
Fixes: 15250/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5648992869810176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 79204a1fc8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-08 11:42:14 +02:00
Michael Niedermayer
ac9d8e7c50
avcodec/alac: Check lpc_quant
...
lpc_quant of 0 produces undefined behavior, thus disallow this.
If valid samples use this then such a sample would be quite
usefull to confirm the correct&lossles handling of this.
Fixes: libavcodec/alac.c:218:25: runtime error: shift exponent -1 is negative
Fixes: 15273/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5656388535058432
Fixes: 15276/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5761238417539072
Fixes: 15315/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5767260766994432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6474b899c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-08 11:41:51 +02:00
Michael Niedermayer
c697819aee
avcodec/dxv: Initialize tex_funct to NULL
...
Fixes: Various anomalies
Fixes: 14493/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_fuzzer-5071018000908288
Fixes: 14630/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_fuzzer-5714888963391488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e96b7a8ba6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-08 11:41:32 +02:00
Michael Niedermayer
c34512371e
avcodec/alsdec: Add FF_CODEC_CAP_INIT_CLEANUP
...
Fixes: multiple memleaks
Fixes: 15293/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5642409288925184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b7b6ddd596 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-06 23:09:45 +02:00
Michael Niedermayer
fa2dbcfd8f
avcodec/alsdec: Fix integer overflow with buffer number
...
Fixes: signed integer overflow: 65313 * 65313 cannot be represented in type 'int'
Fixes: 15290/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5738074249625600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f64f6058e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-06 23:08:37 +02:00
Michael Niedermayer
ed8e191bfb
avcodec/alsdec: Fixes signed integer overflow in LSB addition
...
Fixes: signed integer overflow: 8 * 536870912 cannot be represented in type 'int'
Fixes: 15281/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5744458785619968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f527021df )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-06 23:07:41 +02:00
Michael Niedermayer
75e838a6da
avcodec/alsdec: Check opt_order / sb_length in ra_block handling
...
Fixes: out of array access
Fixes: 15277/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5184853437317120
Fixes: 15280/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5741062137577472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0794494c8f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-06 23:07:06 +02:00
Michael Niedermayer
99745dc2f3
avcodec/alsdec: Fix integer overflow with shifting samples
...
Fixes: signed integer overflow: -346039050 * 8 cannot be represented in type 'int'
Fixes: 15283/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5692700268953600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a3bd4b260e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-06 23:06:23 +02:00
Michael Niedermayer
dcef55b5ff
avcodec/alsdec: Fix undefined behavior in decode_rice()
...
Fixes: left shift of 72 by 26 places cannot be represented in type 'int'
Fixes: 15279/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5700665621348352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 51f6870c37 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-06 23:05:37 +02:00
Michael Niedermayer
1056217540
avcodec/alsdec: Fixes invalid shifts in read_var_block_data() and INTERLEAVE_OUTPUT()
...
Fixes: left shift of negative value -6
Fixes: 15275/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5742361767837696
Fixes: signed integer overflow: 41582592 * 256 cannot be represented in type 'int'
Fixes: 15296/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5739558227935232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e131568752 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-06 23:05:11 +02:00
Michael Niedermayer
df61ec263f
avcodec/hevc_ps: Change num_tile_rows/columns checks to sps->ctb_height/weight
...
Suggested-by: James Almer <jamrial@gmail.com >
Reviewed-by: James Almer <jamrial@gmail.com
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3b2082c663 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-30 18:50:38 +02:00
Michael Niedermayer
3fa15bb096
avcodec/hevc_ps: Fix integer overflow with num_tile_rows and num_tile_columns
...
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 14880/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5130977304641536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c692051252 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-30 18:50:22 +02:00
Michael Niedermayer
523a47b3f6
avcodec/apedec: Add k < 24 check to the only k++ case which lacks such a check
...
Fixes: 15255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5718831688843264
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d4f4f4a15 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-30 18:49:07 +02:00
Michael Niedermayer
7d075c5f33
avformat/aviobuf: Delay buffer downsizing until asserts are met
...
Fixes: Assertion failure
Fixes: 15151/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5757079496687616
Fixes: 15205/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5767573242642432
May fix: Ticket7094
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0334632d5c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-30 18:48:42 +02:00
Michael Niedermayer
b5d6b509b1
avcodec/fitsdec: Check data_min/max
...
Fixes: division by 0
Fixes: 15206/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5657260212092928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eb82d19f03 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-30 14:41:51 +02:00
Michael Niedermayer
f3bfb07179
avcodec/m101: Fix off be 2 error
...
Fixes: out of array read
Fixes: 15263/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_M101_fuzzer-5728999453491200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 89b96900fa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-29 20:43:54 +02:00
Michael Niedermayer
423d0bbc55
avcodec/qdm2: Move fft_order check up
...
This avoids undefined computations with unchecked values
Fixes: shift exponent -21 is negative
Fixes: 15262/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5651261753393152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8d8b8c4ac6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-29 20:42:20 +02:00
Michael Niedermayer
1aa0c2a06f
avcodec/libvorbisdec: Check extradata size
...
Fixes: out of array read
Fixes: 15261/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVORBIS_fuzzer-5764908467093504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf3c245566 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-29 20:32:43 +02:00
Michael Niedermayer
5b8bce805c
avformat/vqf: Check header_size
...
Fixes: 15271/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5735262606327808
Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7c30ff3888 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-29 20:32:14 +02:00
Michael Niedermayer
7daa138f68
avcodec/atrac9dec: Check q_unit_cnt in parse_band_ext()
...
Fixes: global-buffer-overflow
Fixes: 15247/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5671602181636096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fb4a4557d1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-29 20:30:30 +02:00
Michael Niedermayer
3d1903acfe
avcodec/atrac9dec: Check that the reused block has succeeded initilization
...
Fixes: global-buffer-overflow
Fixes: 15247/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5671602181636096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ac9af7e9a5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-29 19:36:02 +02:00
Michael Niedermayer
6872daee87
Update for 4.1.4
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 19:52:20 +02:00
Michael Niedermayer
1603661523
avcodec/utils: Check bits_per_coded_sample
...
This avoids the need for each decoder separately having to handle this case
Fixes: shift exponent -100663046 is negative
Fixes: out of array access
Fixes: 15270/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5727829913763840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d33414d2ad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
297c5c26cd
avcodec/videodsp_template: Fix overflow of addition
...
Fixes: addition of unsigned offset to 0x7f56fc26a9b6 overflowed to 0x7f56fc26a8be*
Fixes: clusterfuzz-testcase-minimized-mediasource_MP4_AVC1_pipeline_integration_fuzzer-4917949056679936
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 247a1de7f7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
9ede5cab3a
avcodec/alsdec: Fix invalid shift in multiply()
...
Fixes: shift exponent -24 is negative
Fixes: 15292/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5768533318828032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f30be1ec98 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
c434a043ac
avcodec/ffwavesynth: Check ts_end - ts_start for overflow
...
Fixes: signed integer overflow: 2314885530818453536 - -8926099139098304480 cannot be represented in type 'long'
Fixes: 15259/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5764366093254656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2db7a3bc4a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
92140d7b24
avcodec/vc1dsp: Avoid undefined shifts in vc1_v_s_overlap_c / vc1_h_s_overlap_c
...
Fixes: left shift of negative value -13
Fixes: 15260/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5702076048343040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 507ca66ee4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
1b4b738033
avcodec/tta: Fix undefined shift
...
