Michael Niedermayer
4fb9e37c9f
Update for 4.2.8
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 22:09:57 +02:00
Michael Niedermayer
6447e6bb09
avformat/vividas: Check packet size
...
Fixes: signed integer overflow: 119760682 - -2084600173 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-6745781167587328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f44489cc5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:12 +02:00
Michael Niedermayer
23d078dbd1
avcodec/dstdec: Check for overflow in build_filter()
...
Fixes: signed integer overflow: 1917019860 + 265558963 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-4833165046317056
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8008940da5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:11 +02:00
Michael Niedermayer
674f7c87c9
avformat/spdifdec: Use 64bit to compute bit rate
...
Fixes: signed integer overflow: 32 * 553590816 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-6564974517944320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4075f0cec1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:11 +02:00
Michael Niedermayer
619612ac01
avformat/rpl: Use 64bit for duration computation
...
Fixes: signed integer overflow: 24709512 * 88 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6737973728641024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 529f64b2eb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:11 +02:00
Michael Niedermayer
caa009a3fb
avformat/xwma: Use av_rescale() for duration computation
...
Fixes: signed integer overflow: 34242363648 * 538976288 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6577923913547776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c789f753c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:10 +02:00
Michael Niedermayer
3f283529f7
avformat/sdsdec: Use av_rescale() to avoid intermediate overflow in duration calculation
...
Fixes: signed integer overflow: 72128794995445727 * 240 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_SDS_fuzzer-6628185583779840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa8eb1bed0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:10 +02:00
Michael Niedermayer
0a5e3c39eb
avformat/rmdec: check tag_size
...
Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6598073725353984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2cb7ee8a36 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:10 +02:00
Michael Niedermayer
8ab83a7714
avformat/nutdec: Check fields
...
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6566001610719232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c146406ea )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:09 +02:00
Michael Niedermayer
a3169bd843
avformat/flvdec: Use 64bit for sum_flv_tag_size
...
Fixes: signed integer overflow: 2138820085 + 16130322 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_LIVE_FLV_fuzzer-6704728165187584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7124f10c1d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:09 +02:00
Michael Niedermayer
cc57578a35
avformat/dxa: avoid bpc overflows
...
Fixes: signed integer overflow: 2147483647 + 32 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-6639823726706688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93db0f0740 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:09 +02:00
Michael Niedermayer
bf1893f342
avformat/cafdec: Check that nb_frasmes fits within 64bit
...
Fixes: signed integer overflow: 1099511693312 * 538976288 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6565048815845376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d4bb4e3759 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:08 +02:00
Michael Niedermayer
0c56afb8d6
avformat/asfdec_o: Limit packet offset
...
avoids overflows with it
Fixes: signed integer overflow: 9223372036846866010 + 4294967047 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6538296768987136
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-657169555665715
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 736e9e69d5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:08 +02:00
Michael Niedermayer
4235afc12c
avformat/ape: Check frames size
...
Fixes: signed integer overflow: 9223372036854775806 + 3 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_APE_fuzzer-6389264140599296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d0349c9929 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:08 +02:00
Michael Niedermayer
297ef9edd9
avformat/icodec: Check nb_pal
...
Fixes: signed integer overflow: 538976288 * 4 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-6690068904935424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit db73ae0dc1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:07 +02:00
Michael Niedermayer
9053465771
avformat/aiffdec: Use 64bit for block_duration use
...
Fixes: signed integer overflow: 3 * -2147483648 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6668935979728896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9303ba272e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:07 +02:00
Michael Niedermayer
f129928164
avformat/aiffdec: Check block_duration
...
Fixes: signed integer overflow: 3 * -2147483648 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6668935979728896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1c2b6265c8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:07 +02:00
Michael Niedermayer
b6b9c173e0
avformat/mxfdec: only probe max run in
...
Suggested-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1182bbb2c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:06 +02:00
Michael Niedermayer
c75a0b98f8
avformat/mxfdec: Check run_in is within 65536
...
Fixes: signed integer overflow: 9223372036854775807 - -2146905566 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6570996594769920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7786097825 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:06 +02:00
Michael Niedermayer
f1e46857cc
avcodec/apedec: Fix integer overflow in filter_3800()
...
Fixes: signed integer overflow: -2147448926 + -198321 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5739619273015296
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6744428485672960
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f05247f6a4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:06 +02:00
Michael Niedermayer
9645062686
avcodec/tta: Check 24bit scaling for overflow
...
Fixes: signed integer overflow: -8427924 * 256 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5409428670644224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3993345f91 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:05 +02:00
Michael Niedermayer
b14de343c7
avcodec/tiff: Fix loop detection
...
Fixes regression with tickets/4364/L1004220.DNG
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 43a4854510 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:05 +02:00
Michael Niedermayer
3b184fab45
libavformat/hls: Free keys
...
Fixes: memleak
Fixes: 50703/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-6399058578636800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Steven Liu <lingjiujianke@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d32a9f3137 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:05 +02:00
Michael Niedermayer
6c6861279d
avcodec/fmvc: Move frame allocation to a later stage
...
This way more things are checked before allocation
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9783749c66 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:04 +02:00
Michael Niedermayer
f7c84aa4db
avfilter/vf_showinfo: remove backspaces
...
They mess with storing editing and comparing the results
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 31581ae7ee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:04 +02:00
Michael Niedermayer
5e6469b241
avcodec/speedhq: Check width
...
Fixes: out of array access
Fixes: 50014/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-4748914632294400
Alternatively the buffer size can be increased
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f0395f9ef6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:04 +02:00
Michael Niedermayer
9909b41f92
avcodec/bink: disallow odd positioned scaled blocks
...
Fixes: out of array access
Fixes: 47911/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6194020855971840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b14104a637 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:03 +02:00
Michael Niedermayer
48b8139b95
avformat/asfdec_o: limit recursion depth in asf_read_unknown()
...
The threshold of 5 is arbitrary, both smaller and larger should work fine
Fixes: Stack overflow
Fixes: 50603/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6049302564175872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f1a368169 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:03 +02:00
Michael Niedermayer
54efe79ce7
doc/git-howto.texi: Document commit signing
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ced0dc807e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:03 +02:00
Michael Niedermayer
b9a50e0161
libavcodec/8bps: Check that line lengths fit within the buffer
...
Fixes: Timeout
Fixes: undefined pointer arithmetic
Fixes: 50330/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EIGHTBPS_fuzzer-5436287485607936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2316d5ec1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:02 +02:00
Michael Niedermayer
e84ddc90c7
libavformat/iff: Check for overflow in body_end calculation
...
Fixes: signed integer overflow: -6322983228386819992 - 5557477266266529857 cannot be represented in type 'long'
Fixes: 50112/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6329186221948928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bcb4690304 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:02 +02:00
Michael Niedermayer
28f1396cfb
avformat/avidec: Prevent entity expansion attacks
...
Fixes: Timeout
Fixes no testcase, this is the same idea as similar attacks against XML parsers
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f3e823c2aa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:02 +02:00
Michael Niedermayer
457941c11a
avcodec/h263dec: Sanity check against minimal I/P frame size
...
Fixes: Timeout
Fixes: 49718/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4874987894341632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ca4ff9c21c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:01 +02:00
Michael Niedermayer
85f1286c8f
avcodec/hevcdec: Check s->ref in the md5 path similar to hwaccel
...
This is somewhat redundant with the is_decoded check. Maybe
there is a nicer solution
Fixes: Null pointer dereference
Fixes: 49584/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5297367351427072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3b51e19922 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:01 +02:00
Michael Niedermayer
6b42366763
MAINTAINERS: Add ED25519 key for signing my commits in the future
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 05225180be )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:01 +02:00
Michael Niedermayer
3a41f58c94
avcodec/hevc_filter: copy_CTB() only within width&height
...
Fixes: out of array access
Fixes: 49271/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5424984922652672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 009ef35d38 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:01 +02:00
Michael Niedermayer
1654bac49e
avformat/flvdec: Check for EOF in index reading
...
Fixes: Timeout
Fixes: 47992/clusterfuzz-testcase-minimized-ffmpeg_dem_LIVE_FLV_fuzzer-6020443879899136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ceff5d7b74 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:00 +02:00
Michael Niedermayer
1b8dbd0b37
avformat/nutdec: Check get_packetheader() in mainheader
...
Fixes; Timeout
Fixes: 48794/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6524604713140224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5de084aa6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:00 +02:00
Michael Niedermayer
ea1761e14d
avformat/asfdec_f: Use 64bit for packet start time
...
Fixes: signed integer overflow: 2147483647 + 32 cannot be represented in type 'int'
Fixes: 49014/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-6314973315334144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ed78486fc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:33:00 +02:00
Michael Niedermayer
52c4226a68
avcodec/lagarith: Check dst/src in zero run code
...
Fixes: out of array access
Fixes: 48799/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LAGARITH_fuzzer-4764457825337344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9450f75974 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:59 +02:00
Michael Niedermayer
43b4d0afd5
avcodec/h264dec: Skip late SEI
...
Fixes: Race condition
Fixes: clusterfuzz-testcase-minimized-mediasource_MP2T_AVC_pipeline_integration_fuzzer-6282675434094592
Found-by: google ClusterFuzz
Tested-by: Dan Sanders <sandersd@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f7dd408d64 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:59 +02:00
Michael Niedermayer
f5c39a8672
avcodec/sbrdsp_fixed: Fix integer overflows in sbr_qmf_deint_neg_c()
...
Fixes: signed integer overflow: 2147483645 + 16 cannot be represented in type 'int'
Fixes: 46993/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-4759025234870272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1537f40516 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:59 +02:00
Michael Niedermayer
30dff62b4f
avfilter/vf_signature: Fix integer overflow in filter_frame()
...
Fixes: CID1403233
The second of the 2 changes may be unneeded but will help coverity
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dd6040675e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:58 +02:00
Michael Niedermayer
ea9418debc
avformat/rtsp: break on unknown protocols
...
This function needs more cleanup and it lacks error handling
Fixes: use of uninitialized memory
Fixes: CID700776
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73c0fd27c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:58 +02:00
Michael Niedermayer
c7c63dead5
avcodec/hevcdsp_template: stay within tables in sao_band_filter()
...
Fixes: out of array read
Fixes: 47875/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5719393113341952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c5250a561 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:58 +02:00
Michael Niedermayer
a541add1b6
avcodec/qpeldsp: copy less for the mc0x cases
...
Fixes: out of array access
Fixes: 47936/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5745039940124672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e690d4edf5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:57 +02:00
Michael Niedermayer
2921c393b1
avcodec/ffv1dec: Limit golomb rice coded slices to width 8M
...
This limit is possibly not reachable due to other restrictions on buffers but
the decoder run table is too small beyond this, so explicitly check for it.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b4431399ec )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:57 +02:00
Michael Niedermayer
86cbbd66cd
avformat/iff: simplify duration calculation
...
Fixes: signed integer overflow: 315680096256 * 134215943 cannot be represented in type 'long long'
Fixes: 48713/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5886272312311808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0740641e93 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:57 +02:00
Michael Niedermayer
3ca6eeff77
avcodec/wnv1: Check for width =1
...
The decoder only outputs pixels for width >1 images, fail early
Fixes: Timeout
Fixes: 48298/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WNV1_fuzzer-6198626319204352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d98d5a436a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:56 +02:00
Michael Niedermayer
7513f8c036
avcodec/ffv1dec_template: fix indention
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eee7364c90 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:56 +02:00
Michael Niedermayer
84fbe1a05d
avformat/sctp: close socket on errors
...
This is untested as i have no testcase
Fixes: CID1302709
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9a2996544 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:56 +02:00
Michael Niedermayer
d4dad587e6
avcodec/aasc: Fix indention
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit af2ed09220 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:55 +02:00
Michael Niedermayer
d79de91f1e
avcodec/qdrw: adjust max colors to array size
...
Fixes: out of array access
Fixes: 48429/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDRAW_fuzzer-4608329791438848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cd847f86d3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:55 +02:00
Michael Niedermayer
0b999775a0
avcodec/alacdsp: Make intermediates unsigned
...
Fixes: signed integer overflow: -14914387 + -2147418648 cannot be represented in type 'int'
Fixes: 46464/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-474307197311385
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8709f4c10a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:55 +02:00
Michael Niedermayer
62e2545463
avformat/aiffdec: cleanup size handling for extreem cases
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c6f1e48b86 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:54 +02:00
Michael Niedermayer
92a4adfd8c
avcodec/jpeglsdec: fix end check for xfrm
...
Fixes: out of array access
Fixes: 47871/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMV_fuzzer-5646305956855808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6a82412bf3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:54 +02:00
Michael Niedermayer
d40c8b4202
avcodec/cdgraphics: limit scrolling to the line
...
Fixes: out of array access
Fixes: 47877/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CDGRAPHICS_fuzzer-5690504626438144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b7e30a13d4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:54 +02:00
Michael Niedermayer
4aeea332eb
avformat/aiffdec: avoid integer overflow in get_meta()
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 45891/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6159183893889024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6a02de2127 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:53 +02:00
Michael Niedermayer
b928cd3bda
avformat/ape: more bits in size for less overflows
...
Fixes: signed integer overflow: 2147483647 + 3 cannot be represented in type 'int'
Fixes: 46184/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-4678059519770624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e5f6707a7b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:53 +02:00
Michael Niedermayer
a162f52438
avformat/bfi: Check offsets better
...
Fixes: signed integer overflow: -2145378272 - 538976288 cannot be represented in type 'int'
Fixes: 45690/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5015496544616448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 35dc93ab44 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:53 +02:00
Michael Niedermayer
485aeea57c
avformat/asfdec_f: Check packet_frag_timestamp
...
Fixes: signed integer overflow: -9223372036854775808 - 4607 cannot be represented in type 'long'
Fixes: 45685/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5280102802391040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ffc8772150 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:52 +02:00
Michael Niedermayer
8987124bad
avcodec/texturedspenc: Fix indexing in color distribution determination
...
Fixes CID1396405
MSE and PSNR is slightly improved, and some noticable corruptions disappear as
well.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit ade36d61de )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:52 +02:00
Michael Niedermayer
c8177552a7
avformat/act: Check ff_get_wav_header() for failure
...
Fixes: missing error check
Fixes: CID717495
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5982da87e3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:52 +02:00
Michael Niedermayer
55a3423863
avfilter/vsrc_mandelbrot: Check for malloc failure
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fbd22504c4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:51 +02:00
Michael Niedermayer
54c4f1e32b
avfilter/vf_frei0r: Copy to frame allocated according to frei0r requirements
...
Fixes: issues with non trivial linesize
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d353909e77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:51 +02:00
Michael Niedermayer
ddc96fdb43
avfilter/video: Add ff_default_get_video_buffer2() to set specific alignment
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d740782701 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:51 +02:00
Michael Niedermayer
30ac63c8d2
avformat/genh: Check sample rate
...
Fixes: signed integer overflow: -2515507630940093440 * 4 cannot be represented in type 'long'
Fixes: 46318/clusterfuzz-testcase-minimized-ffmpeg_dem_GENH_fuzzer-5009637474172928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a3d790f197 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-09 21:32:50 +02:00
Christopher Degawa
839f98ff67
configure: extend SDL check to accept all 2.x versions
...
sdl2 recently changed their versioning, moving the patch level to minor level
cd7c2f1de7
and have said that they will instead ship sdl3.pc for 3.0.0
Fixes ticket 9768
Signed-off-by: Christopher Degawa <ccom@randomderp.com >
Signed-off-by: Gyan Doshi <ffmpeg@gyani.pro >
2022-06-10 13:58:36 +02:00
Michael Niedermayer
55a9533952
Update for 4.2.7
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-09 23:52:36 +02:00
Paul B Mahol
7d4c2d90b3
avfilter/vf_colorspace: fix memmory leaks
...
Fixes #8303
(cherry picked from commit fddef964e8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 20:00:05 +02:00
James Almer
3a04214c60
avformat/nutenc: don't allocate a dynamic AVIOContext if no index is going to be written
...
Fixes ticket #8295
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 1d479300cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 20:00:05 +02:00
Paul B Mahol
c6fdee5274
avfilter/vf_random: fix memory leaks
...
Fixes #8296
(cherry picked from commit 3488e0977c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 20:00:05 +02:00
Paul B Mahol
6f579cf963
avfilter/vf_bwdif: fix heap-buffer overflow
...
Fixes #8261
(cherry picked from commit 8c3166e1c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 20:00:05 +02:00
Andreas Rheinhardt
a43a89a089
fftools/ffmpeg_opt: Fix leak of options when parsing options fails
...
Fixes #8094 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 21265f42ec )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 20:00:05 +02:00
Paul B Mahol
156af49b09
avfilter/vf_edgedetect: fix heap-buffer overflow
...
Fixes #8275
(cherry picked from commit de598f82f8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 20:00:05 +02:00
Paul B Mahol
e103a2cb9c
avfilter/vf_w3fdif: deny processing small videos
...
Fixes #8243
(cherry picked from commit 0e68e8c93f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 20:00:05 +02:00
Paul B Mahol
724b8fa1e2
avfilter/vf_avgblur: fix heap-buffer overflow
...
Fixes #8274
(cherry picked from commit f069a9c2a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 20:00:05 +02:00
Paul B Mahol
7eb02a1f83
avfilter/af_tremolo: fix heap-buffer overflow
...
Fixes #8317
(cherry picked from commit 58bb9d3a3a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 20:00:05 +02:00
Paul B Mahol
ff1c55c913
avfilter/vf_edgedetect: check if height is big enough
...
Fixes #8260
(cherry picked from commit ccf4ab8c9a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 20:00:05 +02:00
Paul B Mahol
72bc9bd8ef
avfilter/vf_bitplanenoise: fix overreads
...
Fixes #8244
(cherry picked from commit 0b56723874 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 20:00:05 +02:00
Paul B Mahol
25b2341f9a
avfilter/vf_fieldorder: fix heap-buffer overflow
...
Fixes #8264
(cherry picked from commit 07050d7bdc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 20:00:05 +02:00
Paul B Mahol
b116c7a6b0
avfilter/vf_fieldmatch: fix heap-buffer overflow
...
Also fix use of uninitialized values.
Fixes #8239
(cherry picked from commit ce5274c138 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 20:00:05 +02:00
Paul B Mahol
77b61358aa
avcodec/pngenc: remove monowhite from apng formats
...
Monowhite pixel format is not supported, and it does not make sense
to add support for it.
Fixes #7989
(cherry picked from commit 5d9f44da46 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 20:00:05 +02:00
Timo Rothenpieler
43d68a0738
lavf/tls_mbedtls: add support for mbedtls version 3
...
- certs.h is gone. Only contains test data, and was not used at all.
- config.h is renamed. Was seemingly not used, so can be removed.
- MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE is gone, instead
MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE will be thrown.
- mbedtls_pk_parse_keyfile now needs to be passed a properly seeded
RNG. Hence, move the call to after RNG seeding.
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2022-04-27 18:49:49 +02:00
Michael Niedermayer
79aba62389
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-16 11:01:28 +02:00
Gyan Doshi
773e4c43f6
configure: bump year
...
(cherry picked from commit 2f6360ff21 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-16 11:00:47 +02:00
James Almer
eb42adab36
fate: update reference files after the recent dash manifest muxer changes
...
Missed in 487b49d8f2 .
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit aa0829d834 )
2022-04-08 16:11:48 -03:00
James Almer
d36f0ff69a
avformat/webmdashenc: fix on-demand profile string
...
Fixes ticket #9596
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 487b49d8f2 )
2022-04-08 00:08:40 -03:00
Michael Niedermayer
550a713791
Update for 4.2.6
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 23:56:00 +02:00
Paul B Mahol
6ac6df4e1f
avfilter/vf_lenscorrection: make width/height int
...
Somehow previous correct fix broke usage.
(cherry picked from commit 79522411fa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 23:56:00 +02:00
Michael Niedermayer
9576ed4e48
avcodec/diracdec: avoid signed integer overflow in global mv
...
Fixes: signed integer overflow: -128275513086 * -76056576 cannot be represented in type 'long'
Fixes: 45818/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5129799149944832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f1279684e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
c6845555fc
avcodec/takdsp: Fix integer overflow in decorrelate_sf()
...
Fixes: signed integer overflow: -101 * 71041254 cannot be represented in type 'int'
Fixes: 45938/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-4687974320701440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 01d8c887f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
0c68e3455b
avcodec/apedec: fix a integer overflow in long_filter_high_3800()
...
Fixes: signed integer overflow: -2146549696 - 3923884 cannot be represented in type 'int'
Fixes: 45907/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5992380584558592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b085b400be )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Oneric
4641d71fb0
avfilter/vf_subtitles: pass storage size to libass
...
Due to a quirk of the ASS format some tags depend on the exact storage
resolution of the video, so tell libass via ass_set_storage_size.
2022-04-07 16:27:00 +02:00
Michael Niedermayer
7b9ee6a49e
avformat/aqtitledec: Skip unrepresentable durations
...
Fixes: signed integer overflow: -5 - 9223372036854775807 cannot be represented in type 'long'
Fixes: 45665/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-475618463934054
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c2d1597a8a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
64a756b8f5
avformat/cafdec: Do not store empty keys in read_info_chunk()
...
Fixes: Timeout
Fixes: 45543/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5684953164152832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ec28e1d4c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
a882801bc3
avformat/hls: Check target_duration
...
Fixes: signed integer overflow: 77777777777777 * 1000000 cannot be represented in type 'long long'
Fixes: 45545/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-6438101247983616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Steven Liu <lingjiujianke@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8fd3f7fab )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
4a7f3467d8
avcodec/pixlet: Avoid signed integer overflow in scaling in filterfn()
...
Fixes: signed integer overflow: 11494 * 1073741824000000 cannot be represented in type 'long'
Fixes: 26586/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PIXLET_fuzzer-5752633970917376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c1f20c6c8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
f79f5a97bd
avformat/matroskadec: Check pre_ns
...
Fixes: division by 0
Fixes: 44615/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6681108677263360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 710e51677a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
93445cbbf4
avcodec/sonic: Use unsigned for predictor_k to avoid undefined behavior
...
Fixes: signed integer overflow: -1094995529 * 24 cannot be represented in type 'int'
Fixes: 44436/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-4874459459223552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 28008bf95e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
a0fa20bae4
avformat/matroskadec: Use rounded down duration in get_cue_desc() check
...
Floating point is evil, it would be better if duration was not a double
Fixes: Infinite loop
Fixes: 45123/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6725052291219456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bd3a03db9a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
78707ae025
avformat/avidec: Check height
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: Ticket8486
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec8ff659f5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
27ed2b5bd8
avformat/rmdec: Better duplicate tags check
...
Fixes: memleaks
Fixes: 44810/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5619494647627776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 15a646e501 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
a09bc161b0
avformat/mov: Disallow empty sidx
...
It appears this is not allowed "Each Segment Index box documents how a (sub)segment is divided into one or more subsegments
(which may themselves be further subdivided using Segment Index boxes)."
Fixes: Null pointer dereference
Fixes: Ticket9517
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4419433d77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
084b4f82a3
avformat/matroskadec: Check duration
...
Fixes: -nan is outside the range of representable values of type 'long'
Fixes: 44614/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6216204841254912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 36680078ca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
bc56a27094
avformat/mov: Corner case encryption error cleanup in mov_read_senc()
...
Fixes: memleak
Fixes: 42341/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4566632823914496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ee0e4abcb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
51bc510327
avcodec/jpeglsdec: Fix if( code style
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f306b8e80a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
bf1df43681
avcodec/jpeglsdec: Check get_ur_golomb_jpegls() for error
...
Fixes: Timeout
Fixes: Invalid shift
Fixes: 44548/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-556487680891289
Fixes: 44569/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMV_fuzzer-6302543246917632
Fixes: 44570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-4550196556595200
Fixes: 44592/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5651610385121280
Fixes: 44571/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5094698987945984
Fixes: 44607/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5341352013987840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 151f83584e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
05067fe680
avcodec/motion_est: fix indention of ff_get_best_fcode()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ce43e1c581 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
8c5f441a0d
avcodec/motion_est: Fix xy indexing on range violation in ff_get_best_fcode()
...
This codepath seems untested, no testcases change
Found-by: <mkver>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 634312a70f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
e13aba0023
avcodec/jpeglsdec: Increase range for N in ls_get_code_runterm() by using unsigned
...
Fixes: left shift of 32768 by 16 places cannot be represented in type 'int'
Fixes: Timeout
Fixes: 44219/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-4679455379947520
Fixes: 44088/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-4885976600674304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ee283d7d0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
fd062924b8
avformat/matroskadec: Check desc_bytes
...
Fixes: Division by 0
Fixes: 44035/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4826721386364928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5038933977 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
c6c36aa97a
avformat/utils: Fix invalid NULL pointer operation in ff_parse_key_value()
...
Fixes: pointer index expression with base 0x000000000000 overflowed to 0xffffffffffffffff
Fixes: 44012/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-5670607746891776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 59328aabd2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
94fc589f8e
avformat/matroskadec: Fix infinite loop with bz decompression
...
The same check is added to zlib too, it seems not needed there though
Fixes: Infinite loop
Fixes: 43932/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-6175167573786624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c3d2cbb51 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
b8492ff76d
avformat/mov: Check size before subtraction
...
Fixes: signed integer overflow: -9223372036854775808 - 8 cannot be represented in type 'long'
Fixes: 43542/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5237670148702208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d8d9d506a3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
7a9dfc503d
avcodec/apedec: Fix integer overflows in predictor_update_3930()
...
Fixes: signed integer overflow: 1074134419 - -1075212485 cannot be represented in type 'int'
Fixes: 43273/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-4706880883130368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c9c9bbd01 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
770e373ca2
avcodec/apedec: fix integer overflow in 8bit samples
...
Fixes: signed integer overflow: 2147483542 + 128 cannot be represented in type 'int'
Fixes: 42812/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6344057861832704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7cee3b3718 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
f8bbc2ced3
avformat/flvdec: timestamps cannot use the full int64 range
...
We do not support this as we multiply by 1000
Fixes: signed integer overflow: -45318575073853696 * 1000 cannot be represented in type 'long'
Fixes: 42804/clusterfuzz-testcase-minimized-ffmpeg_dem_LIVE_FLV_fuzzer-4630325425209344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c217ca7718 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
c202ffefaa
avcodec/vqavideo: reset accounting on error
...
Fixes: Timeout (same growing chunk is decoded to failure repeatedly)
Fixes: 42582/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-6531195591065600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d8ea7a67ba )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
fd854bced1
avcodec/alacdsp: fix integer overflow in decorrelate_stereo()
...
Fixes: signed integer overflow: -16777216 * 131 cannot be represented in type 'int'
Fixes: 23835/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5669943160078336
Fixes: 41101/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-4636330705944576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 68457c1e85 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
fccff20bdd
avformat/4xm: Check for duplicate track ids
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dd94912479 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
f34273703b
avformat/4xm: Consider max_streams on reallocating tracks array
...
Fixes: OOM
Fixes: 41595/clusterfuzz-testcase-minimized-ffmpeg_dem_FOURXM_fuzzer-6355979363549184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0dcd95ef8a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
2aefb4b7ac
avformat/mov: Check next offset in mov_read_dref()
...
Fixes: signed integer overflow: 9223372036200463215 + 1109914409 cannot be represented in type 'long'
Fixes: 41480/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6553086177443840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 562021e2fd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
a962cda7fd
avformat/vivo: Favor setting fps from explicit fractions
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf1e93bdc9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
6cbacf1818
avformat/vivo: Do not use the general expression evaluator for parsing a floating point value
...
Fixes: Timeout
Fixes: 41564/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVO_fuzzer-6309014024093696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b24615565 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
e94ae6c679
avformat/mxfdec: Check for duplicate mxf_read_index_entry_array()
...
Fixes: memleak
Fixes: 41596/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6439060204290048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f44a218e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
24f5e3a191
avcodec/apedec: Change avg to uint32_t
...
Fixes: Integer overflow
Fixes: 40973/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6739312704618496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ec75723a4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:27:00 +02:00
Michael Niedermayer
1f62d58dae
avformat/mov: Disallow duplicate smdm
...
Fixes: memleak
Fixes: 39879/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5327819907923968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5ba74053c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:26:59 +02:00
Michael Niedermayer
6711c16e63
avformat/mov: Check for EOF in mov_read_glbl()
...
Fixes: Infinite loop
Fixes: 41351/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5433895854669824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 59b4e7cbd8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:26:59 +02:00
Michael Niedermayer
a8e6ddb5df
avcodec/vp3: Check version in all cases when VP4 code is not built
...
Fixes: out of array read
Fixes: 40284/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP3_fuzzer-4599568176644096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 96caa01f13 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:26:59 +02:00
Michael Niedermayer
498a365d6d
avformat/mov: Check channels for mov_parse_stsd_audio()
...
Fixes: signed integer overflow: -776522110086937600 * 16 cannot be represented in type 'long'
Fixes: 40563/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6644829447127040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a64a4c582 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:26:59 +02:00
Michael Niedermayer
208434c164
avformat/avidec: Check read_odml_index() for failure
...
Fixes: Timeout
Fixes: 40950/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6478873068437504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 57adb26d05 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:26:59 +02:00
Michael Niedermayer
d2d817eaf2
avformat/aiffdec: Use av_rescale() for bitrate
...
Fixes: integer overflow
Fixes: 40313/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-4814761406103552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 905588df97 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:26:59 +02:00
Michael Niedermayer
ed968f5290
avformat/aiffdec: sanity check block_align
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93f7776921 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:26:59 +02:00
Michael Niedermayer
f2a206309e
avformat/aiffdec: Check sample_rate
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b04836dff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:26:59 +02:00
Paul B Mahol
84fdfdf859
avfilter/vf_gblur: fix heap-buffer overflow
...
Fixes #8282
(cherry picked from commit 64a805883d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:26:59 +02:00
Paul B Mahol
15900ff8e6
avfilter/vf_lenscorrection: fix division by zero
...
Fixes #8265
(cherry picked from commit 19587c9332 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:26:59 +02:00
James Almer
c4629d8abe
avformat/latmenc: abort if no extradata is available
...
Fixes ticket #8273 .
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit dd01947397 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:26:59 +02:00
Andreas Rheinhardt
c55cf1d0cc
avformat/movenc: Fix segfault when remuxing rtp hint stream
...
When remuxing an rtp hint stream (or any stream with the tag "rtp "),
the mov muxer treats this as one of the rtp hint tracks it creates
internally when ordered to do so; yet this track lacks the
AVFormatContext for the hinting rtp muxer, leading to segfaults in
mov_write_udta_sdp() if a "trak" atom is written for this stream; if not,
the stream's codecpar is freed by mov_free() as if the mov muxer owned
it (it does for the internally created "rtp " tracks), but without
resetting st->codecpar, leading to double-frees lateron. This commit
therefore ignores said tag which makes rtp hint streams unremuxable.
This fixes tickets #8181 and #8186 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 22c3cd1760 )
2022-04-07 16:26:59 +02:00
Paul B Mahol
f126288f23
avformat/tty: add probe function
...
(cherry picked from commit 3bce9e9b3e )
2022-04-07 16:26:59 +02:00
Paul B Mahol
98981312e1
avfilter/vf_neighbor: check if width is 1
...
Fixes #8242
(cherry picked from commit e787f8fd7e )
2022-04-07 16:26:59 +02:00
Michael Niedermayer
d1cdfe78cf
avcodec/flac_parser: Consider AV_INPUT_BUFFER_PADDING_SIZE
...
Fixes: out if array read
Fixes: 40109/clusterfuzz-testcase-minimized-ffmpeg_dem_FLAC_fuzzer-4805686811295744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Mattias Wadman <mattias.wadman@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:26:59 +02:00
Michael Niedermayer
77fc0df720
avcodec/ttadsp: Fix integer overflows in tta_filter_process_c()
...
Fixes: signed integer overflow: 822841647 + 1647055738 cannot be represented in type 'int'
Fixes: 39935/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-4592657142251520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f24028c798 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:26:59 +02:00
Michael Niedermayer
ffcba1be9a
avutil/mathematics: Document av_rescale_rnd() behavior on non int64 results
...
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e154353fdb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-07 16:26:59 +02:00
Andreas Rheinhardt
bf85c589d7
configure: Add missing libshine->mpegaudioheader dependency
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com >
(cherry picked from commit e228d7b0db )
2022-01-06 08:46:55 +01:00
Michael Niedermayer
60037d6693
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-12 16:47:10 +02:00
Lynne
a9febd5870
configure: update copyright year
...
(cherry picked from commit 63505fc60a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-12 16:46:06 +02:00
Michael Niedermayer
c0b6f4b38d
avformat/matroskadec: Reset state also on failure in matroska_reset_status()
...
The calling code does not handle failures and will fail with assertion failures later.
Seeking can always fail even when the position was previously read.
Fixes: Assertion failure
Fixes: 35253/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-4693059982983168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d115eec979 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-12 16:46:06 +02:00
Michael Niedermayer
2d993f5fd6
avformat/wavdec: Check smv_block_size
...
Fixes: Timeout
Fixes: 39554/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-4915221701984256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 849138f476 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-12 16:46:06 +02:00
Michael Niedermayer
707d85b356
avformat/rmdec: Check for multiple audio_stream_info
...
Fixes: memleak
Fixes: 39166/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5153276690038784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8fe3566b8f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-12 16:46:06 +02:00
Michael Niedermayer
523098c8b9
avcodec/apedec: Use 64bit to avoid overflow
...
Fixes: runtime error: signed integer overflow: 727298502 * 3 cannot be represented in type 'int'
Fixes: 39172/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-638602483033702
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f059b56195 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-12 16:46:06 +02:00
Michael Niedermayer
3055a0155b
avcodec/apedec: Fix undefined integer overflow in long_filter_ehigh_3830()
...
Fixes: signed integer overflow: -2145648640 - 3357696 cannot be represented in type 'int'
Fixes: 38899/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5358815017566208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ad517ee6e4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-12 16:46:06 +02:00
Michael Niedermayer
501f0aef5d
oavformat/avidec: Check offset in odml
...
Fixes: signed integer overflow: 9223372036854775807 + 8 cannot be represented in type 'long'
Fixes: 38787/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-4859845799444480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 255a7b423e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-12 16:46:06 +02:00
Michael Niedermayer
bbbde5f077
avformat/mpegts: use actually read packet size in mpegts_resync special case
...
Fixes: infinite loop
Fixes: 37986/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5292311517462528 -
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 83b2e4c8f1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-12 16:46:06 +02:00
Timo Rothenpieler
2e68ac694c
avfilter/scale_npp: fix non-aligned output frame dimensions
2021-10-07 18:29:08 +02:00
Michael Niedermayer
a7be534d8a
Update for 4.2.5
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 14:26:23 +02:00
Michael Niedermayer
ff87b7bd2f
swscale/alphablend: Fix slice handling
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 06d6726588 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:59:34 +02:00
Michael Niedermayer
838c34ec53
avcodec/mxpegdec: Check for AVDISCARD_ALL
...
Fixes: Fixes NULL pointer dereference
Fixes: 36610/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-6052641783283712
Fixes: 37907/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-4725170850365440
Fixes: 37904/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-6367889262247936
Fixes: 38085/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-5175270823297024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 20afd3a63a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:59:34 +02:00
Michael Niedermayer
01b228834a
avcodec/flicvideo: Check remaining bytes in FLI*COPY
...
Fixes: Timeout
Fixes: 37795/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-4846536543043584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f835efbca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:59:34 +02:00
Michael Niedermayer
8b8ab274af
avcodec/cbs_h265_syntax_template: Limit sps_num_palette_predictor_initializer_minus1 to 127
...
Fixes: index 128 out of bounds for type 'uint16_t [128]'
Fixes: 38651/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-6296416058736640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 85413a5ae6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:59:34 +02:00
Michael Niedermayer
6edcacf465
avcodec/mpeg12dec: Do not put mpeg_f_code into an invalid state on error return
...
Fixes: invalid shift
Fixes: 37018/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG2VIDEO_fuzzer-5290280902328320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5a95abcce4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:59:34 +02:00
Michael Niedermayer
10226f869e
avcodec/mpegvideo_enc: Limit bitrate tolerance to the representable
...
Fixes: error: 1.66789e+11 is outside the range of representable values of type 'int'
Fixes: Ticket8201
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 245017ec8a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:59:34 +02:00
Michael Niedermayer
29f073ca46
avcodec/apedec: Fix integer overflow in intermediate
...
