Andreas Rheinhardt
df000208ea
libavcodec/libvpxenc: Don't free user-provided AVPacket
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 26b4509690 )
2020-05-23 21:34:02 +02:00
Andreas Rheinhardt
021fe2603f
avcodec/libopusenc: Don't free user-provided AVPacket
...
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit b803993b6d )
2020-05-23 21:33:57 +02:00
Andreas Rheinhardt
e631660726
avformat/matroskadec: Fix default value of BlockAddID
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit dbc50f8a93 )
2020-04-03 23:17:39 +02:00
Mark Harris
b858bcbbf6
avutil/mem: Fix invalid use of av_alloc_size
...
The alloc_size attribute is valid only on functions that return a
pointer. GCC 9 (not yet released) warns about invalid usage:
./libavutil/mem.h:342:1: warning: 'alloc_size' attribute ignored on a function returning int' [-Wattributes]
342 | av_alloc_size(2, 3) int av_reallocp_array(void *ptr, size_t nmemb, size_t size);
| ^~~~~~~~~~~~~
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4361293fcf )
2019-07-23 01:18:14 -03:00
James Almer
b307cbe276
avcodec/hevcdec: decode at most one slice reporting being the first in the picture
...
Fixes deadlocks when decoding packets containing more than one of the aforementioned
slices when using frame threads.
Tested-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 70c8c8a818 )
2019-03-20 22:23:12 -03:00
Paul B Mahol
bdcbe9296a
avfilter/af_silenceremove: fix possible crash if supplied duration is negative
...
Signed-off-by: Paul B Mahol <onemda@gmail.com >
Fixes ticket #7697 .
(cherry picked from commit 2d1594a8d6 )
2019-01-25 00:53:39 +01:00
Michael Niedermayer
527e64d32c
Changelog: Update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 00:24:53 +02:00
Michael Niedermayer
15296d64ca
avutil/integer: Fix integer overflow in av_mul_i()
...
Found-by: fate
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3cc3cb663b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-25 00:24:54 +02:00
Michael Niedermayer
82e796a4c9
avcodec/msrle: Check that the input is large enough to contain a end of picture code
...
Fixes: Timeout
Fixes: 10625/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSRLE_fuzzer-5659651283091456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 203ccb8746 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-25 00:24:29 +02:00
Michael Niedermayer
1dbf2bc7a9
Update for 3.0.12
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 02:15:08 +02:00
Michael Niedermayer
dd5232c838
avcodec/jpeg2000dec: Fix off by 1 error in JPEG2000_PGOD_CPRL handling
...
Fixes: assertion failure
Fixes: 10785/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5672160496975872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 305e523105 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:41 +02:00
Michael Niedermayer
9c1bb7e8de
avcodec/mpeg4videodec: Fix typo in sprite delta check
...
Fixes: Integer overflow
Fixes: 10890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5636062181851136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b737317a88 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:41 +02:00
Michael Niedermayer
f9cfdf2bae
avcodec/h264_cavlc: Check mb_skip_run
...
Fixes: 10300/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-6292205497483264
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f72b9904fe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:41 +02:00
Michael Niedermayer
b15db639a5
avcodec/ra144: Fix integer overflow in add_wav()
...
Fixes: signed integer overflow: -2144033225 + -5208934 cannot be represented in type 'int'
Fixes: 10633/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-5679133791617024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c6282141cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:41 +02:00
Michael Niedermayer
6a5b0a3c75
avformat/utils: Never store negative values in last_IP_duration
...
Fixes: integer overflow compute_pkt_fields()
Fixes: compute_pkt_usan
Reported-by: Thomas Guilbert <tguilbert@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 079d1a7175 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:41 +02:00
Michael Niedermayer
51404bb4f6
avformat/utils: Fix integer overflow in discontinuity check
...
Fixes: signed integer overflow: 7738135736989908991 - -7954308516317364223 cannot be represented in type 'long'
Fixes: find_stream_info_usan
Reported-by: Thomas Guilbert <tguilbert@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4e19cfcfa3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:41 +02:00
Michael Niedermayer
4b14c3ed78
avcodec/unary: Improve get_unary() docs
...
Found-by: kierank
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ad89e203bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:41 +02:00
Michael Niedermayer
9b95c4740d
avcodec/dvdsubdec: Sanity check len in decode_rle()
...
Fixes: Timeout
Fixes: 9778/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVDSUB_fuzzer-5186007132536832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e7b023e1db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:41 +02:00
Michael Niedermayer
58cb3ad576
avcodec/mpeg4videodec: Fix undefined shift in get_amv()
...
Fixes: runtime error: shift exponent -1 is negative
Fixes: 9938/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5653783529914368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c88afa44c4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:41 +02:00
Michael Niedermayer
648b904662
avcodec/zmbv: Check that the decompressed data size is correct
...
This checks the value exactly for intra frames and checks it against a
minimum for inter frames as they can be variable.
Fixes: Timeout
Fixes: 10182/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZMBV_fuzzer-6245951174344704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e33b28cc79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:41 +02:00
Michael Niedermayer
6161aade4c
avcodec/zmbv: Update decomp_len in raw frames
...
decomp_len is used in raw frames, so it should not be left at the value from
whatever was decoded previously (which may be any other frame)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d201b83cd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
1ed6224cdf
avcodec/shorten: Fix bitstream end check in read_header()
...
Fixes: Timeout
Fixes: 9961/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5687856176562176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 28b80c2d52 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
1049ccec34
avcodec/dvdsubdec: Avoid branch in decode_run_8bit()
...
Speed improvment 35.5 sec -> 34.7sec
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 71bf033050 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
fcab1b996a
avcodec/h264_refs: Document last if() in ff_h264_execute_ref_pic_marking()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 697984b9db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
fceedd4de9
avcodec/ra144: Fix undefined integer overflow in add_wav()
...
Fixes: signed integer overflow: -26884 * 91439 cannot be represented in type 'int'
Fixes: 9687/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-4995588121690112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93a203662f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
23c5d8d9ce
avcodec/hq_hqa: Check remaining input bits in hqa_decode_mb()
...
Fixes: Timeout
Fixes: 9634/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-6267852259590144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9222b972d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
c2ac8d3147
avcodec/vb: Check for end of bytestream before reading blocktype
...
Fixes: Timeout
Fixes: 9601/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VB_fuzzer-4550228702134272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1cbac9ce20 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
22f743e602
avcodec/snowdec: Fix integer overflow with motion vector residual
...
Fixes: signed integer overflow: -19818 + -2147483648 cannot be represented in type 'int'
Fixes: 9545/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-4928769537081344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit acba153a14 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
172bb520c9
avformat/nsvdec: Do not parse multiple NSVf
...
The specification states "NSV files may contain a single file header. "
Fixes: out of array access
Fixes: nsv-asan-002f473f726a0dcbd3bd53e422c4fc40b3cf3421
Found-by: Paul Ch <paulcher@icloud.com >
Tested-by: Paul Ch <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 78d4b6bd43 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
4babf70c7e
avformat/mlvdec: read_string() received unsigned size, make the argument unsigned
...
Fixes: infinite loop
Fixes: mlv-timeout-e3b8cab9835edecad6823baa057e029671329d04
Found-by: Paul Ch <paulcher@icloud.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e71cb2c8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
0ea54cae21
avformat/rmdec: Fix EOF check in the stream loop in ivr_read_header()
...
Fixes: long running loop
Fixes: ivr-timeout-42468cb797f52f025fb329394702f5d4d64322d6
Found-by: Paul Ch <paulcher@icloud.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c2eec1762d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
f1425b389a
avcodec/shorten: Fix integer overflow in residual/LPC combination
...
Fixes: signed integer overflow: -540538872 + -2012739576 cannot be represented in type 'int'
Fixes: 9255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5758630052757504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit db7e9082e1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
5eeaaa29fa
avcodec/shorten: Check verbatim length
...
Fixes: Timeout
Fixes: 9252/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5780720709533696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7007dabec0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
f7778c2ce9
avcodec/mpegaudio_parser: Initialize poutbuf*
...
Possibly fixes: null pointer dereference
Possibly fixes: 9352/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP3ADUFLOAT_fuzzer-5146068961460224
Fixes: Heap-use-after-free
Fixes: 9453/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP3ADUFLOAT_fuzzer-5137954375729152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0f4c3b0b8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
f6e570aa01
avcodec/aacpsdsp_template: Fix integer overflow in ps_stereo_interpolate_c()
...
Fixes: signed integer overflow: -1813244069 + -1407981383 cannot be represented in type 'int'
Fixes: 8823/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5643295618236416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47db5763e2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
f81fd4c524
avcodec/qtrle: Check remaining bytestream in qtrle_decode_XYbpp()
...
Fixes: Timeout
Fixes: 9213/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QTRLE_fuzzer-5649753332252672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7dd836a3f9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
9f18b056da
avcodec/diracdec: Check bytes count in else branch in decode_lowdelay() too
...
Fixes: signed integer overflow: 8 * 340018243 cannot be represented in type 'int'
Fixes: 9441/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5194665207791616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bed125b710 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
cc82d22289
avcodec/diracdec: Change frame_number to 64bit as its a 32bit from the bitstream and we also have a -1 special case
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 9291/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-6324345860259840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 462d1be6de )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
86dfce06e3
avcodec/dirac_dwt_template: Fix several integer overflows in horizontal_compose_daub97i()
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 8926/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-6047609228623872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 69cac9e130 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
057cfa4200
avcodec/diracdec: Prevent integer overflow in intermediate in global_mv()
...
Fixes: signed integer overflow: -393471 * 5460 cannot be represented in type 'int'
Fixes: 8890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-6299775379963904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5129040646 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
d7d54f3fd5
swresample/swresample: Fix input channel count in resample_first computation
...
Found-by: Marcin Gorzel <gorzel@google.com >
Reviewed-by: Marcin Gorzel <gorzel@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bce4da85e8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
60493f388c
avutil/pixfmt: Document chroma plane size for odd resolutions
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be0b77e6e8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
961eeb4035
avcodec/dvdsub_parser: Allocate input padding
...
Fixes: out of array read
Fixes: 9350/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVDSUB_fuzzer-5746777750765568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cd86b5cfe2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
d7d237a441
avcodec/dvdsub_parser: Init output buf/size
...
No testcase
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e6c843776 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Simon Thelen
e7dc6231e2
avcodec/imgconvert: fix possible null pointer dereference
...
regression since 354b26a394
(cherry picked from commit 8c2c97403b )
(cherry picked from commit c1e172c2e1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
0c9c4c3103
avcodec/dirac_dwt_template: Fix signedness regression in interleave()
...
Found-by: <jdarnley>
Tested-by: James Darnley <james.darnley@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 181435a4de )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Rahul Chaudhry
328ab7f0a1
swresample/arm: rename labels to fix xcode build error
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e84212b78e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
James Almer
0d4a11d0a9
avformat/utils: fix mixed declarations and code
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 31de45d20b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
James Almer
c3831e89ef
libwebpenc_animencoder: add missing braces to struct initialization
...
The first member of the WebPAnimEncoderOptions struct is non scalar
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 488e6409df )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
790e6fead0
avformat/movenc: Check input sample count
...
Fixes: division by 0
Fixes: fpe_movenc.c_199_1.wav
Fixes: fpe_movenc.c_199_2.wav
Fixes: fpe_movenc.c_199_3.wav
Fixes: fpe_movenc.c_199_4.wav
Fixes: fpe_movenc.c_199_5.wav
Fixes: fpe_movenc.c_199_6.wav
Fixes: fpe_movenc.c_199_7.wav
Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a2d21bc5f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
4ead5a9470
avcodec/mjpegdec: Check for odd progressive RGB
...
Fixes: out of array access
Fixes: 9225/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-5684770334834688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ee1e3ca5eb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
469503ac1d
avformat/movenc: Check that frame_types other than EAC3_FRAME_TYPE_INDEPENDENT have a supported substream id
...
Fixes: out of array access
Fixes: ffmpeg_bof_1.avi
Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ed22dc2221 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
94edbf464c
avformat/mms: Add missing chunksize check
...
Fixes: out of array read
Fixes: mms-crash-01b6c5d85f9d9f40f4e879896103e9f5b222816a
Found-by: Paul Ch <paulcher@icloud.com >
1st hunk by Paul Ch <paulcher@icloud.com >
Tested-by: Paul Ch <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cced03dd66 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
6cadf46dff
avformat/pva: Check for EOF before retrying in read_part_of_packet()
...
Fixes: Infinite loop
Fixes: pva-4b1835dbc2027bf3c567005dcc78e85199240d06
Found-by: Paul Ch <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9807d3976b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
ee8c6566e2
avformat/rmdec: Do not pass mime type in rm_read_multi() to ff_rm_read_mdpr_codecdata()
...
Fixes: use after free()
Fixes: rmdec-crash-ffe85b4cab1597d1cfea6955705e53f1f5c8a362
Found-by: Paul Ch <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a7e032a277 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
438e848b65
avcodec/indeo4: Check for end of bitstream in decode_mb_info()
...
Fixes: Timeout
Fixes: 8776/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-5361788798369792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 267ba2aa96 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
21a6570158
avcodec/shorten: Fix undefined addition in shorten_decode_frame()
...
Fixes: signed integer overflow: 1139785606 + 1454196085 cannot be represented in type 'int'
Fixes: 8937/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-6202943597445120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3b10bb8772 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
3afdb1c8a7
avcodec/jpeg2000dec: Fixes invalid shifts in jpeg2000_decode_packets_po_iteration()
...
Fixes: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 9163/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5661750182543360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 652d7c6348 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
405cfcae41
avcodec/jpeg2000dec: Check that there are enough bytes for all tiles
...
Fixes: OOM
Fixes: 8781/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5810709081358336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0898a3d990 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
dd7d2770f3
avcodec/escape124: Fix spelling errors in comment
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f59c4e4391 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
181c3d82e9
avcodec/ra144: Fix integer overflow in ff_eval_refl()
...
Fixes: signed integer overflow: -4096 * -524288 cannot be represented in type 'int'
Fixes: 8650/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-5734816036159488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b31189881a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
662f7cef06
avcodec/cscd: Check output buffer size for lzo.
...
Fixes: Timeout
Fixes: 8665/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CSCD_fuzzer-5768442610188288
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit 78167b498f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
1e067b7ed8
avcodec/escape124: Check buf_size against num_superblocks
...
Fixes: Timeout
Fixes: 8722/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-4843268402577408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6677c98626 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
d862380718
avcodec/mjpegdec: Check for end of bitstream in ljpeg_decode_rgb_scan()
...
Fixes: Timeout
Fixes: 8648/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5108395525799936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 540e8c2d64 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
eaefd3ada9
avcodec/aacdec_fixed: Fix undefined integer overflow in apply_independent_coupling_fixed()
...
Fixes: signed integer overflow: 1195517 * 2048 cannot be represented in type 'int'
Fixes: 8636/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-4695836326887424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8bd514d934 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
a1c125d2bd
avcodec/dirac_dwt_template: Fix undefined behavior in interleave()
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 8697/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5197148130902016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 575d8ca026 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
626143903b
avutil/common: Fix undefined behavior in av_clip_uintp2_c()
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 8521/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5639024952737792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa41d322be )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
963915a4b4
fftools/ffmpeg: Fallback to duration if sample rate is unavailable
...
Regression since: af1761f7
Fixes: Division by 0
Fixes: ffmpeg_crash_1
Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 16d8b13b3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
ff75dc10fd
avformat/mov: Only set pkt->duration to non negative values
...
Reviewed-by: Sasi Inguva <isasi@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8176799f31 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
18214e2a3f
avcodec/h264_mc_template: Only prefetch motion if the list is used.
...
Fixes: index 59 out of bounds for type 'H264Ref [48]'
Fixes: 8232/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5703295145345024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b55591757 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
aa803d93bf
avcodec/xwddec: Use ff_set_dimensions()
...
Fixes: OOM
Fixes: 8178/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XWD_fuzzer-4844793342459904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c2852e4e00 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
23fdebaec5
avcodec/wavpack: Fix overflow in adding tail
...
Fixes: signed integer overflow: 2146907204 + 26846088 cannot be represented in type 'int'
Fixes: 8105/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-6233036682166272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d13379fb79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
50e55b81be
avcodec/shorten: Fix multiple integer overflows
...
Fixes: signed integer overflow: 3 * 1006632960 cannot be represented in type 'int'
Fixes: 8278/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5692857166856192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f2abd36b38 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
07fd8627e5
avcodec/shorten: Sanity check nmeans
...
Fixes: OOM
Fixes: 8195/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5179785826271232
The reference software appears to use longs for 32bits and it uses int for nmeans
hinting that the intended maximum size was not 32bit.
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d91a0b503d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
0c645bd73c
avcodec/mjpegdec: Fix integer overflow in ljpeg_decode_rgb_scan()
...
Fixes: signed integer overflow: 32768 + 2147450880 cannot be represented in type 'int'
Fixes: 7885/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-5298834394578944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 936f4a2c2e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
aee71463fb
avcodec/truemotion2: Fix overflow in tm2_apply_deltas()
...
Fixes: signed integer overflow: 1077952576 + 1077952576 cannot be represented in type 'int'
Fixes: 7712/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5056281753681920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 79c6047c36 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
f144d5eb49
avcodec/opus_silk: Change silk_lsf2lpc() slightly toward silk/NLSF2A.c
...
Fixes: runtime error: signed integer overflow: -1440457022 - 785819492 cannot be represented in type 'int'
Fixes: 7700/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OPUS_fuzzer-6595838684954624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e7dda51150 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
bbd9f480f3
avcodec/amrwbdec: Fix division by 0 in find_hb_gain()
...
This restructures the code slightly toward D_UTIL_dec_synthesis()
Fixes: 7420/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMRWB_fuzzer-6577305112543232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dce80a4b47 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
7f142e5402
avformat/mov: replace a value error by clipping into valid range in mov_read_stsc()
...
Fixes : #7165
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fe84f70819 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
b4024909c1
avformat/mov: Break out early if chunk_count is 0 in mov_build_index()
...
Without this some operations might overflow (undefined behavior)
even though the index adding loop would never execute
No testcase known
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 56e76bd057 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
fe9c23bebb
avcodec/fic: Avoid some magic numbers related to cursors
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c6a11714c4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
243bdbde57
avcodec/g2meet: ask for sample with overflowing RGB
...
Suggested-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab834b8f36 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
1f81818c6a
avcodec/aacdec_fixed: use 64bit to avoid overflow in rounding in apply_dependent_coupling_fixed()
...
Fixes: signed integer overflow: -2141499320 + -14469590 cannot be represented in type 'int'
Fixes: 7351/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-6351214791884800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 90475db97e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
be77d7ba78
oavcodec/aacpsdsp_template: Use unsigned for hs0X to prevent undefined behavior
...
Fixes: signed integer overflow: 1073741842 + 1784008138 cannot be represented in type 'int'
Fixes: 6792/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5677589835284480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 62cb6fadf3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
fe37daf25d
avcodec/g723_1dec: Clip bits2 in both directions
...
Fixes: shift exponent 33 is too large for 32-bit type 'int'
Fixes: 6743/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G723_1_fuzzer-5823772687859712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53f241218d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
0d58511013
avcodec/mpeg4videoenc: Use 64 bit for times in mpeg4_encode_gop_header()
...
Fixes truncation
Fixes Assertion n <= 31 && value < (1U << n) failed at libavcodec/put_bits.h:169
Fixes: ffmpeg_crash_2.avi
Found-by: Thuan Pham <thuanpv@comp.nus.edu.sg >, Marcel Böhme, Andrew Santosa and Alexandru RazvanCaciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e1182fac1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
3eff19d388
avcodec/mlpdec: Only change noise_type if the related fields are valid
...
Fixes: inconsistency
Fixes:runtime error: index 8 out of bounds for type 'int32_t [8]'
Fixes: 6686/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-5191383498358784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 63c4a4b0d6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
876d3ee862
indeo4: Decode all or nothing of a band header.
...
This avoids inconsistent value combinations.
Alternatively it would be possible to add more checks and careful use of
temporary variables, but my try of this quickly seemed to become
a rather large change.
The disadvantage of this, is that the struct is copied back and forth.
Fixes: index 6 out of bounds for type 'const uint16_t [5][16]'
Fixes: 6557/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-4787296550256640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 10c8521265 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
ffe4ffa4ef
avformat/mov: Only fail for STCO/STSC contradictions if both exist
...
Fixes regression with playback of GF9720Repeal20the20Eighth20with20Helen20Linehan.m4a
See: crbug 822666
Found-by: "Mattias Wadman <mattias.wadman@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c2d689c56 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
a8fcb810c9
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD97iH0 / COMPOSE_DD137iL0
...
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int');
Fixes: 6500/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-4523620274536448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cb944fc7f1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
1747563cea
avcodec/fic: Check available input space for cursor
...
Fixes: out of array read
Fixes: 6546/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FIC_fuzzer-6317064647081984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cb2f7ea96b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
00c18862a3
avcodec/g2meet: Check RGB upper limit
...
Fixes: runtime error: left shift of 1876744317 by 16 places cannot be represented in type 'int'
Fixes: 6799/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5115274731716608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4dd2c8b9ea )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
6850377b59
avcodec/jpeg2000dec: Fix undefined shift in the jpeg2000_decode_packets_po_iteration() CPRL case
...
Fixes: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 7955/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-6016721977606144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 652ba72ed3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
6aae60cc7d
avcodec/jpeg2000dec: Skip init for component in CPRL if nothing is to be done
...
Fixes: assertion failure
Fixes: 7949/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-4819602782552064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a96c131eb5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
88e5a30cf8
avcodec/g2meet: Change order of operations to avoid undefined behavior
...
Fixes: signed integer overflow: 65280 * 196032 cannot be represented in type 'int'
Fixes: 7279/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5977332473921536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a47451458 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
9505b28538
avcodec/flac_parser: Fix infinite loop
...
Fixes: crbug/827204
Reported-by: Frank Liberato <liberato@google.com >
Reviewed-by: Frank Liberato <liberato@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 15a2e35e9e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
04e69effbb
avcodec/wavpack: Fix integer overflow in DEC_MED() / INC_MED()
...
Fixes: runtime error: signed integer overflow: 2147483637 + 128 cannot be represented in type 'int'
Fixes: 6701/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5358324934508544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6e95d80e6f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
baa4913e12
avcodec/error_resilience: Fix integer overflow in filter181()
...
Fixes: runtime error: signed integer overflow: 197710 * 10923 cannot be represented in type 'int'
Fixes: 7010/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5667127596941312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1c97035e3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
aaa2d4a265
avcodec/h263dec: Check slice_ret in mspeg4 slice loop
...
Fixes infinite loop
Fixes: 6858/clusterfuzz-testcase-ffmpeg_AV_CODEC_ID_MSMPEG4V3_fuzzer-4681563766784000
Fixes: 6890/clusterfuzz-testcase-ffmpeg_AV_CODEC_ID_WMV1_fuzzer-4756103142309888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit de841fbea7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
cc8710b5af
avcodec/elsdec: Fix memleaks
...
Fixes: 6798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5135899701542912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0bd0401336 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
70c7c73920
avcodec/vc1_block: simplify ac_val computation
...
also fixes: runtime error: index 1456 out of bounds for type 'int16_t [16]'
Found-by: durandal_1707
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d06b01fc2d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
142e1e3e9a
avcodec/ffv1enc: Check that the crc + version combination is supported
...
The crc flag is only stored since version 3 thus before this crcs do not
work. We increase the version as needed same as we do with pix_fmts
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d9706f79c1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Stephan Holljes
73d07e320c
lavf/http.c: Free allocated client URLContext in case of error.
...
Signed-off-by: Stephan Holljes <klaxa1337@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b6b8c9265 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
3bf0a405f0
avcodec/dsicinvideo: Fail if there is only a small fraction of the data available that comprises a full frame
...
Fixes: Timeout
Fixes: 6306/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DSICINVIDEO_fuzzer-5079253549842432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5549488bbf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
a8640c87a7
avcodec/dsicinvideo: Propagate errors from cin_decode_rle()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 942217b153 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
e49e8259df
avcodec/dfa: Check dimension against maximum
...
The headers from where the dimensions are read in actual files
are limited to 16bit per component.
Fixes: Timeout
Fixes: 6305/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DFA_fuzzer-4824270749302784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d5a4fcfbb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
3009bf0be6
avcodec/cinepak: Skip empty frames
...
Speeds up decoding from 3 to 0.1 seconds for 6302/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CINEPAK_fuzzer-5626371985375232
Fixes: Timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9033920bec )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
5891d222ff
avcodec/cinepak: move some checks prior to frame allocation
...
Speeds up decoding from 8 to 3 seconds for 6302/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CINEPAK_fuzzer-5626371985375232
Fixes: Timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2324ef1ff3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Rahul Chaudhry
ad3ec05d03
swresample/arm: remove unintentional relocation.
...
Branch to global symbol results in reference to PLT, and when compiling
for THUMB-2 - in a R_ARM_THM_JUMP19 relocation. Some linkers don't
support this relocation (ld.gold), while others can end up truncating
the relocation to fit (ld.bfd).
Convert this branch through PLT into a direct branch that the assembler
can resolve locally.
See https://github.com/android-ndk/ndk/issues/337 for background.
The current workaround is to disable neon during gstreamer build,
which is not optimal and can be reverted after this patch:
41556c4157
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b22db4f465 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
9665d6258c
doc/APIchanges: Fix typos in hashes
...
Thanks-to: Moritz Barsnick <barsnick@gmx.net > for finding the correct ones
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec8a5262b0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
b591673c50
avformat/utils: Check cur_dts in update_initial_timestamps() more
...
Fixes: runtime error: signed integer overflow: 18133149658382192 - -9223090561878065151 cannot be represented in type 'long long'
Fixes: crbug 831552
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 37d46dc21d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
cf321e93c4
avcodec/utils: Enforce minimum width also for VP5/6
...
Fixes: out of array access
Fixes: poc_0411
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Tested-by: GwanYeong Kim <gy741.kim@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 544324827e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
065057c8a3
avcodec/truemotion2: Propagate out of bounds error from GET_TOK()
...
Fixes: Timeout
Fixes: 6389/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5695918121680896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f6304af234 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
5aaa5bd1b0
avcodec/mjpegdec: Check input buffer size.
...
Fixes: Timeout
Fixes: 6381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-5665032743419904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8d381b57fd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Matt Wolenetz
4b04da1e52
lavc/libopusdec: Allow avcodec_open2 to call .close
...
If there is a decoder initialization failure detected in avcodec_open2
after .init is called, allow graceful decoder .close to prevent leaking
libopus decoder allocations.
BUG=828526
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e43e97f0e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
c0bb5613d4
avcodec/movtextdec: Check style_start/end
...
Limits based on 3GPP TS 26.245 V14.0.0
Fixes: Timeout
Fixes: 6377/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOVTEXT_fuzzer-5175929115508736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Philip Langdale <philipl@overt.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 249aca8f98 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
72b9ba8a5b
avcodec/aacsbr_fixed: Fix integer overflow in sbr_hf_assemble()
...
Fixes: runtime error: signed integer overflow: 2052929346 + 204817098 cannot be represented in type 'int'
This was missed in b1bef755f6
Fixes: 5275/clusterfuzz-testcase-minimized-5367635958038528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c837918f50 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
b2be78f9d2
libavcodec/rv34: error out earlier on missing references
...
Fixes visual corruption on seeking
Fixes: downloadTest_clip_24M.rmvb
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6cd81d68c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Hendrik Schreiber
da371c5b21
swresample/swresample: Fix for seg fault in swr_convert_internal() -> sum2_float during dithering.
...
Removed +len1 in call to s->mix_2_1_f() as I found no logical explanation for it. After removal, problem was gone.
Signed-off-by: Hendrik Schreiber <hs@tagtraum.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 647fd4b829 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
98096645f2
avcodec/aacdec_fixed: Fix integer overflow in apply_independent_coupling_fixed()
...
I was not able to reproduce this, this fix is based on just the fuzzer log.
Fixes: 4959/clusterfuzz-testcase-minimized-6035350934781952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 197a4e8fee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
1f648a098d
avcodec/cscd: Error out when LZ* decompression fails
...
Fixes: Timeout
Fixes: 6304/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CSCD_fuzzer-5754772461191168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d52be5d4e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
heimdallr
19379529a5
avcodec/imgconvert: Fix loss mask bug in avcodec_find_best_pix_fmt_of_list()
...
example:
AVPixelFormat pixFmts[] = { AV_PIX_FMT_RGB24, AV_PIX_FMT_RGBA };
int loss = 0;
AVPixelFormat best = avcodec_find_best_pix_fmt_of_list(pixFmts, AV_PIX_FMT_BGRA, 1, &loss);
best is AV_PIX_FMT_RGB24. But AV_PIX_FMT_RGBA is better.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 354b26a394 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
03f891c050
avcodec/wmalosslessdec: Fix null pointer dereference in decode_frame()
...
Fixes: 2018_03_23_poc.wav
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea15915b2d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
0721e3c1bd
avcodec/tableprint_vlc: Fix build failure with --enable-hardcoded-tables
...