Fixes: left shift of negative value -4483
Fixes: 15256/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5738691617619968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ebccd2f778 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
d00e33ed3a
avcodec/qdmc: Fix integer overflows in PRNG
...
Fixes: signed integer overflow: 214013 * 2531011 cannot be represented in type 'int'
Fixes: 15254/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDMC_fuzzer-5698137026461696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2921b45a38 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
9b8a58fa78
avcodec/bintext: Check font height
...
Fixes: division by zero
Fixes: 15257/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINTEXT_fuzzer-5757352881422336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bfb58bdd70 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
d08d4b1066
avcodec/binkdsp: Fix integer overflows in idct
...
Fixes: signed integer overflow: 3784 * 682038 cannot be represented in type 'int'
Fixes: 15265/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5088311799971840
Fixes: 15268/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5666502344179712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7a072fbcc4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
9a68341e9e
avcodec/bink: Fix integer overflow in unquantize_dct_coeffs()
...
Fixes: signed integer overflow: -3447 * 2883584 cannot be represented in type 'int'
Fixes: 15265/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5088311799971840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 62ad08cef9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
da081ecf69
avcodec/motionpixels: Check for vlc error in mp_get_vlc()
...
Fixes: 15246/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOTIONPIXELS_fuzzer-5168534407086080
Fixes: runtime error: index -1 out of bounds for type 'HuffCode [16]'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 930cdef80a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
479b70d2f8
avcodec/loco: Limit lossy parameter so it is sane and does not overflow
...
Fixes: 15248/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5087440458481664
Fixes: signed integer overflow: 3 + 2147483647 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ce3b0b9066 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
65e1440140
avformat/mov: Set fragment.found_tfhd only after TFHD has been parsed
...
Fixes: Assertion failure
Fixes: crbug971646.mp4
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 696312c487 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
529a719a25
avcodec/xpmdec: Do not use context dimensions as temporary variables
...
Fixes: Integer overflow
Fixes: 15134/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XPM_fuzzer-5722635939348480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5ea7f20500 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
c0e3f54ec0
avcodec/fitsdec: Fix division by 0 in size check
...
Fixes: division by zero
Fixes: 15210/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5746033243455488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 07ffe94c17 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
26605408f1
avcodec/aacpsdsp_template: Fix integer overflow in ps_hybrid_analysis_c()
...
Fixes: signed integer overflow: -1539565182 + -798086761 cannot be represented in type 'int'
Fixes: 14807/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-564925382682214
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f8f5668df5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
ef73b0da2d
avcodec/truemotion2: Fix integer overflow in last loop in tm2_update_block()
...
Fixes: signed integer overflow: -1727985666 - 538976288 cannot be represented in type 'int'
Fixes: 15031/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5100228035739648
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3aecd01704 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
8ba9b195e7
avcodec/iff: finetune the palette size check in the mask case
...
Fixes: out of array access
Fixes: 15381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5668057826983936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0f9789c8e3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
4d2343825c
avcodec/iff: Fix mask_buf / mask_palbuf leak
...
Fixes: 15372/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5708881759567872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 92e8db532c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
45d3ba9e5f
avformat/icodec: Free ico->images on error paths
...
Fixes: 15116/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5715173567889408
Fixes: memleak
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 54918b5116 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
0789b6295b
avformat/wsddec: Fix undefined shift
...
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 15123/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5738039235575808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 112eb17a2b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
a56b96a3da
avcodec/fmvc: Check if header fields are available before allocating the image
...
Fixes: Timeout (15sec -> 0.5sec)
Fixes: 14846/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FMVC_fuzzer-5068322120400896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 561cc161ca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
6e26b1b0b1
avcodec/bink: Reorder operations in init to avoid memleak on error
...
Fixes: Direct leak of 536 byte(s) in 1 object(s)
Fixes: 15266/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5629530426834944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2603f25d32 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
f487aa964b
avformat/wtvdec: Avoid (32bit signed) sectors
...
Fixes: left shift of negative value -14614752
Fixes: 15174/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5670543606415360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dd357d76e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
0ccdabffd7
avcodec/bitstream: Check for more conflicting codes in build_table()
...
Fixes: out of array read
Fixes: 14563/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5646451545210880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a7e3b271fc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
ec23fe0fd9
avcodec/bitstream: Check for integer code truncation in build_table()
...
Fixes: out of array read
Fixes: 14563/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5646451545210880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e78b0f8374 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
837e9e8898
avformat/sbgdec: Fixes integer overflow in str_to_time() with hours
...
Fixes: signed integer overflow: 904444 * 3600 cannot be represented in type 'int'
Fixes: 15113/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5764083346833408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2a0f23b9d6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
e73ef454e8
avformat/vpk: Check offset for validity
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa003019ab )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
a2ebfb6afe
avformat/vpk: Fix integer overflow in samples_per_block computation
...
Fixes: signed integer overflow: 84026453 * 28 cannot be represented in type 'int'
Fixes: 15111/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5675630072430592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c6c4129b4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
1a022c66c8
avcodec/mjpegdec: Check for non ls PAL8
...
Fixes: Null-dereference READ in av_malloc
Fixes: 15002/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-5643474625363968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 442375fee7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
c4a14a6303
avcodec/interplayvideo: check decoding_map_size with video_data_size
...
Fixes: Timeout (90543 ms -> 59 ms)
Fixes: 14721/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_VIDEO_fuzzer-5697492148027392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 914d6a7c1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
66cbac4a0b
avcodec/h264_parse: Use 64bit for expectedpoc and expected_delta_per_poc_cycle
...
Fixes: signed integer overflow: -2142516591 + -267814575 cannot be represented in type 'int'
Fixes: 14450/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5716105319940096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4896fa18ad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
f021c40c30
avcodec/mss4: Check input size against skip bits
...
Fixes: Timeout (17sec -> 20ms)
Fixes: 14615/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MTS2_fuzzer-5093007763701760
Fixes: 14797/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MTS2_fuzzer-5651696119709696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0fef412dff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
43afeaa086
avcodec/dxv: Check op_offset in dxv_decompress_cocg()
...
Fixes: signed integer overflow: -2147483648 - 12 cannot be represented in type 'int'
Fixes: 14732/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_fuzzer-5735273129836544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e520843dd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
04c3e3d4e2
avcodec/diracdec: Fix integer overflow in global_mv()
...
Fixes: signed integer overflow: 16384 * 196607 cannot be represented in type 'int'
Fixes: 14810/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5091232683917312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a99ffb5bb4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
eed8561f7c
avcodec/vmnc: Check available space against chunks before reget_buffer()
...
Fixes: Timeout (16sec -> 60ms)
Fixes: 14673/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMNC_fuzzer-5640217517621248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 279d9a84af )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
5fbc6dcdcc
avcodec/aacdec_template: skip apply_tns() if max_sfb is 0 (from previous header decode failure)
...
Fixes: NULL pointer dereference
Fixes: 14723/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5654612436058112
Fixes: 14724/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5712607111020544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf3156e762 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
42245d49a4
avcodec/aacdec_fixed: Handle more extreem cases in noise_scale()
...
Its unclear if these cases have any relevance in real files
Fixes: shift exponent -2 is negative
Fixes: 14489/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5681941631729664
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d14663f83 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
11f5eb0f16
avcodec/aacdec_template: Merge 3 #ifs related to noise handling
...
Fewer #if and fewer lines
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc33c99d56 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
a527b49cb9
avcodec/aacdec_fixed: ssign seems always -1 in noise_scale(), simplify
...