Fixes: signed integer overflow: 559334865 * 4 cannot be represented in type 'int'
Fixes: 37929/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6751932295806976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 90da43557f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:59:34 +02:00
Michael Niedermayer
c8b796b472
avformat/mvdec: Do not set invalid sample rate
...
Fixes: signed integer overflow: -682581959642593728 * 16 cannot be represented in type 'long'
Fixes: 37883/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5311691517198336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 737e6bf216 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:59:34 +02:00
Michael Niedermayer
c5d07ade3e
avformat/rmdec: Use 64bit for intermediate for DEINT_ID_INT4
...
Fixes: runtime error: signed integer overflow: 65312 * 65535 cannot be represented in type 'int'
Fixes: 32832/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-4817710040088576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e2c2872393 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:59:34 +02:00
Michael Niedermayer
cd5c9b590d
avformat/mov: Check for duplicate clli
...
Fixes: memleak
Fixes: 35261/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4869656287510528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9a222f140e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:56:53 +02:00
Michael Niedermayer
261e06947e
avformat/jacosubdec: Check for min in t overflow in get_shift()
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 34651/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-5157941012463616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 989febfbd0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:56:53 +02:00
Michael Niedermayer
78706c08d9
avformat/mxfdec: check channel number in mxf_get_d10_aes3_packet()
...
Fixes: Out of array access
Fixes: 37030/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5387719147651072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3dd5a8a135 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:56:53 +02:00
James Almer
d17624507a
avcodec/utils: don't return negative values in av_get_audio_frame_duration()
...
In some extrme cases, like with adpcm_ms samples with an extremely high channel
count, get_audio_frame_duration() may return a negative frame duration value.
Don't propagate it, and instead return 0, signaling that a duration could not
be determined.
Fixes ticket #9312
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit e01d306c64 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:56:53 +02:00
Michael Niedermayer
cfb2b5db9e
avcodec/jpeg2000dec: Check that atom header is within bytsetream
...
Fixes: Infinite loop
Fixes: 36666/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5912760671141888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3c659f8618 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:56:53 +02:00
Michael Niedermayer
6b34dd48ad
avcodec/apedec: Fix 2 integer overflows in filter_3800()
...
Fixes: signed integer overflow: 1683879955 - -466265224 cannot be represented in type 'int'
Fixes: 37419/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6074294407921664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 33feb527ff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:56:53 +02:00
Michael Niedermayer
5e73b973c5
avcodec/xpmdec: Move allocations down after more error checks
...
Fixes: Timeout
Fixes: 37035/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XPM_fuzzer-5142718576721920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e58692837c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:56:53 +02:00
Martin Storsjö
e4e6a3fbcc
network: Define ENOTCONN as WSAENOTCONN if not defined
...
This fixes compilation with old mingw.org toolchains, which has got
much fewer errno.h entries.
Signed-off-by: Martin Storsjö <martin@martin.st >
(cherry picked from commit 6569e9505c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:56:53 +02:00
Michael Niedermayer
295597b749
avformat/avidec: Use 64bit for frame number in odml index parsing
...
Fixes: signed integer overflow: 1179337772 + 1392508928 cannot be represented in type 'int'
Fixes: 34088/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5846945303232512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a4c98c507e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:56:53 +02:00
Michael Niedermayer
a55db635fd
avcodec/mjpegbdec: Skip SOS on AVDISCARD_ALL as does mjpeg
...
Fixes: NULL pointer dereference
Fixes: 36342/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEGB_fuzzer-4579188072906752
Fixes: 36344/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEGB_fuzzer-5049579300061184
Fixes: 36345/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEGB_fuzzer-5301149845553152
Fixes: 36374/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEGB_fuzzer-6056312352931840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 104a8399ae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:56:53 +02:00
Michael Niedermayer
78e045df38
avcodec/mjpegdec: Check for bits left in mjpeg_decode_scan_progressive_ac()
...
Fixes: Timeout
Fixes: 36262/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-4969052454912000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 909faca929 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:56:53 +02:00
maryam ebrahimzadeh
5976047ae0
avformat/adtsenc: return value check for init_get_bits in adts_decode_extradata
...
As the second argument for init_get_bits (buf) can be crafted, a return value check for this function call is necessary.
'buf' is part of 'AVPacket pkt'.
replace init_get_bits with init_get_bits8.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9ffa49496d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:56:53 +02:00
Michael Niedermayer
5e2aae4c73
avcodec/webp: Check available space in loop in decode_entropy_coded_image()
...
Fixes: Timeout
Fixes: 35401/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WEBP_fuzzer-5714401821851648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5e00eab611 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:56:53 +02:00
Michael Niedermayer
3dbc3d7aa3
avcodec/vc1dec: ff_print_debug_info() does not support WMV3 field_mode
...
Fixes: out of array read
Fixes: 36331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-5140494328922112.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c59b5e3d1e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
0f8a56d5af
avcodec/frame_thread_encoder: Free AVCodecContext structure on error during init
...
Fixes: MemLeak
Fixes: 8281
Fixes: PoC_option158.jpg
Fixes: CVE-2020-22037
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7bba0dd638 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
bcb56d512b
avcodec/faxcompr: Check for end of input in cmode == 1 in decode_group3_2d_line()
...
Fixes: Infinite loop
Fixes: 35591/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4503764022198272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f803635c4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
62ec07a948
avcodec/vc1dec: Disable error concealment for *IMAGE
...
The existing error concealment makes no sense for the image formats, they
use transformed source images which is different from keyframe + MC+difference
for which the error concealment is designed.
Of course feel free to re-enable this if you have a case where it works and
improves vissual results
Fixes: Timeout
Fixes: 36234/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-6300306743885824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 643b2d49bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
cbe02fb860
avcodec/sbrdsp_fixed: Fix negation overflow in sbr_neg_odd_64_c()
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 35593/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5182217725804544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8f2856a1da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
ab78ddd4c1
avformat/wtvdec: Check for EOF before seeking back in parse_media_type()
...
Fixes: Infinite loop
Fixes: 36311/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-4889181296918528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 89505d38de )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
1f1318971e
avformat/wavdec: Use 64bit in new_pos computation
...
Fixes: signed integer overflow: 129 * 16711680 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-6742285317439488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9b57d2f0a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
afcd295bb0
avformat/sbgdec: Check for overflow in timestamp preparation
...
Fixes: signed integer overflow: 9223372036854775807 + 86400000000 cannot be represented in type 'long'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6731040263634944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9dbed90840 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
13d9666b5e
avformat/dsicin: Check packet size for overflow
...
Fixes: signed integer overflow: 24672 + 2147483424 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_DSICIN_fuzzer-6731325979623424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d1c47ec03 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
18df459002
avformat/bfi: check nframes
...
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_BFI_fuzzer-6737028768202752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b4e77dfca1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
baa941a5f9
avformat/avidec: fix position overflow in avi_load_index()
...
Fixes: signed integer overflow: 9223372033098784808 + 4294967072 cannot be represented in type 'long'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6732488912273408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 527821a2dd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
ef74f8b75f
avformat/asfdec_f: Check sizeX against padding
...
Fixes: signed integer overflow: 2147483607 + 64 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-6753897878257664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f034c2e36a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
99c8690870
avformat/aiffdec: Check for size overflow in header parsing
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6723467048255488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bae2e19777 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
9410be6ddd
avcodec/aaccoder: Add minimal bias in search_for_ms()
...
Fixes: floating point division by 0
Fixes: Ticket8218
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 75a099fc73 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
3d3a60533b
avfilter/af_drmeter: Check that there is data
...
Fixes: floating point division by 0
Fixes: -nan is outside the range of representable values of type 'int'
Fixes: Ticket8307
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f49fa6abe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
853147f753
avfilter/vf_mestimate: Check b_count
...
Fixes: left shift of negative value -1
Fixes: Ticket8270
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 06af6e101b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
22fa7efe02
avformat/mov: do not ignore errors in mov_metadata_hmmt()
...
Fixes: Timeout
Fixes: 35637/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6311060272447488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c52c99a18f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
6d72fc6be2
avformat/mxfdec: Check size for shrinking
...
av_shrink_packet() takes int size, so size must fit in int
Fixes: out of array access
Fixes: 35607/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4875541323841536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65b862ab59 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
maryam ebr
796a84fd04
avcodec/dnxhddec: check and propagate function return value
...
Similar to CVE-2013-0868, here return value check for 'init_vlc' is needed.
crafted DNxHD data can cause unspecified impact.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 7150f95756 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
d3f9206997
swscale/slice: Fix wrong return on error
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7874d40f10 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
b72df5e492
swscale/slice: Check slice for allocation failure
...
Fixes: null pointer dereference
Fixes: alloc_slice.mp4
Found-by: Rafael Dutra <rafael.dutra@cispa.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 997f9cfc12 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
452e7cba2c
avformat/matroskadec: Fix handling of huge default durations
...
Fixes: negation of -9223372036854775808 cannot be represented in type 'int64_t' (aka 'long'); cast to an unsigned type to negate this value to itself
Fixes: 33997/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6752039691485184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 343d950a4a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
4596eefd83
avcodec/lpc: check for zero err in normalization in compute_lpc_coefs()
...
Fixes: floating point division by 0
Fixes: Ticket8213
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 70874e024a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
2104bed562
avformat/ftp: Check for av_strtok() failure
...
Fixes: CID1396258 Dereference null return value
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d40782088 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
5baa775675
tools/cws2fws: Check read() for failure
...
Fixes: CID1452579 Argument cannot be negative
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0b3cdd7cc2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
81bddb1859
avcodec/cpia: Fix missing src_size update
...
Fixes: out of array read
Fixes: 35210/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CPIA_fuzzer-5669199688105984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cea05864e6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
f806412b00
avcodec/clearvideo: Check tile_size to be not too large
...
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 35023/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CLEARVIDEO_fuzzer-6740166587842560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 11fac9613e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
22ae198e0c
avcodec/utils: Use 64bit for intermediate in AV_CODEC_ID_ADPCM_THP* duration calculation
...
Fixes: signed integer overflow: 486539264 * 14 cannot be represented in type 'int'
Fixes: 35281/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-6068262742917120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 00ae9b77ef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
5d7fbb35d3
avformat/rmdec: Check old_format len for overflow
...
Maybe such large values could be disallowed earlier and closer to where
they are set.
Fixes: signed integer overflow: 538976288 * 8224 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6704350354341888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 06d174e289 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
8b8e5ccdc2
avformat/realtextdec: Check the pts difference before using it for the duration computation
...
Fixes: signed integer overflow: 5404200000 - -9223372031709351616 cannot be represented in type 'long'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_REALTEXT_fuzzer-6737340551790592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fe12aa6890 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
7da58f8fe7
avformat/qcp: Avoid negative nb_rates
...
Fixes: signed integer overflow: 2 * -1725947872 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_QCP_fuzzer-6726807632084992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b865cc703 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
dda8d338a1
avformat/nutdec: Check tmp_size
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6739990530883584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1ca00b5e44 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
ba6d58a333
avformat/msf: Check that channels doesnt overflow during extradata construction
...
Fixes: signed integer overflow: 2048 * 1122336 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_MSF_fuzzer-6726959600107520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1a277926b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
e9f7f01b76
avformat/mpc8: Check for position overflow in mpc8_handle_chunk()
...
Fixes: signed integer overflow: 15 + 9223372036854775796 cannot be represented in type 'long'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6723520756318208
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6739833034768384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ef25d1182 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
92214f9c1d
avformat/iff: Use 64bit in duration computation
...
Fixes: signed integer overflow: 588 * 16719904 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6748331936186368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93d964689c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
fbd85a15e1
avformat/dxa: Check fps to be within the supported range more precissely
...
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: assertion failure
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-6744985740378112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ea494befc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
42e4597252
avcodec/iff: Only write palette to plane 1 if its PAL8
...
Fixes: null pointer passed as argument 1, which is declared to never be null
Fixes: 33791/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5107575256383488.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 216eb60b85 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
fee5c1ec54
avformat/tta: Check for EOF in index reading loop
...
Fixes: OOM
Fixes: 33585/clusterfuzz-testcase-minimized-ffmpeg_dem_TTA_fuzzer-4564665830080512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b72d657b73 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
e46fac4042
Update missed irc links
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c067d20177 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
b65f9e606a
avformat/rpl: The associative law doesnt hold for signed integers in C
...
Add () to avoid undefined behavior
Fixes: signed integer overflow: 9223372036854775790 + 57 cannot be represented in type 'long'
Fixes: 34983/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-5765822923538432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 480f11bdd7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
2955147e93
avcodec/faxcompr: Check available bits in decode_uncompressed()
...
Fixes: Timeout
Fixes: 34950/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5686764151898112
Fixes: 34966/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4587409334468608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ff56c139e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
2d59246341
avcodec/faxcompr: Check if bits are available before reading in cmode == 9 || cmode == 10
...
Fixes: Timeout
Fixes: 34950/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5686764151898112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d8421e3d5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
665192827a
avcodec/utils: do "calc from frame_bytes, channels, and block_align" in 64bit
...
Fixes: signed integer overflow: 104962766 * 32 cannot be represented in type 'int'
Fixes: 33614/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-6252129036664832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3447979d08 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
91afefa2b6
avcodec/ttadata: Add sentinel at the end of ff_tta_shift_1
...
Fixes: out of array access
Fixes: 34933/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5629322560929792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dbbcfbcc4e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
95a86b7fc9
avformat/mov: Check for duplicate mdcv
...
Fixes: memleak
Fixes: 34932/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5456227658235904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f54d85cee6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
f747fd6d6f
avfilter/vf_dctdnoiz: Check threads
...
Fixes: floating point division by 0
Fixes: Ticket 8269
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a3917c02c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
879ac3418e
avfilter/vf_ciescope: Fix undefined behavior in rgb_to_xy() with black
...
Fixes: floating point division by 0
Fixes: undefined behavior in handling NaN
Fixes: Ticket 8268
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d500e62f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
516632359d
avformat/rpl: Check for EOF and zero framesize
...
Fixes: Infinite loop
Fixes: 34751/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-5439330800762880
Fixes: 34774/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-5851571660390400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a0a4a527c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
c86f19e47c
avcodec/vc2enc: Check for non negative slice bounds
...
Fixes: invalid shifts
Fixes: Ticket 8221
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f7862e8268 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
511989d2a7
avformat/rpl: Use 64bit in bitrate computation and check it
...
Fixes: signed integer overflow: 777777776 * 4 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-6726188921913344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 29b244ffc1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
e01ffd6f3f
avcodec/svq1enc: Do not print debug RD value before it has been computed
...
Avoids floating point division by 0
Fixes: Ticket8191
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c297f7e57a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
4e779e4ace
avcodec/aacpsy: Check bandwidth
...
Fixes: Ticket8011
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 36dead4bc2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
ddd6d344c5
avcodec/aacenc: Do not divide by lambda_count if it is 0
...
Avoids Floating point division by 0
Fixes: Ticket8011
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c520b98691 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
92b047755e
avcodec/aacenc: Use FLT_EPSILON for lambda minimum
...
(cherry picked from commit 4b89cf7aa4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
7cc32a537b
avformat/cinedec: Fix index_entries size check
...
Fixes: out of array access
Fixes: 29868/clusterfuzz-testcase-minimized-ffmpeg_dem_CINE_fuzzer-5692001957445632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
0ab6b4469c
avfilter/vf_yadif: Fix handing of tiny images
...
Fixes: out of array access
Fixes: Ticket8240
Fixes: CVE-2020-22021
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7971f62120 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
e6b5c7a5fc
avfilter/vf_vmafmotion: Check dimensions
...
Fixes: out of array access
Fixes: Ticket8241
Fixes: Ticket8246
Fixes: CVE-2020-22019
Fixes: CVE-2020-22033
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 82ad1b7675 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
cf876bdef8
avformat/movenc: Check pal_size before use
...
Fixes: assertion failure
Fixes: out of array read
Fixes: Ticket8190
Fixes: CVE-2020-22015
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4c1afa2925 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
196d21d7ee
avcodec/lpc: Avoid floating point division by 0
...
Fixes: Ticket7996
Fixes: CVE-2020-20445
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38d18fb578 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
e56ee5a3e4
avcodec/aacpsy: Avoid floating point division by 0 of norm_fac
...
Fixes: Ticket7995
Fixes: CVE-2020-20446
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 223b5e8ac9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
c21762969e
avcodec/aacenc: Avoid 0 lambda
...
Fixes: Ticket8003
Fixes: CVE-2020-20453
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a7a7f32c8a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
c840ac7464
avcodec/exr: x/ymax cannot be INT_MAX
...
The code uses x/ymax + 1 so the maximum is INT_MAX-1
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 33158/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5545462457303040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 48342aa075 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
b673bcc017
avformat/avio: Check av_opt_copy() for failure
...
Fixes: CID1477416 Unchecked return value
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f8611ae1ef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
a19e2a5a94
avcodec/clearvideo: Check for 0 tile_shift
...
Fixes: shift exponent -1 is negative
Fixes: 33401/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CLEARVIDEO_fuzzer-5908683596890112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 63e75e09ae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
9e98ee41e7
avcodec/vc1: Check remaining bits in ff_vc1_parse_frame_header()
...
Fixes: Timeout
Fixes: 33156/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-6259655027326976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38c4761588 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
f143bb05c6
avformat/mov: Ignore duplicate CoLL
...
Fixes: memleak
Fixes: 32146/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5377612845285376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9548dc74d8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
6dcff59432
avformat/mov: Limit nb_chapter_tracks to input size
...
Fixes: Timeout (15k loop iterations instead of 400m)
Fixes: 31368/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6601583174483968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 299a56c900 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
16629cf4a6
avformat/utils: Use 64bit earlier in r_frame_rate check
...
Fixes: signed integer overflow: 1406796319 * 2 cannot be represented in type 'int'
Fixes: 32777/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5632576913014784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 578633fc1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
6785185ea5
avformat/mvdec: Check sample rate in parse_audio_var()
...
Fixes: signed integer overflow: -635424002382840000 * 16 cannot be represented in type 'long'
Fixes: 33612/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5704741108711424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ff60249a5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
4a688d139b
avcodec/faxcompr: Check for end of bitstream in decode_group3_1d_line() and decode_group3_2d_line()
...
Fixes: infinite loop
Fixes: 33674/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4816457818046464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 08d2df4153 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
92ecb9c9e6
avcodec/utils: treat PAL8 for jpegs similar to other colorspaces
...
Fixes: out of array access
Fixes: 33713/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5778775641030656
Fixes: 33717/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-4960397238075392
Fixes: 33718/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-5314270096130048.fuzz
Fixes: 33719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5352721864589312
Fixes: 33721/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-5938892055379968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f0ce023ddb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
0d5e8b2746
avcodec/jpeglsdec: Set alpha plane in PAL8 so image is not 100% transparent
...
Fixes: tickets/3933/128.jls
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 011006874c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
fdfacc449b
avformat/asfdec_o: Use ff_get_extradata()
...
Fixes: OOM
Fixes: 27240/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-5937469859823616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 098314e1e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
97c9eaaf04
avformat/id3v2: Check end for overflow in id3v2_parse()
...
Fixes: signed integer overflow: 9223372036840103978 + 67637280 cannot be represented in type 'long'
Fixes: 33341/clusterfuzz-testcase-minimized-ffmpeg_dem_DSF_fuzzer-6408154041679872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit efdb564504 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
7d64c2256e
avformat/wtvdec: Improve size overflow checks in parse_chunks()
...
Fixes: signed integer overflow: 32 + 2147483647 cannot be represented in type 'int
Fixes: 32967/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5132856218222592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f8ec1da8ac )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
33dc68cad1
avcodec/faxcompr: Check remaining bits on error in decode_group3_1d_line()
...
Fixes: Timeout
Fixes: 32886/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4779761466474496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b3881f0da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
5ca2f59b89
avcodec/utils: Check ima wav duration for overflow
...
Fixes: signed integer overflow: 44331634 * 65 cannot be represented in type 'int'
Fixes: 32120/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-5760221223583744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f40e9b1355 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-06 13:54:16 +02:00
Michael Niedermayer
8620139042
avformat/cafdec: Check channels
...
Fixes: signed integer overflow: -1184429040541376544 * 32 cannot be represented in type 'long'
Fixes: 31788/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6236746338664448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 641c1db22b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
98843a29eb
avcodec/dpx: Check bits_per_color earlier
...
Fixes: shift exponent 251 is too large for 32-bit type 'int'
Fixes: 32147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DPX_fuzzer-5519111675314176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c093eb3031 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
d1ec3974a4
avcodec/pnm_parser: Check image size addition for overflow
...
Fixes: assertion failure
Fixes: out of array access
Fixes: 32664/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-6533642202513408.fuzz
Fixes: 32669/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-6001928875147264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 79ac8d5546 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
746fda9419
avcodec/h265_metadata_bsf: Check nb_units before accessing the first in h265_metadata_update_fragment()
...
Fixes: null pointer dereference
Fixes: 32113/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-4803262287052800
Same as 0c48c332ee
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 497ea04dbd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
ddcaa14abb
avformat/rmdec: use larger intermediate type for audio_framesize * sub_packet_h check
...
Fixes: signed integer overflow: 65535 * 65535 cannot be represented in type 'int'
Fixes: 31406/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5024692843970560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf2fd9204b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
7cafb6461d
avcodec/h264_slice: Check input SPS in ff_h264_update_thread_context()
...
Fixes: crash
Fixes: check_pkt.mp4
Found-by: Rafael Dutra <rafael.dutra@cispa.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ceae92cb29 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
94c0877dd0
avcodec/mpegvideo: Update chroma_?_shift in ff_mpv_common_frame_size_change()
...
Fixes: out of array access
Fixes: 31201/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4627865612189696.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 87d87e6587 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
d24c7e4c8b
avformat/mov: Ignore multiple STSC / STCO
...
Fixes: STSC / STCO inconsistency and assertion failure
Fixes: crbug1184666.mp4
Found-by: Chromium ASAN fuzzer
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2611d20d35 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
fbb6d182d0
avformat/utils: Extend overflow check in dts wrap in compute_pkt_fields()
...
Fixes: signed integer overflow: -9223372032574480351 - 4294967296 cannot be represented in type 'long long'
Fixes: 30022/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5568610275819520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b37ff29e0e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
41903a9dd2
avfilter/vf_scale: Fix adding 0 to NULL (which is UB) in scale_slice()
...
Found-by: Jeremy Leconte <jleconte@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1cf96ce269 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
73947ed459
avutil/common: Add FF_PTR_ADD()
...
Suggested-by: Andreas Rheinhardt
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 522a5259e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
79a910c805
avformat/wtvdec: Check size in SBE2_STREAM_DESC_EVENT / stream2_guid
...
Fixes: signed integer overflow: 539033600 - -1910497124 cannot be represented in type 'int'
Fixes: 30928/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5922630966312960
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f74661543 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
25a4ecd49b
avformat/cafdec: Do not build an index if all packets are the same
...
Fixes: Timeout
Fixes: 28214/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6495999421579264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea12590c8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
eef4190e89
avformat/vividas: Use equals check with n in read_sb_block()
...
Fixes: OOM
Fixes: 27780/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5097985075314688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e44214a824 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
6dbd46339f
avcodec/sonic: Use unsigned temporary in predictor_calc_error()
...
Fixes: signed integer overflow: -2147471366 - 18638 cannot be represented in type 'int'
Fixes: 30157/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5171199746506752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 075d793ba8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
aa3cdf2a56
avformat/jacosubdec: Use 64bit intermediate for start/end timestamp shift
...
Fixes: signed integer overflow: -1957694447 + -1620425806 cannot be represented in type 'int'
Fixes: 30207/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-5050791771635712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c477be08a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
347053103f
avformat/flvdec: Check array entry number
...
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 30209/clusterfuzz-testcase-minimized-ffmpeg_dem_FLV_fuzzer-5724831658147840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5d8fe1c87 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
44318df915
avcodec/h264_slice: Check sps in h264_slice_header_init()
...
Fixes: null pointer dereference
Fixes: h264_slice_header_init.mp4
Found-by: Rafael Dutra <rafael.dutra@cispa.de >
Tested-by: Rafael Dutra <rafael.dutra@cispa.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8047243899 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
3d57bede38
avformat/movenc: Avoid loosing cluster array on failure
...
Fixes: crash
Fixes: check_pkt.mp4
Found-by: Rafael Dutra <rafael.dutra@cispa.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c2ff44f91 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
97bb7b8ac7
avformat/avidec: Check for dv streams before using priv_data in parse ##dc/##wb
...
Fixes: null pointer dereference
Fixes: 31588/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6165716135968768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f733688d30 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
44c75695b1
avformat/mov: Check sample size for overflow in mov_parse_stsd_audio()
...
Fixes: signed integer overflow: 2 * 1914708000 cannot be represented in type 'int'
Fixes: 31639/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6303428239294464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d35677736a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
188f48b6d4
avcodec/ffwavesynth: Avoid signed integer overflow in phi_at()
...
Fixes: signed integer overflow: 2314885530818453536 - -9070214327174160352 cannot be represented in type 'long'
Fixes: 31000/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-6558389742206976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be08b84f8b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
7ef5814e0f
avcodec/mpeg4videoenc: Check extradata malloc()
...
Fixes: Null pointer dereference
Fixes: any mpeg4 testcase which fails the malloc at that exact spot
Found-by: Rafael Dutra <rafael.dutra@cispa.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 33a1687bf6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
d694a9426d
avcodec/speedhq: Width < 8 is not supported
...
Fixes: out of array access
Fixes: 31733/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-4704307963363328
Fixes: 31736/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-6190960292790272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 462b8261aa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
ae300bcf66
avformat/matroskadec: Check for EOF in resync loop
...
Fixes: Timeout (too long -> instantly)
Fixes: 29136/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4586141227548672
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5282147d0c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
bb8db0639e
avcodec/utils: Use more bits for intermediate for AV_CODEC_ID_ADPCM_MS
...
Fixes: signed integer overflow: 1172577312 * 2 cannot be represented in type 'int'
Fixes: 29924/clusterfuzz-testcase-minimized-ffmpeg_dem_BOA_fuzzer-4882912874594304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0f441b9063 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
8c683b707e
avcodec/jpegls: Check A[Q] for overflow in ff_jpegls_update_state_regular()
...
Fixes: Timeout
Fixes: 30912/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5556235476795392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8a3fea802a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
455e4ca588
avformat/voc_packet: prevent remaining size from becoming negative in ff_voc_get_packet()
...
Fixes: memleak
Fixes: 30909/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS_fuzzer-4886284057313280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 337984c133 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
c4708620f8
avutil/timecode: Avoid fps overflow
...
Fixes: Integer overflow and division by 0
Fixes: poc-202102-div.mov
Found-by: 1vanChen of NSFOCUS Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c94875471e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
2f3efc996a
avformat/mvi: Check audio size for more overflows
...
Fixes: left shift of negative value -352256000
Fixes: 30837/clusterfuzz-testcase-minimized-ffmpeg_dem_MVI_fuzzer-5755626262888448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 403b35e16e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
bd4060a718
avcodec/flacdec: Avoid undefined shift in error case
...
Fixes: flac_1040988
Reported-by: Thomas Guilbert <tguilbert@google.com >
Reviewed-by: Thomas Guilbert <tguilbert@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bd525e2876 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
467a2c95a9
avcodec/ffv1dec: Check if trailer is available
...
Fixes: out of array read
Fixes: 29750/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-4808377272238080.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 36ad2f41e3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
c467086184
avcodec/4xm: Check pre_gb in decode_i_block()
...
Fixes: Timeout
Fixes: 31257/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5150866229297152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b87781649e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
a015ca9606
avcodec/dcadsp: Fix integer overflow in dmix_add_c()
...
Fixes: signed integer overflow: 1515225320 + 759416059 cannot be represented in type 'int'
Fixes: 29256/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DCA_fuzzer-5719088561258496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b4ebf483bc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
6d20ed96c7
avformat/flvdec: Check double before cast in parse_keyframes_index()
...
Fixes: -2.21166e+304 is outside the range of representable values of type 'long'
Fixes: 29169/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5725452796821504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 09e5e406c7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
e8f9a3690d
avformat/paf: Check for EOF before allocation in read_header()
...
Fixes: OOM
Fixes: 26584/clusterfuzz-testcase-minimized-ffmpeg_dem_PAF_fuzzer-5172661183053824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bcb1e9d3b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
00c664f10e
avcodec/aacdec_template: Avoid undefined negation in imdct_and_windowing_eld()
...
Fixes: negation of -2147483648 cannot be represented in type 'INTFLOAT' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: 29057/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5642758933053440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 633924539a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
174093afd1
avformat/lxfdec: Fix multiple integer overflows related to track_size
...
Fixes: signed integer overflow: 538976288 * 8 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_LXF_fuzzer-6634030636335104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7819412f44 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
97c89068e9
avcodec/exr: skip bottom clearing loop when its outside the image
...
Fixes: signed integer overflow: 1633771809 * 32960 cannot be represented in type 'int'
Fixes: 26532/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5613925708857344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
908e836bca
avutil/parseutils: Check sign in av_parse_time()
...
Fixes: signed integer overflow: -9223372053736 * 1000000 cannot be represented in type 'long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-6607924558430208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d7f17e885 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
118c895270
avformat/aiffdec: Check that SSND is at least 8 bytes
...
Fixes: Infinite loop
Fixes: 30874/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-5933710488764416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 460d3dc41f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
a2e344eac4
avformat/dcstr: Check sample rate
...
Fixes: signed integer overflow: -1300248894420254720 * 16 cannot be represented in type 'long'
Fixes: 30879/clusterfuzz-testcase-minimized-ffmpeg_dem_DCSTR_fuzzer-5094464215449600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fdcb966f4a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
db0a8edfe8
avcodec/alsdec: Check bitstream input in read_block()
...
Fixes: Timeout
Fixes: 28110/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5036338973507584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53d739db4e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
6b0a5c6741
avformat/mov: Extend data_size check in mov_read_udta_string()
...
Fixes: signed integer overflow: -2147483634 - 16 cannot be represented in type 'int'
Fixes: 28322/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5711888402612224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 74c4c53953 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
5ccb9ccea1
avformat/aadec: Check for EOF while reading chapters
...
Fixes: timeout
Fixes: 28199/clusterfuzz-testcase-minimized-ffmpeg_dem_AA_fuzzer-4896162657861632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bcc7d14453 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
b3a37b1abc
avformat/voc_packet: Add a basic check on max_size
...
Fixes: signed integer overflow: -2147483648 - 4 cannot be represented in type 'int'
Fixes: 28127/clusterfuzz-testcase-minimized-ffmpeg_dem_VOC_fuzzer-4880586455646208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 52f75181bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
5323cef5d0
avformat/microdvddec: use 64bit for durations
...
Fixes: signed integer overflow: 7 - -2147483647 cannot be represented in type 'int'
Fixes: 28036/clusterfuzz-testcase-minimized-ffmpeg_dem_MICRODVD_fuzzer-5171698751766528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f569ac4ce0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
c641b7dd4b
avcodec/hapdec: Change compressed_offset to unsigned 32bit
...
Fixes: out of array access
Fixes: 29345/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5401813482340352
Fixes: 30745/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5762798221131776
Suggested-by: Anton
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 89fe1935b1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
3a8911ec09
avformat/rmdec: Check codec_length without overflow
...
Fixes: signed integer overflow: 2147483647 + 64 cannot be represented in type 'int'
Fixes: 30333/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-5175286983426048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d558c9f237 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
4df5e76723
avformat/mov: Check element count in mov_metadata_hmmt()
...
Fixes: Timeout
Fixes: 30325/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6048395703746560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1d277b92fa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
a9c3bade3b
avcodec/vp8: Move end check into MB loop in vp78_decode_mv_mb_modes()
...
Fixes: Timeout (long -> 5sec)
Fixes: 30269/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP7_fuzzer-5430325004075008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6a797ceafe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
5acfef0727
avcodec/fits: Check gcount and pcount being non negative
...
Fixes: signed integer overflow: 9223372036854775807 - -30069403896 cannot be represented in type 'long'
Fixes: 30046/clusterfuzz-testcase-minimized-ffmpeg_dem_FITS_fuzzer-5807144773484544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c000a91288 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
4b8666d20f
avformat/nutdec: Check timebase count against main header length
...
Fixes: Timeout (long -> 3ms)
Fixes: 28514/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6078669009321984
Fixes: 30095/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-5074433016463360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c425198558 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
70855e0e61
avformat/electronicarts: Clear partial_packet on error
...
Fixes: Infinite loop
Fixes: 30165/clusterfuzz-testcase-minimized-ffmpeg_dem_EA_fuzzer-6224642371092480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 59bb9dc2a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
8e8bf8ca8f
avformat/r3d: Check samples before computing duration
...
Fixes: signed integer overflow: -4611686024827895807 + -4611686016279904256 cannot be represented in type 'long'
Fixes: 30161/clusterfuzz-testcase-minimized-ffmpeg_dem_R3D_fuzzer-5694406713802752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7a2aa5dc2a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
a2dbe8005d
avcodec/pnm_parser: Check av_image_get_buffer_size() for failure
...
Fixes: out of array access
Fixes: 30135/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PBM_fuzzer-4997145650397184
Fixes: 30208/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-5605891665690624.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5314a4996c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
7628ea6d01
avformat/wavdec: Consider AV_INPUT_BUFFER_PADDING_SIZE in set_spdif()
...
The buffer is read by using the bit reader
Fixes: out of array read
Fixes: 27539/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-5650565572591616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a7c648e2d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
e5a1d0febe
avformat/rmdec: Check remaining space in debug av_log() loop
...
Fixes: Timeout (long -> 2 ms)
Fixes: 26709/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5665833403285504
Fixes: 27522/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-6321071221112832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8fe78decd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
7cf8366fe5
avformat/flvdec: Treat high ts byte as unsigned
...
Fixes: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 27516/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5152854660349952
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f514113cfa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
fcbcc75059
avformat/samidec: Sanity check pts
...
Fixes: signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'long'
Fixes: 29743/clusterfuzz-testcase-minimized-ffmpeg_dem_SAMI_fuzzer-5499256859394048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2014b01352 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
a5f24927a7
avcodec/jpeg2000dec: Check atom_size in jp2_find_codestream()
...
Fixes: Infinite loop
Fixes: 29722/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-6412228041506816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2a2082a41b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
bcdcc17015
avformat/avidec: Use 64bit in get_duration()
...
Fixes: signed integer overflow: 2147483424 + 8224 cannot be represented in type 'int'
Fixes: 29619/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5191424373030912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a0ceb0cdd4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
5dafc1edca
avformat/mov: Check for duplicate st3d
...
Fixes: memleak
Fixes: 29585/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6594188688490496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 658f0606cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
2b79229316
avformat/mvdec: Check for EOF in read_index()
...
Fixes: Timeout
Fixes: 29550/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5094307193290752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6c64351bb1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
b290a54e5f
avcodec/jpeglsdec: Fix k=16 in ls_get_code_regular()
...
Fixes: Timeout
Fixes: left shift of 33046 by 16 places cannot be represented in type 'int'
Fixes: 29258/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-4889231489105920
Fixes: 29515/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-6161940391002112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 980900d991 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
ac7566e2d8
avformat/id3v2: Check the return from avio_get_str()
...
Fixes: out of array access
Fixes: 29446/clusterfuzz-testcase-minimized-ffmpeg_dem_AAC_fuzzer-5096222622875648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 25f240fcb3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
ae3364bc30
avcodec/hevc_sei: Check payload size in decode_nal_sei_message()
...
Fixes: out of array access
Fixes: 29392/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4821602850177024.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0791a515d3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
b2a43371b8
libavutil/eval: Remove CONFIG_TRAPV special handling
...
Fixes: division by zero
Fixes: 29555/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVO_fuzzer-5149951447400448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8574fcbfc7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
8d66c20378
avformat/wtvdec: Check len in parse_chunks() to avoid overflow
...
Fixes: signed integer overflow: 2147483647 + 7 cannot be represented in type 'int'
Fixes: 30084/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-6192261941559296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5552ceaf56 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
5e0ef4e2a9
avformat/asfdec_f: Add an additional check for the extradata size
...
Fixes: OOM
Fixes: 30066/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-6182309126602752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c8cd4490a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
c8707132a9
avformat/3dostr: Check sample_rate
...
Fixes: signed integer overflow: -1268324762623155200 * 8 cannot be represented in type 'long'
Fixes: 30123/clusterfuzz-testcase-minimized-ffmpeg_dem_THREEDOSTR_fuzzer-6710765123928064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7e5034f97e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
b31b549e76
avformat/4xm: Make audio_frame_count 64bit
...
