Rémi Denis-Courmont
9983d098ff
avcodec/x86/mathops: clip constants used with shift instructions within inline assembly
...
Fixes assembling with binutil as >= 2.41
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit effadce6c7 )
2025-03-29 17:04:13 -03:00
Michael Niedermayer
62e1c44263
doc/Doxyfile: Fix typo
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-12 22:13:01 +01:00
Michael Niedermayer
e6304a83a2
Update for 3.4.14
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 22:23:23 +01:00
Lynne
2f8faa3ff1
configure: update copyright year
...
On 01/01/2025 19:05, Peter Ross wrote:
> FFmpeg turns 25 this year.
(cherry picked from commit d3aa99a4f4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 22:23:23 +01:00
Cosmin Stejerean
e6ef90db6c
avfilter/bwdif: account for chroma sub-sampling in min size calculation
...
The current logic for detecting frames that are too small for the
algorithm does not account for chroma sub-sampling, and so a sample
where the luma plane is large enough, but the chroma planes are not
will not be rejected. In that event, a heap overflow will occur.
This change adjusts the logic to consider the chroma planes and makes
the change to all three bwdif implementations.
Fixes #10688
Signed-off-by: Cosmin Stejerean <cosmin@cosmin.at >
Reviewed-by: Thomas Mundt <tmundt75@gmail.com >
Signed-off-by: Philip Langdale <philipl@overt.org >
(cherry picked from commit 737ede405b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 22:23:23 +01:00
Michael Niedermayer
dae907d551
avformat/iff: Check that we have a stream in read_dst_frame()
...
Fixes: null pointer dereference
Fixes: 385644864/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4551049565765632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8668957ef6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 22:23:22 +01:00
Michael Niedermayer
7dc39ecb8f
avformat/mlvdec: fix size checks
...
Fixes: heap-buffer-overflow
Fixes: 391962476/clusterfuzz-testcase-minimized-ffmpeg_dem_MLV_fuzzer-5746746587676672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 251d43aef0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 22:23:22 +01:00
Michael Niedermayer
5c072bd7e1
avcodec/h263dec: Check against previous dimensions instead of coded
...
Fixes: out of array access
Fixes: crash-a41ef3db699013f669b076f02f36942925f5a98c
Found-by: Kacper Michajlow <kasper93@gmail.com >
Reviewed-by: Kacper Michajlow <kasper93@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0fe33c99a2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 22:23:22 +01:00
Michael Niedermayer
17c4b50908
avformat/mxfdec: Check avio_read() success in mxf_decrypt_triplet()
...
Fixes: Use of uninitialized memory
Fixes: 71444/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5448597561212928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ecc96f4d0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 22:23:21 +01:00
Michael Niedermayer
67249b7cbf
avcodec/huffyuvdec: Initialize whole output for decode_gray_bitstream()
...
Fixes: use of uninitialized memory
Fixes: 375286238/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-6352546854141952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ef71552cf9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 22:23:21 +01:00
Michael Niedermayer
8c32f218fb
avformat/ipmovie: Check signature_buffer read
...
Fixes: use of uninitilaized data
Fixes: 385167047/clusterfuzz-testcase-minimized-ffmpeg_dem_IPMOVIE_fuzzer-5941477505564672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 788abe0d25 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 22:23:20 +01:00
Michael Niedermayer
f1515fa17d
avformat/wtvdec: Initialize buf
...
ff_parse_mpeg2_descriptor() reads over what is initialized
Fixes: use of uninitialized memory
Fixes: 383825645/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5144130618982400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 17b019c517 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 22:23:20 +01:00
Michael Niedermayer
ceffbe4633
avformat/vqf: Propagate errors from add_metadata()
...
Suggested-by: Marton Balint <cus@passwd.hu >
Reviewed-by: Alexander Strasser <eclipse7@gmx.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 49fa3f6c5b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 22:23:20 +01:00
Michael Niedermayer
ad5b7b0312
avformat/vqf: Check avio_read() in add_metadata()
...
Fixes: use of uninitialized data
Fixes: 383825642/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5380168801124352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c43dbecbda )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:30 +01:00
Michael Niedermayer
de24884352
avutil/avstring: dont mess with NULL pointers in av_match_list()
...
Fixes: applying zero offset to null pointer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c6c54943d1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:30 +01:00
Michael Niedermayer
51dd93b44c
avcodec/mpegvideo_enc: Check FLV1 resolution limits
...
Found-by: Elias Myllymäki <elias.myllymaki04p@gmail.com >
Reviewed-by: Alexander Strasser <eclipse7@gmx.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 827c073154 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:29 +01:00
Michael Niedermayer
bc13387c5b
avcodec/ffv1enc: Fix handling of 32bit unsigned symbols
...
This may be needed for floats
Sponsored-by: Sovereign Tech Fund
Reviewed-by: Alexander Strasser <eclipse7@gmx.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 402824e9e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:29 +01:00
Michael Niedermayer
7da68e0879
avcodec/vc1dec: Clear block_index in vc1_decode_reset()
...
Fixes: 377965565/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-4504434689769472
Fixes: out of array access
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 251de1791e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:29 +01:00
Michael Niedermayer
c58836887d
avcodec/aacsbr_template: Clear n_q on error
...
Fixes: index 5 out of bounds for type 'uint8_t [5]'
Fixes: 377748135/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5167109774049280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3f029bfb7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:28 +01:00
Michael Niedermayer
922b6e6a2d
swscale/output: Fix undefined overflow in yuv2rgba64_full_X_c_template()
...
Fixes: signed integer overflow: -1082982400 + -1195645138 cannot be represented in type 'int'
Fixes: 376136843/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-4791844321427456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 56faee21c1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:28 +01:00
Michael Niedermayer
f4dd0a5fc7
avfilter/af_pan: Fix sscanf() use
...
Fixes: Memory Data Leak
Found-by: Simcha Kosman <simcha.kosman@cyberark.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5b6391d64 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:27 +01:00
Michael Niedermayer
d7f72f7a84
avformat/rmdec: check that buf if completely filled
...
Fixes: use of uninitialized value
Fixes: 70988/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5298245077630976
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9578c135d0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:27 +01:00
Michael Niedermayer
f41be82aca
avformat/mxfdec: Check that key was read sucessfull
...
Fixes: use of uninitialized value
Fixes: 70932/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4870202133643264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4c62cbcae2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:27 +01:00
Michael Niedermayer
b322533a60
avformat/rpl: Fix check for negative values
...
Fixes: signed integer overflow: 10 * -1923267925333400000 cannot be represented in type 'int64_t' (aka 'long')
Fixes: 378891963/clusterfuzz-testcase-minimized-fuzzer_loadfile_direct-5714338935013376
Found-by: ossfuzz
Reported-by: Kacper Michajlow <kasper93@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eab65379bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:26 +01:00
Michael Niedermayer
dcfacf4ee5
avformat/mlvdec: Check avio_read()
...
Fixes: use-of-uninitialized-value
Fixes: 383170476/clusterfuzz-testcase-minimized-ffmpeg_dem_MLV_fuzzer-4696002884337664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bb85423142 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:26 +01:00
Michael Niedermayer
250912e23f
avcodec/utils: Fix block align overflow for ADPCM_IMA_WAV
...
Fixes: signed integer overflow: 529008646 * 8 cannot be represented in type 'int'
Fixes: 383379145/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6674045107503104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9327093079 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:26 +01:00
Michael Niedermayer
e6f9fe73e2
avformat/matroskadec: Check pre_ns for overflow
...
Fixes: signed integer overflow: -3483479120376300096 - 7442323944145700864 cannot be represented in type 'long'
Fixes: 383187489/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4561470580391936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 361d24e6d9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:25 +01:00
Michael Niedermayer
6c9f3e222e
avcodec/webp: Check ref_x/y
...
Fixes: 70991/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WEBP_fuzzer-5544067620995072
Fixes: use of uninintailized value
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7c1e732ad2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:25 +01:00
Michael Niedermayer
764aa5238f
avformat/dxa: check bpc
...
Fixes: integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 373971762/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-4880491112103936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7e020f2141 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:25 +01:00
Michael Niedermayer
f15e004be6
swscale/slice: clear allocated memory in alloc_lines()
...
Fixes: use of uninitialized memory in hScale16To15_c()
Fixes: 373924007/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5841199968092160
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aeec39f3c1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:24 +01:00
Michael Niedermayer
06942392a0
avformat/icodec: fix integer overflow with nb_pal
...
Fixes: runtime error: signed integer overflow
Fixes: 42536949/clusterfuzz-testcase-minimized-fuzzer_loadfile-6199846684393472
Found-by: ossfuzz
Reported-by: Kacper Michajlow
Tested-by: Kacper Michajlow
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 84569b6c22 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:24 +01:00
Michael Niedermayer
7cdefdb2ff
doc/developer: Document relationship between git accounts and MAINTAINERS
...
This should have been documented long ago and i thought it was
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7051825b01 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:24 +01:00
Michael Niedermayer
6ecbd8bbca
avformat/ilbc: Check avio_read() for failure
...
Fixes: use of uninitialized value
Fixes: 42537627/clusterfuzz-testcase-minimized-fuzzer_protocol_memory-6656646223298560-cut
Found-by: ossfuzz
Reported-by: Kacper Michajlow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e30d957a9b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:23 +01:00
Michael Niedermayer
2ac5f60d17
avformat/nistspheredec: Clear buffer
...
Fixes: use-of-uninitialized-value
Fixes: 42537627/clusterfuzz-testcase-minimized-fuzzer_protocol_memory-6515855798632448-cut
Found-by: ossfuzz
Reported-by: Kacper Michajlow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 898f6582eb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:23 +01:00
Michael Niedermayer
197cf58407
INSTALL: explain the circular dependency issue and solution
...
Sponsored-by: Sovereign Tech Fund
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df00705e00 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:23 +01:00
Michael Niedermayer
8700666752
avformat/mpegts: Initialize predefined_SLConfigDescriptor_seen
...
Fixes: use of uninitialized variable
Fixes: 368729566/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTS_fuzzer-6044501804646400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit db7b4fc89f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:22 +01:00
Michael Niedermayer
5f0067652b
avcodec/rangecoder: only perform renorm check/loop for callers that need it
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d147b3d7ec )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:22 +01:00
Michael Niedermayer
1f5977e95c
avcodec/ffv1dec: Fix end computation with ec=2
...
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 10e5af15bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:22 +01:00
Michael Niedermayer
d5a26a396d
avcodec/ffv1enc: Prevent generation of files with broken slices
...
Fixes: Ticket5548
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b7ff66a358 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:21 +01:00
Michael Niedermayer
b6f2250c12
avformat/matroskadec: Check desc_bytes so bits fit in 64bit
...
Likely a tighter check can be done
Fixes: signed integer overflow: 3305606804154370442 * 8 cannot be represented in type 'long'
Fixes: 70449/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4771166007918592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4122406f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:21 +01:00
Michael Niedermayer
9a0d56f8f7
avcodec/ffv1enc: Correct error message about unsupported version
...
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 556c767786 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:21 +01:00
Michael Niedermayer
db47d9ecb7
avcodec/ffv1enc: Slice combination is unsupported
...
We always write minimal slices, the size calculation is wrong in some
corner cases but as its always 1x1 (minus1) we can for now just hard-code it
This helps with ticket 5548
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d514655bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:20 +01:00
Michael Niedermayer
b4d26a6333
avcodec/ffv1enc: 2Pass mode is not possible with golomb coding
...
"Fixes" Ticket7063
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 417b163c00 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:20 +01:00
Michael Niedermayer
1c68f225cd
avcodec/ffv1enc: Fix >8bit context size
...
Fixes: Ticket5405
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a9c83e43f2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:20 +01:00
Michael Niedermayer
0e997798c1
avcodec/xan: Add basic input size check
...
Fixes: Timeout
Fixes: 71739/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XAN_WC3_fuzzer-6170301405134848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpe
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 56bef2fd58 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:19 +01:00
Michael Niedermayer
e253f3735d
avcodec/svq3: Check for minimum size input
...
Fixes: Timeout
Fixes: 71295/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-4999941125111808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 050b5e85cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:19 +01:00
Michael Niedermayer
d0f7089871
avcodec/jfdctint_template: use unsigned z* in row_fdct()
...
Fixes: signed integer overflow: 856827136 + 2123580416 cannot be represented in type 'int'
Fixes: 70772/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PRORES_KS_fuzzer-5180569961431040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f27c8b04d3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:19 +01:00
Michael Niedermayer
de9b2a2b35
avformat/mxfdec: More offset_temp checks
...
Fixes: signed integer overflow: 9223372036854775807 - -1927491430256034080 cannot be represented in type 'long'
Fixes: 70607/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5282235077951488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <git@haerdin.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5a96aa435a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:18 +01:00
Michael Niedermayer
94acfdb3a2
swscale/output: Fix undefined integer overflow in yuv2rgba64_2_c_template()
...
Fixes: signed integer overflow: -1082982400 + -1083218484 cannot be represented in type 'int'
Fixes: 70657/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-6707819712675840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bd80c97391 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:18 +01:00
Michael Niedermayer
c61cab713b
swscale/swscale: Use unsigned operation to avoid undefined behavior
...
I have not checked that the constant is correct, this just fixes the undefined behavior
Fixes: signed integer overflow: -646656 * 3517 cannot be represented in type 'int
Fixes: 70559/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5209368631508992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 44c5641ae8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:17 +01:00
Michael Niedermayer
c28eaa1696
avcodec/vc2enc: basic sanity check on slice_max_bytes
...
Fixes: left shift of 896021632 by 3 places cannot be represented in type 'int'
Fixes: 70544/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC2_fuzzer-6685593652756480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6df9a0292c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:17 +01:00
Michael Niedermayer
b7892cd835
avcodec/wmavoice: Do not use uninitialized pitch[0]
...
Fixes: use of uninitialized value
Fixes: 70850/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-4806127362048000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5338707930 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:17 +01:00
Michael Niedermayer
c4faa5356e
avformat/apetag: Check APETAGEX
...
Fixes: Use of uninitialized value
Fixes: 71074/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5697034877730816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 796ff2d599 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:16 +01:00
Michael Niedermayer
9973a54ece
avcodec/avcodec: Warn about data returned from get_buffer*()
...
Text based on suggestion by: epirat07@gmail.com
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93444c46fce195e378c4ebb1a20ea662e7f0123b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:16 +01:00
Michael Niedermayer
45c96c41eb
avcodec/aic: Clear slice_data
...
Fixes: use-of-uninitialized-value
Fixes: 70865/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AIC_fuzzer-4874102695854080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit de3f6c8888 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:16 +01:00
Michael Niedermayer
3a85504365
avcodec/shorten: clear padding
...
Fixes: use-of-uninitialized-value
Fixes: 70854/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5533480570650624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e44349ee88 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:15 +01:00
Michael Niedermayer
730e9281f5
avformat/mpeg: Check an avio_read() for failure
...
Fixes: use-of-uninitialized-value
Fixes: 70849/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGPS_fuzzer-4684401009557504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 66ee75d76c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:15 +01:00
Michael Niedermayer
7d2f1817bf
avformat/segafilm: Set keyframe
...
Fixes: use of uninitialized value
Fixes: 70871/clusterfuzz-testcase-minimized-ffmpeg_dem_SEGAFILM_fuzzer-5883617752973312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4dc7dfe65a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:15 +01:00
Michael Niedermayer
bc687c63a0
avcodec/dxva2: initialize hr in ff_dxva2_common_end_frame()
...
Related: CID1591924 Uninitialized scalar variable
Related: CID1591938 Uninitialized scalar variable
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1d6a2aebae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:14 +01:00
Michael Niedermayer
d0fb119755
avcodec/dxva2: initialize validate
...
Related: CID1591915 Uninitialized scalar variable
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2232c4cc8c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:14 +01:00
Michael Niedermayer
3945020ab5
avcodec/dxva2: Initialize ConfigBitstreamRaw
...
Related: CID1591894 Uninitialized scalar variable
Related: CID1591906 Uninitialized scalar variable
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 489c05b9c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:14 +01:00
Michael Niedermayer
8d570b477e
avcodec/dxva2: Initialize dxva_size and check it
...
Related: CID1591878 Uninitialized scalar variable
Related: CID1591928 Uninitialized pointer read
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8c59e9929 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:13 +01:00
Michael Niedermayer
7c9f2e65de
avformat/lmlm4: Eliminate some AVERROR(EIO)
...
Found by code review related to CID732224 Overflowed constant
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 191a685010 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:13 +01:00
Michael Niedermayer
c6083eee1a
avformat/wtvdec: Check length of read mpeg2_descriptor
...
Fixes: Use of uninitialized value
Fixes: 70900/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-6286909377150976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c390234da2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:13 +01:00
Michael Niedermayer
acc28553d1
avformat/wtvdec: clear sectors
...
The code can leave uninitialized holes in the array.
Fixes: use of uninitialized values
Fixes: 70883/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-6698694567591936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c95ea03104 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:12 +01:00
Kacper Michajłow
8a173a9bf4
avcodec/parser: ensure input padding is zeroed
...
Fixes use of uninitialized value, reported by MSAN.
Found by OSS-Fuzz.
Signed-off-by: Kacper Michajłow <kasper93@gmail.com >
Fixes: 70852/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5179190066872320
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5dfc0cc841 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:12 +01:00
Michael Niedermayer
ec84a7de47
avformat/img2dec: Clear padding data after EOF
...
Fixes: use-of-uninitialized-value
Fixes: 70852/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5179190066872320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Kacper Michajlow <kasper93@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3978e81809 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:12 +01:00
Michael Niedermayer
b66ada8ae5
avformat/wavdec: Check if there are 16 bytes before testing them
...
Fixes: use-of-uninitialized-value
Fixes: 70839/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5212907590189056
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 79a1cf30d1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:11 +01:00
Michael Niedermayer
f6adefd4cd
avcodec/snow: Fix off by 1 error in run_buffer
...
Fixes: out of array access
Fixes: 70741/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5703668010647552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 06f5ed40f8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:11 +01:00
Michael Niedermayer
5c27f68507
avcodec/utils: apply the same alignment to YUV410 as we do to YUV420 for snow
...
The snow encoder uses block based motion estimation which can read out of array if
insufficient alignment is used
It may be better to only apply this for the encoder, as it would safe a few bytes of memory
for the decoder. Until then, this fixes the issue in a simple way.
Fixes: out of array access
Fixes: 68963/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-4979988435632128
Fixes: 68969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-6239933667803136.fuzz
Fixed: 70497/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5751882631413760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 58fbeb59e7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:11 +01:00
Michael Niedermayer
c22eb904fd
avcodec/vaapi_encode: Check hwctx
...
Fixes: null pointer dereference
Fixes: 70376/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_VAAPI_fuzzer-4733551250046976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3cd077e282 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:10 +01:00
Michael Niedermayer
7fb253b20d
avcodec/proresdec: Consider negative bits left
...
Fixes: 70036/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PRORES_fuzzer-6298797647396864
Fixes: shift exponent 40 is too large for 32-bit type 'uint32_t' (aka 'unsigned int')
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 419eee6356 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:10 +01:00
Michael Niedermayer
ec4f24805e
avcodec/hevc/hevcdec: Do not allow slices to depend on failed slices
...
An alternative would be to leave the context unchanged on failure of hls_slice_header()
Fixes: out of array access
Fixes: NULL pointer dereference
Fixes: 69584/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5931086299856896
Fixes: 69724/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5104066422702080
Fixes: 70422/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5908731129298944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d9544cfb0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:10 +01:00
Michael Niedermayer
8bc12fa45f
avutil/slicethread: Check pthread_*_init() for failure
...