(cherry picked from commit 3d5863d739 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
3760f17e9b
avformat/mp3enc: Avoid SEEK_END as it is unsupported
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf3ee6a130 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
57e9b3cac1
avcodec/truemotion2: Fix several integer overflows in tm2_update_block()
...
Fixes: signed integer overflow: -1877966852 + -469491713 cannot be represented in type 'int'
Fixes: 14561/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5167608359288832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8eecf761a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
75501f90fd
avformat/webm_chunk: Specify expected argument length of get_chunk_filename()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1a74b04737 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
fd05665f9c
avformat/webm_chunk: Check header filename length
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3b5b977c9f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
7ffd2ae87e
avcodec/cpia: Check input size also against linesizes and EOL
...
Fixes: Timeout (14sec -> 29ms)
Fixes: 14733/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CPIA_fuzzer-5707022445576192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Carl Eugen Hoyos <ceffmpeg@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3c0bfa7d1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
0a0f052868
swscale/tests/swscale: Lengthen pixfmt name buffer to 21 bytes
...
Some formats use longer names than 12.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d269301f0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Adam Richter
b6529605ce
libswcale: Fix possible string overflow in test.
...
In libswcale/tests/swcale.c, the function fileTest() calls sscanf in
an argument of "%12s" on character srcStr[] and dstStr[], which are
only 12 bytes. So, if the input string is 12 characters, a
terminating null byte can be written past the end of these arrays.
This bug was found by cppcheck.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b8ed493061 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
1d015d840b
avcodec/hq_hqa: Check available space before reading slice offsets
...
Fixes: Timeout (43sec -> 18sec)
Fixes: 14556/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-5673543024508928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 407e7c34ca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Andreas Rheinhardt
85578838cb
lavf/webm_chunk: Respect buffer size
...
The last argument of av_strlcpy is supposed to contain the size of the
destination buffer, but it was filled with the size of the source
string, effectively negating its very purpose.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73ef1f47f5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
8c9e131d3a
avcodec/fits: Check bitpix
...
Reference: Table 8: Interpretation of valid BITPIX value from FITS standard 4.0
Fixes: runtime error: division by zero
Fixes: 14581/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5652382425284608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0b5c93b276 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
0060dc62f1
avcodec/jvdec: Use ff_get_buffer() when the content is not reused
...
Fixes: Timeout (11sec -> 5sec)
Fixes: 14473/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JV_fuzzer-5761630857592832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 09edcd3572 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
5ea8ce3b37
avcodec/truemotion2: Fix 2 integer overflows in tm2_update_block()
...
Fixes: signed integer overflow: -2147483648 + -1 cannot be represented in type 'int'
Fixes: 14107/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5694078680825856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f4a1b8d409 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
08d736d536
avcodec/gdv: Check input palette size before rescale()
...
Fixes: Timeout (22sec -> 11sec)
Fixes: 13576/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_GDV_fuzzer-5681024577568768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f857753f56 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
3f950b866a
avcodec/jpeg2000: Check stepsize before using it
...
Fixes: value 1.87633e+10 is outside the range of representable values of type 'int'
Fixes: Undefined behavior
Fixes: 14246/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5758393601490944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 06ef186fa1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
d5ba641ff4
avcodec/aacdec_fixed: Fix undefined shift in noise_scale()
...
Fixes: 13655/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5120559430500352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ea211ab79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
d8bdc95457
avutil/avstring: Fix bug and undefined behavior in av_strncasecmp()
...
The function in case of n=0 would read more bytes than 0.
The end pointer could be beyond the allocated space, which
is undefined.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6f0e9a8634 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
05a90821d0
avformat/mov: Skip stsd adjustment without chunks
...
Fixes: Assertion failure
Fixes: clusterfuzz-testcase-minimized-media_pipeline_integration_fuzzer-5683096400822272
Found-by: Clusterfuzz
Reported-by: Dan Sanders <sandersd@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 18a567c369 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
9b4004c054
avformat/aadec: Check for scanf() failure
...
Fixes: use of uninitialized variables
Fixes: blank.aa
Found-by: Chamal De Silva <chamal.desilva@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ed188f6dcd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
d39467262d
avcodec/ccaption_dec: Add a blank like at the end to avoid rollup reading from outside
...
Fixes: index 20 out of bounds for type 'const char *[4][128]'
Fixes: 14367/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CCAPTION_fuzzer-5718819672162304
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f17e8e90bb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
92205c4a1d
avcodec/ivi: Move buffer/block end check to caller of ivi_dc_transform()
...
Fixes: assertion failure
Fixes: 14078/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO5_fuzzer-5760571284127744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 110dce9633 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
fb3135ae97
avcodec/diracdec: Use 64bit in intermediate of global motion vector field generation
...
It seems the specification does not limit the value to 32bit
Fixes: signed integer overflow: -109611143 * 24 cannot be represented in type 'int'
Fixes: 13477/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5648337460527104
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 837820f385 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Michael Niedermayer
6a0895bdf3
avcodec/truemotion2: Fix integer overflow in tm2_decode_blocks()
...
Fixes: signed integer overflow: 255 + 2147483634 cannot be represented in type 'int'
Fixes: 13472/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5712444142387200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ad0533e91 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-06-27 17:50:47 +02:00
Andreas Rheinhardt
b5229a0b3e
movsub_bsf: Fix mov2textsub regression
...
The mov flavour of timed text uses the first two bytes of the packet as
a length field. And up until 11bef2fe said length field has been read
correctly in the mov2textsub bsf. But since then the next two bytes are
read as if they were the length field. This is fixed in this commit.
Reviewed-by: Philip Langdale <philipl@overt.org >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 800f618a34 )
2019-06-24 23:55:17 -03:00
Jun Zhao
72f03b2af4
lavc/libaomenc: Add a maximum constraint of 64 encoder threads.
...
fixed the error in Intel(R) Xeon(R) Gold 6152 CPU like:
[libaom-av1 @ 0x469f340] Failed to initialize encoder: Invalid parameter
[libaom-av1 @ 0x469f340] Additional information: g_threads out of range [..MAX_NUM_THREADS]
Signed-off-by: Jun Zhao <mypopydev@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit b87063c06d )
2019-06-17 18:50:05 -03:00
James Almer
7211e1ca93
avformat/aacdec: fix demuxing of small frames
...
10 bytes (id3v2 header amount of bytes) were being read before any checks
were made on the bitstream. The result was that we were overreading into
the next frame if the current one was 8 or 9 bytes long.
Fixes tickets #7271 and #7869 .
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit d88193c219 )
2019-05-06 13:53:39 -03:00
Sergey Svechnikov
7c2dd1f969
avcodec/cuviddec: improve progressive frame detection
...
There are 2 types of problems when using adaptive deinterlace with cuvid:
1. Sometimes, in the middle of transcoding, cuvid outputs frames with visible horizontal lines (as though weave deinterlace method was chosen);
2. Occasionally, on scene changes, cuvid outputs a wrong frame, which should have been shown several seconds before (as if the frame was assigned some wrong PTS value).
The reason is that sometimes CUVIDPARSERDISPINFO has property progressive_frame equal to 1 with interlaced videos.
In order to fix the problem we should check if the video is interlaced or progressive in the beginning of a video sequence (cuvid_handle_video_sequence).
And then we just use this information instead of the property progressive_frame in CUVIDPARSERDISPINFO (which is unreliable).
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2019-04-23 12:52:02 +02:00
Tristan Matthews
cf7a5c655c
avformat/matroskaenc: fix leak on error
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 1ec777dcdd )
2019-04-09 12:10:36 -03:00
Jeremy Dorfman
420fe39aff
avformat/av1: Initialize padding in ff_isom_write_av1c
...