Fixes: signed integer overflow: 2099257366 * 2 cannot be represented in type 'int'
Fixes: 27486/clusterfuzz-testcase-minimized-ffmpeg_dem_FOURXM_fuzzer-5112179134824448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 842c268c64 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
bba37dfe0f
avformat/mov: Use av_mul_q() to avoid integer overflows
...
Fixes: signed integer overflow: 538976288 * 538976288 cannot be represented in type 'int'
Fixes: 27473/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5758978289827840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f70e1ec0c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
45995534b2
avcodec/vp9dsp_template: Fix integer overflows in itxfm_wrapper
...
Fixes: signed integer overflow: 2147483641 + 32 cannot be represented in type 'int'
Fixes: 27452/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5078752576667648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4dfb7ff528 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
8493ee2af5
avformat/rmdec: Reorder operations to avoid overflow
...
Fixes: signed integer overflow: -2147483648 - 14 cannot be represented in type 'int'
Fixes: 27659/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-5697250168406016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b12e713b80 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
95da75eb99
avcodec/mxpegdec: fix SOF counting
...
Fixes: Timeout (>10sec -> 15ms)
Fixes: 27652/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-5125920868007936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 401495def6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
044af7cb4b
avcodec/rscc: Check inflated_buf size whan it is used
...
Fixes: out of array access
Fixes: 27434/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RSCC_fuzzer-5196757675540480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit a5ed6da9bd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
ad9e2f8914
avformat/mvdec: Sanity check SAMPLE_WIDTH
...
Fixes: signed integer overflow: 999999999 * 8 cannot be represented in type 'int'
Fixes: 30048/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5864289917337600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab82c10578 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
3f6044ae55
avformat/rmdec: Fix codecdata_length overflow check
...
Fixes: signed integer overflow: 2147483647 + 64 cannot be represented in type 'int'
Fixes: 28509/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-6310969680723968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3c41d0bfd6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
6bc7e2bd6e
avcodec/simple_idct: Fix undefined integer overflow in idct4row()
...
Fixes: signed integer overflow: -1498310196 - 902891776 cannot be represented in type 'int'
Fixes: 28445/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5075163389493248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 57f7e5caa3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
d4c2967a35
avformat/tta: Use 64bit intermediate for index
...
Fixes: signed integer overflow: 42032 * 51092 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_TTA_fuzzer-6679539648430080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fd61b42b4c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
da9a2397e6
avformat/soxdec: Check channels to be positive
...
Fixes: signed integer overflow: 32 * -1795162112 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_SOX_fuzzer-6724151473340416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b0588b73da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
ef89d01449
avcodec/cscd: Check output len in zlib as in lzo
...
Fixes: Timeout (>10sec -> 134ms)
Fixes: 27245/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CSCD_fuzzer-575318210772992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6de039823c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
e4bfc5e421
avcodec/vp3: Check input amount in theora_decode_header()
...
Fixes: Timeout
Fixes: 29226/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-6195092572471296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 869fe41d10 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
a8efc94b39
avformat/wavdec: Check avio_get_str16le() for failure
...
Fixes: out of array access
Fixes: 29195/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5037853281222656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d7594ee751 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
f594353f26
avformat/flvdec: Check for EOF in amf_skip_tag()
...
Fixes: Timeout
Fixes: 29070/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5650106766458880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9725d07a17 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
502ca11d69
avformat/aiffdec: Check size before subtraction in get_aiff_header()
...
Fixes: Infinite loop
Fixes: 27235/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-5761398380167168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8af299acde )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
6ed98dfd14
avformat/electronicarts: More chunk_size checks
...
Fixes: Timeout
Fixes: 26909/clusterfuzz-testcase-minimized-ffmpeg_dem_EA_fuzzer-6489496553783296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d03f0ec9a1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
381f3d9fac
avcodec/cfhd: check peak.offset
...
Fixes: signed integer overflow: -2147483648 - 4 cannot be represented in type 'int'
Fixes: 26907/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-5746202330267648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 386faeda5f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
a6c91db54c
avformat/tedcaptionsdec: Check for overflow in parse_int()
...
Fixes: signed integer overflow: 1111111111111111111 * 10 cannot be represented in type 'long'
Fixes: 26892/clusterfuzz-testcase-minimized-ffmpeg_dem_TEDCAPTIONS_fuzzer-5756045055754240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b0f8586ca9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
7faebb4e0a
avformat/nuv: Check channels
...
Fixes: signed integer overflow: -3468545475927866368 * 4 cannot be represented in type 'long'
Fixes: 28879/clusterfuzz-testcase-minimized-ffmpeg_dem_NUV_fuzzer-6303367307591680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fc45d924d7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
846e09c8b3
avformat/mpc8: Check size before implicitly converting to int
...
Fixes: Timeout
Fixes: 28551/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6229183210586112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 78d6d8ddb5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
e5dbd96637
avformat/nutdec: Fix integer overflow in count computation
...
Note, the value is checked a few lines later already
Fixes: signed integer overflow: -440402016 - 1879048064 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6603876618469376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0014249fd9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
9cc75e54a8
avformat/mvi: Use 64bit for testing dimensions
...
Fixes: signed integer overflow: 65535 * 65535 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_MVI_fuzzer-6649291124899840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 48fb752767 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
428ff6d209
avformat/utils: Check dts in update_initial_timestamps() more
...
Fixes: signed integer overflow: -9223372036853488158 - 90000000 cannot be represented in type 'long long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_MPSUB_fuzzer-6696625298866176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 29851cb840 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
32ad867b24
avformat/flvdec: Check for avio_read() failure in amf_get_string()
...
Suggested-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cb31667611 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
ee92e68f6c
avformat/flvdec: Check for nesting depth in amf_skip_tag()
...
Fixes: out of array access
Fixes: 29440/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5985279812960256.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ef522c918 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
3db1c93b5c
avformat/flvdec: Check for nesting depth in amf_parse_object()
...
Fixes: out of array access
Fixes: 29202/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5112845840809984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 074e204b42 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
6cd5bfe3cd
avformat/asfdec_o: Check for EOF in asf_read_marker()
...
Fixes: Timeout
Fixes: 26460/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-5710884393189376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e3d09f435 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
a5d1613f48
avformat/utils: Check dts - (1<<pts_wrap_bits) overflow
...
Fixes: signed integer overflow: -9223372036842389247 - 2147483648 cannot be represented in type 'long long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_FLV_fuzzer-4845007531671552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d82ee907d6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
657efee3d4
avformat/bfi: Check chunk_header
...
Fixes: signed integer overflow: -2147483648 - 3 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_BFI_fuzzer-6665764123836416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 638a151a87 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
d5b6c4dd0e
avformat/ads: Check size
...
Fixes: signed integer overflow: -2147483616 - 64 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_ADS_fuzzer-6617769344892928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c78b2b138c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
aa63110c1d
avformat/iff: Check block align also for ID_MAUD
...
Fixes: Timeout & OOM
Fixes: 28701/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5185094964871168
Fixes: 29116/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4874284795297792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b17ffe8f8f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
7fcac5c8c3
avcodec/utils: Check for integer overflow in get_audio_frame_duration() for ADPCM_DTK
...
Fixes: signed integer overflow: 131203586 * 28 cannot be represented in type 'int'
Fixes: 26817/clusterfuzz-testcase-minimized-ffmpeg_dem_MSF_fuzzer-6296902548848640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2488ba85a0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
d960a7a5d8
avformat/fitsdec: Better size checks
...
Fixes: out of array access
Fixes: 26819/clusterfuzz-testcase-minimized-ffmpeg_dem_FITS_fuzzer-5634559355650048
Fixes: 26820/clusterfuzz-testcase-minimized-ffmpeg_dem_FITS_fuzzer-5760774955597824
Fixes: 27379/clusterfuzz-testcase-minimized-ffmpeg_dem_FITS_fuzzer-5129775942991872.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 14bbb6bb30 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
34e30575ae
avformat/mxfdec: Fix integer overflow in next position in mxf_read_local_tags()
...
Fixes: signed integer overflow: 9223372036854775723 + 8192 cannot be represented in type 'long'
Fixes: 29072/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4812604904177664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d3d9b1fc8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
5367c59d68
avformat/avidec: dv does not support palettes
...
Fixes: memleak
Fixes: 26937/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5763003338981376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b373b41d9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
424f434c56
libavformat/utils: consider avio_size() failure in ffio_limit()
...
Fixes: Timeout (>20sec -> 3ms)
Fixes: 26918/clusterfuzz-testcase-minimized-ffmpeg_dem_THP_fuzzer-5750425191710720
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b1dac2716 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
ca82f2f1e2
avformat/nistspheredec: Check bits_per_coded_sample and channels
...
Fixes: signed integer overflow: 80 * 92233009 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_NISTSPHERE_fuzzer-6669100654919680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 60770a50fb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
891209076d
avformat/asfdec_o: Check size vs. offset in detect_unknown_subobject()
...
Fixes: signed integer overflow: 2314885530818453566 + 7503032301549264928 cannot be represented in type 'long'
Fixes: 26639/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6024222100684800
Alternatively this could be ignored but then the end condition of the loop
would be hard to reach as avio_tell() is int64_t
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0bee216ad4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
2382d58689
avformat/utils: check for integer overflow in av_get_frame_filename2()
...
Fixes: signed integer overflow: 317316873 * 10 cannot be represented in type 'int'
Fixes: 24708/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5731180885049344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 03c479ce23 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
4e73410837
avutil/timecode: Avoid undefined behavior with large framenum
...
Fixes: signed integer overflow: 2147462079 + 2149596 cannot be represented in type 'int'
Fixes: 27565/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5091972813160448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b19057396 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
bd899b2cee
avformat/mov: Check a.size before computing next_root_atom
...
Fixes: signed integer overflow: 64 + 9223372036854775799 cannot be represented in type 'long'
Fixes: 27563/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6244650163372032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c9a5a0fe9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
1adc349011
avformat/sbgdec: Reduce the amount of floating point in str_to_time()
...
Fixes: 1e+75 is outside the range of representable values of type 'long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6626834808700928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ac6c8993f7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
a0984a153e
avformat/mxfdec: Free all types for both Descriptors
...
Fixes: memleak
Fixes: 26352/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5201158714687488
Suggested-by: Tomas Härdin <tjoppen@acc.umu.se >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 88519be8db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
d5aa69dbed
uavformat/rsd: check for EOF in extradata
...
Fixes: OOM
Fixes: 26503/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-6530816735444992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7186ec88b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
24ca658ea6
avcodec/wmaprodec: Check packet size
...
Fixes: left shift of negative value -25824
Fixes: 27754/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA2_fuzzer-5760255962906624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 69aeba8a19 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
6b0eacc1c2
avcodec/rasc: Check frame before clearing
...
Fixes: null pointer dereference
Fixes: 27737/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RASC_fuzzer-5769028685266944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 380a3a0adf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
7ce729649f
avformat/vividas: Check number of audio channels
...
Fixes: division by 0
Fixes: 28597/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5752201490333696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 66deab3a26 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
273f53e57d
avcodec/alsdec: Fix integer overflow with quant_cof
...
Fixes: signed integer overflow: -210824 * 16384 cannot be represented in type 'int'
Fixes: 28670/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5682310846480384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ce40dde03 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
53da736645
avformat/mpegts: Fix argument type for av_log
...
Reviewed-by: Marton Balint <cus@passwd.hu >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 654b21ef17 )
2021-09-10 16:04:26 +02:00
Michael Niedermayer
2b3c1a3000
avformat/cafdec: clip sample rate
...
Fixes: 1.21126e+111 is outside the range of representable values of type 'int'
Fixes: 27398/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5412960339755008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 684aec6a68 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
dcb07bee75
avcodec/ffv1dec: Fix off by 1 error with quant tables
...
Fixes: assertion failure
Fixes: 28447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-5369575948550144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5cae71d2b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
92c1ee9486
avformat/mpegts: Increase pcr_incr width to 64bit
...
Fixes: division by zero
Fixes: 26459/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5666350112178176
Fixes: 28154/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5195728439476224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ef7b117b7b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
d84bc6850e
avcodec/utils: Check bitrate for overflow in get_bit_rate()
...
Fixes: signed integer overflow: 617890810133996544 * 16 cannot be represented in type 'long'
Fixes: 26565/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5092054700654592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8aadae670f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
eb43e14f8c
avformat/mov: Check if hoov is at the end
...
Fixes: Timeout, probably infinite loop
Fixes: 26559/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5391165484171264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0afbaabdca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
781f4fc448
avcodec/hevc_ps: check scaling_list_dc_coef
...
Fixes: signed integer overflow: 2147483640 + 8 cannot be represented in type 'int'
Fixes: 28449/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5686013259284480
Reviewed-by: James Almer <jamrial@gmail.com >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f1700bd8bb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
40932b723f
avformat/iff: Check data_size
...
Fixes: infinite loop
Fixes: 27834/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5694930919620608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 001bc594d8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
35076c8f63
avformat/matroskadec: Sanity check codec_id/track type
...
Fixes: memleak
Fixes: 27766/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-5198300814508032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b88dd8f0c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
9ea488e0fb
avformat/rpl: Check the number of streams
...
Fixes: out of memory access
Fixes: 27787/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-4743666463408128.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0677bdb1f5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
95882fe008
avformat/vividas: Check sample_rate
...
Fixes: Assertion c > 0 failed at libavutil/mathematics.c
Fixes: 27001/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5726041328582656
Fixes: 27453/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5716060384526336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b1bced5433 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
e1bea3ad03
avformat/vividas: Make len signed
...
Fixes: out of array access
Fixes: 27424/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5682070692823040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b29d351f97 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
2d73ff7004
avcodec/h264idct_template: Fix integer overflow in ff_h264_chroma422_dc_dequant_idct()
...
Fixes: signed integer overflow: -2105540608 - 2105540608 cannot be represented in type 'int'
Fixes: 26870/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5656647567147008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 51dfd6f1bd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
a643e2e9c1
avformat/dsfdec: Check block_align more completely
...
Fixes: infinite loop
Fixes: 26865/clusterfuzz-testcase-minimized-ffmpeg_dem_DSF_fuzzer-5649473830912000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65b8974d54 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
fe64c72c5a
avformat/mpc8: Check remaining space in mpc8_parse_seektable()
...
Fixes: Fixes infinite loop
Fixes: 26704/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6327056939614208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f66dd13d0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
ca040d6b65
avformat/id3v2: Sanity check tlen before alloc and uncompress
...
Fixes: Timeout (>20sec -> 65ms)
Fixes: 26896/clusterfuzz-testcase-minimized-ffmpeg_dem_DAUD_fuzzer-5691024049176576
Fixes: 27627/clusterfuzz-testcase-minimized-ffmpeg_dem_AEA_fuzzer-4907019324358656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d7f87a4b9e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
2f16247c99
avformat/vqf: Check len for COMM chunks
...
Fixes: Infinite loop
Fixes: 26696/clusterfuzz-testcase-minimized-ffmpeg_dem_VQF_fuzzer-5648269168082944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a834af133b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
6718c814aa
avcodec/hevc_cabac: Limit value in coeff_abs_level_remaining_decode() tighter
...
The max depth is 16bps, the max allowed coefficient depth is depth+6
Fixes: signed integer overflow: 1074266112 + 1073725439 cannot be represented in type 'int'
Fixes: 26493/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5657763331702784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7cf852b03c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
071ae40ee3
avformat/cafdec: Check the return code from av_add_index_entry()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9dc3301745 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
f1018f874c
avformat/cafdec: Check for EOF in index read loop
...
Fixes: OOM
Fixes: 27398/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-541296033975500
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eb46939e3a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
68dd210aab
avformat/cafdec: Check that bytes_per_packet and frames_per_packet are non negative
...
These fields are not signed in the spec (1.0) so they cannot be negative
Changing bytes_per_packet to unsigned would not solve this as it is exported
as block_align which is signed
Fixes: Infinite loop
Fixes: 26492/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5632087614554112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5eed718087 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
f226e4b469
avformat/mpc8: correct integer overflow in mpc8_parse_seektable()
...
Fixes: signed integer overflow: -4683718486770919638 * 2 cannot be represented in type 'long'
Fixes: 26704/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6327056939614208
Fixes: 27550/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6259212652642304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0897402ac8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
8d3dd028a5
avformat/mpc8: correct 32bit timestamp truncation
...
Fixes: left shift of 65536 by 15 places cannot be represented in type 'int'
Fixes: 26801/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-5164313092030464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ad3e495657 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
4810fe7936
avcodec/exr: Check ymin vs. h
...
Fixes: out of array access
Fixes: 26532/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5613925708857344
Fixes: 27443/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5631239813595136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3e5959b345 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
9be82d9ab0
avformat/avs: Use 64bit for the avio_tell() output
...
Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented in type 'long'
Fixes: 26549/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS_fuzzer-4844306424397824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1278f117d7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
a1206b3fc6
avformat/wavdec: More complete size check in find_guid()
...
Fixes: signed integer overflow: 9223372036854775807 + 8 cannot be represented in type 'long'
Fixes: 27341/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5442833206738944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a207df2acb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
d3606caee9
avformat/iff: Check size before skip
...
Fixes: Infinite loop
Fixes: 27292/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5731168991051776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b50e8bc29 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
2521c55a54
avformat/rmdec: Check for EOF in index packet reading
...
Fixes: Timeout(>10sec -> 1ms)
Fixes: 27284/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6304211110985728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ebf4bc629e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
df388f600d
avcodec/vp3dsp: Use unsigned constant to avoid undefined integer overflow in ff_vp3dsp_set_bounding_values()
...
Fixes: signed integer overflow: 64 * 33686018 cannot be represented in type 'int'
Fixes: 26911/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-4904975073017856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c7e775f712 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
89db9bbfc3
avformat/icodec: Check for zero streams and stream creation failure
...
Fixes: NULL pointer dereference
Fixes: 26814/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-5758487797432320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b33233bd53 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
636fe41451
avformat/icodec: Factor failure code out in read_header()
...
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 27ee67c00f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
a21ad9701f
avformat/bintext: Check width
...
Fixes: division by 0
Fixes: 26780/clusterfuzz-testcase-minimized-ffmpeg_dem_ADF_fuzzer-5117945027756032
Fixes: 26998/clusterfuzz-testcase-minimized-ffmpeg_dem_ADF_fuzzer-5119352359354368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f6dc285fb5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
316c6d1645
avformat/sbgdec: Check that end is not before start
...
Fixes: signed integer overflow: -9223372036854775808 + -5279949906739200 cannot be represented in type 'long'
Fixes: 26908/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6329610851319808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9ef60a66f1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
cdf76ca572
avformat/lvfdec: Check stream_index before use
...
Fixes: assertion failure
Fixes: 26905/clusterfuzz-testcase-minimized-ffmpeg_dem_LVF_fuzzer-5724267599364096.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b1d99ab14f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
63e0cb0b68
avformat/au: cleanup on EOF return in au_read_annotation()
...
Fixes: memleak
Fixes: 26841/clusterfuzz-testcase-minimized-ffmpeg_dem_AU_fuzzer-5174166309044224
Regression since: e680d50eb4
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d16974c3dd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
bce5806f42
avformat/mpegts: Limit copied data to space
...
Fixes: out of array access
Fixes: 26816/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-6282861159907328.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 79cf7c7191 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
a56fdfc01f
avformat/bintext: Check width in idf_read_header()
...
Fixes: division by 0
Fixes: 26802/clusterfuzz-testcase-minimized-ffmpeg_dem_IDF_fuzzer-5180591554953216.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 442d53f409 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
143037c580
avformat/iff: check size against INT64_MAX
...
Bigger sizes are misinterpreted as negative numbers by the API
Fixes: infinite loop
Fixes: 26611/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4890614975692800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f291cd681b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
955b471fbe
avformat/vividas: improve extradata packing checks in track_header()
...
Fixes: out of array accesses
Fixes: 26622/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-6581200338288640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 27a99e2c7d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
f201ec88d0
avformat/paf: Check for EOF in read_table()
...
Fixes: OOM
Fixes: 26528/clusterfuzz-testcase-minimized-ffmpeg_dem_PAF_fuzzer-5081929248145408
Fixes: 26584/clusterfuzz-testcase-minimized-ffmpeg_dem_PAF_fuzzer-5172661183053824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 437b7302b0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
5d804bfba3
avformat/gxf: Check pkt_len
...
Fixes: Infinite loop
Fixes: 26576/clusterfuzz-testcase-minimized-ffmpeg_dem_GXF_fuzzer-4823080360476672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dad9a86ca7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
c1574b35c3
avformat/aiffdec: Check packet size
...
Fixes: Fixes infinite loop
Fixes: 26575/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-5727522236661760
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ba71a72d3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
fa31c57838
avformat/concatdec: use av_strstart()
...
Fixes: out array read
Fixes: 26610/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-5631838049271808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2610acb49a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
59305f5dfe
avformat/wavdec: Refuse to read chunks bigger than the filesize in w64_read_header()
...
Fixes: OOM
Fixes: 26414/clusterfuzz-testcase-minimized-ffmpeg_dem_FWSE_fuzzer-5070632544632832
Fixes: 26475/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5770207722995712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b2244565a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
ab8e3d3d46
avformat/rsd: Check size and start before computing duration
...
Fixes: signed integer overflow: 100794754 * 28 cannot be represented in type 'int'
Fixes: 26474/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-5181797606096896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c79d8a6851 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
9029882be6
avformat/vividas: better check of current_sb_entry
...
This is the simplest fix for the problem, it is possible to instead check
this when the variables are set and propagate errors and then fail earlier
Fixes: out of array access
Fixes: 26490/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5723367078100992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b848baef0d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
2765860a65
avformat/iff: More completely check body_size
...
Fixes: infinite loop
Fixes: 26485/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5126561373880320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3588e2e6b0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
804fcfb05e
avformat/xwma: Check for EOF in dpds_table read code
...
Fixes: Timeout (>30 -> 140ms)
Fixes: 26478/clusterfuzz-testcase-minimized-ffmpeg_dem_XWMA_fuzzer-5918147066200064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 44b18a76b8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
49c220f93b
avcodec/utils: Check sample rate before use for AV_CODEC_ID_BINKAUDIO_DCT in get_audio_frame_duration()
...
Fixes: shift exponent 95 is too large for 32-bit type 'int'
Fixes: 26590/clusterfuzz-testcase-minimized-ffmpeg_dem_SMACKER_fuzzer-5120609937522688
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec7e0d4288 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
ca6118797e
avcodec/dirac_parser: do not offset AV_NOPTS_OFFSET
...
Fixes: signed integer overflow: -9223372036854775807 - 48000 cannot be represented in type 'long long'
Fixes: 26521/clusterfuzz-testcase-minimized-ffmpeg_dem_DIRAC_fuzzer-5635536506847232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 343c3149ab )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
6e0988527f
avformat/rmdec: Make expected_len 64bit
...
Fixes: signed integer overflow: 1347551268 * 14 cannot be represented in type 'int'
Fixes: 26458/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-5655364324032512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 728330462c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
607a34f726
avformat/pcm: Check block_align
...
Fixes: signed integer overflow: 321 * 8746632 cannot be represented in type 'int'
Fixes: 26461/clusterfuzz-testcase-minimized-ffmpeg_dem_PVF_fuzzer-6326427831762944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b23a619c13 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
2325490a2f
avformat/lrcdec: Clip timestamps
...
Fixes: signed integer overflow: 7111111111111531010 - -7335632962598013506 cannot be represented in type 'long'
Fixes: 26463/clusterfuzz-testcase-minimized-ffmpeg_dem_LRC_fuzzer-6015558333759488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 80bc2ac3c0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
cb054a2daa
avformat/electronicarts: Check for EOF in each iteration of the loop in ea_read_packet()
...
Fixes: timeout(>20sec -> 1ms)
Fixes: 26526/clusterfuzz-testcase-minimized-ffmpeg_dem_EA_fuzzer-5672328069120000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 857aba7c45 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
e583c69816
avformat/ifv: Check that total frames do not overflow
...
Fixes: Infinite loop
Fixes: 26392/clusterfuzz-testcase-minimized-ffmpeg_dem_GIF_fuzzer-5713658237419520
Fixes: 26435/clusterfuzz-testcase-minimized-ffmpeg_dem_SUBVIEWER_fuzzer-6548251853193216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b990148d1e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
4d5d82314f
avcodec/vp9dsp_template: Fix some overflows in iadst8_1d()
...
Fixes: signed integer overflow: 190587 * 11585 cannot be represented in type 'int'
Fixes: 26407/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5086348408782848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bca0735be5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
d3595579ca
avcodec/fits: Check bscale
...
Fixes: division by 0
Fixes: 26208/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-6270472117026816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c2ccd76fd0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
17e941dbd4
avformat/nistspheredec: Check bps
...
Fixes: left shift of 1111111190 by 3 places cannot be represented in type 'int'
Fixes: 26437/clusterfuzz-testcase-minimized-ffmpeg_dem_NISTSPHERE_fuzzer-4886896091856896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7c144b363e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
b8ba08ef17
avformat/jacosubdec: Use 64bit inside get_shift()
...
Fixes: signed integer overflow: 111111111 * 30 cannot be represented in type 'int'
Fixes: 26448/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-5638440374501376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 715ff75e5d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
92938c2f30
avformat/genh: Check block_align
...
Fixes: infinite loop
Fixes: 26440/clusterfuzz-testcase-minimized-ffmpeg_dem_GENH_fuzzer-5632134020333568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 37396e9ba8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
50faadb711
avformat/mvi: Check count for overflow
...
Fixes: left shift of 21378748 by 10 places cannot be represented in type 'int'
Fixes: 26449/clusterfuzz-testcase-minimized-ffmpeg_dem_MVI_fuzzer-5680463374712832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a413ed9863 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
b98d0d4d33
avcodec/magicyuv: Check slice size before reading flags and pred
...
Fixes: heap-buffer-overflow
Fixes: 26487/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_fuzzer-5742553675333632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0dc42147b6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
bd58373224
avformat/asfdec_f: Check for negative ext_len
...
Fixes: Infinite loop
Fixes: 26376/clusterfuzz-testcase-minimized-ffmpeg_dem_PCM_U32LE_fuzzer-6050518830678016
Fixes: 26377/clusterfuzz-testcase-minimized-ffmpeg_dem_TY_fuzzer-4838195726123008
Fixes: 26384/clusterfuzz-testcase-minimized-ffmpeg_dem_G729_fuzzer-5173450337157120
Fixes: 26396/clusterfuzz-testcase-minimized-ffmpeg_dem_PCM_S24BE_fuzzer-5071092206796800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 209b9ff5c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
476c7d446b
avformat/bethsoftvid: Check image dimensions before use
...
Fixes: signed integer overflow: 55255 * 53207 cannot be represented in type 'int'
Fixes: 26387/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS2_fuzzer-5684222226071552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 50b29f081e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
22f451a0a3
avformat/genh: Check block_align for how it will be used in SDX2_DPCM
...
Fixes: signed integer overflow: 19922944 * 1024 cannot be represented in type 'int'
Fixes: 26402/clusterfuzz-testcase-minimized-ffmpeg_dem_VMD_fuzzer-5745470053548032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c95b47e18f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
92d7a08c61
avformat/au: Check for EOF in au_read_annotation()
...
Fixes: Timeout (too looong -> 1 ms)
Fixes: 26366/clusterfuzz-testcase-minimized-ffmpeg_dem_SDX_fuzzer-5655584843759616
Fixes: 26391/clusterfuzz-testcase-minimized-ffmpeg_dem_ALP_fuzzer-5484026133217280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e680d50eb4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
934b7ed517
avformat/vividas: Check for zero v_size
...
Fixes: SEGV on unknown address 0x000000000000
Fixes: 26482/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-4905102324006912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c7a5face77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
3783ffa2a0
avformat/segafilm: Do not assume AV_CODEC_ID_NONE is 0
...
Suggested-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d34e4904cd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
1b1ab7013e
avformat/segafilm: Check that there is a stream
...
Fixes: assertion failure
Fixes: 26472/clusterfuzz-testcase-minimized-ffmpeg_dem_SEGAFILM_fuzzer-5759751591559168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c0d7fd269b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
e653c2fec4
avformat/wtvdec: Check dir_length
...
Fixes: Infinite loop
Fixes: 26445/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5125558331244544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1868cb7316 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
30aea1efec
avformat/ffmetadec: finalize AVBPrint on errors
...
Fixes: memleak
Fixes: 26450/clusterfuzz-testcase-minimized-ffmpeg_dem_FFMETADATA_fuzzer-6249850443923456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a927128617 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
c863e7e600
avcodec/decode/ff_get_buffer: Check for overflow in FFALIGN()
...
Fixes: signed integer overflow: 2147483647 + 64 cannot be represented in type 'int'
Fixes: 26218/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CRI_fuzzer-5734075396259840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 939b72b02e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
d09c9a7162
avcodec/exr: Check limits to avoid overflow in delta computation
...
Fixes: signed integer overflow: 553590816 - -2145378049 cannot be represented in type 'int'
Fixes: 26315/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5938755121446912
Fixes: 26340/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5644316208529408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6910e0f4e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
c8b11c0d3f
avformat/boadec: Check that channels and block_align are set
...
Fixes: Infinite loop
Fixes: 26381/clusterfuzz-testcase-minimized-ffmpeg_dem_BOA_fuzzer-5745789089087488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 44ff5a1bff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
5dbeb9c4d6
avformat/asfdec_f: Check name_len for overflow
...
Fixes: signed integer overflow: -1172299744 * 2 cannot be represented in type 'int'
Fixes: 26258/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5672758488596480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0d088a47ca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
f62da97dfc
avcodec/h264idct_template: Fix integer overflow in ff_h264_chroma422_dc_dequant_idct()
...
Fixes: signed integer overflow: 241173056 + 1953511200 cannot be represented in type 'int'
Fixes: 26086/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5068366420901888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d198362839 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
f419c855b1
avcodec/aacdec_fixed: Limit index in vector_pow43()
...
Fixes: out of array access
Fixes: 26087/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5724825462767616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f83a53638 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
8f17815edb
avformat/rmdec: sanity check coded_framesize
...
Fixes: signed integer overflow: -14671840 * 8224 cannot be represented in type 'int'
Fixes: 24793/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5101884323659776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aee8477c6b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
6075d36825
avformat/flvdec: Check for EOF in amf_parse_object()
...
Fixes: Timeout (too long -> 1ms)
Fixes: 26108/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5653887668977664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 33624f4f2e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
182a1902f7
avcodec/smacker: Check remaining bits in SMK_BLK_FULL
...
Fixes: out of array access
Fixes: 26047/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKER_fuzzer-5083031667474432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 42ded4d1e6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
b77c294c9a
avcodec/cook: Check subpacket index against max
...
Fixes: off by 1 error
Fixes: index 5 out of bounds for type 'COOKSubpacket [5]'
Fixes: 25772/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5762459498184704.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5a2a7604da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
317b5bdcf2
avcodec/utils: Check for overflow with ATRAC* in get_audio_frame_duration()
...
Fixes: signed integer overflow: 1024 * 13129048 cannot be represented in type 'int'
Fixes: 26378/clusterfuzz-testcase-minimized-ffmpeg_dem_CODEC2RAW_fuzzer-5634018353348608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 01bb12f883 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
9bd5b897db
avcodec/hevcpred_template: Fix diagonal chroma availability in 4:2:2 edge case in intra_pred
...
Fixes: pixel decode issue.ts
Fixes: raw frame.hevc
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3fbf873792 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
db799e0bc2
avformat/icodec: Change order of operations to avoid NULL dereference
...
Fixes: SEGV on unknown address 0x000000000000
Fixes: 26379/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-5709011753893888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3300f5c133 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
55698d3ef2
avcodec/exr: Fix overflow with many blocks
...
Fixes: signed integer overflow: 1073741827 * 8 cannot be represented in type 'int'
Fixes: 25621/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6304841641754624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7265b7d904 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
139729ca62
avcodec/vp9dsp_template: Fix integer overflows in idct16_1d()
...
Fixes: signed integer overflow: -190760 * 11585 cannot be represented in type 'int'
Fixes: 25471/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5743354917421056
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 394e8bb385 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
51625c3a41
avcodec/ansi: Check initial dimensions
...
Fixes: Timeout (minutes to less than 1sec)
Fixes: 25682/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ANSI_fuzzer-6320712032452608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 949f0a6be9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
6730fc755b
avcodec/hevcdec: Check slice_cb_qp_offset / slice_cr_qp_offset
...
Fixes: signed integer overflow: 29 + 2147483640 cannot be represented in type 'int'
Fixes: 25413/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5697909331591168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 106f11f68a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
e5e60759bb
avcodec/sonic: Check for overread
...
Fixes: Timeout (too long -> 1.3 sec)
Fixes: 24358/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5107284099989504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eeabdef1bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
9c13daeaf7
avformat/subviewerdec: fail on AV_NOPTS_VALUE
...
Such values are not supported by ff_subtitles_queue*
Fixes: signed integer overflow: 10 - -9223372036854775808 cannot be represented in type 'long'
Fixes: 24193/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5714901855895552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b7f51428b1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
f1e4fe95bc
avcodec/exr: Check line size for overflow
...
Fixes: signed integer overflow: 570425356 * 6 cannot be represented in type 'int
Fixes: 25929/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5099197739827200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9b72cea446 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
20256685ac
avcodec/exr: Check xdelta, ydelta
...
Fixes: assertion failure
Fixes: 25617/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5648746061496320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6949df35d0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
7ec4c95d94
avcodec/celp_filters: Avoid invalid negation in ff_celp_lp_synthesis_filter()
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 25675/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G729_fuzzer-4786580731199488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 11a6347f9e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
c9d831808b
avcodec/takdsp: Fix negative shift in decorrelate_sf()
...
Fixes: left shift of negative value -4
Fixes: 25723/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-6250580752990208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f54f53003 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
0e7b7fdbdf
avcodec/dxtory: Fix negative stride shift in dx2_decode_slice_420()
...
Fixes: left shift of negative value -640
Fixes: 26044/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXTORY_fuzzer-5631057602543616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3291d994b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
fa06111bb1
avformat/asfdec_f: Change order or operations slightly
...
Fixes: signed integer overflow: 20 * 5184056935931942919 cannot be represented in type 'long'
Fixes: 25466/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4798660247552000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 686f015190 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
5973df8f6a
avformat/dxa: Use av_rescale() for duration computation
...
Fixes: signed integer overflow: 8224000000 * 1629552639 cannot be represented in type 'long'
Fixes: 24908/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4658478506049536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c313089fbe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
49eb5761b6
avcodec/vc1_block: Fix integer overflow in ac value
...
Fixes: signed integer overflow: 25488 * 87381 cannot be represented in type 'int'
Fixes: 24765/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5108259565076480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3056e19e68 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
5bc8eae840
avformat/iff: Check data_size not overflowing int64
...
Fixes: Infinite loop
Fixes: 25844/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5660803318153216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 24352ca792 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
f38d86df9d
avcodec/dxtory: Fix negative shift in dx2_decode_slice_410()
...
Fixes: left shift of negative value -768
Fixes: 25574/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXTORY_fuzzer-6012596027916288
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit abebd87764 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
8ab1d3e7f0
avcodec/sonic: Check channels before deallocating
...
Fixes: heap-buffer-overflow
Fixes: 25744/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5172961169113088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f249981976 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
e6be468b4a
avformat/vividas: Check for EOF in first loop in track_header()
...
Fixes: timeout (243sec -> a few ms)
Fixes: 25716/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5764093666131968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7170d342e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-10 16:04:26 +02:00
Michael Niedermayer
653bd4f135
avcodec/ansi: Check nb_args for overflow
...
Fixes: Integer overflow (no testcase)
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc0e776c9a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-20 10:33:45 +02:00
Michael Niedermayer
a4945989fe
avformat/wc3movie: Cleanup on wc3_read_header() failure
...
Fixes: memleak
Fixes: 23660/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6007508031504384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b78860e769 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-05 21:28:08 +02:00
Michael Niedermayer
2b1e1c2d03
avformat/wc3movie: Move wc3_read_close() up
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c635f2ce6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-05 21:28:08 +02:00
Michael Niedermayer
3bdeb977e1
avcodec/diracdsp: Fix integer anomaly in dequant_subband_*
...
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: 23760/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-604209011412172
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ca3c6c981a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-05 21:28:08 +02:00
Michael Niedermayer
ae4393ae9e
avutil/fixed_dsp: Fix integer overflows in butterflies_fixed_c()
...
Fixes: signed integer overflow: 0 - -2147483648 cannot be represented in type 'int'
Fixes: 23646/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5480991098667008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a02ae49c2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-05 21:28:08 +02:00
Michael Niedermayer
6e1af591d5
avcodec/wmalosslessdec: Check remaining space before padding and channel residue
...