Found-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c75438b89 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
7ccb9c37ac
avcodec/get_bits: Make sure the input bitstream with padding can be addressed
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e529fe7633 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
028af5acbe
avformat/mov: Check STSC and remove invalid entries
...
Fixes assertion failure
Fixes: crbug 822547, crbug 822666 and crbug 823009
Affects: aark15sd_9A62E2FA.mp4
Found-by: ClusterFuzz
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e67447a4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
f4fe702258
avcodec/nuv: rtjpeg with dimensions less than 16 would result in no decoded pixels thus reject it
...
Fixes: Timeout
Fixes: 6297/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-4882404863901696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 939440ad1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
e623800387
avcodec/nuv: Check for minimum input size for uncomprssed and rtjpeg
...
Fixes: Timeout
Fixes: 6297/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-4882404863901696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ee3265dbe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
448cd0d0b3
avcodec/wmalosslessdec: Reset num_saved_bits on error path
...
Fixes: NULL pointer dereference
Fixes: poc-201803.wav
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 64c9ce0abc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
30d40580c4
avformat/mov: Fix integer overflows related to sample_duration
...
Fixes: runtime error: signed integer overflow: -9166684017437101870 + -2495066639299164439 cannot be represented in type
Fixes: Chromium bug 791349
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f37082827 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
ad7c57f9db
avformat/oggparsedaala: Do not adjust AV_NOPTS_VALUE
...
Fixes: potential signed integer overflow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f655ddfb47 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
69344f628b
avformat/oggparseogm: Check lb against psize
...
No testcase, this was found during code review
Found-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3e7c847aaf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
46f37c65ab
avformat/oggparseogm: Fix undefined shift in ogm_packet()
...
Fixes: shift exponent 48 is too large for 32-bit type 'int'
Fixes: Chromium bug 786793
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 010b7b30b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
4df16ad1ef
avformat/avidec: Fix integer overflow in cum_len check
...
Fixes: signed integer overflow: 3775922176 * 4278190080 cannot be represented in type 'long'
Fixes: Chromium bug 791237
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 06e092e781 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
81a6076e4b
avformat/oggparsetheora: Do not adjust AV_NOPTS_VALUE
...
Fixes: Chromium bug 795653
Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'long'
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 02ecda4aba )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
7fd80d91f7
avformat/utils: Fix integer overflow of fps_first/last_dts
...
Fixes: runtime error: signed integer overflow: 7738135736989908991 - -7898362169240453118 cannot be represented in type 'long'
Fixes: Chromium bug 796778
Reported-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b1362e408 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
Michael Niedermayer
b8fd13befe
libavformat/oggparsevorbis: Fix memleak on multiple headers
...
Fixes: Chromium bug 800123
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3934aa495d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-23 01:44:40 +02:00
James Almer
29683c6ba1
avdevice/iec61883: free the private context at the end
...
Fixes part of ticket #7146 .
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 5079e96bcc )
2018-04-18 22:57:49 -03:00
James Almer
b949fd7a65
avdevice/iec61883: return reference counted packets
...
Fixes part of ticket #7146 , dealing with leaks of packet data since
commit 87c8812270 .
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit b8629654c6 )
2018-04-18 22:57:41 -03:00
Marton Balint
3c056989dc
avdevice/iec61883: free packet on buffer allocation error
...
Fixes Coverity CID 1396416.
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit 4556dad2b7 )
2018-04-18 22:57:26 -03:00
Michael Niedermayer
b910b34926
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-27 20:00:58 +01:00
Michael Niedermayer
add3c2468e
avcodec/bintext: sanity check dimensions
...
Fixes: Timeout
Fixes: 6277/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XBIN_fuzzer-6047202288861184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 090c0abff9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-27 19:59:58 +01:00
Michael Niedermayer
fbf690d79a
avcodec/utvideodec: Check subsample factors
...
Fixes: Out of array read
Fixes: heap_poc
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7414d0bda7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-27 19:59:58 +01:00
Michael Niedermayer
789a12b140
avcodec/smc: Check input packet size
...
Fixes: Timeout
Fixes: 6261/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMC_fuzzer-5811309653262336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0293663483 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-27 19:59:58 +01:00
Michael Niedermayer
24a3c45da5
avcodec/cavsdec: Check alpha/beta offset
...
Fixes: Integer overflow
Fixes: 6183/clusterfuzz-testcase-minimized-6269224436629504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ae2eb04648 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-27 19:59:58 +01:00
Michael Niedermayer
6822bd50c1
avcodec/diracdec: Fix integer overflow in mv computation
...
Fixes: signed integer overflow: -2072 + -2147483646 cannot be represented in type 'int'
Fixes: 6097/clusterfuzz-testcase-minimized-5034145253163008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47e65ad63b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-27 19:59:58 +01:00
Michael Niedermayer
6648d3fef6
avcodec/aacdec_templat: Fix integer overflow in apply_ltp()
...
Fixes: signed integer overflow: -1625276744 + -1041893960 cannot be represented in type 'int'
Fixes: 5948/clusterfuzz-testcase-minimized-5791479856365568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 33fe17bdc8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-27 19:59:58 +01:00
Michael Niedermayer
afc85dacba
avcodec/jpeg2000dwt: Fix integer overflows in sr_1d53()
...
Fixes: 5918/clusterfuzz-testcase-minimized-5120505435652096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 793347a545 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-27 19:59:58 +01:00
Michael Niedermayer
b4135fb335
avcodec/diracdec: Use int64 in global mv to prevent overflow
...
Fixes: runtime error: signed integer overflow: 361 * -6295541 cannot be represented in type 'int'
Fixes: 5911/clusterfuzz-testcase-minimized-6450382197751808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cbcbefdc3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-27 19:59:58 +01:00
Michael Niedermayer
876ecfccfb
avcodec/dxtory: Remove code that corrupts dimensions
...
Fixes: Timeout
Fixes: 5796/clusterfuzz-testcase-minimized-5206729085157376
Does someone have a valid sample that triggers this path ?
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3748746a4d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-27 19:59:58 +01:00
James Almer
e0750d2067
avformat/hvcc: zero initialize the nal buffers past the last written byte
...
Prevents use of uninitialized values.
Fixes ticket #7038 .
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 9482ec1b20 )
2018-02-24 00:37:13 -03:00
Tobias Rapp
8ae9bbef87
swresample/rematrix: fix update of channel matrix if input or output layout is undefined
...
Prefer direct in/out channel count values over channel layout, when
available. Fixes a pan filter bug (ticket #6790 ).
Signed-off-by: Tobias Rapp <t.rapp@noa-archive.com >
(cherry picked from commit 6325bd3717 )
2018-02-20 10:08:05 +01:00
Michael Niedermayer
9f14908a96
Update for 3.0.11
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 15:33:44 +01:00
Michael Niedermayer
6492799fce
avcodec/dirac_dwt_template: Fix Integer overflow in horizontal_compose_dd137i()
...
Fixes: 5894/clusterfuzz-testcase-minimized-5315325420634112
Fixes: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 647fa49495 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 03:01:43 +01:00
Michael Niedermayer
010dd0d26e
avcodec/vp8: Check for bitstream end before vp7_fade_frame()
...
Fixes: Timeout
Fixes: 5653/clusterfuzz-testcase-5497680018014208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit de675648ce )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:52:16 +01:00
Michael Niedermayer
675e243949
avcodec/exr: Check remaining bits in last get code loop
...
Fixes: runtime error: shift exponent -7 is negative
Fixes: 3902/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6081926122176512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dd8351b118 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:52:16 +01:00
Michael Niedermayer
e38e2d6533
avutil/common: Fix integer overflow in av_clip_uint8_c() and av_clip_uint16_c()
...
Fixes: 5567/clusterfuzz-testcase-minimized-5769966247739392
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab6f571ef7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:52:16 +01:00
Michael Niedermayer
340c315c67
avcodec/h264_cabac: Tighten allowed coeff_abs range
...
Fixes: integer overflows
Reported-by: "Xiaohan Wang (王消寒)" <xhwang@chromium.org >
Based on limits in "8.5 Transform coefficient decoding process and picture
construction process prior to deblocking filter process"
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f26a63c4ee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:52:16 +01:00
Xiaohan Wang
d4f9119532
avcodec/h264_cavlc: Set valid qscale value in ff_h264_decode_mb_cavlc()
...
When ff_h264_decode_mb_cavlc() failed due to wrong sl->qscale values,
e.g. dquant out of range, set the qscale to be a valid value before
returning -1 and exiting the function. The qscale value can be used
later e.g. in loop filter.
BUG=806122
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 71f39de2a5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:52:16 +01:00
Michael Niedermayer
664e3d217a
avcodec/vp3: Error out on invalid num_coeffs in unpack_vlcs()
...
This fixes a hypothetical integer overflow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f2318aee8c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:52:16 +01:00
Michael Niedermayer
ce46e45f4c
avcodec/mpeg4videodec: Ignore multiple VOL headers
...
Fixes: Ticket7005
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 63a4bdbf3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:52:16 +01:00
Michael Niedermayer
c6b5e80635
avcodec/vp3: Check eob_run
...
Fixes: out of array access
Fixes: 5919/clusterfuzz-testcase-minimized-5859311382167552
Fixes: special case for theora (untested due to lack of sample)
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 570023eab3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:52:16 +01:00
Michael Niedermayer
a26ac3cc69
avcodec/huffyuvdec: Check input buffer size
...
Fixes: Timeout
Fixes: 5487/clusterfuzz-testcase-4696837035393024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 08c220d26c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
8886e1228d
avcodec/wavpack: Fix integer overflow in FFABS
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 5396/clusterfuzz-testcase-minimized-6558555529281536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e50bd61e4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
6baa0e811b
avcodec/aacsbr_fixed: Fix overflows in rounding in sbr_hf_assemble()
...
Fixes: runtime error: signed integer overflow: 2052929346 + 204817098 cannot be represented in type 'int'
Fixes: 5275/clusterfuzz-testcase-minimized-5367635958038528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b1bef755f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
35f47ac0d5
avcodec/dirac_dwt: Fix several integer overflows
...
Fixes: runtime error: signed integer overflow: -2146071175 + -268479557 cannot be represented in type 'int'
Fixes: 5237/clusterfuzz-testcase-minimized-4569895275593728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fe1e6c06d0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
c1a133b610
avcodec/indeo5: Do not leave frame_type set to an invalid value
...
Fixes: null pointer dereference
Fixes: 5264/clusterfuzz-testcase-minimized-4621956621008896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ff9f17851 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
adb0a29111
avcodec/hevc_ps: Check log2_sao_offset_scale_*
...
Fixes: 4868/clusterfuzz-testcase-minimized-6236542906400768
Fixes: runtime error: shift exponent 126 is too large for 32-bit type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a75a75c62 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Aman Gupta
d664557023
avcodec/hevc_ps: extract one SPS fields required for hvcC construction
...
Signed-off-by: Aman Gupta <aman@tmm1.net >
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
60039c2d12
avcodec/mpeg4videodec: Avoid possibly aliasing violating casts
...
Found-by: kierank
Reviewed-by: Kieran Kunhya <kieran618@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d4967c04e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
6a01b65034
avcodec/get_bits: Document the return code of get_vlc2()
...
Found-by: kierank
Reviewed-by: Kieran Kunhya <kieran618@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a94ff4ccd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
78b1d57a4b
avcodec/mpeg4videodec: Check mb_num also against 0
...
The spec implies that 0 is invalid in addition to the existing checks
Found-by: <kierank>
Reviewed-by: Kieran Kunhya <kieran618@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 05f4703a16 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
5d06804b31
avfilter/vf_transpose: Fix used plane count.
...
Fixes out of array access
Fixes: poc.mp4
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c6939f65a1 )
(cherry picked from commit 3f621455d6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
cedd9ea93e
avcodec/hevc_cabac: Check prefix so as to avoid invalid shifts in coeff_abs_level_remaining_decode()
...
I suspect that this can be limited tighter, but i failed to find anything
in the spec that would confirm that.
Fixes: 4833/clusterfuzz-testcase-minimized-5302840101699584
Fixes: runtime error: left shift of 134217730 by 4 places cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a026a3efae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
269aecafab
avcodec/mjpegdec: Fix integer overflow in DC dequantization
...
Fixes: runtime error: signed integer overflow: -65535 * 65312 cannot be represented in type 'int'
Fixes: 4900/clusterfuzz-testcase-minimized-5769019744321536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1bfc1aa004 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
181c3cbacf
avcodec/dxtory: Fix bits left checks
...
Fixes: Timeout
Fixes: 4863/clusterfuzz-testcase-6347354178322432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6e1a167c55 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
f7abc14d0d
avcodec/hevc_cabac: Move prefix check in coeff_abs_level_remaining_decode() down
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 94d4237a7a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
a8ce9d518b
avcodec/truemotion2: Fix integer overflow in TM2_RECALC_BLOCK()
...
Fixes: signed integer overflow: 1477974040 - -1877995504 cannot be represented in type 'int'
Fixes: 4861/clusterfuzz-testcase-minimized-4570316383715328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 56a53340ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
dfb8448842
avcodec/snowdec: Fix integer overflow before htaps check
...
Fixes: runtime error: signed integer overflow: -1094995529 * 2 cannot be represented in type 'int'
Fixes: 4828/clusterfuzz-testcase-minimized-5100849937252352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2eecf3cf8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
e5296dfffa
avcodec/ulti: Check number of blocks at init
...
Fixes: Timeout
Fixes: 4832/clusterfuzz-testcase-4699096590843904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 725353525e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
7d5ca21698
avcodec/ac3dec_fixed: Fix integer overflow in scale_coefs()
...
Fixes: runtime error: signed integer overflow: 2147483520 + 128 cannot be represented in type 'int'
Fixes: 4800/clusterfuzz-testcase-minimized-6110372403609600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1f38c7589 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Nikolas Bowe
23af1858fe
avformat/lrcdec: Fix memory leak in lrc_read_header()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ef5994e09d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Nikolas Bowe
9d0b3fa58c
avformat/matroskadec: Fix float-cast-overflow undefined behavior in matroska_parse_tracks()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e07649e618 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Carl Eugen Hoyos
e858326086
configure: bump year
...
Happy new year!
(cherry picked from commit bddf31ba75 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
222ac34612
avcodec/utils: Avoid hardcoding duplicated types in sizeof()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 860d991fcd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
c7e98ee6e0
avcodec/arm/sbrdsp_neon: Use a free register instead of putting 2 things in one
...
Fixes high pitched shriek
Fixes: 25420848_1478428308873746_4255813235963330560_n.mp4
Reported-by: Dale Curtis <dalecurtis@google.com >
Reviewed-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7dbbb75ee3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
abb7498c3f
avcodec/h264addpx_template: Fixes integer overflows
...
Fixes: signed integer overflow: 512 + 2147483491 cannot be represented in type 'int'
Fixes: 4780/clusterfuzz-testcase-minimized-4709066174627840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d6945aeee4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
6164ca4765
avcodec/dirac_dwt: Fix overflows in COMPOSE_HAARiH0/COMPOSE_HAARiL0
...
Fixes: 4830/clusterfuzz-testcase-minimized-5255392054476800
Fixes: signed integer overflow: 2147483646 - -7 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e62a23734 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
b4d9605c67
avcodec/diracdec: Fix integer overflow with quant
...
Fixes: signed integer overflow: 2 + 2147483646 cannot be represented in type 'int'
Fixes: 4792/clusterfuzz-testcase-minimized-6322450775146496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eaa9317589 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
c17cc8ee4f
avcodec/opus_parser: Check payload_len in parse_opus_ts_header()
...
Fixes: clusterfuzz-testcase-minimized-6134545979277312
Fixes: crbug 797469
Reported-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1bcd7fefcb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
3cad8e730e
avcodec/jpeg2000dsp: Fix integer overflows in ict_int()
...
Fixes: signed integer overflow: 46802 * -71230 cannot be represented in type 'int'
Fixes: 4756/clusterfuzz-testcase-minimized-4812495563784192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b3192c64b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
06325d77bf
avcodec/h264_slice: Do not attempt to render into frames already output
...
Fixes: null pointer dereference
Fixes: 4698/clusterfuzz-testcase-minimized-5096956322906112
This testcase does not reproduce the issue before 03b82b3ab9
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 476665d4de )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
0c753a46ef
avcodec/dnxhddec: Check dc vlc
...
Fixes: signed integer overflow: 1024 + 2147483640 cannot be represented in type 'int'
Fixes: 4671/clusterfuzz-testcase-minimized-6027464343027712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b2be76c0a4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
9143ddea0f
avcodec/exr: Check buf_size more completely
...
Fixes: Out of heap array read
Fixes: 4683/clusterfuzz-testcase-minimized-6152313673613312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 903be5e4f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
6fab791daa
avcodec/flacdec: Fix overflow in multiplication in decode_subframe_fixed()
...
Fixes: signed integer overflow: 2 * 1629495328 cannot be represented in type 'int'
Fixes: 4716/clusterfuzz-testcase-minimized-5835915940331520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d23f7a096 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
844a9b439b
avcodec/hevcdsp_template: Fix Invalid shifts in put_hevc_qpel_bi_w_h() and put_hevc_qpel_bi_w_w()
...
Fixes: left shift of negative value -1
Fixes: 4690/clusterfuzz-testcase-minimized-6117482428366848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d135f3c514 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
f08be2b3d2
avcodec/flacdec: avoid undefined shift
...
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 4688/clusterfuzz-testcase-minimized-6572210748653568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 560daf8891 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
b3af84774b
avcodec/hevcdsp_template.c: Fix undefined shift in FUNC(dequant)
...
Fixes: runtime error: left shift of negative value -180
Fixes: 4626/clusterfuzz-testcase-minimized-5647837887987712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c9ab5ef9c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
a0bcc6cced
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD97iH0() and COMPOSE_DD137iL0()
...
Fixes: runtime error: signed integer overflow: 2147483646 + 33554433 cannot be represented in type 'int'
Fixes: 4563/clusterfuzz-testcase-minimized-5438979567517696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4d70fbeec8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
09d61d3b81
avcodec/hevc_cabac: Fix integer overflow in ff_hevc_cu_qp_delta_abs()
...
Fixes: signed integer overflow: 2147483647 + 1073741824 cannot be represented in type 'int'
Fixes: 4555/clusterfuzz-testcase-minimized-4505532481142784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ee143558d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
01f2bc5ec8
avcodec/hevc_sei: Fix integer overflows in decode_nal_sei_message()
...
Fixes: signed integer overflow: 2147483520 + 255 cannot be represented in type 'int'
Fixes: 4554/clusterfuzz-testcase-minimized-4843714515042304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 991ef6e5b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
b7f48cd044
avcodec/hevcdsp_template: Fix undefined shift in put_hevc_qpel_bi_w_hv()
...
Fixes: runtime error: left shift of negative value -3
Fixes: 4524/clusterfuzz-testcase-minimized-6055590120914944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 439fbb9c8b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Kelly Ledford
95139c4480
libavfilter/af_dcshift.c: Fixed repeated spelling error
...
'threshhold' should be 'threshold'
Signed-off-by: Kelly Ledford <kelly.ledford@intel.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc219082bb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Jun Zhao
e512c83e63
avfilter/formats: fix wrong function name in error message
...
Use perdefined micro __FUNCTION__ rather than hard coding function name
to fix wrong function name in error message.
Signed-off-by: Jun Zhao <jun.zhao@intel.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4280948702 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
4d0a460101
avcodec/amrwbdec: Fix division by 0 in voice_factor()
...
The added value matches "Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS); LTE; Extended Adaptive Multi-Rate - Wideband (AMR-WB+) codec; Floating-point ANSI-C code (3GPP TS 26.304 version 14.0.0 Release 14)
Extended Adaptive Multi-Rate - Wideband (AMR-WB+) codec; Floating-point ANSI-C code"
Fixes: runtime error: division by zero
Fixes: 4415/clusterfuzz-testcase-minimized-4677752314658816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1d0817d56b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
4a5ec6226b
avcodec/diracdsp: Fix integer overflow in PUT_SIGNED_RECT_CLAMPED()
...
Fixes: runtime error: signed integer overflow: 2147483646 + 2048 cannot be represented in type 'int'
Fixes: 4479/clusterfuzz-testcase-minimized-6529894147162112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 610dd74502 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
Michael Niedermayer
a5a6d2dc75
avcodec/dirac_dwt: Fix integer overflows in COMPOSE_DAUB97*
...
Fixes: 4478/clusterfuzz-testcase-minimized-4752113767809024
Fixes: runtime error: signed integer overflow: -2147483626 + -319489 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5e9a13a5a3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-19 02:40:54 +01:00
James Almer
ef95789c8c
avformat/libssh: check the user provided a password before trying to use it
...
Fixes ticket #6413
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 8ddb6820bd )
2018-01-11 10:41:31 -03:00
Michael Niedermayer
2bc6b9b2a9
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:30:18 +01:00
Dale Curtis
06a6f73ad8
avcodec/vorbis: Fix another 1 << 31 > int32_t::max() with 1u.
...
Didn't notice this one when 9648cc6d was landed.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 95bacb521a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Dale Curtis
532f0d1278
Don't manipulate duration when it's AV_NOPTS_VALUE.
...
This leads to signed integer overflow.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit c5fd57f483 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Dale Curtis
e6c6bb218e
avcodec/vorbis: 1 << 31 > int32_t::max(), so use 1u << 31 instead.
...
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9648cc6d7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Dale Curtis
b01020a050
avformat/utils: Prevent undefined shift with wrap_bits > 64.
...
2LL << (wrap_bits=64 - 1) does not fit in int64_t; change the
code to use a uint64_t (2ULL) and add an av_assert2() to
ensure wrap_bits <= 64.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 03fbc0daa7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
44dc83f0e0
avcodec/j2kenc: Fix out of array access in encode_cblk()
...
Fixes: 4427/clusterfuzz-testcase-minimized-5106919271301120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0674087004 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
a65633aa9d
avcodec/hevcdsp_template: Fix undefined shift in put_hevc_epel_bi_w_h()
...
Fixes: runtime error: left shift of negative value -127
Fixes: 4397/clusterfuzz-testcase-minimized-4779061080489984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0409d33311 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
78b6e8fb23
avcodec/mlpdsp: Fix signed integer overflow, 2nd try
...
The outputted bits should match what is used in the lossless check
Fixes: runtime error: signed integer overflow: -538697856 * 256 cannot be represented in type 'int'
Fixes: 4326/clusterfuzz-testcase-minimized-5689449645080576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 97c00edaa0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
71e40180cb
avcodec/kgv1dec: Check that there is enough input for maximum RLE compression
...
Fixes: Timeout
Fixes: 4271/clusterfuzz-testcase-4676667768307712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3aad94bf2b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
2214afdf40
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_FIDELITYi*
...
Fixes: runtime error: signed integer overflow: -2143827186 - 7404944 cannot be represented in type 'int'
Fixes: 4354/clusterfuzz-testcase-minimized-4671122764201984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b6964f764 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
abff307736
avcodec/mpeg4videodec: Check also for negative versions in the validity check
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e7865ce41 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Dale Curtis
50b2264810
Close ogg stream upon error when using AV_EF_EXPLODE.
...
Without this there can be multiple memory leaks for unrecognized
ogg streams.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bce8fc0754 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Dale Curtis
c09d587ac5
Fix undefined shift on assumed 8-bit input.
...
decode_user_data() attempts to create an integer |build|
value with 8 bits of spacing for 3 components. However
each component is an int32_t, so shifting each component
is undefined for values outside of the 8 bit range.
This patch simply clamps input to 8-bits per component
and prints out a warning that the values were clamped.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7010dd98b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Dale Curtis
712814fb17
Use ff_thread_once for fixed, float table init.
...
These tables are static so they should only be initialized once
instead of on every call to ff_mpadsp_init().
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5eaaffaf64 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Jacob Trimble
20e78d5339
avformat/mov: Propagate errors in mov_switch_root.
...
Signed-off-by: Jacob Trimble <modmaker@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d9cf3bf16 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
bf44f250a2
avcodec/hevcdsp_template: Fix invalid shift in put_hevc_epel_bi_w_v()
...
Fixes: runtime error: left shift of negative value -255
Fixes: 4037/clusterfuzz-testcase-minimized-5290998163832832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d88586e47 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
a3606385f0
avcodec/mlpdsp: Fix undefined shift ff_mlp_pack_output()
...
Fixes: runtime error: left shift of negative value -7862264
Fixes: 4074/clusterfuzz-testcase-minimized-4516104123711488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f7f70738e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
b9b4d34ecf
avcodec/zmbv: Check that the buffer is large enough for mvec
...
Fixes: Timeout
Fixes: 4143/clusterfuzz-testcase-4736864637419520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ab9568a2c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
bc65abecd3
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD137iL0()
...
Fixes: 4035/clusterfuzz-testcase-minimized-6479308925173760
Fixes: runtime error: signed integer overflow: 9 * 402653183 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73964680d7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
d1421edab7
avcodec/wmv2dec: Check end of bitstream in parse_mb_skip() and ff_wmv2_decode_mb()
...
Fixes: Timeout
Fixes: 3200/clusterfuzz-testcase-5750022136135680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65e0a7c473 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
12aea29a95
avcodec/snowdec: Check for remaining bitstream in decode_blocks()
...
Fixes: Timeout
Fixes: 3142/clusterfuzz-testcase-5007853163118592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4527ec2216 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
b8a10f10cc
avcodec/snowdec: Check intra block dc differences.
...
Fixes: Timeout
Fixes: 3142/clusterfuzz-testcase-5007853163118592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c3b9bbcc6e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Fredrik Hubinette
74677deaca
avformat/mov: Check size of STSC allocation
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6fdd75fe6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
4171249d76
avcodec/vc2enc: Clear coef_buf on allocation
...
Fixes: Use of uninitialized memory
Fixes: assertion failure
Reviewed-by: <atomnuker>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6d00905f81 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
2fc1a8ba49
avcodec/h264dec: Fix potential array overread
...
add padding before scantable arrays
See: 522d850e68
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 380b48fb9f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
b8a6b56027
avcodec/x86/mpegvideodsp: Fix signedness bug in need_emu
...
Fixes: out of array read
Fixes: 3516/attachment-311488.dat
Found-by: Insu Yun, Georgia Tech.
Tested-by: wuninsu@gmail.com
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 58cf31cee7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
91aadc6a5b
avcodec/aacpsdsp_template: Fix integer overflows in ps_decorrelate_c()
...
Fixes: runtime error: signed integer overflow: 1939661764 - -454942263 cannot be represented in type 'int'
Fixes: 3191/clusterfuzz-testcase-minimized-5688798451073024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2afe05402f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
43299eabea
avcodec/aacdec_fixed: Fix undefined shift
...
Fixes: runtime error: left shift of negative value -801112064
Fixes: 3492/clusterfuzz-testcase-minimized-5784775283441664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fca198fb5b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
f2763b8ba8
avcodec/mdct_*: Fix integer overflow in addition in RESCALE()
...
Fixes: runtime error: signed integer overflow: 1219998458 - -1469874012 cannot be represented in type 'int'
Fixes: 3443/clusterfuzz-testcase-minimized-5369987105554432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 770c934fa1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
f33f13172c
avcodec/snowdec: Fix integer overflow in header parsing
...
Fixes: 3984/clusterfuzz-testcase-minimized-5265759929368576
Fixes: runtime error: signed integer overflow: -1085585801 + -1094995529 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c897a92858 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
b9e9c5cee0
avcodec/cngdec: Fix integer clipping
...
Fixes: runtime error: value -36211.7 is outside the range of representable values of type 'short'
Fixes: 2992/clusterfuzz-testcase-6649611793989632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 51090133b3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
b45971a955
avcodec/sbrdsp_fixed: Fix integer overflow in shift in sbr_hf_g_filt_c()
...
Fixes: runtime error: shift exponent 66 is too large for 64-bit type 'long long'
Fixes: 3642/clusterfuzz-testcase-minimized-5443853801750528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 981e99ab99 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
4fbee42727
avutil/softfloat: Add FLOAT_MIN
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
21ae8b4869
avcodec/aacsbr_fixed: Fix division by zero in sbr_gain_calc()
...
Fixes: 3642/clusterfuzz-testcase-minimized-5443853801750528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d1dec4668 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
122634a580
avcodec/h264idct_template: Fix integer overflows in ff_h264_idct8_add()
...
Fixes: runtime error: signed integer overflow: -503316480 + -2013265038 cannot be represented in type 'int'
Fixes: 3805/clusterfuzz-testcase-minimized-6578427831255040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e131b8cedb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
4d9321136d
avcodec/xan: Check for bitstream end in xan_huffman_decode()
...
Fixes: Timeout
Fixes: 3707/clusterfuzz-testcase-6465922706440192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4b51437dcc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Luca Barbato
66754f0a96
avformat: Free the internal codec context at the end
...
Avoid a use after free in avformat_find_stream_info.
(cherry picked from commit 9e4a5eb51b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
a3bb922c4d
avcodec/xan: Improve overlapping check
...