Fixes: CID1604383 Unchecked return value
Fixes: CID1604439 Unchecked return value
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 23851c9ee0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:09 +01:00
Michael Niedermayer
98f0ceb4e9
avutil/frame: Check log2_crop_align
...
Fixes: CID1604586 Overflowed constant
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 15540b3d28 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:09 +01:00
Michael Niedermayer
ddab39d1ff
avutil/buffer: Check ff_mutex_init() for failure
...
Fixes: CID1604487 Unchecked return value
Fixes: CID1604494 Unchecked return value
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 82f5b20ff5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:09 +01:00
Michael Niedermayer
507f993635
avformat/xmv: Check this_packet_size
...
Fixes: CID1604489 Overflowed constant
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 696685df0c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:08 +01:00
Michael Niedermayer
09d35aec7f
avformat/tty: Check avio_size()
...
Fixes: CID1220824 Overflowed constant
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 41745e550a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:08 +01:00
Michael Niedermayer
4ead93ffea
avformat/siff: Basic pkt_size check
...
Fixes: half of CID1258461 Overflowed constant
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 124a97dd8b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:08 +01:00
Michael Niedermayer
c0d4a0c726
avformat/sauce: Check avio_size() for failure
...
Fixes: CID1604592 Overflowed constant
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 759aae590c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:07 +01:00
Michael Niedermayer
3b356b3120
avformat/sapdec: Check ffurl_get_file_handle() for error
...
Fixes: CID1604506 Overflowed constant
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3e305a0e70 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:07 +01:00
Michael Niedermayer
99bf5d92de
avformat/nsvdec: Check asize for PCM
...
Fixes: CID1604527 Overflowed constant
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e83e246504 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:06 +01:00
Michael Niedermayer
de4bb6d706
avformat/mp3dec: Check header_filesize
...
Fixes: CID1608714 Division or modulo by float zero
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cea4dbc903 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:06 +01:00
Michael Niedermayer
99ac5be16b
avformat/mp3dec; Check for avio_size() failure
...
Fixes: CID1608710 Improper use of negative value
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bb936a1a72 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:06 +01:00
Michael Niedermayer
7d0db1511c
avformat/mov: Use 64bit for str_size
...
We assign a 64bit variable to it before checking
Fixes: CID1604544 Overflowed integer argument
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 046d069552 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:05 +01:00
Michael Niedermayer
ed5a7a6c9a
avformat/mm: Check length
...
Fixes: CID1220824 Overflowed constant
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 139bf41246 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:05 +01:00
Michael Niedermayer
3155d06b19
avformat/hnm: Check *chunk_size
...
Fixes: CID1604419 Overflowed constant
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 291356f58b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:05 +01:00
Michael Niedermayer
a186a9a984
avformat/asfdec_o: Check size of index object
...
We subtract 24 so it must be at least 24
Fixes: CID1604482 Overflowed constant
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 891bc070f0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:04 +01:00
Michael Niedermayer
4d93064b95
swscale/output: Fix integer overflows in yuv2rgba64_X_c_template
...
Fixes: signed integer overflow: -1082982400 + -1068681048 cannot be represented in type 'int'
Fixes: 69995/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-6285740271534080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bcab9789ef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:04 +01:00
Michael Niedermayer
e7724960d3
avcodec/utvideoenc: Use unsigned shift to build flags
...
Fixes: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 69083/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_fuzzer-5608202363273216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 69e90491f1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:04 +01:00
Michael Niedermayer
b34ec0c16d
avcodec/vc2enc: Fix overflows with storing large values
...
Fixes: left shift of 1431634944 by 2 places cannot be represented in type 'int'
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int'
Fixes: 69061/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC2_fuzzer-6325700826038272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit af99358353 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:03 +01:00
Michael Niedermayer
ecb722a6ec
avcodec/mpegvideo_enc: Do not duplicate pictures on shifting
...
Fixes: out of array access
Fixes: 69098/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG2VIDEO_fuzzer-6107989688778752
Fixes: 69599/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4848626296225792.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c8881cb35 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:03 +01:00
Michael Niedermayer
d71876ec5c
avdevice/dshow: Check device_filter_unique_name before use
...
Fixes: CID1591931 Explicit null dereferenced
Sponsored-by: Sovereign Tech Fund
Reviewed-by: Roger Pack <rogerdpack@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 175c191668 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:03 +01:00
Michael Niedermayer
d3b625a551
avdevice/dshow_filter: Use wcscpy_s()
...
Fixes: CID1591929 Copy into fixed size buffer
Sponsored-by: Sovereign Tech Fund
Reviewed-by: Roger Pack <rogerdpack@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit daf61dddc8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:02 +01:00
Michael Niedermayer
0a57535109
avcodec/flac_parser: Assert that we do not overrun the link_penalty array
...
Helps: CID1454676 Out-of-bounds read
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9af348bd1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:02 +01:00
Michael Niedermayer
ce0fc150ec
avcodec/pixlet: Simplify pfx computation
...
Found by reviewing code related to CID1604365 Overflowed constant
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0474614e6c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:02 +01:00
Michael Niedermayer
dfc53db0d5
avcodec/motion_est: Fix score squaring overflow
...
Fixes: CID1604552 Overflowed constant
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f18b442370 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:01 +01:00
Michael Niedermayer
5861150898
avcodec/loco: Check loco_get_rice() for failure
...
Fixes: CID1604495 Overflowed constant
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d553276843 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:01 +01:00
Michael Niedermayer
adb8ef8bc6
avcodec/loco: check get_ur_golomb_jpegls() for failure
...
Fixes: CID1604400 Overflowed constant
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b989986641 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:01 +01:00
Michael Niedermayer
fb924d8bc1
avcodec/iff: Use signed count
...
This is more a style fix than a bugfix (CID1604392 Overflowed constant)
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cfe66dfebb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:00 +01:00
Michael Niedermayer
f44ba23251
avcodec/golomb: Assert that k is in the supported range for get_ur/sr_golomb()
...
Found by code review related to CID1604563 Overflowed return value
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b2aaeb81f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:00 +01:00
Michael Niedermayer
158f48acab
avcodec/golomb: Document return for get_ur_golomb_jpegls() and get_sr_golomb_flac()
...
Found while reviewing code related to CID1604409 Overflowed return value
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7cf5b83f6f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:48:00 +01:00
Michael Niedermayer
22924742c9
avcodec/xsubdec: Check parse_timecode()
...
Fixes: CID1604490 Overflowed constant
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 96fd9417e2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:59 +01:00
Michael Niedermayer
515c20cbf1
avutil/imgutils: av_image_check_size2() ensure width and height fit in 32bit
...
width and height > 32bit is not supported and its easier to check in a central place
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ba63e32957 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:59 +01:00
Michael Niedermayer
0a4c165f41
avcodec/proresenc_kostya: use unsigned alpha for rotation
...
Fixes: left shift of negative value -208
Fixes: 69073/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PRORES_KS_fuzzer-4745020002336768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93e0265e27 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:59 +01:00
Michael Niedermayer
f6c9f94998
avformat/rtmppkt: Simplify and deobfuscate amf_tag_skip() slightly
...
Found while reviewing: CID1530313 Untrusted loop bound
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cedbef0394 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:58 +01:00
Michael Niedermayer
8716ce6c20
avformat/rmdec: use 64bit for audio_framesize checks
...
It is not entirely clear what would prevent such overflow so even if it is
not possible, it is better to use 64bit
Fixes: CID1491898 Unintentional integer overflow
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 665be4fa2f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:58 +01:00
Michael Niedermayer
1b9e394ab1
avutil/hwcontext_d3d11va: correct sizeof IDirect3DSurface9
...
Fixes: CID1591944 Wrong sizeof argument
Sponsored-by: Sovereign Tech Fund
Reviewed-by: Steve Lhomme <robux4@ycbcr.xyz >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 628ba061c8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:58 +01:00
Michael Niedermayer
199b3e3093
avutil/hwcontext_d3d11va: correct sizeof AVD3D11FrameDescriptor
...
Fixes: CID1591909 Wrong sizeof argument
Sponsored-by: Sovereign Tech Fund
Reviewed-by: Steve Lhomme <robux4@ycbcr.xyz >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 698ed0d5a5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:57 +01:00
Michael Niedermayer
cba83cd8a5
avformat/tls_schannel: Initialize ret
...
Fixes: CID1591881 Uninitialized scalar variable
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f022afea77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:57 +01:00
Michael Niedermayer
32a4930fd3
avformat/subfile: Assert that whence is a known case
...
This may help CID1452449 Uninitialized scalar variable
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 426d8c84c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:57 +01:00
Michael Niedermayer
64d201f913
avformat/rtsp: Check that lower transport is handled in one of the if()
...
Fixes: CID1473554 Uninitialized scalar variable
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8200d3825 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:56 +01:00
Michael Niedermayer
3112c50439
avformat/rtsp: initialize reply1
...
It seems reply1 is initialized by ff_rtsp_send_cmd() in most cases but there
are code paths like "continue" which look like they could skip it but even if not
writing this so a complex loop after several layers of calls initialized a local
variable through a pointer is just bad design.
This patch simply initialized the variable.
Fixes: CID1473532 Uninitialized scalar variable
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 498ce4e8b8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:56 +01:00
Michael Niedermayer
cfd06ff4fe
avformat/rtsp: use < 0 for error check
...
Found while reviewing CID1473532 Uninitialized scalar variable
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9bb38ba2b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:55 +01:00
Michael Niedermayer
faec74ed04
avformat/rtpenc_vc2hq: Check sizes
...
Fixes: CID1452585 Untrusted loop bound
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7a9ddb7051 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:55 +01:00
Michael Niedermayer
5f93a294c1
avfilter/af_pan: check nb_output_channels before use
...
Fixes: CID1500281 Out-of-bounds write
Fixes: CID1500331 Out-of-bounds write
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5fe8bf4aa5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:55 +01:00
Michael Niedermayer
529aecc37b
tools/coverity: Phase 1 study of anti-halicogenic for coverity av_rescale()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 380a8213b1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:54 +01:00
Michael Niedermayer
7036d7a8c7
avfilter/vf_avgblur: Check plane instead of AVFrame
...
Fixes: CID1551694 Use after free (false positive based on assuming that out == in and one is freed and one used)
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c296d4fdec )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:54 +01:00
Michael Niedermayer
7d11ca1648
avformat/rdt: Check pkt_len
...
Fixes: CID1473553 Untrusted loop bound
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0d0373de3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:54 +01:00
Michael Niedermayer
a8934f906e
avformat/mpeg: Check len in mpegps_probe()
...
Fixes: CID1473590 Untrusted loop bound
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ca237a841e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:53 +01:00
Michael Niedermayer
ccd2e6f76e
avdevice/dshow: Check ICaptureGraphBuilder2_SetFiltergraph() for failure
...
Fixes: CID1591939 Logically dead code
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4c285bb278 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:53 +01:00
Michael Niedermayer
91d1251821
avformat/img2dec: assert no pipe on ts_from_file
...
Help coverity with CID1500302 Uninitialized scalar variable
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4824156fa0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:53 +01:00
Michael Niedermayer
dfe833c8be
avformat/mov: Check edit list for overflow
...
Fixes: 67492/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5778297231310848
Fixes: signed integer overflow: 2314885530818453536 + 7782220156096217088 cannot be represented in type 'long'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2882d30e3a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:52 +01:00
Michael Niedermayer
c5fe1087e3
fftools/ffmpeg: Check read() for failure
...
Fixes: CID1591932 Ignoring number of bytes read
Sponsored-by: Sovereign Tech Fund
Reviewed-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 34fd247c3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:52 +01:00
Michael Niedermayer
dd47be8438
swscale/output: Avoid undefined overflow in yuv2rgb_write_full()
...
Fixes: signed integer overflow: -140140 * 16525 cannot be represented in type 'int'
Fixes: 68859/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-4516387130245120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c221c7422f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:52 +01:00
Michael Niedermayer
39d6c6e7f5
swscale/output: alpha can become negative after scaling, use multiply
...
Fixes: left shift of negative value -3245
Fixes: 69047/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-6571511551950848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e6c5b6e86 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:51 +01:00
Michael Niedermayer
69a05f36c3
avcodec/targaenc: Allocate space for the palette
...
Fixes: out of array access
Fixes: 68927/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TARGA_fuzzer-5105665067515904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a7220bd5c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:51 +01:00
Michael Niedermayer
810d68262f
avcodec/r210enc: Use av_rescale for bitrate
...
Fixes: signed integer overflow: 281612954574848 * 65344 cannot be represented in type 'long'
Fixes: 68956/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_R210_fuzzer-6459074458746880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d34d4b6a7c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:51 +01:00
Michael Niedermayer
f6e9c26f2e
avcodec/jfdctint_template: Fewer integer anomalies
...
Fixes: signed integer overflow: 105788 * -20995 cannot be represented in type 'int'
Fixes: signed integer overflow: 923211729 + 2073948236 cannot be represented in type 'int'
Fixes: signed integer overflow: 1281179284 + 2073948236 cannot be represented in type 'int'
Fixes: 68975/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PRORES_fuzzer-6266769177116672
Fixes: 68997/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PRORES_KS_fuzzer-6284237161431040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 228f255b5d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:50 +01:00
Michael Niedermayer
4a2cf66d5c
avcodec/snowenc: MV limits due to mv_penalty table size
...
Fixes: out of array read
Fixes: 69673/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5476592894148608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a9292aff3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:50 +01:00
Michael Niedermayer
1bbc0359c4
MAINTAINERS: Update the entries for the release maintainer for FFmpeg
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 97ecfb5a19 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:50 +01:00
Lynne
07154aa7fe
configure: update copyright year
...
(cherry picked from commit b95ee2ec5f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:49 +01:00
Michael Niedermayer
4402b85c66
avfilter/vf_rotate: Check ff_draw_init2() return value
...
Fixes: NULL pointer dereference
Fixes: 3_343
Found-by: De3mond
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c9f095e30 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:49 +01:00
Michael Niedermayer
047d7dca52
avformat/img2dec: Move DQT after unrelated if()
...
Fixes: CID1494636 Missing break in switch
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d04c6016b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:49 +01:00
Michael Niedermayer
296d2e6f3c
fftools/cmdutils: Add protective () to FLAGS
...
issue found while reviewing CID1452612 Free of array-typed value
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d9b9fc4be2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:48 +01:00
Michael Niedermayer
9722437217
avformat/sdp: Check before appending ","
...
Found by reviewing code related to CID1500301 String not null terminated
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5b82852519 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:48 +01:00
Michael Niedermayer
fb978f6ee4
avcodec/vp8: Check cond init
...
Fixes: CID1598563 Unchecked return value
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9b76e49061 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:48 +01:00
Michael Niedermayer
1bffffad5b
avcodec/vp8: Check mutex init
...
Fixes: CID1598556 Unchecked return value
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4ac7405aaf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:47 +01:00
Michael Niedermayer
afad059c7b
avcodec/tests/dct: Use 64bit in intermediate for error computation
...
Fixes: CID1500284 Unintentional integer overflow
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 161d0aa2a8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:47 +01:00
Michael Niedermayer
3f9d4fab41
avcodec/wavpackenc: Use unsigned for potential 31bit shift
...
Fixes: CID1465481 Unintentional integer overflow
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6f976db251 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:47 +01:00
Michael Niedermayer
9cdea8e1b7
avcodec/tests/jpeg2000dwt: Use 64bit in comparission
...
Found while reviewing: CID1500309 Unintentional integer overflow
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 12391b732f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:46 +01:00
Michael Niedermayer
8359c315c0
avcodec/tests/jpeg2000dwt: Use 64bit in err2 computation
...
This issue cannot happen with the current function parameters
Fixes: CID1500309 Unintentional integer overflow
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 847a53f264 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:46 +01:00
Michael Niedermayer
3b5e8468fe
avformat/ape: Use 64bit for final frame size
...
Fixes: CID1505963 Unintentional integer overflow
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a2b8d03347 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:46 +01:00
Michael Niedermayer
b68c97fd87
swscale/yuv2rgb: Use 64bit for brightness computation
...
This will not overflow for normal values
Fixes: CID1500280 Unintentional integer overflow
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bfc22f364d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:45 +01:00
Michael Niedermayer
ec14490da3
avutil/tests/opt: Check av_set_options_string() for failure
...
This is test code after all so it should test things
Fixes: CID1518990 Unchecked return value
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e3481730ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:45 +01:00
Michael Niedermayer
aac5ed8cf7
avutil/tests/dict: Check av_dict_set() before get for failure
...
Failure is possible due to strdup()
Fixes: CID1516764 Dereference null return value
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e8a1e1899d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:45 +01:00
Michael Niedermayer
d99388d6c3
avdevice/dshow: fix badly indented line
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4004605b2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:44 +01:00
Michael Niedermayer
9f7302dd94
avcodec/mpegvideo_enc: Fix potential overflow in RD
...
Fixes: CID1500285 Unintentional integer overflow
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b6b2b01025 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:44 +01:00
Michael Niedermayer
078ea6ad6c
avcodec/mpeg4videodec: assert impossible wrap points
...
Helps: CID1473517 Uninitialized scalar variable
Helps: CID1473497 Uninitialized scalar variable
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8fc649b931 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:44 +01:00
Michael Niedermayer
7be3a9dbda
avcodec/vble: Check av_image_get_buffer_size() for failure
...
Fixes: CID1461482 Improper use of negative value
Sponsored-by: Sovereign Tech Fund
Reviewed-.by: "Xiang, Haihao" <haihao.xiang@intel.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dd5379db5d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:43 +01:00
Michael Niedermayer
57ecf48db3
avcodec/jpeg2000dec: remove ST=3 case
...
Fixes: CID1460979 Logically dead code
Sponsored-by: Sovereign Tech Fund
Reviewed-by: Tomas Härdin <git@haerdin.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4ed4f9a6c0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:43 +01:00
Michael Niedermayer
230ffd7bfe
avcodec/fmvc: remove dead assignment
...
Fixes: CID1529220 Unused value
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 96c1162545 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:42 +01:00
Michael Niedermayer
6a2ad69370
avcodec/lpc: copy levenson coeffs only when they have been computed
...
Fixes: CID1473514 Uninitialized scalar variable
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c2d897f356 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:42 +01:00
Michael Niedermayer
c435cd2d99
avutil/tests/base64: Check with too short output array
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c304784a86 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:42 +01:00
Michael Niedermayer
a31b19aec5
libavutil/base64: Try not to write over the array end
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d216566f2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:41 +01:00
Michael Niedermayer
f119b562d2
avcodec/mpegvideo_enc: Fix 1 line and one column images
...
Fixes: Ticket10952
Fixes: poc21ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 96449cfeae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:41 +01:00
Michael Niedermayer
56282bd3c3
swscale/output: Fix integer overflow in yuv2rgba64_full_1_c_template()
...
Fixes: signed integer overflow: -1082982400 + -1079364728 cannot be represented in type 'int'
Fixes: 67910/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5329011971522560
The input is 9bit in 16bit, the fuzzer fills all 16bit thus generating "invalid" input
No overflow should happen with valid input.
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1330a73cca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:41 +01:00
Michael Niedermayer
1c0b87d263
swscale/output: Fix integer overflow in yuv2rgba64_1_c_template
...
Fixes: signed integer overflow: -831176 * 9539 cannot be represented in type 'int'
Fixes: 67869/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5117342091640832
The input is 9bit in 16bit, the fuzzer fills all 16bit thus generating "invalid" input
No overflow should happen with valid input.
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a56559e688 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:40 +01:00
Michael Niedermayer
5ad66bb28a
avcodec/hevcdec: Check ref frame
...
Fixes: NULL pointer dereferences
Fixes: 68197/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6382538823106560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5eb05f4450 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:40 +01:00
Michael Niedermayer
de74a4e269
avfilter/signature_lookup: Dont copy uninitialized stuff around
...