Fixes: Timeout (1101sec -> 0.4sec)
Fixes: 24491/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5725337036783616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c467adf3bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-05 21:28:08 +02:00
Michael Niedermayer
1054819802
avformat/cdg: Fix integer overflow in duration computation
...
Fixes: signed integer overflow: 8398407 * 300 cannot be represented in type 'int'
Fixes: 23914/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4702539290509312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa8935b395 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-05 21:28:08 +02:00
Michael Niedermayer
3a876338f1
avcodec/mpc: Fix multiple numerical overflows in ff_mpc_dequantize_and_synth()
...
Fixes: -2.4187e+09 is outside the range of representable values of type 'int'
Fixes: signed integer overflow: -14512205 + -2147483648 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC7_fuzzer-5747263166480384
Fixes: 23528/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC7_fuzzer-5747263166480384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b9f39689a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-05 21:28:08 +02:00
Michael Niedermayer
8af33f41f7
avcodec/agm: Fix off by 1 error in decode_inter_plane()
...
Fixes: Regression since 1f20969457
Found-by: Paul B Mahol <onemda@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6d71a25cc4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-05 21:28:08 +02:00
Michael Niedermayer
c8fb3183a4
avformat/electronicarts: Check if there are any streams
...
Fixes: Assertion failure (invalid stream index)
Fixes: 25120/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6565251898933248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 39a98623ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-05 21:28:08 +02:00
Michael Niedermayer
5030a9cca1
avcodec/ffwavesynth: Fix integer overflow in wavesynth_synth_sample / WS_SINE
...
Fixes: signed integer overflow: -1429092 * -32596 cannot be represented in type 'int'
Fixes: 24419/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5157849974702080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a0da95df77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-05 21:28:08 +02:00
Michael Niedermayer
a74d895bbd
avcodec/vp9dsp_template: Fix integer overflow in iadst8_1d()
...
Fixes: signed integer overflow: 998938090 + 1169275991 cannot be represented in type 'int'
Fixes: 23411/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-4644692330545152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d182d8f10c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-05 21:28:08 +02:00
Michael Niedermayer
beb4bd4e3a
avformat/avidec: Fix io_fsize overflow
...
Fixes: signed integer overflow: 7958120835074169528 * 9 cannot be represented in type 'long long'
Fixes: 23382/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6230683226996736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf0c700b0c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-05 21:28:08 +02:00
Michael Niedermayer
0ce90738fc
avcodec/cfhd: Check transform type
...
Fixes: out of array access
Fixes: 24823/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-4855119863349248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 659658d08b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-05 21:28:08 +02:00
Michael Niedermayer
71b1422ee9
avcodec/tiff: Restrict tag order based on specification
...
"The entries in an IFD must be sorted in ascending order by Tag. Note that this is
not the order in which the fields are described in this document."
This way various dimensions, sample and bit sizes cannot be changed at
arbitrary times which reduces the potential for bugs.
The tag reading code also on various places assumes that numerically previous
tags have already been parsed, so this needs to be enforced one way or another.
If this commit causes problems with real world files which are not easy to fix
then some other form of checks are needed to ensure the various dependencies
in the tag reading are not violated.
Fixes: out of array access
Fixes: 24825/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-6326925027704832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ad29f9e47c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-05 21:28:08 +02:00
Michael Niedermayer
73634e04f2
avformat/siff: Reject audio packets without audio stream
...
Fixes: Assertion failure
Fixes: 24612/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6600899842277376.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8931c55789 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-05 21:28:08 +02:00
Michael Niedermayer
cb667b6460
avformat/mpeg: Check avio_read() return value in get_pts()
...
Found-by: Thierry Foucu <tfoucu@gmail.com >
Fixes: Use-of-uninitialized-value
Reviewed-by: Thierry Foucu <tfoucu@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e8a88a16f7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-05 21:28:08 +02:00
Michael Niedermayer
8ae6def1e0
avcodec/tiff: Check bpp/bppcount for 0
...
Fixes: division by zero
Fixes: 24253/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-6250318007107584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be090da25f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-05 21:28:08 +02:00
Michael Niedermayer
f955b6efab
avcodec/snowdec: Sanity check hcoeff
...
Fixes: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
Fixes: 24011/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5486376610168832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d51d569cf6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-05 21:28:08 +02:00
Michael Niedermayer
c9a546aeda
avformat/mov: Check comp_brand_size
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 24457/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5760093644390400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ffa6072fc7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-05 21:28:08 +02:00
Michael Niedermayer
185a720a4d
avcodec/alac: Check decorr_shift to avoid invalid shift
...
Later the decorrelate_stereo call is guarded by channels == 2
and non-zero decorr_left_weight. Make sure decorr_shift is in
the expected shift range for that case.
Fixes: shift exponent 128 is too large for 32-bit type 'int'
Fixes: 23860/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5751138914402304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Alexander Strasser <eclipse7@gmx.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4333718b35 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-05 21:28:08 +02:00
Michael Niedermayer
fdaead7e23
avcodec/tdsc: Fix tile checks
...
Fixes: out of array access
Fixes: crash.asf
Found-by: anton listov <greyfarn7@yandex.ru >
Reviewed-by: anton listov <greyfarn7@yandex.ru >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 081e3001ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-05 21:28:08 +02:00
Michael Niedermayer
ed54e26463
avcodec/cbs_jpeg: Fix uninitialized end index in cbs_jpeg_split_fragment()
...
Fixes: Out of array read
Fixes: 24043/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5084566275751936.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a10bc8f6f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-10-05 21:28:08 +02:00
Timo Rothenpieler
c9f3835b2b
avcodec/cuviddec: backport extradata fixes
2020-10-01 21:51:44 +02:00
Timo Rothenpieler
05097aff47
avcodec/cuviddec: handle arbitrarily sized extradata
2020-09-30 14:07:58 +02:00
Błażej Szczygieł
03d6632f96
lavf/tls_gnutls: check for interrupt inside handshake loop
...
fixes #8080
Signed-off-by: Błażej Szczygieł <spaz16@wp.pl >
(cherry picked from commit 561ba15c97 )
2020-09-04 21:34:37 +03:00
Jan Ekström
1e7b385199
avformat/tls_schannel: immediately return decrypted data if available
...
Until now, we would have only attempted to utilize already decrypted
data if it was enough to fill the size of buffer requested, that could
very well be up to 32 kilobytes.
With keep-alive connections this would just lead to recv blocking
until rw_timeout had been reached, as the connection would not be
officially closed after each transfer. This would also lead to a
loop, as such timed out I/O request would just be attempted again.
By just returning the available decrypted data, keep-alive based
connectivity such as HLS playback is fixed with schannel.
(cherry picked from commit 6f8826e4aa )
2020-09-04 19:04:55 +03:00
Jan Ekström
93d1993181
avformat/tls_schannel: always decrypt all received data
...
The dec_buf seems to be properly managed between read calls,
and we have no logic to decrypt before attempting socket I/O.
Thus - until now - such data would not be decrypted in case of
connections such as HTTP keep-alive, as the recv call would
always get executed first, block until rw_timeout, and then get
retried by retry_transfer_wrapper.
Thus - if data is received - decrypt all of it right away. This way
it is available for the following requests in case they can be
satisfied with it.
(cherry picked from commit 39977fff20 )
2020-09-04 19:04:06 +03:00
Andreas Rheinhardt
d359b750af
avformat/sdp: Fix potential write beyond end of buffer
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 5d91b7718e )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-10 21:31:39 +02:00
Andreas Rheinhardt
40e049856e
avformat/mm: Check for existence of audio stream
...
No audio stream is created unconditionally and if none has been created,
no packet with stream_index 1 may be returned. This fixes an assert in
ff_read_packet() in libavformat/utils reported in ticket #8782 .
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit ec59dc73f0 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-10 21:31:36 +02:00
Michael Niedermayer
f9f95ceebf
Changelog: update
2020-07-09 01:30:42 +02:00
Zhao Zhili
a06587b01a
avformat/mov: Fix unaligned read of uint32_t and endian-dependance in mov_read_default
...
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 806a4d5187 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-07 21:05:23 +02:00
Michael Niedermayer
f9a7ca5911
Update for 4.2.4
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-07 20:39:24 +02:00
Michael Niedermayer
11c1e1d6d0
avcodec/apedec: Fix undefined integer overflow with 24bit
...
Fixes: signed integer overflow: 8683744 * 256 cannot be represented in type 'int'
Fixes: 23527/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5679885932822528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9f7b252cdf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-07 19:30:17 +02:00
Michael Niedermayer
b8f3879bcc
avcodec/loco: Fix integer overflow with large values from loco_get_rice()
...
Fixes: signed integer overflow: 155 + 2147483647 cannot be represented in type 'int'
Fixes: 23421/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5652849097965568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ddc5e1f3c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-07 19:29:23 +02:00
Michael Niedermayer
bcbfcf1300
avformat/smjpegdec: Check the existence of referred streams
...
Fixes: Assertion failure
Fixes: 23758/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5160954605338624.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 321ea59dac )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-07 19:28:29 +02:00
Michael Niedermayer
7d3da77756
avcodec/pnmdec: Fix misaligned reads
...
Found-by: "Steinar H. Gunderson" <steinar+ffmpeg@gunderson.no >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea28ce9bc1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-06 01:50:33 +02:00
Michael Niedermayer
a957f43072
avcodec/scpr3: Fix out of array access with dectab
...
Fixes: 23721/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-5914074721550336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8de8dfba6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:57 +02:00
Michael Niedermayer
2cebde69e0
avcodec/dstdec: Replace AC overread check by sample rate check
...
Real files do skip coding 0 bits at the end, thus this kind of check
does not work reliable.
Fixes: Ticket 8770
Fixes: dst-256fs44-6ch-refdstencoder.dff
The samplerate is specified in ISO/IEC 14496-3:2005(E) as one of 3 fixed
values, this also can be used to limit the duration and avoid the timeout
This reverts commit f6df99dba1 .
(cherry picked from commit 1679f23beb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:57 +02:00
Michael Niedermayer
9fd30d0bdf
avutil/avsscanf: Add () to avoid integer overflow in scanexp()
...
Fixes: signed integer overflow: 2147483610 + 52 cannot be represented in type 'int'
Fixes: 23260/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PBM_fuzzer-5187871274434560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 42b28565aa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:57 +02:00
Michael Niedermayer
6fe28832a9
avformat/utils: reorder duration computation to avoid overflow
...
Fixes: signed integer overflow: 8 * 9223372036854774783 cannot be represented in type 'long'
Fixes: 23381/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4818340509122560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 10cc82c35b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:57 +02:00
Michael Niedermayer
3ea2cfe162
avcodec/pngdec: Check for fctl after idat
...
Fixes: out of array access
Fixes: 23554/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-4796622520451072.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65b1ba680f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:57 +02:00
Michael Niedermayer
57970c41f5
avformat/hls: Pass a copy of the URL for probing
...
The segments / url can be modified by the io read when reloading
This may be an alternative or additional fix for Ticket8673
as a further alternative the reload stuff could be disabled during
probing
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5e39880fb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:57 +02:00
Steven Liu
c00e881a45
avformat/hls: check segment duration value of EXTINF
...
fix ticket: 8673
set the default EXTINF duration to 1ms if duration is smaller than 1ms
Signed-off-by: Steven Liu <lq@chinaffmpeg.org >
(cherry picked from commit 9dfb19baeb )
2020-07-05 01:47:57 +02:00
Michael Niedermayer
0c4fcdead8
avutil/common: Fix integer overflow in av_ceil_log2_c()
...
Fixes: left shift of 1913647649 by 1 places cannot be represented in type 'int'
Fixes: 23572/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5082619795734528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e409262837 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:57 +02:00
Michael Niedermayer
e02303282d
avcodec/wmalosslessdec: fix overflow with pred in revert_cdlms
...
Fixes: signed integer overflow: 2048 + 2147483646 cannot be represented in type 'int'
Fixes: 23538/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5227567073460224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 21598d711d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:57 +02:00
Michael Niedermayer
98ff949451
avformat/mvdec: Fix integer overflow with billions of channels
...
Fixes: signed integer overflow: 1394614304 * 2 cannot be represented in type 'int'
Fixes: 23491/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5697377020411904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b6fbbe08c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
a720e4d3c9
avformat/microdvddec: skip malformed lines without frame number.
...
Fixes: signed integer overflow: 1 - -9223372036854775808 cannot be represented in type 'long'
Fixes: 23490/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5133490093031424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8fb7612a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
774efe1ece
avformat/mxfdec: free duplicated utf16 strings
...
Fixes: memleak
Fixes: 23415/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5124814510751744
Suggested-by: Marton Balint <cus@passwd.hu >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0aa2768cb2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
5fd3af45bc
avformat/4xm: Check that a video stream was created before returning packets for it
...
Fixes: assertion failure
Fixes: 23434/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5227750851084288.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c517c3f474 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
19d9c40647
avcodec/ffwavesynth: Avoid undefined operation on ts overflow
...
Alternatively these conditions could be treated as errors
Fixes: 23147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5639254549200896
Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'int64_t' (aka 'long')
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 584d334afd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
ee14b82ee0
avcodec/mpeg4videodec: Fix 2 integer overflows in get_amv()
...
Fixes: signed integer overflow: -144876608 * 16 cannot be represented in type 'int'
Fixes: 22782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-6039584977977344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e361785ee0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
7a00fd4964
avcodec/lossless_audiodsp: Fix undefined overflows in scalarproduct_and_madd_int16_c()
...
Fixes: signed integer overflow: 2142077091 + 6881070 cannot be represented in type 'int'
Fixes: 22737/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5958388889681920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c0dfe134be )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
1a74a8078c
avcodec/sonic: Fix several integer overflows
...
Fixes: signed integer overflow: 2129689466 + 2129689466 cannot be represented in type 'int'
Fixes: 20715/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5155263109922816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 75d520e337 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
8c7a41b455
avcodec/mpeg4videodec: avoid invalid values and reinitialize in format changes for studio profile
...
Fixes: out of array access
Fixes: 23327/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5134822992510976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e53235f06c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
17175055f8
avcodec/pixlet: Fix log(0) check
...
Fixes: passing zero to clz(), which is not a valid argument
Fixes: 23337/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PIXLET_fuzzer-5179131989065728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bd0f81526d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
3a8ae4f297
avcodec/iff: Fix off by x error
...
Fixes: out of array access
Fixes: 23245/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5723121327013888.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 51225dee0a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
9641fcb355
avcodec/wmalosslessdec: Check block_align maximum
...
Fixes: Assertion failure
Fixes: 22737/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5958388889681920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 314d10f7a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
035d30ba17
avcodec/loco: Fix signed integer overflow in loco_get_rice()
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 22975/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5658160970072064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa88cdfd90 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
4f92e48d5c
avformat/thp: Check fps
...
Fixes: division by zero
Fixes: 23162/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4856420817436672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e15b01b4e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
374a18fbc8
avformat/mpl2dec: Fix integer overflow with duration
...
Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented in type 'long'
Fixes: 23167/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6425051741290496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9a42a67c5c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
75df98c0a0
avcodec/cbs: Allocate more CodedBitstreamUnit at once in cbs_insert_unit()
...
Fixes: Timeout (85sec -> 0.5sec)
Fixes: 20791/clusterfuzz-testcase-minimized-ffmpeg_BSF_AV1_FRAME_SPLIT_fuzzer-5659537719951360
Fixes: 21214/clusterfuzz-testcase-minimized-ffmpeg_BSF_MPEG2_METADATA_fuzzer-5165560875974656
Fixes: 21247/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_METADATA_fuzzer-5715175257931776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 49ba60fed0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
c540f6939d
avcodec/mpeg12dec: remove outdated comments
...
Found-by: Kieran
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 48de8f5816 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
4dec5b22ac
avcodec/snowdec: Avoid integer overflow with huge qlog
...
Fixes: integer overflow
Fixes: 22285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5682428762128384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38fbf33c72 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Dale Curtis
361416218a
avformat/mov: Check if DTS is AV_NOPTS_VALUE in mov_find_next_sample().
...
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf446711bc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
500965b7ee
avcodec/mpeg12dec: Fix got_output
...
This makes got_output consistent with the code in slice_end() which sets the output
in slice_end()
if (s->pict_type == AV_PICTURE_TYPE_B || s->low_delay) {
int ret = av_frame_ref(pict, s->current_picture_ptr->f);
...
} else {
Fixes: assertion failure
Fixes: 22178/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5664234440753152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f33a9803a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
a09705cf48
avformat/4xm: Cleanup on GET_LIST_HEADER() failure
...
Fixes: memleak
Fixes: 23142/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5932860820422656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5313ce654 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
a497d3de31
avcodec/lzf: Consider the needed size in reallocation
...
Fixes: NULL pointer dereference
Fixes: 22381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-5659879921680384.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 292b9b93a5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
3e88f40dfc
avformat/mlvdec: fail reading a packet with 0 streams
...
Fixes: NULL pointer dereference
Fixes: 22604/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5667739074297856.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5bd5c31087 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
a77a20ddee
avformat/thp: Check compcount
...
Fixes: out of array access
Fixes: 22520/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5100297658826752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1ba8484559 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
7991001f9d
avcodec/adpcm: XA: Check shift similar to filter
...
Fixes: negative shift
Fixes: 22499/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_XA_fuzzer-5765452130418688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6d96bae9c4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
ab4798ae39
avcodec/huffyuvdec: Test vertical coordinate more often
...
Fixes: out of array access
Fixes: 22892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-5135996772679680.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1223ddc56 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
e19a5624d5
avformat/rawdec: fix identifier names
...
Fixes: out of array access
Fixes: 22686/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5121369624018944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 71a822fa35 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
2f5040203b
avcodec/hq_hqa: Check info size
...
Fixes: assertion failure
Fixes: 21079/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-5737046523248640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf28521fee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
b4c08bbd9c
avcodec/wmalosslessdec: Fix integer overflow in mclms_predict()
...
Fixes: signed integer overflow: 2147483636 + 2048 cannot be represented in type 'int'
Fixes: 22016/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5109395618004992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c42ed06695 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
0a93c8b60b
avcodec/vp9dsp_template: Fix integer overflow(s) in iadst16_1d()
...
Fixes: signed integer overflow: 1080285923 - -1130879337 cannot be represented in type 'int'
Fixes: 22002/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-6260237310099456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 071e293723 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
aab78e0c00
avcodec/h264dec: Disable forced small_padding on flag2 fast
...
Fixes: 20978/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5746381832847360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Michael Niedermayer
6555a71388
avformat/oggparsevorbis: Error out on double init of vp
...
Fixes: memleak
Fixes: 19949/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5743636058210304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2a3bbc0086 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-05 01:47:56 +02:00
Andreas Rheinhardt
9ffcbf1db9
avcodec/h264_metadata_bsf: Fix invalid av_freep
...
This bug was introduced in 3c8a2a1180 .
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 04e06beb0a )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-04 22:32:14 +02:00
Andreas Rheinhardt
210aa29b42
avformat/hnm: Check for extradata allocation failure
...
and also add padding to it; moreover, don't use memcpy to write one byte
to extradata.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e0f3352d1 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 01:25:24 +02:00
Andreas Rheinhardt
ca4d2c3c52
avcodec/bitstream: Don't check for undefined behaviour after it happened
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 5e196dac22 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:40:13 +02:00
Andreas Rheinhardt
fd6cb26583
avformat/avc, mxfenc: Avoid allocation of H264 SPS structure, fix memleak
...
Up until now, ff_avc_decode_sps would parse a SPS and return some
properties from it in a freshly allocated structure. Yet said structure
is very small and completely internal to libavformat, so there is no
reason to use the heap for it. This commit therefore changes the
function to return an int and to modify a caller-provided structure.
This will also allow ff_avc_decode_sps to return better error codes in
the future.
It also fixes a memleak in mxfenc: If a packet contained multiple SPS,
only the SPS structure belonging to the last SPS would be freed, the
other ones would leak when the pointer is overwritten to point to the
new SPS structure. Of course, without allocations there are no leaks.
This is Coverity issue #1445194 .
Furthermore, the SPS structure has been renamed from
H264SequenceParameterSet to H264SPS in order to avoid overlong lines.
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit a0b6df0a39 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:39:54 +02:00
Andreas Rheinhardt
847bb1d522
avcodec/cbs_av1: Fix writing uvlc numbers >= INT_MAX
...
Fixes: assertion failure
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 23264/clusterfuzz-testcase-minimized-ffmpeg_BSF_AV1_METADATA_fuzzer-6308429248593920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 6f06c17a55 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:39:45 +02:00
Andreas Rheinhardt
d1fe26f2b7
avformat/mov: Fix memleak
...
When the mov/mp4 demuxer encounters an error during decrypting a packet,
it returns the error, yet doesn't free the packet, so that the packet
leaks. This has been fixed in this commit.
Fixes the memleaks from ticket #8150 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 34bd293b01 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:39:33 +02:00
Zhao Zhili
6b0276f05e
avformat/mov: fix memleaks
...
Fix two cases of memleaks:
1. The leak of dv_demux
2. The leak of dv_fctx upon dv_demux allocate failure
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit f3dc38a186 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:39:24 +02:00
Andreas Rheinhardt
b1d8fac858
libavformat/mov: Fix memleaks when demuxing DV audio
...
The code for demuxing DV audio predates the introduction of refcounted
packets and when the latter was added, changes to the former were
forgotten. This meant that when avpriv_dv_produce_packet initialized the
packet containing the AVBufferRef, the AVBufferRef as well as the
underlying AVBuffer leaked; the actual packet data didn't leak: They
were directly freed, but not via their AVBuffer's free function.
https://samples.ffmpeg.org/ffmpeg-bugs/trac/ticket4671/dir1.tar.bz2
contains samples for this (enable_drefs needs to be enabled for them).
Moreover, errors in avpriv_dv_produce_packet were ignored; this has been
changed, too.
Furthermore, in the hypothetical scenario that the track has a palette,
this would leak, too, so reorder the code so that the palette code
appears after the DV audio code.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 61f5c6ab06 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:39:14 +02:00
Andreas Rheinhardt
76562bf8f0
avformat/mov: Fix reel_name size check
...
Only read str_size bytes from offset 30 of extradata if the extradata is
indeed at least 30 + str_size bytes long.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit ff3fad6b0e )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:39:04 +02:00
Andreas Rheinhardt
ca2ca8d647
avformat/mov: Fix memleak upon encountering repeating tags
...
mov_read_custom tries to read three strings belonging to three different
tags. When an already encountered tag is encountered again, a new buffer
for the string to be read is allocated and stored in the pointer
destined for this particular tag. But in this scenario, said pointer
already holds the address of the string read earlier, leading to a leak.
This commit therefore aborts the reading process upon encountering
an already encountered tag.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit dfef1d5e3c )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:38:55 +02:00
Andreas Rheinhardt
27dec16bbf
avformat/matroskaenc: Don't use NULL for %s format string
...
The argument pertaining to a printf %s conversion specifier must not
be NULL, even if the precision (i.e. the number of characters to write)
is zero. If it is NULL, it is undefined behaviour.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 6de6ce7bc8 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:38:47 +02:00
Andreas Rheinhardt
5a2fbc43b7
avformat/webvttdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit c784fe8b86 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:38:41 +02:00
Andreas Rheinhardt
4cfc3e8a15
avformat/vplayerdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 67434afa7f )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:38:35 +02:00
Andreas Rheinhardt
c86d0c0f7c
avformat/tedcaptionsdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if allocating the AVStream for the subtitles fails.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 337783b118 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:38:30 +02:00
Andreas Rheinhardt
8bfc38893b
avformat/subviewerdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit a708f65273 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:38:25 +02:00
Andreas Rheinhardt
1e6a52841c
avformat/subviewer1dec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 9751d75152 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:38:19 +02:00
Andreas Rheinhardt
11f041c6c8
avformat/stldec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit e13874b9ea )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:37:54 +02:00
Andreas Rheinhardt
fae6d7c5a8
avformat/srtdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit c70409957c )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:37:34 +02:00
Andreas Rheinhardt
6b7af5991a
avformat/sccdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit f3c63e67bb )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:37:21 +02:00
Andreas Rheinhardt
5c9f00b47e
avformat/samidec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle
or when creating extradata.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit f161f8e4ad )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:37:08 +02:00
Andreas Rheinhardt
bdde2f25ed
avformat/pjsdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 9df560e898 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:36:51 +02:00
Andreas Rheinhardt
9542691e95
avformat/mpsubdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon creating an AVStream.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit a5ed8aeea4 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:36:38 +02:00
Andreas Rheinhardt
ae98e1945e
avformat/mpl2dec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 331799747e )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:35:23 +02:00
Andreas Rheinhardt
f6a97f2270
avformat/microdvddec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle
or when allocating extradata.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit b12014a5b8 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:35:03 +02:00
Andreas Rheinhardt
24dc184409
avformat/lrcdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit d38694cea9 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:34:43 +02:00
Andreas Rheinhardt
3ccbb8c104
avformat/jacosubdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit c13a752733 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:33:59 +02:00
Andreas Rheinhardt
b0bdd9f16e
avformat/assdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle
or if creating the extradata failed.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 5ab39c2d8c )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:33:54 +02:00
Andreas Rheinhardt
24ef2a85a3
avformat/aqtitledec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit a86a5d06d8 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:33:39 +02:00
Andreas Rheinhardt
bb03a54e40
avformat/mov: Fix memleaks upon read_header failure
...
By default, a demuxer's read_close function is not called automatically
if an error happens when reading the header; instead it is up to the
demuxer to clean up after itself in this case. The mov demuxer did this
by calling its read_close function when it encountered some errors when
reading the header. Yet for other errors (mostly adding side-data to
streams) this has been forgotten, so that all the internal structures
of the demuxer leak.
This commit fixes this by making sure mov_read_close is called when
necessary.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit ac378c535b )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:33:27 +02:00
Andreas Rheinhardt
ecfe87bdef
avformat/omadec: Fix memleaks upon read_header failure
...
Fixes possible leaks of id3v2 metadata as well as an AVDES struct in
case the content is encrypted and an error happens lateron.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 3d3ba43bc6 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:33:18 +02:00
Andreas Rheinhardt
cadde6894d
avformat/matroskadec: Fix memleaks in WebM DASH manifest demuxer
...
In certain error scenarios, the underlying Matroska demuxer was not
properly closed, causing leaks.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 0841063ce6 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:33:10 +02:00
Andreas Rheinhardt
6d798509e3
avformat/matroskadec: Use right number of tracks
...
When demuxing a Matroska/WebM file, streams are added for tracks and for
attachments, so that the array containing the former can be NULL even
when the corresponding AVFormatContext has streams. So check for there
to be tracks in the MatroskaDemuxContext instead of just streams in the
AVFormatContext before dereferencing the pointer to the tracks.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 1ef30571a0 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:33:03 +02:00
Andreas Rheinhardt
13437c338e
avformat/matroskadec: Fix handling gigantic durations
...
matroska_parse_block currently asserts that the duration is not equal to
AV_NOPTS_VALUE, but there is nothing that actually guarantees this. It
is easy to create (spec-compliant) files which run into this assert;
so replace it and instead cap the duration to INT64_MAX, as the duration
field of an AVPacket is an int64_t.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 3714d452b8 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:32:56 +02:00
Andreas Rheinhardt
2b2358f595
avformat/aviobuf: Don't check for overflow after it happened
...
If adding two ints overflows, it doesn't matter whether the result will
be stored in an unsigned or not; and checking afterwards does not make it
retroactively defined.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 28a078eded )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:32:50 +02:00
Andreas Rheinhardt
5daaa64d8a
avformat/apngenc: Add deinit function
...
Prevents memleaks when the trailer is never written (e.g. when there was
a write error when writing the header).
Fixes ticket #8347 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 26aa04991e )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-01 21:31:59 +02:00
Andreas Rheinhardt
07eb039e04
avcodec/hevc_mp4toannexb_bsf: Check NAL size against available input
...
The hevc_mp4toannexb bsf does not explicitly check whether a NAL unit
is so big that it extends beyond the end of the input packet; it does so
only implicitly by using the checked version of the bytestream2 API.
But this has downsides compared to real checks: It can lead to huge
allocations (up to 2GiB) even when the input packet is just a few bytes.
And furthermore it leads to uninitialized data being output.
So add a check to error out early if it happens.
Also check directly whether there is enough data for the length field.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit ea1b71e82f )
2020-06-15 04:46:05 +02:00
Roman Arzumanyan
221e490d42
avcodec/nvenc: honor max bitrate in CQ mode
...
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2020-06-04 19:02:25 +02:00
Roman Arzumanyan
e388365754
avcodec/nvenc: zero avg and max bitrate in CQ mode
...
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2020-06-01 19:55:37 +02:00
Andreas Rheinhardt
bf7ed52c25
libavcodec/libvpxenc: Don't free user-provided AVPacket
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 26b4509690 )
2020-05-23 20:29:17 +02:00
Andreas Rheinhardt
ef76e5acaa
libavcodec/libmp3lame: Don't free user-provided AVPacket
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 7e6941e185 )
2020-05-23 20:29:16 +02:00
Andreas Rheinhardt
cf813c09d7
avcodec/libopusenc: Don't free user-provided AVPacket
...
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit b803993b6d )
2020-05-23 20:29:16 +02:00
Michael Niedermayer
d3b963cc41
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-21 15:33:14 +02:00
Michael Niedermayer
989a2788c0
avcodec/pnmdec: Use unsigned for maxval rescaling
...
Fixes: signed integer overflow: 65535 * 55335 cannot be represented in type 'int'
Fixes: 21955/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-5669206981083136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 49459aca47 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-21 15:32:29 +02:00
Michael Niedermayer
b7fdc2d02b
avcodec/ivi: Clear got_p_frame before decoding a new frame using it
...
Fixes: assertion failure
Fixes: 21666/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-5706468994318336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1d633e6a0a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-21 15:32:29 +02:00
Michael Niedermayer
219c025463
avcodec/dsddec: Check channels
...
Fixes: division by zero
Fixes: 21677/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DSD_MSBF_fuzzer-5712547983654912
Fixes: 21751/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DSD_LSBF_fuzzer-5197097180856320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2570a8777e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-21 15:32:28 +02:00
Michael Niedermayer
53bfdb6fdb
avcodec/xvididct: Fix integer overflow in idct_row()
...
Fixes: signed integer overflow: -1238335488 + -1003634688 cannot be represented in type 'int'
Fixes: 21649/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5112005765890048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 620236e4d2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-21 15:32:28 +02:00
Michael Niedermayer
5df443f763
avcodec/wmalosslessdec: Fix integer overflows in revert_inter_ch_decorr()
...
Fixes: signed integer overflow: -717241856 + -1434459904 cannot be represented in type 'int'
Fixes: 21405/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5677143666458624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e9a4c4fe99 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-21 15:32:28 +02:00
Michael Niedermayer
209b429168
avcodec/cbs_jpeg: Fix infinite loop in cbs_jpeg_split_fragment()
...
Fixes: Timeout
Fixes: 21104/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5129580475318272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a3dc67c984 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-21 15:32:28 +02:00
Michael Niedermayer
ab9074c1c3
avformat/mpegenc: Fix integer overflow with AV_NOPTS_VALUE
...
Fixes: signed integer overflow: -9223372036854775808 - 45000 cannot be represented in type 'long'
Fixes: ticket8187
Found-by: Suhwan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9874815b1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-21 15:32:28 +02:00
Michael Niedermayer
52510a50f7
avformat/swfenc: Fix integer overflow in frame rate handling
...
Fixes: signed integer overflow: 30000299 * 256 cannot be represented in type 'int'
Fixes: ticket8184
Found-by: Suhwan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 31f956acad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-21 15:32:28 +02:00
Michael Niedermayer
719deee9a7
avformat/aadec: Check toc_size to contain the minimum to demuxer uses
...
Fixes: out of array access
Fixes: stack-buffer-overflow-READ-0x0831fff1
Found-by: GalyCannon <galycannon@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit daa2482871 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-21 15:32:28 +02:00
Michael Niedermayer
1653a2247f
avcodec/cbs_h265_syntax_template: Limit num_long_term_pics more strictly
...
The limit is based on hevcdec.c
Fixes: 20854/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-5160442882424832
Fixes: out of array access
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 435fa373d1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-21 15:32:28 +02:00
Peter Ross
1fc446d7e2
ffplay: set stream_index to -1 earlier to prevent segfault
...
Signed-off-by: Peter Ross <pross@xvid.org >
Reviewed-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit 6cfb33f976 )
2020-05-20 22:11:28 +02:00
Michael Niedermayer
137ceea997
Update for 4.2.3
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-20 19:44:32 +02:00
Dale Curtis
7c01f27701
avformat/mov: Free temp buffer upon negative sample_size error.
...
2d8d554f15 added a new error condition
to mov_read_stsz() but forgot to free a temporary buffer when it
occurs.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cd0771c38c )
2020-05-20 19:42:47 +02:00
Andreas Rheinhardt
0a4e978f35
avformat/matroskadec: Improve forward compability
...
Matroska is built around the principle that a reader does not need to
understand everything in a file in order to be able to make use of it;
it just needs to ignore the data it doesn't know about.
Our demuxer typically follows this principle, but there is one important
instance where it does not: A Block belonging to a TrackEntry with no
associated stream is treated as invalid data (i.e. the demuxer will try
to resync to the next level 1 element because it takes this as a sign
that it has lost sync). Given that we do not create streams if we don't
know or don't support the type of the TrackEntry, this impairs this
demuxer's forward compability.
Furthermore, ignoring Blocks belonging to a TrackEntry without
corresponding stream can (in future commits) also be used to ignore
TrackEntries with obviously bogus entries without affecting the other
TrackEntries (by not creating a stream for said TrackEntry).
Finally, given that matroska_find_track_by_num() already emits its own
error message in case there is no TrackEntry with a given TrackNumber,
the error message (with level AV_LOG_INFO) for this can be removed.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit b577968cab )
2020-05-20 10:51:30 +02:00
Andreas Rheinhardt
26d1e77923
avformat/matroskadec: Don't discard valid packets
...
A Block (meaning both a Block in a BlockGroup as well as a SimpleBlock)
must have at least three bytes after the field containing the encoded
TrackNumber. So if there are <= 3 bytes, the Matroska demuxer would
skip this block, believing it to be an empty, but valid Block.
This might discard valid nonempty Blocks, namely if the track uses header
stripping. And certain definitely spec-incompliant Blocks don't raise
errors: Those with two or less bytes left after the encoded TrackNumber
and those with three bytes left, but with flags indicating that the Block
uses lacing as then there has to be further data describing the lacing.
Furthermore, zero-sized packets were still possible because only the
size of the last entry of a lace was checked.
This commit fixes this. All spec-compliant Blocks that contain data
(even if side data only) are now returned to the caller; spec-compliant
Blocks that don't contain anything are not returned.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit e471faf962 )
2020-05-20 10:51:30 +02:00
Andreas Rheinhardt
588d258ea4
avformat/matroskaenc: Don't segfault when seekability changes
...
If the Matroska muxer's AVIOContext was unseekable when writing the
header, but is seekable when writing the trailer, the code for writing
the trailer presumes that a dynamic buffer exists and tries to update
its content in order to overwrite data that has already been
preliminarily written when writing the header, yet said buffer doesn't
exist as it has been written finally and not preliminarily when writing
the header (because of the unseekability it was presumed that one won't
be able to update the data anyway).
This commit adds a check for this and also for a similar situation
involving updating extradata with new data from packet side-data.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 8aabcf6c11 )
2020-05-20 10:51:30 +02:00
Andreas Rheinhardt
f2117e1e9c
avformat/utils: Fix memleaks
...
ff_read_packet had potential memleaks:
1. If av_packet_make_refcounted fails, it means that the packet is not
refcounted, but it could nevertheless carry side data and therefore
needs to be unreferenced.
2. If putting a packet on a packet list fails, it wasn't unreferenced.
Furthermore, read_frame_internal leaked a packet's (side) data if a
context update was required and failed.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 66d5e43b99 )
2020-05-20 10:51:30 +02:00
Andreas Rheinhardt
2c88423857
avformat/utils: Fix memleaks in avformat_open_input()
...
A demuxer might have allocated memory while reading the header. If
reading the header was successfull and an error happens before returning
(e.g. when queueing the attached pictures), the read_close function
would have never been called, so that all those allocations would leak.
This commit changes this.
Furthermore, there would be even more memleaks if the error level was
set to AV_EF_EXPLODE in case there is both metadata and id3v2 metadata.