Otherwise, AV1 encodes with FFmpeg trigger use-of-uninitialized-value
warnings under MemorySanitizer, and the output buffer potentially
changes from run to run.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit bb5efd1727 )
2019-04-09 12:08:30 -03:00
James Almer
ec82b3ecbb
avcodec/cbs_av1: fix parsing spatial_id
...
Reviewed-by: Mark Thompson <sw@jkqxz.net >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 461303f94a )
2019-04-02 18:04:53 -03:00
Michael Niedermayer
4154f89678
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-04-01 10:33:02 +02:00
Michael Niedermayer
6c75df556f
avcodec/rscc: Check that the to be uncompressed input is large enough
...
Fixes: Out of array access
Fixes: 13984/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RSCC_fuzzer-5734128093233152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a0ec1511e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-04-01 10:32:08 +02:00
James Almer
58cd70201e
avformat/movenc: free eac3 private data only when closing the stream
...
This makes sure the data is available when writing the moov atom during the
second pass triggered by the faststart movflag.
Fixes ticket #7780
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 27c94c57dc )
2019-03-31 20:36:41 -03:00
Michael Niedermayer
1d720b37f0
Update for 4.1.3
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-31 23:31:47 +02:00
Michael Niedermayer
f1ecebcdb7
avcodec/hevcdec: Avoid only partly skiping duplicate first slices
...
Fixes: NULL pointer dereference and out of array access
Fixes: 13871/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5746167087890432
Fixes: 13845/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5650370728034304
This also fixes the return code for explode mode
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 54655623a8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-31 23:30:09 +02:00
Carl Eugen Hoyos
daca529112
lavc/bmp: Avoid a heap buffer overwrite for 1bpp input.
...
Found by Mingi Cho, Seoyoung Kim, and Taekyoung Kwon
of the Information Security Lab, Yonsei University.
(cherry picked from commit 1e34014010 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-31 23:30:09 +02:00
Michael Niedermayer
65f94b732a
avcodec/mpegpicture: Check size of edge_emu_buffer
...
Fixes: OOM
Fixes: 13710/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5633152942342144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 635067b75f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-31 23:30:09 +02:00
Michael Niedermayer
ad0f4a7d10
avformat/mov: Fix potential integer overflow in entry check in mov_read_trun()
...
No testcase
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ff13a92a6f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-31 23:30:09 +02:00
Michael Niedermayer
cb4768e7f2
avcodec/truemotion2: Fix integer overflow in tm2_null_res_block()
...
Fixes: signed integer overflow: 1111638592 - -2122219136 cannot be represented in type 'int'
Fixes: 13441/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5732769815068672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1223696c72 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-31 23:30:09 +02:00
James Almer
6972b353b4
avcodec/cbs_av1: fix range of values for Mastering Display Color Volume Metadata OBUs
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 40490b3a63 )
2019-03-25 19:59:28 -03:00
James Almer
abf36b76de
avcodec/av1_parser: don't abort parsing the first frame if extradata parsing fails
...
The first frame contains the sequence header, which is needed to parse every
following frame.
This fixes parsing streams with broken extradata but correct packet data.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 699d0c2a30 )
2019-03-25 19:59:22 -03:00
Michael Niedermayer
a7cb7a2e43
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-21 09:02:44 +01:00
Michael Niedermayer
b429df281d
avcodec/dfa: Check the chunk header is not truncated
...
Fixes: Timeout (11sec -> 3sec)
Fixes: 13218/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DFA_fuzzer-5661074316066816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f20760fadb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-21 09:01:42 +01:00
Michael Niedermayer
7ce56329e7
avcodec/clearvideo: Check remaining data in P frames
...
Fixes: Timeout (19sec -> 419msec)
Fixes: 13411/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CLEARVIDEO_fuzzer-5733153811988480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 41f93f9411 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-21 09:01:42 +01:00
James Almer
dbef08b60f
avcodec/hevcdec: decode at most one slice reporting being the first in the picture
...
Fixes deadlocks when decoding packets containing more than one of the aforementioned
slices when using frame threads.
Tested-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 70c8c8a818 )
2019-03-20 20:28:04 -03:00
Michael Niedermayer
77d244e7a9
Update for 4.1.2
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 17:31:54 +01:00
Michael Niedermayer
8cee4190f3
avcodec/dvbsubdec: Check object position
...
Reference: ETSI EN 300 743 V1.2.1 7.2.2 Region composition segment
Fixes: Timeout
Fixes: 13325/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVBSUB_fuzzer-5143979392237568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8c5ae4511 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 16:54:31 +01:00
Michael Niedermayer
04ce4cc072
avcodec/cdgraphics: Use ff_set_dimensions()
...
Fixes: Timeout (17 sec -> 65 milli sec)
Fixes: 13264/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CDGRAPHICS_fuzzer-5711167941509120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9a9f0e239c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 16:54:10 +01:00
Michael Niedermayer
5d208aac52
avformat/gdv: Check fps
...
Fixes: Division by 0
Fixes: ffmpeg_zero_division.bin
Found-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38381400fc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 16:53:57 +01:00
Guo, Yejun
83bfd4f3b5
configure: use vpx_codec_vp8_dx/cx for libvpx-vp8 checking
...
Signed-off-by: Guo, Yejun <yejun.guo@intel.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit d9b2668766 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 11:51:09 +01:00
Guo, Yejun
9bf40978c6
configure: add missing pthreads extralibs dependency for libvpx-vp9
...
Signed-off-by: Guo, Yejun <yejun.guo@intel.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 402bf26237 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 11:49:55 +01:00
Michael Niedermayer
1e50a327c6
avcodec/mpeg4videodec: Check idx in mpeg4_decode_studio_block()
...
Fixes: Out of array access
Fixes: 13500/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5769760178962432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Kieran Kunhya <kierank@obe.tv >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d227ed5d59 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Michael Niedermayer
ad12d9df1e
avcodec/dxv: Correct integer overflow in get_opcodes()
...
Fixes: 13099/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_fuzzer-5665598896340992
Fixes: signed integer overflow: 2147483647 + 7 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6e0b5d3a20 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Michael Niedermayer
67d030787e
avcodec/scpr: Fix use of uninitialized variable
...
Fixes: Undefined shift
Fixes: 12911/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-5677102915911680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53248acfb3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Michael Niedermayer
c90836cc3d
avcodec/qpeg: Limit copy in qpeg_decode_intra() to the available bytes
...
Fixes: Timeout (27 sec -> 39 milli sec)
Fixes: 13151/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QPEG_fuzzer-5717536023248896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b819472995 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Michael Niedermayer
6c0124d392
avcodec/aic: Check remaining bits in aic_decode_coeffs()
...
Fixes: Timeout (78 seconds -> 2 seconds)
Fixes: 13186/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AIC_fuzzer-5639516533030912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 951bb7632f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Michael Niedermayer
29619a8ac2
avcodec/gdv: Check for truncated tags in decompress_5()
...
Testcase: 13169/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_GDV_fuzzer-5666354038833152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5cf42f65b6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Michael Niedermayer
09683e1f4e
avcodec/bethsoftvideo: Check block_type
...
Fixes: Timeout (17 seconds -> 1 second)
Fixes: 13184/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BETHSOFTVID_fuzzer-5711446296494080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b8ecadec05 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Michael Niedermayer
662b6351c8
avcodec/jpeg2000dwt: Fix integer overflow in dwt_decode97_int()
...