Fixes: CID1403238 Uninitialized pointer read
Fixes: CID1403239 Uninitialized pointer read
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e7174e66ac )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:40 +01:00
Michael Niedermayer
46d12dce13
avfilter/signature_lookup: Fix 2 differences to the refernce SW
...
Fixes: CID1403227 Division or modulo by float zero
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 25cb66369e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2025-03-11 19:47:39 +01:00
Martin Storsjö
4767a711c1
ffbuild: Avoid using the --preprocessor argument to windres
...
Instead use --preprocessor-arg; in binutils 2.36, the --preprocessor
flag was changed so that it no longer accepts a string containing
multiple arguments, but the whole --preprocessor argument is
treated as the path to the preprocessor executable (where the path
can contain spaces).
It's currently unclear whether this behaviour will stay or if it
is going to be reverted in the future, see discussion at [1]. Just
to be safe, avoid using the --preprocessor argument. Don't redeclare
the full preprocessing command, but just add the $(CC_DEPFLAGS) options.
Based on a patch by Kyle Schwartz.
[1] https://sourceware.org/bugzilla/show_bug.cgi?id=27594
Signed-off-by: Martin Storsjö <martin@martin.st >
2025-02-27 09:02:21 -05:00
Janne Grunau
970ca1e0f2
vp9: recon: Use emulated edge to prevent buffer overflows
...
The arm/aarch64 horizontal filter reads one additional pixel beyond what
the filter uses. This can become an issue if the application does not
allocate larger buffers than what's required for the pixel data. If the
motion vector points to the bottom right edge of the picture this
becomes a read buffer overflow. This triggers segfaults in Firefox for
video resolutions which result in a page aligned picture size like
1280x640.
Prevent this by using emulated edge in this case.
Fixes: https://bugzilla.mozilla.org/show_bug.cgi?id=1881185
Signed-off-by: Janne Grunau <janne-ffmpeg@jannau.net >
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com >
(cherry picked from commit 060464105b )
2025-01-04 07:28:47 -05:00
Janne Grunau
80ef3328b5
arm: vp9mc: Load only 12 pixels in the 4 pixel wide horizontal filter
...
This reduces the amount the horizontal filters read beyond the filter
width to a consistent 1 pixel. The data is not used so this is usually
not noticeable. It becomes a problem when the application allocates
frame buffers only for the aligned picture size and the end of it is at
a page boundary. This happens for picture sizes which are a multiple of
the page size like 1280x640. The frame buffer allocation is based on
its most likely done via mmap + MAP_ANONYMOUS so start and end of the
buffer are page aligned and the previous and next page are not
necessarily mapped.
This mirrors the aarch64 change.
Signed-off-by: Janne Grunau <janne-ffmpeg@jannau.net >
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com >
(cherry picked from commit f366256215 )
2025-01-04 07:28:47 -05:00
Janne Grunau
180f8216cd
aarch64: vp9mc: Load only 12 pixels in the 4 pixel wide horizontal filter
...
This reduces the amount the horizontal filters read beyond the filter
width to a consistent 1 pixel. The data is not used so this is usually
not noticeable. It becomes a problem when the application allocates
frame buffers only for the aligned picture size and the end of it is at
a page boundary. This happens for picture sizes which are a multiple of
the page size like 1280x640. The frame buffer allocation is based on
its most likely done via mmap + MAP_ANONYMOUS so start and end of the
buffer are page aligned and the previous and next page are not
necessarily mapped.
Under these conditions like seen by Firefox a read beyond the end of the
buffer results in a segfault.
After the over-read is reduced to a single pixel it's reasonable to use
VP9's emulated edge motion compensation for this.
Fixes: https://bugzilla.mozilla.org/show_bug.cgi?id=1881185
Signed-off-by: Janne Grunau <janne-ffmpeg@jannau.net >
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com >
(cherry picked from commit 430c38f698 )
2025-01-04 07:28:47 -05:00
Andreas Rheinhardt
b6dbfbc789
fate/subtitles: Ignore line endings for sub-scc test
...
Since 7bf1b9b357 ,
the test produces ordinary \n, yet this is not what the reference
file used for the most time, leading to test failures.
Reviewed-by: Martin Storsjö <martin@martin.st >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com >
(cherry picked from commit 99d33cc661 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-04-14 03:25:15 +02:00
Michael Niedermayer
184322d378
avformat/mxfdec: Check index_edit_rate
...
Fixes: Assertion b >=0 failed at libavutil/mathematics.c:62
Fixes: 67811/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5108429687422976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ed49391961 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-04-04 21:10:50 +02:00
Michael Niedermayer
56434954c4
swscale/utils: Fix xInc overflow
...
Fixes: signed integer overflow: 2 * 1073741824 cannot be represented in type 'int'
Fixes: 67802/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-6249515855183872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1a9eda65d0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-04-04 21:09:53 +02:00
Michael Niedermayer
db0f173b3e
avformat/mxfdec: Make edit_unit_byte_count unsigned
...
Suggested-by: Marton Balint <cus@passwd.hu >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f30fe5e8d0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-04-03 01:57:21 +02:00
Michael Niedermayer
bfd0d09637
avformat/movenc: Check that cts fits in 32bit
...
Fixes: Assertion av_rescale_rnd(start_dts, mov->movie_timescale, track->timescale, AV_ROUND_DOWN) <= 0 failed at libavformat/movenc.c:3694
Fixes: poc2
Found-by: Wang Dawei and Zhou Geng, from Zhongguancun Laboratory
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d88c284c18 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-04-03 01:45:59 +02:00
Michael Niedermayer
622e11ce11
avformat/mxfdec: Check first case of offset_temp computation for overflow
...
This is kind of ugly
Fixes: signed integer overflow: 255 * 1157565362826411919 cannot be represented in type 'long'
Fixes: 67313/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6250434245230592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d6ed6f6e8d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-04-03 01:40:25 +02:00
Michael Niedermayer
ea2a7937ce
avfilter/vf_signature: Dont crash on no frames
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d5f03bbc8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-04-03 01:33:39 +02:00
Michael Niedermayer
f91d171d29
avformat/westwood_vqa: Fix 2g packets
...
Fixes: signed integer overflow: 2147483424 * 2 cannot be represented in type 'int'
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_WSVQA_fuzzer-4576211411795968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 86f73277bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-04-03 01:21:44 +02:00
Michael Niedermayer
318ab4d2e2
avformat/matroskadec: Check timescale
...
Fixes: 3.82046e+18 is outside the range of representable values of type 'unsigned int'
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6381436594421760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e849eb2343 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-04-03 01:20:36 +02:00
Michael Niedermayer
569eb2f655
avformat/sbgdec: Check for negative duration
...
Fixes: signed integer overflow: 9223372036854775807 - -8000000 cannot be represented in type 'long'
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-5133181743136768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0bed22d597 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-04-03 01:05:11 +02:00
Michael Niedermayer
73e2d87b92
avformat/rpl: Use 64bit for total_audio_size and check it
...
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-4677434693517312
Fixes: signed integer overflow: 5555555555555555556 * 8 cannot be represented in type 'long long'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 878625812f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-04-03 01:03:24 +02:00
Michael Niedermayer
ec9fecaa90
avformat/timecode: use 64bit for intermediate for rounding in fps_from_frame_rate()
...
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4802790784303104
Fixes: signed integer overflow: 1768972133 + 968491058 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d8d778a68 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-04-03 01:02:22 +02:00
Michael Niedermayer
b1374b8bd2
avcodec/truemotion1: Height not being a multiple of 4 is unsupported
...
mb_change_bits is given space based on height >> 2, while more data is read
Fixes: out of array access
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION1_fuzzer-5201925062590464.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ebdcf98499 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-04-03 00:58:59 +02:00
Michael Niedermayer
037cfbe417
avformat/cafdec: Check that data chunk end fits within 64bit
...
Fixes: signed integer overflow: 64 + 9223372036854775803 cannot be represented in type 'long long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6536881135550464
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6536881135550464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b792e4d4c7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-03-26 20:15:50 +01:00
Michael Niedermayer
fd02b195bf
avformat/dxa: Adjust order of operations around block align
...
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-5730576523198464
Fixes: signed integer overflow: 2147483566 + 82 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 50d8e4f273 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-03-26 20:14:58 +01:00
Michael Niedermayer
2eb0e9d168
avformat/cafdec: dont seek beyond 64bit
...
Fixes: signed integer overflow: 64 + 9223372036854775807 cannot be represented in type 'long long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6418242730328064
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6418242730328064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d973fcbcc2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-03-26 20:13:49 +01:00
Michael Niedermayer
dccb2d95ec
avformat/id3v2: read_uslt() check for the amount read
...
Fixes: timeout
Fixes: 66783/clusterfuzz-testcase-minimized-ffmpeg_dem_GENH_fuzzer-5356884892647424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c0f4abe2aa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-03-26 20:11:38 +01:00
Michael Niedermayer
6d4e1d6913
avcodec/proresenc_kostya: Remove bug similarity text
...
According to kostya, it is not based on Wassermans encoder
CC: Kostya Shishkov <kostya.shishkov@gmail.com >
CC: Anatoliy Wasserman <anatoliy.wasserman@yandex.ru >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e0e30e07a1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-03-26 20:09:04 +01:00
Michael Niedermayer
8ff0d307b8
avcodec/vorbisdec: Check remaining data in vorbis_residue_decode_internal()
...
Fixes: timeout
Fixes: 66326/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-6295291863040000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dc89cf804a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-03-26 20:07:45 +01:00
Michael Niedermayer
8bc8b35a37
libswscale/utils: Fix bayer to yuvj
...
Fixes: out of array access.
Earlier code assumes that a unscaled bayer to yuvj420 converter exists
but the later code then skips yuvj420
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e9cc9e492f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-03-26 19:54:04 +01:00
Michael Niedermayer
8b79265d2d
swscale/swscale: Check srcSliceH for bayer
...
Fixes: Assertion srcSliceH > 1 failed at libswscale/swscale_unscaled.c:1359
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 64098d0cd8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-03-26 18:52:17 +01:00
Michael Niedermayer
0898209a48
swscale/utils: Allocate more dithererror
...
Fixes: out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 18f26f8a2f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-03-26 18:46:37 +01:00
Michael Niedermayer
0977cf003d
avcodec/indeo3: Round dimensions up in allocate_frame_buffers()
...
Fixes: Ticket6581
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3be80ce299 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-03-26 18:33:53 +01:00
Michael Niedermayer
c3cbefbdff
avutil/rational: Document what is to be expected from av_d2q() of doubles representing rational numbers
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f465badb06 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-03-26 04:23:05 +01:00
Michael Niedermayer
c81cf184c5
avfilter/signature_lookup: Do not dereference NULL pointers after malloc failure
...
Fixes: CID 1403229 Dereference after null check
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 98ae1ad7cf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-03-26 04:20:16 +01:00
Michael Niedermayer
7ea72140a5
avfilter/signature_lookup: dont leave uncleared pointers in sll_free()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6c50482951 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-03-26 04:19:19 +01:00
Michael Niedermayer
51c1485abe
avcodec/mpegvideo_enc: Use ptrdiff_t for stride
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e063c1d079 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2024-03-26 04:16:30 +01:00
Michael Niedermayer
c47825e94f
avcodec/mpegvideo_enc: Dont copy beyond the image
...
Fixes: out of array access
Fixes: tickets/10754/poc17ffmpeg
Discovered by Zeng Yunxiang.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a066b8a809 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-12-30 22:15:28 +01:00
Michael Niedermayer
fd3f7522a2
avfilter/vf_minterpolate: Check pts before division
...
Fixes: FPE
Fixes: tickets/10758/poc20ffmpeg
Discovered by Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 68146f06f8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-12-30 21:59:35 +01:00
Michael Niedermayer
2c30c938f9
avformat/flacdec: Avoid double AVERRORS
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 029294ff54 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-12-29 23:10:19 +01:00
Michael Niedermayer
0b8a2e6c0c
avfilter/vf_vidstabdetect: Avoid double AVERRORS
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bb04235d72 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-12-29 23:09:12 +01:00
Michael Niedermayer
1b8ef074c1
avfilter/vf_swaprect: round coordinates down
...
Fixes: out of array access:
Fixes: tickets/10745/poc12ffmpeg
Found-by: Li Zeyuan and Zeng Yunxiang.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7deaca71b3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-12-29 23:07:17 +01:00
Michael Niedermayer
6c8b1116a8
avfilter/vf_swaprect: Use height for vertical variables
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9f4c5bd7d2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-12-29 23:05:29 +01:00
Michael Niedermayer
a01849d11e
avfilter/vf_swaprect: assert that rectangles are within memory
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d1ba698d2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-12-29 23:03:41 +01:00
Michael Niedermayer
4d4c58c0f8
avfilter/af_alimiter: Check nextpos before use
...
Fixes: out of array read
Fixes: tickets/10744/poc11ffmpeg
Found-by: Li Zeyuan and Zeng Yunxiang.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a88b06f9ee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-12-29 23:02:37 +01:00
Michael Niedermayer
4a8ced17d0
avfilter/af_stereowiden: Check length
...
Fixes: out of array access
Fixes: tickets/10746/poc13ffmpeg
Found-by: Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 50f0f8c53c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-12-29 22:49:26 +01:00
Michael Niedermayer
6750d82cba
avfilter/vf_gradfun: Do not overread last line
...
The code works in steps of 2 lines and lacks support for odd height
Implementing odd height support is better but for now this fixes the
out of array access
Fixes: out of array access
Fixes: tickets/10702/poc6ffmpe
Found-by: Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e4d2666bdc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-12-29 02:37:08 +01:00
Michael Niedermayer
70c1aaf5ee
avformat/mov: do not set sign bit for chunk_offsets
...
Fixes: signed integer overflow: 2314885530818453536 - -7412889664301817824 cannot be represented in type 'long'
Fixes: 64296/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6304027146846208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cfc0a68d4d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-12-29 02:29:39 +01:00
Michael Niedermayer
996d282430
avcodec/jpeglsdec: Check Jpeg-LS LSE
...
Fixes: signed integer overflow: 2147478526 + 33924 cannot be represented in type 'int'
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 64243/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-5195717848989696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c72a20f01a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-12-29 02:26:28 +01:00
Brad Smith
13342df7af
configure: Enable section_data_rel_ro for FreeBSD and NetBSD aarch64 / arm
...
Fixes the build. It's a requirement when utilizing PIE.
Signed-off-by: Brad Smith <brad@comstyle.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6066c430e3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-12-26 00:18:49 +01:00
Michael Niedermayer
a823657ee0
avformat/mov: Ignore duplicate ftyp
...
Fixes: switch_1080p_720p.mp4
Found-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4cdf2c7f76 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-12-15 00:21:32 +01:00
Martin Storsjö
01a8c87e15
seek: Fix crashes in ff_seek_frame_binary if built with latest Clang 14
...
Passing an uninitialized variable as argument to a function is
undefined behaviour (UB). The compiler can assume that UB does not
happen.
Hence, the compiler can assume that the variables are never
uninitialized when passed as argument, which means that the codepaths
that initializes them must be taken.
In ff_seek_frame_binary, this means that the compiler can assume
that the codepaths that initialize pos_min and pos_max are taken,
which means that the conditions "if (sti->index_entries)" and
"if (index >= 0)" can be optimized out.
Current Clang git versions (upcoming Clang 14) enabled an optimization
that does this, which broke the current version of this function
(which intentionally left the variables uninitialized, but silencing
warnings about being uninitialized). See [1] for discussion on
the matter.
[1] https://reviews.llvm.org/D105169#3069555
Signed-off-by: Martin Storsjö <martin@martin.st >
(cherry picked from commit ab79263419 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-11-16 23:52:27 +01:00
Michael Niedermayer
cbc25c8cc8
avcodec/4xm: Check for cfrm exhaustion
...
Fixes: index -1 out of bounds for type 'CFrameBuffer [100]'
Fixes: 63877/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5854263397711872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bb0a684d93 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-11-10 00:25:46 +01:00
Michael Niedermayer
26e74a7fa0
avformat/mov: Disallow FTYP after streams
...
Fixes: Assertion !c->fc->nb_streams failed at libavformat/mov.c:7799
Fixes: 63875/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5479178702815232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 19fcf43131 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-11-10 00:24:26 +01:00
Frank Plowman
aaea9be22e
doc/html: fix styling issue with Texinfo 7.0
...
Texinfo 7.0 produces quite different HTML to Texinfo 6.8. Without
this change, enumerated option flags (i.e. Possible values of x
are...) render as white text on a white background with Texinfo 7.0
and are unreadable. This change removes a style for the selector
`.table .table` which causes the background to turn white for these
elements. As far as I can tell, it is not actually used anywhere in
files generated by Texinfo 6.8.
Signed-off-by: Frank Plowman <post@frankplowman.com >
(cherry picked from commit f16900bda2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-11-09 00:22:42 +01:00
Frank Plowman
4f52743f3a
doc/html: support texinfo 7.0
...
Resolves trac ticket #10636 (http://trac.ffmpeg.org/ticket/10636 ).
Texinfo 7.0, released in November 2022, changed the names of various
functions. Compiling docs with Texinfo 7.0 resulted in warnings and
improperly formatted documentation. More old names appear to have
been removed in Texinfo 7.1, released October 2023, which causes docs
compilation to fail.
This commit addresses the issue by adding logic to switch between the old
and new function names depending on the Texinfo version. Texinfo 6.8
produces identical documentation before and after the patch.
CC
https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1938238.html
https://bugs.gentoo.org/916104
Signed-off-by: Frank Plowman <post@frankplowman.com >
(cherry picked from commit f01fdedb69 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-11-09 00:21:23 +01:00
Matthew White
fef23b8c23
doc/t2h.pm: fix missing TOC with texinfo 6.8 and above
...
Since texinfo 6.8, there's no longer an INLINE_CONTENTS variable.
makeinfo: warning: set_from_init_file: unknown variable INLINE_CONTENTS
texinfo commit 62a6adfb33b006e187483779974bbd45f0f782b1 replaced
INLINE_CONTENTS with OUTPUT_CONTENTS_LOCATION.
texinfo commit 41f8ed4eb42bf6daa7df7007afd946875597452d replaced
OUTPUT_CONTENTS_LOCATION with CONTENTS_OUTPUT_LOCATION.
With texinfo 6.8 and above, the same as INLINE_CONTENTS=1 could be
achieved by CONTENTS_OUTPUT_LOCATION=inline.
https://www.gnu.org/software/texinfo/manual/texinfo/html_node/HTML-Customization-Variables.html
(cherry picked from commit bfbd5954e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-11-09 00:21:22 +01:00
Matthew White
9cc9301da7
doc/t2h.pm: fix missing CSS with texinfo 6.8 and above
...
Since texinfo commit 6a5ceab6a48a4f052baad9f3474d741428409fd7, the
formatting functions, in particular begin_file, program_string and
end_file, are prefixed with format_, i.e. format_begin_file, etc.
This patch fixes building the documentation when texinfo 6.8, or
above, is used:
Unknown formatting type begin_file
at /usr/bin/makeinfo line 415.
Unknown formatting type program_string
at /usr/bin/makeinfo line 415.
Unknown formatting type end_file
at /usr/bin/makeinfo line 415.
(cherry picked from commit c980dd7a97 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-11-09 00:21:22 +01:00
Andreas Rheinhardt
a65faea34e
avformat/matroskadec: Fix declaration-after-statement warnings
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com >
(cherry picked from commit 37b5f4a1f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-29 01:24:31 +02:00
Michael Niedermayer
7b3534186a
avformat/rtsp: Use rtsp_st->stream_index
...