Fixes: memcpy-param-overlap
Fixes: 3612/clusterfuzz-testcase-minimized-6393461273001984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e8fafef1db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
52ebd1a0dc
avcodec/aacdec_fixed: Fix integer overflow in apply_dependent_coupling_fixed()
...
Fixes: runtime error: signed integer overflow: 623487 * 536870912 cannot be represented in type 'int'
Fixes: 3594/clusterfuzz-testcase-minimized-4650622935629824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 41d96af2a7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
56cc35019e
avcodec/aacdec_fixed: Fix integer overflow in predict()
...
Fixes: runtime error: signed integer overflow: -2110708110 + -82837504 cannot be represented in type 'int'
Fixes: 3547/clusterfuzz-testcase-minimized-6009386439802880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0976752420 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
93854b7052
avcodec/jpeglsdec: Check for end of bitstream in ls_decode_line()
...
Fixes: 1773/clusterfuzz-testcase-minimized-4832523987189760
Fixes: Timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f80224ed19 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Michael Niedermayer
52bb493afa
avcodec/jpeglsdec: Check ilv for being a supported value
...
Fixes: 1773/clusterfuzz-testcase-minimized-4832523987189760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fe533628b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-02 00:28:59 +01:00
Rostislav Pehlivanov
94e538aebb
vc2enc_dwt: pad the temporary buffer by the slice size
...
Since non-Haar wavelets need to look into pixels outside the frame, we
need to pad the buffer. The old factor of two seemed to be a workaround
that fact and only padded to the left and bottom. This correctly pads
by the slice size and as such reduces memory usage and potential
exploits.
Reported by Liu Bingchang.
Ideally, there should be no temporary buffer but the encoder is designed
to deinterleave the coefficients into the classical wavelet structure
with the lower frequency values in the top left corner.
Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com >
(cherry picked from commit 3228ac730c )
2017-11-09 02:09:53 +00:00
Michael Niedermayer
479e65ba47
Update for 3.0.10
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-26 18:48:41 +02:00
Michael Niedermayer
abb3ec84bb
avcodec/snowdec: Check mv_scale
...
Fixes: runtime error: signed integer overflow: 2 * -1094995530 cannot be represented in type 'int'
Fixes: 3512/clusterfuzz-testcase-minimized-4812747210489856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 393d6fc739 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-15 00:45:25 +02:00
Michael Niedermayer
5422cdca42
avcodec/pafvideo: Check for bitstream end in decode_0()
...
Fixes: Timeout
Fixes: 3529/clusterfuzz-testcase-5057068371279872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c85329cd0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-15 00:45:11 +02:00
Michael Niedermayer
df441441c5
avcodec/ffv1dec: Fix out of array read in slice counting
...
Fixes: test-201710.mp4
Found-by: 连一汉 <lianyihan@360.cn > and Zhibin Hu
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c20f4fcb74 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-13 13:02:24 +02:00
Michael Niedermayer
87a8a4a507
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_53iL0()
...
Fixes: runtime error: signed integer overflow: 2147483646 + 2 cannot be represented in type 'int'
Fixes: 3485/clusterfuzz-testcase-minimized-4940429332054016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bdee75a4e7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-13 13:01:59 +02:00
Michael Niedermayer
ad3b198f47
avcodec/mpeg_er: Clear mcsel in mpeg_er_decode_mb()
...
Fixes out of array read
Should fix: 3516/clusterfuzz-testcase-minimized-4608518562775040 (not reprodoceable)
Found-by: Insu Yun, Georgia Tech.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 127a362630 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-13 12:59:48 +02:00
Michael Niedermayer
789ad4d361
avcodec/mpeg4videodec: Use 64 bit intermediates for sprite delta
...
Fixes: runtime error: signed integer overflow: -104713 * 65536 cannot be represented in type 'int'
Fixes: 3453/clusterfuzz-testcase-minimized-5555554657239040
Fixes: 3528/clusterfuzz-testcase-minimized-6283628420005888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e38f280fec )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-13 12:59:00 +02:00
Michael Niedermayer
6fa58eabb1
avcodec/x86/lossless_videoencdsp: Fix handling of small widths
...
Fixes out of array access
Fixes: crash-huf.avi
Regression since: 6b41b44149
This could also be fixed by adding checks in the C code that calls the dsp
Found-by: Zhibin Hu and 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df62b70de8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-05 01:34:00 +02:00
Michael Niedermayer
9825fcea99
avcodec/truemotion2: Fix integer overflows in tm2_high_chroma()
...
Fixes: runtime error: signed integer overflow: -1408475220 + -1408475220 cannot be represented in type 'int'
Fixes: 3336/clusterfuzz-testcase-minimized-5656839179993088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 44874b4f5e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-05 01:30:03 +02:00
Michael Niedermayer
d0e4c3410c
avcodec/aacdec_template: Clear tns present flag on error
...
Fixes: 3444/clusterfuzz-testcase-minimized-6270352105668608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dcf9bae4a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-05 01:29:45 +02:00
Michael Niedermayer
fc1acb103d
avcodec/proresdec2: SKIP_BITS() does not work with len=32
...
Fixes: invalid shift
Fixes: 3482/clusterfuzz-testcase-minimized-5446915875405824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c37138e01a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-05 01:28:22 +02:00
Michael Niedermayer
9f2beced0a
avcodec/hevcdsp_template: Fix undefined shift
...
Fixes: runtime error: left shift of negative value -255
Fixes: 3373/clusterfuzz-testcase-minimized-5604083912146944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fbdab6eca7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-05 01:28:00 +02:00
Michael Niedermayer
d164c49af7
avcodec/jpeg2000: Check that codsty->log2_prec_widths/heights has been initialized
...
Fixes: OOM
Fixes: 2225/clusterfuzz-testcase-minimized-5505632079708160
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 64e034da95 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-05 01:26:58 +02:00
Michael Niedermayer
2c84969cb4
avcodec/takdec: Fix integer overflow in decode_lpc()
...
Fixes: runtime error: signed integer overflow: 16748560 + 2143729712 cannot be represented in type 'int'
Fixes: 3202/clusterfuzz-testcase-minimized-4988291642294272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d31f03a02 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-25 11:10:30 +02:00
Michael Niedermayer
09913c5ec4
avcodec/proresdec2: Check bits in DECODE_CODEWORD(), fixes invalid shift
...
Fixes: runtime error: shift exponent 42 is too large for 32-bit type 'unsigned int'
Fixes: 3410/clusterfuzz-testcase-minimized-5313377960198144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f5eaf0b59 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-25 11:10:15 +02:00
Michael Niedermayer
a89a340e4f
avcodec/takdec: Fix integer overflows in decode_subframe()
...
Fixes: runtime error: signed integer overflow: -1562477869 + -691460395 cannot be represented in type 'int'
Fixes: 3196/clusterfuzz-testcase-minimized-4528307146063872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3dabb9c69d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-25 11:09:06 +02:00
Michael Niedermayer
977d6d8bff
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_FIDELITYi*()
...
Fixes: runtime error: signed integer overflow: 161 * 13872281 cannot be represented in type 'int'
Fixes: 3295/clusterfuzz-testcase-minimized-4738998142500864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 67da2685e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-24 02:43:53 +02:00
Michael Niedermayer
3386a57b08
avcodec/ffv1dec: Fix integer overflow in read_quant_table()
...
Fixes: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 3361/clusterfuzz-testcase-minimized-5065842955911168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d00fc952b6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-24 02:41:19 +02:00
Michael Niedermayer
145fce8c4b
avcodec/svq3: Fix overflow in svq3_add_idct_c()
...
Fixes: runtime error: signed integer overflow: 2147392585 + 524288 cannot be represented in type 'int'
Fixes: 3348/clusterfuzz-testcase-minimized-4809500517203968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c933c5168 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-24 02:41:00 +02:00
Michael Niedermayer
d54cc921a4
avcodec/pngdec: Clean up on av_frame_ref() failure
...
Fixes: memleak
Fixes: 3203/clusterfuzz-testcase-minimized-4514553595428864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5480e82d77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-20 03:09:15 +02:00
Michael Niedermayer
791d06da1a
avcodec/hevc_ps: Fix c?_qp_offset_list size
...
Fixes: runtime error: index 5 out of bounds for type 'int8_t const[5]'
Fixes:3175/clusterfuzz-testcase-minimized-4736774054084608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit abf3f9fa23 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-12 02:30:35 +02:00
Michael Niedermayer
9bc5df5ec8
avcodec/jpeg2000dsp: Fix multiple integer overflows in ict_int()
...
Fixes: runtime error: signed integer overflow: 22553 * -188962 cannot be represented in type 'int'
Fixes: 3042/clusterfuzz-testcase-minimized-5174210131394560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d025e7428 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-11 13:29:39 +02:00
Michael Niedermayer
03d8e9fec5
avcodec/hevcdsp_template: Fix undefined shift in put_hevc_pel_bi_w_pixels
...
Fixes: runtime error: left shift of negative value -95
Fixes: 3077/clusterfuzz-testcase-minimized-4684917524922368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c225da68cf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-11 13:29:19 +02:00
Michael Niedermayer
bed626f845
avcodec/diracdec: Fix overflow in DC computation
...
Fixes: runtime error: signed integer overflow: 11896 + 2147483646 cannot be represented in type 'int'
Fixes: 3053/clusterfuzz-testcase-minimized-6355082062856192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5995856a4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-11 13:28:43 +02:00
Michael Niedermayer
e4a9790bac
avformat/asfdec: Fix DoS in asf_build_simple_index()
...
Fixes: Missing EOF check in loop
No testcase
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit afc9c683ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-08 18:37:40 +02:00
Michael Niedermayer
d08abbd0bd
avformat/mov: Fix DoS in read_tfra()
...
Fixes: Missing EOF check in loop
No testcase
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9cb4eb7728 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-08 18:37:21 +02:00
Michael Niedermayer
fd4500df5c
avcodec/dirac_dwt: Fix multiple overflows in 9/7 lifting
...
Fixes: runtime error: signed integer overflow: 1073901567 + 1073901567 cannot be represented in type 'int'
Fixes: 3124/clusterfuzz-testcase-minimized-454643435752652
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f71cd44147 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-02 23:54:44 +02:00
Michael Niedermayer
92f4341ed1
avcodec/diracdec: Fix integer overflow in INTRA_DC_PRED()
...
Fixes: runtime error: signed integer overflow: 1168175789 + 1168178473 cannot be represented in type 'int'
Fixes: 3081/clusterfuzz-testcase-minimized-4807564879462400
Fixes: 2844/clusterfuzz-testcase-minimized-5561715838156800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2a0823ae96 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-02 23:54:16 +02:00
孙浩(晓黑)
b2aa633d66
avformat/mxfdec: Fix Sign error in mxf_read_primer_pack()
...
Fixes: 20170829B.mxf
Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com >
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d00fb9d70 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-01 03:20:53 +02:00
孙浩(晓黑)
74c067e955
avformat/mxfdec: Fix DoS issues in mxf_read_index_entry_array()
...
Fixes: 20170829A.mxf
Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com >
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 900f39692c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-01 03:04:24 +02:00
孙浩(晓黑)
c6d3640cf7
avformat/nsvdec: Fix DoS due to lack of eof check in nsvs_file_offset loop.
...
Fixes: 20170829.nsv
Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com >
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c24bcb5536 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-09-01 03:03:44 +02:00
Michael Niedermayer
e89125faba
avcodec/snowdec: Fix integer overflow in decode_subband_slice_buffered()
...
Fixes: runtime error: signed integer overflow: 267 * 8388608 cannot be represented in type 'int'
Fixes: 2743/clusterfuzz-testcase-minimized-5820652076400640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 732f976456 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-29 21:21:05 +02:00
Michael Niedermayer
51ee15df58
avcodec/hevc_ps: Fix undefined shift in pcm code
...
Fixes: runtime error: shift exponent -1 is negative
Fixes: 3091/clusterfuzz-testcase-minimized-6229767969832960
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2a83866c9f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-29 21:20:50 +02:00
Michael Niedermayer
a5018026af
avcodec/sbrdsp_fixed: Fix undefined overflows in autocorrelate()
...
Fixes: runtime error: signed integer overflow: 8903997421129740175 + 354481484684609529 cannot be represented in type 'long'
Fixes: 2045/clusterfuzz-testcase-minimized-6751255865065472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eefb68c9c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-28 01:44:23 +02:00
Michael Niedermayer
9a73a77681
avformat/mvdec: Fix DoS due to lack of eof check
...
Fixes: loop.mv
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f05e2e2dc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-28 01:43:28 +02:00
孙浩 and 张洪亮(望初)
4c6bed6e3b
avformat/rl2: Fix DoS due to lack of eof check
...
Fixes: loop.rl2
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 96f24d1bee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-28 01:43:03 +02:00
孙浩 and 张洪亮(望初)
81e6a95e54
avformat/rmdec: Fix DoS due to lack of eof check
...
Fixes: loop.ivr
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 124eb202e7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-28 01:42:34 +02:00
孙浩 and 张洪亮(望初)
adca94d65e
avformat/cinedec: Fix DoS due to lack of eof check
...
Fixes: loop.cine
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7e80b63ecd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-28 01:42:23 +02:00
孙浩 and 张洪亮(望初)
39ddbd204a
avformat/asfdec: Fix DoS due to lack of eof check
...
Fixes: loop.asf
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f9ec5593e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-28 01:42:00 +02:00
Michael Niedermayer
b9fa2a86e6
avformat/hls: Fix DoS due to infinite loop
...
Fixes: loop.m3u
The default max iteration count of 1000 is arbitrary and ideas for a better solution are welcome
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Previous version reviewed-by: Steven Liu <lingjiujianke@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ec414892d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-28 01:41:36 +02:00
Michael Niedermayer
ffdc430c4a
ffprobe: Fix NULL pointer handling in color parameter printing
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 351e28f9a7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-24 12:46:07 +02:00
Michael Niedermayer
cf838b8fd2
ffprobe: Fix null pointer dereference with color primaries
...
Found-by: AD-lab of venustech
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 837cb4325b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b2c39fcc3c0749490dc93bca80f56724878b55fe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-24 12:25:56 +02:00
Michael Niedermayer
9e98eee39d
avcodec/hevc_ps: Check delta_pocs in ff_hevc_decode_short_term_rps()
...
Fixes: integer overflow
Fixes: 2893/clusterfuzz-testcase-minimized-5809330567774208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b44dcbc44 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-24 12:10:32 +02:00
Vitaly Buka
aadd7fbc14
avformat/aviobuf: Fix signed integer overflow in avio_seek()
...
Signed integer overflow is undefined behavior.
Detected with clang and -fsanitize=signed-integer-overflow
Signed-off-by: Vitaly Buka <vitalybuka@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eca2a49716 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-24 12:08:06 +02:00
Vitaly Buka
64af458bb8
avformat/mov: Fix signed integer overflows with total_size
...
Signed integer overflow is undefined behavior.
Detected with clang and -fsanitize=signed-integer-overflow
Signed-off-by: Vitaly Buka <vitalybuka@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a404cb5b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-24 12:03:51 +02:00
Vitaly Buka
616154a6a5
avcodec/utils: Fix signed integer overflow in rc_initial_buffer_occupancy initialization
...
Signed integer overflow is undefined behavior.
Detected with clang and -fsanitize=signed-integer-overflow
Signed-off-by: Vitaly Buka <vitalybuka@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c2bb10ddf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-24 12:03:33 +02:00
Michael Niedermayer
2820ffe392
avcodec/aacdec_template: Fix running cleanup in decode_ics_info()
...
Fixes: out of array read
Fixes: 2873/clusterfuzz-testcase-minimized-5924145713905664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Previous version reviewed-by: Alex Converse <alex.converse@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6f03ffb47d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-23 04:03:16 +02:00
Michael Niedermayer
c543ff526b
avcodec/me_cmp: Fix crashes on ARM due to misalignment
...
Adds a diff_pixels_unaligned()
Fixes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872503
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc488ec28a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-21 23:27:09 +02:00
Michael Niedermayer
2f49580e03
avcodec/dirac_dwt_template: Fix integer overflow in vertical_compose53iL0()
...
Fixes: runtime error: signed integer overflow: 2147483646 + 2 cannot be represented in type 'int'
Fixes: 3013/clusterfuzz-testcase-minimized-4644084197097472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a165b53daa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-21 23:27:09 +02:00
Michael Niedermayer
689e97fcad
avcodec/fic: Fixes signed integer overflow
...
Fixes: runtime error: signed integer overflow: 1037142357 + 1227025305 cannot be represented in type 'int'
Fixes: 3024/clusterfuzz-testcase-minimized-5885660323905536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c9d5b015c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-21 23:27:08 +02:00
Michael Niedermayer
f7509e9fce
avcodec/snowdec: Fix off by 1 error
...
Fixes: runtime error: index 4 out of bounds for type 'int8_t [4]'
Fixes: 3023/clusterfuzz-testcase-minimized-6421736130084864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d132683ddd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-21 23:27:08 +02:00
Michael Niedermayer
9bfa8b692e
avcodec/diracdec: Check perspective_exp and zrs_exp.
...
Fixes: undefined shift
Fixes: runtime error: shift exponent 264 is too large for 32-bit type 'int'
Fixes: 2860/clusterfuzz-testcase-minimized-4672811689836544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e6cab8745 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-17 00:27:31 +02:00
Michael Niedermayer
e154826a2f
avcodec/mpeg4videodec: Clear mcsel before decoding an image
...
Fixes: runtime error: signed integer overflow: 2146467840 + 1032192 cannot be represented in type 'int'
Fixes: 2826/clusterfuzz-testcase-minimized-5901511613743104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7735ed2974 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-13 01:07:20 +02:00
Michael Niedermayer
f91733e141
avcodec/dirac_dwt: Fixes integer overflows in COMPOSE_DAUB97*
...
Fix multiple: runtime error: signed integer overflow: 6497 * 3409630 cannot be represented in type 'int'
Fixes: 2819/clusterfuzz-testcase-minimized-4743700301217792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5380f9c1c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-08 19:38:09 +02:00
Michael Niedermayer
410f709bec
avcodec/aacdec_fixed: fix invalid shift in predict()
...
Fixes: runtime error: shift exponent -2 is negative
Fixes: 2818/clusterfuzz-testcase-minimized-5062943676825600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e443051b2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-08 19:37:42 +02:00
Michael Niedermayer
b59d6183c4
avcodec/h264_slice: Fix overflow in slice offset
...
Fixes: runtime error: signed integer overflow: 1610612736 * 2 cannot be represented in type 'int'
Fixes: 2817/clusterfuzz-testcase-minimized-5289691240726528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f53bde6d8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-08 19:37:24 +02:00
Steven Siloti
a371850d58
avformat/utils: fix memory leak in avformat_free_context
...
The pointer to the packet queue is stored in the internal structure
so the queue needs to be flushed before internal is freed.
Signed-off-by: Steven Siloti <ssiloti@bittorrent.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 949debd1d1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-08-05 23:25:05 +02:00
Michael Niedermayer
693db350dd
avcodec/dirac_dwt: Fix multiple integer overflows in COMPOSE_DD97iH0()
...
Fixes: runtime error: signed integer overflow: 9 * 335544320 cannot be represented in type 'int'
Fixes: 2739/clusterfuzz-testcase-minimized-6737297955356672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf8ab72ae9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-29 19:13:21 +02:00
Michael Niedermayer
ac0fbaf8ac
avcodec/diracdec: Fix integer overflow in divide3()
...
Fixes: runtime error: signed integer overflow: -1073746548 * 21845 cannot be represented in type 'int'
Fixes: 2729/clusterfuzz-testcase-minimized-5902915464069120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c0220c768c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-29 14:23:25 +02:00
Michael Niedermayer
43d7b1e42f
avcodec/takdec: Fix integer overflow in decode_subframe()
...
Fixes: runtime error: signed integer overflow: -536870912 - 1972191120 cannot be represented in type 'int'
Fixes: 2711/clusterfuzz-testcase-minimized-4975142398590976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c630d159f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-29 14:18:35 +02:00
Michael Niedermayer
81c940b151
avformat/rtmppkt: Convert ff_amf_get_field_value() to bytestream2
...
Fixes: out of array accesses
Found-by: JunDong Xie of Ant-financial Light-Year Security Lab
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ffcc82219c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-29 14:17:58 +02:00
Michael Niedermayer
2954ce9dea
avformat/rtmppkt: Convert ff_amf_tag_size() to bytestream2
...
Fixes: out of array accesses
Fixes: crash-9238fa9e8d4fde3beda1f279626f53812cb001cb-SEGV
Found-by: JunDong Xie of Ant-financial Light-Year Security Lab
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 08c073434e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-29 04:49:47 +02:00
Michael Niedermayer
654e157d21
avcodec/diracdec: Fix integer overflow in signed multiplication in UNPACK_ARITH()
...
Fixes: runtime error: signed integer overflow: 1073741823 * 4 cannot be represented in type 'int'
Fixes: 2729/clusterfuzz-testcase-minimized-5902915464069120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e275a74b0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-28 03:41:09 +02:00
Michael Niedermayer
f31fc4755f
avcodec/dnxhddec: Move mb height check out of non hr branch
...
Fixes: out of array access
Fixes: poc.dnxhd
Found-by: Bingchang, Liu@VARAS of IIE
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 296debd213 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-27 03:11:20 +02:00
Michael Niedermayer
665311ab1f
avcodec/hevc_ps: fix integer overflow in log2_parallel_merge_level_minus2
...
Fixes: runtime error: signed integer overflow: -2147483647 - 2 cannot be represented in type 'int'
Fixes: 2702/clusterfuzz-testcase-minimized-4511932591636480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 74c1c22d7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-26 17:25:17 +02:00
Michael Niedermayer
8c05ac89d3
avformat/oggparsecelt: Do not re-allocate os->private
...
Fixes: double free
Fixes: clusterfuzz-testcase-minimized-5080550145785856
Found-by: ClusterFuzz
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7140761481 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-26 00:15:38 +02:00
Michael Niedermayer
3fd54e4440
avcodec/aacps: Fix multiple integer overflow in map_val_34_to_20()
...
Fixes: avcodec/aacps.c:511:40: runtime error: signed integer overflow: 1509077651 + 758068176 cannot be represented in type 'int'
Fixes: 2678/clusterfuzz-testcase-minimized-4702787684270080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0764fe1d09 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-26 00:14:03 +02:00
Michael Niedermayer
d4bc7fc412
avcodec/aacdec_fixed: fix: left shift of negative value -1
...
Fixes: 2699/clusterfuzz-testcase-minimized-5631303862976512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2dfb8c4178 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-26 00:11:56 +02:00
Brice Waegeneire
d57345e8d0
doc/filters: typo in frei0r
...
Signed-off-by: Brice Waegeneire <brice.wge@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6a6eec485d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-23 15:01:04 +02:00
Vodyannikov Aleksandr
8642322b9f
avcodec/cfhd: Fix decoding regression due to height check
...
Fixes: Ticket6546
Regression since: 54aaadf648
Reviewed-by: Muhammad Faiz <mfcc64@gmail.com >
Reviewed-by: Kieran Kunhya <kierank@obe.tv >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47c9365724 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-23 15:00:53 +02:00
Michael Niedermayer
0df61711cf
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 13:48:31 +02:00
Michael Niedermayer
4e7ddba594
avcodec/aacdec_template (fixed point): Check gain in decode_cce() to avoid undefined shifts later
...
Fixes: runtime error: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 2581/clusterfuzz-testcase-minimized-4681474395602944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2886142e0c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 04:03:10 +02:00
Michael Niedermayer
5e78e477fa
avcodec/aacdec_template: Fix undefined integer overflow in apply_tns()
...
Fixes: runtime error: signed integer overflow: -2147483648 - 1202286525 cannot be represented in type 'int'
Fixes: 2071/clusterfuzz-testcase-minimized-6036414271586304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ef8f03133 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 03:54:39 +02:00
Michael Niedermayer
9a2ca3cce2
avcodec/mjpegdec: Clip DC also on the negative side.
...
Fixes: runtime error: signed integer overflow: -16711425 + -2130772346 cannot be represented in type 'int'
Fixes: 2533/clusterfuzz-testcase-minimized-5372857678823424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c28f648b19 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 03:48:00 +02:00
Michael Niedermayer
f1143f5dc0
avcodec/aacps (fixed point): Fix multiple signed integer overflows
...
Fixes: runtime error: signed integer overflow: 1421978265 - -1810326882 cannot be represented in type 'int'
Fixes: 2527/clusterfuzz-testcase-minimized-5260915396050944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 80b9e40b6f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 03:47:45 +02:00
Michael Niedermayer
0ddff40bf8
avcodec/sbrdsp_fixed: Fix integer overflow in sbr_hf_apply_noise()
...
Fixes: runtime error: signed integer overflow: -2049425300 + -117591631 cannot be represented in type 'int'
Fixes: part of 2096/clusterfuzz-testcase-minimized-4901566068817920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2061de8a3f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 03:39:53 +02:00
Michael Niedermayer
2170bdb56d
avcodec/wavpack: Fix invalid shift
...
Fixes: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 2377/clusterfuzz-testcase-minimized-6108505935183872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c07af72098 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 02:50:35 +02:00
Michael Niedermayer
665885bfc1
avcodec/hevc_ps: Fix integer overflow with beta/tc offsets
...
Fixes: runtime error: signed integer overflow: 2113929216 * 2 cannot be represented in type 'int'
Fixes: 2422/clusterfuzz-testcase-minimized-5242114713583616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit de54a37c1d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 02:50:01 +02:00
Michael Niedermayer
7807d2478b
avcodec/cfhd: Fix invalid left shift of negative value
...
Fixes: runtime error: left shift of negative value -1
Fixes: 2395/clusterfuzz-testcase-minimized-6540529313513472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c709f009da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 02:49:04 +02:00
Michael Niedermayer
cc9082dce1
avcodec/vb: Check vertical GMC component before multiply
...
Fixes: runtime error: signed integer overflow: 8224 * 663584 cannot be represented in type 'int'
Fixes: 2393/clusterfuzz-testcase-minimized-6128334993883136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc6ab72bc7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 02:48:40 +02:00
Michael Niedermayer
34535941ae
avcodec/jpeg2000dwt: Fix integer overflow in dwt_decode97_int()
...
Fixes: runtime error: signed integer overflow: -163654656 * 256 cannot be represented in type 'int'
Fixes: 2367/clusterfuzz-testcase-minimized-4648678897745920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea5366670e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-19 02:45:52 +02:00
Michael Niedermayer
3cae97b090
avcodec/apedec: Fix integer overflow
...
Fixes: out of array access
Fixes: PoC.ape and others
Found-by: Bingchang, Liu@VARAS of IIE
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ba4beaf614 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-07-16 17:02:31 +02:00
Michael Niedermayer
654ff56103
Update for 3.0.9
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-25 02:55:08 +02:00
Michael Niedermayer
0fe174fa9c
avcodec/wavpack: Fix integer overflow in wv_unpack_stereo()
...
Fixes: runtime error: signed integer overflow: 2080374785 + 2080374784 cannot be represented in type 'int'
Fixes: 2351/clusterfuzz-testcase-minimized-5359403240783872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73ea2a028e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-25 02:52:41 +02:00
Michael Niedermayer
8b9e522e08
avcodec/mpeg4videodec: Fix GMC with videos of dimension 1
...
Fixes: runtime error: shift exponent -1 is negative
Fixes: 2338/clusterfuzz-testcase-minimized-5153426541379584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4976a3411f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-25 02:48:01 +02:00
Michael Niedermayer
bb02e5bc09
avcodec/wavpack: Fix integer overflow
...
Fixes: runtime error: signed integer overflow: 227511904 + 1964113935 cannot be represented in type 'int'
Fixes: 2331/clusterfuzz-testcase-minimized-6182185830711296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 24e95f9d4d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-23 03:05:55 +02:00
Michael Niedermayer
addf70e492
avcodec/takdec: Fix integer overflow
...
Fixes: runtime error: signed integer overflow: 512 + 2147483146 cannot be represented in type 'int'
Fixes: 2314/clusterfuzz-testcase-minimized-4519333877252096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c2ef4f6b4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-23 03:05:44 +02:00
Michael Niedermayer
0879ecd4a3
avcodec/tiff: Update pointer only when the result is used
...
Fixes: runtime error: signed integer overflow: 538976288 * 32 cannot be represented in type 'int'
Fixes: 2310/clusterfuzz-testcase-minimized-4534784887881728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 27f80ab016 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-23 03:05:34 +02:00
Michael Niedermayer
df11b45644
avcodec/cfhd: Check bpc before setting bpc in context
...
Fixes: runtime error: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 2306/clusterfuzz-testcase-minimized-5002997392211968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6f1d2355a7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-22 03:09:18 +02:00
Michael Niedermayer
605bc45295
avcodec/cfhd: Fix undefined shift
...
Fixes: runtime error: left shift of negative value -1
Fixes: 2303/clusterfuzz-testcase-minimized-5529675273076736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5a950f4e32 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-22 03:08:58 +02:00
Michael Niedermayer
eb7ad56075
avcodec/hevc_filter: Fix invalid shift
...