This has been fixed, too.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit e2307f4ff1 )
2020-05-20 10:51:30 +02:00
Andreas Rheinhardt
15ccdea8b3
avfilter/vf_dedot: Fix leak of AVFrame if making it writable fails
...
Even in this scenario, the frame still contains references to data that
won't be freed if the frame isn't unreferenced. And the AVFrame itself
will leak, too.
Fixes Coverity issue #1441422 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 212077eda4 )
2020-05-20 10:51:29 +02:00
Andreas Rheinhardt
126cd3821d
avfilter/vf_paletteuse: Fix potential double-free of AVFrame
...
apply_palette() would free an AVFrame given to it only via an AVFrame *
(and not via AVFrame **) in three of its four exists (namely in the
normal path and in two error paths). So upon error the caller has no way
to know whether the frame has already been freed or not;
load_apply_palette(), the only caller, opted to free the frame in this
scenario.
This commit changes this by making apply_palette not freeing the frame
at all, which is left to load_apply_palette().
Fixes Coverity issue #1452434 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit adea33f465 )
2020-05-20 10:51:29 +02:00
Andreas Rheinhardt
fa7d8d63db
avformat/mov: Don't leak MOVFragmentStreamInfo on error
...
Fixes Coverity issue #1441933 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 43f58f2354 )
2020-05-20 10:51:29 +02:00
Andreas Rheinhardt
09d2b9b7be
avformat/mov: Free encryption data on error
...
Fixes memleak and Coverity issue #1439587 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3999c4b374 )
2020-05-20 10:51:29 +02:00
Andreas Rheinhardt
f23478aba2
fftools/ffmpeg: Free swresample dictionary during cleanup
...
Freeing this was forgotten in ad899522 .
Fixes #8315 and #8316 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6f2a3958cf )
2020-05-20 10:51:29 +02:00
Matthieu Bouron
a7b0ab2a23
avcodec/mediacodec_wrapper: fix {input,output}_buffers global reference leak
...
Fixes ticket #8607 .
Signed-off-by: Matthieu Bouron <matthieu.bouron@gmail.com >
(cherry picked from commit 5216edbc54 )
2020-05-20 09:35:58 +02:00
Andreas Rheinhardt
60d8a54432
avformat/webm_chunk: Close IO if writing header fails
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 2a78968849 )
2020-05-20 04:15:00 +02:00
Andreas Rheinhardt
c70f788836
avcodec/cavsdsp: Fix undefined left shifts of negative numbers
...
Affected the ffmpeg-filter_colorkey FATE-test (but only if the C version
of idct8_add is used and not e.g. the x86 SSE2 version).
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Fixes: left shift of negative value -107
Fixes: 20398/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5725389278412800
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0f0f2ab0c3 )
2020-05-20 04:12:20 +02:00
Andreas Rheinhardt
3d9fd3ed69
avcodec/ra144enc: Fix invalid left shift of negative number
...
by replacing it with a multiplication. Said multiplication can't
overflow an int32_t because lpc_coefs is limited to 16 bit precision.
Fixes the FACE-test acodec-ra144 as well as part of #8217 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e3fb9af6f1 )
2020-05-20 04:08:57 +02:00
Andreas Rheinhardt
dfe0d907c2
avcodec/adxenc: Avoid undefined left shift of negative numbers
...
Replace "((a << shift) + b) >> shift" by "a + (b >> shift)". This avoids
a left shift which also happens to trigger undefined behaviour in case "a"
is negative. This affected the FATE-tests acodec-adpcm-adx and
acodec-adpcm-adx-trellis; it also fixes ticket #8008 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 59a9d65e0d )
2020-05-20 04:05:39 +02:00
Andreas Rheinhardt
4f17205a51
avcodec/adpcm: Fix undefined left shifts of negative numbers
...
Affected the adpcm-afc, adpcm-ea-1, adpcm-ea-2, adpcm-ea-maxis-xa,
adpcm-thp and ea-cdata FATE-tests. Also fixes ticket #8487 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ad8af51b7 )
2020-05-20 04:02:44 +02:00
Andreas Rheinhardt
dc0ace722b
avcodec/proresenc_anatoliy: Fix invalid left shift of negative number
...
This fixes ticket #7997 as well as the vsynth*-prores_# FATE-tests
(where * ranges over { 1, 2, 3, _lena } and # over { , _int, _444,
_444_int }).
(Given that prev_dc is in the range -0xC000..0x3FFF, no overflow can
happen upon multiplication with 2.)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 198081efb7 )
2020-05-20 04:00:32 +02:00
Andreas Rheinhardt
e13e36f322
avformat/aviobuf: Honor avio_open[2] documentation
...
The documentation of both avio_open() as well as avio_open2() states
that on failure, the pointer to an AVIOContext given to this function
(via a pointer to a pointer to an AVIOContext) will be set to NULL. Yet
it didn't happen upon failure of ffurl_open_whitelist() or when allocating
the internal buffer failed. This commit changes this.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 220846f74f )
2020-05-20 03:59:36 +02:00
Andreas Rheinhardt
d74e112ad8
avcodec/cinepakenc: Fix invalid shifts
...
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'.
Affected the FATE-tests vsynth1-cinepak, vsynth2-cinepak and
vsynth_lena-cinepak. Also fixes ticket #8220 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e3650dcfc9 )
2020-05-20 03:51:23 +02:00
Andreas Rheinhardt
02ac15ff35
avfilter/vf_xbr: Fix left shift of negative number
...
Affected every usage of vf_xbr, e.g. the FATE-tests filter-2xbr,
filter-3xbr, filter-4xbr.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4294dc3589 )
2020-05-20 03:49:13 +02:00
Andreas Rheinhardt
cbf4c7a6d8
avfilter/vf_hqx: Fix undefined left shifts of negative numbers
...
Affected every usage of this filter; in particular, it affected the
FATE-tests filter-2xbr, filter-3xbr and filter-4xbr.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fa21194326 )
2020-05-20 03:48:42 +02:00
Andreas Rheinhardt
33093d3782
avcodec/jpeg2000dwt: Fix undefined shifts of negative numbers
...
Affected the vsynth*-jpeg2000 and the vsynth*-jpeg2000-97 FATE tests
(where * ranges over { 1, 2, 3, _lena }) as well as ticket #7983 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5cf593adcd )
2020-05-20 03:47:24 +02:00
Andreas Rheinhardt
5b26d86cde
avcodec/ituh263dec: Fix undefined left shift of negative number
...
Fixes ticket #8160 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 324487b596 )
2020-05-20 03:46:43 +02:00
Andreas Rheinhardt
0d5596a3fb
avcodec/dnxhdenc: Fix undefined left shifts of negative numbers
...
Affected 61 FATE-tests: 60 vsynth tests and lavf-mxf_opatom.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b7f156e8cb )
2020-05-20 03:45:50 +02:00
Andreas Rheinhardt
4b75d960b6
swscale/utils: Fix invalid left shifts of negative numbers
...
Affected the FATE-tests vsynth_lena-dv-411, vsynth1-dv-411,
vsynth2-dv-411 and hevc-paramchange-yuv420p.yuv420p10.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e2646e23be )
2020-05-20 03:44:07 +02:00
Andreas Rheinhardt
b694403ef9
swscale/x86/swscale: Fix undefined left shifts of negative numbers
...
This affected many FATE-tests: The number of failing tests went down
from 663 to 344. (Both numbers exclude tests that failed because of
unaligned accesses in code that is inside #if HAVE_FAST_UNALIGNED.)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 736c7c20e7 )
2020-05-20 03:42:42 +02:00
Andreas Rheinhardt
a4a5abbad6
fftools/ffmpeg_opt: Fix signed integer overflow
...
Fixes ticket #8154 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b1fcba8dd )
2020-05-20 03:39:58 +02:00
Andreas Rheinhardt
4f5168e808
avcodec/exr: Fix undefined left shifts of negative numbers
...
Affected the FATE-tests exr-rgb-scanline-pxr24-half-uint32-13x9 and
exr-rgb-scanline-pxr24-uint32.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b0f949906 )
2020-05-20 03:35:10 +02:00
Andreas Rheinhardt
d58dab562b
avformat/movenc: Fix undefined shift
...
Fixes the movenc FATE-test.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 646799b42f )
2020-05-20 03:33:45 +02:00
Andreas Rheinhardt
21cc3c0d87
avcodec/pcm: Fix undefined shifts
...
Fixes the acodec-pcm-u16[lb]e FATE-tests.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 69473bec6f )
2020-05-20 03:24:57 +02:00
Andreas Rheinhardt
0605f5c42a
avcodec/wavpackenc: Fix undefined shifts
...
Fixes ticket #8161 and the acodec-wavpack FATE-test.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 84974c6fb5 )
2020-05-20 03:22:16 +02:00
Andreas Rheinhardt
53a6224227
avutil/encryption_info: Don't pass NULL to memcpy
...
The pointer arguments to memcpy (and several other functions of the
C standard library) are not allowed to be NULL, not even when the number
of bytes to copy is zero. An AVEncryptionInitInfo's data pointer is
explicitly allowed to be NULL and yet av_encryption_init_info_add_side_data
unconditionally used it as a source pointer to copy from. This commit changes
this so that copying is only done if the number of bytes to copy is > 0.
Fixes ticket #8141 as well as a part of ticket #8150 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e6018fda14 )
2020-05-20 03:19:02 +02:00
Andreas Rheinhardt
141c507e05
avcodec/ac3enc: Fix memleak
...
Fixes ticket #8294 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 097c917c14 )
2020-05-20 03:16:34 +02:00
Andreas Rheinhardt
93a8f6d34e
avcodec/ac3enc: Fix invalid shift
...
Fixes the FATE-tests unknown_layout-ac3, ac3-fixed-encode, ac3-encode
and eac3-encode. It furthermore fixes the ac3-encoder bugs mentioned in
tickets #7994 , #8144 and #8159 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f289ec914 )
2020-05-20 03:16:07 +02:00
Andreas Rheinhardt
3e4e968a98
avcodec/g723_1dec: Fix invalid shift
...
Fixes the FATE-tests g723_1-dec-1, g723_1-dec-2 and g723_1-dec-4.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 54e1efda6d )
2020-05-20 03:12:40 +02:00
Andreas Rheinhardt
627f7ba5e2
avcodec/tdsc: Fix undefined shifts
...
Fixes the tdsc FATE-test.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 86bef10e7a )
2020-05-20 03:11:21 +02:00
Andreas Rheinhardt
da3cf6ceb4
avcodec/ttaenc: Fix undefined shift
...
ttaenc contained (1 << unary) - 1 as an argument for a function
expecting an unsigned int. unary can be as big as 31 in this case.
The type of the shift and the whole expression is int, because 1 fits
into an integer, so that the behaviour is undefined if unary == 31
as the result of the shift can't be represented in an int §. Subtraction
by 1 (which makes the result of the whole expression representable in
an int) doesn't change that this is undefined (it usually leads to
signed integer overflow which is undefined, too).
The solution is simple: Make 1 unsigned to change the type of the
whole expression to unsigned int (as the function expects anyway).
Fixes ticket #8153 .
§: This of course presupposes the common int range of -2^31..2^31-1
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ab488a540 )
2020-05-20 03:08:52 +02:00
Andreas Rheinhardt
710ad43919
avformat/avidec: Fix memleak with embedded GAB2 subtitles
...
The code for GAB2 subtitles predates refcounting AVPackets. So in order
to transfer the ownership of a packet's data pkt->data was simply stored
and the packet zeroed; in the end (i.e. in the read_close-function) this
data was then simply freed with av_freep(). This of course leads to a leak
of an AVBufferRef and an AVBuffer. It has been fixed by keeping and
eventually unreferencing the packet's buf instead.
Additionally, the packet is now reset via av_packet_unref().
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit da44bbefaa )
2020-05-20 02:54:39 +02:00
Andreas Rheinhardt
15f051e09a
avformat/matroskadec: Don't discard the upper 32bits of TrackNumber
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit ba36a07734 )
2020-05-20 02:50:59 +02:00
Andreas Rheinhardt
e7b36268be
dump_extradata: Insert extradata even for small packets
...
3469cfab added a check for whether the extradata coincided with the
beginning of the packet's data in order not to add extradata to packets
that already have it. But the check used was buggy for packets whose
size is smaller than the extradata's size. This commit fixes this.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a88a3cdb4b )
2020-05-20 02:46:10 +02:00
Andreas Rheinhardt
95d2ae9710
avformat/segafilmenc: Fix undefined left shift of 1 by 31 places
...
by changing the type to unsigned.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ae026d74f )
2020-05-20 02:44:52 +02:00
Andreas Rheinhardt
09d777a30e
avformat/wtvdec: Fix memleak when reading header fails
...
Fixes #8314 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 373c1c9b69 )
2020-05-20 02:36:58 +02:00
Andreas Rheinhardt
efea91321e
avformat/dashenc: Fix leak of AVFormatContext on error
...
The Dash muxer uses submuxers and when one such submuxer has been allocated,
it is initially only stored in a temporary variable. Therefore it leaks
if an error happens between the allocation and storing it permanently.
This commit changes this.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: "Jeyapal, Karthick" <kjeyapal@akamai.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8aeab0dbc1 )
2020-05-20 02:36:02 +02:00
Andreas Rheinhardt
9dad33fcae
avformat/fitsdec: Fix potential leak of string in AVBPrint
...
by freeing it a bit earlier.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bb20f3dd73 )
2020-05-20 02:34:46 +02:00
Andreas Rheinhardt
4b93166add
avformat/matroskadec: Sanitize SeekHead entries
...
A Seek element in a Matroska SeekHead should contain a SeekID and a
SeekPosition element and upon reading, they should be sanitized:
Given that IDs are restricted to 32 bit, longer SeekIDs should be treated
as invalid. Instead currently the lower 32 bits have been used.
For SeekPosition, no checks were performed for the element to be
present and if present, whether it was excessively large (i.e. the
absolute file position described by it exceeding INT64_MAX). The
SeekPosition element had a default value of -1 which means that a check
seems to have been intended; but it was not implemented. This commit adds
a check for overflow to the calculation of the absolute file position of
the referenced level 1 elements.
Using -1 (i.e. UINT64_MAX) as default value for SeekPosition implies that
a Seek element without SeekPosition will run afoul of this check.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 7c243eece3 )
2020-05-20 02:11:30 +02:00
Andreas Rheinhardt
2dc4034c5a
avformat/matroskaenc: Fix memleak upon encountering bogus chapter
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit cb255b616c )
2020-05-20 02:09:19 +02:00
Andreas Rheinhardt
3a971af005
avformat/matroskaenc: Make ebml_num_size() more robust
...
Matroska (or actually EBML) uses variable-length numbers where only
seven bits of every byte is usable for the length; the other bits encode
the length of the variable-length number. So in order to find out how
many bytes one needs to encode a given number one can use a loop like
while (num >> 7 * bytes) bytes++; the Matroska muxer effectively did this.
Yet it has a disadvantage: It is impossible for the result of a single
right shift of an unsigned number with most significant bit set to be
zero, because one can only shift by 0..(width - 1). On some
architectures like x64 it is not even possible to do it with undefined
right shifts in which case this leads to an infinite loop.
This can be easily avoided by switching to a loop whose condition is
(num >>= 7). The maximum value the so modified function can return
is 10; any value > 8 is invalid and will now lead to an assert in
put_ebml_num() or in start_ebml_master() (or actually in
put_ebml_size_unknown()).
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 9b0f9003df )
2020-05-20 02:05:56 +02:00
Andreas Rheinhardt
f60a1e8d34
avformat/oggenc: Don't free AVStream's priv_data, fix memleak
...
For FLAC, Speex, Opus and VP8 the Ogg muxer allocates two buffers
for building the headers: The first for extradata in an Ogg-specific
format and the second contains a Vorbiscomment. These buffers are
reachable via pointers in the corresponding AVStream's priv_data.
If an error happens during building the headers, the AVStream's
priv_data would be freed. This is pointless in general as it would be
freed generically anyway, but here it is actively harmful: If the second
of the aforementioned allocations fails, the first buffer would leak
upon freeing priv_data.
This commit stops freeing priv_data manually, which allows the muxer to
properly clean up in the deinit function.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 0fcf74f435 )
2020-05-20 02:03:53 +02:00
Andreas Rheinhardt
df88108c97
avformat/utils: Fix memleak when decoding subtitle in find_stream_info
...
avformat_find_stream_info() may decode some frames to get stream
information. And when it does this for subtitles, the decoded subtitles
leak.
(Decoding subtitles was added in b1511e00f6
for PGS subtitles. When PGS subtitles originate from a container that
exports every segment as a packet of its own, no output will be
generated when decoding a packet, because not enough input is available.
Yet when used with PGS subtitles in the Matroska form a single packet
contains enough data to generate output. Yet said output is not freed,
hence this leak.)
Reviewed-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit d026fef999 )
2020-05-20 01:53:20 +02:00
Andreas Rheinhardt
754d63e9d2
fftools/ffmpeg_opt: Check attachment filesize
...
The data of an attachment file is put into an AVCodecParameter's
extradata. The corresponding size field has type int, yet there was no
check for the size to fit into an int. As a consequence, it was possible
to create extradata with negative size (by using a big enough max_alloc).
Other errors were also possible: If SIZE_MAX < INT64_MAX (e.g. on 32bit
systems) then the file size might be truncated before the allocation;
and avio_read() takes an int, too, so one would not have read as much
as one desired.
Furthermore, the extradata is now padded as is required.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 889ad93c88 )
2020-05-20 01:49:24 +02:00
Andreas Rheinhardt
4b9f3c4323
avformat/mpeg: Don't use unintialized value
...
vobsub_read_packet() didn't check whether an array of AVPackets was
valid and therefore used uninitialized values.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit a39536caee )
2020-05-20 01:34:36 +02:00
Andreas Rheinhardt
84b2ec226a
avformat/webmdashenc: Check codec types
...
The WebM DASH Manifest muxer only supports VP8, VP9, Vorbis and Opus,
but there was no check for this. The codec type is used to get a pointer
to a string containing the codec name or NULL if it is not one of those
four codecs. Said pointer has then been used without further checks as
string for the %s conversion specifier in an avio_printf()) call which
is undefined behaviour.
This commit adds a check for the supported codec types.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit cbea58b2b3 )
2020-05-20 01:22:38 +02:00
Andreas Rheinhardt
e4fd6ef46a
avformat/webmdashenc: Fix memleak upon realloc failure
...
The classical ptr = av_realloc(ptr, size).
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 418e468699 )
2020-05-20 01:21:36 +02:00
Andreas Rheinhardt
2765e92731
avformat/subtitles: Don't increment packet counter prematurely
...
Do it only if the packet has been successfully allocated in
av_new_packet() -- otherwise on error a completely uninitialized packet
would be unreferenced later.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6bd8bcc2ac )
2020-05-20 01:10:43 +02:00
Andreas Rheinhardt
10b1d1d3ca
avformat/bethsoftvid: Fix potential memleak upon reallocation failure
...
The classical ptr = av_realloc(ptr, size), just with av_fast_realloc().
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5acef12061 )
2020-05-20 01:09:57 +02:00
Andreas Rheinhardt
5efb7dc2b2
avformat/smoothstreaming: Fix memleaks on errors
...
If an AVFormatContext could be allocated, but white-/blacklists couldn't
be copied, the AVFormatContext would leak as it was only accessible
through a local variable that goes out of scope when one goes to fail.
Furthermore, in case writing a header of a submuxer failed, the options
used for said call could leak.
Both of these memleaks have been fixed.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit abbb466368 )
2020-05-20 01:07:22 +02:00
Andreas Rheinhardt
119ed69bd5
avformat/matroskaenc: Check BlockAdditional size before use
...
Don't read a 64bit number before having checked that the data is at
least 8 bytes long.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6e9cc96429 )
2020-05-20 01:06:28 +02:00
Andreas Rheinhardt
12efc04b3b
avformat/matroskaenc: Check functions that can fail
...
Sometimes it has not been checked whether opening the dynamic buffer for
writing Tags fails; this might have led to segfaults.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b4f300f8ea )
2020-05-20 01:01:12 +02:00
Andreas Rheinhardt
7f2ab227e0
avformat/matroskaenc: Check for reformatting errors
...
This is needed especially for AV1: If a reformatting error happens (e.g.
if the length field of an OBU contained in the current packet indicates
that said OBU extends beyond the current packet), the data pointer is
still NULL, yet the size is unchanged, so that writing the data leads
to a segmentation fault.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 58428bef4b )
2020-05-20 00:52:54 +02:00
Andreas Rheinhardt
703473ec04
avformat/matroskadec: Check before allocations
...
That way one doesn't have to free later. In this case (concerning TTA
extradata), this also fixes a memleak when the output samplerate is
invalid.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit f7bf59b431 )
2020-05-20 00:25:30 +02:00
Andreas Rheinhardt
2980fb5704
avfilter/vf_unsharp: Don't dereference NULL
...
The unsharp filter uses an array of arrays of uint32_t, each of which is
separately allocated. These arrays also need to freed separately; but
before doing so, one needs to check whether the array of arrays has
actually been allocated, otherwise one would dereference a NULL pointer.
This fixes #8408 .
Furthermore, the array of arrays needs to be zero-initialized so that
no uninitialized pointer will be freed in case an allocation of one of
the individual arrays fails.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 710ab13693 )
2020-05-20 00:24:23 +02:00
Andreas Rheinhardt
eae4b61422
avcodec/zmbvenc: Correct offset in buffer
...
zmbvenc allocates a buffer for a picture with padding on all four sides:
The stride is choosen so large that it already contains padding on the
right; the height also includes padding rows. The padding on the right
of each row is also reused as padding for the left of the next row. So
one still needs to add padding on the left for the first row. This is done
by offsetting the actual pointer used to access the picture from the
pointer returned by av_mallocz and the formula for this offset was
wrong, because it ignored that a pixel can take more than one byte when
calculating the offset resulting from the left padding of the first row.
This fixes accesses outside of the allocated buffer that were reported
in tickets #7980 and #7994 . No writes were ever attempted outside of
the buffer.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit def04022f4 )
2020-05-20 00:16:37 +02:00
Andreas Rheinhardt
ca04589371
avcodec/cbs_h2645: Fix potential out-of-bounds array access
...
The maximum allowed index for an array access is FF_ARRAY_ELEMS - 1; yet
the current code allowed FF_ARRAY_ELEMS. This wasn't dangerous in practice,
as parameter sets with invalid ids were already filtered out during
reading.
Found via PVS-Studio (see ticket #8156 ).
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit f3333c3c67 )
2020-05-20 00:10:47 +02:00
Dale Curtis
d2f5691e96
avformat/mov: Don't allow negative sample sizes.
...
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d8d554f15 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Vitaly Buka
558daf07e5
mpeg4videoenc: Don't crash with -fsanitize=bounds
...
Also the patch makes this code consistent with mpeg4videodec.c
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f163d30de2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
b0b8ce0002
avformat/mpegts: Shuffle avio_seek
...
This avoids accessing an old, no longer valid buffer.
Fixes: out of array access
Fixes: crash_audio-2020
Found-by: le wu <shoulewoba@gmail.com >
Reviewed-by: Marton Balint <cus@passwd.hu >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cd74af1416 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
36786f54e7
avcodec/binkaudio: Fix 2Ghz sample_rate
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 19950/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINKAUDIO_DCT_fuzzer-5765514337189888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Paul
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f603d10b1e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
2f747b2d82
avcodec/adpcm: Fix integer overflow in ADPCM THP
...
The reference (thp.txt) uses floats so wrap around would seem incorrect.
Fixes: signed integer overflow: 1073741824 + 1073741824 cannot be represented in type 'int'
Fixes: 20658/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_THP_fuzzer-5646302555930624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b12b05374f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
8d08b70cbc
avcodec/ralf: Check num_blocks before use
...
Fixes: out of array access
Fixes: 20659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5739471895265280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f0c0471075 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
0ce43ac4cd
avcodec/iff: Test video_size being non zero
...
Fixes: Out of array access
Fixes: 20659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5658548592967680
Fixes: 20659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5723561177382912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a035fd88ae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
1cd90e80fe
avcodec/utvideodec: Fix integer overflow in decode_plane()
...
Fixes: signed integer overflow: 2147483594 + 142 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_fuzzer-5658568101724160
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 876cfa67f3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
77753c67c4
avcodec/ttadsp: Fix several integer overflows in tta_filter_process_c()
...
Fixes: signed integer overflow: 1931744255 + 252497024 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5763348114440192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8627885172 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
a6553d7db2
avcodec/ralf: Fix integer overflow in decode_block()
...
Fixes: signed integer overflow: 289082077 - -2003141111 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5196077752123392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c4330847c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
afbb6324c0
avcodec/nuv: widen buf_size type
...
Fixes: signed integer overflow: 65312 * 65312 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-5740176118906880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1ac106bf56 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
ed96d96303
avcodec/iff: Fix several integer overflows
...
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int32_t' (aka 'int')
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5764066459254784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7a92147f87 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
07388eee45
avcodec/g729postfilter: Clip gain before scaling with AGC_FAC1
...
The fixed point integer reference specifies the multiplication used
to have 16bit input and clips so we need to clip the input
The floating point implementation does not seem to do that.
Fixes: signed integer overflow: 6317568 * 410 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G729_fuzzer-5700189272932352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 82d4c7b95e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
95f0a6a171
avcodec/alac: Fix integer overflow with 24/20bps samples
...
Fixes: signed integer overflow: 1020048 * 4096 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5753877751660544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 22e51e95ac )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
8f15c0e767
avcodec/dstdec: Check sample rate
...
Fixes: out of array access
Fixes: 20659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5735812071424000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5727b1f13f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
2cfb8f35cd
avformat/thp: Require a video stream
...
The demuxer code assumes the existence of a video stream
Fixes: assertion failure
Fixes: 21512/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5699660783288320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 97c78caf3e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
68eeca2803
avformat/mpeg: Decrease score by 1 for files with very little valid data
...
Fixes: 8233/PPY6574574605_cut.mp3
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 20f7b4dfc9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
7ab1351794
avcodec/pngdec: Check length in fdAT
...
Fixes: 21089/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-5135981419429888
Fixes: out of array read
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 79e5c2ee2b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
65ae8c5a31
avcodec/g2meet: Check tile_width in epic_jb_decode_tile()
...
Fixes: out of array access
Fixes: 21469/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5199357982015488
Alternatively the arrays can be made bigger or the index can be clipped.
In case a real file with such huge tiles exist we ask the user to upload it.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5501bb28dd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
c8a7672299
avcodec/hapdec: Check tex_size more strictly and before using it
...
Fixes: OOM
Fixes: 20774/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5678608951803904
Fixes: 20956/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5713643025203200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 81fe316ad9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
83f883cea7
avcodec/vp9dsp_template: Fix integer overflows in idct32_1d()
...
Fixes: signed integer overflow: -193177 * 11585 cannot be represented in type 'int'
Fixes: 20557/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5704852816789504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e16e3e63f0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
c0cec459eb
avcodec/alacdsp: Fix invalid shift in append_extra_bits()
...
Fixes: left shift of negative value -1
Fixes: 21390/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-6242539519868928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 49ae034b42 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
e9e585fc29
libavcodec/wmalosslessdec: prevent sum of positive numbers from becoming negative
...
Fixes: left shift of negative value -8321365
Fixes: 20506/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-4798062906310656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 62e4003780 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
595565aeba
avcodec/dstdec: Fix integer overflow in read_table()
...
Fixes: signed integer overflow: -16 * 134217879 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5639509530378240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d465a401d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
5191ef4402
avcodec/txd: Check for input size against the header size.
...
Fixes: Timeout (21sec -> 80ms)
Fixes: 20673/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TXD_fuzzer-5177453863763968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aeb4e43584 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
602caf11c2
avcodec/svq1dec: Check that there is data left after the header
...
Fixes: Timeout (21sec -> 255ms)
Fixes: 20709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ1_fuzzer-5085075089915904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 55e344ee5a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
726904b6d0
avcodec/cbs_h265_syntax_template: Check num_negative/positive_pics when inter_ref_pic_set_prediction_flag is set
...
Fixes: out of array access
Fixes: 20446/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-5707770718584832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 588114cea4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
751e7f7882
avcodec/intrax8: Check for end of bitstream in ff_intrax8_decode_picture()
...
Fixes: Timeout (105sec -> 1sec)
Fixes: 20479/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5769846937878528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a9ccc2514 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
1bc94e816b
avcodec/hevc_mp4toannexb_bsf: Check nalu_size
...
Fixes: Timeout (29sec -> 5ms)
Fixes: 20237/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_MP4TOANNEXB_fuzzer-5165615044362240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ae2537f53e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
4d9462837c
avcodec/iff: Check length before memcpy() in decode_deep_rle32()
...
Fixes: out of array read
Fixes: 20796/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5111364702175232.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b4a33387cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
22fba2adee
avcodec/iff: Fix invalid pointer intermediates in decode_deep_rle32()
...
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc41a29a5a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
0078687445
avcodec/pngdec: Pass ret from decode_iccp_chunk()
...
Found while reviewing a patch fixing a similar issue
Reviewed-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4c7bcaa385 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
d6b070771e
avcodec/rv40dsp: Fix integer overflows in rv40_weight_func_*()
...
Fixes: signed integer overflow: 40550400 * 128 cannot be represented in type 'int'
Fixes: 20331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV40_fuzzer-5676685725007872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 13171ad2e3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
8777426938
avcodec/ac3dec_fixed: Fix several invalid left shifts in scale_coefs()
...
Fixes: left shift of negative value -14336
Fixes: 20298/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AC3_FIXED_fuzzer-5675484201615360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e30502abe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
fe91bb30e9
avcodec/flac_parser: Do not lose header count in find_headers_search()
...
Fixes: Timeout
Fixes: out of array access
Fixes: 20274/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5649631988154368
Fixes: 19275/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5757535722405888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 55f9683cf6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
f70d5d99ce
avcodec/audiodsp: Fix integer overflow in scalarproduct_int16_c()
...
Fixes: signed integer overflow: 2145417478 + 76702564 cannot be represented in type 'int'
Fixes: 20313/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-5734487724130304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit abb5762e98 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
ed1c60d06b
avcodec/cbs_jpeg_syntax_template: Check array index in huffman_table()
...
Fixes: index 224 out of bounds for type 'uint8_t [224]'
Fixes: 21534/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-6291612167831552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 18f5256c0d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
8967905307
avcodec/cbs_jpeg_syntax_template: Check table index before use in dht()
...
Fixes: out of array access
Fixes: 21515/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5766121576988672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d31862c2b1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
33d17d1b53
avformat/oggdec: Check for EOF after page header
...
Fixes: Infinite loop
Fixes: Ticket8594
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f1589be9fd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
01628af26d
swscale/yuv2rgb: Fix vertical dither offset with slices
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be3c29e379 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
85138be8e1
avcodec/dpcm: clip exponent into supported range in XAN DPCM
...
Fixes: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 21200/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XAN_DPCM_fuzzer-5754704894361600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 20ade59d96 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
ddcbb66e00
avcodec/flacdsp_template: Fix invalid shifts in decorrelate
...
Fixes: left shift of negative value -2
Fixes: 20303/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5096829297623040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3935c891e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
85b921c4dc
avcodec/xvididct: Fix integer overflow in MULT()
...
Fixes: signed integer overflow: 23170 * 95058 cannot be represented in type 'int'
Fixes: 20295/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5800212870463488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ccb576191 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
21be7407af
avcodec/ffwavesynth: Correct undefined overflow of PINK_UNIT
...
Fixes: signed integer overflow: 9223372036854775775 + 128 cannot be represented in type 'long'
Fixes: 20054/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5686385113825280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 187161d62f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
90a306ba97
avcodec/cbs_h264_syntax_template: fix off by 1 error with slice_group_change_cycle
...
Fixes: assertion failure
Fixes: 20390/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_REDUNDANT_PPS_fuzzer-5683400772157440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 741565a1e6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
c3b5c1423e
swscale/output: Fix integer overflow in yuv2rgb_write_full() with out of range input
...
Fixes: signed integer overflow: 1169365504 + 981452800 cannot be represented in type 'int'
Fixes: ticket8293
Found-by: Suhwan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e057e83a4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
824c773263
swscale/output: Fix integer overflow in alpha computation in yuv2gbrp16_full_X_c()
...
Fixes: signed integer overflow: 524280 * 4432 cannot be represented in type 'int'
Fixes: ticket8322
Found-by: Suhwan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 49ba1879ad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
John Rummell
83b2cc152d
libavformat/amr.c: Check return value from avio_read()
...
If the buffer doesn't contain enough bytes when reading a stream,
fail rather than continuing on with initialized data. Caught by
Chromium fuzzeras (crbug.com/1065731).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5b967f56b6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
John Rummell
8c73f80276
libavformat/mov.c: Free aes_decrypt to avoid leaking memory
...
Found by Chromium fuzzers (crbug.com/1057205).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ad91cf1f2f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
John Rummell
33bdb19d23
libavformat/oggdec.c: Check return value from avio_read()
...
If the buffer doesn't contain enough bytes when reading a stream,
fail rather than continuing on with unitialized data. Caught by
Chromium fuzzers (crbug.com/1054229).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b7c67b1ae3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
52dbafe7b6
avformat/asfdec_f: Fix overflow check in get_tag()
...
Fixes: signed integer overflow: 2 * 1210064928 cannot be represented in type 'int'
Fixes: 20873/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5761116909338624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8140fe732 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
69ff8871ff
avformat/nsvdec: Fix memleaks on errors while reading the header
...
Fixes: memleaks
Fixes: 21084/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5655975492321280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 96c0469455 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
cf64e8c5b1
avcodec/ffwavesynth: Fix integer overflow in computation of ddphi
...
Fixes: signed integer overflow: 1302123111085380114 - -8319005078741256972 cannot be represented in type 'long'
Fixes: 20991/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5148554161291264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c85bf16318 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
838105153a
avcodec/cbs_jpeg: Check length for SOS
...
Fixes: out of array access
Fixes: 19734/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5673507031875584
Fixes: 19353/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5703944462663680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1812352d76 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
614fc179d6
avcodec/adpcm: Fix invalid shift in AV_CODEC_ID_ADPCM_PSX
...
Fixes: left shift of negative value -1
Fixes: 20859/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_PSX_fuzzer-5720391507247104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a11ef68f0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
0eb38a9b84
avcodec/mpeg12dec: Fix invalid shift in mpeg2_fast_decode_block_intra()
...
Fixes: left shift of negative value -695
Fixes: 19232/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5702856963522560
Fixes: 19555/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5741218147598336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c40df2166c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Andreas Rheinhardt
fe7f3e3d27
avcodec/cbs_h2645: Treat slices without data as invalid
...
Slices that end after their header (meaning slices after the header
without any data before the rbsp_stop_one_bit or possibly without any
rbsp_stop_one_bit at all) are invalid and are now dropped. This ensures
that one doesn't run into two asserts in cbs_h2645_write_slice_data().
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Fixes: 19629/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_METADATA_fuzzer-5676822528524288
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 66fac1ff7c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Andreas Rheinhardt
b10b63f24a
avcodec/cbs_h2645: Remove dead code to delete trailing zeroes
...
Trailing zeroes are already discarded when splitting a fragment, which
makes the code to remove them when decomposing slices dead code.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8f701932b3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
5921562180
avcodec/cbs_av1_syntax_template: Set seen_frame_header only after successfull uncompressed_header()
...
Fixes: assertion failure
Fixes: 19301/clusterfuzz-testcase-minimized-ffmpeg_BSF_AV1_FRAME_MERGE_fuzzer-5743212006473728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a2e4879432 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
10e9e8b811
avcodec/mpegaudioenc_template: fix invalid shift of sample
...
Fixes: Ticket8010
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a2c97a8342 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:36 +02:00
Michael Niedermayer
a78fb50d1f
avcodec/motion_est_template: Fix invalid shifts in no_sub_motion_search()
...
Fixes: Ticket8167
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e13eee37ee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
1756a83aed
libavformat/avienc: Check bits per sample for PAL8
...
Fixes: assertion failure
Fixes: Ticket 8172
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3595878281 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
5946d0bafa
avformat/mpegts: Improve the position determination for avpriv_mpegts_parse_packet()
...
Fixes: assertion failure
Fixes: Ticket 8005
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e5bb48ae59 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
c80bb322a8
avcodec/magicyuv: Check that there are enough lines for interlacing to be possible
...
Fixes: out of array access
Fixes: 20763/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_fuzzer-5759562508664832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f8a0e9f9f7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
07ffedc01d
avformat/mvdec: Check stream numbers
...