Fixes: runtime error: signed integer overflow: 2147483598 + 128 cannot be represented in type 'int'
Fixes: 12926/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5705100733972480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4801eea0d4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Michael Niedermayer
b8dd1d2d4b
avcodec/error_resilience: Use a symmetric check for skipping MV estimation
...
This speeds up the testcase by a factor of 4
Fixes: Timeout
Fixes: 13100/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV2_fuzzer-5767533905313792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e4289cb253 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Michael Niedermayer
92335fc02b
avcodec/mlpdec: Insuffient typo
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fc32e08941 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Michael Niedermayer
ff491b1544
avcodec/zmbv: obtain frame later
...
The frame is not needed that early so obtaining it later avoids
the costly operation in case other checks fail.
Fixes: Timeout (14sec -> 4sec)
Fixes: 13140/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZMBV_fuzzer-5738330308739072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 177b40890c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Michael Niedermayer
4e624c89fd
avcodec/jvdec: Check available input space before decode8x8()
...
Fixes: Timeout (78 sec -> 15 millisec)
Fixes: 13147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JV_fuzzer-5727107827630080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 61523683c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Michael Niedermayer
9495228df0
avcodec/h264_direct: Fix overflow in POC comparission
...
Fixes: runtime error: signed integer overflow: 2147421862 - -33624063 cannot be represented in type 'int'
Fixes: 12885/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5733516975800320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5ccf296e74 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Michael Niedermayer
339f40f618
avformat/webmdashenc: Check id in adaption_sets
...
Fixes: out of array access
Found-by: Wenxiang Qian
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b687b549aa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Wenxiang Qian
ec22b46a4d
avformat/http: Fix Out-of-Bounds access in process_line()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 85f91ed760 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Wenxiang Qian
11375cd101
avformat/ftp: Fix Out-of-Bounds Access and Information Leak in ftp.c:393
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a142ffdcae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Kevin Backhouse via RT
f7f3937494
avcodec/htmlsubtitles: Fixes denial of service due to use of sscanf in inner loop for handling braces
...
Fixes: [Semmle Security Reports #19439 ]
Fixes: dos_sscanf2.mkv
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 894995c41e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Kevin Backhouse via RT
cc5361ed18
avcodec/htmlsubtitles: Fixes denial of service due to use of sscanf in inner loop for tag scaning
...
Fixes: [Semmle Security Reports #19438 ]
Fixes: dos_sscanf1.mkv
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f00c97bc3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Michael Niedermayer
4d1fcd734e
avformat/matroskadec: Do not leak queued packets on sync errors
...
Fixes: memleak
Fixes: clusterfuzz-testcase-minimized-audio_decoder_fuzzer-5649187601121280
Reported-by: Chris Cunningham <chcunningham@google.com >
Tested-by: Chris Cunningham <chcunningham@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d1afa7284c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Michael Niedermayer
8066cb3556
avcodec/mpeg4videodec: Clear interlaced_dct for studio profile
...
Fixes: Out of array access
Fixes: 13090/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5408668986638336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Kieran Kunhya <kierank@obe.tv >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f686d023b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Michael Niedermayer
d25f388584
avformat/mov: Do not use reference stream in mov_read_sidx() if there is no reference stream
...
Fixes: NULL pointer dereference
Fixes: clusterfuzz-testcase-minimized-audio_decoder_fuzzer-5634316373721088
Reported-by: Chris Cunningham <chcunningham@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b0d8b7cb8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Michael Niedermayer
1a82246cae
avcodec/sbrdsp_fixed.c: remove input value limit for sbr_sum_square_c()
...
Fixes: 1377/clusterfuzz-testcase-minimized-5487049807233024
Fixes: assertion failure in sbr_sum_square_c()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4cde7e62db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Alex Mogurenko
7e204f7260
avcodec/prores_ks: Fix luma quantization if q >= MAX_STORED_Q
...
The problem occurs in slice quant estimation and slice encoding:
If the slice quant is larger than MAX_STORED_Q we don't use pre-calculated
quant matrices, but generate a new one, but both qmat and qmat_chroma both
point to the same table, so the luma table ends up having chroma table
values.
Add custom_chroma_q the same way as custom_q.
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
(cherry picked from commit e4788ae31b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-14 00:24:44 +01:00
Charles Liu
53f3f5233f
avformat/mov: fix hang while seek on a kind of fragmented mp4
...
Binary searching would hang if the fragment items do NOT have timestamp for the
specified stream.
For example, a fmp4 consists of separated 'moof' boxes for each track, and
separated 'sidx' for each segment, but no 'mfra' box. Then every fragment item
only have the timestamp for one of its tracks.
Example:
ffmpeg -f lavfi -i testsrc -f lavfi -i sine -movflags dash+frag_keyframe+skip_trailer+separate_moof -t 1 out.mp4
ffmpeg -ss 0.5 -i out.mp4 -f null none
Also fixes the hang in ticket #7572 , but not the reason for having
AV_NOPTS_VALUE timestamps there.
Signed-off-by: Charles Liu <liuchh83@gmail.com >
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit aa25198f1b )
2019-02-11 22:07:54 +01:00
Marton Balint
110eff79ca
avformat/async: fix assertion condition when draining buffer
...
Fixes some random assertion failures with
ffprobe -show_packets async:samples/ffmpeg-bugs/trac/ticket6132/Samsung_HDR_-_Chasing_the_Light.ts > /dev/null
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit 4b46d1ee46 )
2019-02-11 22:07:06 +01:00
James Almer
33c8009773
avcodec/cbs_av1: don't call cbs_av1_read_trailing_bits() when no bits remain in the OBU
...
Reviewed-by: jkqxz
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 3e8b8b6b50 )
2019-02-10 21:02:06 -03:00
Michael Niedermayer
74700e50bf
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-02-09 18:33:21 +01:00
chcunningham
00cdf4e4e5
avformat/mov: validate chunk_count vs stsc_data
...
Bad content may contain stsc boxes with a first_chunk index that
exceeds stco.entries (chunk_count). This ammends the existing check to
include cases where chunk_count == 0. It also patches up the case
when stsc refers to unknown chunks, but stts has no samples (so we
can simply ignore stsc).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1c15449ca9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-02-08 12:22:37 +01:00
chcunningham
bcc71f30ad
avformat/mov.c: require tfhd to begin parsing trun
...
Detecting missing tfhd avoids re-using tfhd track info from the previous
moof. For files with multiple tracks, this may make a mess of the
avindex and fragindex, which can later trigger av_assert0 in
mov_read_trun().
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ea87e5d9e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-02-08 12:22:13 +01:00
Michael Niedermayer
31a1d2aa83
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-02-04 00:51:42 +01:00
Michael Niedermayer
7816497ba0
avcodec/pgssubdec: Check for duplicate display segments
...
In such a duplication the previous gets overwritten and leaks
Fixes: memleak
Fixes: 12510/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGSSUB_fuzzer-5694439226343424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e35c3d887b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-02-04 00:32:09 +01:00
Michael Niedermayer
953f97979f
avformat/rtsp: Check number of streams in sdp_parse_line()
...
Fixes: OOM
Found-by: Michael Hanselmann <public@hansmi.ch >
Reviewed-by: Michael Hanselmann <public@hansmi.ch >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 497c9b0cce )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-31 18:03:35 +01:00
Michael Niedermayer
e75a73d629
avformat/rtsp: Clear reply in every iteration in ff_rtsp_connect()
...