Fixes: runtime error: left shift of negative value -1
Fixes: 2299/clusterfuzz-testcase-minimized-4843509351710720
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d7b3d5c3f2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-22 03:08:45 +02:00
Michael Niedermayer
6dca67f3a6
avcodec/mpeg4videodec: Fix overflow in virtual_ref computation
...
Fixes: runtime error: signed integer overflow: 262144 * -16120 cannot be represented in type 'int'
Fixes: 2292/clusterfuzz-testcase-minimized-6156080415506432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5443c4bdf4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-22 03:08:35 +02:00
Michael Niedermayer
fae49f28e6
avcodec/lpc: signed integer overflow in compute_lpc_coefs() (aacdec_fixed)
...
Fixes: runtime error: signed integer overflow: -1575818955 + -915383657 cannot be represented in type 'int'
Fixes: 2224/clusterfuzz-testcase-minimized-6208559949807616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e95fcfe8fb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-22 03:08:23 +02:00
Michael Niedermayer
628e2b2dd3
avcodec/wavpack: Fix undefined integer negation
...
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 2291/clusterfuzz-testcase-minimized-5538453481586688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f89747086 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-22 03:07:20 +02:00
Michael Niedermayer
784d57bb62
avcodec/aacdec_fixed: Check s for being too small
...
Fixes: runtime error: shift exponent -8 is negative
Fixes: 2286/clusterfuzz-testcase-minimized-5711764169687040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf7edbd6c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-22 03:07:08 +02:00
Michael Niedermayer
9b346f12fa
avcodec/htmlsubtitles: Replace very slow redundant sscanf() calls by cleaner and faster code
...
This reduces the worst case from O(n²) to O(n) time
Fixes Timeout
Fixes: 2127/clusterfuzz-testcase-minimized-6595787859427328
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4132218b87 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-22 03:06:43 +02:00
Anton Mitrofanov
85e0f61b41
avcodec/h264: Fix mix of lossless and lossy MBs decoding
...
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com >
(cherry picked from commit cf231b68da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 03:09:09 +02:00
Anton Mitrofanov
273e87be3b
avcodec/h264_mb: Fix 8x8dct in lossless for new versions of x264
...
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com >
(cherry picked from commit 06dda70f1e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 03:04:29 +02:00
Anton Mitrofanov
48ab5a4dc0
avcodec/h264_cabac: Fix CABAC+8x8dct in 4:4:4
...
Use the correct ctxIdxInc calculation for coded_block_flag.
Keep old behavior for old versions of x264 for backward compatibility.
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com >
(cherry picked from commit 840b41b2a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:09 +02:00
Michael Niedermayer
d5abcaacb3
avcodec/takdec: Fixes: integer overflow in AV_SAMPLE_FMT_U8P output
...
Fixes: runtime error: signed integer overflow: 2147483543 + 128 cannot be represented in type 'int'
Fixes: 2234/clusterfuzz-testcase-minimized-6266896041115648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 27c2006805 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:09 +02:00
Michael Niedermayer
e46f8c96d0
avcodec/jpeg2000dsp: Reorder operations in ict_int() to avoid 2 integer overflows
...
Fixes: runtime error: signed integer overflow: 58065 * 51981 cannot be represented in type 'int'
Fixes: 2271/clusterfuzz-testcase-minimized-5778297776504832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c746f92a8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:09 +02:00
Michael Niedermayer
fce334274b
avcodec/hevcpred_template: Fix left shift of negative value
...
Fixes: runtime error: left shift of negative value -1
Fixes: 2250/clusterfuzz-testcase-minimized-5693382112313344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c94326c1fc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:09 +02:00
Michael Niedermayer
59d40e2d68
avcodec/hevcdec: Fix signed integer overflow in decode_lt_rps()
...
Fixes: runtime error: signed integer overflow: 2147483647 + 6 cannot be represented in type 'int'
Fixes: 2263/clusterfuzz-testcase-minimized-4800359627227136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1edbf5e20c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:09 +02:00
Michael Niedermayer
e8555274b9
avcodec/jpeg2000dec: Check nonzerobits more completely
...
Fixes: runtime error: shift exponent 36 is too large for 32-bit type 'int'
Fixes: 2239/clusterfuzz-testcase-minimized-5639766592716800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dfb61ea263 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:09 +02:00
Michael Niedermayer
79393f4fb1
avcodec/shorten: Sanity check maxnlpc
...
Fixes OOM
Fixes: 2131/clusterfuzz-testcase-minimized-4718045157130240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e77ddd31a8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:09 +02:00
Michael Niedermayer
a5feb7e9bd
avcodec/truemotion2: Move skip computation after checks
...
Fixes: runtime error: signed integer overflow: 630067357 * 4 cannot be represented in type 'int'
Fixes: 2233/clusterfuzz-testcase-minimized-5943031318446080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3c716682a8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:09 +02:00
Michael Niedermayer
23d02b4465
avcodec/jpeg2000: Fixes integer overflow in ff_jpeg2000_ceildivpow2()
...
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 2231/clusterfuzz-testcase-minimized-4565181982048256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e3fadc57c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:09 +02:00
Michael Niedermayer
f19152559f
avcodec/hevcdec: Check nb_sps
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc40674462 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:09 +02:00
Michael Niedermayer
7c82082ac8
avcodec/hevc_refs: Check nb_refs in add_candidate_ref()
...
Fixes: runtime error: index 16 out of bounds for type 'int [16]'
Fixes: 2209/clusterfuzz-testcase-minimized-5012343912136704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1cb4ef526d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:09 +02:00
Michael Niedermayer
ea5603ff3a
avcodec/mpeg4videodec: Check sprite delta upshift against overflowing.
...
Fixes: runtime error: signed integer overflow: -268386304 * 16 cannot be represented in type 'int'
Fixes: 2204/clusterfuzz-testcase-minimized-5616756909408256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 12245ab1f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:09 +02:00
Michael Niedermayer
301791a2bd
avcodec/mpeg4videodec: Fix integer overflow in num_sprite_warping_points=2 case
...
Fixes: runtime error: signed integer overflow: 131072 + 2147352576 cannot be represented in type 'int'
Fixes: 2192/clusterfuzz-testcase-minimized-5370387988742144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a87be404a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:09 +02:00
Michael Niedermayer
5a35ac5435
avcodec/aacsbr_fixed: Check shift in sbr_hf_assemble()
...
Fixes: runtime error: shift exponent -10 is negative
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d1992448d3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:09 +02:00
Michael Niedermayer
3db46e6447
avcodec/sbrdsp_fixed: Return an error from sbr_hf_apply_noise() if operations are impossible
...
Fixes: 1775/clusterfuzz-testcase-minimized-5330288148217856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d549f026d8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:09 +02:00
Michael Niedermayer
0f59d5a6e0
avcodec/jpeg2000dwt: Fix runtime error: left shift of negative value -123
...
Fixes: 2208/clusterfuzz-testcase-minimized-5976593765761024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d24043e1a2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:09 +02:00
Michael Niedermayer
fef11b7c38
avcodec/wavpack: Fix runtime error: signed integer overflow: 1886191616 + 277872640 cannot be represented in type 'int'
...
Fixes: 2181/clusterfuzz-testcase-minimized-6314784322486272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c996374d4d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:09 +02:00
Michael Niedermayer
e8c87c21c0
avcodec/snowdec: Fix runtime error: left shift of negative value -1
...
Fixes: 2197/clusterfuzz-testcase-minimized-6010716676947968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2e44126363 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:09 +02:00
Michael Niedermayer
f3be926246
avcodec/aacdec_fixed: Fix runtime error: left shift of negative value -1297616
...
Fixes: 2195/clusterfuzz-testcase-minimized-4736721533009920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6d499ecef9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:09 +02:00
Michael Niedermayer
91da2f8ebb
avcodec/tiff: Fix leak of geotags[].val
...
Fixes: 2176/clusterfuzz-testcase-minimized-5908197216878592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 22a25ab389 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:08 +02:00
Michael Niedermayer
e7f8984f99
avcodec/ra144: Fix runtime error: signed integer overflow: -2200 * 1033073 cannot be represented in type 'int'
...
Fixes: 2175/clusterfuzz-testcase-minimized-5809657849315328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 71da0a5c97 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:08 +02:00
Michael Niedermayer
3784d34c3b
avcodec/flicvideo: Fix runtime error: signed integer overflow: 4864 * 459296 cannot be represented in type 'int'
...
Fixes: 2174/clusterfuzz-testcase-minimized-5739234533048320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 90e8317b3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:08 +02:00
Michael Niedermayer
72b8c6c645
avcodec/cfhd: Check band parameters before storing them
...
Fixes out of array read
Fixes: 2169/clusterfuzz-testcase-minimized-5688641642823680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 54aaadf648 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:08 +02:00
Michael Niedermayer
2dcae36de1
avcodec/indeo4: Check remaining data in Pic hdr extension parsing code
...
Fixes: Timeout
Fixes: 2115/clusterfuzz-testcase-minimized-6594111748440064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a3b5b60bdf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:08 +02:00
Michael Niedermayer
968036dbf9
avcodec/ac3dec_fixed: Fix multiple runtime error: signed integer overflow: -39271008 * 59 cannot be represented in type 'int'
...
Fixes: 2113/clusterfuzz-testcase-minimized-6510704959946752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4e3ab1a5c1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:08 +02:00
Michael Niedermayer
3ca6d26458
avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: 53098 * 40448 cannot be represented in type 'int'
...
Fixes: 2106/clusterfuzz-testcase-minimized-6136503639998464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 18bca25adb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:08 +02:00
Michael Niedermayer
a3b9a5c4c4
avcodec/pafvideo: Fix assertion failure
...
Fixes: 2100/clusterfuzz-testcase-minimized-4522961547558912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4360559ee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:08 +02:00
Michael Niedermayer
0ed96055f4
avcodec/takdec: Fix multiple runtime error: signed integer overflow: 637072 * 4096 cannot be represented in type 'int'
...
Fixes: 2079/clusterfuzz-testcase-minimized-5345861779324928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e4efd41b83 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:08 +02:00
Michael Niedermayer
b6b70060ba
avcodec/mjpegdec: Check that reference frame matches the current frame
...
Fixes: out of array read
Fixes: 2097/clusterfuzz-testcase-minimized-5036861833609216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4705edbbb9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:08 +02:00
Michael Niedermayer
d37559993f
avcodec/tiff: Avoid loosing allocated geotag values
...
Fixes memleak
Fixes: 2076/clusterfuzz-testcase-minimized-6542640243802112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d7cbeab4c1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:08 +02:00
Michael Niedermayer
49b7446317
avcodec/cavs: Fix runtime error: signed integer overflow: -12648062 * 256 cannot be represented in type 'int'
...
Fixes: 2067/clusterfuzz-testcase-minimized-5578430902960128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e6ee86d92 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:08 +02:00
Michael Niedermayer
bb1014279d
avformat/hls: Check local file extensions
...
This reduces the attack surface of local file-system
information leaking.
It prevents the existing exploit leading to an information leak. As
well as similar hypothetical attacks.
Leaks of information from files and symlinks ending in common multimedia extensions
are still possible. But files with sensitive information like private keys and passwords
generally do not use common multimedia filename extensions.
It does not stop leaks via remote addresses in the LAN.
The existing exploit depends on a specific decoder as well.
It does appear though that the exploit should be possible with any decoder.
The problem is that as long as sensitive information gets into the decoder,
the output of the decoder becomes sensitive as well.
The only obvious solution is to prevent access to sensitive information. Or to
disable hls or possibly some of its feature. More complex solutions like
checking the path to limit access to only subdirectories of the hls path may
work as an alternative. But such solutions are fragile and tricky to implement
portably and would not stop every possible attack nor would they work with all
valid hls files.
Developers have expressed their dislike / objected to disabling hls by default as well
as disabling hls with local files. There also where objections against restricting
remote url file extensions. This here is a less robust but also lower
inconvenience solution.
It can be applied stand alone or together with other solutions.
limiting the check to local files was suggested by nevcairiel
This recommits the security fix without the author name joke which was
originally requested by Nicolas.
Found-by: Emil Lerner and Pavel Cheremushkin
Reported-by: Thierry Foucu <tfoucu@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 189ff42196 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-20 02:05:08 +02:00
Michael Niedermayer
c4a3020c1b
avcodec/qdrw: Fix null pointer dereference
...
The RGB555 PACKBITSRGN case tries to read a palette, if such
palette is actually stored then it accesses a null pointer.
All 16bit samples i could find use DIRECTBITSRGN.
Fixes: 2065/clusterfuzz-testcase-minimized-6298930457346048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 46b865ea9f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 03:33:56 +02:00
Michael Niedermayer
1065957f7b
avutil/softfloat: Fix sign error in and improve documentation of av_int2sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6019d721d4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 03:33:22 +02:00
Michael Niedermayer
af85f35d2c
avcodec/hevc_ps: Fix runtime error: index 32 out of bounds for type 'uint8_t [32]'
...
Fixes: 2010/clusterfuzz-testcase-minimized-6209288450080768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 29808fff33 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 03:31:52 +02:00
Michael Niedermayer
e0d1be3539
avcodec/dxv: Check remaining bytes in dxv_decompress_raw()
...
Fixes: Timeout
Fixes: 2006/clusterfuzz-testcase-minimized-5766515037044736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eb50492270 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-05 03:31:29 +02:00
Michael Niedermayer
ce4196561a
avcodec/pafvideo: Check packet size and frame code before ff_reget_buffer()
...
Fixes 1745/clusterfuzz-testcase-minimized-6160693365571584
Fixes: Timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit faa5a2181d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-04 14:14:51 +02:00
Michael Niedermayer
06f6931529
avcodec/ac3dec_fixed: Fix runtime error: left shift of 419 by 23 places cannot be represented in type 'int'
...
Fixes: 1352/clusterfuzz-testcase-minimized-5757565017260032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 136ce8baa4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-04 14:13:02 +02:00
Michael Niedermayer
641b38c9c8
avformat/options: log filename on open
...
The loglevel is choosen so that the main filename and any images of
multi image sequences are shown only at debug level to avoid
clutter.
This makes exploits in playlists more visible. As they would show
accesses to private/sensitive files
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53e0d5d724 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-04 14:11:39 +02:00
Michael Niedermayer
3764e3a2c5
avcodec/aacps: Fix runtime error: left shift of 1073741824 by 1 places cannot be represented in type 'INTFLOAT' (aka 'int')
...
Fixes: 2005/clusterfuzz-testcase-minimized-5744226438479872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9faf098163 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-04 01:11:22 +02:00
Michael Niedermayer
2c3bcf6bf2
avcodec/wavpack: Fix runtime error: shift exponent 32 is too large for 32-bit type 'int'
...
Fixes: 1967/clusterfuzz-testcase-minimized-5757031199801344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b3e580b7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-04 01:10:21 +02:00
Michael Niedermayer
ecc3fe3859
avcodec/wavpack: Fix runtime error: signed integer overflow: 2013265955 - -134217694 cannot be represented in type 'int'
...
Fixes: 1922/clusterfuzz-testcase-minimized-5561194112876544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a47273c803 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-04 00:29:42 +02:00
Michael Niedermayer
9d8c59ce50
avcodec/cinepak: Check input packet size before frame reallocation
...
Reduces time spend decoding 1917/clusterfuzz-testcase-minimized-5023221273329664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e47057e932 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-04 00:29:23 +02:00
Michael Niedermayer
a249250b3a
avcodec/hevc_ps: Fix runtime error: signed integer overflow: 2147483628 + 256 cannot be represented in type 'int'
...
Fixes: 1909/clusterfuzz-testcase-minimized-6732072662073344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6726328f79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-04 00:28:56 +02:00
Michael Niedermayer
9589a7f391
avcodec/ra144: Fixes runtime error: signed integer overflow: 7160 * 327138 cannot be represented in type 'int'
...
Fixes: 1908/clusterfuzz-testcase-minimized-5392712477966336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 08cb69e870 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-04 00:28:23 +02:00
Michael Niedermayer
309ec23130
avcodec/pnm: Use ff_set_dimensions()
...
Fixes: OOM
Fixes: 1906/clusterfuzz-testcase-minimized-4599315114754048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1c0d1d906 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-04 00:28:05 +02:00
Michael Niedermayer
f5c5bec448
avcodec/cavsdec: Fix runtime error: signed integer overflow: 59 + 2147483600 cannot be represented in type 'int'
...
Fixes: 1903/clusterfuzz-testcase-minimized-5359318167715840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 58f8cd4ac5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-06-04 00:27:10 +02:00
Michael Niedermayer
794bcc6eca
avformat/avidec: Limit formats in gab2 to srt and ass/ssa
...
This prevents part of one exploit leading to an information leak
Found-by: Emil Lerner and Pavel Cheremushkin
Reported-by: Thierry Foucu <tfoucu@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5d849b149 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-31 02:45:14 +02:00
Michael Niedermayer
c82db14411
avcodec/acelp_pitch_delay: Fix runtime error: value 4.83233e+39 is outside the range of representable values of type 'float'
...
Fixes: 1902/clusterfuzz-testcase-minimized-4762451407011840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 87bddba43b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-31 02:44:40 +02:00
Michael Niedermayer
343c1d1d7d
avcodec/wavpack: Check float_shift
...
Fixes: runtime error: shift exponent 40 is too large for 32-bit type 'unsigned int'
Fixes: 1898/clusterfuzz-testcase-minimized-5970744880136192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4020b009d1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-31 02:44:17 +02:00
Michael Niedermayer
d542185e05
avcodec/wavpack: Fix runtime error: signed integer overflow: 24 * -2147483648 cannot be represented in type 'int'
...
Fixes: 1894/clusterfuzz-testcase-minimized-4716739789062144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d90c5bf105 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-31 02:43:29 +02:00
Michael Niedermayer
c92acd5ed4
avcodec/ansi: Fix frame memleak
...
Fixes: 1892/clusterfuzz-testcase-minimized-4519341733183488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e091b9b3c7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-31 02:43:15 +02:00
Michael Niedermayer
759739e996
avcodec/jpeg2000dec: Use ff_set_dimensions()
...
Fixes: OOM
Fixes: 1890/clusterfuzz-testcase-minimized-6329019509243904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f3da6fbff8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-31 02:42:35 +02:00
Michael Niedermayer
27fecc7a73
avcodec/truemotion2: Fix passing null pointer to memset()
...
Fixes part of: 1888/clusterfuzz-testcase-minimized-5237704826552320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c901627918 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-31 02:41:31 +02:00
Michael Niedermayer
24ab34a3fc
avcodec/truemotion2: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
...
Fixes part of: 1888/clusterfuzz-testcase-minimized-5237704826552320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9e884f3d9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-31 02:41:09 +02:00
Michael Niedermayer
3b3a3b7a5a
avcodec/ra144: Fix runtime error: signed integer overflow: -2449 * 1398101 cannot be represented in type 'int'
...
Fixes: 1885/clusterfuzz-testcase-minimized-5336328549957632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7c845450d2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-31 02:40:49 +02:00
Michael Niedermayer
7e7c25a48e
avcodec/ra144: Fix runtime error: signed integer overflow: 11184810 * 404 cannot be represented in type 'int'
...
Fixes: 1884/clusterfuzz-testcase-minimized-4637425835966464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4c472c5252 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-31 02:40:24 +02:00
Michael Niedermayer
7f0c66b8cf
avcodec/aac_defines: Add missing () to AAC_HALF_SUM() macro
...
Fixes: runtime error: shift exponent 1073741848 is too large for 32-bit type 'INTFLOAT' (aka 'int')
Fixes: 1880/clusterfuzz-testcase-minimized-4900645322620928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 872bac8159 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-31 02:40:02 +02:00
Michael Niedermayer
62979de168
avcodec/webp: Fixes null pointer dereference
...
Fixes: 1470/clusterfuzz-testcase-minimized-5404421666111488
Fixes: 1472/clusterfuzz-testcase-minimized-5677426430443520
Fixes: 1875/clusterfuzz-testcase-minimized-5536474562822144
Approved-by: BBB
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 67020711b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-31 02:39:20 +02:00
Michael Niedermayer
a8625d1110
avcodec/aacdec_fixed: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
...
Fixes: 1878/clusterfuzz-testcase-minimized-6441918630199296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6b9cb5d26a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-31 02:39:03 +02:00
Michael Niedermayer
21cb305903
avcodec/snow: Fix runtime error: signed integer overflow: 1086573993 + 1086573994 cannot be represented in type 'int'
...
Fixes: 1871/clusterfuzz-testcase-minimized-5719950331215872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b9c032ebc0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-31 02:38:02 +02:00
Michael Niedermayer
9495075a7f
avcodec/jpeg2000: Fix runtime error: signed integer overflow: 4185 + 2147483394 cannot be represented in type 'int'
...
Fixes: 1870/clusterfuzz-testcase-minimized-4686788029317120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 781f88bb26 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-28 14:32:20 +02:00
Michael Niedermayer
5c1c1e89de
avcodec/jpeg2000dec: Check tile offsets more completely
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c1812491f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-28 14:31:16 +02:00
Michael Niedermayer
aaf104e525
avcodec/aacdec_fixed: Fix multiple runtime error: shift exponent 127 is too large for 32-bit type 'int'
...
Fixes: 1851/clusterfuzz-testcase-minimized-5692607495667712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6c3a63fc3d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-28 04:09:14 +02:00
Michael Niedermayer
bd4dcd8731
avcodec/wnv1: More strict buffer size check
...
This requires at least 25% of a picture to allocate and decode it
Fixes: Timeout
Fixes: 1845/clusterfuzz-testcase-minimized-5075974343360512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f50c25124 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-28 04:08:56 +02:00
Michael Niedermayer
25442bd95f
avcodec/libfdk-aacdec: Correct buffer_size parameter
...
the timeDataSize argument to aacDecoder_DecodeFrame() seems undocumented and until
2016 04 (203e3f28fbebec7011342017fafc2a0bda0ce530) unused.
after that commit libfdk-aacdec interprets it as size in sample units and memsets that on error.
FFmpeg as well as others (like GStreamer) did interpret it as size in bytes
Fixes: 1442/clusterfuzz-testcase-minimized-4540199973421056 (This requires recent libfdk to reproduce)
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ca6776a993 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-28 04:06:03 +02:00
Michael Niedermayer
ca3fab8c80
avcodec/sbrdsp_template: Fix: runtime error: signed integer overflow: 849815297 + 1315389781 cannot be represented in type 'int'
...
Fixes: 1770/clusterfuzz-testcase-minimized-5285511235108864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7c36ee216f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-28 04:05:39 +02:00
Michael Niedermayer
1a800e8ff6
avcodec/ivi_dsp: Fix runtime error: left shift of negative value -2
...
Fixes: 1839/clusterfuzz-testcase-minimized-6238490993885184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 357f2316a0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-28 04:04:09 +02:00
Kevin Mark
3ad48f9acb
doc/filters: Clarify scale2ref example
...
Signed-off-by: Kevin Mark <kmark937@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 114e871621 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-28 04:03:52 +02:00
Michael Niedermayer
a3ba6a66a3
avcodec/mlpdec: Do not leave invalid values in matrix_out_ch[] on error
...
Fixes: runtime error: index 12 out of bounds for type 'uint8_t [8]'
Fixes: 1832/clusterfuzz-testcase-minimized-6574546079449088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ac8dfcbd89 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-27 15:00:50 +02:00
Michael Niedermayer
385642f8c8
avcodec/ra144dec: Fix runtime error: left shift of negative value -17
...
Fixes: 1830/clusterfuzz-testcase-minimized-5828293733384192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53c0c637d3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-27 15:00:25 +02:00
Michael Niedermayer
780c360e76
avformat/mux: Fix copy an paste typo
...
Found-by: Roger Scott <rscott@grammatech.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1a36354698 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-27 04:22:52 +02:00
Michael Niedermayer
278bd748a8
avutil/internal: Do not enable CHECKED with DEBUG
...
This avoids potential undefined behavior in debug mode while still allowing
developers which want to check for potential additional overflows to do so
by manually enabling this.
Reviewed-by: wm4
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a44b3abb4c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-27 01:38:40 +02:00
Michael Niedermayer
7fe0a0e9e7
avcodec/aacdec_fixed: Fix runtime error: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
...
Fixes: 1825/clusterfuzz-testcase-minimized-6002833050566656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e87d146d7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-26 12:30:42 +02:00
Michael Niedermayer
6185b5e9bc
avcodec/smc: Check remaining input
...
Fixes: Timeout
Fixes: 1818/clusterfuzz-testcase-minimized-5039166473633792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 356194fcb1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-26 12:28:08 +02:00
Michael Niedermayer
16f76d544d
avcodec/jpeg2000dec: Fix copy and paste error
...
Found-by: jamrial
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5782e0ba8c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-25 11:31:36 +02:00
Michael Niedermayer
c071e74aad
avcodec/jpeg2000dec: Check tile offsets
...
Fixes: runtime error: signed integer overflow: 4096 - -2147483648 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 89325417e7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-25 11:30:56 +02:00
Max Justicz
5753c06dd7
avcodec/sanm: Fix uninitialized reference frames
...
Fixes: poc.snm
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ca616b0f72 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-24 15:53:16 +02:00
Michael Niedermayer
4e8405b347
avcodec/jpeglsdec: Check get_bits_left() before decoding a picture
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4bc3008d04 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-24 15:52:46 +02:00
Michael Niedermayer
0169072409
avcodec/ivi_dsp: Fix multiple runtime error: left shift of negative value -71
...
Fixes: 1734/clusterfuzz-testcase-minimized-5385630815092736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8fb00b3e85 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-22 02:59:15 +02:00
Michael Niedermayer
9a993c5bc8
avcodec/mjpegdec: Fix runtime error: signed integer overflow: -32767 * 130560 cannot be represented in type 'int'
...
Fixes: 1724/clusterfuzz-testcase-minimized-4842395432648704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 40fa6a2fa2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-22 02:59:02 +02:00
Michael Niedermayer
96f0b1de49
avcodec/aacdec_fixed: Fix runtime error: shift exponent 34 is too large for 32-bit type 'int'
...
Fixes: 1721/clusterfuzz-testcase-minimized-4719352135811072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5228e44c7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-21 20:47:26 +02:00
Michael Niedermayer
0e003452c0
avcodec/mpeg4videodec: Check for multiple VOL headers
...
Fixes multiple: runtime error: signed integer overflow: 2147115008 + 413696 cannot be represented in type 'int'
Fixes: 1723/clusterfuzz-testcase-minimized-5309409372667904
Fixes: 1727/clusterfuzz-testcase-minimized-5900685306494976
Fixes: 1737/clusterfuzz-testcase-minimized-5922321338466304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit efeb47fd5d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-21 16:20:39 +02:00
Michael Niedermayer
c06677aab1
avcodec/vmnc: Check location before use
...
Fixes: runtime error: signed integer overflow: 65535 * 64256 cannot be represented in type 'int'
Fixes: 1717/clusterfuzz-testcase-minimized-5491696676634624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec2b76aab4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-21 14:53:17 +02:00
Michael Niedermayer
d7b53e87b9
avcodec/takdec: Fix runtime error: signed integer overflow: 8192 * 524308 cannot be represented in type 'int'
...
Fixes: 1630/clusterfuzz-testcase-minimized-6326111917047808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 955db41192 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-21 14:52:35 +02:00
Michael Niedermayer
4cad001b04
avcodec/aac_defines: Fix: runtime error: left shift of negative value -2
...
Fixes: 1716/clusterfuzz-testcase-minimized-4691012196761600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c3547dcbc3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-21 04:48:26 +02:00
Michael Niedermayer
02b8d62a8c
avcodec/takdec: Fix runtime error: left shift of negative value -63
...
Fixes: 1713/clusterfuzz-testcase-minimized-5791887476654080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d66193252b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-21 04:48:07 +02:00
Michael Niedermayer
fcc87a4676
avcodec/mlpdsp: Fix runtime error: signed integer overflow: -24419392 * 128 cannot be represented in type 'int'
...
Fixes: 1711/clusterfuzz-testcase-minimized-5248503515185152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1d04fc94e1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-21 04:47:19 +02:00
Michael Niedermayer
9b7c194ba1
avcodec/sbrdsp_fixed: fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
...
Fixes: part of 1709/clusterfuzz-testcase-minimized-4513580554649600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 384508b2ff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-21 02:37:11 +02:00
Michael Niedermayer
6bd5fcc463
avcodec/aacsbr_fixed: Fix multiple runtime error: shift exponent 170 is too large for 32-bit type 'int'
...
Fixes part of 1709/clusterfuzz-testcase-minimized-4513580554649600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6310fc714d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-21 02:37:01 +02:00
Michael Niedermayer
f6fbc874d1
avcodec/mlpdec: Do not leave a invalid num_primitive_matrices in the context
...
Fixes: runtime error: index 8 out of bounds for type 'uint8_t [8]'
Fixes: 1699/clusterfuzz-testcase-minimized-6327177438035968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 64ea4d102a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-20 02:42:44 +02:00
Michael Niedermayer
9532ad523e
avcodec/aacsbr_fixed: Fix multiple runtime error: shift exponent 150 is too large for 32-bit type 'int'
...