Fixes: null pointer dereference
Fixes: 20768/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5638648978735104.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 618a9bea65 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
85705482f2
avcodec/pcm: Fix invalid shift in AV_CODEC_ID_PCM_LXF
...
Fixes: left shift of 233 by 24 places cannot be represented in type 'int'
Fixes: 20736/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PCM_LXF_fuzzer-4829212685107200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 051d11f659 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
f10514b5e6
avcodec/qdm2: Check fft_coefs_index
...
Fixes: out of array access
Fixes: 20660/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5658290216501248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9fc73bf022 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
f5180c3b9b
avformat/utils: Fix integer overflow with complex time bases in avformat_find_stream_info()
...
Fixes: signed integer overflow: 2045163756 * 2 cannot be represented in type 'int'
Fixes: Ticket5132
Found-by: tsmith
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f3d8f517db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
c7df41ed6b
avformat/avidec: Avoid integer overflow in NI switch check
...
Fixes: signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'long'
Fixes: Ticket8149
Found-by: Suhwan
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 347920ca21 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
26e55785dd
fftools/ffmpeg: Fix integer overflow in duration computation in seek_to_start()
...
Fixes: signed integer overflow: -9223372036854775808 - 9223372036854775807 cannot be represented in type 'long'
Fixes: Ticket8142
Found-by: Suhwan
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f4ad33d96 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
0a565190a7
avfilter/vf_aspect: Fix integer overflow in compute_dar()
...
Fixes: signed integer overflow: 1562273630 * 17 cannot be represented in type 'int'
Fixes: Ticket8323
Found-by: Suhwan
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c0ca0f244 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
3e88c32669
avcodec/apedec: Fix invalid shift with 24 bps
...
Fixes: left shift of negative value -463
Fixes: 20542/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5688714435231744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e27867229 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Dale Curtis
9a6d41e979
avformat/utils: Fix undefined behavior in ff_configure_buffers_for_index()
...
When e2_pts == INT64_MIN and e1_pts >= 0 the calculation of
e2_pts - e1_pts will overflow an int64_t.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f15007afa9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
3919ee03dd
avcodec/dpcm: Fix integer overflow in AV_CODEC_ID_GREMLIN_DPCM
...
Fixes: signed integer overflow: -2147479324 + -32568 cannot be represented in type 'int'
Fixes: 20103/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_GREMLIN_DPCM_fuzzer-5667667579240448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b1aecad9ea )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
1016074532
avcodec/wmalosslessdec: Fix integer overflow with sliding in padding bits
...
Fixes: signed integer overflow: -53716100 * 256 cannot be represented in type 'int'
Fixes: 20143/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5716604000403456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b8a0be9352 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
df317ec215
avcodec/wmalosslessdec: Fix loop in revert_acfilter()
...
Fixes: out of array read
Fixes: 20059/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5691776237305856
No testcase except the fuzzed one.
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5584c0bb94 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
6a4b26eaf6
avcodec/agm: YUV420 without DCT needs even dimensions
...
Fixes: out of array access
Fixes: 19892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5707525924323328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a98eeb0c1e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
e6567ca7dc
avcodec/agm: Test remaining data in decode_raw_intra_rgb()
...
Fixes: Timeout (270sec -> 25ms)
Fixes: 20485/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5636954207289344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c151e1491 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
10d70a65d1
avcodec/lagarith: Sanity check scale
...
A value of 24 and above can collaps the range to 0 which would not work.
Fixes: Timeout (75sec -> 21sec)
Fixes: 18707/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LAGARITH_fuzzer-5708950892969984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fb3855342b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
6c35049858
avcodec/apedec: Fix integer overflows in predictor_decode_mono_3950()
...
Fixes: signed integer overflow: -2147407150 + -1871606 cannot be represented in type 'int'
Fixes: 18702/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5679095417667584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eb64a5c6f9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
792d4dc128
avcodec/ralf: Fix integer overflow in apply_lpc()
...
Fixes: signed integer overflow: 2147482897 + 2048 cannot be represented in type 'int'
Fixes: 19240/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5743240326414336
Fixes: 19869/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5150136636538880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fd313d8cf8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
40d5c0c63b
avcodec/dca_lbr: Fix some error codes and error passing
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bfea054a75 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
0cfd3d6dd6
avcodec/wmavoice: Fix rounding and integer anomalies in calc_input_response()
...
Fixes: out of array access
Fixes: inf is outside the range of representable values of type 'int'
Fixes: signed integer overflow: -9223372036854775808 - 1 cannot be represented in type 'long'
Fixes: 19316/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5677369365102592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38d3758444 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
06df6bfdb4
avcodec/wmavoice: sanity check block_align
...
This limit is roughly based on the bitreader limit, its likely a much tighter limit
could be used
Fixes: left shift of 1965039647 by 1 places cannot be represented in type 'int'
Fixes: 19545/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5695391899320320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6847e22c8c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
38a05c9722
avcodec/pcm: Fix invalid shift in pcm_decode_frame for LXF
...
Fixes: left shift of 32 by 28 places cannot be represented in type 'int'
Fixes: 19472/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PCM_LXF_fuzzer-5704364320096256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 985d3666f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
b24779ffef
avcodec/snappy: Sanity check bytestream2_get_levarint()
...
Fixes: left shift of 79 by 28 places cannot be represented in type 'int'
Fixes: 20202/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5719004081815552
Fixes: 20219/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5641738677125120
Fixes: 20389/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5680721517871104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be54da2117 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
2517ab2fa3
avcodec/mlpdsp: Fix a invalid shift in ff_mlp_rematrix_channel()
...
Fixes: left shift of negative value -2
Fixes: 20305/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-5677196618498048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Jai Luthra <me@jailuthra.in >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fcc9f13717 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
ebbce3fa18
avcodec/avdct: Clear IDCTDSPContext context
...
Fixes use of uninitialized variable and segfault
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b82825eba8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
bbd445320a
avcodec/x86/diracdsp: Fix high bits on Windows x86_64
...
Found-by: james
(cherry picked from commit 24af459d1e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
bc92c163f0
tests/fate/lavf-video.mak: fix fate-lavf-gif dependencies
...
The gif test should depend on gif not fits
Regression since: ac4b5d8622
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 24a5e873b3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
913f64e923
avformat/mov: Check STCO location
...
Fixes: bypassing of checks and assertion failure
Fixes: asan_1003879.mp4
Found-by: Clusterfuzz + asan
Reported-by: Thomas Guilbert <tguilbert@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1cd4184020 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
0724e514dc
avcodec/wmalosslessdec: Fix multiple integer overflows
...
Fixes: left shift of 3329 by 20 places cannot be represented in type 'int'
Fixes: signed integer overflow: -199378355 + -1948950833 cannot be represented in type 'int'
Fixes: 19837/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5752565837070336
Fixes: 19839/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5767483265122304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 422202516c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
c19a204706
avcodec/apedec: Fix undefined integer overflow in decode_array_0000()
...
Fixes: signed integer overflow: -2143289344 - 6246400 cannot be represented in type 'int'
Fixes: 19239/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5173755680915456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a3655bb02c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
2df0ae557d
avcodec/smacker: Check space before decoding type
...
Fixes: Timeout (232sec -> 280ms)
Fixes: 19682/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKER_fuzzer-5654129649385472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6f5c18da59 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
7249a04d45
avcodec/rawdec: Use linesize in b64a
...
Fixes: out of array access
Fixes: 19750/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RAWVIDEO_fuzzer-5074834119983104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b5b9d5dac )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
09b2cb7181
avcodec/iff: Over-allocate ham_palbuf for HAM6 IFF-PBM
...
IFF-PBM-HAM6 can read out of array without this overallocation
Fixes: Out of array read
Fixes: 19752/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5675331403120640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8652f4e7a1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
ff668b1ff8
avcodec/x86/diracdsp: Fix incorrect src addressing in dequant_subband_32()
...
Fixes: Segfault (not reproducable with asm, which made this hard to debug)
Fixes: decoding errors
Fixes: 19854/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5729372837511168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0694b60b7b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
9f32da1fa9
avfilter/vf_find_rect: Remove assert
...
A score of 0 is possible
Fixes: Ticket8500
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dfc4714886 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
b6e9477449
avfilter/vf_find_rect: Increase worst case score
...
score could be 1.0 which lead to uninitialized values
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ff2474e02 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
9430ad3e21
swscale/input: Fix several invalid shifts related to rgb2yuv constants
...
Fixes: Invalid shifts
Fixes : #8140
Fixes : #8146
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d48e510124 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
ea7a818c95
swscale/output: Fix several invalid shifts in yuv2rgb_full_1_c_template()
...
Fixes: Invalid shifts
Fixes : #8320
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b7f97532b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
8a9c9711cf
swscale/swscale: Fix several invalid shifts related to vChrDrop
...
Fixes: Invalid shifts
Fixes : #8166
Fixes: filter-crop_scale_vflip FATE-test
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6ca22c118 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
0e517ef459
avcodec/hevc_mp4toannexb_bsf: check that nalu size doesnt overflow
...
Fixes: Out of array access
Fixes: 19299/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_MP4TOANNEXB_fuzzer-5169193398042624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8ceb2a72f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
8d89e97e26
avcodec/hevc_mp4toannexb_bsf: Avoid NULL memcpy()
...
Fixes: invalid memcpy use
Fixes: 19299/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_MP4TOANNEXB_fuzzer-5169193398042624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e23b5a706 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
1c2b1c0428
avcodec/cbs_av1: Check leb128 values read
...
"It is a requirement of bitstream conformance that the value returned from the leb128 parsing process is less than or equal
to (1 << 32) - 1."
Fixes: assertion failure
Fixes: 19293/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5749508361420800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a70d836364 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
cc7760b009
avcodec/wmalosslessdec: move channel check up
...
Fixes: out of array access
Fixes: 2nd part of 18429/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-6210814364614656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 891bcc4acc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
2ac4b4fde5
avcodec/cbs_h2645: Skip all 0 NAL units
...
Fixes: assertion failure
Fixes: 19286/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_REDUNDANT_PPS_fuzzer-5707990724509696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 285138ef14 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
a641bd4ad7
avcodec/adpcm: Fix overflow in FFABS() IMA_EA_EACS
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 19235/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_EA_EACS_fuzzer-5680878952382464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 794352ae9d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
7e0c15c3ec
avcodec/alac: Fix integer overflow in LPC coefficient adaption
...
Fixes: signed integer overflow: 267693597 * 10 cannot be represented in type 'int'
Fixes: 19237/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5755407700328448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6a865cec5e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
b46b2e52b8
avcodec/g729postfilter: Optimize out overflowing multiplication from apply_tilt_comp()
...
Fixes: signed integer overflow: -1114392282 * 2 cannot be represented in type 'int'
Fixes: 19236/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G729_fuzzer-5741678938030080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c0bd5fa43d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
26e88eb02f
avcodec/vc1dec: Check field_mode for sprites
...
Fixes: Out of array read
Fixes: 19263/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5389219325542400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 32fb919836 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
9b97acef22
avcodec/vc1dec: Limit bits by the actual bitstream size
...
Fixes: Timeout (350 ->19sec)
Fixes: 19249/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-6566896438870016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c56a52a82c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
ec8c556db8
avcodec/vmdaudio: Check block_align more
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 19788/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMDAUDIO_fuzzer-5743379690553344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 06f6857b54 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Gyan Doshi
dc33a53c2e
configure: bump year
...
(cherry picked from commit 7b58702cbd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Michael Niedermayer
f1d84ff4cb
avcodec/pgssubdec: Free subtitle on error
...
Fixes: Assertion failure
Fixes: 19753/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGSSUB_fuzzer-5688461843759104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b0a718923b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-05-19 17:17:35 +02:00
Zachariah Brown
393eff8917
avcodec/nvenc: use framerate if available
...
The h264_nvenc and hevc_nvenc encoders aren't respecting the framerate in the codec context.
Instead it was using the timebase which in our use-case was 1/1000 so the encoder was behaving
as if we wanted 1000fps. This resulted in poor encoding results due to an extremely low bitrate.
Both the amf and qsv encoders already contain similar logic to first check the framerate before
falling back to the timebase.
Signed-off-by: Zachariah Brown <zachariah@renewedvision.com >
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2020-05-15 00:52:14 +02:00
James Almer
31c523469a
avcodec/cbs_h265: fix writing extension_data bits
...
We only care about the right most bit.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 38d1815cc6 )
2020-05-03 18:49:01 -03:00
Timo Rothenpieler
a59b535af4
avcodec/nvenc: offset dts to account for b-frame reordering
...
Fixes ticket #7303
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2020-05-01 21:00:40 +02:00
Carl Eugen Hoyos
d1e8be3411
Revert "avformat/rtp: Pass sources and block filter addresses via sdp file for rtp"
...
This reverts commit b71685865f .
The commit lead to the use of an uninitialized variable.
Other issues were listed by Andreas Rheinhardt:
https://ffmpeg.org/pipermail/ffmpeg-devel/2020-March/259150.html
(cherry picked from commit 8b1f07ef51 )
In addition, it is not understandable why the patch that neither
claims to fix a regression nor a security issue was backported.
2020-04-05 11:59:49 +02:00
Andreas Rheinhardt
5b61639a21
avformat/matroskadec: Fix default value of BlockAddID
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit dbc50f8a93 )
2020-04-03 21:12:52 +02:00
Andreas Rheinhardt
3eedf1599b
avformat/dashdec: Don't allocate and leak strings that are never used
...
Since commit e134c203 strdups of several elements of a manifest are kept
in the DASHContext; but said commit completely forgot to free these
strings again (with xmlFree()). Given that these strings are never used
at all, this commit closes this leak by reverting said commit.
This reverts commit e134c20374 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 3c138e5ceb )
2020-03-30 08:03:58 +02:00
Andreas Rheinhardt
4772757958
avformat/matroskaenc: Write level 1 elements in one go
...
Up until now, writing level 1 elements proceeded as follows: First, the
element id was written to the ordinary output AVIOContext and a dynamic
buffer was opened for the content of the level 1 element in
start_ebml_master_crc32(). Then this buffer was actually used and after it
was closed (in end_ebml_master_crc32()), the size field corresponding to
the buffer's size was written, after which the actual data was written.
This commit changes this: Nothing is written to the main AVIOContext any
more in start_ebml_master_crc32(). end_ebml_master_crc32() now writes
both the id, the length field as well as the data. This is benefical for
streaming, because a client that receives just a Cluster ID and nothing
more might infer that this is EOF; in certain usecases there is also the
danger of a client receiving the Cluster without the actual Cluster ID
at the beginning.
Addresses #8578 .
(cherry picked from commit d9c21ec )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-03-30 07:56:38 +02:00
phunkyfish
635ca9aa01
avformat/rtp: Pass sources and block filter addresses via sdp file for rtp
...
Signed-off-by: Aman Gupta <aman@tmm1.net >
(cherry picked from commit b71685865f )
2020-03-27 11:00:50 -07:00
Paul B Mahol
19bfd72126
avformat/bintext: avoid division by zero
...
Fixes #8335
(cherry picked from commit 9d711a90fd )
Fixes ticket #8484 .
2020-01-19 13:47:21 +01:00
Michael Niedermayer
192d1d34eb
Update for FFmpeg 4.2.2
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 21:19:06 +01:00
Andreas Rheinhardt
14644e3322
cbs_mpeg2: Fix parsing the last unit
...
There is one way to find out if avpriv_find_start_code has found a start
code or not: One has to check whether the state variable contains a
start code, i.e. whether the three most significant bytes are 0x00 00 01.
Checking for whether the return value is the end of the designated
buffer is not enough: If the last four bytes constitute a start code,
the return value is also the end of the buffer. This happens with
sequence_end_codes which have been ignored for exactly this reason,
although e.g. all three files used for fate tests of cbs_mpeg2 contain
sequence_end_codes.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit fd93d5efe6 )
2019-12-31 16:57:37 -03:00
Andreas Rheinhardt
c1fb94fcac
cbs_mpeg2: Rearrange start code search
...
1. Currently, cbs_mpeg2_split_fragment uses essentially three variables
to hold the start code values found by avpriv_find_start_code. By
rearranging the code, one of them can be omitted.
2. The return value of avpriv_find_start_code points to the byte after
the byte containing the start code identifier (or to the byte after the
last byte of the fragment's data if no start code was found), but
cbs_mpeg2_split_fragment needs to work with the pointer to the byte
containing the start code identifier; it already did this, but in a
clumsy way. This has been changed.
3. Also use the correct type for the variable holding the
CodedBitstreamUnitType.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 276b21a586 )
2019-12-31 16:57:37 -03:00
Andreas Rheinhardt
2852aa5084
cbs_mpeg2: Decompose Sequence End
...
Sequence End units (or actually, sequence_end_codes) have up until now
not been decomposed; in fact due to a bug in cbs_mpeg2_split_fragment they
have mostly been treated as part of the preceding unit. So implement
decomposing them as preparation for fixing said bug.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 0e66e1b61e )
2019-12-31 16:57:37 -03:00
Andreas Rheinhardt
9db961861a
cbs_mpeg2: Fix parsing of picture and slice headers
...
1. The extra information in slice headers was parsed incorrectly:
In the first reading pass to derive the length of the extra information,
one should look at bits n, n + 9, n + 18, ... and check whether they
equal one (further extra information) or zero (end of extra information),
but instead bits n, n + 8, n + 16, ... were inspected. The second pass
of reading (where the length is already known and the bytes between the
length-determining bits are copied into a buffer) did not record what
was in bits n, n + 9, n + 18, ..., presuming they equal one. And during
writing, the bytes in the buffer are interleaved with set bits and
written. This means that if the detected length of the extra information
was greater than the real length, the output was corrupted. Fortunately
no sample is known that made use of this mechanism: The extra information
in slices is still marked as reserved in the specifications. cbs_mpeg2
is now ready in case this changes.
2. Furthermore, the buffer is now padded and slightly different, but
very similar code for reading resp. writing has been replaced by code
used for both. This was made possible by a new macro, the equivalent
to cbs_h2645's fixed().
3. These changes also made it possible to remove the extra_bit_slice
element from the MPEG2RawSliceHeader structure. Said element was always
zero except when the detected length of the extra information was less
than the real length.
4. The extra information in picture headers (which uses essentially the
same syntax as the extra information in slice headers) has simply been
forgotten. This meant that if this extra information was present, it was
discarded during reading; and unfortunately writing created invalid
bitstreams in this case (an extra_bit_picture - the last set bit of the
whole unit - indicated that there would be a further byte of data,
although the output didn't contain said data).
This has been fixed; both types of extra information are now parsed via
the same code and essentially passed through.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit d9182f04ca )
2019-12-31 16:57:37 -03:00
Andreas Rheinhardt
fd53f6745e
cbs: Remove useless initializations
...
Up until now, a temporary variable was used and initialized every time a
value was read in CBS; if reading turned out to be successfull, this
value was overwritten (without having ever been looked at) with the
value read if reading was successfull; on failure the variable wasn't
touched either. Therefore these initializations can be and have been
removed.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit b71a0367a6 )
2019-12-31 16:57:37 -03:00
Andreas Rheinhardt
4bc84f4f7d
mpeg2_metadata, cbs_mpeg2: Fix handling of colour_description
...
If a sequence display extension is read with colour_description equal to
zero, but a user wants to add one or more of the colour_description
elements, then the colour_description elements the user did not explicitly
request to be set are set to zero and not to the value equal to
unknown/unspecified (namely 2). A value of zero is not only inappropriate,
but explicitly forbidden. This is fixed by inferring the right default
values during the reading process if the elements are absent; moreover,
changing any of the colour_description elements to zero is now no longer
possible.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit c2a91645c5 )
2019-12-31 16:57:37 -03:00
Andriy Gelman
662accb728
lavc/cbs_h2645_syntax_template: Fix memleak
...
payload_count is used to track the number of SEI payloads. It is also
used to free the SEIs in cbs_h264_free_sei()/cbs_h265_free_sei().
Currently, payload_count is set after for loop is completed. Hence if
there is an error and the function exits, the payload remains zero
causing a memleak.
This commit keeps track of payload_count inside the for loop to fix the
issue. Note that that the contents of current are initialized with
av_mallocz() so there is no need to zero initialize payload_count.
Found-by: libFuzzer
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com >
(cherry picked from commit c07a772473 )
2019-12-31 16:57:37 -03:00
Andreas Rheinhardt
4667920455
avcodec/cbs: Fix potential overflow
...
The number of bits in a PutBitContext must fit into an int, yet nothing
guaranteed the size argument cbs_write_unit_data() uses in init_put_bits()
to be in the range 0..INT_MAX / 8. This has been changed.
Furthermore, the check 8 * data_size > data_bit_start that there is
data beyond the initial padding when writing mpeg2 or H.264/5 slices
could also overflow, so divide it by 8 to get an equivalent check
without this problem.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit cda3e8ca04 )
2019-12-31 16:57:37 -03:00
Andreas Rheinhardt
1cf238d3bf
avcodec/cbs: Factor out common code for writing units
...
All cbs-functions to write units share a common pattern:
1. They check whether they have a write buffer (that is used to store
the unit's data until the needed size becomes known after writing the
unit when a dedicated buffer will be allocated).
2. They use this buffer for a PutBitContext.
3. The (codec-specific) writing takes place through the PutBitContext.
4. The return value is checked. AVERROR(ENOSPC) here always indicates
that the buffer was too small and leads to a reallocation of said
buffer.
5. The final buffer will be allocated and the data copied.
This commit factors this common code out in a single function in cbs.c.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 7c92eaace2 )
2019-12-31 16:57:37 -03:00
Michael Niedermayer
cb3a59ca82
avcodec/ffwavesynth: Fix undefined overflow in wavesynth_synth_sample()
...
Fixes: signed integer overflow: 2147464192 + 21176 cannot be represented in type 'int'
Fixes: 19042/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5719828090585088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fa47f6412d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
25b5331a1d
avcodec/cook: Use 3 stage VLC decoding for channel_coupling
...
Fixes: shift exponent -1 is negative
Fixes: out of array read
Fixes: 19028/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5759766471376896
Fixes: 19037/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5734106625474560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 89fd76db71 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
525a8ee3d8
avcodec/wmalosslessdec: Fixes undefined overflow in dequantization in decode_subframe()
...
Fixes: signed integer overflow: 47875596 * 45 cannot be represented in type 'int'
Fixes: 19082/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5687766512041984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53efab44a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
9bea771035
avcodec/sonic: Check e in get_symbol()
...
Fixes: signed integer overflow: 1721520852 + 1721520852 cannot be represented in type 'int'
Fixes: 18346/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5709623893426176
Fixes: 18753/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5663299131932672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aea6755611 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
4abd0e1282
avcodec/twinvqdec: Correct overflow in block align check
...
Fixes: signed integer overflow: 538976288 * 8 cannot be represented in type 'int'
Fixes: 19126/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TWINVQ_fuzzer-5687464110325760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4dc93ae3d7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
fd674648a2
avcodec/vc1dec: Fix "return -1" cases
...
Reviewed-by: "mypopy@gmail.com " <mypopy@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 26f040bcb4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
31e169948d
avcodec/vc1dec: Free sprite_output_frame on error
...
Fixes: memleaks
Fixes: 19471/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5688035714269184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ee9240be3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
cb1111b04a
avcodec/atrac9dec: Clamp band_ext_data to max that can be read if skipped.
...
Fixes: out of array read
Fixes: 19327/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5679823087468544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 18ff210efb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
067b2c0c28
avcodec/agm: Include block size in the MV check for flags == 3
...
Fixes: out of array read
Fixes: 19331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5644115983466496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f20969457 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
8681622d7b
avcodec/wmadec: Keep track of exponent initialization per channel
...
Fixes: division by 0
Fixes: 19123/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5655493121146880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf5c850b79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
3679bda78b
avcodec/iff: Check that video_size is large enough for the read parameters
...
video is allocated before parameters like bpp are read.
Fixes: out of array access
Fixes: 19084/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5718556033679360
Fixes: 19465/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5759908398235648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f1b97f62f8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
affedbd027
avcodec/cbs_vp9: Check data_size
...
Fixes: out of array access
Fixes: 19542/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5659498341728256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4fa2d5a692 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
d7fbabaeb5
avcodec/cbs_vp9: Check index_size
...
Fixes: out of array read
Fixes: 19300/clusterfuzz-testcase-minimized-ffmpeg_BSF_VP9_METADATA_fuzzer-5653911730126848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d6553e2e60 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
9511cfe07f
avcodec/adpcm: Clip predictor for APC
...
Fixes: signed integer overflow: -2147483648 - 13 cannot be represented in type 'int'
Fixes: 18893/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_APC_fuzzer-5630760442920960
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9fe07908c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
5f14ba4776
avcodec/targa: Check colors vs. available space
...
Fixes: Timeout (37sec -> 52ms)
Fixes: 18892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TARGA_fuzzer-5739537854889984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 01593278ce )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
bc17113954
avcodec/dstdec: Use get_ur_golomb_jpegls()
...
Fixes: shift exponent -4 is negative
Fixes: 17793/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5766088435957760
Fixes: 18989/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5175008116867072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a76690c02b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
ddb35d510e
avcodec/wmavoice: Check remaining input in parse_packet_header()
...
Fixes: Infinite loop
Fixes: 18914/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5731902946541568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 19c41969b2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
846c61789c
avcodec/wmalosslessdec: Fix 2 overflows in mclms
...
Fixes: signed integer overflow: 2038337026 + 109343477 cannot be represented in type 'int'
Fixes: 18886/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5673660505653248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 92455c8c65 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
01f5442b82
avcodec/wmaprodec: Fixes integer overflow with 32bit samples
...
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 18860/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAPRO_fuzzer-5755223125786624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a9cc69c0d5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
090d10ce60
avcodec/adpcm: Fix invalid shift in xa_decode()
...
Fixes: left shift of negative value -1
Fixes: 18859/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_XA_fuzzer-5748474213040128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 50db30b47d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
7a1b6aa6ac
avcodec/wmalosslessdec: Fix several integer issues
...
Fixes: shift exponent -1 is negative (and others)
Fixes: 18852/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5660855295541248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec3fe67074 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
19691eb4d5
avcodec/wmalosslessdec: Check that padding bits is not more than sample bits
...
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 18817/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5713317180211200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d42826580 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
ef722f7692
avcodec/iff: Skip overflowing runs in decode_delta_d()
...
Fixes: Timeout (107sec - 75ms>
Fixes: 18812/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-6295585225441280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 185f441ba2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
3c0fcc7779
avcodec/pnm: Check that the header is not truncated
...
Fixes: Ticket8430
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c94cb8d9b2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
60605ffa5c
avcodec/mp3_header_decompress_bsf: Check sample_rate_index
...
Fixes: out of array read
Fixes: 19309/clusterfuzz-testcase-minimized-ffmpeg_BSF_MP3_HEADER_DECOMPRESS_fuzzer-5651002950942720
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f064c7c449 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
075b337798
avcodec/cbs_av1_syntax_template: Check num_y_points
...
"It is a requirement of bitstream conformance that num_y_points is less than or equal to 14."
Fixes: index 24 out of bounds for type 'uint8_t [24]'
Fixes: 19282/clusterfuzz-testcase-minimized-ffmpeg_BSF_AV1_FRAME_MERGE_fuzzer-5747424845103104
Note, also needs a23dd33606
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: jamrial
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bbe27890ff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
747245ce0e
avformat/rmdec: Initialize and sanity check offset in ivr_read_header()
...
Fixes: signed integer overflow: -9223372036854775808 - 17 cannot be represented in type 'long'
Fixes: 18768/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5674385247830016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7e665e4a81 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
1f88bbc9f2
avcodec/agm: Do not allow MVs out of the picture area as no edge is allocated
...
Fixes: out of array access
Fixes: 18499/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5749038406434816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7a1b30c871 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
d6cc432751
avcodec/apedec: Fix 2 integer overflows
...
Fixes: signed integer overflow: 2119056926 - -134217728 cannot be represented in type 'int'
Fixes: 18728/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5747539563511808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6e15ba2d1f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Andreas Rheinhardt
d39a058707
avformat/id3v2: Fix double-free on error
...
ff_id3v2_parse_priv_dict() uses av_dict_set() with the flags
AV_DICT_DONT_STRDUP_KEY and AV_DICT_DONT_STRDUP_VAL. In this case both
key and value are freed on error (and owned by the destination
dictionary on success), so that freeing them again on error is a
double-free and therefore forbidden. But it nevertheless happened.
Fixes CID 1452489 and 1452421.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 67d4940a77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
96e1ca6e05
avcodec/wmaprodec: Set packet_loss when we error out on a sanity check
...
Fixes: left shift of negative value -34
Fixes: 18719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAPRO_fuzzer-5642658173419520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a9cbd25d89 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
50ed50a03b
avcodec/wmaprodec: Check offset
...
Fixes: index 33280 out of bounds for type 'float [32768]'
Fixes: 18718/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA2_fuzzer-5635373899710464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5473c7825e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
6bb2004c82
avcodec/truemotion2: Fix 2 integer overflows in tm2_low_res_block()
...
Fixes: signed integer overflow: 1778647621 + 574372924 cannot be represented in type 'int'
Fixes: 18692/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-6248679635943424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93d52a181e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
7bf4d235c0
avcodec/wmaprodec: Check if the channel sum of all internal contexts match the external
...
Fixes: NULL pointer dereference
Fixes: 18689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA1_fuzzer-5715114640015360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 090ac57997 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
3bd30882b1
avcodec/atrac9dec: Check q_unit_cnt more completely before using it to access at9_tab_band_ext_group
...
Fixes: index 8 out of bounds for type 'const uint8_t [8][3]'
Fixes: 19127/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5709394985091072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e1d836d237 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
573cfcc52b
avcodec/fitsdec: Use lrint()
...
Fixes: fate-fitsdec-bitpix-64
Possibly Fixes: -nan is outside the range of representable values of type 'unsigned short'
Possibly Fixes: 17769/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5678314672357376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 37f31f4e50 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
fe04b47cea
avcodec/g729dec: Avoid using buf_size
...
buf_size is not updated as buf is advanced so it is wrong after the first
iteration
Fixes: Timeout (160sec -> 27sec)
Fixes: 18658/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G729_fuzzer-5729784269373440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 336f9461df )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:57 +01:00
Michael Niedermayer
3292f6c6be
avcodec/g729dec: Factor block_size out
...
This will be used in the next commit
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 576746b4e3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
c98cecea59
avcodec/g729dec: require buf_size to be non 0
...
The 0 case was added with the support for multiple packets. It
appears unintended and causes extra complexity and out of array
accesses (though within padding)
No testcase
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f64be9da4c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
d808a43e29
avcodec/alac: Fix integer overflow in lpc_prediction() with sign
...
Fixes: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
Fixes: 18643/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5672182449700864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7686ba1f14 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
079db0014b
avcodec/wmaprodec: Fix buflen computation in save_bits()
...
Fixes: Assertion failure
Fixes: 18630/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAPRO_fuzzer-5201588654440448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 589cb44498 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
7ee5d5bf66
avcodec/vc1_block: Fix integer overflow in AC rescaling in vc1_decode_i_block_adv()
...
Fixes: signed integer overflow: 50176 * 262144 cannot be represented in type 'int'
Fixes: 18629/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5182370286403584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e010e489b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
e0f9f52938
avcodec/vmdaudio: Check chunk counts to avoid integer overflow
...
Fixes: signed integer overflow: 4 * 538976288 cannot be represented in type 'int'
Fixes: 18622/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMDAUDIO_fuzzer-5092166174507008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47d963335e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
3266d05538
avformat/mxfdec: Clear metadata_sets_count in mxf_read_close()
...
This avoids problems if the function is called twice
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 13816a1d08 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
b02b306f73
avcodec/nuv: Use ff_set_dimensions()
...
Fixes: OOM
Fixes: 18956/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-5766505644163072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1ca978d636 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
5f8e1a014f
avformat/vividas: Error out on audio packets in the absence of audio streams
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d83002179f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
f21ef41c14
avformat/vividas: Check and require 1 video stream
...
The decoder hardcodes that audio is stream_id = 1 so it does not
currently work with more or less than 1 video stream at st=0
Fixes: assertion failure
Fixes: 18602/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6259277199310848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3e5a528bbe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
31240bb703
avcodec/ffwavesynth: Fix integer overflow with pink_ts_cur/next
...
Fixes: signed integer overflow: 6175076100092079360 - -5034989061050195840 cannot be represented in type 'long'
Fixes: 18614/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5704508847423488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d82ab96e76 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
8c1c43c6c1
avcodec/ralf: Fix integer overflows with the filter coefficient in decode_channel()
...
Fixes: signed integer overflow: 1145975808 - -1146173210 cannot be represented in type 'int'
Fixes: 18616/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5121296757424128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 721624c2f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
10fb811c0d
avcodec/g729dec: Use 64bit and clip in scalar product
...
The G729 reference decoder clips after each individual operation and keeps track if overflow
occurred (in the fixed point implementation), this here is
simpler and faster but not 1:1 the same what the reference does.
Non fuzzed samples which trigger any such overflow are welcome, so
the need and impact of different clipping solutions can be evaluated.
Fixes: signed integer overflow: 1271483721 + 1073676289 cannot be represented in type 'int'
Fixes: 18617/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5137705679978496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf9c4a1275 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
1aeef9979d
avcodec/mxpegdec: Check for multiple SOF
...
Fixes: Timeout (14sec -> 9ms)
Fixes: 18598/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-5726095261564928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 75b64e5aa3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
4cd8ae5b9c
avcodec/nuv: Move comptype check up
...
Fixes: Timeout (23sec -> 5ms)
Fixes: 18517/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-5753135536013312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1138cdecbe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
0ae9a8cdbb
avcodec/wmavoice: Fix integer overflow in synth_frame()
...
Fixes: left shift of negative value -3
Fixes: 18518/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-6560514359951360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf323f4d38 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
b56388541b
avcodec/rawdec: Check bits_per_coded_sample more pedantically for 16bit cases
...
Fixes: shift exponent -14 is negative
Fixes: 18335/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RAWVIDEO_fuzzer-5723267192586240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5634e20525 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
f0bd54aaa7
avutil/lfg: Correct index increment type to avoid undefined behavior
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 18333/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COMFORTNOISE_fuzzer-5668481831272448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6014bcf1b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
3a6ef19263
avcodec/cngdec: Remove AV_CODEC_CAP_DELAY
...
As is the decoder will never stop, it will cause an infinite loop. The RFC seems only
to speak of non empty packets so endlessly generating noise from the last empty flush
packets seems wrong.
Fixes: infinite loop
Fixes: 18333/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COMFORTNOISE_fuzzer-5668481831272448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 327a968817 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
afd3574959
avcodec/iff: Move index use after check in decodeplane8()
...
Fixes: index 9 out of bounds for type 'const uint64_t [8][256]'
Fixes: 18409/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5767030560522240
Fixes: 18720/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5651995784642560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1f8b36cc4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
f75b377857
avcodec/atrac3: Check for huge block aligns
...
The largest documented frame size = block align is 1024 bytes
(https://wiki.multimedia.cx/index.php/ATRAC3 )
Without a limit this can allocate arbitrary memory and trigger OOM
Fixes: OOM
Fixes: 18337/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3_fuzzer-5763861478637568
Fixes: 18556/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3AL_fuzzer-5646183334936576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f09151fff9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
96ccd5665c
avcodec/ralf: use multiply instead of shift to avoid undefined behavior in decode_block()
...
Fixes: left shift of negative value -249
Fixes: 18566/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5649394561187840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b7d02642b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
9eecca08e7
avcodec/wmadec: Require previous exponents for reuse
...
Fixes: division by zero
Fixes: 18474/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5764986962182144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c54b9fc42f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
074d7c2f8d
avcodec/vc1_block: Fix undefined behavior in ac prediction rescaling
...
The intermediates are required to fit in 12bit (8.1.3.9 Coefficient Scaling)
See SMPTE 421M-2006 and Amendment 1-2007
Fixes: signed integer overflow: -20691 * 262144 cannot be represented in type 'int'
Fixes: 18479/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5128912371187712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7fc1baf0ca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
3c53cdb1ad
avcodec/qdm2: The smallest header seems to have 2 bytes so treat 1 as invalid
...
Fixes: Timeout (217sec -> 2ms)
Fixes: 18488/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5708293662310400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e36ccb5048 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
1c531e7d76
avcodec/apedec: Fixes integer overflow of res+*data in do_apply_filter()
...