Fixes: out of array access
Fixes: rtpdec_h264.c149/poc
Found-by: Hardik Shah of Vehere
Reviewed-by: Martin Storsjö <martin@martin.st >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e4d5ac8d7d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-28 20:19:03 +02:00
Michael Niedermayer
af0b7d9a1a
avcodec/jpeg2000dec: Check image offset
...
Fixes: left shift of negative value -538967841
Fixes: 62447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-6427134337613824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <git@haerdin.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 88453250db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-28 20:19:03 +02:00
Michael Niedermayer
a31de889ea
avcodec/h2645_parse: Avoid EAGAIN
...
EAGAIN causes an assertion failure when it is returned from the decoder
Fixes: Assertion consumed != (-(11)) failed at libavcodec/decode.c:462
Fixes: assertion_IOT_instruction_decode_c_462/poc
Found-by: Hardik Shah of Vehere (Dawn Treaders team)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5ddab49d48 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-28 20:19:03 +02:00
Michael Niedermayer
355d7cd130
avcodec/xvididct: Make c* unsigned to avoid undefined overflows
...
Fixes: signed integer overflow: 1496950099 + 728014168 cannot be represented in type 'int'
Fixes: 62667/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEGB_fuzzer-6511785170305024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f7e5537dc1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-28 20:19:03 +02:00
Michael Niedermayer
1de06f992e
avformat/tmv: Check video chunk size
...
This check matches the audio chunk check
Fixes: Timeout
Fixes: 62681/clusterfuzz-testcase-minimized-ffmpeg_dem_TMV_fuzzer-5299107876700160
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b79fc70596 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-28 20:19:03 +02:00
Michael Niedermayer
283e077dc6
avformat/xwma: sanity check bits_per_coded_sample
...
Fixes: signed integer overflow: 65312 * 524296 cannot be represented in type 'int'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_XWMA_fuzzer-6595971445555200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fe6ce28d11 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-28 20:19:03 +02:00
Michael Niedermayer
d74868664f
avformat/matroskadec: Check prebuffered_ns for overflow
...
Fixes: signed integer overflow: 9223372036630775808 + 1000000000 cannot be represented in type 'long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-5406131992526848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d6df3719d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-28 20:19:03 +02:00
Michael Niedermayer
1f5bc3b37b
avformat/wavdec: Check left avio_tell for overflow
...
Fixes: signed integer overflow: 155 + 9223372036854775655 cannot be represented in type 'long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5364032278495232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 929ddef3f4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-28 20:19:03 +02:00
Michael Niedermayer
9ee8383f8e
avformat/tta: Better totalframes check
...
Fixes: signed integer overflow: 4 * 740491135 cannot be represented in type 'int'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_TTA_fuzzer-6298893367508992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f0d00464a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-28 20:19:03 +02:00
Michael Niedermayer
1fb0738053
avformat/rpl: Check for number_of_chunks overflow
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int32_t' (aka 'int')
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-6086131095830528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b3c973acbe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-28 20:19:03 +02:00
Michael Niedermayer
9d73eb002f
avformat/mov: compute absolute dts difference without overflow in mov_find_next_sample()
...
Fixes: signed integer overflow: -9223372036854775808 - 9222726413022000000 cannot be represented in type 'long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5959420033761280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3508b496e1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-28 20:19:03 +02:00
Michael Niedermayer
effb46dfb0
avformat/jacosubdec: Check timeres
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 51f0ab8b12 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-28 20:19:03 +02:00
Michael Niedermayer
9dccc34ce2
avcodec/escape124: Do not return random numbers
...
Fixes: out of array access
Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-6035022714634240
Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-6422176201572352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fe6d46490f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-28 20:19:03 +02:00
Michael Niedermayer
557617b129
avformat/avs: Check if return code is representable
...
Fixes: leak
Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS_fuzzer-6738814988320768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 52d666edec )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-28 20:19:03 +02:00
Michael Niedermayer
ee9ff31dc6
avcodec/lcldec: Make PNG filter addressing match the code afterwards
...
Also update check accordingly
Fixes: tickets/10237/mszh_306_306_yuv422_nocompress.avi
Fixes: tickets/10237/mszh_306_306_yuv411_nocompress.avi
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d11b8bd0c6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-19 12:16:49 +02:00
Michael Niedermayer
56b0ad3ad1
avformat/westwood_vqa: Check chunk size
...
the type is also changed to int as it is interpreted as int in av_get_packet()
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_WSVQA_fuzzer-6593408795279360
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_WSVQA_fuzzer-4613908817903616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c0df3da0b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-19 12:15:03 +02:00
Michael Niedermayer
48c506ddb4
avformat/sbgdec: Check for period overflow
...
Fixes: signed integer overflow: 4481246996173000000 - -4778576820000000000 cannot be represented in type 'long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-5063670588899328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a9137110ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-19 12:10:18 +02:00
Michael Niedermayer
523a7ddc9f
avcodec/xvididct: Fix integer overflow in idct_row()
...
Fixes: signed integer overflow: 1871429831 + 343006811 cannot be represented in type 'int'
Fixes: 61784/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AIC_fuzzer-5372151001120768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b12444fe72 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-18 18:52:31 +02:00
Michael Niedermayer
60e4708729
avcodec/celp_math: avoid overflow in shift
...
by making gain unsigned we have 1 bit more available
alternatively we can clip twice as in the g729 reference
Fixes: left shift of 23404 by 17 places cannot be represented in type 'int'
Fixes: 61728/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-6280412547383296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6580a7b2b2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-18 18:51:40 +02:00
Michael Niedermayer
aef6e2a7ca
avformat/format: Stop reading data at EOF during probing
...
Issue found by: Сергей Колесников
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 80f6e0378b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-18 18:44:08 +02:00
Michael Niedermayer
ebea366ea9
avcodec/huffyuvdec: avoid undefined behavior with get_vlc2() failure
...
Fixes: left shift of negative value -1
Fixes: 59889/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HUFFYUV_fuzzer-5472742275940352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 90647a9249 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-18 18:40:47 +02:00
Michael Niedermayer
83a6af7f1a
avcodec/hevcdec: Fix undefined memcpy()
...
There is likely a better way to fix this, this is mainly to show the problem
Fixes: MC within same frame resulting in overlapping memcpy()
Fixes: 60189/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4992746590175232
Fixes: 61753/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5022150806077440
Fixes: 58062/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4717458841010176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 94bd1796ff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-18 18:35:32 +02:00
Michael Niedermayer
1c9ae4ada6
avcodec/mpeg4videodec: more unsigned in amv computation
...
Fixes: signed integer overflow: -2147483648 + -1048576 cannot be represented in type 'int'
Fixes: 59365/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-642654923954585
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0adaa90d89 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-18 18:34:33 +02:00
Michael Niedermayer
5e57f3c8de
avcodec/tta: fix signed overflow in decorrelate
...
Fixes: signed integer overflow: 2079654542 - -139267653 cannot be represented in type 'int'
Fixes: 60811/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5915858409750528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 283bf5c35b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-18 18:33:15 +02:00
Michael Niedermayer
c123a4dd0c
avcodec/xvididct: Fix integer overflow in idct_row()
...
Fixes: signed integer overflow: -1403461578 + -843974775 cannot be represented in type 'int'
Fixes: 60868/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-4599793035378688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ce322a51e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-18 18:25:41 +02:00
Michael Niedermayer
717b15de1d
avformat/avr: Check sample rate
...
Fixes: 54979/clusterfuzz-testcase-minimized-ffmpeg_dem_AVR_fuzzer-6681035461230592
Fixes: Timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 32556fa62b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-18 18:23:49 +02:00
Michael Niedermayer
f2937fde73
avcodec/jpeg2000dec: Check for reduction factor and image offset
...
This combination is not working (it writes out of array)
Reviewed-by: Tomas Härdin <git@haerdin.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9b6d191a66 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-18 11:32:27 +02:00
Michael Niedermayer
d4fcb508d1
avutil/softfloat: Basic documentation for av_sincos_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4aa1a42a91 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-18 11:31:35 +02:00
Michael Niedermayer
f7f742a519
avutil/softfloat: fix av_sincos_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d84677abd8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-18 11:30:45 +02:00
Michael Niedermayer
9c7334b053
avcodec/utils: fix 2 integer overflows in get_audio_frame_duration()
...
Fixes: signed integer overflow: 256 * 668003712 cannot be represented in type 'int'
Fixes: 59819/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-4674636538052608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a4bf559683 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-18 11:28:13 +02:00
Michael Niedermayer
781fdc6964
avcodec/hevcdec: Avoid null pointer dereferences in MC
...
Fixes: runtime error: pointer index expression with base 0x000000000000 overflowed to 0xfffffffffffffff8
Fixes: 58440/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5956015530311680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a0f4d4e650 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-18 11:22:54 +02:00
Michael Niedermayer
4e6b5097f2
avcodec/takdsp: Fix integer overflows
...
Fixes: avcodec/takdsp.c:44:23: runtime error: signed integer overflow: -2097158 - 2147012608 cannot be represented in type 'int'
Fixes: 58417/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5268919664640000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ff8a496d41 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-18 11:21:58 +02:00
Michael Niedermayer
7167952f0e
avcodec: Ignoring errors is only possible before the input end
...
Fixes: out of array read
Fixes: Ticket 10308
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fead656a7b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-10-18 11:08:00 +02:00
Michael Niedermayer
c721020755
Changelog: update
2023-06-10 22:49:06 +02:00
Michael Niedermayer
7b4662fae5
avcodec/noise_bsf: Check for wrapped frames
...
Wrapped frames contain pointers so they need specific code to
noise them, the generic code would lead to segfaults
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0889ebc577 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-07 01:35:38 +02:00
Michael Niedermayer
5a797e7c23
Update for 3.4.13
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:26:33 +02:00
Michael Niedermayer
30cdacf8c2
avcodec/pngdec: Do not pass AVFrame into global header decode
...
The global header should not contain a frame, and decoding it
would result in leaks
Fixes: memleak
Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-6603443149340672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d31d4f3228 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:24:48 +02:00
Michael Niedermayer
b79b50a308
avformat/wavdec: Check that smv block fits in available space
...
Fixes: OOM
Fixes: 56271/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-5290810045497344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a76efafdb9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:24:43 +02:00
Michael Niedermayer
77d1ae5d94
avcodec/tak: Check remaining bits in ff_tak_decode_frame_header()
...
Fixes: out of array access
Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-6682195323650048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 19b66b89da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:24:43 +02:00
Michael Niedermayer
40f962e569
avcodec/utils: the IFF_ILBM implementation assumes that there are a multiple of 16 allocated
...
Fixes: out of array access
Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5124452659888128
Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-6362836707442688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 34056a94ea )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:24:43 +02:00
Michael Niedermayer
0b003c0828
avcodec/vorbisdec: Check codebook float values to be finite
...
Fixes: Timeout
Fixes: 55116/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-4572159970508800
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cadd7e7a75 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:24 +02:00
Michael Niedermayer
99bab6e961
avcodec/g2meet: Replace fake allocation avoidance for framebuf
...
framebuf is only allocated when the new width/height are larger than the old
but nothing sets the old so its always allocated.
Use av_fast_mallocz() instead.
Fixes: Timeout
Fixes: 55094/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5116909932904448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38adbc6eeb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:24 +02:00
Michael Niedermayer
dc530f258c
avcodec/lcldec: More space for rgb24
...
Fixes: Ticket 10239
Fixes: zlib_306_306_rgb24.av
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e2c3aa8e2b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:24 +02:00
Michael Niedermayer
09e16d736b
avcodec/lcldec: Support 4:1:1 and 4:2:2 with odd width
...
Fixes: Ticket10240
Fixes: zlib_306_306_yuv422.avi
Fixes: zlib_306_306_yuv411.avi
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0cf1ac905d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:23 +02:00
Michael Niedermayer
9989fd4516
libavcodec/lcldec: width and height should not be unsigned
...
Computations like col < width - 3 will not work with unsigned width=1
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3eb4e28c26 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:23 +02:00
Michael Niedermayer
e7ae341c2a
avcodec/escape124: Check that blocks are allocated before use
...
Fixes: NULL pointer dereference
Fixes: 57819/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-5077280228769792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5366ae12b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:23 +02:00
Michael Niedermayer
8c8821b545
avcodec/huffyuvdec: Fix undefined behavior with shift
...
Fixes: left shift of negative value -1
Fixes: 57554/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFVHUFF_fuzzer-4853603839115264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 27e7857bd1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:22 +02:00
Michael Niedermayer
db29a66295
avcodec/j2kenc: fix 5/3 DWT identifer
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f6955b6df4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:22 +02:00
Michael Niedermayer
e52276f77a
avcodec/vp3: Check width to avoid assertion failure
...
Fixes: Assertion failure on x86-32
av_assert2(block_w * sizeof(pixel) <= FFABS(buf_linesize)); in ff_emulated_edge_mc()
Fixes: 39641/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-5925660741206016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dab1cd2dc0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:22 +02:00
Michael Niedermayer
192353f7c1
avcodec/g729postfilter: Limit shift in long term filter
...
Fixes: shift exponent 34 is too large for 32-bit type 'int'
Fixes: 57389/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-6229522659016704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6d1d8609ac )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:21 +02:00
Lynne
a159bfb3ba
configure: update copyright year
...
(cherry picked from commit 62da0b4a74 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:21 +02:00
Michael Niedermayer
789e189779
avcodec/tests/snowenc: Fix 2nd test
...
(cherry picked from commit 163013c724 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:21 +02:00
Michael Niedermayer
62a0bbfa54
avcodec/tests/snowenc: return a failure if DWT/IDWT mismatches
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 771c266c0b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:20 +02:00
Michael Niedermayer
872c74b3ba
avcodec/snowenc: Fix visual weight calculation
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5b5fcadea0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:20 +02:00
Michael Niedermayer
bf6bff0b75
avcodec/tests/snowenc: unbreak DWT tests
...
the IDWT data type mismatched current code
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b3351bbea )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:20 +02:00
Jiasheng Jiang
5cd450dd7a
avcodec/vp3: Add missing check for av_malloc
...
Since the av_malloc() may fail and return NULL pointer,
it is needed that the 's->edge_emu_buffer' should be checked
whether the new allocation is success.
Fixes: d14723861b ("VP3: fix decoding of videos with stride > 2048")
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn >
(cherry picked from commit 656cb0450a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:19 +02:00
Michael Niedermayer
f8ef4290e3
avcodec/escape124: Fix some return codes
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 98df605f7a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:19 +02:00
Michael Niedermayer
800ba7107e
avcodec/escape124: fix signdness of end of input check
...
Fixes: Timeout
Fixes: 56561/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-5560363635834880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 87ad0a5dd7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:19 +02:00
Michael Niedermayer
03b34a884f
Use https for repository links
...
Reviewed-by: Stefano Sabatini <stefasab@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 011f30fc82 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:18 +02:00
Michael Niedermayer
d85f407e0d
avcodec/motionpixels: Mask pixels to valid values
...
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOTIONPIXELS_fuzzer-6724203352555520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ac6eec1fc2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:18 +02:00
Michael Niedermayer
2ca69aa42d
avcodec/xpmdec: Check size before allocation to avoid truncation
...
Fixes:OOM
Fixes:out of array access (no testcase)
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XPM_fuzzer-6573323838685184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 95f0f84dae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:18 +02:00
Michael Niedermayer
a2da41e03a
avcodec/bink: Avoid undefined out of array end pointers in binkb_decode_plane()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea9deafd3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:17 +02:00
Michael Niedermayer
e152447bb5
avcodec/bink: Fix off by 1 error in ref end
...
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6657932926517248
Alterantivly to this it is possibly to allocate a bigger array
Note: oss-fuzz assigned this issue to a unrelated theora bug so the bug number matches that
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 49487045dd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:17 +02:00
Michael Niedermayer
06fe955608
avcodec/utils: Ensure linesize for SVQ3
...
Fixes: Assertion block_w * sizeof(uint8_t) <= ((buf_linesize) >= 0 ? (buf_linesize) : (-(buf_linesize))
Fixes: 54861/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-5352418248622080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4eef658ca5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:17 +02:00
Michael Niedermayer
331d1d5677
avcodec/utils: allocate a line more for VC1 and WMV3
...
Fixes: out of array read on 32bit
Fixes: 54857/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5840588224462848
The chroma MC code reads over the currently allocated frame.
Alternative fixes would be allocating a few bytes more at the end instead of a whole
line extra or to adjust the threshold where the edge emu code is activated
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 01636a63d4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:16 +02:00
Michael Niedermayer
6047f056af
avcodec/videodsp_template: Adjust pointers to avoid undefined pointer things
...
Fixes: subtraction of unsigned offset from 0xf6602770 overflowed to 0xf6638c80
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-495074400600064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f0150cd41c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:16 +02:00
Michael Niedermayer
3b39e8a3b8
avcodec/pngdec: Check deloco index more exactly
...
Fixes: out of array access:
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PNG_fuzzer-6716193709096960
Alternatively it should be possible to limit this to 3 plane RGB 8 /16bit to ensure the size is what it should be
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d5bae70406 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:16 +02:00
Michael Niedermayer
a928367cba
avcodec/ffv1dec: Check that num h/v slices is supported
...
Fixes: out of array access
Fixes: 55597/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-4898293416329216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ead0ae68e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:15 +02:00
Michael Niedermayer
a919346b63
avformat/mov: Check samplesize and offset to avoid integer overflow
...
Fixes: signed integer overflow: 9223372036854775584 + 536870912 cannot be represented in type 'long'
Fixes: 55844/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-510613920664780
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53c1f5c2e2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:15 +02:00
Michael Niedermayer
07dd5b4d69
avcodec/pictordec: Remove mid exit branch
...
This causes the RLE decoder to exit before applying the last RLE run
All images i tested with are unchanged, this makes the special case
for handling the last run unused for non truncated images.
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 88f0e05c72 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:15 +02:00
Michael Niedermayer
1552773f07
avcodec/eac3dec: avoid float noise in fixed mode addition to overflow
...
Fixes: 2.28595e+09 is outside the range of representable values of type 'int'
Fixes: 54644/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AC3_FIXED_fuzzer-4816961584627712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f48d227c1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:14 +02:00
Michael Niedermayer
d361cdee61
avcodec/utils: use 32pixel alignment for bink
...
bink supports 16x16 blocks in chroma planes thus we need to allocate enough.
Fixes: out of array access
Fixes: 55026/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6013915371012096
Reviewed-by: Peter Ross <pross@xvid.org >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b95b2c8492 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:14 +02:00
Michael Niedermayer
05fd95fe85
avcodec/012v: Order operations for odd size handling
...
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZERO12V_fuzzer-6714182078955520.fuzz
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZERO12V_fuzzer-6698145212137472.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4d42d82563 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:14 +02:00
Michael Niedermayer
0791340377
avcodec/eatgq: : Check index increments in tgq_decode_block()
...
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATGQ_fuzzer-6743211456724992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e7755b433e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:13 +02:00
Michael Niedermayer
879521ecdc
avcodec/scpr: Test bx before use
...
Fixes: out of array access on 32bit
Fixes: 54850/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-5302669294305280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b59de3770 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:13 +02:00
Michael Niedermayer
4f9152af77
avcodec/sunrast: Fix maplength check
...
Fixes: out of bounds read
Found-by: Ibrahim Mohamed <ielsayed@meta.com >
Reviewed-by; Ibrahim Mohamed <ielsayed@meta.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f8a2a65078 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:13 +02:00
Michael Niedermayer
25b434d931
avcodec/wavpack: Avoid undefined shift in get_tail()
...
Fixes: left shift of 1208485947 by 1 places cannot be represented in type 'int'
Fixes: 54058/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5827521084260352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8374a747af )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:12 +02:00
Michael Niedermayer
76d48fbd86
avformat/id3v2: Check taglen in read_uslt()
...