Fixes: 1681/clusterfuzz-testcase-minimized-5970545365483520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3fb104f447 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-19 13:15:37 +02:00
Michael Niedermayer
053ca03564
avcodec/mimic: Use ff_set_dimensions() to set the dimensions
...
Fixes: OOM
Fixes: 1671/clusterfuzz-testcase-minimized-4759078033162240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e434840fd4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-18 18:11:52 +02:00
Michael Niedermayer
1de61c6b01
avcodec/fic: Fix multiple runtime error: signed integer overflow: 5793 * 419752 cannot be represented in type 'int'
...
Fixes: 1669/clusterfuzz-testcase-minimized-5287529198649344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a173f484b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-18 18:11:25 +02:00
Michael Niedermayer
b33d01d8a2
Update for 3.0.8
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-18 12:36:32 +02:00
Michael Niedermayer
dac9ef7108
avcodec/mlpdec: Fix: runtime error: left shift of negative value -8
...
Fixes: 1658/clusterfuzz-testcase-minimized-4889937130291200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 25c81e4b73 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-18 12:36:32 +02:00
Michael Niedermayer
f2afdab8e4
avcodec/dfa: Fix: runtime error: signed integer overflow: -14202 * 196877 cannot be represented in type 'int'
...
Fixes: 1657/clusterfuzz-testcase-minimized-4710000079405056
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 58ac7fb9c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-18 12:36:32 +02:00
James Almer
abe2d4de92
avcodec/hevc_sei: fix amount of bits skipped when reading picture timing SEI message
...
The code was skipping the entire reported SEI message size regardless of
the amount of bits read.
While in theory safe for NALU where the picture timing SEI message is alone
or at the end as we're using the checked bitstream reader, it isn't in any
other situation, where every SEI message in the NALU after the picture
timing one would potentially fail to parse.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit f738140807 )
Conflicts:
libavcodec/hevc_sei.c
2017-05-17 16:58:59 -03:00
James Almer
30415662ef
avformat/concatdec: fix the h264 annexb extradata check
...
The start code can be either in the first three or four bytes.
(cherry picked from commit b4330a0e02 )
2017-05-17 16:57:38 -03:00
Aaron Levinson
c54a76bf71
avformat/utils: free AVStream.codec properly in free_stream()
...
Fixes memory leaks.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit b9d2005ea5 )
2017-05-17 16:27:25 -03:00
James Almer
676ba8eff8
avcodec/options: do a more thorough clean up in avcodec_copy_context()
...
Free coded_frame and coded_side_data to prevent potential leaks.
Reviewed-by: Aaron Levinson <alevinsn@aracnet.com >
Tested-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit cac8de2da5 )
2017-05-17 16:26:06 -03:00
James Almer
cf44f0ae6a
avcodec/options: factorize avcodec_copy_context() cleanup code
...
Reviewed-by: Aaron Levinson <alevinsn@aracnet.com >
Tested-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 54a4c9b4e9 )
2017-05-17 16:25:14 -03:00
Michael Niedermayer
a1627fe928
avcodec/aacdec: Fix runtime error: signed integer overflow: 2147483520 + 255 cannot be represented in type 'int'
...
Fixes: 1656/clusterfuzz-testcase-minimized-5900404925661184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 94d05ff159 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
a1babbd4de
avcodec/aacdec_template: Fix fixed point scale in decode_cce()
...
Fixes: runtime error: shift exponent 1073741824 is too large for 32-bit type 'int'
Fixes: 1654/clusterfuzz-testcase-minimized-5151903795118080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53a502206a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
c32237e948
avcodec/flicvideo: Check frame_size before decrementing
...
Fixes: runtime error: signed integer overflow: -2147483627 - 22 cannot be represented in type 'int'
Fixes: 1637/clusterfuzz-testcase-minimized-5376582493405184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 355e27e24d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
28f2341e2f
avcodec/mlpdec: Fix runtime error: left shift of negative value -1
...
Fixes: 1636/clusterfuzz-testcase-minimized-5310494757879808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 552adf1dd3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
e79851f2e7
avcodec/takdec: Fix runtime error: left shift of negative value -42
...
Fixes: 1635/clusterfuzz-testcase-minimized-4992749856096256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 99c4c76cfb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
dcbebc931e
avcodec/hq_hqa: Fix: runtime error: signed integer overflow: -255 * 10180917 cannot be represented in type 'int'
...
Fixes: 1626/clusterfuzz-testcase-minimized-6416580571299840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d9cb583c8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
e05148dfe6
avcodec/truemotion1: Fix multiple runtime error: signed integer overflow: 1246906962 * 2 cannot be represented in type 'int'
...
Fixes: 1616/clusterfuzz-testcase-minimized-5119196578971648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5ea6bc2a166edac37042f2bbc28eb603a0fbeccb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
cd4674f608
avcodec/svq3: Fix runtime error: left shift of negative value -6
...
Fixes: 1604/clusterfuzz-testcase-minimized-5312060206350336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6eb006ad4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
55d320ddf8
avcodec/tiff: reset sampling[] if its invalid
...
Fixes divission by 0
Fixes: clusterfuzz-testcase-minimized-5592896440893440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f08122fbe0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
ec7206fdf8
avcodec/aacps: Fix undefined behavior
...
Fixes: 1337/clusterfuzz-testcase-minimized-5212314171080704
Fixes the existence of a potentially invalid pointer intermediate
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 527f89e059 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
9cd39ab7d3
avcodec/opus_silk: Fix integer overflow and out of array read
...
Fixes: 1362/clusterfuzz-testcase-minimized-6097275002552320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4654baff12 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
c82ea252e3
avcodec/flacdec: Return error code instead of 0 for failures
...
Fixes: infinite loop
Fixes: 1418/clusterfuzz-testcase-minimized-5934472438480896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3f5a68533d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
2790054dc2
avcodec/snowdec: Check width
...
Fixes: out of array read
Fixes: 1419/clusterfuzz-testcase-minimized-6108700873850880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 78aa93807b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
8198258d9e
avcodec/webp: Update canvas size in vp8_lossy_decode_frame() as in vp8_lossless_decode_frame()
...
Fixes: 1407/clusterfuzz-testcase-minimized-6044604124102656
Fixes: 1420/clusterfuzz-testcase-minimized-6059927359455232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 72810d20b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
edf7bd14a8
avcodec/webp: Factor update_canvas_size() out
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4f63b78b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
98dff828d8
avcodec/cllc: Check prefix
...
Fixes: runtime error: left shift of 1610706944 by 1 places cannot be represented in type 'int'
Fixes: 1421/clusterfuzz-testcase-minimized-6239947507892224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 62c5949bec )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
0246760e94
avcodec/rscc: Check pixel_size for overflow
...
Fixes: 1509/clusterfuzz-testcase-minimized-5129419876204544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 934572c5c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
a359138fb3
avcodec/dds: Fix runtime error: left shift of 210 by 24 places cannot be represented in type 'int'
...
Fixes: 1510/clusterfuzz-testcase-minimized-5826231746428928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit afb4632cc3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
eeece50aa2
avcodec/mpeg4videodec: Clear sprite wraping on unsupported cases in VOP decode
...
Fixes: Integer overflow
Fixes: 1572/clusterfuzz-testcase-minimized-4578773729017856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 467677769a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
e2fd01c282
avcodec/ac3dec: Fix: runtime error: index -1 out of bounds for type 'INTFLOAT [2]'
...
It seems dual mono with a LFE channel is not forbidden
Fixes: 1570/clusterfuzz-testcase-minimized-6455337349545984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c55e637072 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
99cbee2a2f
avcodec/hqxdsp: Fix runtime error: signed integer overflow: -196264 * 11585 cannot be represented in type 'int'
...
Fixes: 1568/clusterfuzz-testcase-minimized-5944868608147456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b923213276 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
49109b0c6f
avcodec/g723_1dec: Fix LCG type
...
Fixes: 1567/clusterfuzz-testcase-minimized-5693653555085312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f2c539d350 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
4ffab6703b
libswscale/tests/swscale: Fix uninitialized variables
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7796f29065 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
52f4c9c31f
avcodec/ffv1dec: Fix runtime error: signed integer overflow: 1550964438 + 1550964438 cannot be represented in type 'int'
...
Fixes: 1559/clusterfuzz-testcase-minimized-5048096079740928
Fixes: 1560/clusterfuzz-testcase-minimized-6011037813833728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8630b2cd36 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
e1fcdf1930
avcodec/webp: Fix signedness in prefix_code check
...
Fixes: out of array read
Fixes: 1557/clusterfuzz-testcase-minimized-6535013757616128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c5cd1c9d3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
f857975bfd
avcodec/svq3: Fix runtime error: signed integer overflow: 169 * 12717677 cannot be represented in type 'int'
...
Fixes: 1556/clusterfuzz-testcase-minimized-5027865978470400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 86b1b0d33d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
09ac75c47c
avcodec/mlpdec: Check that there is enough data for headers
...
Fixes: out of array access
Fixes: 1541/clusterfuzz-testcase-minimized-6403410590957568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e3e51f8c14 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
c24bff130d
avcodec/ac3dec: Keep track of band structure
...
It is needed in some corner cases that seem not to be forbidden
Fixes: out of array index
Fixes: 1538/clusterfuzz-testcase-minimized-4696904925446144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9351a156de )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
f8502c267f
avcodec/webp: Add missing input padding
...
Fixes: 1536/clusterfuzz-testcase-minimized-5973925404082176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a3508cc3fe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
113bba3a2a
avcodec/aacdec_fixed: Fix runtime error: left shift of negative value -1
...
Fixes: 1535/clusterfuzz-testcase-minimized-5826695535788032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 26227d9186 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
03b8d285df
avcodec/aacsbr_template: Do not change bs_num_env before its checked
...
Fixes: 1489/clusterfuzz-testcase-minimized-5075102901207040
Fixes: out of array access
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 87b08ee6d2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
4bc3ae5533
avcodec/mlp: Fix multiple runtime error: left shift of negative value -1
...
Fixes: 1512/clusterfuzz-testcase-minimized-4713846423945216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 74dc728a2c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
d302803c39
avcodec/vp8dsp: vp7_luma_dc_wht_c: Fix multiple runtime error: signed integer overflow: -1366381240 + -1262413604 cannot be represented in type 'int'
...
Fixes: 1440/clusterfuzz-testcase-minimized-5785716111966208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ccce2248bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
86a7a933fc
avcodec/avcodec: Limit the number of side data elements per packet
...
Fixes: 1293/clusterfuzz-testcase-minimized-6054752074858496
See: [FFmpeg-devel] [PATCH] avcodec/avcodec: Limit the number of side data elements per packet
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d5711cb891 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
b2d2e59174
avcodec/texturedsp: Fix runtime error: left shift of 255 by 24 places cannot be represented in type 'int'
...
Fixes: 1505/clusterfuzz-testcase-minimized-4561688818876416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f225003d17 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
43965feca7
avcodec/g723_1dec: Fix runtime error: left shift of negative value -1
...
Fixes: 1504/clusterfuzz-testcase-minimized-6249212138225664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4c0245686 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
188e015c7b
avcodec/wmv2dsp: Fix runtime error: signed integer overflow: 181 * -17047030 cannot be represented in type 'int'
...
Fixes: 1503/clusterfuzz-testcase-minimized-5369271855087616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df640dbbc9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
a53182a71c
avcodec/diracdec: Fix Assertion frame->buf[0] failed at libavcodec/decode.c:610
...
Fixes: 1487/clusterfuzz-testcase-minimized-6288036495097856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6899e6e560 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
b8c80b9d2d
avcodec/msmpeg4dec: Check for cbpy VLC errors
...
Fixes: runtime error: left shift of negative value -1
Fixes: 1480/clusterfuzz-testcase-minimized-5188321007370240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 15e892aad1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
d75f932e77
avcodec/cllc: Check num_bits
...
Fixes: runtime error: shift exponent -2 is negative
Fixes: 1479/clusterfuzz-testcase-minimized-6638493360979968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2bfd0a9758 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
07e8da34fa
avcodec/cllc: Factor VLC_BITS/DEPTH out, do not use repeated literal numbers
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e717fa1f0a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
47c6f1b600
avcodec/dvbsubdec: Check entry_id
...
Fixes: randomly writing over the array end
Fixes: 1473/clusterfuzz-testcase-minimized-5768907824562176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8a69f2602f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
ddc77f1f1e
avcodec/aacdec_fixed: Fix multiple shift exponent 33 is too large for 32-bit type 'int'
...
Fixes: 1471/clusterfuzz-testcase-minimized-6376460543590400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a0ff78168 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
3cb8d1f2c1
avcodec/mpeg12dec: Fixes runtime error: division by zero
...
Fixes: 1464/clusterfuzz-testcase-minimized-4925445571084288
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c0ece1f4ad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
ee12581551
avcodec/webp: Always set pix_fmt
...
Fixes: out of array access
Fixes: 1434/clusterfuzz-testcase-minimized-6314998085189632
Fixes: 1435/clusterfuzz-testcase-minimized-6483783723253760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6b5d3fb26f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
3812e40894
avfilter/vf_uspp: Fix currently unused input frame dimensions
...
Found-by: Nicolas
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 942036e97c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
c0744d7549
avcodec/truemotion1: Fix multiple runtime error: left shift of negative value -1
...
Fixes: 1446/clusterfuzz-testcase-minimized-5577409124368384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit db5fae3229 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
743c419a59
avcodec/eatqi: Fix runtime error: signed integer overflow: 4466147 * 1075 cannot be represented in type 'int'
...
Fixes: 1443/clusterfuzz-testcase-minimized-4826998612426752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8de60ba27 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
7b4d0a2402
avcodec/dss_sp: Fix runtime error: signed integer overflow: 2147481189 + 4096 cannot be represented in type 'int'
...
Fixes: 1441/clusterfuzz-testcase-minimized-6223152357048320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ea4287893 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
李赞
00e8a7adf4
avformat/wavdec: Check chunk_size
...
Fixes integer overflow and out of array access
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d23219637 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
742ccace7c
avcodec/cavs: Check updated MV
...
Fixes: runtime error: signed integer overflow: 251 + 2147483647 cannot be represented in type 'int'
Fixes: 1438/clusterfuzz-testcase-minimized-4917542646710272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5871adc90f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
7956757d7d
avcodec/y41pdec: Fix width in input buffer size check
...
Fixes: out of array read
Fixes: 1437/clusterfuzz-testcase-minimized-4569970002362368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d8d372947 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
70cc62271b
avcodec/svq3: Fix multiple runtime error: signed integer overflow: -237341 * 24552 cannot be represented in type 'int'
...
Fixes: 1429/clusterfuzz-testcase-minimized-5959951610544128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ae6fd1790f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
4800f38ffb
avcodec/texturedsp: Fix runtime error: left shift of 218 by 24 places cannot be represented in type 'int'
...
Fixes: 1428/clusterfuzz-testcase-minimized-5263281793007616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2bd8eb05d2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
dfda82809c
avcodec/lagarith: Check scale_factor
...
Fixes: 1425/clusterfuzz-testcase-minimized-6295712339853312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ed3c9b5b0d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
c1a6521df8
avcodec/lagarith: Fix runtime error: left shift of negative value -1
...
Fixes: 1424/clusterfuzz-testcase-minimized-6088327159611392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ddb2dd7edb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
0fed5947bd
avcodec/takdec: Fix multiple runtime error: left shift of negative value -1
...
Fixes: 1423/clusterfuzz-testcase-minimized-5063889899225088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c5d2fa2fdf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
bac7b59542
avcodec/indeo2: Check for invalid VLCs
...
Fixes: timeout
Fixes: 1416/clusterfuzz-testcase-minimized-5536862435278848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 159fb8ff7e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
c152707dc1
avcodec/g723_1dec: Fix several integer related cases of undefined behaviour
...
Fixes: 1412/clusterfuzz-testcase-minimized-6561308772139008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d3088e0fd8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
de5b23ead6
avcodec/htmlsubtitles: Check for string truncation and return error
...
Fixes out of array access
Fixes: 1354/clusterfuzz-testcase-minimized-5520132195483648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f4ae3cce64 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
154c73b63e
avcodec/bmvvideo: Fix runtime error: left shift of 137 by 24 places cannot be represented in type 'int'
...
Fixes: 1411/clusterfuzz-testcase-minimized-5776085184675840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 29692023b2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
3724f36b09
avcodec/dss_sp: Fix multiple runtime error: signed integer overflow: -15699 * -164039 cannot be represented in type 'int'
...
Fixed: 1409/clusterfuzz-testcase-minimized-5237365020819456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea59ef0c03 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
6cb55a7032
avcodec/dvbsubdec: check region dimensions
...
Fixes: 1408/clusterfuzz-testcase-minimized-6529985844084736
Fixes: integer overflow
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0075d9eced )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
6c15025dee
avcodec/vp8dsp: Fixes: runtime error: signed integer overflow: 1330143360 - -1023040530 cannot be represented in type 'int'
...
Fixes: 1406/clusterfuzz-testcase-minimized-5064865125236736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8824b7370a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
386767ecea
avcodec/hqxdsp: Fix multiple runtime error: signed integer overflow: 248220 * 21407 cannot be represented in type 'int' in idct_col()
...
Fixes: 1405/clusterfuzz-testcase-minimized-5011491835084800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d5118f81b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
6b334460de
avcodec/cavsdec: Check sym_factor
...
Fixes: runtime error: signed integer overflow: 25984 * 130560 cannot be represented in type 'int'
Fixes: 1404/clusterfuzz-testcase-minimized-5000441286885376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 279420b5a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
f903400a0b
avcodec/cdxl: Check format for BGR24
...
Fixes: out of array access
Fixes: 1427/clusterfuzz-testcase-minimized-5020737339392000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e42736b95 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
51e4936798
avcodec/ffv1dec: Fix copying planes of paletted formats
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a4d387195 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
e4b1426e1b
avcodec/wmv2dsp: Fix runtime error: signed integer overflow: 181 * -12156865 cannot be represented in type 'int'
...
Fixes: 1401/clusterfuzz-testcase-minimized-6526248148795392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b1f66cf5c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
9320f86494
avcodec/xwddec: Check bpp more completely
...
Fixes out of array access
Fixes: 1399/clusterfuzz-testcase-minimized-4866094172995584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 441026fcb1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
d55d821b9e
avcodec/s302m: Fix left shift of 8 by 28 places cannot be represented in type 'int'
...
Fixes: 1395/clusterfuzz-testcase-minimized-5330939741732864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a38e9797cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
d93c75f037
avcodec/eamad: Fix runtime error: signed integer overflow: 49674 * 49858 cannot be represented in type 'int'
...
Fixes: 1394/clusterfuzz-testcase-minimized-6493376885030912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ac1c87194 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
87c1cff598
avcodec/g726: Fix runtime error: left shift of negative value -2
...
Fixes: 1393/clusterfuzz-testcase-minimized-5948366791901184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c04aa14882 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
c4371e8b2f
avcodec/ra144: Fix runtime error: left shift of negative value -798
...
Fixes: 1388/clusterfuzz-testcase-minimized-6680800936329216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 78bf446852 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:20 +02:00
Michael Niedermayer
9371fef23c
avcodec/mss34dsp: Fix multiple signed integer overflow
...
Fixes: 1387/clusterfuzz-testcase-minimized-4802757766676480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 464c4b86ee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
95700803f4
avcodec/targa_y216dec: Fix width type
...
Fixes out of array access
Fixes: 1376/clusterfuzz-testcase-minimized-6361794975105024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3e56db8926 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
2d8a3daddb
avcodec/texturedsp: Fix multiple runtime error: left shift of 255 by 24 places cannot be represented in type 'int'
...
Fixes: 1386/clusterfuzz-testcase-minimized-5323086394032128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e92fb2bea1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
7465d229cb
avcodec/ivi_dsp: Fix multiple left shift of negative value -2
...
Fixes: 1385/clusterfuzz-testcase-minimized-5552882663292928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e88cc94e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
0caf6fa51e
avcodec/svq3: Fix multiple runtime error: signed integer overflow: 44161 * 61694 cannot be represented in type 'int'
...
Fixes: 1382/clusterfuzz-testcase-minimized-6013445293998080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 669419939c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
74f35b9d5e
avcodec/msmpeg4dec: Correct table depth
...
Fixes undefined shift
Fixes: 1381/clusterfuzz-testcase-minimized-5513944540119040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1121d92707 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
daa9bca16b
avcodec/dds: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
...
Fixes: 1380/clusterfuzz-testcase-minimized-650122545122508
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8a8335de03 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
05b8e57aba
avcodec/cdxl: Check format parameter
...
Fixes out of array access
Fixes: 1378/clusterfuzz-testcase-minimized-5715088008806400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e1b60aad77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
c99e86556c
avutil/softfloat: Fix overflow in av_div_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 277e397eb5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
a5c7c22c66
avcodec/hq_hqa: Fix runtime error: left shift of negative value -207
...
Fixes: 1375/clusterfuzz-testcase-minimized-6070134701555712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1283c42447 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
6f57b9d715
avcodec/mss3: Change types in rac_get_model_sym() to match the types they are initialized from
...
Fixes integer overflow
Fixes: 1372/clusterfuzz-testcase-minimized-5712192982745088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ef0f39271 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
9f4e2b15e0
avcodec/shorten: Check k in get_uint()
...
Fixes: undefined shift
Fixes: 1371/clusterfuzz-testcase-minimized-5770822591447040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b6a51f59c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
65ec573358
avcodec/webp: Fix null pointer dereference
...
Fixes: 1369/clusterfuzz-testcase-minimized-5048908029886464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9bf4523e40 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
969689d7d7
avcodec/dfa: Fix signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
...
Fixes: 1368/clusterfuzz-testcase-minimized-4507293276176384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 12936a4585 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
94a58e597b
avcodec/g723_1: Fix multiple runtime error: left shift of negative value
...
Fixes: 1367/clusterfuzz-testcase-minimized-571496882346393
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4ace2d2219 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
c78e5a2cb4
avcodec/mimic: Fix runtime error: left shift of negative value -1
...
Fixes: 1365/clusterfuzz-testcase-minimized-5624158450876416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fc2c420b82 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
903c4b2c3c
avcodec/fic: Fix multiple left shift of negative value -15
...
Fixes: 1356/clusterfuzz-testcase-minimized-6008489086287872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b20c71409b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
1e034a9ffe
avcodec/mlpdec: Fix runtime error: left shift of negative value -22
...
Fixes: 1355/clusterfuzz-testcase-minimized-6662205472768000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c535436cbe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
93702fd208
avcodec/snowdec: Check qbias
...
Fixes: signed integer overflow: -1094995529 * 131 cannot be represented in type 'int'
Fixes: 1353/clusterfuzz-testcase-minimized-5208180449607680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 523205ce1e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
317c043316
avutil/softfloat: Fix multiple runtime error: left shift of negative value -8
...
Fixes: 1352/clusterfuzz-testcase-minimized-5757565017260032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 35f3df0d76 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
4a58c5a3b9
avcodec/aacsbr_template: Do not leave bs_num_env invalid
...
Fixes out of array read
Fixes: 1349/clusterfuzz-testcase-minimized-5370707196248064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8ad83b793 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
d0947505dc
avcodec/mdec: Fix signed integer overflow: 28835400 * 83 cannot be represented in type 'int'
...
Fixes: 1346/clusterfuzz-testcase-minimized-5776732600664064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a234b5ade3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
c93df94fe3
avcodec/dfa: Fix off by 1 error
...
Fixes out of array access
Fixes: 1345/clusterfuzz-testcase-minimized-6062963045695488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f52fbf4f3e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
e488ad44aa
avcodec/nellymoser: Fix multiple left shift of negative value -8591
...
Fixes: 1342/clusterfuzz-testcase-minimized-5490842129137664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0953736b7e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
2871d8dbb5
avcodec/cdxl: Fix signed integer overflow: 14243456 * 164 cannot be represented in type 'int'
...
Fixes: 1341/clusterfuzz-testcase-minimized-5441502618583040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1002932a3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
add1e9c371
avcodec/g722: Fix multiple runtime error: left shift of negative value -1
...
Fixes: 1340/clusterfuzz-testcase-minimized-4669892148068352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f55df62998 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
c4ae78ef06
avcodec/dss_sp: Fix multiple left shift of negative value -466
...
Fixes: 1339/clusterfuzz-testcase-minimized-4614671485108224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38152d9368 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
ca6277e1ee
avcodec/wnv1: Fix runtime error: left shift of negative value -1
...
Fixes: 1338/clusterfuzz-testcase-minimized-6485546354343936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9fac508ca4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
8054b21f8d
avcodec/tiertexseqv: set the fixed dimenasions, do not depend on the demuxer doing so
...
Fixes: out of array access
Fixes: 1348/clusterfuzz-testcase-minimized-6195673642827776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ce551a3925 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
2fe493ed72
avcodec/mjpegdec: Fix runtime error: signed integer overflow: -24543 * 2031616 cannot be represented in type 'int'
...
Fixes: 943/clusterfuzz-testcase-5114865297391616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a78ae465fd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
7d0830c546
avcodec/cavsdec: Fix undefined behavior from integer overflow
...
Fixes: 1335/clusterfuzz-testcase-minimized-5566961566089216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a0e5f7f363 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
27fbb554fc
avcodec/dvdsubdec: Fix runtime error: left shift of 242 by 24 places cannot be represented in type 'int'
...
Fixes: 1080/clusterfuzz-testcase-5353236754071552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ce7098b8f2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
d0ac194ea4
libavcodec/mpeg4videodec: Convert sprite_offset to 64bit
...
This avoids intermediates from overflowing (the final values are checked)
Fixes: runtime error: signed integer overflow: -167712 + -2147352576 cannot be represented in type 'int'
Fixes: 1298/clusterfuzz-testcase-minimized-5955580877340672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1c3a14073 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
79d027ae7c
avcodec/pngdec: Use ff_set_dimensions()
...
Fixes OOM
Fixes: 1314/clusterfuzz-testcase-minimized-4621997222920192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a0296fc056 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
32f047ce5c
avcodec/msvideo1: Check buffer size before re-getting the frame
...
Fixes timeout
Fixes: 1306/clusterfuzz-testcase-minimized-6152296217968640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cabfed6895 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
4a6426d3cb
avcodec/h264_cavlc: Fix undefined behavior on qscale overflow
...
Fixes: 1214/clusterfuzz-testcase-minimized-6130606599569408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fc8cff96ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
487ea209f8
avcodec/dcadsp: Fix runtime error: signed integer overflow
...
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9244b839b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
6828048800
avcodec/svq3: Increase offsets to prevent integer overflows
...
Fixes: 1280/clusterfuzz-testcase-minimized-6102353767825408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 382b4fc9b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
53c2b81281
avcodec/indeo2: Check remaining bits in ir2_decode_plane()
...
Fixes: 1290/clusterfuzz-testcase-minimized-5815578902134784
Fixes: timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b29feec982 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
b2af4884a9
avcodec/vp3: Check remaining bits in unpack_dct_coeffs()
...
Decreases the time spend decoding junk.
May fix: 1283/clusterfuzz-testcase-minimized-6221126759874560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f00300b77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
345ae4e8df
doc/developer: Add terse documentation of assumed C implementation defined behavior
...
Suggested-by: "Ronald S. Bultje" <rsbultje@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b706ddbae3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
b3328c069c
avcodec/mdec: Fix runtime error: left shift of negative value -127
...
Fixes undefined behavior
Fixes: 1275/clusterfuzz-testcase-minimized-6718162017976320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ca82975b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
8bca0d7651
avcodec/x86/vc1dsp_init: Fix build failure with --disable-optimizations and clang
...
compilers doing DCE at -O0 do not necessarily understand "complex" boolean expressions
Build succeeds with this change, this was the only failure
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fa8fd0808f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Martin Vignali
19a58a10fd
libavcodec/exr : fix float to uint16 conversion for negative float value
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e46d637452 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Derek Buitenhuis
b1d5c2de2b
avformat/webmdashenc: Validate the 'streams' adaptation sets parameter
...
It should not be a value larger than the number of streams we have,
or it will cause invalid reads and/or SIGSEGV.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec07efa700 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Derek Buitenhuis
351dc1f33a
avformat/webmdashenc: Require the 'adaptation_sets' option to be set
...
This seems to be non-optional, and if the muxer is run without it,
strlen() is run on NULL, causing a segfault.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cbd3a68f3e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
70e26e9c25
avcodec/dvdsubdec: Fixes 2 runtime error: left shift of 170 by 24 places cannot be represented in type 'int'
...
Fixes: 619/clusterfuzz-testcase-5803914534322176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 61ee2ca775 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
ed0c3290f8
avformat/oggparsedaala: Do not leave an invalid value in gpshift
...
Fixes: undefined behavior
Fixes: 702974
Found-by: Thomas Guilbert <tguilbert@google.com >
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 23ae3cc822 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
98f93f5272
avformat/oggparsedaala: Check duration for AV_NOPTS_VALUE
...
This avoids an integer overflow
the solution matches oggparsevorbis.c and 45581ed15d
Fixes: 700242
Found-by: Thomas Guilbert <tguilbert@google.com >
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 679a315424 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
0cbd48a38b
avfilter/af_sofalizer: Fix bad shift
...