Fixes: signed integer overflow: 7400 + 2147482786 cannot be represented in type 'int'
Fixes: 18405/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5708834760294400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dc3f327e74 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
d79972badd
avcodec/sonic: Fix integer overflow in predictor_calc_error()
...
Fixes: signed integer overflow: 5 * -1094995529 cannot be represented in type 'int'
Fixes: 18346/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5709623893426176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8c17b8cef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
b0c18a836a
avformat/vividas: Add EOF check in val_1 loop in track_header()
...
Fixes: Timeout (148sec -> 0.1sec)
Fixes: 18427/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5682124627116032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit faea5b4462 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
e57cb9429a
avcodec/atrac9dec: Check precision_fine/coarse
...
Clipping is done as it was preferred in review
See: [FFmpeg-devel] [PATCH 1/5] avcodec/atrac9dec: Check precision_fine/coarse
Fixes: out of array access
Fixes: 18330/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5641113058148352
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 19b8db2908 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
3a91eb37c4
avformat/mp3dec: Check that the frame fits within the probe buffer
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e9a335150a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
1c24ab39b6
vcodec/agm: Alloc based on coded dimensions
...
Fixes: out of array read
Fixes: 18715/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5659333417500672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bfa8272f40 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
922837561b
avcodec/wmaprodec: get frame during frame decode
...
Fixes: memleak
Fixes: 17615/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA2_fuzzer-5681306024804352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0f89a2293e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
f3c4718f1b
avcodec/interplayacm: Fix overflow of last unused value
...
Fixes: signed integer overflow: -2147450880 - 65535 cannot be represented in type 'int'
Fixes: 18393/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5667520110919680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 10eabb8e40 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
88d97044cb
avcodec/adpcm: Fix undefined behavior with negative predictions in IMA OKI
...
Fixes: left shift of negative value -30
Fixes: 18392/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_OKI_fuzzer-5631771831435264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7786f6c30e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
9cf2764389
avcodec/cook: Move up and extend block_align check
...
Fixes: signed integer overflow: 2046820356 * 8 cannot be represented in type 'int'
Fixes: 18391/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5631674666188800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1c63edcdd2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
62dae886b6
avcodec/sbcdec: Fix integer overflows in sbc_synthesize_four()
...
Fixes: signed integer overflow: 1494495519 + 1494495519 cannot be represented in type 'int'
Fixes: 18347/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SBC_fuzzer-5711714661695488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 00e469fb61 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
651e9773ed
avcodec/twinvq: Check block_align
...
Fixes: signed integer overflow: 538976288 * 8 cannot be represented in type 'int'
Fixes: 18348/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_METASOUND_fuzzer-6681325716635648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 97f778e9c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
61fd1484c4
avcodec/cook: Enlarge gain table
...
Fixes: index 25 out of bounds for type 'float [23]'
Fixes: 18355/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5641398941908992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 50001cd440 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
0c6d17ae87
avcodec/cook: Check samples_per_channel earlier
...
Fixes: division by zero
Fixes: 18362/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5653727679086592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 57750bb629 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
c599f7ed76
avcodec/atrac3plus: Check split point in fill mode 3
...
Fixes: index 32 out of bounds for type 'int [32]'
Fixes: 18350/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3P_fuzzer-5643794862571520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit de5102fd92 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
556bb822a0
avcodec/wmavoice: Check sample_rate
...
Fixes: left shift of 538976288 by 8 places cannot be represented in type 'int'
Fixes: 18376/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5741645391200256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 55c97a7637 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
d32058276c
avcodec/xsubdec: fix overflow in alpha handling
...
Fixes: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 18368/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XSUB_fuzzer-5702665442426880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9ea9973959 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
571c66659d
avcodec/iff: Check available space before entering loop in decode_long_vertical_delta2() / decode_long_vertical_delta()
...
Fixes: Timeout (31sec -> 41ms)
Fixes: 18380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5645210121404416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 32b3c8ce7d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
3613a0df40
avcodec/apedec: Fix integer overflow in filter_3800()
...
Fixes: signed integer overflow: 2117181180 + 60483298 cannot be represented in type 'int'
Fixes: 18344/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5685327791915008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1c038c5c63 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
58226980a6
avutil/lfg: Document the AVLFG struct
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d6fea2ef22 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
b8425d0e26
avcodec/ffv1dec: Use a different error message for the slice level CRC
...
This way they can be told apart easily
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df498cf544 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
72c9dab15d
avcodec/apedec: Fix undefined integer overflow in long_filter_ehigh_3830()
...
Fixes: signed integer overflow: -1094995529 * 2 cannot be represented in type 'int'
Fixes: 18281/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5692589180715008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1d1719a44d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
f9738b2af3
avcodec/dstdec: Check that AC probabilities are within range
...
ISO/IEC 14496-3:2005(E): "Each entry of P_one[ ][ ] is in the range of 1 to
128, corresponding to a probability of 1/256 to 128/256 of the next error bit (bit E, See Figure 10.5)..."
Fixes: Timeout (42sec ->1sec)
Fixes: 18181/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5736646250594304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c3e1b395b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
a06c0fadc8
avcodec/dstdec: Check read_table() for failure
...
Fixes: Timeout (too long -> 42sec)
Fixes: 18181/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5736646250594304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 03ea8d8cd4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
c609312a47
avformat/vividas: Fix n_sb_blocks Check
...
Fixes: signed integer overflow: 1540265776 * 2 cannot be represented in type 'int'
Fixes: 18160/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5758808818712576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 114ddf6430 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
1c1b94aaae
avcodec/snowenc: Set mb_num to avoid ratecontrol floating point divisions by 0.0
...
Fixes: Ticket7990
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 55279d699f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
f348a0bc3c
avcodec/snowenc: Fix 2 undefined shifts
...
Fixes: Ticket7990
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8802e329c8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
e634dc98b2
avformat/nutenc: Do not pass NULL to memcmp() in get_needed_flags()
...
This compared to the other suggestions is cleaner and easier to understand
keeping the condition in the if() simple.
This affects alot of fate tests.
See: [FFmpeg-devel] [PATCH 05/11] avformat/nutenc: Don't pass NULL to memcmp
See: [FFmpeg-devel] [PATCH]lavf/nutenc: Do not call memcmp() with NULL argument
Fixes: Ticket 7980
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e4fdeb3fce )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
59a2b67c79
avcodec/aptx: Check the number of channels
...
Fixes: store to null pointer of type 'uint32_t' (aka 'unsigned int')
Fixes: 18021/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APTX_HD_fuzzer-5761738313564160
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 98a257c323 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
5cf9d6c586
avcodec/aacdec_template: Check samplerate
...
Fixes: signed integer overflow: 2 * 1881153568 cannot be represented in type 'int'
Fixes: 17996/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5687126468853760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7730bacb41 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
63162b9f97
avcodec/truemotion2: Fix several integer overflows in tm2_low_res_block()
...
Fixes: signed integer overflow: 1077952576 + 1355863565 cannot be represented in type 'int'
Fixes: 16196/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5679842317565952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b655f55ea )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
267ee47529
avcodec/utils: Check block_align
...
Fixes: out of array access
Fixes: 18432/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5675574936207360
Fixes: 18326/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5071752362721280
Fixes: 18384/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV1_fuzzer-5769439500304384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f011572e66 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
f3a90da0b5
avcodec/wmalosslessdec: Fix some integer anomalies
...
Fixes: left shift of negative value -341180
Fixes: 18401/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5686380134400000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d3dee676b8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
b55ec3f327
avcodec/adpcm: Fix invalid shifts in ADPCM DTK
...
Fixes: left shift of negative value -1
Fixes: 18397/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_DTK_fuzzer-5675653487132672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 34e701ff93 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
6be30c4f8e
avcodec/apedec: Only clear the needed buffer space, instead of all
...
Fixes: Timeout (15sec -> 0.4sec)
Fixes: 18396/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5730080487112704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f17ea02001 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
8f71cd980c
avcodec/libvorbisdec: Fix insufficient input checks leading to out of array reads
...
Fixes: 16144/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVORBIS_fuzzer-5638618940440576
Fixes: out of array read
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 069be4aa5d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
99243eea7b
avcodec/g723_1dec: fix invalid shift with negative sid_gain
...
Fixes: left shift of negative value -1
Fixes: 18395/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G723_1_fuzzer-5710313034350592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1850c3feaa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
87e8bfeb90
avcodec/vp5: Check render_x/y
...
Fixes: Timeout (15sec -> 91ms)
Fixes: 18353/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP5_fuzzer-5704150326706176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 698e042c77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
28ddc0b9b8
avcodec/hcom: Check the root entry and the right entries
...
Fixes: Segfault
Fixes: 17991/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCOM_fuzzer-5647235349479424
Also fixes related memleak
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4834ec926a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
f66e52fd96
avcodec/qdrw: Check input for header/skiped space before get_buffer()
...
Fixes: Timeout (21sec -> 0.8sec)
Fixes: 17990/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDRAW_fuzzer-5200374436200448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b63fbc19c0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
3a9432ec64
avcodec/ralf: Skip initializing unused filter variables
...
Fixes: left shift of negative value -1
Fixes: 17890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5643307467669504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f4ecf6c39d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
4006aecd19
avcodec/takdec: Fix overflow with large sample rates
...
Fixes: signed integer overflow: 2147483647 + 511 cannot be represented in type 'int'
Fixes: 17899/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5719753322135552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 42eb78059d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
2eddfd7cfd
avcodec/atrac9dec: Set channels
...
Fixes: null pointer dereference
Fixes: 18341/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5681203490848768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e85eb7cb04 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
59479f474f
avcodec/alsdec: Check that input space for header exists in read_diff_float_data()
...
Fixes: Timeout (21sec -> 8sec)
Fixes: 17832/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5737092172218368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 09581f7923 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
f2457bd115
avformat/pjsdec: Check duration for overflow
...
Fixes: signed integer overflow: -3 - 9223372036854775807 cannot be represented in type 'long'
Fixes: 17828/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5645915116797952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1efaac6932 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
a93c1d1e83
avcodec/agm: Check for reference frame earlier
...
Fixes: Timeout (14sec - 120ms)
Fixes: 17824/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5639825457152000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 315a445933 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
d3d4ba2dbe
avcodec/ptx: Check that the input contains at least one line
...
Fixes: Timeout (19sec -> 44ms)
Fixes: 17816/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PTX_fuzzer-5704459950227456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6ad328256 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
f75c931238
avcodec/alac: Fix integer overflow in LPC
...
Fixes: signed integer overflow: 2147483628 + 128 cannot be represented in type 'int'
Fixes: 17783/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5146470595952640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 44b73a0568 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
a3e5542744
avcodec/smacker: Fix integer overflows in pred[] in smka_decode_frame()
...
Fixes: signed integer overflow: -2147481503 + -32732 cannot be represented in type 'int'
Fixes: 17782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKAUD_fuzzer-5769672225456128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a76897e19c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
7755265387
avcodec/aliaspixdec: Check input size against minimal picture size
...
Fixes: Timeout (15sec -> 72ms)
Fixes: 17774/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALIAS_PIX_fuzzer-5193929107963904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c69310477 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
6496bfcc65
avcodec/ffwavesynth: Fix integer overflows in pink noise addition
...
Fixes: signed integer overflow: -1795675744 + -1926578528 cannot be represented in type 'int'
Fixes: 17741/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5131336402075648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7916b6863c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
36ba4471d4
avcodec/vc1_block: Fixes integer overflow in vc1_decode_i_block_adv()
...
Fixes: signed integer overflow: 62220 * 262144 cannot be represented in type 'int'
Fixes: 17145/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5667394743173120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6fdeb20817 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
64c2abf53f
avcodec/wmalosslessdec: Check block_align
...
Fixes: NULL pointer dereference
Fixes: 18331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5652847445671936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1c799271e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
81672bf00f
avcodec/g729dec: Avoid computing invalid temporary pointers for ff_acelp_weighted_vector_sum()
...
Fixes: Ticket8176
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c78a76cb0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
b97aaf791f
avcodec/g729postfilter: Fix left shift of negative value
...
Fixes: Ticket8176
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f0acc5064 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
b786eed33a
avcodec/binkaudio: Check sample rate
...
Fixes: signed integer overflow: 1092624416 * 2 cannot be represented in type 'int'
Fixes: 18045/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINKAUDIO_RDFT_fuzzer-5718519492116480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2fca09bce4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
21d514a67a
avcodec/sbcdec: Fix integer overflows in sbc_synthesize_eight()
...
Fixes: signed integer overflow: 518484152 + 1868182638 cannot be represented in type 'int'
Fixes: 17732/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SBC_fuzzer-5663738132168704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c70d547751 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
f20ca5d729
avcodec/adpcm: Check initial predictor for ADPCM_IMA_EA_EACS
...
Fixes: signed integer overflow: -2147483360 - 631 cannot be represented in type 'int'
Fixes: 17701/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_EA_EACS_fuzzer-5711517319692288
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f66e8436d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
e34028dd81
avcodec/g723_1dec: Fix overflow in shift
...
Fixes: shift exponent 1008 is too large for 32-bit type 'int'
Fixes: 17700/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G723_1_fuzzer-5707633436131328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 07732f12a4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
3a46c84945
avcodec/apedec: Fix integer overflow in predictor_update_3930()
...
Fixes: signed integer overflow: -69555262 * 31 cannot be represented in type 'int'
Fixes: 17698/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5728970447781888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c072c9ed7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
f725378bff
avcodec/g729postfilter: Fix undefined intermediate pointers
...
Fixes: index -49 out of bounds for type 'int16_t [192]'
Fixes: 17689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5756275014500352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c61661a2c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
70ef5ce67e
avcodec/g729postfilter: Fix undefined shifts
...
Fixes: left shift of negative value -12
Fixes: 17689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5756275014500352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6a4fdbf112 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
0259532a6e
avcodec/lsp: Fix undefined shifts in lsp2poly()
...
Fixes: left shift of negative value -30635
Fixes: 17689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5756275014500352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b93f52cd6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
3f919ef19c
avcodec/adpcm: Fix left shifts in AV_CODEC_ID_ADPCM_EA
...
Fixes: left shift of negative value -1
Fixes: 17683/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_EA_R2_fuzzer-5111690013704192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8695fbec57 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
90e449a690
avformat/shortendec: Check k in probe
...
Fixes: Assertion failure
Fixes: 17640/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5708767475269632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea770eb559 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
030884f6a6
avfilter/vf_geq: Use av_clipd() instead of av_clipf()
...
With floats we cannot represent all 32bit integer dimensions
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8813b1a98 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
d9259e05c2
avcodec/wmaprodec: Check that the streams channels do not exceed the overall channels
...
Fixes: NULL pointer dereference
Fixes: 18075/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA1_fuzzer-5708262036471808
Fixes: 18087/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA1_fuzzer-5740627634946048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e418b315dd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
3410c67da1
avcodec/qdmc: Check input space in qdmc_get_vlc()
...
Fixes: Timeout (125sec -> 0.4sec)
Fixes: 18059/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDMC_fuzzer-5656195825664000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c7975fe6f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
b07290fa84
avcodec/wmaprodec: Fix cleanup on error
...
Fixes: memleaks
Fixes: 18023/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA2_fuzzer-5642535011090432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5d29812ec )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
ee7d2ea4f6
avcodec/pcm: Check bits_per_coded_sample
...
Fixes: shift exponent -2 is negative
Fixes: 17736/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PCM_F16LE_fuzzer-5742815929171968
Fixes: 17998/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PCM_F24LE_fuzzer-5716980383875072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5de19160a3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
a4c6ba7ea7
avcodec/exr: Allow duplicate use of channel indexes
...
Fixes: Ticket #8203
Reported-by: durandal_1707
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 080819b3b4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
f6c9c455b6
avcodec/fitsdec: Fail on 0 naxisn
...
Fixes: Timeout (100+ sec -> 23ms)
Fixes: 17769/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5678314672357376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a3303d520 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
50a81bd978
avcodec/dxv: Subtract 12 earlier in dxv_decompress_cocg()
...
the data_start is after reading 12 bytes and if its subtracted
at the very end the intermediate might overflow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dd9e6d077e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
22a784c6db
libavcodec/dxv: Remove redundant seek
...
This seeks to the position the previous call to dxv_decompress_opcodes()
positioned us in case of success
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c371e50b4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
ae1b3038d0
avcodec/ituh263dec: Check input for minimal frame size
...
Fixes: Timeout (28sec -> 3sec)
Fixes: 17559/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H263_fuzzer-5681050776240128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f0498ed46 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
7bd58702f9
avcodec/truemotion1: Check that the input has enough space for a minimal index_stream
...
Fixes: Timeout (18sec -> 0.4sec)
Fixes: 17585/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION1_fuzzer-5117015135617024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a660fac98 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
71f3bb58df
avformat/mpsubdec: Clear queue on error
...
Fixes: Memleaks
Fixes: 17219/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5720539124989952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9a0d36e562 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
fb8e3a5b44
avcodec/sunrast: Check that the input is large enough for the maximally compressed image
...
Fixes: Timeout (17sec -> 15ms)
Fixes: 17224/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SUNRAST_fuzzer-5663218491457536
Fixes: 17224/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SUNRAST_fuzzer-5735590015795200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf0ba75c4a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
da773624b6
avcodec/sunrast: Check for availability of maplength before allocating image
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 711ad71aea )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
292c492271
avformat/subtitles: Check nb_subs in ff_subtitles_queue_finalize()
...
Fixes: null pointer dereference
Fixes: 17828/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5645915116797952
Fixes: Ticket8147
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 81b53913bb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
44b48d6acb
avcodec/vc1_block: Fix invalid left shift in vc1_decode_p_mb()
...
Fixes: left shift of negative value -6
Fixes: 17810/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5638541240958976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f588ccfb7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:56 +01:00
Michael Niedermayer
9cb50bb3cc
avcodec/wmaprodec: Check if there is a stream
...
Fixes: null pointer dereference
Fixes: signed integer overflow: 512 * 2147483647 cannot be represented in type 'int'
Fixes: 17809/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA1_fuzzer-5634409947987968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9b533de28e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
3a82e564cc
avcodec/g2meet: Check for end of input in jpg_decode_block()
...
Fixes: Timeout (100sec -> 0.7sec)
Fixes: 8668/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5174143888130048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 61dd2e07be )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
ed47b3d429
avcodec/g2meet: Check if adjusted pixel was on the stack
...
This basically checks if a pixel that was coded with prediction
and residual could have been stored using a previous case.
This avoids basically a string of 0 symbols stored in less than
50 bytes to hit a O(n²) codepath.
Fixes: Timeout (too slow to wait -> immediately)
Fixes: 8668/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-4895946310680576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c84c162e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
9c3ae17cc1
avformat/electronicarts: If no packet has been read at the end do not treat it as if theres a packet
...
Fixes: Assertion failure
Fixes: 17770/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5700606668308480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4de49edc4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
3a40d5ab2f
avcodec/dxv: Check op_offset in dxv_decompress_yo()
...
Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type 'int'
Fixes: 17745/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_fuzzer-5734628463214592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 97450d2b6a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
6f2723e54b
avcodec/utils: Check sample_rate before opening the decoder
...
Fixes: signed integer overflow: 2 * -1306460384 cannot be represented in type 'int'
Fixes: 17685/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_fuzzer-5747390337777664
Fixes: 17688/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5739287210885120
Fixes: 17699/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5678394531905536
Fixes: 17738/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5763415733174272
Fixes: 17746/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINKAUDIO_RDFT_fuzzer-5703008159006720
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 75fefb1fb7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
37e1cc6186
avcodec/aptx: Fix multiple shift anomalies
...
Fixes: left shift of negative value -24576
Fixes: 17719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APTX_fuzzer-5710508002377728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 675f62a202 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
James Almer
101244dad9
avcodec/fitsdec: fix use of uninitialised values
...
header.data_max and header.data_min are not necessarely set on all decoding scenarios.
Fixes a Valgrind reported regression since cfa1937791 .
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit e3f0ecfc57 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
4d0bd531f4
avcodec/motionpixels: Mark 2 functions as always_inline
...
Fixes: Timeout (30sec -> 25sec)
Fixes: 17050/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOTIONPIXELS_fuzzer-5719149803732992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 017884bdc3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
8323e0dc73
avcodec/ituh263dec: Make the condition for the studio slice start code match between ff_h263_resync() and ff_mpeg4_decode_studio_slice_header()
...
If they mismatch an infinite loop can occur
Fixes: Timeout (infinite loop)
Fixes: 17043/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5695051748868096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8335ba8ae9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
321d838098
avcodec/ralf: Fix integer overflow in decode_channel()
...
Fixes: signed integer overflow: -1094995519 * 64 cannot be represented in type 'int'
Fixes: 17030/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5640695838146560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fbb314b6f2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
f5f0e11378
vcodec/vc1: compute rangex/y only for P/B frames
...
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int'
Fixes: 16976/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-4847262047404032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e75e7fe160 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
838b359225
avcodec/vc1_pred: Fix invalid shifts in scaleforopp()
...
Fixes: left shift of negative value -2
Fixes: 16964/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5757853565976576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ced9a1cd0a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
2e527ed7b1
avcodec/vc1_block: Fix invalid shift with rangeredfrm
...
Fixes: left shift of negative value -7
Fixes: 16959/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-5200360825683968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c722a69253 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
e59b387e0a
avcodec/vc1: Check for excessive resolution
...
Fixes: overflow in aspect ratio calculation
Fixes: signed integer overflow: 393215 * 14594 cannot be represented in type 'int'
Fixes: 15728/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5661588893204480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 181e138da7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
32a9a34f86
avcodec/vc1: check REFDIST
...
"9.1.1.43 P Reference Distance (REFDIST)"
"The value of REFDIST shall be less than, or equal to, 16."
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f7af9e294 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
d4602f21da
avcodec/apedec: Fix several integer overflows in predictor_update_filter() and do_apply_filter()
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: signed integer overflow: -14527961 - 2147483425 cannot be represented in type 'int'
Fixes: 16380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5645957131141120
Fixes: 16968/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5716169901735936
Fixes: 17074/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5198710497083392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e95a3e8a7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
519532549f
avcodec/hevc_cabac: Tighten the limit on k in ff_hevc_cu_qp_delta_abs()
...
Values larger would fail subsequent tests.
Fixes: signed integer overflow: 5 + 2147483646 cannot be represented in type 'int'
Fixes: 16966/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5695709549953024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f63cd1963e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
c9754099e5
avcodec/4xm: Check index in decode_i_block() also in the path where its not used.
...
Fixes: Infinite loop
Fixes: signed integer overflow: 2147483644 + 16 cannot be represented in type 'int'
Fixes: 16169/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5662570416963584
Fixes: 16782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5743163859271680
Fixes: 17641/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5711603562971136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 87ddf9f1ef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
3d60a87a5b
avcodec/loco: Check for end of input in the first line
...
Fixes: Timeout (85sec -> 0.1sec)
Fixes: 17634/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5666410809786368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c5a52eb5cd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
53f38b7b82
avcodec/atrac3: Check block_align
...
Fixes: Infinite loop
Fixes: 17620/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3_fuzzer-5086123012915200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2acbbe2623 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
447a67589b
avcodec/alsdec: Avoid dereferencing context pointer in inner interleave loop
...
This makes the decoder faster
Improves/Fixes: Timeout (22sec -> 20sec)
Testcase: 17619/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5078510820917248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 581a895c5c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
9e58eb10ba
avcodec/hcom: Check that there are dictionary entries
...
Fixes: out of array read
Fixes: 17617/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCOM_fuzzer-5674970478280704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b2785cd3ac )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
962b0345a5
avcodec/fitsdec: Prevent division by 0 with huge data_max
...
Fixes: division by 0
Fixes: 15657/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5738154838982656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cfa1937791 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
6e6f0027fd
avcodec/dstdec: Fix integer overflow in samples_per_frame computation
...
Fixes: Timeout (? -> 2ms)
Fixes: 17616/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5198057947267072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7dc0943d4a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
1493a952ed
avcodec/g729_parser: Check block_size
...
Fixes: Infinite loop
Fixes: 17611/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5765134928052224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 972a0a818f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
c0f315b835
avcodec/sbcdec: Initialize number of channels
...
Fixes: out of array access
Fixes: 17609/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SBC_fuzzer-5758729319874560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Reviewed-by: Moritz Barsnick <barsnick@gmx.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 02fb6a2147 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
026f243d71
avcodec/utils: Optimize ff_color_frame() using memcpy()
...
4650975 -> 4493240 dezicycles
This optimizes lines 2 and later. Line 1 still uses av_memcpy_backptr()
This change originally fixed ossfuzz 10790 but this is now fixed by other
optimizations already
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 95e5396919 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
331b5ac3c9
avcodec/aacdec: Check if we run out of input in read_stream_mux_config()
...
Fixes: Infinite loop
Fixes: 16920/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5653421289373696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3dce4d03d5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
c3fb2bd9aa
avcodec/utils: Use av_memcpy_backptr() in ff_color_frame()
...
Fixes: Timeout (191sec -> 53sec)
Fixes: 16908/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5711207859748864
Fixes: 10709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5630617975259136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 340ab13504 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
6271b13be6
avcodec/smacker: Fix integer overflow in signed int multiply in SMK_BLK_FILL
...
Fixes: signed integer overflow: 238 * 16843009 cannot be represented in type 'int'
Fixes: 16958/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKER_fuzzer-5193905355620352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 033d2c4884 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
0373a4ce53
avcodec/alac: Fix invalid shifts in 20/24 bps
...
Fixes: left shift of negative value -256
Fixes: 16892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-4880802642395136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b30c07cc2b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
e08778c3ea
avcodec/alac: fix undefined behavior with INT_MIN in lpc_prediction()
...
Fixes: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
Fixes: 16786/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5632818851348480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0831cbfe09 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
8eb6296172
avcodec/ffwavesynth: Fix integer overflow in timestamps
...
Fixes: signed integer overflow: 9223371075321077760 * 2 cannot be represented in type 'long'
Fixes: 16447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5698937431785472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c7ccbf40ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
c7d53daf9a
avformat/vividas: Test size and packet numbers a bit more
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 27a2f65948 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
1beae222db
avformat/vividas: Check n_sb_blocks against input space
...
Fixes: OOM
Fixes: 16726/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5719320750981120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e51f35f81 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
0147b74205
avcodec/dxv: Check op_offset in both directions
...
Fixes: signed integer overflow: 61 + 2147483647 cannot be represented in type 'int'
Fixes: 15311/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_fuzzer-5742552826773504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c7d5fcfc3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
daa398e80e
avcodec/adpcm: Check number of channels for MTAF
...
Fixes: out of array access
Fixes: 17608/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_MTAF_fuzzer-5074936267276288
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 74bbf9bc82 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
dc2bae1b3b
avcodec/sunrast: Fix indention
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0728d64497 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
0bf92a41c3
avcodec/sunrast: Fix return type for "unsupported (compression) type"
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e8b7709a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
28aafef295
avcodec/utils: Check channels fully earlier
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 83f2555e5f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
75cd59ec21
avformat/mov: Check for EOF in mov_read_meta()
...
Fixes: Timeout (195sec -> 2ms)
Fixes: 16735/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5090676403863552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 093d1f4250 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
f72580eb0f
avcodec/hevcdec: Fix memleak of a53_caption
...
Fixes: 15295/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5675655187922944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ef50cf7b32 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
69e32fd0b1
avformat/vividas: Remove align offset which is always masked off
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e8fd25272 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
372f9254c3
avformat/vividas: remove dead assignment
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 08dc354ef7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
8ae4a2915a
avformat/cdxl: Fix integer overflow in intermediate
...
Fixes: signed integer overflow: 65535 * 65312 cannot be represented in type 'int'
Fixes: 16704/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6294115603447808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c5575c8dc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
9b81e32f01
avcodec/hevcdec: repeat character in skiped
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d2d8e797cc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
315362028e
repeat an even number of characters in occured
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fccc37ca85 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
da988851dc
avcodec/gdv: Replace assert() checking bitstream by if()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a9fae76370 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
4f9200a963
libavcodec/utils: Free threads on init failure
...
Fixes: Multiple memleaks
Fixes: ffmpeg-memory-leak
Found-by: Francis Provencher <francis@protekresearchlab.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 61b055bed0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
bc09450e29
avcodec/htmlsubtitles: Avoid locale dependant isdigit()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b94cf549e2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
38fde9e95f
avcodec/alsdec: Check k from being outside what our implementation can handle
...
The specification does not seem to list what the maximum valid
value is
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 16268/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5638164544225280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e125578994 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
6789b3c2c3
avcodec/takdec: Fix integer overflow in decorrelate()
...
Fixes: signed integer overflow: -2424832 - 2145653689 cannot be represented in type 'int'
Fixes: 16138/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5643451346976768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f119273649 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
2e260c2271
avcodec/aacps: Fix integer overflows in hybrid_synthesis()
...
Fixes: signed integer overflow: -822667928 + -1399761199 cannot be represented in type 'int'
Fixes: 15756/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5645182051024896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec749ed222 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
58e6635324
avcodec/mpeg4videodec: Fix integer overflow in mpeg4_decode_studio_block()
...
Fixes: signed integer overflow: 24023040 * 112 cannot be represented in type 'int'
Fixes: 16570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5173275211071488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Kieran Kunhya <kierank@obe.tv >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e4a0e962c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
83e85e9798
avcodec/vp56rac: delay signaling an error on truncated input
...
A threshold of 1 is sufficient for simple_dump_cut.webm, 10 is used
just to be sure the next truncated file doesnt cause the same issue
Obvious alternative fixes are to simply accept that the file is broken or to
write some advanced error concealment or to
simply accept that the decoder wont stop at the end of input.
Fixes: Ticket 8069 (artifacts not the differing md5 which was there before 1afd246960 )
Fixes: simple_dump_cut.webm
Fixes: regression of 1afd246960
fate-vp5 changes because the last frame is truncated and now handled
differently.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b6b9ac5698 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Michael Niedermayer
48659851e2
avcodec/pnm_parser: Use memchr() in pnm_parse()
...
Fixes: Timeout (45sec -> 0.5sec)
Fixes: 16942/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PPM_fuzzer-5085393073995776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 10ea6c3116 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Andrey Semashev
69be8cc6e0
tests: Fix bash errors in lavf_container tests.
...
Because the lavf_container is sometimes called with only 2 arguments,
fate tests produce bash errors like this:
tests/fate-run.sh: 299: test: =: unexpected operator
This commit fixes this.
Reviewed-by: Limin Wang <lance.lmwang@gmail.com >
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6d9d053edb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-31 19:51:55 +01:00
Andreas Rheinhardt
48ae235848
avformat/matroskadec: Fix use-after-free when demuxing ProRes
...
ProRes in Matroska is supposed to not contain the first atom header
(containing a size field and the tag "icpf") and therefore the Matroska
demuxer has to recreate it; this involves an allocation and copy, of
course. Whether the old buffer (containing the data without the atom
header) needs to be freed or not depends upon whether it is what was
directly read (in which case it is owned by an AVBuffer) or whether it
has been allocated when reversing the track's content compression (e.g.
zlib compression) that Matroska supports.
So there are three pointers involved: The one pointing to the directly
read data (owned by the AVBuffer), the one pointing to the currently
valid data (which coincides with the former if no content compression
needed to be reverted) and the one pointing to the new data with the
first atom header. The check for whether to free the second of these is
simply whether the first two are different.
This works mostly, but there is a complication: Some muxers don't strip
the first atom header away and in this case, it is also not reinserted
and no new buffer is allocated; instead, the second and the third
pointers agree. In this case, one must never free the second buffer.
Yet it is currently done if the track is e.g. zlib compressed.
This commit fixes this.
This is a regression since b8e75a2a .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit af50f0a515 )
2019-12-13 12:01:20 -03:00
Andreas Rheinhardt
2f89f24eb9
avformat/matroskadec: Fix demuxing ProRes
...
The structure of a ProRes frame in mov/mp4 is that of a typical atom:
First a 32 bit BE size field, then a tag detailling the content. Said
size field includes the eight bytes of the atom header.
This header is actually redundant, as the size of the atom is already
known from the containing atom. It is therefore stripped away when muxed
into Matroska and so the Matroska demuxer has to recreate upon demuxing.
But it did not account for the fact that the size field includes the
size of the header and this can lead to problems when a decoder uses the
in-band size field.
Fixes ticket #8210 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 581419ea39 )
2019-12-13 12:01:16 -03:00
James Almer
d3fef1a3bd
avcodec/cbs_av1: fix array size for ar_coeffs_cb_plus_128 and ar_coeffs_cr_plus_128
...
Taking into account the code
fb(2, ar_coeff_lag);
num_pos_luma = 2 * current->ar_coeff_lag * (current->ar_coeff_lag + 1);
if (current->num_y_points)
num_pos_chroma = num_pos_luma + 1;
else
num_pos_chroma = num_pos_luma;
Max value for ar_coeff_lag is 3 (two bits), for num_pos_luma 24, and for
num_pos_chroma 25.
Both ar_coeffs_cb_plus_128 and ar_coeffs_cr_plus_128 may have up to
num_pos_chroma values.
Reviewed-by: Ronald S. Bultje <rsbultje@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit a23dd33606 )
2019-12-11 22:19:28 -03:00
Fei Wang
69abae318a
avcodec/cbs_av1: avoid reading trailing bits when obu type is OBU_TILE_LIST
...
Signed-off-by: Fei Wang <fei.w.wang@intel.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 1ea44178f5 )
2019-12-11 22:19:03 -03:00
Andriy Gelman
0493699813
lavc/cbs_h2645: Fix incorrect max size of nalu unit
...
In the worst case the startcode prefix has 4 bytes.
This fixes a trigerred assertion:
Assertion dp <= max_size failed at libavcodec/cbs_h2645.c:1451
Found-by:libFuzzer
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com >
(cherry picked from commit 02a83e26de )
2019-12-11 22:18:48 -03:00
Andreas Rheinhardt
2722fc2bcf
avcodec/extract_extradata_bsf: Don't unref uninitialized buffers
...
This happens if allocating extradata fails and s->remove is unset.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 76e0ecec0b )
2019-12-06 21:33:54 -03:00
Andreas Rheinhardt
40123639fe
avformat/av1: Fix leak of dynamic buffer in case of parsing failure
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 27c6c92534 )
2019-12-06 21:33:47 -03:00
Ross Nicholson
289838b7bd
libavformat/rtsp: return error if rtsp_hd_out is null instead of crash
...
Signed-off-by: Aman Gupta <aman@tmm1.net >
(cherry picked from commit 460f74495f )
2019-12-02 16:41:32 -08:00
Mark Thompson
82a3a623f0
cbs_h264: Fix missing inferred colour description fields
...
With video_signal_type_present_flag set but colour_description_present_flag
unset the colour fields would not have had their correct values inferred.
(cherry picked from commit f9b8503639 )
2019-11-19 23:40:02 -03:00
James Almer
252ef2329a
avcodec/cbs_av1: keep separate reference frame state for reading and writing
...
In scearios where a Temporal Unit is written right after reading it using the same
CBS context (av1_metadata, av1_frame_merge, etc), the reference frame state used
by the writer must not be the state that's the result of the reader having already
parsed the current frame in question.
This fixes writing Switch frames, and frames using short ref signaling.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 4e2bef6a82 )
2019-11-19 23:37:49 -03:00
James Almer
8da31e9eef
avcodec/cbs_av1: fix reading reference order hint in skip_mode_params()
...
Reviewed-by: Ronald S. Bultje <rsbultje@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 2703068110 )
2019-11-19 23:36:54 -03:00
James Almer
57365f67a0
avcodec/amfnec: allocate packets using av_new_packet()
...
This ensures they will be reference counted, as required by the AVCodec.receive_packet()
API.
Should fix ticket #8386 .
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit fdf46b4a6b )
2019-11-19 19:48:33 -03:00
Timo Rothenpieler
44fe41a1ca
avcodec/nvenc: make sure newly allocated packets are refcounted
...
Fixes ticket 8383
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2019-11-17 01:41:11 +01:00
Jun Zhao
61853f7503
lavc/mpeg4audio: add chan_config check to avoid indeterminate channels
...
add chan_config check to avoid indeterminate channels.
Signed-off-by: Jun Zhao <barryjzhao@tencent.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 333109f469 )
2019-09-27 22:28:16 -03:00
James Almer
2ec1b096b1
aformat/movenc: add missing padding to output track extradata
...
Fixes ticket #8183 .
Tested-by: Thierry Foucu <tfoucu@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 58aa0ed8f1 )
2019-09-26 16:02:39 -03:00
Timo Rothenpieler
0eb1088960
avcodec/nvenc: add driver version info for SDK 9.1
...