Fixes: Timeout (read mostly the same data repeatly)
Fixes: 52457/clusterfuzz-testcase-minimized-ffmpeg_dem_ALP_fuzzer-6610706313379840
Fixes: 53098/clusterfuzz-testcase-minimized-ffmpeg_dem_SOL_fuzzer-6481382981632000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a798af91d7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:12 +02:00
Michael Niedermayer
e4b0610c6a
avcodec/ffv1dec: restructure slice coordinate reading a bit
...
Fixes: signed integer overflow: -1094995528 * 8224 cannot be represented in type 'int'
Fixes: 53508/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-474551033462784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 74b6ac7ebb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:12 +02:00
Michael Niedermayer
0f09239167
avcodec/mlpdec: Check max matrix instead of max channel in noise check
...
This is a regression since: adaa06581c
Before this, max_channel and max_matrix_channel where compared for equality
Fixes: out of array access
Fixes: 53340/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-514959011885875
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa79560de5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:11 +02:00
Michael Niedermayer
832cb64af2
swscale/input: Use more unsigned intermediates
...
Same principle as previous commit, with sufficiently huge rgb2yuv table
values this produces wrong results and undefined behavior.
The unsigned produces the same incorrect results. That is probably
ok as these cases with huge values seem not to occur in any real
use case.
Fixes: signed integer overflow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ba209e3d51 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:11 +02:00
Michael Niedermayer
42e5ab500a
avcodec/alsdec: The minimal block is at least 7 bits
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5280947fb6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:11 +02:00
Michael Niedermayer
bf0b88d00a
avformat/replaygain: avoid undefined / negative abs
...
Fixes: signed integer overflow: -2147483648 * 100000 cannot be represented in type 'int'
Fixes: 52060/clusterfuzz-testcase-minimized-ffmpeg_dem_MP3_fuzzer-5131616708329472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2532b20b17 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:10 +02:00
Michael Niedermayer
7c70adcc37
swscale/output: Bias 16bps output calculations to improve non overflowing range
...
Fixes: integer overflow
Fixes: ./ffmpeg -f rawvideo -video_size 66x64 -pixel_format yuva420p10le -i ~/videos/overflow_input_w66h64.yuva420p10le -filter_complex "scale=flags=bicubic+full_chroma_int+full_chroma_inp+bitexact+accurate_rnd:in_color_matrix=bt2020:out_color_matrix=bt2020:in_range=full:out_range=full,format=rgba64[out]" -pixel_format rgba64 -map '[out]' -y overflow_w66h64.png
Found-by: Drew Dunne <asdunne@google.com >
Tested-by: Drew Dunne <asdunne@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0f0afc7fb5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:10 +02:00
Michael Niedermayer
80201f0dc1
avcodec/speedhq: Check buf_size to be big enough for DC
...
Fixes: Timeout
Fixes: 51919/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-6023716480090112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9184d3d7b6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:10 +02:00
Michael Niedermayer
f6780b83f7
avcodec/ffv1dec: Fail earlier if prior context is corrupted
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4df91e2215 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2023-06-04 20:18:09 +02:00
Martin Storsjö
244b61e276
swscale: aarch64: Fix yuv2rgb with negative strides
...
Treat the 32 bit stride registers as signed.
Alternatively, we could make the stride arguments ptrdiff_t instead
of int, and changing all of the assembly to operate on these
registers with their full 64 bit width, but that's a much larger
and more intrusive change (and risks missing some operation, which
would clamp the intermediates to 32 bit still).
Fixes: https://trac.ffmpeg.org/ticket/9985
Signed-off-by: Martin Storsjö <martin@martin.st >
(cherry picked from commit cb803a0072 )
Signed-off-by: Martin Storsjö <martin@martin.st >
2022-11-04 14:33:28 +02:00
Michael Niedermayer
872001459c
Update for 3.4.12
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-10-12 15:05:20 +02:00
Michael Niedermayer
cdeb121c6a
avcodec/dstdec: Check for overflow in build_filter()
...
Fixes: signed integer overflow: 1917019860 + 265558963 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-4833165046317056
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8008940da5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-09-24 22:57:49 +02:00
Michael Niedermayer
c825c20c4f
avformat/spdifdec: Use 64bit to compute bit rate
...
Fixes: signed integer overflow: 32 * 553590816 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-6564974517944320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4075f0cec1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-09-24 22:56:59 +02:00
Michael Niedermayer
989f56371d
avformat/xwma: Use av_rescale() for duration computation
...
Fixes: signed integer overflow: 34242363648 * 538976288 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6577923913547776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c789f753c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-09-24 22:56:22 +02:00
Michael Niedermayer
1361895229
avformat/sdsdec: Use av_rescale() to avoid intermediate overflow in duration calculation
...
Fixes: signed integer overflow: 72128794995445727 * 240 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_SDS_fuzzer-6628185583779840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa8eb1bed0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-09-24 22:56:03 +02:00
Michael Niedermayer
82bd617683
avformat/rmdec: check tag_size
...
Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6598073725353984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2cb7ee8a36 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-09-24 22:54:46 +02:00
Michael Niedermayer
34e46dc429
avformat/nutdec: Check fields
...
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6566001610719232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c146406ea )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-09-24 22:54:05 +02:00
Michael Niedermayer
6cc025a76a
avformat/dxa: avoid bpc overflows
...
Fixes: signed integer overflow: 2147483647 + 32 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-6639823726706688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93db0f0740 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-09-24 22:52:54 +02:00
Michael Niedermayer
77d5cf5e9b
avformat/cafdec: Check that nb_frasmes fits within 64bit
...
Fixes: signed integer overflow: 1099511693312 * 538976288 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6565048815845376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d4bb4e3759 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-09-24 22:51:39 +02:00
Michael Niedermayer
049b9f44e9
avformat/asfdec_o: Limit packet offset
...
avoids overflows with it
Fixes: signed integer overflow: 9223372036846866010 + 4294967047 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6538296768987136
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-657169555665715
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 736e9e69d5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-09-24 22:51:07 +02:00
Michael Niedermayer
225d003f5b
avformat/ape: Check frames size
...
Fixes: signed integer overflow: 9223372036854775806 + 3 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_APE_fuzzer-6389264140599296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d0349c9929 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-09-24 22:49:30 +02:00
Michael Niedermayer
65bc53d608
avformat/icodec: Check nb_pal
...
Fixes: signed integer overflow: 538976288 * 4 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-6690068904935424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit db73ae0dc1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-09-24 22:48:19 +02:00
Michael Niedermayer
e628454a43
avformat/aiffdec: Use 64bit for block_duration use
...
Fixes: signed integer overflow: 3 * -2147483648 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6668935979728896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9303ba272e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-09-24 22:47:53 +02:00
Michael Niedermayer
5ebbc03baa
avformat/aiffdec: Check block_duration
...
Fixes: signed integer overflow: 3 * -2147483648 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6668935979728896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1c2b6265c8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-09-24 22:47:06 +02:00
Michael Niedermayer
b231f3be56
avcodec/apedec: Fix integer overflow in filter_3800()
...
Fixes: signed integer overflow: -2147448926 + -198321 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5739619273015296
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6744428485672960
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f05247f6a4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-09-24 22:44:30 +02:00
Michael Niedermayer
78da181eee
avcodec/tta: Check 24bit scaling for overflow
...
Fixes: signed integer overflow: -8427924 * 256 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5409428670644224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3993345f91 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-09-24 22:43:37 +02:00
Michael Niedermayer
0874d4bce7
libavformat/hls: Free keys
...
Fixes: memleak
Fixes: 50703/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-6399058578636800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Steven Liu <lingjiujianke@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d32a9f3137 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-09-24 22:39:01 +02:00
Michael Niedermayer
d10b5d96dd
avcodec/fmvc: Move frame allocation to a later stage
...
This way more things are checked before allocation
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9783749c66 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-09-24 22:38:37 +02:00
Michael Niedermayer
ad107f99b6
avcodec/speedhq: Check width
...
Fixes: out of array access
Fixes: 50014/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-4748914632294400
Alternatively the buffer size can be increased
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f0395f9ef6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-09-24 22:31:00 +02:00
Michael Niedermayer
3128853ad4
avcodec/bink: disallow odd positioned scaled blocks
...
Fixes: out of array access
Fixes: 47911/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6194020855971840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b14104a637 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-09-02 10:45:58 +02:00
Michael Niedermayer
70f491be13
avformat/asfdec_o: limit recursion depth in asf_read_unknown()
...
The threshold of 5 is arbitrary, both smaller and larger should work fine
Fixes: Stack overflow
Fixes: 50603/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6049302564175872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f1a368169 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-08-31 18:06:23 +02:00
Michael Niedermayer
1d5e021c23
doc/git-howto.texi: Document commit signing
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ced0dc807e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-08-28 22:53:38 +02:00
Michael Niedermayer
2d83c7492d
libavcodec/8bps: Check that line lengths fit within the buffer
...
Fixes: Timeout
Fixes: undefined pointer arithmetic
Fixes: 50330/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EIGHTBPS_fuzzer-5436287485607936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2316d5ec1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-08-28 22:52:03 +02:00
Michael Niedermayer
d2f7d6a380
libavformat/iff: Check for overflow in body_end calculation
...
Fixes: signed integer overflow: -6322983228386819992 - 5557477266266529857 cannot be represented in type 'long'
Fixes: 50112/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6329186221948928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bcb4690304 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-08-28 22:49:42 +02:00
Michael Niedermayer
18a3e264b8
avformat/avidec: Prevent entity expansion attacks
...
Fixes: Timeout
Fixes no testcase, this is the same idea as similar attacks against XML parsers
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f3e823c2aa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-08-28 22:49:02 +02:00
Michael Niedermayer
b2e0b0843f
avcodec/h263dec: Sanity check against minimal I/P frame size
...
Fixes: Timeout
Fixes: 49718/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4874987894341632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ca4ff9c21c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-08-23 23:19:20 +02:00
Michael Niedermayer
371fc3769b
avcodec/hevcdec: Check s->ref in the md5 path similar to hwaccel
...
This is somewhat redundant with the is_decoded check. Maybe
there is a nicer solution
Fixes: Null pointer dereference
Fixes: 49584/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5297367351427072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3b51e19922 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-08-23 23:18:48 +02:00
Michael Niedermayer
fd1db5262b
MAINTAINERS: Add ED25519 key for signing my commits in the future
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 05225180be )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-08-23 22:21:01 +02:00
Michael Niedermayer
59d3ee9046
avcodec/hevc_filter: copy_CTB() only within width&height
...
Fixes: out of array access
Fixes: 49271/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5424984922652672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 009ef35d38 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-07-22 17:31:45 +02:00
Michael Niedermayer
5dfad587a1
avformat/flvdec: Check for EOF in index reading
...
Fixes: Timeout
Fixes: 47992/clusterfuzz-testcase-minimized-ffmpeg_dem_LIVE_FLV_fuzzer-6020443879899136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ceff5d7b74 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-07-22 17:15:53 +02:00
Michael Niedermayer
932463c69d
avformat/nutdec: Check get_packetheader() in mainheader
...
Fixes; Timeout
Fixes: 48794/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6524604713140224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5de084aa6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-07-22 17:15:18 +02:00
Michael Niedermayer
d51b09d503
avformat/asfdec_f: Use 64bit for packet start time
...
Fixes: signed integer overflow: 2147483647 + 32 cannot be represented in type 'int'
Fixes: 49014/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-6314973315334144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ed78486fc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-07-22 17:12:28 +02:00
Michael Niedermayer
26be0c6c7a
avcodec/lagarith: Check dst/src in zero run code
...
Fixes: out of array access
Fixes: 48799/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LAGARITH_fuzzer-4764457825337344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9450f75974 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-07-16 16:24:11 +02:00
Michael Niedermayer
b66fa64a9f
avcodec/h264dec: Skip late SEI
...
Fixes: Race condition
Fixes: clusterfuzz-testcase-minimized-mediasource_MP2T_AVC_pipeline_integration_fuzzer-6282675434094592
Found-by: google ClusterFuzz
Tested-by: Dan Sanders <sandersd@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f7dd408d64 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-07-12 23:11:37 +02:00
Michael Niedermayer
3f9e48f8e6
avcodec/sbrdsp_fixed: Fix integer overflows in sbr_qmf_deint_neg_c()
...
Fixes: signed integer overflow: 2147483645 + 16 cannot be represented in type 'int'
Fixes: 46993/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-4759025234870272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1537f40516 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-07-12 23:11:11 +02:00
Michael Niedermayer
aed958c060
avfilter/vf_signature: Fix integer overflow in filter_frame()
...
Fixes: CID1403233
The second of the 2 changes may be unneeded but will help coverity
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dd6040675e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-07-12 23:10:35 +02:00
Michael Niedermayer
566aa23054
avformat/rtsp: break on unknown protocols
...
This function needs more cleanup and it lacks error handling
Fixes: use of uninitialized memory
Fixes: CID700776
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73c0fd27c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-07-12 22:46:58 +02:00
Michael Niedermayer
0fcc724726
avcodec/hevcdsp_template: stay within tables in sao_band_filter()
...
Fixes: out of array read
Fixes: 47875/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5719393113341952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c5250a561 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-07-12 22:37:12 +02:00
Michael Niedermayer
55fd698f85
avcodec/qpeldsp: copy less for the mc0x cases
...
Fixes: out of array access
Fixes: 47936/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5745039940124672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e690d4edf5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-07-12 22:32:17 +02:00
Michael Niedermayer
f3e18932ff
avcodec/ffv1dec: Limit golomb rice coded slices to width 8M
...
This limit is possibly not reachable due to other restrictions on buffers but
the decoder run table is too small beyond this, so explicitly check for it.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b4431399ec )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-07-12 22:31:18 +02:00
Michael Niedermayer
db0daa80bc
avformat/iff: simplify duration calculation
...
Fixes: signed integer overflow: 315680096256 * 134215943 cannot be represented in type 'long long'
Fixes: 48713/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5886272312311808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0740641e93 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-07-12 22:30:50 +02:00
Michael Niedermayer
f0aeea08a9
avcodec/wnv1: Check for width =1
...
The decoder only outputs pixels for width >1 images, fail early
Fixes: Timeout
Fixes: 48298/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WNV1_fuzzer-6198626319204352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d98d5a436a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-07-12 22:30:12 +02:00
Michael Niedermayer
6d40df7ea7
avformat/sctp: close socket on errors
...
This is untested as i have no testcase
Fixes: CID1302709
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9a2996544 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-07-12 22:27:50 +02:00
Michael Niedermayer
384b5dc0f1
avcodec/aasc: Fix indention
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit af2ed09220 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-07-12 22:24:16 +02:00
Michael Niedermayer
7521f2f66c
avcodec/qdrw: adjust max colors to array size
...
Fixes: out of array access
Fixes: 48429/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDRAW_fuzzer-4608329791438848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cd847f86d3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-07-12 22:21:51 +02:00
Michael Niedermayer
cddda6d7e4
avcodec/alacdsp: Make intermediates unsigned
...
Fixes: signed integer overflow: -14914387 + -2147418648 cannot be represented in type 'int'
Fixes: 46464/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-474307197311385
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8709f4c10a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-07-12 22:21:20 +02:00
Michael Niedermayer
9722b774c5
avformat/aiffdec: cleanup size handling for extreem cases
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c6f1e48b86 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-07-12 22:20:36 +02:00
Michael Niedermayer
a886e9526d
avcodec/jpeglsdec: fix end check for xfrm
...
Fixes: out of array access
Fixes: 47871/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMV_fuzzer-5646305956855808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6a82412bf3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-07-12 22:10:54 +02:00
Michael Niedermayer
93d44b10e8
avcodec/cdgraphics: limit scrolling to the line
...
Fixes: out of array access
Fixes: 47877/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CDGRAPHICS_fuzzer-5690504626438144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b7e30a13d4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-07-12 22:09:38 +02:00
Michael Niedermayer
06bd0a44a8
avformat/aiffdec: avoid integer overflow in get_meta()
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 45891/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6159183893889024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6a02de2127 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-07-12 22:02:28 +02:00
Michael Niedermayer
6ee5e7a696
avformat/ape: more bits in size for less overflows
...
Fixes: signed integer overflow: 2147483647 + 3 cannot be represented in type 'int'
Fixes: 46184/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-4678059519770624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e5f6707a7b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-06-14 19:31:34 +02:00
Michael Niedermayer
c7e436a0b3
avformat/bfi: Check offsets better
...
Fixes: signed integer overflow: -2145378272 - 538976288 cannot be represented in type 'int'
Fixes: 45690/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5015496544616448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 35dc93ab44 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-06-14 17:12:20 +02:00
Michael Niedermayer
4cd065324a
avformat/asfdec_f: Check packet_frag_timestamp
...
Fixes: signed integer overflow: -9223372036854775808 - 4607 cannot be represented in type 'long'
Fixes: 45685/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5280102802391040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ffc8772150 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-06-14 17:11:46 +02:00
Michael Niedermayer
0a330619bf
avcodec/texturedspenc: Fix indexing in color distribution determination
...
Fixes CID1396405
MSE and PSNR is slightly improved, and some noticable corruptions disappear as
well.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit ade36d61de )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-06-14 17:10:25 +02:00
Michael Niedermayer
c5dba22ae4
avformat/act: Check ff_get_wav_header() for failure
...
Fixes: missing error check
Fixes: CID717495
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5982da87e3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-06-14 17:06:21 +02:00
Michael Niedermayer
8775295080
avfilter/vsrc_mandelbrot: Check for malloc failure
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fbd22504c4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-06-14 16:56:57 +02:00
Michael Niedermayer
0a3a33311e
avfilter/vf_frei0r: Copy to frame allocated according to frei0r requirements
...
Fixes: issues with non trivial linesize
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d353909e77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-06-14 16:55:15 +02:00
Michael Niedermayer
1e99ff9d33
avfilter/video: Add ff_default_get_video_buffer2() to set specific alignment
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d740782701 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-06-14 16:54:58 +02:00
Michael Niedermayer
bdadddf530
avformat/genh: Check sample rate
...
Fixes: signed integer overflow: -2515507630940093440 * 4 cannot be represented in type 'long'
Fixes: 46318/clusterfuzz-testcase-minimized-ffmpeg_dem_GENH_fuzzer-5009637474172928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a3d790f197 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-06-14 16:53:24 +02:00
Michael Niedermayer
ffb5153d39
Update for 3.4.11
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-11 02:14:22 +02:00
Paul B Mahol
ee981f7ceb
avfilter/vf_colorspace: fix memmory leaks
...
Fixes #8303
(cherry picked from commit fddef964e8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 19:57:06 +02:00
Andreas Rheinhardt
02fd294a33
avcodec/ac3enc: Fix memleak
...
Fixes ticket #8294 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 097c917c14 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 19:54:53 +02:00
James Almer
13dfa80870
avformat/nutenc: don't allocate a dynamic AVIOContext if no index is going to be written
...
Fixes ticket #8295
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 1d479300cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 19:38:37 +02:00
Paul B Mahol
ac6c213c4e
avfilter/vf_random: fix memory leaks
...
Fixes #8296
(cherry picked from commit 3488e0977c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 19:34:58 +02:00
Paul B Mahol
16eb9939ea
avfilter/vf_bwdif: fix heap-buffer overflow
...
Fixes #8261
(cherry picked from commit 8c3166e1c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 19:31:57 +02:00
Andreas Rheinhardt
6f6036146d
fftools/ffmpeg_opt: Fix leak of options when parsing options fails
...
Fixes #8094 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 21265f42ec )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 19:28:19 +02:00
Paul B Mahol
222783e2fa
avfilter/vf_edgedetect: fix heap-buffer overflow
...