Fixes CID1396835
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4064f3f0df )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
408242556c
avfilter/avfiltergraph: Add assert to write down in machine readable form what is assumed about sample rates in swap_samplerates_on_filter()
...
Fixes CID1397292
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f2b360fc0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
cc4a13b8a7
avcodec/tiff: Perform multiply in tiff_unpack_lzma() as 64bit
...
This should make no difference as the value should not be able to be that large
but its more correct this way
Fixes CID1348138
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f48b6b8b91 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Philip Langdale
0a13449b28
avcodec/vdpau_hevc: Fix potential out-of-bounds write
...
The maximum number of references is 16, so the index value cannot
exceed 15.
Fixes Coverity CID 1348139, 1348140, 1348141
(cherry picked from commit 4e6d1c1f4e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
f1e6c03739
avcodec/tiff: Check geotag count for being non zero
...
Fixes memleak
Fixes: 874/clusterfuzz-testcase-5252796175613952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3182e19c1c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
fd5f357461
avcodec/vp56: Check avctx->error_concealment before enabling EC
...
Fixes timeout with 847/clusterfuzz-testcase-5291877358108672
Fixes timeout with 850/clusterfuzz-testcase-5721296509861888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 98da63b3f5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
72b968361b
avcodec/tiff: Check stripsize strippos for overflow
...
Fixes: 861/clusterfuzz-testcase-5688284384591872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d996b5649 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
6a70c38e39
avcodec/mpegaudiodec_template: Make l3_unscale() work with e=0
...
Fixes undefined behavior
Fixes: 830/clusterfuzz-testcase-6253175327686656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ebed703f1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
5e69ec6c2f
avcodec/tiff: Check for multiple geo key directories
...
Fixes memleak
Fixes: 826/clusterfuzz-testcase-5316921379520512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 108b02e547 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
9ff9e3931b
avcodec/wavpack: Fix runtime error: shift exponent 32 is too large for 32-bit type 'int'
...
Fixes: 822/clusterfuzz-testcase-4873433189974016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7cebc5a9cc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
8df6363188
avcodec/rv34: Fix runtime error: signed integer overflow: 36880 * 66288 cannot be represented in type 'int'
...
Fixes: 768/clusterfuzz-testcase-4807444305805312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a66c6e28b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
bb0baaf580
avcodec/amrwbdec: Fix runtime error: left shift of negative value -1
...
Fixes: 763/clusterfuzz-testcase-6007567320875008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 44e2105189 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
7b91d4f07b
avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: -135088512 * 16 cannot be represented in type 'int'
...
Fixes: 736/clusterfuzz-testcase-5580263943831552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e2a4f1a9eb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
625044336e
avcodec/h264_mvpred: Fix runtime error: left shift of negative value -1
...
Fixes: 734/clusterfuzz-testcase-4821293192970240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 222c9f031d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
8b4386ab87
avcodec/mjpegdec: Fix runtime error: left shift of negative value -127
...
Fixes: 733/clusterfuzz-testcase-4682158096515072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 800d02abe0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
e4d5f9bf93
avcodec/wavpack: Fix runtime error: left shift of negative value -5
...
Fixes: 729/clusterfuzz-testcase-5154831595470848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3016e919d4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
41beb7297f
avcodec/wavpack: Fix runtime error: left shift of negative value -2
...
Fixes: 723/clusterfuzz-testcase-6471394663596032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ba15005132 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
b7239fec9d
avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: 134527392 * 16 cannot be represented in type 'int'
...
This checks the sprite delta intermediates for overflow
Fixes: 716/clusterfuzz-testcase-4890287480504320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fab13bbbcd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
f458d65bb4
avcodec/mpeg12dec: Fix runtime error: left shift of negative value -13
...
Fixes: 709/clusterfuzz-testcase-4789836449841152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d757ddbaab )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
868de78861
avcodec/h264_mvpred: Fix multiple runtime error: left shift of negative value
...
Fixes: 710/clusterfuzz-testcase-5091051431788544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab998f4c7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
a44c53f8d7
avcodec/adxdec: Fix runtime error: left shift of negative value -1
...
Fixes: 705/clusterfuzz-testcase-5129572590813184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d23727e042 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
ab92ed6365
avcodec/mpeg4videodec: Improve the overflow checks in mpeg4_decode_sprite_trajectory()
...
Also clear the state on errors
Fixes integer overflows in 701/clusterfuzz-testcase-6594719951880192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eb41956636 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
20c36f04b9
avcodec/mjpegdec: Fix runtime error: left shift of negative value -511
...
Fixes: 693/clusterfuzz-testcase-6109776066904064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4b72d5cd6f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
250d2b402a
avcodec/h264_direct: Fix runtime error: left shift of negative value -14
...
Fixes: 682/clusterfuzz-testcase-4799120021651456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4bd3f1ce3e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
e8fb38f48c
avcodec/pictordec: Check plane value before doing value/mask computations
...
Fixes integer overflow
Fixes: 675/clusterfuzz-testcase-6722971232108544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 63e400a880 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
5a4709e9e3
avcodec/mpeg4videodec: Fix runtime error: left shift of negative value -2650
...
Fixes: 674/clusterfuzz-testcase-6713275880308736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 25e93aacc2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
6da1353a5a
avcodec/eac3dec: Fix runtime error: left shift of negative value -3
...
Fixes: 672/clusterfuzz-testcase-5595018867769344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 87eb374970 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
89ffe4e0e0
avcodec/mpeg12dec: Fix runtime error: left shift of negative value -2
...
671/clusterfuzz-testcase-4990381827555328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aff8cf18cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
2e7621d615
avcodec/mpeg4videodec: Check the other 3 sprite points for intermediate overflows
...
This is not necessarily specific to fuzzed files
Fixes: Multiple integer overflows
Fixes: 656/clusterfuzz-testcase-6463814516080640
Fixes: 658/clusterfuzz-testcase-6691260146384896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 76ba09d182 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
c66899d5e4
avcodec/mpeg4videodec: Check sprite_offset in addition to shifts
...
Fixes: 651/clusterfuzz-testcase-5710668915277824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6871df02d9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
99696ad046
avcodec/mpeg4video: Fix runtime error: left shift of negative value
...
Fixes: 644/clusterfuzz-testcase-4726434209726464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6179dc8aa7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
d6419e984f
avcodec/ituh263dec: Fix runtime error: left shift of negative value -22
...
Fixes: 639/clusterfuzz-testcase-5143866241974272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 631f748491 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
a9d1e7d3c8
avcodec/rv40: Fix runtime error: left shift of negative value
...
Fixes: 630/clusterfuzz-testcase-6608718928019456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 956472a323 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
37400a9068
avcodec/h264_cabac: runtime error: signed integer overflow: 2147483647 + 14 cannot be represented in type 'int'
...
Fixes: 614/clusterfuzz-testcase-4931860079575040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 258763ad0e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
a18c76cb78
avcodec/mpeg4videodec: Fix runtime error: shift exponent -2 is negative
...
Fixes: 612/clusterfuzz-testcase-4707817137111040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa2b75263e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
97bbd8e8d3
avcodec/mjpegdec: Fix runtime error: left shift of negative value -507
...
Fixes: 611/clusterfuzz-testcase-5613455820193792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c91bdd4524 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
2fd1ab16d9
avcodec/eac3dec: Fix runtime error: left shift of negative value
...
Fixes: 610/clusterfuzz-testcase-4831030085156864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 067485b673 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
9a891b843c
avcodec/htmlsubtitles: Fix reading one byte beyond the array
...
Fixes: fuzz-2-ffmpeg_SUBTITLE_AV_CODEC_ID_SUBRIP_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 04bd1b38ee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
bb4ca14d13
avcodec/vp6: clear dimensions on failed resolution change in vp6_parse_header()
...
Fixes: 807/clusterfuzz-testcase-6470061042696192
Fixes null pointer dereference
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 967feea5eb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
537b2b8ab5
avcodec/vp56: Reset have_undamaged_frame on resolution changes
...
Fixes: timeout in 758/clusterfuzz-testcase-4720832028868608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6e913f2129 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Thomas Guilbert
a132c3f3be
avcodec/vp8: Fix hang with slice threads
...
Fixes: 447860.webm
Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9bbc73ae9f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
404fbd980b
avcodec/vp8: Check for the bitstream end per MB in decode_mb_row_no_filter()
...
Fixes: timeout in 730/clusterfuzz-testcase-5265113739165696 (part 2 of 2)
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: BBB
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1afd246960 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
9f225bbcab
avcodec/vp568: Check that there is enough data for ff_vp56_init_range_decoder()
...
Fixes: timeout in 730/clusterfuzz-testcase-5265113739165696 (part 1 of 2)
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: BBB
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 55d7371fe0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
f4f5f69082
avcodec/vp8: remove redundant check
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5098a6f627 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
a38d6d36a8
avcodec/vp56: Require a correctly decoded frame before using vp56_conceal_mb()
...
Fixes timeout with 700/clusterfuzz-testcase-5660909504561152
Fixes timeout with 702/clusterfuzz-testcase-4553541576294400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ce4f28431 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
e11e2574c7
avcodec/vp3: Do not return random positive values but the buf size
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d8094a303b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
5740278de2
avcodec/vp8: Check for bitsteam end in decode_mb_row_no_filter()
...
Fixes timeout with 686/clusterfuzz-testcase-5853946876788736
this shortcuts (i.e. speeds up) the error and
return-to-user when decoding a truncated frame
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Previous version reviewed by: "Ronald S. Bultje" <rsbultje@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b5ff7d573 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
49130f4145
avcodec/vp56: Factorize vp56_render_mb() out
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4c0139463c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
8b644b9563
avcodec/vp3dsp: Fix multiple signed integer overflow: 46341 * 47523 cannot be represented in type 'int'
...
Fixes: 664/clusterfuzz-testcase-4917047475568640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b8b7921c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
067bd9877f
Add CHECK/SUINT code
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4614bf2caf )
(cherry picked from commit e8d4eacc07 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3f2a09a43f6fade53227804459e6babb1c7248b3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
095449d272
avcodec/mpeg12dec: Fix runtime error: left shift of negative value -1
...
Fixes: 764/clusterfuzz-testcase-6273034652483584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a720b854b0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
f6908d087e
avcodec/vp56: Clear dimensions in case of failure in the middle of a resolution change
...
Similar code is used elsewhere in vp56 to force a more complete reinit in the future.
Fixes null pointer dereference
Fixes: 707/clusterfuzz-testcase-4717453097566208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4bed066377 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
3c8c0c0162
avcodec/vp56: Implement very basic error concealment
...
This should fix the fate failure due to a truncated last frame.
Alternatively the frame could be dropped.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d34bf886e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
336a4c5f79
avcodec/amrwbdec: Fix 2 runtime errors: left shift of negative value -1
...
Fixes: 669/clusterfuzz-testcase-4847965409640448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6bd79ba59f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
674cd62f07
avcodec/pngdec: Fix runtime error: left shift of 152 by 24 places cannot be represented in type 'int'
...
Fixes: 666/clusterfuzz-testcase-6581447227867136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 310d2af319 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
065440d96b
avcodec/vp56: Fix sign typo
...
Fixes: 664/clusterfuzz-testcase-4917047475568640
The change to fate is due to a truncated last frames which is now detected as damaged.
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 513a349439 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
90f7b5fd16
avcodec/mpegaudiodec_template: Correct return code on id3 tag discarding
...
Fixes: 665/clusterfuzz-testcase-4863789881098240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d81616be3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
7aaac74f58
avcodec/rv34: Simplify and factor get_slice_offset() code
...
This also fixes several integer overflows by checking each value before
use.
Fixes: 662/clusterfuzz-testcase-4898131432964096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8696f25444 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
783ba62dae
avcodec/pictordec: Do not read more than nb_planes
...
Fixes undefined behavior
Fixes: 622/clusterfuzz-testcase-5745722022428672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 01d196a67d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
fe27d3f02f
avcodec/srtdec: Fix signed integer overflow: 1811992524 * 384 cannot be represented in type 'int'
...
Fixes: 617/clusterfuzz-testcase-6413875723370496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c11d3634b0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
0465fc58e8
avcodec/pngdec: Check bit depth for validity
...
Fixes: runtime error: shift exponent 132 is too large for 32-bit type 'int'
Fixes: 609/clusterfuzz-testcase-4825202619842560
See 11.2.2 IHDR Image header
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4279613a26 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
1f4f22eb0f
avcodec/mpeg12dec: Fix runtime error: left shift of negative value
...
Fixes: 608/clusterfuzz-testcase-603978286392934
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 706757d26d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
5cfd259820
avcodec/wavpacl: Fix runtime error: left shift of negative value -1
...
Fixes: 607/clusterfuzz-testcase-5108792465293312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 12eebb845a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
Michael Niedermayer
d5cdae9e35
avformat/http: Check for truncated buffers in http_connect()
...
Reported-by: SleepProgger <security@gnutp.com >
Reviewed-by: Steven Liu <lingjiujianke@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8fa18e042a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-05-17 20:35:19 +02:00
James Almer
48706b9fef
avformat/apng: fix setting frame delay when max_fps is set to no limit
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 874eb012f7 )
2017-03-21 20:21:41 -03:00
James Almer
4c97b79cf5
swresample/resample: free existing ResampleContext on reinit
...
Fixes memleak.
Reviewed-by: wm4 <nfxjfg@googlemail.com >
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit db7a05dab0 )
2017-03-21 12:17:52 -03:00
James Almer
2423dd9656
swresample/resample: move resample_free() higher in the file
...
Also make it more readable while at it.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 2a8a8a2e98 )
Conflicts:
libswresample/resample.c
2017-03-21 12:17:03 -03:00
Carl Eugen Hoyos
dffd455b9b
lavf/mpeg: Initialize a stack variable used by memcmp().
...
Silence a valgrind warning.
Fixes ticket #6160 .
(cherry picked from commit a5c1c7a8b3 )
2017-02-21 02:16:23 +01:00
Carl Eugen Hoyos
9b6af4561b
lavc/avpacket: Initialize a variable in error path.
...
Fixes ticket #6153 .
Tested-by: Tyson Smith
(cherry picked from commit 1d54be2153 )
2017-02-17 10:44:39 +01:00
Matt Wolenetz
c63e587566
lavf/mov.c: Avoid heap allocation wraps in mov_read_{senc,saiz}()
...
Core of patch is from paul@paulmehta.com
Reference https://crbug.com/643952 (senc,saiz portions)
Signed-off-by: Matt Wolenetz <wolenetz@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 36aba43bd5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-10 12:16:24 +01:00
Matt Wolenetz
b5c13002d1
lavf/mov.c: Avoid OOB in mov_read_udta_string()
...
Core of patch is from paul@paulmehta.com
Reference https://crbug.com/643952 (udta_string portion)
Signed-off-by: Matt Wolenetz <wolenetz@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9bbdf5d921 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-10 12:14:40 +01:00
Michael Niedermayer
a5dabd4013
Update for 3.0.7
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 21:16:57 +01:00
Michael Niedermayer
3295d22f3a
avcodec/h264_slice: Clear ref_counts on redundant slices
...
Fixes reading freed memory
Fixes: 568/clusterfuzz-testcase-6107186067406848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c03029a835 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 20:08:22 +01:00
Matt Wolenetz
dc1e099bf2
lavf/mov.c: Avoid heap allocation wrap in mov_read_uuid
...
Core of patch is from paul@paulmehta.com
Reference https://crbug.com/643951
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
Check value reduced as the code does not support values beyond INT_MAX
Also the check is moved to a more common place and before integer truncation
(cherry picked from commit 2d453188c2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 11:05:51 +01:00
Matt Wolenetz
4f7064c9da
lavf/mov.c: Avoid heap allocation wrap in mov_read_hdlr
...
Core of patch is from paul@paulmehta.com
Reference https://crbug.com/643950
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
Check value reduced as the code does not support larger lengths
(cherry picked from commit fd30e4d57f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-08 04:08:26 +01:00
Michael Niedermayer
bb504aa5eb
avcodec/pictordec: Fix logic error
...
Fixes: 559/clusterfuzz-testcase-6424225917173760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c2ea3030a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-07 21:33:21 +01:00
Michael Niedermayer
4730d0d385
avcodec/movtextdec: Fix decode_styl() cleanup
...
Fixes: null pointer dereference
Fixes: 555/clusterfuzz-testcase-5986646595993600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e248522d1b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-06 12:11:39 +01:00
Chris Cunningham
be0e26d107
lavf/matroskadec: fix is_keyframe for early Blocks
...
Blocks are marked as key frames whenever the "reference" field is
zero. This breaks for non-keyframe Blocks with a reference timestamp
of zero.
The likelihood of reference timestamp being zero is increased by a
longstanding bug in muxing that encodes reference timestamp as the
absolute time of the referenced frame (rather than relative to the
current Block timestamp, as described in MKV spec).
Now using INT64_MIN to denote "no reference".
Reported to chromium at http://crbug.com/497889 (contains sample)
(cherry picked from commit ac25840ee3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-06 11:00:26 +01:00
James Almer
e8b94e5ce4
configure: bump year
...
Happy new year!
(cherry picked from commit d800d48fc6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-05 01:53:31 +01:00
Michael Niedermayer
c595b1da4f
Changelog: Update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-05 01:05:58 +01:00
Michael Niedermayer
f9a96bac28
avcodec/pngdec: Check trns more completely
...
Fixes out of array access
Fixes: 546/clusterfuzz-testcase-4809433909559296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e477f09d0b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-04 13:23:30 +01:00
Michael Niedermayer
9797929749
avcodec/interplayvideo: Move parameter change check up
...
Fixes out of array read
Fixes: 544/clusterfuzz-testcase-5936536407244800.f8bd9b24_8ba77916_70c2c7be_3df6a2ea_96cd9f14
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b1e2192007 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-04 03:05:08 +01:00
Michael Niedermayer
dfca37f0e5
Update for 3.0.6
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-03 17:30:51 +01:00
Michael Niedermayer
a71d22d84d
avcodec/mjpegdec: Check for for the bitstream end in mjpeg_decode_scan_progressive_ac()
...
Fixes timeout
Fixes: 496/clusterfuzz-testcase-5805083497332736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3782656631 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-03 15:59:14 +01:00
Frank Liberato
44eaff5e6d
avformat/flacdec: Check avio_read result when reading flac block header.
...
Return AVERROR_INVALIDDATA if all four bytes aren't present.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 95bde49982 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-03 15:59:14 +01:00
Michael Niedermayer
cfbab85809
avcodec/utils: correct align value for interplay
...
Fixes out of array access
Fixes: 452/fuzz-1-ffmpeg_VIDEO_AV_CODEC_ID_INTERPLAY_VIDEO_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2080bc3371 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-03 15:59:14 +01:00
Michael Niedermayer
3e03d12c83
avcodec/vp56: Check for the bitstream end, pass error codes on
...
Fixes timeout
Fixes: 446/fuzz-3-ffmpeg_VIDEO_AV_CODEC_ID_VP6_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e6a242755 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-03 15:59:14 +01:00
Michael Niedermayer
02323b1d02
avcodec/mjpegdec: Check remaining bitstream in ljpeg_decode_yuv_scan()
...
Fixes timeout
Fixes: 445/fuzz-3-ffmpeg_VIDEO_AV_CODEC_ID_MJPEG_fuzzer
Fixes: 456/fuzz-2-ffmpeg_VIDEO_AV_CODEC_ID_JPEGLS_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 755933cb5c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-03 15:59:14 +01:00
Michael Niedermayer
99c78466ff
avcodec/pngdec: Fix off by 1 size in decode_zbuf()
...
Fixes out of array access
Fixes: 444/fuzz-2-ffmpeg_VIDEO_AV_CODEC_ID_PNG_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e371f031b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-03 15:59:14 +01:00
Tobias Rapp
a6639334df
avformat/avidec: skip odml master index chunks in avi_sync
...
Fixes pts gaps when reading AVI files > 256GiB generated by FFmpeg.
Signed-off-by: Tobias Rapp <t.rapp@noa-archive.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6d579d7c1b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-03 15:59:14 +01:00
Michael Niedermayer
72d5addc0b
avcodec/mjpegdec: Check for rgb before flipping
...
Fixes assertion failure due to unsupported case
Fixes: 356/fuzz-1-ffmpeg_VIDEO_AV_CODEC_ID_MJPEG_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 25d9643f11 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-03 15:59:14 +01:00
Michael Niedermayer
a0b7a3c8aa
avutil/random_seed: Reduce the time needed on systems with very low precission clock()
...
This should fix issues on BSD
CLOCKS_PER_SEC is 128 on BSD while SUSv2 requires it to be a million
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4152fc42e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-03 15:59:14 +01:00
Michael Niedermayer
c4b36ccd02
avutil/random_seed: Improve get_generic_seed() with higher precission clock()
...
Tested-by: Thomas Turner <thomastdt@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit da73d95bad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-03 15:59:14 +01:00
Michael Niedermayer
198c8924c6
avformat/utils: Print verbose error message if stream count exceeds max_streams
...
Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f0bdd53871 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-03 15:59:14 +01:00
Michael Niedermayer
4535861ef8
avformat/options_table: Set the default maximum number of streams to 1000
...
Fixes CVE-2016-9561, Note the security relevance of this is disputed as
running out of memory can happen with valid files
Suggested-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com >
Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 30581c51e7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-02-03 15:59:14 +01:00
Andreas Cadhalpun
1a168061da
pgssubdec: reset rle_data_len/rle_remaining_len on allocation error
...
The code relies on their validity and otherwise can try to access a NULL
object->rle pointer, causing segmentation faults.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 842e98b4d8 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2017-02-01 02:28:56 +01:00
Michael Niedermayer
76961f4f42
avutil: Add av_image_check_size2()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f542b152aa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-10 23:12:20 +01:00
Michael Niedermayer
7dd1cc6076
avformat: Add max_streams option
...
This allows user apps to stop OOM due to excessive number of streams
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1296f84495 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-10 22:42:03 +01:00
Michael Niedermayer
667c9ed1f1
avcodec/ffv1enc: Allocate smaller packet if the worst case size cannot be allocated
...
We are checking during encoding if there is enough space as version 4 needs that
check.
Fixes Ticket6005
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38a7834bbb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-09 21:39:14 +01:00
Michael Niedermayer
efa164aa68
avcodec/mpeg4videodec: Fix undefined shifts in mpeg4_decode_sprite_trajectory()
...
Fixes: part of 670190.ogg
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8258e36385 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-09 17:46:31 +01:00
Michael Niedermayer
7c68d5e701
avformat/oggdec: Skip streams in duration correction that did not had their duration set.
...
Fixes: part of 670190.ogg
Fixes integer overflow
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ee2a6f5df8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-09 17:46:10 +01:00
Michael Niedermayer
0bcc7ea5dc
avcodec/ffv1enc: Fix size of first slice
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cff1c0edaa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-09 02:04:58 +01:00
Michael Niedermayer
b408dba231
Chagelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-05 23:32:35 +01:00
James Almer
c1435f9dfb
configure: check for strtoull on msvc
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit b52d3574d4 )
2016-12-05 19:19:58 -03:00
Ronald S. Bultje
726faff0aa
http: move chunk handling from http_read_stream() to http_buf_read().
...
(cherry picked from commit 845bb40178 )
2016-12-05 16:50:51 -05:00
Ronald S. Bultje
2e3f0a1c6f
http: make length/offset-related variables unsigned.
...
Fixes #5992 , reported and found by Paul Cher <paulcher@icloud.com >.
(cherry picked from commit 2a05c8f813 )
2016-12-05 16:50:50 -05:00
Michael Niedermayer
1768e02a04
ffserver: Check chunk size
...
Fixes out of array access
Fixes: poc_ffserver.py
Found-by: Paul Cher <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5d25faa3f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-05 22:05:37 +01:00
Michael Niedermayer
e0d1db72da
Avoid using the term "file" and prefer "url" in some docs and comments
...
This should make it less ambigous that these are URLs
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5f27a9c3a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-05 22:05:37 +01:00
Michael Niedermayer
a5513ae7bc
avformat/rtmppkt: Check for packet size mismatches
...
Fixes out of array access
Found-by: Paul Cher <paulcher@icloud.com >
Reviewed-by: Paul Cher <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d57ca4d9a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-05 22:05:37 +01:00
Timothy Gu
9c0b2b9d5b
zmqsend: Initialize ret to 0
...
Fixes CID1396857.
(cherry picked from commit d903b4e3ad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-05 22:05:37 +01:00
James Almer
d111c9ce13
avcodec/rawdec: check for side data before checking its size
...
Fixes valgrind warnings about usage of uninitialized values.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 51e329918d )
2016-12-04 17:27:07 -03:00
Michael Niedermayer
6e1bc747df
Update for version 3.0.5
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 21:15:15 +01:00
Michael Niedermayer
2c6792b0c6
avcodec/flacdec: Fix undefined shift in decode_subframe()
...
Fixes undefined behavior
Fixes: 639961-media
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f5630af51 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
66bf84e2c4
avcodec/get_bits: Fix get_sbits_long(0)
...
Fixes undefined behavior
Fixes: 640889-media
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c72fa43234 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
9f7eb718e9
avformat/ffmdec: Check media type for chunks
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e706e2e775 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
2d66fbc853
avcodec/flacdec: Fix signed integer overflow in decode_subframe_fixed()
...
Fixes undefined behavior
Fixes: 640912-media
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 83a75bf6c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
2f26f3de78
avcodec/flacdsp_template: Fix undefined shift in flac_decorrelate_indep_c
...
Fixes: left shift of negative value
Fixes: 668346-media
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit acc163c6ab )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
e9003828dd
avformat/oggparsespeex: Check frames_per_packet and packet_size
...
The speex specification does not seem to restrict these values, thus
the limits where choosen so as to avoid multiplicative overflow
Fixes undefined behavior
Fixes: 635422.ogg
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit afcf15b0db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
66e8f87ebc
avformat/utils: Check start/end before computing duration in update_stream_timings()
...
Fixes undefined behavior
Fixes: 637428.ogg
Found-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 90da187f1d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
6bee6ef0c2
avcodec/flac_parser: Update nb_headers_buffered
...
Fixes infinite loop
Fixes: fuzz.flac
Found-by: Frank Liberato <liberato@google.com >
Reviewed-by: Frank Liberato <liberato@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2475858889 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
ff01dbb6ec
avformat/idroqdec: Check chunk_size for being too large
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 744a0b5206 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
2caee48576
avformat/mpeg: Adjust vid probe threshold to correct mis-detection
...
Fixes: _ij.mp3
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4e5049a230 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
63caf18787
avcodec/rv40: Test remaining space in loop of get_dimension()
...
Fixes infinite loop
Fixes: 178/fuzz-3-ffmpeg_VIDEO_AV_CODEC_ID_RV40_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1546d487cf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
8ad4e1c1cb
avcodec/ituh263dec: Avoid spending a long time in slice sync
...
Fixes: 177/fuzz-3-ffmpeg_VIDEO_AV_CODEC_ID_FLV1_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2baf36caed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
27fbf8f110
avcodec/movtextdec: Add error message for tsmb_size check
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0eb3198005 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
3f9a24f06d
avcodec/movtextdec: Fix tsmb_size check==0 check
...
Fixes: 173/fuzz-3-ffmpeg_SUBTITLE_AV_CODEC_ID_MOV_TEXT_fuzzer
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a609905723 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
083919e9c4
avcodec/movtextdec: Fix potential integer overflow
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ea2715768 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
bc63205ae2
avcodec/sunrast: Fix input buffer pointer check
...
Fixes: out of array read
Fixes: poc.dat
Found-by: Bingchang, Liu @VARAS of IIE
Tested-by: bc L <l.bing.chang.bc@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 37138338ff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
4251dc6d7e
avcodec/tscc: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 979bca5134 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
8fd3293fa1
avcodec/rawdec: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f0bc0215a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
7affe32738
avcodec/msvideo1: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 161ccdaa06 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
1bc7215e8a
avcodec/qpeg: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 16793504df )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
51aa6d0987
avcodec/qtrle: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d196f2a5a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
136fc7084e
avcodec/msrle: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6330119a0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
adc86ad32f
avcodec/kmvc: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d99101d09 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
e0dd617ed7
avcodec/idcinvideo: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a2b8dde659 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
9cab9b878f
avcodec/cinepak: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 121be31060 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
3549871847
avcodec/8bps: Check side data size before use
...
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 042faa847f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
9ec40eacb1
avcodec/dvdsubdec: Fix off by 1 error
...
Fixes out of array read
Found-by: Thomas Garnier using libFuzzer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c92f55847a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
8cca6b06ec
avcodec/dvdsubdec: Fix buf_size check
...
Fixes out of array access
Found-by: Thomas Garnier using libFuzzer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 25ab1a65f3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Ronald S. Bultje
642cd5de4d
vp9: change order of operations in adapt_prob().
...
This is intended to workaround bug "665 Integer Divide Instruction May
Cause Unpredictable Behavior" on some early AMD CPUs, which causes a
div-by-zero in this codepath, such as reported in Mozilla bug #1293996 .