Fixes: Infinite loop
Found-by: Michael Hanselmann <public@hansmi.ch >
Reviewed-by: Michael Hanselmann <public@hansmi.ch >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0b50f27635 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-31 17:29:41 +01:00
Michael Niedermayer
b482e94e59
avcodec/rasc: Move ff_get_buffer() after frame checks
...
If the frame1/2 checks fail this avoids doing the allocation of a new frame
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9f4af97aff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-31 17:29:05 +01:00
Michael Niedermayer
0f1332309a
avcodec/rasc: Check uncompressed dlta size
...
We assume that if the compressed size is bigger than if each byte is encoded in a single raw packet
that the data is invalid.
Fixes: Out of memory
Fixes: 12208/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RASC_fuzzer-5648916473708544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f4079d5174 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-31 17:28:23 +01:00
Michael Niedermayer
f5c9753bfd
avcodec/fic: Check that there is input left in fic_decode_block()
...
Fixes: Timeout
Fixes: 12450/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FIC_fuzzer-5661984622641152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit db1c4acd02 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-31 17:23:01 +01:00
Michael Niedermayer
d8b8b27dc3
avcodec/ilbcdec: Fix undefined integer overflow lsf2poly()
...
The addition is moved up into the context where the variable is unsigned avoiding
the undefined behavior
Fixes: runtime error: signed integer overflow: 2147481972 + 4096 cannot be represented in type 'int'
Fixes: 12444/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ILBC_fuzzer-5755706244857856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4523cc5e75 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-31 17:20:38 +01:00
Michael Niedermayer
62f5325ca3
avcodec/ilbcdec: Fix integer overflow in construct_vector()
...
webrtc contains explicit code to ignore the undefined behavior (RTC_NO_SANITIZE / OverflowingAddS32S32ToS32())
Probably fixes: Integer overflow (unreproducable here)
Probably fixes: 12215/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ILBC_fuzzer-5767142427852800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c95d0fb239 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-31 17:20:24 +01:00
Michael Niedermayer
bcfd82b0be
Update for 4.1.1
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 08:34:57 +01:00
Michael Niedermayer
31fa50f3d9
avcodec/prosumer: Error out if decompress() stops reading data
...
if 0 is encountered in the LUT then decompress() will continue to output 0 bytes but never read more data.
Without a specification it is impossible to say if this is invalid or a feature.
None of the valid prosumer files tested cause a 0 to be read, so it is likely
not a intended feature.
Fixes: Timeout
Fixes: 11266/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PROSUMER_fuzzer-5681827423977472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 62f8d27ef1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
552733d48b
avcodec/tiff: Check for 12bit gray fax
...
Fixes: Assertion failure
Fixes: 11898/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5759794191794176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec28a85107 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
a8b5990f45
avutil/imgutils: Optimize memset_bytes() by using av_memcpy_backptr()
...
This is strongly based on code by Marton Balint, and depends on the previous commit
Fixes: Timeout
Fixes: 11502/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WCMV_fuzzer-5664893810769920
Before: Executed clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WCMV_fuzzer-5664893810769920 in 11209 ms
After: Executed clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WCMV_fuzzer-5664893810769920 in 4104 ms
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f64c0dffa1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
cb6af7dfa1
avutil/mem: Optimize fill32() by unrolling and using 64bit
...
Reviewed-by: Marton Balint <cus@passwd.hu >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 12b1338be3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
James Almer
29d978c91e
configure: bump year
...
Happy new year!
(cherry picked from commit 3209d7b393 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
3a52cae2c7
avcodec/tests/rangecoder: initialize array to avoid valgrind warning
...
Found-by: jamrial
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c15972f0af )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
792df36f42
avcodec/gdv: Optimize and factorize scaling loops
...
Fixes: Timeout
Fixes: 11067/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_GDV_fuzzer-5686623711264768
Before change: Executed clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_GDV_fuzzer-5686623711264768 in 34386 ms
After change: Executed clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_GDV_fuzzer-5686623711264768 in 24327 ms
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6e23736aef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
c694273feb
avcodec/h264_slice: Fix integer overflow in implicit_weight_table()
...
Fixes: signed integer overflow: 2 * 2132811760 cannot be represented in type 'int'
Fixes: 11156/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-6237685933408256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 77e56d74f9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
9239d58b36
avcodec/exr: set layer_match in all branches
...
Otherwise it is left to the value from the previous iteration
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 433d2ae435 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
1623f42d99
avcodec/exr: Check for duplicate channel index
...
Fixes: Out of memory
Fixes: 11582/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5730204559867904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f9728feaf9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
99576bf034
avfilter/vf_tonemap_opencl: Make static tables const
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47c3a10b16 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
e385fc45dd
doc/indevs: fix upto typo
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b33de55747 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
15857674c5
avcodec/4xm: Fix returned error codes
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 07607a1db8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
6b6c854658
avformat/libopenmpt: Fix successfull typo
...
Reviewed-by: Lou Logan <lou@lrcd.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 571af98a59 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
41ee513c81
avcodec/v4l2_m2m: fix cant typo
...
Reviewed-by: Lou Logan <lou@lrcd.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 062bf56393 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
33b4aba5bd
avcodec/mjpegbdec: Fix some misplaced {} and spaces
...
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 11a8d2ccab )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
David Bryant
ea279bd160
avformat/wvdec: detect and error out on WavPack DSD files
...
Not currently supported.
(cherry picked from commit db109373d8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
gxw
929b5519d8
avcodec/mips: Fix failed case: hevc-conformance-AMP_A_Samsung_* when enable msa
...
The AV_INPUT_BUFFER_PADDING_SIZE has been increased to 64, but the value is still 32
in function ff_hevc_sao_edge_filter_8_msa. So, use AV_INPUT_BUFFER_PADDING_SIZE directly.
Also, use MAX_PB_SIZE directly instead of 64. Fate tests passed.
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f652c7a45c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
5ed024e40b
avcodec/fic: Fail on invalid slice size/off
...
Fixes: Timeout
Fixes: 11486/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FIC_fuzzer-5677133863583744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 30a7a81cdc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
5550946ff4
avcodec/ilbcdec: fix integer overflow in energy
...
webrtc uses a int32_t like the existing code in ilbcdec
Fixes: signed integer overflow: 2080245063 + 257939661 cannot be represented in type 'int'
Fixes: 11037/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ILBC_fuzzer-5682976612941824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fbf409cd91 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
daef9d4382
postproc/postprocess_template: remove FF_REG_sp from clobber list
...
Future gcc may no longer support this
Tested-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1cbeb87db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
69f50eb915
postproc/postprocess_template: Avoid using %4 for the threshold compare
...
This avoids problems if %4 is the stack pointer
the constraints do not allow %4 to be the stack pointer but gcc 9 may
no longer support specifying such constraints
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4325527e1c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Jacob Trimble
73c90818b1
libavformat/mov: Fix NULL-dereference read for some encrypted content.
...
When reading frames, we need to use the fragment for the correct
stream. Sometimes the "current" fragment is not the same as the one
the frame is for.
Found by Chromium's ClusterFuzz:
https://crbug.com/906392 and https://crbug.com/915524
Signed-off-by: Jacob Trimble <modmaker@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 555f332e7a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
c22b67feaa
avcodec/rpza: Check that there is enough data for all the blocks
...
Fixes: Timeout
Fixes: 11547/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RPZA_fuzzer-5678435842654208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e63517e00a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
4c0be3a60c
avcodec/rpza: Move frame allocation to a later point
...