Fixes #8275
(cherry picked from commit de598f82f8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 19:25:28 +02:00
Paul B Mahol
da58e7fb9e
avfilter/vf_w3fdif: deny processing small videos
...
Fixes #8243
(cherry picked from commit 0e68e8c93f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 19:23:47 +02:00
Paul B Mahol
cde751ce49
avfilter/vf_avgblur: fix heap-buffer overflow
...
Fixes #8274
(cherry picked from commit f069a9c2a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 18:49:23 +02:00
Paul B Mahol
c5629402fa
avfilter/af_tremolo: fix heap-buffer overflow
...
Fixes #8317
(cherry picked from commit 58bb9d3a3a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 18:47:02 +02:00
Paul B Mahol
3ee76a3ddb
avfilter/vf_edgedetect: check if height is big enough
...
Fixes #8260
(cherry picked from commit ccf4ab8c9a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 18:42:52 +02:00
Paul B Mahol
c1ce4fba51
avfilter/vf_bitplanenoise: fix overreads
...
Fixes #8244
(cherry picked from commit 0b56723874 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 18:40:16 +02:00
Paul B Mahol
c72ed4f3eb
avfilter/vf_fieldorder: fix heap-buffer overflow
...
Fixes #8264
(cherry picked from commit 07050d7bdc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 18:37:30 +02:00
Paul B Mahol
278f86ece9
avfilter/vf_fieldmatch: fix heap-buffer overflow
...
Also fix use of uninitialized values.
Fixes #8239
(cherry picked from commit ce5274c138 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 18:34:31 +02:00
James Almer
8296bf3dd0
aformat/movenc: add missing padding to output track extradata
...
Fixes ticket #8183 .
Tested-by: Thierry Foucu <tfoucu@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 58aa0ed8f1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 18:20:56 +02:00
Paul B Mahol
e1b399c818
avcodec/pngenc: remove monowhite from apng formats
...
Monowhite pixel format is not supported, and it does not make sense
to add support for it.
Fixes #7989
(cherry picked from commit 5d9f44da46 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-05-04 18:17:43 +02:00
Gyan Doshi
64c2815c29
configure: bump year
...
(cherry picked from commit 2f6360ff21 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-16 10:49:25 +02:00
Michael Niedermayer
148314955b
Update for FFmpeg 3.4.10
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:41:11 +02:00
Paul B Mahol
07cb2c8863
avfilter/vf_lenscorrection: make width/height int
...
Somehow previous correct fix broke usage.
(cherry picked from commit 79522411fa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
73c593b0ce
avcodec/diracdec: avoid signed integer overflow in global mv
...
Fixes: signed integer overflow: -128275513086 * -76056576 cannot be represented in type 'long'
Fixes: 45818/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5129799149944832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f1279684e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
8ed50e1838
avcodec/takdsp: Fix integer overflow in decorrelate_sf()
...
Fixes: signed integer overflow: -101 * 71041254 cannot be represented in type 'int'
Fixes: 45938/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-4687974320701440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 01d8c887f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
7ea021e7bf
avcodec/apedec: fix a integer overflow in long_filter_high_3800()
...
Fixes: signed integer overflow: -2146549696 - 3923884 cannot be represented in type 'int'
Fixes: 45907/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5992380584558592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b085b400be )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Oneric
1c73b96c21
avfilter/vf_subtitles: pass storage size to libass
...
Due to a quirk of the ASS format some tags depend on the exact storage
resolution of the video, so tell libass via ass_set_storage_size.
2022-04-13 23:39:50 +02:00
Michael Niedermayer
86c204addf
avformat/aqtitledec: Skip unrepresentable durations
...
Fixes: signed integer overflow: -5 - 9223372036854775807 cannot be represented in type 'long'
Fixes: 45665/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-475618463934054
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c2d1597a8a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
adcacd0d74
avformat/cafdec: Do not store empty keys in read_info_chunk()
...
Fixes: Timeout
Fixes: 45543/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5684953164152832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ec28e1d4c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
ea391e65ef
avformat/hls: Check target_duration
...
Fixes: signed integer overflow: 77777777777777 * 1000000 cannot be represented in type 'long long'
Fixes: 45545/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-6438101247983616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Steven Liu <lingjiujianke@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8fd3f7fab )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
14eea4ade4
avcodec/pixlet: Avoid signed integer overflow in scaling in filterfn()
...
Fixes: signed integer overflow: 11494 * 1073741824000000 cannot be represented in type 'long'
Fixes: 26586/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PIXLET_fuzzer-5752633970917376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c1f20c6c8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
92521686ce
avformat/matroskadec: Check pre_ns
...
Fixes: division by 0
Fixes: 44615/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6681108677263360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 710e51677a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
4b298c8721
avcodec/sonic: Use unsigned for predictor_k to avoid undefined behavior
...
Fixes: signed integer overflow: -1094995529 * 24 cannot be represented in type 'int'
Fixes: 44436/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-4874459459223552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 28008bf95e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
4e305299d9
avformat/matroskadec: Use rounded down duration in get_cue_desc() check
...
Floating point is evil, it would be better if duration was not a double
Fixes: Infinite loop
Fixes: 45123/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6725052291219456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bd3a03db9a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
b545c25078
avformat/avidec: Check height
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: Ticket8486
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec8ff659f5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
680f821af3
avformat/rmdec: Better duplicate tags check
...
Fixes: memleaks
Fixes: 44810/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5619494647627776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 15a646e501 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
b70429e33c
avformat/mov: Disallow empty sidx
...
It appears this is not allowed "Each Segment Index box documents how a (sub)segment is divided into one or more subsegments
(which may themselves be further subdivided using Segment Index boxes)."
Fixes: Null pointer dereference
Fixes: Ticket9517
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4419433d77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
77f3f2aaf9
avformat/matroskadec: Check duration
...
Fixes: -nan is outside the range of representable values of type 'long'
Fixes: 44614/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6216204841254912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 36680078ca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
83d5b57074
avcodec/jpeglsdec: Fix if( code style
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f306b8e80a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
fa91d68bf4
avcodec/jpeglsdec: Check get_ur_golomb_jpegls() for error
...
Fixes: Timeout
Fixes: Invalid shift
Fixes: 44548/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-556487680891289
Fixes: 44569/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMV_fuzzer-6302543246917632
Fixes: 44570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-4550196556595200
Fixes: 44592/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5651610385121280
Fixes: 44571/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5094698987945984
Fixes: 44607/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5341352013987840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 151f83584e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
00f9a2bfd5
avcodec/motion_est: fix indention of ff_get_best_fcode()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ce43e1c581 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
5ead850302
avcodec/motion_est: Fix xy indexing on range violation in ff_get_best_fcode()
...
This codepath seems untested, no testcases change
Found-by: <mkver>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 634312a70f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
07b7a4be0a
avcodec/jpeglsdec: Increase range for N in ls_get_code_runterm() by using unsigned
...
Fixes: left shift of 32768 by 16 places cannot be represented in type 'int'
Fixes: Timeout
Fixes: 44219/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-4679455379947520
Fixes: 44088/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-4885976600674304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ee283d7d0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
79d52d0668
avformat/matroskadec: Check desc_bytes
...
Fixes: Division by 0
Fixes: 44035/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4826721386364928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5038933977 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
9eca5d77c4
avformat/utils: Fix invalid NULL pointer operation in ff_parse_key_value()
...
Fixes: pointer index expression with base 0x000000000000 overflowed to 0xffffffffffffffff
Fixes: 44012/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-5670607746891776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 59328aabd2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
0027251644
avformat/matroskadec: Fix infinite loop with bz decompression
...
The same check is added to zlib too, it seems not needed there though
Fixes: Infinite loop
Fixes: 43932/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-6175167573786624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c3d2cbb51 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
e42732b91f
avformat/mov: Check size before subtraction
...
Fixes: signed integer overflow: -9223372036854775808 - 8 cannot be represented in type 'long'
Fixes: 43542/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5237670148702208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d8d9d506a3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
a33ae75225
avcodec/apedec: Fix integer overflows in predictor_update_3930()
...
Fixes: signed integer overflow: 1074134419 - -1075212485 cannot be represented in type 'int'
Fixes: 43273/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-4706880883130368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c9c9bbd01 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
0190d175c6
avcodec/apedec: fix integer overflow in 8bit samples
...
Fixes: signed integer overflow: 2147483542 + 128 cannot be represented in type 'int'
Fixes: 42812/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6344057861832704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7cee3b3718 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
83778e7787
avformat/flvdec: timestamps cannot use the full int64 range
...
We do not support this as we multiply by 1000
Fixes: signed integer overflow: -45318575073853696 * 1000 cannot be represented in type 'long'
Fixes: 42804/clusterfuzz-testcase-minimized-ffmpeg_dem_LIVE_FLV_fuzzer-4630325425209344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c217ca7718 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
807a564acf
avcodec/vqavideo: reset accounting on error
...
Fixes: Timeout (same growing chunk is decoded to failure repeatedly)
Fixes: 42582/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-6531195591065600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d8ea7a67ba )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
50b56b539e
avcodec/alacdsp: fix integer overflow in decorrelate_stereo()
...
Fixes: signed integer overflow: -16777216 * 131 cannot be represented in type 'int'
Fixes: 23835/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5669943160078336
Fixes: 41101/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-4636330705944576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 68457c1e85 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
fa922acc51
avformat/4xm: Check for duplicate track ids
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dd94912479 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
e1793ad68e
avformat/4xm: Consider max_streams on reallocating tracks array
...
Fixes: OOM
Fixes: 41595/clusterfuzz-testcase-minimized-ffmpeg_dem_FOURXM_fuzzer-6355979363549184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0dcd95ef8a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
60500dfc38
avformat/mov: Check next offset in mov_read_dref()
...
Fixes: signed integer overflow: 9223372036200463215 + 1109914409 cannot be represented in type 'long'
Fixes: 41480/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6553086177443840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 562021e2fd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
816a97ba50
avformat/mxfdec: Check for duplicate mxf_read_index_entry_array()
...
Fixes: memleak
Fixes: 41596/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6439060204290048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f44a218e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
7300c29bd4
avcodec/apedec: Change avg to uint32_t
...
Fixes: Integer overflow
Fixes: 40973/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6739312704618496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ec75723a4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
b60f4ff5dd
avformat/mov: Disallow duplicate smdm
...
Fixes: memleak
Fixes: 39879/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5327819907923968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5ba74053c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
c63fed4293
avformat/mov: Check for EOF in mov_read_glbl()
...
Fixes: Infinite loop
Fixes: 41351/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5433895854669824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 59b4e7cbd8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
54d7297b33
avformat/mov: Check channels for mov_parse_stsd_audio()
...
Fixes: signed integer overflow: -776522110086937600 * 16 cannot be represented in type 'long'
Fixes: 40563/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6644829447127040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a64a4c582 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
f486033934
avformat/avidec: Check read_odml_index() for failure
...
Fixes: Timeout
Fixes: 40950/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6478873068437504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 57adb26d05 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
1cd6a75cba
avformat/aiffdec: Use av_rescale() for bitrate
...
Fixes: integer overflow
Fixes: 40313/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-4814761406103552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 905588df97 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
a7eeea7872
avformat/aiffdec: sanity check block_align
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93f7776921 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Michael Niedermayer
b982f9fe9d
avformat/aiffdec: Check sample_rate
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b04836dff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Paul B Mahol
b239ccff7d
avfilter/vf_gblur: fix heap-buffer overflow
...
Fixes #8282
(cherry picked from commit 64a805883d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
Paul B Mahol
32a384519a
avfilter/vf_lenscorrection: fix division by zero
...
Fixes #8265
(cherry picked from commit 19587c9332 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:50 +02:00
James Almer
b8197738d2
avformat/latmenc: abort if no extradata is available
...
Fixes ticket #8273 .
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit dd01947397 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:49 +02:00
Michael Niedermayer
04240e1d09
avcodec/g729dec: Avoid computing invalid temporary pointers for ff_acelp_weighted_vector_sum()
...
Fixes: Ticket8176
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c78a76cb0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:49 +02:00
Andreas Rheinhardt
3b49688440
avformat/movenc: Fix segfault when remuxing rtp hint stream
...
When remuxing an rtp hint stream (or any stream with the tag "rtp "),
the mov muxer treats this as one of the rtp hint tracks it creates
internally when ordered to do so; yet this track lacks the
AVFormatContext for the hinting rtp muxer, leading to segfaults in
mov_write_udta_sdp() if a "trak" atom is written for this stream; if not,
the stream's codecpar is freed by mov_free() as if the mov muxer owned
it (it does for the internally created "rtp " tracks), but without
resetting st->codecpar, leading to double-frees lateron. This commit
therefore ignores said tag which makes rtp hint streams unremuxable.
This fixes tickets #8181 and #8186 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 22c3cd1760 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:49 +02:00
Paul B Mahol
b5873ca4f5
avformat/tty: add probe function
...
(cherry picked from commit 3bce9e9b3e )
2022-04-13 23:39:49 +02:00
Michael Niedermayer
59b4b9086a
avcodec/flac_parser: Consider AV_INPUT_BUFFER_PADDING_SIZE
...
Fixes: out if array read
Fixes: 40109/clusterfuzz-testcase-minimized-ffmpeg_dem_FLAC_fuzzer-4805686811295744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Mattias Wadman <mattias.wadman@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:49 +02:00
Michael Niedermayer
a2c450db44
avcodec/ttadsp: Fix integer overflows in tta_filter_process_c()
...
Fixes: signed integer overflow: 822841647 + 1647055738 cannot be represented in type 'int'
Fixes: 39935/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-4592657142251520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f24028c798 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:49 +02:00
Michael Niedermayer
ef075e363d
avutil/mathematics: Document av_rescale_rnd() behavior on non int64 results
...
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e154353fdb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2022-04-13 23:39:49 +02:00
Andreas Rheinhardt
9e213f5086
configure: Add missing libshine->mpegaudioheader dependency
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com >
(cherry picked from commit e228d7b0db )
2022-01-06 08:53:14 +01:00
Lynne
1eca11f81a
configure: update copyright year
...
(cherry picked from commit 63505fc60a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-11 23:08:44 +02:00
Michael Niedermayer
e7bed708a8
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-09 18:35:56 +02:00
Michael Niedermayer
7a1c59e455
avformat/wavdec: Check smv_block_size
...
Fixes: Timeout
Fixes: 39554/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-4915221701984256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 849138f476 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-09 18:34:49 +02:00
Michael Niedermayer
a85739087d
avformat/rmdec: Check for multiple audio_stream_info
...
Fixes: memleak
Fixes: 39166/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5153276690038784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8fe3566b8f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-09 18:34:49 +02:00
Michael Niedermayer
c3971ff707
avcodec/apedec: Use 64bit to avoid overflow
...
Fixes: runtime error: signed integer overflow: 727298502 * 3 cannot be represented in type 'int'
Fixes: 39172/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-638602483033702
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f059b56195 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-09 18:34:49 +02:00
Michael Niedermayer
ca5f10e0c3
avcodec/apedec: Fix undefined integer overflow in long_filter_ehigh_3830()
...
Fixes: signed integer overflow: -2145648640 - 3357696 cannot be represented in type 'int'
Fixes: 38899/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5358815017566208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ad517ee6e4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-09 18:34:49 +02:00
Michael Niedermayer
afe2a1a8c5
oavformat/avidec: Check offset in odml
...
Fixes: signed integer overflow: 9223372036854775807 + 8 cannot be represented in type 'long'
Fixes: 38787/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-4859845799444480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 255a7b423e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-09 18:34:49 +02:00
Michael Niedermayer
67b9b10b70
avformat/mpegts: use actually read packet size in mpegts_resync special case
...
Fixes: infinite loop
Fixes: 37986/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5292311517462528 -
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 83b2e4c8f1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-09 18:34:49 +02:00
Michael Niedermayer
582098acf7
swscale/alphablend: Fix slice handling
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 06d6726588 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-09 18:34:49 +02:00
Michael Niedermayer
d091597467
avcodec/mxpegdec: Check for AVDISCARD_ALL
...
Fixes: Fixes NULL pointer dereference
Fixes: 36610/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-6052641783283712
Fixes: 37907/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-4725170850365440
Fixes: 37904/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-6367889262247936
Fixes: 38085/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-5175270823297024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 20afd3a63a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-09 18:34:49 +02:00
Michael Niedermayer
7f8a534e56
avcodec/flicvideo: Check remaining bytes in FLI*COPY
...
Fixes: Timeout
Fixes: 37795/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-4846536543043584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f835efbca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-09 18:34:49 +02:00
Michael Niedermayer
22181868e3
avcodec/mpeg12dec: Do not put mpeg_f_code into an invalid state on error return
...
Fixes: invalid shift
Fixes: 37018/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG2VIDEO_fuzzer-5290280902328320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5a95abcce4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-09 18:34:49 +02:00
Michael Niedermayer
fdb61f366c
avcodec/mpegvideo_enc: Limit bitrate tolerance to the representable
...
Fixes: error: 1.66789e+11 is outside the range of representable values of type 'int'
Fixes: Ticket8201
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 245017ec8a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-09 18:34:49 +02:00
Michael Niedermayer
b9761037d0
avcodec/apedec: Fix integer overflow in intermediate
...
Fixes: signed integer overflow: 559334865 * 4 cannot be represented in type 'int'
Fixes: 37929/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6751932295806976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 90da43557f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-09 18:34:49 +02:00
Michael Niedermayer
fa742cda4e
avformat/mvdec: Do not set invalid sample rate
...
Fixes: signed integer overflow: -682581959642593728 * 16 cannot be represented in type 'long'
Fixes: 37883/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5311691517198336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 737e6bf216 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-09 18:34:49 +02:00
Michael Niedermayer
6715ea85c0
avformat/rmdec: Use 64bit for intermediate for DEINT_ID_INT4
...
Fixes: runtime error: signed integer overflow: 65312 * 65535 cannot be represented in type 'int'
Fixes: 32832/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-4817710040088576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e2c2872393 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-09 18:34:49 +02:00
Michael Niedermayer
cbe954f578
avformat/jacosubdec: Check for min in t overflow in get_shift()
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 34651/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-5157941012463616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 989febfbd0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-09 18:34:49 +02:00
Michael Niedermayer
90d2f32f62
avformat/mxfdec: check channel number in mxf_get_d10_aes3_packet()
...
Fixes: Out of array access
Fixes: 37030/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5387719147651072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3dd5a8a135 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-09 18:34:49 +02:00
Timo Rothenpieler
11388838ff
avfilter/scale_npp: fix non-aligned output frame dimensions
2021-10-07 18:39:44 +02:00
Michael Niedermayer
1b44a20a19
Update for 3.4.9
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 21:40:20 +02:00
James Almer
a4a3fd814a
avcodec/utils: don't return negative values in av_get_audio_frame_duration()
...
In some extrme cases, like with adpcm_ms samples with an extremely high channel
count, get_audio_frame_duration() may return a negative frame duration value.
Don't propagate it, and instead return 0, signaling that a duration could not
be determined.
Fixes ticket #9312
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit e01d306c64 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
0fe497d795
avcodec/jpeg2000dec: Check that atom header is within bytsetream
...
Fixes: Infinite loop
Fixes: 36666/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5912760671141888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3c659f8618 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
d11d5f7da4
avcodec/apedec: Fix 2 integer overflows in filter_3800()
...
Fixes: signed integer overflow: 1683879955 - -466265224 cannot be represented in type 'int'
Fixes: 37419/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6074294407921664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 33feb527ff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
980224770a
avcodec/xpmdec: Move allocations down after more error checks
...
Fixes: Timeout
Fixes: 37035/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XPM_fuzzer-5142718576721920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e58692837c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Martin Storsjö
fc76c6037a
network: Define ENOTCONN as WSAENOTCONN if not defined
...