Note that this isn't guaranteed to fix the bug, since a compiler is free
to reorder instructions that don't depend on each other. However, it
appears to fix the bug in Firefox, and a similar patch was applied to
libvpx also (see Chrome bug #599899 ).
(cherry picked from commit be885da342 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
d54aa2de17
avcodec/interplayvideo: Check side data size before use
...
Fixes out of array read
Found-by: Thomas Garnier using libFuzzer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 85d23e5cbc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
bab7d72d46
avformat/mxfdec: Check size to avoid integer overflow in mxf_read_utf16_string()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fecb3e82a4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
9128ef0302
avcodec/mpegvideo_enc: Clear mmx state in ff_mpv_reallocate_putbitbuffer()
...
This function must be called from the mb or slice encoding loop and MMX state may not
be clean there
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 03ec6b780c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Michael Niedermayer
86f5b73429
avcodec/utils: Clear MMX state before returning from avcodec_default_execute*()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f96f9d111 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-12-04 20:25:15 +01:00
Mark Harris
9375a7d85e
avformat/icodec: Fix crash probing fuzzed file
...
Avoid invalid memory read/crash when frame offset >= 0xfffffff8.
Base64-encoded example: AAABADAwMDAwMAAAMAAwMDAw/P///w==
(The previous commit verifies that p->buf_size >= 22.)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 56e2cd9c04 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:58 +01:00
Andreas Cadhalpun
e8ab2bd2ac
dcstr: fix division by zero
...
Also check for possible overflows.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit b0a043f51b )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:58 +01:00
Andreas Cadhalpun
45b18fbb9a
rsd: limit number of channels
...
Negative values don't make sense and too large values can cause
overflows. For AV_CODEC_ID_ADPCM_THP this leads to a too small extradata
buffer being allocated, causing out-of-bounds writes.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit ee5f0f1d35 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:58 +01:00
Andreas Cadhalpun
0496403c08
mss2: only use error correction for matching block counts
...
This fixes a heap-buffer-overflow in ff_er_frame_end when decoding mss2
with coded_width/coded_height larger than width/height.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 2566ad98b0 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:58 +01:00
Andreas Cadhalpun
88bf1d2749
softfloat: decrease MIN_EXP to cover full float range
...
floats are not necessarily normalized, so a normalized softfloat needs
MIN_EXP lowered by 23 to cover that range.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 2d6f46d801 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:58 +01:00
Andreas Cadhalpun
dbad792487
libopusdec: default to stereo for invalid number of channels
...
This fixes an out-of-bounds read if avc->channels is 0.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 8c8f543b81 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:57 +01:00
Andreas Cadhalpun
5d2f1ffef1
pgssubdec: only set w/h/linesize when allocating data
...
Rects with positive w/h/linesize but no data are invalid.
Reviewed-by: Petri Hintukainen <phintuka@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 995512328e )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:57 +01:00
Andreas Cadhalpun
80b85300ae
sbgdec: prevent NULL pointer access
...
Reviewed-by: Josh de Kock <josh@itanimul.li >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit dbefbb61b7 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:57 +01:00
Andreas Cadhalpun
48d24cca13
smacker: limit recursion depth of smacker_decode_bigtree
...
This fixes segmentation faults due to stack-overflow caused by too deep
recursion.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 946ecd19ea )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:57 +01:00
Andreas Cadhalpun
1c282152c1
mxfdec: fix NULL pointer dereference in mxf_read_packet_old
...
Metadata streams have priv_data set to NULL.
Reviewed-by: Josh de Kock <josh@itanimul.li >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit fdb8c455b6 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:57 +01:00
Andreas Cadhalpun
4ffd5805af
libschroedingerdec: fix leaking of framewithpts
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 3c0328d58d )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:57 +01:00
Andreas Cadhalpun
57665e04e2
libschroedingerdec: don't produce empty frames
...
They are not valid and can cause problems/crashes for API users.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit a86ebbf7f6 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:57 +01:00
Andreas Cadhalpun
48496e4d4f
softfloat: handle -INT_MAX correctly
...
This is similar to commit 9ac61e73d0 .
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 0edd569466 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:57 +01:00
Andreas Cadhalpun
e93934e100
filmstripdec: correctly check image dimensions
...
This prevents a division by zero in read_packet.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 25012c5644 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:57 +01:00
Andreas Cadhalpun
b32c9941a2
pnmdec: make sure v is capped by maxval
...
Otherwise put_bits can be called with a value that doesn't fit in the
sample_len, causing an assertion failure.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit cdb5479c9d )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:57 +01:00
Andreas Cadhalpun
69673d0279
smvjpegdec: make sure cur_frame is not negative
...
This fixes a heap-buffer-overflow detected by AddressSanitizer.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 360bc0d90a )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:57 +01:00
Andreas Cadhalpun
3047b0a4a3
icodec: correctly check avio_read return value
...
It can read less than the requested amount, in which case buf contains
uninitialized data, causing problems like segmentation faults later on.
Also make sure that image->size is positive, so that it can't match a
negative error code.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 89eb398c7f )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:57 +01:00
Andreas Cadhalpun
27888d13b8
dvbsubdec: fix division by zero in compute_default_clut
...
This problem was introduced in commit
4b90dcb849 .
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit c82b8ef0e4 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:56 +01:00
Andreas Cadhalpun
416a8a06b9
proresdec_lgpl: explicitly check coff[3] against slice_data_size
...
The implicit checks via v_data_size and a_data_size don't work in the case
'(hdr_size > 7) && !ctx->alpha_info'.
This fixes segmentation faults due to invalid reads.
This problem was introduced in commit
547c2f002a .
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 1e33035ee7 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:56 +01:00
Andreas Cadhalpun
e14cc2f197
escape124: reject codebook size 0
...
It causes a cb_depth of 32, leading to assertion failures in get_bits.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 226d35c845 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:56 +01:00
Andreas Cadhalpun
05e6606ba9
icodec: add ico_read_close to fix leaking ico->images
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit d54c95a143 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:56 +01:00
Andreas Cadhalpun
c3307f7e9e
icodec: fix leaking pkt on error
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 467eece1be )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:56 +01:00
Andreas Cadhalpun
3d82cebdd2
mpegts: prevent division by zero
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 1bbb18fe82 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:56 +01:00
Andreas Cadhalpun
5801482379
matroskadec: fix NULL pointer dereference in webm_dash_manifest_read_header
...
The code assumes that s->streams[0] is valid.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit ff100c9dd9 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:56 +01:00
Andreas Cadhalpun
e6197a6ce9
mpegaudio_parser: don't return AVERROR_PATCHWELCOME
...
The API does not allow returning AVERROR codes.
It triggers an assert in av_parser_parse2.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 5249706e9d )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:56 +01:00
Andreas Cadhalpun
e78d9f3f35
mxfdec: fix NULL pointer dereference
...
Metadata streams have priv_data set to NULL.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 0efb610611 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:56 +01:00
Andreas Cadhalpun
ef2d91e9c3
lzf: update pointer p after realloc
...
This fixes heap-use-after-free detected by AddressSanitizer.
Reviewed-by: Luca Barbato <lu_zero@gentoo.org >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit bb6a7b6f75 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:55 +01:00
Andreas Cadhalpun
dcc8d2418a
diracdec: check return code of get_buffer_with_edge
...
If it fails, buffers aren't allocated, causing NULL pointer dereferencing.
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit db79dedb1a )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:55 +01:00
Andreas Cadhalpun
087b777415
ppc: pixblockdsp: do unaligned block accesses correctly again
...
This was broken by the following Libav commit:
4c387c7 ppc: dsputil: do unaligned block accesses correctly
The following tests fail due to this:
fate-checkasm
fate-vsynth1-dnxhd-2k-hr-hq fate-vsynth1-dnxhd-edge1-hr
fate-vsynth1-dnxhd-edge2-hr fate-vsynth1-dnxhd-edge3-hr
fate-vsynth1-dnxhd-hr-sq-mov fate-vsynth1-dnxhd-hr-hq-mov
fate-vsynth2-dnxhd-2k-hr-hq fate-vsynth2-dnxhd-edge1-hr
fate-vsynth2-dnxhd-edge2-hr fate-vsynth2-dnxhd-edge3-hr
fate-vsynth2-dnxhd-hr-sq-mov fate-vsynth2-dnxhd-hr-hq-mov
fate-vsynth3-dnxhd-2k-hr-hq fate-vsynth3-dnxhd-edge1-hr
fate-vsynth3-dnxhd-edge2-hr fate-vsynth3-dnxhd-edge3-hr
fate-vsynth3-dnxhd-hr-sq-mov fate-vsynth3-dnxhd-hr-hq-mov
Fixes trac ticket #5508 .
Reviewed-by: Carl Eugen Hoyos <ceffmpeg@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 3932ccc472 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:55 +01:00
Andreas Cadhalpun
aca7f5f060
interplayacm: increase bitstream buffer size by AV_INPUT_BUFFER_PADDING_SIZE
...
This fixes out-of-bounds reads by the bitstream reader.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 60178e78f2 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:55 +01:00
Andreas Cadhalpun
aa32d41527
interplayacm: validate number of channels
...
The number of channels is used as divisor in decode_frame, so it must
not be zero to avoid SIGFPE crashes.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 5540d6c134 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:55 +01:00
Andreas Cadhalpun
a1e6daeb1e
interplayacm: check for too large b
...
This fixes out-of-bounds reads.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 14e4e26559 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:55 +01:00
Andreas Cadhalpun
30d542d55d
mpeg12dec: unref discarded picture from extradata
...
Otherwise another frame gets referenced into picture, triggering an assert
(from commit 13aae8) in av_frame_ref.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit a92f8edf0c )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:55 +01:00
Andreas Cadhalpun
1d439041ec
cavsdec: unref frame before referencing again
...
This fixes asserts (from commit 13aae8) in av_frame_ref and
av_frame_move_ref.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 1966ea012f )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:55 +01:00
Andreas Cadhalpun
0009cf348a
avformat: prevent triggering request_probe assert in ff_read_packet
...
If probe_codec is called with pkt == NULL, it sets probe_packets to 0
and request_probe to -1.
However, request_probe can change when calling s->iformat->read_packet
and thus a probe_packets value of 0 doesn't guarantee a request_probe
value of -1.
In that case calling probe_codec again is necessary to prevent
triggering the assert.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit a5b4476a60 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-11-27 00:38:51 +01:00
James Almer
492bbe5890
avcodec/avpacket: fix leak on realloc in av_packet_add_side_data()
...
If realloc fails, the pointer is overwritten and the previously allocated
buffer is leaked, which goes against the expected behavior of keeping the
packet unchanged in case of error.
Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 574929d8b6 )
2016-11-19 20:24:23 -03:00
Michael Niedermayer
5771a0c823
doc/examples/demuxing_decoding: Drop AVFrame->pts use
...
This code is not correct for git master
Reviewed-by: Stefano Sabatini <stefasab@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2bd9956454 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-10-18 23:00:33 +02:00
Andreas Cadhalpun
f309b698e6
Changelog: update for recent commits
...
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-10-17 18:15:04 +02:00
Andreas Cadhalpun
0887f1835d
libopenjpegenc: fix out-of-bounds reads when filling the edges
...
The calculation of width/height should round up, not round down to
prevent setting width or height to 0.
Also image->comps[compno].w is unsigned (at least in openjpeg2), so the
calculation could silently wrap around without the explicit cast to int.
Reviewed-by: Michael Bradshaw <mjbshaw@gmail.com >
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 56706ac0d5 )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-10-17 17:24:40 +02:00
Andreas Cadhalpun
de42af2bee
libopenjpegenc: stop reusing image data buffer for openjpeg 2
...
openjpeg 2 sets the data pointers of the image components to NULL,
causing segfaults if the image is reused.
Reviewed-by: Michael Bradshaw <mjbshaw@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 69c8505f3b )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-10-17 17:23:55 +02:00
Andreas Cadhalpun
ada229e66f
configure: fix detection of libopenjpeg
...
Use check_lib2 to test the header together with the function. This is
necessary, because '-DOPJ_STATIC' changes what the included header does.
Also add '-DOPJ_STATIC' to CPPFLAGS, so that it isn't necessary to
hardcode this in libavcodec/libopenjpeg{dec,enc}.c.
Finally, check for non-static openjpeg 2.1, too.
Reviewed-by: Michael Bradshaw <mjbshaw@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 7a65aef00d )
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
2016-10-17 17:22:01 +02:00
Michael Niedermayer
047e0049d1
Changelog: update for recent commits
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-10-17 04:55:52 +02:00
Moritz Barsnick
88f52f2f8f
cmdutils: fix typos
...
Signed-off-by: Moritz Barsnick <barsnick@gmx.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3e5d27d7a7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-10-09 20:14:23 +02:00
Moritz Barsnick
8baf2d8fad
lavfi: fix typos
...
Signed-off-by: Moritz Barsnick <barsnick@gmx.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f4e4bde1f4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-10-09 20:14:01 +02:00
Moritz Barsnick
17b8e7799f
lavc: fix typos
...
Signed-off-by: Moritz Barsnick <barsnick@gmx.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3305f71025 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-10-09 20:13:48 +02:00
Moritz Barsnick
6457346e6a
tools: fix grammar error
...
Signed-off-by: Moritz Barsnick <barsnick@gmx.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f71c98ee12 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-10-09 20:13:30 +02:00
Hendrik Leppkes
27f1fb1251
ffmpeg: remove unused and errorneous AVFrame timestamp check
...
Decoders have previously not used AVFrame.pts, and with the upcoming
deprecation of pkt_pts (in favor of pts), this would lead to an errorneous
interpration of timestamps.
(cherry picked from commit 04a3577263 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-10-07 16:11:57 +02:00
Shivraj Patil
c993a11e56
Support for MIPS cpu P6600
...
Signed-off-by: Shivraj Patil <shivraj.patil@imgtec.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6803a298f4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-10-06 21:30:53 +02:00
Shivraj Patil
ef5b120e2d
avutil/mips/generic_macros_msa: rename macro variable which causes segfault for mips r6
...
Signed-off-by: Shivraj Patil <shivraj.patil@imgtec.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1cc13cd2a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-10-06 21:27:25 +02:00
Michael Niedermayer
b9a1d389b2
Update for 3.0.4
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-28 17:13:09 +02:00
Michael Niedermayer
8c43f32057
avformat/avidec: Check nb_streams in read_gab2_sub()
...
Fixes null pointer dereference
Fixes: 1/null_point.avi
Found-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2679ad4773 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-28 17:11:52 +02:00
Michael Niedermayer
77d5a237ef
avformat/avidec: Remove ancient assert
...
This assert can with crafted files fail, a warning is already printed
for this case.
Fixes assertion failure
Fixes:1/assert.avi
Found-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 14bac7e00d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-28 17:11:52 +02:00
Michael Niedermayer
fb7617df4e
avformat/avidec: Fix memleak with dv in avi
...
Found-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b98dafe045 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-28 17:11:52 +02:00
Sasi Inguva
82b58841c9
lavc/movtextdec.c: Avoid infinite loop on invalid data.
...
Signed-off-by: Sasi Inguva <isasi@google.com >
(cherry picked from commit 7e9e1b7070 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-28 17:11:52 +02:00
Michael Niedermayer
e5bf7ab3e7
avcodec/ansi: Check dimensions
...
Fixes: 1.avi
Found-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 69449da436 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-28 17:11:52 +02:00
Michael Niedermayer
63f951601e
avcodec/cavsdsp: use av_clip_uint8() for idct
...
Fixes out of array read
Fixes: 1.swf
Found-by: 连一汉 <lianyihan@360.cn >
Tested-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e318f110b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-28 17:11:52 +02:00
Michael Niedermayer
7fefa4138d
avformat/movenc: Check packet in mov_write_single_packet() too
...
Fixes assertion failure
Found-by: durandal117
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2834313933 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-28 17:11:52 +02:00
Michael Niedermayer
a1f77124c8
avformat/movenc: Factor check_pkt() out
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit deabcd2c05 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-28 17:11:52 +02:00
Xinzheng Zhang
f2f7d49f41
avformat/utils: fix timebase error in avformat_seek_file()
...
When there is only one stream and stream_index has not specified,
The ts has been transferd by the timebase of stream0 without modifying the stream_index
In this condation it cause seek failure.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ecc04b4f2f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-28 17:11:52 +02:00
Michael Niedermayer
9357aa6757
avcodec/g726: Add missing ADDB output mask
...
Fixes: 1.poc
Fixes out of array read
Found-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5af1240fc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-28 17:11:52 +02:00
Michael Niedermayer
26a8fc1c00
avcodec/avpacket: clear side_data_elems
...
Fixes null pointer dereference
Found-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5e1bf9d8c0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-28 17:11:52 +02:00
Michael Niedermayer
b7b3b0086d
avformat/movenc: Check first DTS similar to dts difference
...
Fixes assertion failure
Fixes: b84b53855a0b74560e64c6f45f505a13/signal_sigabrt_7ffff6ae7c37_3837_ef4e243ea5b4fa8d0becf4afe9166604.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 68f4c2163e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-28 17:11:52 +02:00
Michael Niedermayer
d669b7f4f6
avcodec/ccaption_dec: Use simple array instead of AVBuffer
...
This is simpler and fixes an out of array read, fixing it with AVBuffers
would be more complex
Fixes: e00d9e6e50e5495cc93fea41147b97bb/asan_heap-oob_12dcdbb_8798_b32a97ea722dd37bb5066812cc674552.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 752e6dfa3e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-28 17:11:52 +02:00
Sergey Volk
9259b7f38e
avformat/mov: Fix potential integer overflow in mov_read_keys
...
Actual allocation size is computed as (count + 1)*sizeof(meta_keys), so
we need to check that (count + 1) won't cause overflow.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 347cb14b7c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-28 17:11:52 +02:00
Michael Niedermayer
cb8a29f872
swscale/swscale_unscaled: Try to fix Rgb16ToPlanarRgb16Wrapper() with slices
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e57d99dd4e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-28 17:11:52 +02:00
Michael Niedermayer
6744d3f6b9
swscale/swscale_unscaled: Fix packed_16bpc_bswap() with slices
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47bc1bdafb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-28 17:11:52 +02:00
Carl Eugen Hoyos
73b644cdee
lavf/utils: Avoid an overflow for huge negative durations.
...
Fixes ticket #5135 .
(cherry picked from commit 267da70ea8 )
2016-09-24 21:08:23 +02:00
Michael Niedermayer
3512ed3622
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-05 02:13:28 +02:00
Michael Niedermayer
1d90326f95
avformat/avidec: Fix infinite loop in avi_read_nikon()
...
Fixes: 360/test.poc
Found-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e4e4a9cad7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-05 01:01:35 +02:00
Michael Niedermayer
1b47c278a6
avformat/utils: End probing if the expected codec surpasses AVPROBE_SCORE_STREAM_RETRY
...
Fixes Ticket5800
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c75273310c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-05 01:01:35 +02:00
Michael Niedermayer
cd91aaa4cc
avcodec/aacenc: Tighter input checks
...
Fixes occurance of NaN/Inf leading to assertion failures and out of array access
Fixes: d1c38a09acc34845c6be3a127a5aacaf/signal_sigsegv_3982225_6121_d18bd5451d4245ee09408f04badd1b83.wmv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 77bf96b047 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-05 01:01:35 +02:00
Michael Niedermayer
2858f77fd4
avformat/wtvdec: Check pointer before use
...
Fixes out of array read
Fixes: 049fdf78565f1ce5665df236d90f8657/asan_heap-oob_10a5a97_1026_42f9d4855547329560f385768de2f3fb.wtv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cc5e5548df )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-05 01:01:35 +02:00
Michael Niedermayer
fe7366ee93
libavcodec/wmalosslessdec: Check the remaining bits
...
Fixes assertion failure
Fixes: 24ebfda03228b5cc1ef792608cfba458/signal_sigabrt_7ffff6ae7c37_6473_3fa8a111dbc752b1a7c411c5ab79aaa4.wma
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 67318187fb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-05 01:01:35 +02:00
Michael Niedermayer
4ab41164d2
avcodec/diracdec: Check numx/y
...
Fixes division by 0
Fixes: 60261c4469ba3e11059890fb2832a515/asan_generic_135e694_2790_beb94eaa0aeb7d11c0437375a8964a99.drc
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a31e08fa1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-05 01:01:35 +02:00
Michael Niedermayer
d794d97d96
avcodec/cfhd: Increase minimum band dimension to 3
...
The implementation does not currently support len=2
Fixes out of array accesses
Fixes: 29d1b3db5ba2205e82b0b3a533e057a3/asan_heap-oob_12b650c_9254_3b8c4e4d931eb2c32841c18ebb297f1d.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b8b3671721 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-05 01:01:35 +02:00
Michael Niedermayer
93534cd642
avcodec/indeo2: check ctab
...
Fixes out of array access
Fixes: 6b73fa392ac808f02e95a4e0a5770026/asan_static-oob_1b15f9a_1969_e7778535e5f27225fe0d6ded14721430.AVI
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9ffe44c5c7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-05 01:01:35 +02:00
Michael Niedermayer
ca92adafb0
avformat/swfdec: Fix inflate() error code check
...
Fixes infinite loop
Fixes endless.poc
Found-by: 连一汉 <lianyihan@360.cn >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a453bbb68f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-05 01:01:35 +02:00
Michael Niedermayer
815a4439c3
avcodec/rawdec: Fix bits_per_coded_sample checks
...
Fixes assertion failure
Fixes: 9eb9cf5b8c26dd0fa7107ed0348dcc1f/signal_sigabrt_7ffff6ae7c37_8926_4609a5c3f071d555d2d557625f9687b1.swf
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 237207645b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-09-05 01:01:35 +02:00
Carl Eugen Hoyos
17035c8d2e
lavc/mjpegdec: Do not skip reading quantization tables.
...
They may contain 0xFFs, confusing the start code finding algorithm.
Fixes ticket #5819 .
(cherry picked from commit cef5bc0e6e )
Conflicts:
libavcodec/mjpegdec.c
2016-09-03 15:35:12 +02:00
Tobias Rapp
426b959e37
cmdutils: fix implicit declaration of SetDllDirectory function
...
Pre-processor check changed by commiter.
Signed-off-by: James Almer <jamrial@gmail.com >
2016-08-29 20:00:51 -03:00
James Almer
61fcba7546
cmdutils: check for SetDllDirectory() availability
...
It's only available on Windows XP or newer.
Should fix compilation with mingw32 using the default OS target.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
2016-08-22 19:24:31 -03:00
Michael Niedermayer
66bd740e0b
avcodec/h264: Put context_count check back
...
Fixes assertion failure
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f883f0b0bd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 15:05:44 +02:00
Michael Niedermayer
534dc63089
Update for 3.0.3
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 14:23:46 +02:00
Hendrik Leppkes
09d1854063
cmdutils: remove the current working directory from the DLL search path on win32
...
Reviewed-by: Matt Oliver <protogonoi@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3bf142c773 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
ab9616428a
avcodec/raw: Fix decoding of ilacetest.mov
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bbec14de31 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
e7c00a2814
avcodec/ffv1enc: Fix assertion failure with non zero bits per sample
...
Fixes Ticket5736
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1bfeda5a3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
2a8441e949
avformat/oggdec: Fix integer overflow with invalid pts
...
If negative pts are possible for some codecs in ogg then the code needs to be
changed to use signed values.
Found-by: Thomas Guilbert <tguilbert@google.com >
Fixes: clusterfuzz_usan-2016-08-02
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c5cc3b08e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
7876fd679d
ffplay: Fix invalid array index
...
Found-by: Thomas Guilbert <tguilbert@google.com >
Fixes: clusterfuzz_usan-2016-08-02
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6cd9a8b67a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
8b3d9c33d6
avcodec/vp9_parser: Check the input frame sizes for being consistent
...
Suggested-by: BBB
Fixed-by: BBB
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 77b0f3f26d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Kacper Michajłow
c575726621
libavformat/rtpdec_asf: zero initialize the AVIOContext struct
...
This fixes crash in avformat_open_input() when accessing
protocol_whitelist field.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e947b75b1c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Kacper Michajłow
6e6609f5dd
libavutil/opt: Small bugfix in example.
...
Fix const corectness and zero init the struct. This example code would actually crash when initializing string.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 69630f4d30 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Sasi Inguva
6e13acaadd
libx264: Increase x264 opts character limit to 4096
...
Signed-off-by: Sasi Inguva <isasi@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 282477bf45 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
a5680d83af
avformat/mov: Check sample size
...
Fixes integer overflow
Fixes: poc.mp4
Found-by: ajax secure <ajax4sec@hotmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8a3221cc67 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
811d560378
avformat/format: Fix registering a format more than once and related races
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4cc896ea5f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
c34f0616d9
avformat/flacdec: Fix seeking close to EOF
...
Fixes Ticket5428
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d0b21b28a3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
96ce6f64cc
avcodec/flac_parser: Raise threshold for detecting invalid data
...
Fixes regression from Ticket5428
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b0b3676e13 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
13b6852225
avformat/flvdec: Accept last size if its off by 1
...
Fixes part of Ticket5648
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e8931d79cc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
d13ba39606
tests/api/api-codec-param-test: Do not directly access caps_internal
...
The caps_internal field has moved without major bump and direct
access causes crashes, found when testing 3.1
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d0ee2e3ae6a7b58363b5e1ae518b242d0666f82b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
19b86db2b3
avcodec: Add avpriv_codec_get_cap_skip_frame_fill_param()
...
With this the use of the caps_internal from libavformat can be avoided
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
694d37eb52
avfilter/vf_telecine: Make frame writable before writing into it
...
Fixes Ticket 5627
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fa0097e008 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
4e5d1c45f1
avformat/mpegts: adjust probe score for low check_count
...
Fixes mis-detection of tiff as mpegts
Fixes Ticket5565
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 00c4861f13 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
2577cfd207
avcodec/mpc8: Correct end truncation
...
Fixes Ticket5478
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b21f674876 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
280587b4ab
avformat/mp3dec: Increase probe score slightly when the whole data from begin to end is mp3
...
Improves score for 1000-frames-of-noise-encoded-with-lame.mp3 without file extension
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5fd73948bb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
5bf11223dd
avcodec/cfhd: Set dimensions unconditionally
...
Fixes Ticket5215
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 056a4ae771 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
679e869496
avcodec/mpegvideo: Do not clear the parse context during init
...
It is allocated before, this cannot work
Fixes Ticket5613
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 24f5136196 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
7216068e42
MAINTAINERs cleanup (remove myself from things i de facto dont maintain)
...
x86 is maintained entirely by others these days
ML, mostly too
remove myself from a few spots that have other maintainers and where i
just dont know the code that well anyway to do an ideal job
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bb5bc08ba6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
e7a064efa6
avcodec/h264: Fix off by 1 context count
...
Fixes fate-h264-xavc-4389 with slice threads
(cherry picked from commit 27c1eae55f )
Conflicts:
libavcodec/h264.c
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
a004e2e4f1
avcodec/alsdec: Check r to prevent out of array read
...
No testcase known
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c36fc857b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Umair Khan
f50f7adf7a
avcodec/alsdec: fix max bits in ltp prefix code
...
The maximum number of bits int the prefix code for
p(0) is 4. By setting it as 3, we were missing the
last 0 bit.
This fixes bug #4715 present on the trac.
Signed-off-by: Umair Khan <omerjerk@gmail.com >
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d64ba9d18 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
9cf85419a3
avcodec/utils: check skip_samples signedness
...
Fixes Ticket5528
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 153ab83bd3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
b3fe93e73b
avformat/mpegts: Do not trust BSSD descriptor, it is sometimes not an S302M stream
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5eb70ad95 )
Conflicts:
libavformat/mpegts.c
2016-08-13 13:08:57 +02:00
Michael Niedermayer
603fd4f771
avcodec/bmp_parser: Check fsize
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 43a4276c69 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
76a239768f
avcodec/bmp_parser: reset state
...
Fixes part of ticket 5598
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 37005e65eb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
fca62cc6a7
avcodec/bmp_parser: Fix remaining size
...
Fixes part of ticket 5598
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 250b620d29 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
9f1e8b4fb2
avcodec/bmp_parser: Fix frame_start_found in cross frame cases
...
Fixes part of ticket 5598
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bfe945ac3a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Michael Niedermayer
b2a2b1a88b
avfilter/af_amix: dont fail if there are no samples in output_frame()
...
Fixes Ticket5326
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit abc957e896 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-08-13 13:08:57 +02:00
Vivekanand
f3c1a76ffd
avformat/allformats: Making av_register_all() thread-safe.
...
When multiple threads tries to call av_register_all(), the first thread sets
initialized to 1 and do the register process. At the same time, other thread might
also call av_register_all(), which returns immediately because initialized is set to 1
(even when it has not completed registering codecs). We can avoid this problem
if we set initialised to 1 while exiting from function.
Github: Closes #196
(cherry picked from commit b092ee701f )
Conflicts:
libavformat/allformats.c
2016-08-13 13:08:57 +02:00
Luca Barbato
b62191f9c1
librtmp: Avoid an infiniloop setting connection arguments
...
The exit condition was missing.