This will allow performing some fast checks before the slow allocation
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8a708aa99c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
42357b37cb
avcodec/avcodec: Document the data type for AV_PKT_DATA_MPEGTS_STREAM_ID
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 68e011e410 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
e3fbbb7d18
avformat/mpegts: Fix side data type for stream id
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab1319d82f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
2f75965c47
tests/fate/filter-video: increase fuzz for fate-filter-refcmp-psnr-rgb
...
Fixes: test failure on powerpc
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f8f762c300 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
e1f40f0dae
avcodec/mjpegdec: Fix indention of ljpeg_decode_yuv_scan()
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea30ac1e40 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
chcunningham
45f5f2086e
lavf/id3v2: fail read_apic on EOF reading mimetype
...
avio_read may return EOF, leaving the mimetype array unitialized. fail
early when this occurs to avoid using the array in an unitialized state.
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ee1e39a576 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
321c418b87
avcodec/rasc: Check that the number of moves is less than or equal the number of pixels
...
Fixes: OOM
Fixes: 10307/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RASC_fuzzer-5393974559244288
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 092cb17983 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
f5859d4a8e
avformat/nutenc: Document trailer index assert better
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a95b73abc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
chcunningham
54fbdacc37
lavf/mov: ensure only one tkhd per trak
...
Chromium fuzzing produced a whacky file with extra tkhds. This caused
an AVStream that was already in use to be corrupted by assigning it a
new id, which blows up later in mov_read_trun because the
MOVFragmentStreamInfo.index_entry now points OOB.
Reviewed-by: Baptiste Coudurier <baptiste.coudurier@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9f7b6f7a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
228f17ced3
avcodec/clearvideo: Check remaining input bits in P macro block loop
...
Fixes: Timeout
Fixes: 11083/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CLEARVIDEO_fuzzer-5657180351496192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7aaab127be )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
9b5a6bb67b
avcodec/rasc: Check input space before reading chunk
...
Fixes: Timeout
Fixes: 11118/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RASC_fuzzer-5652564066959360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 52ba824c65 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
219cbc5527
avcodec/dxv: Check that there is enough data to decompress
...
Fixes: Timeout
Fixes: 10979/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_fuzzer-6178582203203584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2bc3811c0d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
55c36d2498
avcodec/ppc/hevcdsp: Fix build failures with powerpc-linux-gnu-gcc-4.8 with --disable-optimizations
...
The affected functions could also be changed into macros, this is the
smaller change to fix it though. And avoids (probably) less readable macros
The extra code should be optimized out when optimizations are done as all values
are known at build after inlining.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c64a6bcd2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
558ba71de5
avcodec/msvideo1: Check for too small dimensions
...
Such low resolution would result in empty output as a minimum of 4x4 is needed
We could also check for multiple of 4 dimensions but that is not needed
Fixes: Timeout
Fixes: 11191/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSVIDEO1_fuzzer-5739529588178944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 953bd58861 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
1a5db666ac
avcodec/wmv2dec: Skip I frame if its smaller than 1/8 of the minimal size
...
Frames that small are not valid and of limited use for error concealment, while
being very computationally intensive to process.
Fixes: Timeout
Fixes: 11168/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV2_fuzzer-5733782032744448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d6f4341522 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
eee0cf487a
avcodec/msmpeg4dec: Skip frame if its smaller than 1/8 of the minimal size
...
Frames that small are not valid and of limited use for error concealment, while
being very computationally intensive to process.
Fixes: Timeout
Fixes: 11318/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSMPEG4V1_fuzzer-5710884555456512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 09ec182864 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
90db1e441f
avcodec/truemotion2rt: Fix rounding in input size check
...
Fixes: Timeout
Fixes: 11332/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2RT_fuzzer-5678456612847616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f22a4ebc9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
4fe90900d8
avcodec/diracdec: Check component quant
...
Fixes: Timeout
Fixes: 10708/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5730140957442048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 28c96c2ce2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:26 +01:00
Michael Niedermayer
ee349bd0fd
avcodec/tiff: Limit filtering to decoded data
...
Fixes: Timeout
Fixes: 11068/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5698456681709568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 90ac0e5f29 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:25 +01:00
Michael Niedermayer
ab744447e1
avcodec/truemotion2: fix integer overflows in tm2_low_chroma()
...
Fixes: 11295/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-4888953459572736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ae39d7956 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:25 +01:00
Michael Niedermayer
89d65915cf
avcodec/pngdec: Check compression method
...
method 0 (inflate/deflate) is the only specified in the specification and the only supported
Fixes: Timeout
Fixes: 10976/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PNG_fuzzer-5729372588736512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f99674ddd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:25 +01:00
Michael Niedermayer
e69bb0fb05
fftools/ffmpeg: Repair reinit_filter feature
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3504004879 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:25 +01:00
Michael Niedermayer
98a9d868d1
avcodec/shorten: Fix integer overflow with offset
...
Fixes: signed integer overflow: -1625810908 - 582229060 cannot be represented in type 'int'
Fixes: 10977/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5732602018267136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f888771cd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:25 +01:00
Michael Niedermayer
b66152a4e5
avcodec/imm4: Use ff_set_dimensions()
...
Fixes: Out of memory
Fixes: 10970/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IMM4_fuzzer-5698750043914240
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c305e134ce )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:25 +01:00
Andreas Rheinhardt
ac50246cc4
h264_redundant_pps: Fix logging context
...
The first element of H264RedundantPPSContext is not a pointer to an
AVClass as required.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6dafcb6fdb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-01-21 07:53:25 +01:00
Marton Balint
ddc284300e
avfilter/af_asetnsamples: fix last frame props
...
Frame properties were not copied, so e.g. PTS was not set for the last frame.
Regression since ef3babb2c7 .
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit f9e947845f )
2019-01-01 20:39:44 +01:00
Mark Thompson
b420f23566
cbs_av1: Fix reading of overlong uvlc codes
...
The specification allows 2^32-1 to be encoded as any number of zeroes
greater than 31, followed by a one. This previously failed because the
trace code would overflow the array containing the string representation
of the bits if there were more than 63 zeroes. Fix that by splitting the
trace output into batches, and at the same time move it out of the default
path.
(While this seems likely to be a specification error, libaom does support
it so we probably should as well.)
From a test case by keval shah <skeval65@gmail.com >.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b97a4b6588 )
2018-12-22 18:28:41 +00:00
James Almer
5356e61001
avcodec/cbs_av1: fix parsing delta_frame_id_minus1
...
delta_frame_id_minus1 is not a single value in the bitstream, and can
store values up to 17 bits wide.
Fixes parsing files with frame ids.
Reviewed-by: Mark Thompson <sw@jkqxz.net >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 064f9505f4 )
2018-12-20 18:29:42 -03:00
Paul B Mahol
a4ddc3c9fc
avfilter/vf_overlay: fix filtering with negative y
...
(cherry picked from commit 8440835dbe )
2018-12-14 23:56:21 +01:00
Paul B Mahol
59e30c05d7
avformat/movenc: get number of written bytes from bitstream writer
...
Update fate test.
(cherry picked from commit 97d1ee437b )
2018-11-26 15:36:12 +01:00
Paul B Mahol
fcffed470a
avformat/movenc: fix size calculation in mov_write_eac3_tag()
...
Otherwise it would assert when flushing bits.
(cherry picked from commit 027f032bbc )
2018-11-26 15:36:05 +01:00
Paul B Mahol
9efc591cb7
avfilter/vf_overlay: fix crash with negative y
...
(cherry picked from commit 57815cfad5 )
2018-11-25 12:46:56 +01:00
Marton Balint
d4c5f515f0
avcodec/mpeg_er: fix clearing chroma blocks for 422 and 444
...