This fixes compilation with old mingw.org toolchains, which has got
much fewer errno.h entries.
Signed-off-by: Martin Storsjö <martin@martin.st >
(cherry picked from commit 6569e9505c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
36f962f3c2
avformat/avidec: Use 64bit for frame number in odml index parsing
...
Fixes: signed integer overflow: 1179337772 + 1392508928 cannot be represented in type 'int'
Fixes: 34088/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5846945303232512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a4c98c507e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
43a4d78e3b
avcodec/mjpegdec: Check for bits left in mjpeg_decode_scan_progressive_ac()
...
Fixes: Timeout
Fixes: 36262/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-4969052454912000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 909faca929 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
maryam ebrahimzadeh
bc9e0b6cd2
avformat/adtsenc: return value check for init_get_bits in adts_decode_extradata
...
As the second argument for init_get_bits (buf) can be crafted, a return value check for this function call is necessary.
'buf' is part of 'AVPacket pkt'.
replace init_get_bits with init_get_bits8.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9ffa49496d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
1e198bd926
avcodec/webp: Check available space in loop in decode_entropy_coded_image()
...
Fixes: Timeout
Fixes: 35401/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WEBP_fuzzer-5714401821851648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5e00eab611 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
f4700142dc
avcodec/vc1dec: ff_print_debug_info() does not support WMV3 field_mode
...
Fixes: out of array read
Fixes: 36331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-5140494328922112.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c59b5e3d1e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
071ecaddb9
avcodec/frame_thread_encoder: Free AVCodecContext structure on error during init
...
Fixes: MemLeak
Fixes: 8281
Fixes: PoC_option158.jpg
Fixes: CVE-2020-22037
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7bba0dd638 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
f71c7a358e
avcodec/faxcompr: Check for end of input in cmode == 1 in decode_group3_2d_line()
...
Fixes: Infinite loop
Fixes: 35591/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4503764022198272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f803635c4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
2b4e4af6dc
avcodec/vc1dec: Disable error concealment for *IMAGE
...
The existing error concealment makes no sense for the image formats, they
use transformed source images which is different from keyframe + MC+difference
for which the error concealment is designed.
Of course feel free to re-enable this if you have a case where it works and
improves vissual results
Fixes: Timeout
Fixes: 36234/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-6300306743885824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 643b2d49bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
0b98a1d5e5
avcodec/sbrdsp_fixed: Fix negation overflow in sbr_neg_odd_64_c()
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 35593/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5182217725804544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8f2856a1da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
d64fddb9a8
avformat/wtvdec: Check for EOF before seeking back in parse_media_type()
...
Fixes: Infinite loop
Fixes: 36311/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-4889181296918528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 89505d38de )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
a415c253b4
avformat/wavdec: Use 64bit in new_pos computation
...
Fixes: signed integer overflow: 129 * 16711680 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-6742285317439488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9b57d2f0a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
5ebce16fde
avformat/sbgdec: Check for overflow in timestamp preparation
...
Fixes: signed integer overflow: 9223372036854775807 + 86400000000 cannot be represented in type 'long'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6731040263634944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9dbed90840 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
a4b9ac104e
avformat/dsicin: Check packet size for overflow
...
Fixes: signed integer overflow: 24672 + 2147483424 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_DSICIN_fuzzer-6731325979623424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d1c47ec03 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
0b5c564580
avformat/bfi: check nframes
...
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_BFI_fuzzer-6737028768202752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b4e77dfca1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
89fd36adfe
avformat/avidec: fix position overflow in avi_load_index()
...
Fixes: signed integer overflow: 9223372033098784808 + 4294967072 cannot be represented in type 'long'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6732488912273408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 527821a2dd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
d15d67e6cc
avformat/asfdec_f: Check sizeX against padding
...
Fixes: signed integer overflow: 2147483607 + 64 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-6753897878257664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f034c2e36a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
f95a80bbd7
avformat/aiffdec: Check for size overflow in header parsing
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6723467048255488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bae2e19777 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
c593517453
avcodec/aaccoder: Add minimal bias in search_for_ms()
...
Fixes: floating point division by 0
Fixes: Ticket8218
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 75a099fc73 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
7590dbf9be
avfilter/vf_mestimate: Check b_count
...
Fixes: left shift of negative value -1
Fixes: Ticket8270
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 06af6e101b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
bbec731fca
avformat/mov: do not ignore errors in mov_metadata_hmmt()
...
Fixes: Timeout
Fixes: 35637/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6311060272447488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c52c99a18f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
00ecb22167
avformat/mxfdec: Check size for shrinking
...
av_shrink_packet() takes int size, so size must fit in int
Fixes: out of array access
Fixes: 35607/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4875541323841536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65b862ab59 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
maryam ebr
e61b25e255
avcodec/dnxhddec: check and propagate function return value
...
Similar to CVE-2013-0868, here return value check for 'init_vlc' is needed.
crafted DNxHD data can cause unspecified impact.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 7150f95756 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
e4f7328d51
swscale/slice: Fix wrong return on error
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7874d40f10 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
a6f5191f2e
swscale/slice: Check slice for allocation failure
...
Fixes: null pointer dereference
Fixes: alloc_slice.mp4
Found-by: Rafael Dutra <rafael.dutra@cispa.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 997f9cfc12 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-12 11:22:04 +02:00
Luca Barbato
9cfd59b5fa
configure: Fix sem_timedwait probe
...
(cherry-picked from libav commit 41262498ff )
Signed-off-by: James Almer <jamrial@gmail.com >
2021-09-12 11:22:04 +02:00
James Almer
2e1e677c6d
configure: add missing pthreads dependency to v4l2_m2m
...
Signed-off-by: James Almer <jamrial@gmail.com >
2021-09-12 11:22:04 +02:00
Michael Niedermayer
94bb92e5bb
avformat/matroskadec: Fix handling of huge default durations
...
Fixes: negation of -9223372036854775808 cannot be represented in type 'int64_t' (aka 'long'); cast to an unsigned type to negate this value to itself
Fixes: 33997/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6752039691485184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 343d950a4a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
73e81965b7
avcodec/lpc: check for zero err in normalization in compute_lpc_coefs()
...
Fixes: floating point division by 0
Fixes: Ticket8213
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 70874e024a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
afb3519570
avformat/ftp: Check for av_strtok() failure
...
Fixes: CID1396258 Dereference null return value
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d40782088 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
375aa8f5f8
tools/cws2fws: Check read() for failure
...
Fixes: CID1452579 Argument cannot be negative
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0b3cdd7cc2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
3ecb97e45b
avcodec/cpia: Fix missing src_size update
...
Fixes: out of array read
Fixes: 35210/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CPIA_fuzzer-5669199688105984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cea05864e6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
2eb23b82c8
avcodec/utils: Use 64bit for intermediate in AV_CODEC_ID_ADPCM_THP* duration calculation
...
Fixes: signed integer overflow: 486539264 * 14 cannot be represented in type 'int'
Fixes: 35281/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-6068262742917120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 00ae9b77ef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
153833e42c
avformat/rmdec: Check old_format len for overflow
...
Maybe such large values could be disallowed earlier and closer to where
they are set.
Fixes: signed integer overflow: 538976288 * 8224 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6704350354341888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 06d174e289 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
090e2d1680
avformat/realtextdec: Check the pts difference before using it for the duration computation
...
Fixes: signed integer overflow: 5404200000 - -9223372031709351616 cannot be represented in type 'long'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_REALTEXT_fuzzer-6737340551790592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fe12aa6890 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
0602cf0ce3
avformat/qcp: Avoid negative nb_rates
...
Fixes: signed integer overflow: 2 * -1725947872 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_QCP_fuzzer-6726807632084992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b865cc703 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
5ae0f402de
avformat/nutdec: Check tmp_size
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6739990530883584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1ca00b5e44 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
159ec5a6ab
avformat/msf: Check that channels doesnt overflow during extradata construction
...
Fixes: signed integer overflow: 2048 * 1122336 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_MSF_fuzzer-6726959600107520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1a277926b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
c65e5a1933
avformat/mpc8: Check for position overflow in mpc8_handle_chunk()
...
Fixes: signed integer overflow: 15 + 9223372036854775796 cannot be represented in type 'long'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6723520756318208
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6739833034768384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ef25d1182 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
7a62ddb3cd
avformat/iff: Use 64bit in duration computation
...
Fixes: signed integer overflow: 588 * 16719904 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6748331936186368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93d964689c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
d4755459b3
avformat/dxa: Check fps to be within the supported range more precissely
...
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: assertion failure
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-6744985740378112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ea494befc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
e618928e40
avcodec/iff: Only write palette to plane 1 if its PAL8
...
Fixes: null pointer passed as argument 1, which is declared to never be null
Fixes: 33791/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5107575256383488.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 216eb60b85 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
ba0f5aa4cb
avformat/tta: Check for EOF in index reading loop
...
Fixes: OOM
Fixes: 33585/clusterfuzz-testcase-minimized-ffmpeg_dem_TTA_fuzzer-4564665830080512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b72d657b73 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
aee1476099
Update missed irc links
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c067d20177 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
9274418fe8
avformat/rpl: The associative law doesnt hold for signed integers in C
...
Add () to avoid undefined behavior
Fixes: signed integer overflow: 9223372036854775790 + 57 cannot be represented in type 'long'
Fixes: 34983/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-5765822923538432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 480f11bdd7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
7f28e32486
avcodec/faxcompr: Check available bits in decode_uncompressed()
...
Fixes: Timeout
Fixes: 34950/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5686764151898112
Fixes: 34966/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4587409334468608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ff56c139e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
40053dc0bc
avcodec/faxcompr: Check if bits are available before reading in cmode == 9 || cmode == 10
...
Fixes: Timeout
Fixes: 34950/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5686764151898112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d8421e3d5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
6bbacb011a
avcodec/utils: do "calc from frame_bytes, channels, and block_align" in 64bit
...
Fixes: signed integer overflow: 104962766 * 32 cannot be represented in type 'int'
Fixes: 33614/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-6252129036664832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3447979d08 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
628a1682e9
avcodec/ttadata: Add sentinel at the end of ff_tta_shift_1
...
Fixes: out of array access
Fixes: 34933/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5629322560929792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dbbcfbcc4e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
58bbb40b72
avfilter/vf_dctdnoiz: Check threads
...
Fixes: floating point division by 0
Fixes: Ticket 8269
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a3917c02c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
a2d45c6b9a
avfilter/vf_ciescope: Fix undefined behavior in rgb_to_xy() with black
...
Fixes: floating point division by 0
Fixes: undefined behavior in handling NaN
Fixes: Ticket 8268
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d500e62f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
226d608e95
avformat/rpl: Check for EOF and zero framesize
...
Fixes: Infinite loop
Fixes: 34751/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-5439330800762880
Fixes: 34774/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-5851571660390400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a0a4a527c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
2e36b0d55a
avcodec/vc2enc: Check for non negative slice bounds
...
Fixes: invalid shifts
Fixes: Ticket 8221
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f7862e8268 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
5f44a99a60
avformat/rpl: Use 64bit in bitrate computation and check it
...
Fixes: signed integer overflow: 777777776 * 4 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-6726188921913344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 29b244ffc1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
a3f8ddabde
avcodec/svq1enc: Do not print debug RD value before it has been computed
...
Avoids floating point division by 0
Fixes: Ticket8191
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c297f7e57a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
92f83a2147
avcodec/aacpsy: Check bandwidth
...
Fixes: Ticket8011
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 36dead4bc2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
bcab3700df
avcodec/aacenc: Do not divide by lambda_count if it is 0
...
Avoids Floating point division by 0
Fixes: Ticket8011
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c520b98691 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
0c71bd5ebf
avcodec/aacenc: Use FLT_EPSILON for lambda minimum
...
(cherry picked from commit 4b89cf7aa4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
ed9f251a5d
avformat/cinedec: Fix index_entries size check
...
Fixes: out of array access
Fixes: 29868/clusterfuzz-testcase-minimized-ffmpeg_dem_CINE_fuzzer-5692001957445632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
1c5391ce1c
avfilter/vf_yadif: Fix handing of tiny images
...
Fixes: out of array access
Fixes: Ticket8240
Fixes: CVE-2020-22021
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7971f62120 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bb08ee0c6fb7bdebd37cbf00aefed206909e8f78)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
c2ae301888
avfilter/vf_vmafmotion: Check dimensions
...
Fixes: out of array access
Fixes: Ticket8241
Fixes: Ticket8246
Fixes: CVE-2020-22019
Fixes: CVE-2020-22033
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 82ad1b7675 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
a4a70c1568
avformat/movenc: Check pal_size before use
...
Fixes: assertion failure
Fixes: out of array read
Fixes: Ticket8190
Fixes: CVE-2020-22015
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4c1afa2925 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
3d97ab7dad
avcodec/lpc: Avoid floating point division by 0
...
Fixes: Ticket7996
Fixes: CVE-2020-20445
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38d18fb578 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
f07177cb71
avcodec/aacpsy: Avoid floating point division by 0 of norm_fac
...
Fixes: Ticket7995
Fixes: CVE-2020-20446
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 223b5e8ac9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
00446f74ad
avcodec/aacenc: Avoid 0 lambda
...
Fixes: Ticket8003
Fixes: CVE-2020-20453
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a7a7f32c8a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
95cacdbbca
avcodec/exr: x/ymax cannot be INT_MAX
...
The code uses x/ymax + 1 so the maximum is INT_MAX-1
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 33158/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5545462457303040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 48342aa075 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
fcff15dc06
avformat/avio: Check av_opt_copy() for failure
...
Fixes: CID1477416 Unchecked return value
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f8611ae1ef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
c46b016b1d
avcodec/vc1: Check remaining bits in ff_vc1_parse_frame_header()
...
Fixes: Timeout
Fixes: 33156/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-6259655027326976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38c4761588 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
7ba104475a
avformat/mov: Ignore duplicate CoLL
...
Fixes: memleak
Fixes: 32146/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5377612845285376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9548dc74d8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
34880e3541
avformat/mov: Limit nb_chapter_tracks to input size
...
Fixes: Timeout (15k loop iterations instead of 400m)
Fixes: 31368/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6601583174483968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 299a56c900 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
78f4185041
avformat/utils: Use 64bit earlier in r_frame_rate check
...
Fixes: signed integer overflow: 1406796319 * 2 cannot be represented in type 'int'
Fixes: 32777/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5632576913014784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 578633fc1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
1c48b56a0e
avformat/mvdec: Check sample rate in parse_audio_var()
...
Fixes: signed integer overflow: -635424002382840000 * 16 cannot be represented in type 'long'
Fixes: 33612/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5704741108711424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ff60249a5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
4da6a18395
avcodec/faxcompr: Check for end of bitstream in decode_group3_1d_line() and decode_group3_2d_line()
...
Fixes: infinite loop
Fixes: 33674/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4816457818046464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 08d2df4153 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
78da48bb74
avcodec/utils: treat PAL8 for jpegs similar to other colorspaces
...
Fixes: out of array access
Fixes: 33713/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5778775641030656
Fixes: 33717/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-4960397238075392
Fixes: 33718/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-5314270096130048.fuzz
Fixes: 33719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5352721864589312
Fixes: 33721/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-5938892055379968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f0ce023ddb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
2a5d44e3cb
avcodec/jpeglsdec: Set alpha plane in PAL8 so image is not 100% transparent
...
Fixes: tickets/3933/128.jls
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 011006874c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
0a123f3b67
avformat/asfdec_o: Use ff_get_extradata()
...
Fixes: OOM
Fixes: 27240/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-5937469859823616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 098314e1e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
13a3dc95b9
avformat/id3v2: Check end for overflow in id3v2_parse()
...
Fixes: signed integer overflow: 9223372036840103978 + 67637280 cannot be represented in type 'long'
Fixes: 33341/clusterfuzz-testcase-minimized-ffmpeg_dem_DSF_fuzzer-6408154041679872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit efdb564504 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
069ea22b51
avformat/wtvdec: Improve size overflow checks in parse_chunks()
...
Fixes: signed integer overflow: 32 + 2147483647 cannot be represented in type 'int
Fixes: 32967/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5132856218222592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f8ec1da8ac )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
7cd4ac4b2d
avcodec/faxcompr: Check remaining bits on error in decode_group3_1d_line()
...
Fixes: Timeout
Fixes: 32886/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4779761466474496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b3881f0da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
175c3a0904
avcodec/utils: Check ima wav duration for overflow
...
Fixes: signed integer overflow: 44331634 * 65 cannot be represented in type 'int'
Fixes: 32120/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-5760221223583744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f40e9b1355 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
b4eeac2a1b
avformat/cafdec: Check channels
...
Fixes: signed integer overflow: -1184429040541376544 * 32 cannot be represented in type 'long'
Fixes: 31788/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6236746338664448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 641c1db22b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
6128c6f338
avcodec/dpx: Check bits_per_color earlier
...
Fixes: shift exponent 251 is too large for 32-bit type 'int'
Fixes: 32147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DPX_fuzzer-5519111675314176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c093eb3031 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
f4916e5c97
avcodec/pnm_parser: Check image size addition for overflow
...
Fixes: assertion failure
Fixes: out of array access
Fixes: 32664/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-6533642202513408.fuzz
Fixes: 32669/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-6001928875147264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 79ac8d5546 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
3264d9f546
avformat/rmdec: use larger intermediate type for audio_framesize * sub_packet_h check
...
Fixes: signed integer overflow: 65535 * 65535 cannot be represented in type 'int'
Fixes: 31406/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5024692843970560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf2fd9204b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
5911f7bbf1
avcodec/h264_slice: Check input SPS in ff_h264_update_thread_context()
...
Fixes: crash
Fixes: check_pkt.mp4
Found-by: Rafael Dutra <rafael.dutra@cispa.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ceae92cb29 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
9689bc0c5c
avcodec/mpegvideo: Update chroma_?_shift in ff_mpv_common_frame_size_change()
...
Fixes: out of array access
Fixes: 31201/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4627865612189696.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 87d87e6587 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
e6d3ace07e
avformat/mov: Ignore multiple STSC / STCO
...
Fixes: STSC / STCO inconsistency and assertion failure
Fixes: crbug1184666.mp4
Found-by: Chromium ASAN fuzzer
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2611d20d35 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
5c9eaff60c
avformat/utils: Extend overflow check in dts wrap in compute_pkt_fields()
...
Fixes: signed integer overflow: -9223372032574480351 - 4294967296 cannot be represented in type 'long long'
Fixes: 30022/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5568610275819520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b37ff29e0e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
5ca2ee38e8
avfilter/vf_scale: Fix adding 0 to NULL (which is UB) in scale_slice()
...
Found-by: Jeremy Leconte <jleconte@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1cf96ce269 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
8adb20d3de
avutil/common: Add FF_PTR_ADD()
...
Suggested-by: Andreas Rheinhardt
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 522a5259e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
bc4a1f63fb
avformat/wtvdec: Check size in SBE2_STREAM_DESC_EVENT / stream2_guid
...
Fixes: signed integer overflow: 539033600 - -1910497124 cannot be represented in type 'int'
Fixes: 30928/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5922630966312960
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f74661543 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
578b4ce853
avformat/cafdec: Do not build an index if all packets are the same
...
Fixes: Timeout
Fixes: 28214/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6495999421579264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea12590c8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
843437a14a
avcodec/sonic: Use unsigned temporary in predictor_calc_error()
...
Fixes: signed integer overflow: -2147471366 - 18638 cannot be represented in type 'int'
Fixes: 30157/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5171199746506752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 075d793ba8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
f5e2d548f1
avformat/flvdec: Check array entry number
...