Signed-off-by: Timothy Gu <timothygu99@gmail.com >
(cherry picked from commit e85d38c20a )
Signed-off-by: Timothy Gu <timothygu99@gmail.com >
2016-07-26 12:07:55 -07:00
James Almer
21c36d83f8
avformat/oggparsevp8: fix pts calculation on pages ending with an invisible frame
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 5adfbd3918 )
2016-07-25 10:00:10 -03:00
James Almer
4774eb8128
Revert "configure: Enable GCC vectorization on ≥4.9 on x86"
...
This reverts commit cb8646af24 .
This change has brough more issues than benefits, between compilation
time failures depending on flags used and code miscompilation causing
runtime crashes.
See the "[PATCH 2/2] configure: Enable GCC vectorization on ≥4.9"
thread in the ffmpeg-devel mailing list for the relevant discussion.
(cherry picked from commit fd6dbc5385 )
2016-07-09 17:39:31 -03:00
Michael Niedermayer
96f5019bde
avcodec/libopenjpegenc: Set numresolutions by default to a value that is not too large
...
Fixes issues with libopenjpeg 2.1
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e9394ca63d )
2016-07-01 00:01:46 -03:00
Timo Rothenpieler
bffe1c4222
ffplay: Fix usage of private lavfi API
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1bd9fb6de5 )
2016-06-29 22:49:58 -03:00
Michael Niedermayer
fbdf5ca763
tests/checkasm/checkasm: Disable checkasm_check_pixblockdsp for ppc64be
...
See: Ticket5508
Suggested-by: Carl
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e5d434b840 )
2016-06-26 04:17:59 +02:00
Michael Niedermayer
c6470d8193
avcodec/mpegvideo: Deallocate last/next picture earlier
...
Fixes regression with mplayers direct rendering and reduces buffer count
pressure in some cases
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 39c0b22df4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-06-05 02:40:31 +02:00
Michael Niedermayer
e5942c1436
avcodec/bmp_parser: Fix state
...
Fixes Ticket5598
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d0388bd32e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-06-05 02:40:31 +02:00
Thomas Guilbert
dab82a2a7c
avformat/oggparseopus: Fix Undefined behavior in oggparseopus.c and libavformat/utils.c
...
Fixes: usan_granule_overflow
constant type fix by commiter
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1a82d2cf8f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-06-05 02:40:31 +02:00
Michael Niedermayer
7f864badc0
avformat/utils: avoid overflow in compute_chapters_end() with huge durations
...
Fixes: usan_granule_overflow
Found-by: Thomas Guilbert <tguilbert@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1ed78a591 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-06-05 02:40:31 +02:00
Michael Niedermayer
cc1e01d8b6
avformat/utils: avoid overflow in update_stream_timings() with huge durations
...
Fixes: usan_granule_overflow
Found-by: Thomas Guilbert <tguilbert@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2be3007ed5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-06-05 02:40:31 +02:00
Michael Niedermayer
69c3dfdd54
doc/developer.texi: Add a code of conduct
...
See: [FFmpeg-devel] [Vote] Code of Conduct
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 89e9393022 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-06-05 02:40:31 +02:00
Gregor Riepl
241f1e603f
ffserver: fixed deallocation bug in build_feed_streams
...
Signed-off-by: Gregor Riepl <onitake@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d970f7ba31 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-06-05 02:40:31 +02:00
Michael Niedermayer
4d9fdca053
avcodec/diracdec: Fix potential integer overflow
...
Fixes CID1361948
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ecfe4dc36 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-06-05 02:40:31 +02:00
Michael Niedermayer
b11900251f
avformat/avidec: Detect index with too short entries
...
Fixes Ticket5498
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d08f2c172f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-06-05 02:40:31 +02:00
Chris Cunningham
145b18ce9a
avformat/utils: Check negative bps before shifting in ff_get_pcm_codec_id()
...
Fixes: undefined shift.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2875745d35 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-06-05 02:40:31 +02:00
Michael Niedermayer
e5d167149d
avformat/utils: Do not compute the bitrate from duration == 0
...
Fixes division by 0 in fate-acodec-ra144
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 635b2ec5f2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-06-05 02:40:31 +02:00
Michael Niedermayer
ed71759fd0
ffmpeg: Check that r_frame_rate is set before attempting to use it
...
Avoids unexpected occurance and dependency on NaN behavior and divisions by 0
Testcase: fate-lavf-fate-avi_cram
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6085d6b2ae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-06-05 02:40:31 +02:00
Michael Niedermayer
d7ae13d479
swresample/resample: Fix division by 0 with tap_count=1
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit feeb3a9261 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-06-05 02:40:31 +02:00
Michael Niedermayer
1cd872a7d5
swresample/rematrix: Use clipping s16 rematrixing if overflows are possible
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f76157eb0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-06-05 02:40:31 +02:00
Michael Niedermayer
f6586db165
swresample/rematrix: Use error diffusion to avoid error in the DC component of the matrix
...
This fixes the sum of the integer coefficients ending up summing to a value
larger than the value representing unity.
This issue occurs with qN0.dts when converting to stereo
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7fe81bc4f8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-06-05 02:40:30 +02:00
Will Kelleher
7c43c48fda
hevc: Fix memory leak related to a53_caption data
...
Signed-off-by: Will Kelleher <wkelleher@gogoair.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 964f07f68e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-06-05 02:40:30 +02:00
Chris Cunningham
069eea16d9
libavformat/oggdec: Free stream private when header parsing fails.
...
Leaking this private structure opens up the possibility that it may
be re-used when parsing later packets in the stream. This is
problematic if the later packets are not the same codec type (e.g.
private allocated during Vorbis parsing, but later packets are Opus
and the private is assumed to be the oggopus_private type in
opus_header()).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 542f725964 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-06-05 02:40:30 +02:00
Michael Niedermayer
79181b97d4
avformat/utils: Check bps before using it in a shift in ff_get_pcm_codec_id()
...
Fixes undefined shift
Fixes: usan_shift
Found-by: Thomas Guilbert <tguilbert@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea791c080d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-06-05 02:40:30 +02:00
Michael Niedermayer
46360e36d9
avformat/oggparseopus: Check that granule pos is within the supported range
...
Larger values would imply file durations of astronomic proportions and cause
overflows
Fixes integer overflow
Fixes: usan_int64_overflow
Found-by: Thomas Guilbert <tguilbert@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8efaee3710 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-06-05 02:40:30 +02:00
Michael Niedermayer
ef2b8416d9
avcodec/mjpegdec: Do not try to detect last scan but apply idct after all scans for progressive jpeg
...
Fixes: IMG-20160418-WA0002.jpg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit deaf58abf2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-06-05 02:40:30 +02:00
Michael Niedermayer
9491f47035
avformat/options_table: Add missing identifier for very strict compliance
...
Fixes Ticket5443
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 11db7eee9b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-06-05 02:40:30 +02:00
Michael Niedermayer
2fc7e5c1b5
avformat/ffmdec: Check pix_fmt
...
Fixes crash
Fixes Ticket5412
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 78baa450d9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-06-05 02:40:30 +02:00
James Almer
68dcb46205
doc/general: update supported DCA extensions
2016-05-14 23:02:52 -03:00
James Almer
8dce66d33d
avcodec/rscc: check input buffer size for deflate mode
...
Fixes overreads.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit b2244fa0a6 )
2016-05-10 19:13:54 -03:00
foo86
08c21bcb5d
avcodec/dca: fix sync word search error condition
...
This didn't actually check if sync word was found and always errored out
with "-err_detect explode" option enabled.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ce2f9fdb0a )
2016-05-02 22:48:52 -03:00
Carl Eugen Hoyos
e675926a4f
lavf/mpegts: Return small probe score for very short transport streams.
...
Fixes Debian bug 823098.
(cherry picked from commit 88a849c714 )
2016-05-02 22:48:45 -03:00
Michael Niedermayer
c66f4d1ae6
Changelog: Fix minor formating inconsistency
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-28 03:03:39 +02:00
Michael Niedermayer
ad559492dc
update for 3.0.2
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-28 01:40:54 +02:00
Michael Niedermayer
8d0cfa68b9
avcodec/ttaenc: Reallocate packet if its too small
...
Fixes assertion failure
Fixes Ticket5394
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 005c61c6b8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-26 19:49:09 +02:00
Shivraj Patil
83eaaae005
configure: build fix for P5600 with mips code restructuring
...
Note:- backporting commit 15ef98afd1 from head
Signed-off-by: Shivraj Patil <shivraj.patil@imgtec.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-26 12:27:49 +02:00
Vicente Olivert Riera
a5638dbfba
mips: add support for R6
...
Note:- backporting commit ad16eff64b from head
Understanding the mips32r6 and mips64r6 ISAs in the configure script is
not enough. In order to have full support for MIPS R6 in FFmpeg we need
to be able to build it, and for that we need to make sure we don't use
incompatible assembler code which makes the build fail. Ifdefing the
offending code is sufficient to fix the problem.
Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-26 12:27:39 +02:00
Jan Ekström
666754c665
pgssubdec: fix subpicture output colorspace and range
...
Functionality used before didn't widen the values from limited to
full range. Additionally, now the decoder uses BT.709 where it
should be used according to the video resolution.
Default for not yet set colorimetry is BT.709 due to most observed
HDMV content being HD.
BT.709 coefficients were gathered from the first two parts of BT.709
to BT.2020 conversion guide in ARIB STD-B62 (Pt. 1, Chapter 6.2.2).
They were additionally confirmed by manually calculating values.
Fixes #4637
(cherry picked from commit 9779b62624 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-26 02:47:09 +02:00
Michael Niedermayer
4c896d6bd4
avcodec/ac3dec: Reset SPX when switching from EAC3 to AC3
...
Fixes Ticket5319
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9ac154d1fa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-25 04:27:29 +02:00
Michael Niedermayer
f2e9e4757f
avfilter/vf_drawtext: Check return code of load_glyph()
...
Fixes segfault
Fixes Ticket5347
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2e67a99fbc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-24 12:41:09 +02:00
Michael Niedermayer
512c064cd9
avformat/mux: Check that deinit is set before calling it
...
Fixes null pointer dereference
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c84ba07db4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-24 12:40:58 +02:00
Paul B Mahol
7626fb6cbf
avcodec/takdec: add code that got somehow lost in process of REing
...
Signed-off-by: Paul B Mahol <onemda@gmail.com >
(cherry picked from commit 38797a8033 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-21 14:13:38 +02:00
Paul B Mahol
6fdd122b11
avcodec/apedec: fix decoding of stereo files with one channel full of silence
...
Signed-off-by: Paul B Mahol <onemda@gmail.com >
(cherry picked from commit 9149e9c0ba )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-21 14:12:45 +02:00
Michael Niedermayer
264c9fe6aa
avcodec/avpacket: Fix off by 5 error
...
Fixes out of array read
Fixes: mozilla bug 1266129
Found-by: Tyson Smith
Tested-by: Tyson Smith
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9f36ea57ae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-21 00:54:00 +02:00
Ivan
76573c5239
avcodec/h264: Fix for H.264 configuration parsing
...
Sometimes video fails to decode if H.264 configuration changes mid stream.
The reason is that configuration parser assumes that nal_ref_idc is equal to 11b
while actually some codecs but 01b there. The H.264 spec is somewhat
vague about this but it looks like it allows any non-zero nal_ref_idc for sps/pps.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a727606c4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-17 02:40:53 +02:00
Michael Niedermayer
14fdebc4ff
avcodec/bmp_parser: Ensure remaining_size is not too small in startcode packet crossing corner case
...
Fixes Ticket 5438
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e26bdd59b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-14 15:29:25 +02:00
Michael Niedermayer
325d0b64d5
avcodec/pngdec: Fix alpha detection with skip_frame
...
Fixes Ticket4816
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d433623fba )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-09 01:12:32 +02:00
Michael Niedermayer
6103a8453f
Changelog: Make formating consistent
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-04 22:45:14 +02:00
Marios Titas
47f0d80ee0
avfilter/src_movie: fix how we check for overflows with seek_point
...
Currently, if the movie source filter is used and a seek_point is
specified on a file that has a negative start time, ffmpeg will fail.
An easy way to reproduce this is as follows:
$ ffmpeg -vsync passthrough -filter_complex 'color=d=10,setpts=PTS-1/TB' test.mp4
$ ffmpeg -filter_complex 'movie=filename=test.mp4:seek_point=2' -f null -
The problem is caused by checking for int64_t overflow the wrong way.
In general, to check whether a + b overflows, it is not enough to do:
a > INT64_MAX - b
because b might be negative; the correct way is:
b > 0 && > a > INT64_MAX - b
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1f9734f97 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-03 01:55:24 +02:00
Aaron Boxer
5d79566ab3
avcodec/j2kenc: Add attribution to OpenJPEG project:
...
http://ghostscript.com/~tor/gs-browse/gs/openjpeg/libopenjpeg/t1.c
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b6b4b0a65e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-04-01 17:35:50 +02:00
Michael Niedermayer
fda00aa774
doc/Doxyfile: update for 3.0.1
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-29 04:25:48 +02:00
Michael Niedermayer
9b1b674ebe
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-29 04:23:42 +02:00
Michael Niedermayer
00b54d4625
avcodec/diracdec: check bitstream size related fields for overflows
...
Fixes segfault
Fixes Ticket5333
Regression since bfc8a4dabe
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8f2a1990c0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-29 03:25:15 +02:00
Michael Niedermayer
26d29f0c3d
avcodec/h264_slice: Check PPS more extensively when its not copied
...
Fixes Ticket5371
Fixes null pointer dereference
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c50be7a52b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-29 03:25:15 +02:00
James Almer
7b1e020fc5
avformat/svag: fix division by zero
...
Fixes ticket #5386
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit d5a3578350 )
2016-03-28 19:10:34 -03:00
Rostislav Pehlivanov
3d9ebfd272
Changelog: update for 3.0.1's vc2enc fixes
...
Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com >
2016-03-28 17:04:23 +01:00
Rostislav Pehlivanov
f01919b57a
vc2enc: correctly zero out coefficient array padding
...
Credit for figuring this out goes to James Darnley.
Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com >
(cherry picked from commit 3ef10406e1 )
2016-03-28 17:02:05 +01:00
Rostislav Pehlivanov
6cb5bbc660
Changelog: update for 3.0.1's aacenc optimizations
...
Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com >
2016-03-28 16:59:14 +01:00
Ganesh Ajjanagadde
f281cb4ea9
lavc/aacenc_utils: replace powf(x,y) by expf(logf(x), y)
...
This is ~2x faster for y not an integer on Haswell+GCC, and should
generally be faster due to the fact that anyway powf essentially does
this under the hood. Made an inline function in lavu/internal.h for this
purpose.
Note that there are some accuracy differences, that should generally be
negligible. In particular, FATE still passes on this platform.
Results in ~ 7% speedup in aac encoding with -march=native, Haswell+GCC.
before:
ffmpeg -i sin.flac -acodec aac -y sin_new.aac 6.05s user 0.06s system 104% cpu 5.821 total
after:
ffmpeg -i sin.flac -acodec aac -y sin_new.aac 5.67s user 0.03s system 105% cpu 5.416 total
This is also faster than an alternative approach that pulls in powf, gets rid of
the crufty NaN checks and other special cases, exploits knowledge about the intervals, etc.
This of course does not exclude smarter approaches; just suggests that
there would need to be significant work on this front of lower utility than
searches for hotspots elsewhere.
Reviewed-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de >
Reviewed-by: Ronald S. Bultje <rsbultje@gmail.com >
Signed-off-by: Ganesh Ajjanagadde <gajjanag@gmail.com >
(cherry picked from commit bccc81dfa0 )
2016-03-28 16:57:41 +01:00
Reimar Döffinger
b176ab0556
aacenc_utils: Use temporary variable.
...
This ensures gcc does not create unnecessary
loads or stores and possibly even does not vectorize
the negation.
Speeds up mp3 to aac transcoding with default settings
by 10% when using "gcc (Debian 5.3.1-10) 5.3.1 20160224".
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de >
(cherry picked from commit b60dfae7af )
2016-03-28 16:56:27 +01:00
Reimar Döffinger
1cbe4ff2ac
aacenc: avoid double in quantize_bands.
...
I cannot see any point whatsoever to use
double here instead of float, the results
are likely identical in all cases..
Using float allows for much more
efficient use of SIMD.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de >
(cherry picked from commit 0a04c2885f )
2016-03-28 16:56:11 +01:00
Ganesh Ajjanagadde
7c2576e15d
lavc/aacenc_utils: replace sqrtf(Q*sqrtf(Q)) by precomputed value
...
It makes no sense whatsoever to do this at each function call; we
already have a table for this.
Yields a 2x improvement in find_min_book (x86-64, Haswell+GCC):
ffmpeg -i sin.flac -acodec aac -y sin.aac
find_min_book
old
605 decicycles in find_min_book, 8388453 runs, 155 skips.9x
606 decicycles in find_min_book,16776912 runs, 304 skips.9x
607 decicycles in find_min_book,33553819 runs, 613 skips.2x
607 decicycles in find_min_book,67107668 runs, 1196 skips.3x
607 decicycles in find_min_book,134215360 runs, 2368 skips3x
new
359 decicycles in find_min_book, 8388552 runs, 56 skips.3x
360 decicycles in find_min_book,16777112 runs, 104 skips.1x
361 decicycles in find_min_book,33554218 runs, 214 skips.4x
361 decicycles in find_min_book,67108381 runs, 483 skips.5x
361 decicycles in find_min_book,134216725 runs, 1003 skips5x
and more importantly a non-negligible speedup (~ 8%) to overall AAC encoding:
old:
ffmpeg -i sin.flac -acodec aac -strict -2 -y sin_new.aac 6.82s user 0.03s system 104% cpu 6.565 total
new:
ffmpeg -i sin.flac -acodec aac -strict -2 -y sin_old.aac 6.24s user 0.03s system 104% cpu 5.993 total
This also improves accuracy of the expression by ~ 2 ulp in some cases.
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com >
Signed-off-by: Ganesh Ajjanagadde <gajjanag@gmail.com >
(cherry picked from commit bd9c58756a )
2016-03-28 16:55:59 +01:00
Michael Niedermayer
526c7b2186
Update for 3.0.1
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 22:37:41 +01:00
Michael Niedermayer
2d0e415482
avcodec/libutvideodec: copy frame so it has reference counters when refcounted_frames is set
...
Reviewed-by: maintainer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0cd9ff4e3a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:48 +01:00
Ico Doornekamp
daa6dc0a3b
avformat/rtpdec_jpeg: fix low contrast image on low quality setting
...
Original mail and my own followup on ffmpeg-user earlier today:
I have a device sending out a MJPEG/RTP stream on a low quality setting.
Decoding and displaying the video with libavformat results in a washed
out, low contrast, greyish image. Playing the same stream with VLC results
in proper color representation.
Screenshots for comparison:
http://zevv.nl/div/libav/shot-ffplay.jpg
http://zevv.nl/div/libav/shot-vlc.jpg
A pcap capture of a few seconds of video and SDP file for playing the
stream are available at
http://zevv.nl/div/libav/mjpeg.pcap
http://zevv.nl/div/libav/mjpeg.sdp
I believe the problem might be in the calculation of the quantization
tables in the function create_default_qtables(), the attached patch
solves the issue for me.
The problem is that the argument 'q' is of the type uint8_t. According to the
JPEG standard, if 1 <= q <= 50, the scale factor 'S' should be 5000 / Q.
Because the create_default_qtables() reuses the variable 'q' to store the
result of this calculation, for small values of q < 19, q wil subsequently
overflow and give wrong results in the calculated quantization tables. The
patch below uses a new variable 'S' (same name as in RFC2435) with the proper
range to store the result of the division.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e3e6a2cff4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:48 +01:00
Michael Niedermayer
6e5648ad42
avformat/mpegtsenc: Fix used service
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 26811fd946 )
Conflicts:
libavformat/version.h
2016-03-26 21:52:48 +01:00
Michael Niedermayer
e15a48d35a
avformat/mpegtsenc: Keep track of the program for each service
...
Simplifies code
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 50d017a281 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:48 +01:00
Michael Niedermayer
0fae52d7e3
avformat/file: Add crypto to default whitelist
...
Fixes Ticket5287
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit efa98cdc2f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
Michael Niedermayer
50a639a62a
avcodec/mjpegenc_common: Store approximate aspect if exact cannot be stored
...
Fixes Ticket5244
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 068026b0f7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
Mark Thompson
d6adcab842
lavc/hevc: Allow arbitrary garbage in bytestream as long as at least one NAL unit is found.
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fbec157ea0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
Michael Niedermayer
bf80b1d88d
avcodec/resample: Remove disabled and faulty code
...
Fixes Ticket5345
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 50ef7361cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
Luca Barbato
53fffc9fc4
indeo2: Fix banding artefacts
...
Rename luma table to delta table and change how it is used.
CC: libav-stable@libav.org
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com >
Signed-off-by: Diego Biurrun <diego@biurrun.de >
(cherry picked from commit f8c34f4b8d )
(cherry picked from commit 73f3c8f73e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
Luca Barbato
b0e836466f
indeo2data: K&R formatting cosmetics
...
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com >
Signed-off-by: Diego Biurrun <diego@biurrun.de >
(cherry picked from commit d4066a7024 )
(cherry picked from commit 522ab0b9a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
Michael Niedermayer
e158936712
avformat/hlsenc: Fix passing options, regression since bc9a5965c8
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b2ab3398f5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
Michael Niedermayer
c8977ec6e9
avutil/random_seed: Add the runtime in cycles of the main loop to the entropy pool
...
This should theoretically improve the randomness slightly
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2540d884f3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
Martin Cracauer
934bc32acc
avutil/channel_layout: AV_CH_LAYOUT_6POINT1_BACK not reachable in parsing
...
Trying to make heads and tails out of DTS 6.1 I can across this typo.
I also noticed that this wiki page is incorrect or misleading, the
channel order for 6.1 given does not match the source code. At the
least it should be clarified that the layout given does not apply to
DTS. https://trac.ffmpeg.org/wiki/AudioChannelManipulation
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73d1398f0c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
Michael Niedermayer
64f2b48be0
avformat/concatdec: set safe mode to enabled instead of auto
...
This is safer, as a selected demuxer could still mean that it was auto-detected
by a user application
Reviewed-previously-by: Nicolas George <george@nsup.org >
Reviewed-previously-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 689211d572 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
Michael Niedermayer
756f4b586a
avformat/utils: fix dts from pts code in compute_pkt_fields() during ascending delay
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit de1de49324 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
Boris Nagels
56c4dca5ae
avformat/rtpenc: Fix integer overflow in NTP_TO_RTP_FORMAT
...
RTCP synchronization packet was broken since commit in ffmpeg version > 2.8.3
(commit: e04b039b15 ) Since this commit (2e814d0329 )
"rtpenc: Simplify code by introducing a macro for rescaling NTP timestamps", NTP_TO_RTP_FORMAT
uses av_rescale_rnd() function to add the data to the packet.
This causes an overflow in the av_rescale_rnd() function and it will return INT64_MIN.
Causing the NTP stamp in the RTCP packet to have an invalid value.
Github: Closes #182
Reverting commit '2e814d0329aded98c811d0502839618f08642685' solves the problem.
(cherry picked from commit 1109ed7973 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
foo86
da6ccfe18e
avcodec/dca: clear X96 channels if nothing was decoded
...
The first X96 channel set can have more channels than core, causing X96
decoding to be skipped. Clear the number of decoded X96 channels to zero
in this rudimentary case.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit db44b59980 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
Michael Niedermayer
27a61302b7
fate/aac: Increase fuzz from of fate-aac-pns-encode from 72 to 74 for Loongson
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c78a726717 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
Michael Niedermayer
b4be953c55
avformat/cache: Fix memleak of tree entries
...
Found-by: jamrial
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 554f6e930c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
Rodger Combs
3b179b6302
lavf/mov: downgrade sidx errors to non-fatal warnings; fixes trac #5216
...
(cherry picked from commit 22dbc1caaf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
Rodger Combs
bf8f2fae2a
lavf/mov: fix sidx with edit lists
...
(cherry picked from commit 3617e69d50 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
Michael Niedermayer
0d7343f8dd
avcodec/mjpegdec: Fix decoding slightly odd progressive jpeg
...
Fixes: ebd58db6-dc86-11e5-91c2-59daeddf50c7.jpg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c6f4720b86 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
Michael Niedermayer
fb8676eb1c
swscale/utils: Fix chrSrcHSubSample for GBRAP16
...
Fixes part of Ticket5264
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 67e5bd0c50 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
Michael Niedermayer
ca5c639446
swscale/input: Fix GBRAP16 input
...
Fixes part of Ticket5264
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df36257a53 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
Michael Niedermayer
bd79dbfa2b
avutil/pixdesc: Make get_color_type() aware of CIE XYZ formats
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1ec7a70380 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
Michael Niedermayer
c4765a41b9
avcodec/h264: Execute error concealment before marking the frame as done.
...
Fixes race condition causing artifacts
Fixes Ticket4122
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 98a0053d0f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
Michael Niedermayer
be5acd6cb1
swscale/x86/output: Fix yuv2planeX_16* with unaligned destination
...
Reviewed-by: BBB
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f6492a2ea8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
Michael Niedermayer
c3e7a7ef3f
swscale/x86/output: Move code into yuv2planeX_mainloop
...
Reviewed-by: BBB
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d07f6e5f1c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:47 +01:00
KO Myung-Hun
9e4d297ba7
MAINTAINERS: add myself as an OS/2 maintainer
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 346ec91764 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-03-26 21:52:46 +01:00
James Almer
373bc77a35
libwebpenc_animencoder: print library messages in verbose log levels
...
Reviewed-by: James Zern <jzern@google.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit f875ba4873 )
2016-03-17 12:57:00 -03:00
James Almer
20d89a3a32
libwebpenc_animencoder: zero initialize the WebPAnimEncoderOptions struct
...
This zeroes the WebPAnimEncoderOptions.verbose field, silencing library info messages
printed to stderr.
Reviewed-by: James Zern <jzern@google.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 626b6b769c )
2016-03-17 12:56:30 -03:00
Hendrik Leppkes
ee7c347935
configure: check for SEC_I_CONTEXT_EXPIRED before enabling SChannel
...
Fixes build on mingw32, which lacks this constant.
2016-03-16 15:32:50 +01:00
Carl Eugen Hoyos
9da31a0373
lavf/http: Add httpproxy to the default protocol whitelist.
...
(cherry picked from commit 58fa694978 )
2016-03-14 16:39:05 +01:00
Paul B Mahol
eb46065f4a
doc/utils: fix typo for min() description
...
Signed-off-by: Paul B Mahol <onemda@gmail.com >
(cherry picked from commit bdf474bcff )
Signed-off-by: Timothy Gu <timothygu99@gmail.com >
2016-03-02 16:43:57 -08:00
Oliver Collyer
b80083a5c1
ffserver&ffm: Fixed issues preventing ffserver write_index and files_size from being set correctly which was breaking ffserver streaming.
...
I discovered that ffserver streaming was broken (it seems like it has been since 20th November) and I opened a ticket for this (https://trac.ffmpeg.org/ticket/5250 <https://trac.ffmpeg.org/ticket/5250 >).
I spent yesterday learning git bisect (with the kind help of cehoyos) to painstakingly track down the cause. This was made more difficult due to the presence of a segfault in ffserver during the period where the bug was introduced so I first had to identify when and how that was fixed and then retrospectively apply that fix again for each step of the second git bisect to find the actual bug.
Anyway, the fruits of my labour are the innocent looking patch below to correct a couple of typos and define a valid range for two variables.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a2f8beef2d )
2016-02-23 15:58:42 +01:00
Carl Eugen Hoyos
449ff0e3fd
postproc: fix unaligned access
...
Based on 59074310 by Andreas Cadhalpun.
Fixes ticket #5259 .
(cherry picked from commit 2aa21eec1a )
2016-02-23 15:58:07 +01:00
Rostislav Pehlivanov
0aa2fbddb1
vc2enc: fix use of uninitialized variables in the rate control system
...
Fixes: CID1352550
Fixes: CID1352549
Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com >
(cherry picked from commit 7cdea450c6 )
2016-02-15 15:36:59 +00:00
Michael Niedermayer
c40983a6f6
fate/source-check.sh: Use "git show" instead of git --version to test for git
...
This fixes fate with non git source trees
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 295de3efc5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-15 03:51:39 +01:00
Michael Niedermayer
bd0497b28b
avcodec/cfhd: Temporary disable frame threading until related bugs have been fixed
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-15 03:12:13 +01:00
James Almer
4d95207938
x86: use the new helper macros where useful
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 70d685a77f )
2016-02-14 20:04:19 -03:00
James Almer
1e8a75fae4
x86: add some more helper macros to check for slow cpuflags
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 73a4589d4b )
2016-02-14 20:04:06 -03:00
Rostislav Pehlivanov
380980e0d2
Changelog: add entries for the SMPTE VC-2 decoder and encoder
...
Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com >
2016-02-14 22:12:06 +00:00
Michael Niedermayer
1fd8eb4d4f
Basic updates for 3.0
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2016-02-14 23:03:41 +01:00