Fixes ticket #7494 .
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit e3a9630982 )
2018-11-19 23:29:30 +01:00
Marton Balint
bb01cd3cc0
avfilter/af_afade: fix duration maximum
...
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit aecd63b926 )
2018-11-15 22:34:53 +01:00
Mark Harris
fed94c2f22
avfilter/vf_fade: fix start/duration max value
...
A fade out (usually at the end of a video) can easily start beyond
INT32_MAX (about 36 minutes). Regression since d40dc64173 .
(cherry picked from commit ae4323548a )
2018-11-15 22:34:34 +01:00
James Almer
a9e9303f26
avcodec/cbs_av1: fix parsing signed integer values
...
Reviewed-by: Mark Thompson <sw@jkqxz.net >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit f0f2832a5c )
2018-11-14 20:53:44 -03:00
James Almer
49bc641e89
avcodec/cbs_av1: fix storage size for segmentation_params feature_value fields
...
The valid range is -255 to 255.
Reviewed-by: Mark Thompson <sw@jkqxz.net >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 79831f4531 )
2018-11-14 20:53:40 -03:00
Mark Thompson
4f1e07090a
configure: Add missing xlib dependency for VAAPI X11 code
...
Fixes #7538 .
(cherry picked from commit 2ce3a48f30 )
2018-11-14 23:24:51 +00:00
Mark Wu
11dff170ef
avcodec/hevcdec: fix non-ref frame judgement
...
After inspecting the source code of x265, mpv and ffmpeg, I've found that
ffmpeg mistakenly regards EVC_NAL_BLA_N_LP and HEVC_NAL_IDR_N_LP as non-
reference frames, which are acutally reference frames according to the
specification in x265, and drops them.
This patch should address the problem. I have tested it with mpv.
Signed-off-by: Mark Wu <wfwf1997@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 10bc4c3a7d )
2018-11-10 14:38:25 -03:00
Mark Thompson
10506de9ad
cbs_av1: Support redundant frame headers
...
(cherry picked from commit f5894178fb )
2018-11-05 23:11:03 +00:00
Mark Thompson
af3fccfeff
cbs_av1: Fix header writing when already aligned
...
(cherry picked from commit 6bdb7712ae )
2018-11-05 23:10:57 +00:00
Mark Thompson
ec1b5216fc
configure: Add missing V4L2 M2M decoder BSF dependencies
...
(cherry picked from commit e9d2e3fdaa )
2018-11-05 23:10:49 +00:00
Mark Thompson
066ff02621
configure: Add missing IVF muxer BSF dependency
...
(cherry picked from commit a4fb2b1150 )
2018-11-05 23:10:41 +00:00
James Almer
398a70309e
avcodec/cbs_av1: fix decoder/encoder_buffer_delay variable types
...
buffer_delay_length_minus_1 is five bits long, meaning decode_buffer_delay and
encoder_buffer_delay can have values up to 32 bits long.
Reviewed-by: Mark Thompson <sw@jkqxz.net >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 89a0d33e3a )
2018-11-04 22:06:20 -03:00
Mark Thompson
acd13f1255
configure: Fix av1_metadata BSF dependency
...
(cherry picked from commit 34429182b9 )
2018-11-04 22:06:11 -03:00
James Almer
1c98cf4ddd
avformat/ivfenc: use the av1_metadata bsf to insert Temporal Delimiter OBUs if needed
...
Reviewed-by: Mark Thompson <sw@jkqxz.net >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 2d2af23349 )
2018-11-04 22:06:08 -03:00
Marton Balint
63c1e291ef
avformat/ftp: allow nonstandard 202 reply to OPTS UTF8
...
Fixes ticket #7481 .
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit 8e5a2495a8 )
2018-11-04 22:55:09 +01:00
Michael Niedermayer
7ebc27e1fa
avcodec/cavsdec: Propagate error codes inside decode_mb_i()
...
Fixes: Timeout
Fixes: 10702/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5669940938407936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1cee05656 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-04 20:26:49 +01:00
Michael Niedermayer
bc5777bdab
avcodec/mpeg4videodec: Clear partitioned frame in decode_studio_vop_header()
...
partitioned_frame is also set/cleared in decode_vop_header()
Fixes: out of array read
Fixes: 9789/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5638681627983872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 074187d599 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-04 20:26:49 +01:00
Michael Niedermayer
7d23ccac8d
avcodec/mpegaudio_parser: Consume more than 0 bytes in case of the unsupported mp3adu case
...
Fixes: Timeout
Fixes: 10966/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP3ADU_fuzzer-5348695024336896
Fixes: 10969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP3ADUFLOAT_fuzzer-5691669402877952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df91af140c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-04 20:26:49 +01:00
Michael Niedermayer
2f04b78b95
avcodec/prosumer: Simplify bit juggling of the c variable in decompress()
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 66425add27 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-04 20:26:49 +01:00
Michael Niedermayer
fd05e20650
avcodec/prosumer: Remove always true check in decompress()
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1dfa0b6f36 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-04 20:26:49 +01:00
Michael Niedermayer
a163384467
avcodec/prosumer: Remove unneeded ()
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 506839a3e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-04 20:26:49 +01:00
Michael Niedermayer
b9875b7583
avcodec/prosumer: Check for bytestream eof in decompress()
...
Fixes: Infinite loop
Fixes: 10685/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PROSUMER_fuzzer-5652236881887232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9acdf17b2c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-04 20:26:49 +01:00
Philip Langdale
ebc1c49e41
avfilter/vf_cuda_yadif: Avoid new syntax for vector initialisation
...
This requires a newer version of CUDA than we want to require.
(cherry picked from commit 8e50215b5e )
2018-11-03 15:50:31 -07:00
Philip Langdale
6feec11e48
avcodec/nvdec: Increase frame pool size to help deinterlacing
...
With the cuda yadif filter in use, the number of mapped decoder
frames could increase by two, as the filter holds on to additional
frames.
(cherry picked from commit 1b41115ef7 )
2018-11-03 15:50:25 -07:00
Philip Langdale
67126555fc
avfilter/vf_yadif_cuda: CUDA accelerated yadif deinterlacer
...
This is a cuda implementation of yadif, which gives us a way to
do deinterlacing when using the nvdec hwaccel. In that scenario
we don't have access to the nvidia deinterlacer.
(cherry picked from commit d5272e94ab )
2018-11-03 15:50:12 -07:00
Philip Langdale
041231fcd6
libavfilter/vf_yadif: Make frame management logic and options shareable
...
I'm writing a cuda implementation of yadif, and while this
obviously has a very different implementation of the actual
filtering, all the frame management is unchanged. To avoid
duplicating that logic, let's make it shareable.
From the perspective of the existing filter, the only real change
is introducing a function pointer for the filter() function so it
can be specified for the specific filter.
(cherry picked from commit 598f0f3927 )
2018-11-03 15:45:55 -07:00
Josh de Kock
765fb1f224
fate/api-h264-slice-test: use cleaner error handling
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 1052578dad )
2018-11-03 12:57:51 -03:00
Josh de Kock
5060a615c7
fate/api-h264-slice-test: don't use ssize_t
...
Fixes ticket #7521
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 8096f52049 )
2018-11-03 12:57:37 -03:00
Michael Niedermayer
1665ac6a44
RELEASE_NOTES: Based on the version from 4.0
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-02 01:36:21 +01:00
Michael Niedermayer
3c7e973430
Update for 4.1
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-02 01:33:08 +01:00