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2019-09-24 12:05:16 +02:00
James Almer
25273ef23a
avcodec/bsf: check that AVBSFInternal was allocated before dereferencing it
...
This can happen when av_bsf_free() is called on av_bsf_alloc() failure.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit d889ae3396 )
2019-09-23 10:11:25 -03:00
Michael Niedermayer
1529dfb73a
Update for 4.2.1
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-06 23:23:41 +02:00
Michael Niedermayer
e66d4725c7
avcodec/qdm2: Check frame size
...
Fixes: index 2304 out of bounds for type 'float [2304]'
Fixes: 16332/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5679142481166336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 12b909ba31 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-06 23:00:46 +02:00
Michael Niedermayer
5a1e0cae2f
avformat/vividas: check for tiny blocks using alignment
...
Ask for a sample for these
Fixes: out of array access
Fixes: 16624/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5762455661182976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 55d4e22d71 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-06 23:00:46 +02:00
Michael Niedermayer
d3b45f1378
avcodec/vc1_pred: Fix refdist in scaleforopp()
...
Fixes: out of array access
Fixes: 16601/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5656105392275456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 413e0f2516 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-06 23:00:46 +02:00
Michael Niedermayer
5b44aec196
avcodec/vorbisdec: fix FASTDIV usage for vr_type == 2
...
This reverts a hunk from f1ca40ee00
Fixes: out of array read
Fixes: 16924/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5157893162139648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 722fd46965 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-06 23:00:46 +02:00
Michael Niedermayer
6c583ec9bd
avcodec/iff: Check for overlap in cmap_read_palette()
...
Fixes: undefined memcpy() use
Fixes: 16302/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5678750575886336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dfa5d1a366 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-06 23:00:46 +02:00
Michael Niedermayer
ee89d9e3d6
avcodec/apedec: Fix 32bit int overflow in do_apply_filter()
...
Fixes: signed integer overflow: 2147480546 + 4096 cannot be represented in type 'int'
Fixes: 16280/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5123442566758400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d3ddef519 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-06 23:00:46 +02:00
Carl Eugen Hoyos
1dec90d456
lavf/rawenc: Only accept the appropriate stream type for raw muxers.
...
This does not affect the rawvideo muxer.
Fixes ticket #7979 .
(cherry picked from commit aef24efb0c )
2019-09-06 16:25:05 -03:00
James Almer
3de33c6e76
avformat/matroskadec: use av_fast_realloc to reallocate ebml list arrays
...
Speeds up the process considerably.
Fixes ticket #8109 .
Suggested-by: nevcairiel
Suggested-by: cehoyos
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 3b3150c45f )
2019-09-04 16:30:46 -03:00
James Almer
6a19167a6f
avformat/matroskadec: use proper types for some EbmlSyntax fields
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit f34aabfbae )
2019-09-04 16:30:46 -03:00
Michael Niedermayer
457ed86478
avcodec/ralf: fix undefined shift in extend_code()
...
Fixes: left shift of negative value -3
Fixes: 16147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5658392722407424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4778407ab3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
a7f6b27e3c
avcodec/ralf: fix undefined shift
...
Fixes: left shift of negative value -2
Fixes: 16145/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5146671058518016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ee886988e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
517fd68acd
avcodec/bgmc: Check input space in ff_bgmc_decode_init()
...
Fixes: Infinite loop
Fixes: 16608/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5636229827133440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b54031a6e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
69db79074f
avcodec/vp3: Check for end of input in 2 places of vp4_unpack_macroblocks()
...
Fixes: Timeout (82sec -> 1sec)
Fixes: 16411/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP3_fuzzer-5166958151991296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit daf92cc074 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
372c91b199
avcodec/truemotion2: Fix multiple integer overflows in tm2_null_res_block()
...
Fixes: signed integer overflow: 1795032576 + 598344192 cannot be represented in type 'int'
Fixes: 16196/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5636723419119616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cc78783ce5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
ba7ba6db74
avcodec/vc1_block: Check the return code from vc1_decode_p_block()
...
Fixes: left shift of negative value -1
Fixes: 16424/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-5656579055026176
Fixes: 16358/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5714436358144000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fe536b6d99 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
fd235d7428
avcodec/vc1dec: Require res_sprite for wmv3images
...
non res_sprite leads to decoder delay which leads to assertion failure
Fixes: Assertion failure
Fixes: 16402/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5704510034411520
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int'
Fixes: 16425/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5692858838810624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c6b400492 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
7edcd88a3f
avcodec/vc1_block: Check for double escapes
...
Fixes: out of array read
Fixes: 16331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5672735195267072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6962fd586e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
948e655d13
avcodec/vorbisdec: Check get_vlc2() failure
...
Fixes: out of array read
Fixes: 16510/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5754510382727168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 07b948fe60 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
92e021ff95
avcodec/tta: Fix integer overflow in prediction
...
Fixes: signed integer overflow: -395281576 + -1827578048 cannot be represented in type 'int'
Fixes: 16038/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5646109705240576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7e9aecc9f3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
b34033dec2
avcodec/vb: Check input packet size to be large enough to contain flags
...
Fixes: Timeout (->9sec)
Fixes: 16292/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VB_fuzzer-5747063496638464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dea2591d4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
7a9b43671a
avcodec/cavsdec: Limit the number of access units per packet to 2
...
Fixes: Timeout (122sec -> 13ms)
Fixes: 15978/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5148925004087296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 37bc8e3249 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
ada9293402
avcodec/atrac9dec: Check block_align
...
Fixes: Infinite loop
Fixes: 16260/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5676365617037312
Fixes: 16260/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5768093879500800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dead949a1f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
7823b70004
avcodec/alac: Check for bps of 0
...
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 15764/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5102101203517440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8f49176e84 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
fc2bb55605
avcodec/alac: Fix multiple integer overflows in lpc_prediction()
...
Fixes: signed integer overflow: 2088795537 + 2147254401 cannot be represented in type 'int'
Fixes: signed integer overflow: -1500363496 + -1295351808 cannot be represented in type 'int'
Fixes: signed integer overflow: -79560 * 32640 cannot be represented in type 'int'
Fixes: signed integer overflow: 2088910005 + 2088796058 cannot be represented in type 'int'
Fixes: signed integer overflow: -117258064 - 2088725225 cannot be represented in type 'int'
Fixes: signed integer overflow: 2088725225 - -117258064 cannot be represented in type 'int'
Fixes: 15739/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5630664122040320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ae3d6a337a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
cf65da16f8
avcodec/rl2: set dimensions
...
The dimensions are always 320x200 they are hardcoded in the demuxer.
Hardcode them instead in the decoder.
Fixes: Timeout (16sec -> 400ms)
Fixes: 15574/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RL2_fuzzer-5158614072819712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 965e766e48 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
209a28bb74
avcodec/aacdec: Add FF_CODEC_CAP_INIT_CLEANUP
...
Fixes: memleaks
Fixes: 16289/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5200695692623872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 48b86dd8a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
53ed19f374
avcodec/idcinvideo: Add 320x240 default maximum resolution
...
Fixes: Timeout (128sec -> 2ms)
Fixes: 16568/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IDCIN_fuzzer-5675004095627264
See: [FFmpeg-devel] [PATCH 4/4] tools/target_dec_fuzzer: Adjust max_pixels for IDCIN
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9fcf881e6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
818a3fd27c
avformat/realtextdec: free queue on error
...
Fixes: memleak
Fixes: 16277/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5696629440512000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 493438fafc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
b881ea0f9e
avcodec/vp5/6/8: use vpX_rac_is_end()
...
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab56e62e8f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
da3e2efad6
avformat/vividas: Check av_xiphlacing() return value before use
...
Fixes: out of array access
Fixes: 16277/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5696629440512000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5937f05503 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
61268f2454
avcodec/alsdec: Fix integer overflow in decode_var_block_data()
...
Fixes: signed integer overflow: 1927975249 - -514719744 cannot be represented in type 'int'
Fixes: 16413/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5651206856245248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 661a9b274b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
d34b5c938b
avcodec/alsdec: Limit maximum channels to 512
...
There seems to be no limit in the specification and upto 64k could be stored
512 is choosen as limit as thats the maximum in a conformance sample
An alternative to this patch would be a max_channels variable
Fixes: OOM
Fixes: 16200/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5764788793114624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Thilo Borgmann <thilo.borgmann@mail.de >
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f51e4d026c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
9f61f2f1ea
avcodec/anm: Check input size for a frame with just a stop code
...
Fixes: Timeout (11sec -> 6sec)
Fixes: 16344/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ANM_fuzzer-5673032000995328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1965161ef6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
36019fc088
avcodec/flicvideo: Optimize and Simplify FLI_COPY in flic_decode_frame_24BPP() by using bytestream2_get_buffer()
...
Fixes: Timeout (31sec -> 22sec)
Fixes: 16217/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-5658084189405184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e301736862 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
3349be5745
avcodec/loco: Check left column value
...
Fixes: Timeout (42sec -> 379 ms)
Fixes: 16323/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5679178099195904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c812db814e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
80ecb421fe
avcodec/ffwavesynth: Fixes invalid shift with pink noise seeking
...
Fixes: left shift of negative value -961533698048
Fixes: 16242/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5738550670131200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cdea0206ef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
bcc1fe5165
avcodec/ffwavesynth: Fix integer overflow for some corner case values
...
Fixes: left shift of negative value -14671840
Fixes: 16000/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5145977817661440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4a88fb546 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
634f590061
avcodec/indeo2: Check remaining input more often
...
Fixes: Timeout (95sec -> 30ms)
Fixes: 14765/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO2_fuzzer-5692455527120896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpe
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 52939a2c57 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
eba31bf944
avcodec/diracdec: Check that slices are fewer than pixels
...
Fixes: Timeout (197sec ->144ms)
Fixes: 15034/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5733549405110272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fbbc8ba67f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
fc902dd374
avcodec/vp56: Consider the alpha start as end of the prior header
...
Fixes: Timeout (23sec -> 71ms)
Fixes: 15661/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP6A_fuzzer-6257865947348992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit db78bc1297 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
6d5377c622
avcodec/4xm: Check for end of input in decode_p_block()
...
Fixes: Timeout (81sec -> 0.2sec)
Fixes: 16169/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5662570416963584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8f92eb05e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
2547f92410
avcodec/hevcdec: Check delta_luma_weight_l0/1
...
Fixes: signed integer overflow: 1 + 2147483647 cannot be represented in type 'int'
Fixes: 16041/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5685680656613376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 021f29506b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
2a59101eb1
avcodec/hnm4video: Optimize postprocess_current_frame()
...
Improves: Timeout (220sec -> 108sec)
Improves: 15570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HNM4_VIDEO_fuzzer-5085482213441536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cd460f4da0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
be36e13e66
avcodec/hevc_refs: Optimize 16bit generate_missing_ref()
...
Fixes: Timeout (86sec -> 8sec) [these numbers assume also "[FFmpeg-devel] [PATCH 2/5] [RFC] avcodec/hevcdec: Check for overread in hls_decode_entry()"]
Fixes: 15702/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5657764929470464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit da8936969f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
3bff0de66b
avcodec/scpr: Use av_memcpy_backptr() in type 17 and 33
...
This makes the changed code-path faster.
Change not tested except with the fuzzer testcase as I found no other testcase.
Improves: Timeout (136sec -> 74sec)
Improves: 16040/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-5705876062601216
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit 950a21e83c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
3223f4229a
avcodec/tiff: Enforce increasing offsets
...
This may break some valid tiff files, it appears the specification does not require
the offsets to be increasing. They increase in the 2 test files i have though except
the last offset which is 0 (an end marker) and for which a special case is added to
avoid asking for a sample for that end marker.
See: [FFmpeg-devel] [PATCH 2/2] avcodec/tiff: Detect infinite retry loop
for an alternative implementation
Fixes: Timeout (Infinite -> Finite)
Fixes: 15706/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5114674904825856
This variant was requested by paul on IRC
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1fedba3c35 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
3520590810
avcodec/dds: Use ff_set_dimensions()
...
Fixes: signed integer overflow: 2082471995 * 36 cannot be represented in type 'int'
Fixes: 16025/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DDS_fuzzer-5136663778426880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9cd1e939cf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
4d7bbeb164
avformat/vividas: Fix another infinite loop
...
Not found by the fuzzer
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1d72b5d2d5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
f5c6f81576
avformat/vividas: Fix infinite loop in header parser
...
Fixes: Timeout (Infinite -> Finite)
Fixes: 16010/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5638616102993920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 52b564ef13 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
4eef201e15
avcodec/mpc8: Fix 32bit mask/enum
...
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 15817/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC8_fuzzer-5636626409062400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e8bb949ade )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
ebc43bef1f
avcodec/alsdec: Fix integer overflows of raw_samples in decode_var_block_data()
...
This also makes the code consistent with the existing similar MUL64()
in decode_var_block_data()
Fixes: signed integer overflow: -7277630735906765035 + -3272193951413647896 cannot be represented in type 'long'
Fixes: 16015/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5666552818434048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fad3ec89b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
7e9bb72dd6
avcodec/alsdec: Fix integer overflow of raw_samples in decode_blocks()
...
Fixes: signed integer overflow: 2147483424 - -1772303236 cannot be represented in type 'int'
Fixes: 15708/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5067890362941440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ce65232406 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
eda64cda63
avcodec/alsdec: fix mantisse shift
...
Fixes: shift exponent -1 is negative
Fixes: 16039/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5656825657032704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 02346292a3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
ee20e3ff2d
avcodec/pngdec: consider chunk size in minimal size check
...
assuming each block contains an empty chunk there has to be at least 8 bytes extra.
Fixes: 15327/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LSCR_fuzzer-5676669303521280
Fixes: Timeout (11->5sec)
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 70432eac0b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
b205d5a6d2
avcodec/vc1_block: Fix invalid shifts in vc1_decode_i_blocks()
...
Fixes: left shift of negative value -9
Fixes: 15299/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSS2_fuzzer-5660922678345728
Fixes: 15557/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5673351911047168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9415e815a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
6449c086f1
avcodec/vc1_block: fix invalid shift in vc1_decode_p_mb()
...
Fixes: left shift of negative value -5
Fixes: 15294/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5733921754447872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b153ba1c2e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Michael Niedermayer
c99cb72d27
avcodec/aacdec_template: fix integer overflow in imdct_and_windowing()
...
Fixes: signed integer overflow: 2147483645 + 4 cannot be represented in type 'int'
Fixes: 15418/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5685269069561856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit da93e2b142 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-09-04 20:26:35 +02:00
Anthony Delannoy
611eb95943
avformat/mpegts: Check if ready on SCTE reception
...
On some DVB stream SCTE-35 data packet are available before the end of
MpegTSContext initialization. We have to check if it is the case to
avoid a SEGFAULT.
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit 39f1295937 )
2019-09-03 21:56:07 +02:00
Aman Gupta
0f8e2a0b86
avcodec/omx: fix xFramerate calculation
...
Integer overflow in the Q16 framerate calculation was sending
invalid values to the OMX encoder.
On the RPI4, this manifested as bitrate controls being ignored
on video streams with 60000/1001 framerates. Video streams with
30000/1001 framerates were not affected.
Signed-off-by: Aman Gupta <aman@tmm1.net >
(cherry picked from commit b022d9ba28 )
2019-09-02 13:53:08 -07:00
Marton Balint
b4e9103709
avformat/avidec: add support for recognizing HEVC fourcc when demuxing
...
Some security cams generate this, as well as some versions of VirtualDub and
VLC so support for _reading_ such files is justified.
Fixes ticket #7110 .
See also this discussion: https://patchwork.ffmpeg.org/patch/8744/
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit 2e31774b40 )
2019-09-02 22:06:00 +02:00
Marton Balint
3a17fe2bdd
avformat/mpegts: fix teletext PTS when selecting teletext streams only
...
After a1b4f120c0 the teletext PTS values were set
to AV_NOPTS_VALUE if the stream of the PCR pid was discarded.
What actually matters is that if we parse the PCR of the PCR PID or not, so
let's use the cached discard value of the actual PCR PID instead of the stream
discard value, which may be different.
Also fixes ticket #7567 , which was caused by the fact that teletext PTS values
were not touched if the PCR pid was discarded even before
a1b4f120c0 .
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit 765c56bfa9 )
2019-09-02 22:05:46 +02:00
James Almer
c1dc4d2d50
avcodec/h2645_parse: zero initialize the rbsp buffer
...
Fixes ticket #8093
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit af70bfbead )
2019-08-27 20:10:35 -03:00
Dave Stevenson
3dd3e8e24a
avcodec/omx: Fix handling of fragmented buffers
...
See https://trac.ffmpeg.org/ticket/7687
If an encoded frame is returned split over two or more
IL buffers due to the size, then there is a race between
whether get_buffer will fail, return NULL, and a truncated
frame is passed on, or IL will return the remaining part
of the encoded frame.
If get_buffer returns NULL, part of the frame is left behind
in the codec, and will be collected on the next call. That
then leaves a frame stuck in the codec. Repeat enough times
and the codec FIFO is full, and the pipeline stalls.
A performance improvement in the Raspberry Pi firmware means
that the timing has changed, and now frequently drops into the
case where get_buffer returns NULL.
Add code such that should a buffer be received without
OMX_BUFFERFLAG_ENDOFFRAME that get_buffer is called with wait
set, so we wait for the remainder of the frame.
This code has been made conditional on the Pi build in case
other IL implementations don't handle ENDOFFRAME correctly.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org >
Signed-off-by: Aman Gupta <aman@tmm1.net >
Signed-off-by: Martin Storsjö <martin@martin.st >
(cherry picked from commit 3d857f219e )
2019-08-23 17:11:37 -07:00
Aman Gupta
e008f89cfa
avcodec/omx: ensure zerocopy mode can be disabled on rpi builds
...
fixes https://trac.ffmpeg.org/ticket/6586
Signed-off-by: Aman Gupta <aman@tmm1.net >
(cherry picked from commit 23a3e1460a )
2019-08-23 17:11:32 -07:00
Marton Balint
370c346d5d
avformat/mxfdec: do not ignore bad size errors
...
The return value was unintentionally lost after
00a2652df3 .
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit 6ee40dcb64 )
2019-08-22 22:23:03 +02:00
Andreas Rheinhardt
299e0dff1f
avformat/matroskadec: Fix seeking
...
matroska_reset_status (a function that is used during seeking (among
other things)) used an int for the return value of avio_seek which
returns an int64_t. Checking the return value then indicated an error
even though the seek was successfull for targets in the range of
2GB-4GB, 6GB-8GB, ... This error implied that the status hasn't been
reset and in particular, the old level was still considered to be in
force, so that ebml_parse returned errors because the newly parsed
elements were of course not contained in the previously active and still
wrongly considered active master element any more.
Addresses ticket #8084 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit c294f38c91 )
2019-08-16 21:37:06 -03:00
Marton Balint
c8dcda22f1
ffplay: properly detect all window size changes
...
SDL_WINDOWEVENT_SIZE_CHANGED should be used instead of SDL_WINDOWEVENT_RESIZED
because SDL_WINDOWEVENT_RESIZED is only emitted if the resize happened due to
an external event.
Fixes ticket #8072 .
Additional references:
https://bugzilla.libsdl.org/show_bug.cgi?id=4760
https://wiki.libsdl.org/SDL_WindowEventID
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit a1c7014847 )
2019-08-14 22:07:32 +02:00
Ricardo Constantino
75384bc464
configure: cuda_llvm: fix include path for MSYS2
...
MSYS2 converts paths to MinGW-based applications from unix to
pseudo-windows paths on execution time.
Since there was no space between '-include' and the path, MSYS2 doesn't
detect the path properly.
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2019-08-05 23:00:29 +02:00
James Almer
35e9d9cbf7
avformat/dashenc: fix writing the AV1 codec string in mp4 mode
...
From https://aomediacodec.github.io/av1-isobmff/#codecsparam , the parameters
sample entry 4CC, profile, level, tier, and bitDepth are all mandatory fields.
All the other fields are optional, mutually inclusive (all or none).
Fixes ticket #8049
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 1cf2f040e3 )
2019-08-05 15:02:55 -03:00
James Almer
d1c81070bc
avformat/dashenc: update stream extradata from packet side data
...
codecpar->extradata is not going to change between packets. New extradata
is instead propagated using packet side data.
Use ff_alloc_extradata() as well.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit ce6a98e830 )
2019-08-05 15:02:50 -03:00
James Almer
5152602ba8
avformat/av1: combine high_bitdepth and twelve_bit into a single bitdepth value
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 9a44ec9410 )
2019-08-05 15:02:45 -03:00
James Almer
6e53b43d48
avformat/av1: rename some AV1SequenceParameters fields
...
Cosmetic change.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 0d597a69ba )
2019-08-05 15:02:36 -03:00
James Almer
a2df7e44b3
avformat/av1: split off sequence header parsing from the av1C writing function
...
It will be used by the dash muxer
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 68e48e5d97 )
2019-08-05 15:02:29 -03:00
James Almer
f4b254e299
avformat/av1: add color config values to AV1SequenceParameters
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 0c7cfd2c19 )
2019-08-05 15:02:18 -03:00
Andreas Rheinhardt
34a40aeb73
libavcodec/iff: Use unsigned to avoid undefined behaviour
...
The initialization of the uint32_t plane32_lut matrix uses left shifts
of the form 1 << plane; plane can be as big as 31 which means that this
is undefined behaviour as 1 will be simply an int. So make it unsigned
to avoid this.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f12e662a3d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-05 19:34:33 +02:00
Michael Niedermayer
d5cd7fe5af
avcodec/alsdec: Check for block_length <= 0 in read_var_block_data()
...
Fixes: left shift of negative value -1
Fixes: 15719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5685731105701888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be4fb282f9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-05 19:34:33 +02:00
Michael Niedermayer
06688a8cc5
avcodec/vqavideo: Set video size
...
Fixes: out of array access
Fixes: 15919/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-5657368257363968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 02f909dc24 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-05 19:34:33 +02:00
Michael Niedermayer
6443b95de6
avcodec/sanm: Check extradata_size before allocations
...
Fixes: Leaks
Fixes: 15349/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5102530557640704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 172a43ce36 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-05 19:34:33 +02:00
Michael Niedermayer
772d91d6b0
avcodec/mss1: check for overread and forward errors
...
Fixes: Timeout (106sec -> 14ms)
Fixes: 15576/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSS1_fuzzer-5688080461201408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 43015afd7c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-05 19:34:33 +02:00
Michael Niedermayer
11f01ad26c
avcodec/loco: Check for end of input in pixel decode
...
Fixes: Timeout (100sec -> 5sec)
Fixes: 15509/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5724297261219840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8305a4509a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-05 19:34:33 +02:00
Michael Niedermayer
3a3c02be9a
avcodec/dirac_parser: Fix overflow in dts
...
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 15568/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5634719611355136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 549fcba8fc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-05 19:34:33 +02:00
Michael Niedermayer
5764b92f82
avcodec/ralf: Fix undefined pointer in decode_channel()
...
Fixes: 16203/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5086088934195200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3c06ba1716 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-05 19:34:33 +02:00
Michael Niedermayer
414144a371
avcodec/ralf: Fix integer overflow in apply_lpc()
...
Fixes: signed integer overflow: 1603085316 + 1238786562 cannot be represented in type 'int'
Fixes: 16203/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5086088934195200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ccca484324 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-05 19:34:33 +02:00
Michael Niedermayer
8b95d93e07
avcodec/vorbisdec: Implement vr->classifications = 1
...
It appears no valid file uses this, so this is not testable with
a valid file.
Fixes: assertion failure
Fixes: 16187/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5638880618872832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5a5f12e3b3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-05 19:34:33 +02:00
Michael Niedermayer
4c16a8fe67
avcodec/vorbisdec: Check parameters in vorbis_floor0_decode() before divide
...
Fixes: division by zero
Fixes: 16183/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5688966782648320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aecc9b96d6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-05 19:34:33 +02:00
Michael Niedermayer
f9597a5a11
avformat/realtextdec: Check for duplicate extradata in realtext_read_header()
...
Fixes: memleak
Fixes: 16140/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5684008052064256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 652ea23cb3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-05 19:34:33 +02:00
Michael Niedermayer
8d17180884
avformat/vividas: Fix memleak of AVIOContext in track_header()
...
Fixes: memleak
Fixes: 16127/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5649290914955264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 76133d7c8b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-05 19:34:33 +02:00
Michael Niedermayer
f06fced6df
avcodec/cbs_av1_syntax_template: Check ref_frame_idx before use
...
Fixes: index -1 out of bounds for type 'AV1ReferenceFrameState [8]'
Fixes: 16079/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5758807440883712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
See: [FFmpeg-devel] [PATCH 05/13] avcodec/cbs_av1_syntax_template: Check ref_frame_idx before use
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8174e5c77d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-05 19:34:33 +02:00
Michael Niedermayer
739f93ebe1
avcodec/apedec: Fix 2 signed overflows
...
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int'
Fixes: signed integer overflow: 2049431315 + 262759074 cannot be represented in type 'int'
Fixes: 16012/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5719016003338240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 392c028cd2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-05 19:34:33 +02:00
Michael Niedermayer
8b8f5fd05e
avcodec/mss3: Check for the rac stream being invalid in rac_normalize()
...
Fixes: out of array read
Fixes: 15982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSA1_fuzzer-5630676251967488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 99a172f3f4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-05 19:34:33 +02:00
Michael Niedermayer
889fdc690a
avcodec/vc1_block: Check get_vlc2() return before use
...
Fixes: index -1 out of bounds for type 'const uint8_t [185][2]'
Fixes: 15720/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSS2_fuzzer-5666071933091840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2cb1f79735 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-05 19:34:33 +02:00
Michael Niedermayer
25aa7ddd31
avcodec/apedec: Do not partially clear data array
...
Fixes: Assertion failure and memleak
Fixes: 15709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5182435093905408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e4b522c91 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-05 19:34:33 +02:00
Michael Niedermayer
99ecd0cfc9
avcodec/atrac9dec: Check grad_range[1] more tightly
...
Alternatively the array could be made bigger but the extra values
would not be read without other changes.
Fixes: Out of array access
Fixes: 15658/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5738260074070016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 208225bd78 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-05 19:34:33 +02:00
Andreas Rheinhardt
fc6f02b297
compat/cuda: Change inclusion guards
...
cuda_runtime.h as well as dynlink_loader.h used nonstandard inclusion
guards with an AV_ prefix, although these files are not in an libav*/
path. So change the inclusion guards and adapt the ref file of the
source fate test accordingly.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2019-08-05 12:11:48 +02:00
Michael Niedermayer
d09370b060
avcodec/hnm4video: Forward errors of decode_interframe_v4()
...
Fixes: Timeout (108sec -> 160ms)
Fixes: 15570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HNM4_VIDEO_fuzzer-5085482213441536
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9af8ce754b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-04 21:16:28 +02:00
Michael Niedermayer
c74712dae3
avformat/vividas: Check that value from ffio_read_varlen() does not overflow
...
Fixes: signed integer overflow: -1241665686 + -1340629419 cannot be represented in type 'int'
Fixes: 15922/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5692826442006528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 07357cd933 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-04 21:16:28 +02:00
Michael Niedermayer
7ce1e57c01
avformat/vividas: forward errors from track_header()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8bac648359 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-04 21:16:28 +02:00
Michael Niedermayer
c8dea60fca
avcodec/clearvideo: fix invalid shift in tile size check
...
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 15631/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CLEARVIDEO_fuzzer-5690110605000704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5dc94924d0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-04 21:16:28 +02:00
Michael Niedermayer
c9322598f4
avformat/vividas: Check buffer size before allocation
...
Fixes: out of array access
Fixes: 15365/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5716153105645568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c3ef24d9ba )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-04 21:16:28 +02:00
Michael Niedermayer
4f57240859
avformat/vividas: Check if extradata was read successfully
...
Fixes: OOM
Fixes: 15575/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5654666781655040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e41675e18 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-04 21:16:28 +02:00
Michael Niedermayer
44119e5ad6
avcodec/vp3: Check for end of input in vp4_unpack_vlcs()
...
Fixes: Timeout (too long -> 1sec)
Fixes: 15232/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP3_fuzzer-5769583086010368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 58c7f419ce )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-04 21:16:28 +02:00
Michael Niedermayer
7821480db5
avcodec/vp3: Check that theora is theora
...
Theora is forced to be non zero if it is zero and a sample
is asked for, as suggested by reimar
Fixes: Timeout (2min -> 600ms)
Fixes: 15366/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-5737849938247680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b4bf7226af )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-04 21:16:28 +02:00
Michael Niedermayer
7f71ebded4
avcodec/vc1_pred: Fix invalid shift in scaleforsame()
...
Fixes: left shift of negative value -1
Fixes: 15531/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5759556258365440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6dfda35dd2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-04 21:16:28 +02:00
Michael Niedermayer
4739a62451
avcodec/vc1_block: Fix integer overflow in ff_vc1_pred_dc()
...
Fixes: signed integer overflow: 32796 * 65536 cannot be represented in type 'int'
Fixes: 15430/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5735424087031808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f31ed8f3b0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-04 21:16:28 +02:00
Michael Niedermayer
a2c8df28c9
avcodec/truemotion2: Fix several integer overflows in tm2_motion_block()
...
Fixes: 15524/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5173148372172800
Fixes: signed integer overflow: 13701388 - -2134868270 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9a353ea876 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-04 21:16:28 +02:00
Michael Niedermayer
f30d67341e
avcodec/apedec: make left/right unsigned to avoid undefined behavior
...
Fixes: signed integer overflow: 755176387 + 1515360583 cannot be represented in type 'int'
Fixes: 15506/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5706859232624640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf778af149 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-04 21:16:28 +02:00
Michael Niedermayer
a33fd08266
avcodec/apedec: Fix multiple integer overflows and undefined behaviorin filter_3800()
...
Fixes: left shift of negative value -4
Fixes: signed integer overflow: -15091694 * 167 cannot be represented in type 'int'
Fixes: signed integer overflow: 1898547155 + 453967445 cannot be represented in type 'int'
Fixes: 15258/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5759095564402688
Fixes: signed integer overflow: 962196438 * 31 cannot be represented in type 'int'
Fixes: 15364/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5718799845687296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 267eb2ab7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-04 21:16:28 +02:00
Michael Niedermayer
5fa0b18c95
avformat/mpc: deallocate frames array on errors
...
Fixes: memleak on error path
Fixes: 15984/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5679918412726272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit da5039415c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-04 21:16:28 +02:00
Michael Niedermayer
8a03611020
avcodec/eatqi: Check for minimum frame size
...
The minimum header is 8 bytes, the smallest bitstream that is passed to
the MB decode code is 4 bytes
Fixes: Timeout (35sec -> 18sec)
Fixes: 15800/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATQI_fuzzer-5684154517159936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5ffb8e8793 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-04 21:16:28 +02:00
Michael Niedermayer
6b04a5dd2d
avcodec/eatgv: Check remaining size after the keyframe header
...
The minimal size which unpack() will not fail on is 5 bytes
Fixes: Timeout (14sec -> 77ms) (testcase 15508)
Fixes: 15508/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATGV_fuzzer-5700053513011200
Fixes: 15996/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATGV_fuzzer-5751353223151616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 009ec8dc33 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-04 21:16:28 +02:00
Michael Niedermayer
8d2e23508f
avcodec/assdec: undefined use of memcpy()
...
Fixes: null pointer passed as argument 2, which is declared to never be null
Fixes: 16008/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SSA_fuzzer-5650582821404672 (this is a separate issue found in this testcase)
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47b6ca0b02 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-04 21:16:28 +02:00
Michael Niedermayer
598496e50c
avcodec/brenderpix: Check input size before allocating image
...
An incomplete image is not supported prior to this and will
not produce any output. This commit moves the failure before
time consuming operations.
Fixes: Timeout (81sec -> 76ms)
Fixes: 15723/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BRENDER_PIX_fuzzer-5147265653538816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38b6c48c43 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-04 21:16:28 +02:00
Matt Wolenetz
907027a4f2
lafv/wavdec: Fail bext parsing on incomplete reads
...
avio_read can successfully return even when less than the requested
amount of input was read. wavdec's bext parsing mistakenly assumed a
successful avio_read always read the full amount that was requested.
The result could be dictionary tags populated with partially
uninitialized values.
This change also fixes a broken assertion in wav_parse_bext_string that
was off-by-one, though no known current usage of that method hits that
broken case.
Chromium bug: 987270
Signed-off-by: Matt Wolenetz <wolenetz@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 052d41377a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-04 21:16:28 +02:00
Michael Niedermayer
9cb0da0bfe
avcodec/utils: fix leak of subtitle_header on error path
...
Fixes: memleak
Fixes: 15528/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_STL_fuzzer-5735993371525120
Fixes: 15792/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SAMI_fuzzer-5737754232619008
Fixes: 16008/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SSA_fuzzer-5650582821404672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 923d5c489f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-08-04 21:16:28 +02:00
Rodger Combs
86de65fbf0
build: add support for building CUDA files with clang
...
This avoids using the CUDA SDK at all; instead, we provide a minimal
reimplementation of the basic functionality that lavfi actually uses.
It generates very similar code to what NVCC produces.
The header contains no implementation code derived from the SDK.
The function and type declarations are derived from the SDK only to the
extent required to build a compatible implementation. This is generally
accepted to qualify as fair use.
Because this option does not require the proprietary SDK, it does not require
the "--enable-nonfree" flag in configure.
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2019-08-04 19:16:59 +02:00
Stefan Schoenefeld
e33ea0f503
avcodec/h263dec: enable nvdec hwaccel
...
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2019-08-04 16:19:25 +02:00
Stefan Schoenefeld
af3541fc7e
avcodec/h263dec: fix hwaccel decoding
...
Recently we encountered an issue when decoding a h.263 file:
FFmpeg will freeze when decoding h.263 video with NVDEC. Turns out this is not directly related to NVDEC but is a problem that shows with several other HW decoders like VDPAU, though the exact kind of error is different (either error messages or freezing[1]). The root cause is that ff_thread_finish_setup() is called twice per frame from ff_h263_decode_frame(). This is not supported by ff_thread_finish_setup() and specifically checked for and warned against in the functions code. The issue is also specific to hw accelerated decoding only as the second call to ff_thread_finish_setup() is only issued when hw acceleration is on. The fix is simple: add a check that the first call is only send when hw acceleration is off, and the second call only when hw acceleration is on (see attached patch). This works fine as far as I was able to test with vdpau and nvdec/nvcuvid hw decoding. The patch also adds NVDEC to the hw config list if available.
I also noticed a secondary issue when browsing through the code which is that, according to documentation, ff_thread_finish_setup() should only be called if the codec implements update_thread_context(), which h263dec does not. The patch does not address this and I'm not sure any action needs to be taken here at all.
[1] This is depending on whether or not the hw decoder sets the HWACCEL_CAPS_ASYNC_SAFE flag
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2019-08-04 16:19:23 +02:00
Rodger Combs
6a5ed71d36
lavfi/vf_thumbnail_cuda: fix operator precedence bug
...
Discovered via a warning when building with clang
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2019-07-30 15:18:31 +02:00
Matthieu Bouron
1df4a99e89
avcodec/mediacodec_wrapper: remove unused local variables in ff_AMediaCodec_getCodecNameByType()
...
(cherry picked from commit 817235b195 )
2019-07-26 18:28:37 +02:00
Matthieu Bouron
3abec7f397
avcodec/mediacodec_wrapper: fix a potential local reference leak in ff_AMediaCodec_getCodecNameByType()
...
(cherry picked from commit 3f232d713d )
2019-07-26 18:28:29 +02:00
Matthieu Bouron
a3d986ff47
avcodec/mediacodec_wrapper: fix a local reference leak in ff_AMediaCodec_getName()
...
(cherry picked from commit 9cb8875c16 )
2019-07-26 18:28:20 +02:00
Matthieu Bouron
65434823a1
avcodec/mediacodec_wrapper: add missing "avcodec.h" include
...
(cherry picked from commit 6251ad89a7 )
2019-07-26 18:28:15 +02:00
Baptiste Coudurier
c60e1d6be5
avformat/mxfenc: fix index byte count in partition header
...
(cherry picked from commit 9e24b98b15 )
2019-07-22 23:27:11 +02:00
Michael Niedermayer
7c4064d9df
Update for version 4.2
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-21 18:58:41 +02:00
Michael Niedermayer
984950cc99
RELEASE_NOTES: Based on the version from 4.1
...
Name suggested by Reto Kromer and Bodecs Bela
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-07-21 18:58:41 +02:00