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 30209/clusterfuzz-testcase-minimized-ffmpeg_dem_FLV_fuzzer-5724831658147840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5d8fe1c87 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
564a4331fd
avcodec/h264_slice: Check sps in h264_slice_header_init()
...
Fixes: null pointer dereference
Fixes: h264_slice_header_init.mp4
Found-by: Rafael Dutra <rafael.dutra@cispa.de >
Tested-by: Rafael Dutra <rafael.dutra@cispa.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8047243899 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
c932b82cc9
avformat/movenc: Avoid loosing cluster array on failure
...
Fixes: crash
Fixes: check_pkt.mp4
Found-by: Rafael Dutra <rafael.dutra@cispa.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c2ff44f91 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
225d542c34
avformat/avidec: Check for dv streams before using priv_data in parse ##dc/##wb
...
Fixes: null pointer dereference
Fixes: 31588/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6165716135968768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f733688d30 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
cf88ca01da
avformat/mov: Check sample size for overflow in mov_parse_stsd_audio()
...
Fixes: signed integer overflow: 2 * 1914708000 cannot be represented in type 'int'
Fixes: 31639/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6303428239294464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d35677736a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
6114ba9ee1
avcodec/ffwavesynth: Avoid signed integer overflow in phi_at()
...
Fixes: signed integer overflow: 2314885530818453536 - -9070214327174160352 cannot be represented in type 'long'
Fixes: 31000/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-6558389742206976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be08b84f8b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
5c3e640624
avcodec/mpeg4videoenc: Check extradata malloc()
...
Fixes: Null pointer dereference
Fixes: any mpeg4 testcase which fails the malloc at that exact spot
Found-by: Rafael Dutra <rafael.dutra@cispa.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 33a1687bf6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
36ee2ff37a
avcodec/speedhq: Width < 8 is not supported
...
Fixes: out of array access
Fixes: 31733/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-4704307963363328
Fixes: 31736/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-6190960292790272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 462b8261aa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
f7e195bdd3
avformat/matroskadec: Check for EOF in resync loop
...
Fixes: Timeout (too long -> instantly)
Fixes: 29136/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4586141227548672
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5282147d0c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
e9871b10a9
avcodec/utils: Use more bits for intermediate for AV_CODEC_ID_ADPCM_MS
...
Fixes: signed integer overflow: 1172577312 * 2 cannot be represented in type 'int'
Fixes: 29924/clusterfuzz-testcase-minimized-ffmpeg_dem_BOA_fuzzer-4882912874594304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0f441b9063 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
5e01c25741
avcodec/jpegls: Check A[Q] for overflow in ff_jpegls_update_state_regular()
...
Fixes: Timeout
Fixes: 30912/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5556235476795392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8a3fea802a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
fcc7bc3cd5
avformat/voc_packet: prevent remaining size from becoming negative in ff_voc_get_packet()
...
Fixes: memleak
Fixes: 30909/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS_fuzzer-4886284057313280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 337984c133 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
862b1ca108
avutil/timecode: Avoid fps overflow
...
Fixes: Integer overflow and division by 0
Fixes: poc-202102-div.mov
Found-by: 1vanChen of NSFOCUS Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c94875471e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
87a22936cb
avformat/mvi: Check audio size for more overflows
...
Fixes: left shift of negative value -352256000
Fixes: 30837/clusterfuzz-testcase-minimized-ffmpeg_dem_MVI_fuzzer-5755626262888448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 403b35e16e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
44ab20a678
avcodec/flacdec: Avoid undefined shift in error case
...
Fixes: flac_1040988
Reported-by: Thomas Guilbert <tguilbert@google.com >
Reviewed-by: Thomas Guilbert <tguilbert@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bd525e2876 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
a477cc0379
avcodec/ffv1dec: Check if trailer is available
...
Fixes: out of array read
Fixes: 29750/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-4808377272238080.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 36ad2f41e3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
ec0531808e
avcodec/4xm: Check pre_gb in decode_i_block()
...
Fixes: Timeout
Fixes: 31257/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5150866229297152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b87781649e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
e7da859daa
avcodec/dcadsp: Fix integer overflow in dmix_add_c()
...
Fixes: signed integer overflow: 1515225320 + 759416059 cannot be represented in type 'int'
Fixes: 29256/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DCA_fuzzer-5719088561258496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b4ebf483bc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
89e3962271
avformat/flvdec: Check double before cast in parse_keyframes_index()
...
Fixes: -2.21166e+304 is outside the range of representable values of type 'long'
Fixes: 29169/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5725452796821504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 09e5e406c7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
a3d5698106
avformat/paf: Check for EOF before allocation in read_header()
...
Fixes: OOM
Fixes: 26584/clusterfuzz-testcase-minimized-ffmpeg_dem_PAF_fuzzer-5172661183053824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bcb1e9d3b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
15321c10b6
avcodec/aacdec_template: Avoid undefined negation in imdct_and_windowing_eld()
...
Fixes: negation of -2147483648 cannot be represented in type 'INTFLOAT' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: 29057/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5642758933053440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 633924539a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
e4f149a26f
avformat/lxfdec: Fix multiple integer overflows related to track_size
...
Fixes: signed integer overflow: 538976288 * 8 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_LXF_fuzzer-6634030636335104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7819412f44 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
af1a0cedb2
avcodec/exr: skip bottom clearing loop when its outside the image
...
Fixes: signed integer overflow: 1633771809 * 32960 cannot be represented in type 'int'
Fixes: 26532/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5613925708857344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
ae9919bb6c
avformat/aiffdec: Check that SSND is at least 8 bytes
...
Fixes: Infinite loop
Fixes: 30874/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-5933710488764416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 460d3dc41f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
a072c4a178
avformat/dcstr: Check sample rate
...
Fixes: signed integer overflow: -1300248894420254720 * 16 cannot be represented in type 'long'
Fixes: 30879/clusterfuzz-testcase-minimized-ffmpeg_dem_DCSTR_fuzzer-5094464215449600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fdcb966f4a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
a3cac14fb9
avcodec/alsdec: Check bitstream input in read_block()
...
Fixes: Timeout
Fixes: 28110/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5036338973507584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53d739db4e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
07b08082f0
avformat/mov: Extend data_size check in mov_read_udta_string()
...
Fixes: signed integer overflow: -2147483634 - 16 cannot be represented in type 'int'
Fixes: 28322/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5711888402612224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 74c4c53953 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
da70d471ad
avformat/voc_packet: Add a basic check on max_size
...
Fixes: signed integer overflow: -2147483648 - 4 cannot be represented in type 'int'
Fixes: 28127/clusterfuzz-testcase-minimized-ffmpeg_dem_VOC_fuzzer-4880586455646208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 52f75181bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
f59e526e09
avformat/microdvddec: use 64bit for durations
...
Fixes: signed integer overflow: 7 - -2147483647 cannot be represented in type 'int'
Fixes: 28036/clusterfuzz-testcase-minimized-ffmpeg_dem_MICRODVD_fuzzer-5171698751766528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f569ac4ce0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
5422b33281
avcodec/hapdec: Change compressed_offset to unsigned 32bit
...
Fixes: out of array access
Fixes: 29345/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5401813482340352
Fixes: 30745/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5762798221131776
Suggested-by: Anton
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 89fe1935b1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
93bb05f77f
avformat/rmdec: Check codec_length without overflow
...
Fixes: signed integer overflow: 2147483647 + 64 cannot be represented in type 'int'
Fixes: 30333/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-5175286983426048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d558c9f237 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
947ce7cca0
avformat/mov: Check element count in mov_metadata_hmmt()
...
Fixes: Timeout
Fixes: 30325/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6048395703746560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1d277b92fa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
7fd5a96f7f
avcodec/fits: Check gcount and pcount being non negative
...
Fixes: signed integer overflow: 9223372036854775807 - -30069403896 cannot be represented in type 'long'
Fixes: 30046/clusterfuzz-testcase-minimized-ffmpeg_dem_FITS_fuzzer-5807144773484544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c000a91288 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
7901a7ed20
avformat/nutdec: Check timebase count against main header length
...
Fixes: Timeout (long -> 3ms)
Fixes: 28514/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6078669009321984
Fixes: 30095/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-5074433016463360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c425198558 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
3b36248fe6
avformat/electronicarts: Clear partial_packet on error
...
Fixes: Infinite loop
Fixes: 30165/clusterfuzz-testcase-minimized-ffmpeg_dem_EA_fuzzer-6224642371092480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 59bb9dc2a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
7fed68e63b
avformat/r3d: Check samples before computing duration
...
Fixes: signed integer overflow: -4611686024827895807 + -4611686016279904256 cannot be represented in type 'long'
Fixes: 30161/clusterfuzz-testcase-minimized-ffmpeg_dem_R3D_fuzzer-5694406713802752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7a2aa5dc2a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
7d1d375245
avcodec/pnm_parser: Check av_image_get_buffer_size() for failure
...
Fixes: out of array access
Fixes: 30135/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PBM_fuzzer-4997145650397184
Fixes: 30208/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-5605891665690624.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5314a4996c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
5bd10bb5f6
avformat/wavdec: Consider AV_INPUT_BUFFER_PADDING_SIZE in set_spdif()
...
The buffer is read by using the bit reader
Fixes: out of array read
Fixes: 27539/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-5650565572591616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a7c648e2d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
73c963692e
avformat/rmdec: Check remaining space in debug av_log() loop
...
Fixes: Timeout (long -> 2 ms)
Fixes: 26709/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5665833403285504
Fixes: 27522/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-6321071221112832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8fe78decd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
bbdd767053
avformat/flvdec: Treat high ts byte as unsigned
...
Fixes: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 27516/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5152854660349952
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f514113cfa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
27a9a81875
avformat/samidec: Sanity check pts
...
Fixes: signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'long'
Fixes: 29743/clusterfuzz-testcase-minimized-ffmpeg_dem_SAMI_fuzzer-5499256859394048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2014b01352 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
69ffdd28c4
avformat/avidec: Use 64bit in get_duration()
...
Fixes: signed integer overflow: 2147483424 + 8224 cannot be represented in type 'int'
Fixes: 29619/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5191424373030912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a0ceb0cdd4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
58b0d89f95
avformat/mov: Check for duplicate st3d
...
Fixes: memleak
Fixes: 29585/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6594188688490496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 658f0606cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
69fc4a7cae
avformat/mvdec: Check for EOF in read_index()
...
Fixes: Timeout
Fixes: 29550/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5094307193290752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6c64351bb1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
2813037bd0
avcodec/jpeglsdec: Fix k=16 in ls_get_code_regular()
...
Fixes: Timeout
Fixes: left shift of 33046 by 16 places cannot be represented in type 'int'
Fixes: 29258/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-4889231489105920
Fixes: 29515/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-6161940391002112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 980900d991 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
cc919e40ac
avformat/id3v2: Check the return from avio_get_str()
...
Fixes: out of array access
Fixes: 29446/clusterfuzz-testcase-minimized-ffmpeg_dem_AAC_fuzzer-5096222622875648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 25f240fcb3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
4db28ef7c2
avcodec/hevc_sei: Check payload size in decode_nal_sei_message()
...
Fixes: out of array access
Fixes: 29392/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4821602850177024.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0791a515d3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
c58d3ebcf4
libavutil/eval: Remove CONFIG_TRAPV special handling
...
Fixes: division by zero
Fixes: 29555/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVO_fuzzer-5149951447400448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8574fcbfc7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
6ada27fe95
avformat/wtvdec: Check len in parse_chunks() to avoid overflow
...
Fixes: signed integer overflow: 2147483647 + 7 cannot be represented in type 'int'
Fixes: 30084/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-6192261941559296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5552ceaf56 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
201eb0c994
avformat/asfdec_f: Add an additional check for the extradata size
...
Fixes: OOM
Fixes: 30066/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-6182309126602752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c8cd4490a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
e41c1dde72
avformat/3dostr: Check sample_rate
...
Fixes: signed integer overflow: -1268324762623155200 * 8 cannot be represented in type 'long'
Fixes: 30123/clusterfuzz-testcase-minimized-ffmpeg_dem_THREEDOSTR_fuzzer-6710765123928064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7e5034f97e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
2aa07c6b8e
avformat/4xm: Make audio_frame_count 64bit
...
Fixes: signed integer overflow: 2099257366 * 2 cannot be represented in type 'int'
Fixes: 27486/clusterfuzz-testcase-minimized-ffmpeg_dem_FOURXM_fuzzer-5112179134824448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 842c268c64 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
b26360b7f9
avformat/mov: Use av_mul_q() to avoid integer overflows
...
Fixes: signed integer overflow: 538976288 * 538976288 cannot be represented in type 'int'
Fixes: 27473/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5758978289827840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f70e1ec0c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
d625865095
avcodec/vp9dsp_template: Fix integer overflows in itxfm_wrapper
...
Fixes: signed integer overflow: 2147483641 + 32 cannot be represented in type 'int'
Fixes: 27452/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5078752576667648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4dfb7ff528 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
270b1a9514
avformat/rmdec: Reorder operations to avoid overflow
...
Fixes: signed integer overflow: -2147483648 - 14 cannot be represented in type 'int'
Fixes: 27659/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-5697250168406016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b12e713b80 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
64be558906
avcodec/mxpegdec: fix SOF counting
...
Fixes: Timeout (>10sec -> 15ms)
Fixes: 27652/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-5125920868007936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 401495def6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
c6f65b8711
avcodec/rscc: Check inflated_buf size whan it is used
...
Fixes: out of array access
Fixes: 27434/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RSCC_fuzzer-5196757675540480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit a5ed6da9bd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
90a723f134
avformat/mvdec: Sanity check SAMPLE_WIDTH
...
Fixes: signed integer overflow: 999999999 * 8 cannot be represented in type 'int'
Fixes: 30048/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5864289917337600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab82c10578 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
599b9b89d1
avformat/rmdec: Fix codecdata_length overflow check
...
Fixes: signed integer overflow: 2147483647 + 64 cannot be represented in type 'int'
Fixes: 28509/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-6310969680723968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3c41d0bfd6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
15e4a29785
avcodec/simple_idct: Fix undefined integer overflow in idct4row()
...
Fixes: signed integer overflow: -1498310196 - 902891776 cannot be represented in type 'int'
Fixes: 28445/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5075163389493248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 57f7e5caa3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
7f8f71737d
avformat/tta: Use 64bit intermediate for index
...
Fixes: signed integer overflow: 42032 * 51092 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_TTA_fuzzer-6679539648430080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fd61b42b4c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
d40aefc2dc
avformat/soxdec: Check channels to be positive
...
Fixes: signed integer overflow: 32 * -1795162112 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_SOX_fuzzer-6724151473340416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b0588b73da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:49 +02:00
Michael Niedermayer
cd64495084
avcodec/vp3: Check input amount in theora_decode_header()
...
Fixes: Timeout
Fixes: 29226/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-6195092572471296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 869fe41d10 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
9b43c8d34a
avformat/wavdec: Check avio_get_str16le() for failure
...
Fixes: out of array access
Fixes: 29195/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5037853281222656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d7594ee751 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
ec6eb51ae8
avformat/flvdec: Check for EOF in amf_skip_tag()
...
Fixes: Timeout
Fixes: 29070/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5650106766458880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9725d07a17 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
35d9e182b9
avformat/aiffdec: Check size before subtraction in get_aiff_header()
...
Fixes: Infinite loop
Fixes: 27235/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-5761398380167168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8af299acde )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
3bdf23b9fe
avformat/electronicarts: More chunk_size checks
...
Fixes: Timeout
Fixes: 26909/clusterfuzz-testcase-minimized-ffmpeg_dem_EA_fuzzer-6489496553783296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d03f0ec9a1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
c44aadea59
avformat/tedcaptionsdec: Check for overflow in parse_int()
...
Fixes: signed integer overflow: 1111111111111111111 * 10 cannot be represented in type 'long'
Fixes: 26892/clusterfuzz-testcase-minimized-ffmpeg_dem_TEDCAPTIONS_fuzzer-5756045055754240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b0f8586ca9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
71f0cfd327
avformat/nuv: Check channels
...
Fixes: signed integer overflow: -3468545475927866368 * 4 cannot be represented in type 'long'
Fixes: 28879/clusterfuzz-testcase-minimized-ffmpeg_dem_NUV_fuzzer-6303367307591680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fc45d924d7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
6d96e983f1
avformat/mpc8: Check size before implicitly converting to int
...
Fixes: Timeout
Fixes: 28551/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6229183210586112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 78d6d8ddb5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
38f634ac7f
avformat/nutdec: Fix integer overflow in count computation
...
Note, the value is checked a few lines later already
Fixes: signed integer overflow: -440402016 - 1879048064 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6603876618469376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0014249fd9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
a34dd1d501
avformat/mvi: Use 64bit for testing dimensions
...
Fixes: signed integer overflow: 65535 * 65535 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_MVI_fuzzer-6649291124899840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 48fb752767 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
c3cd65720f
avformat/utils: Check dts in update_initial_timestamps() more
...
Fixes: signed integer overflow: -9223372036853488158 - 90000000 cannot be represented in type 'long long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_MPSUB_fuzzer-6696625298866176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 29851cb840 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
f551bcd6d6
avformat/flvdec: Check for avio_read() failure in amf_get_string()
...
Suggested-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cb31667611 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
abb8a37bf8
avformat/flvdec: Check for nesting depth in amf_skip_tag()
...
Fixes: out of array access
Fixes: 29440/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5985279812960256.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ef522c918 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
d99234eec2
avformat/flvdec: Check for nesting depth in amf_parse_object()
...
Fixes: out of array access
Fixes: 29202/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5112845840809984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 074e204b42 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
f465193646
avformat/asfdec_o: Check for EOF in asf_read_marker()
...
Fixes: Timeout
Fixes: 26460/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-5710884393189376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e3d09f435 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
2d104fd260
avformat/utils: Check dts - (1<<pts_wrap_bits) overflow
...
Fixes: signed integer overflow: -9223372036842389247 - 2147483648 cannot be represented in type 'long long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_FLV_fuzzer-4845007531671552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d82ee907d6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
74b28ca1ab
avformat/bfi: Check chunk_header
...
Fixes: signed integer overflow: -2147483648 - 3 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_BFI_fuzzer-6665764123836416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 638a151a87 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
ec0eb88a39
avformat/ads: Check size
...
Fixes: signed integer overflow: -2147483616 - 64 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_ADS_fuzzer-6617769344892928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c78b2b138c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
fd7d3d6043
avformat/iff: Check block align also for ID_MAUD
...
Fixes: Timeout & OOM
Fixes: 28701/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5185094964871168
Fixes: 29116/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4874284795297792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b17ffe8f8f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
03cc7590a9
avcodec/utils: Check for integer overflow in get_audio_frame_duration() for ADPCM_DTK
...
Fixes: signed integer overflow: 131203586 * 28 cannot be represented in type 'int'
Fixes: 26817/clusterfuzz-testcase-minimized-ffmpeg_dem_MSF_fuzzer-6296902548848640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2488ba85a0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
f897515f5f
avformat/fitsdec: Better size checks
...
Fixes: out of array access
Fixes: 26819/clusterfuzz-testcase-minimized-ffmpeg_dem_FITS_fuzzer-5634559355650048
Fixes: 26820/clusterfuzz-testcase-minimized-ffmpeg_dem_FITS_fuzzer-5760774955597824
Fixes: 27379/clusterfuzz-testcase-minimized-ffmpeg_dem_FITS_fuzzer-5129775942991872.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 14bbb6bb30 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
5a2d068627
avformat/mxfdec: Fix integer overflow in next position in mxf_read_local_tags()
...
Fixes: signed integer overflow: 9223372036854775723 + 8192 cannot be represented in type 'long'
Fixes: 29072/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4812604904177664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d3d9b1fc8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
d287614620
avformat/avidec: dv does not support palettes
...
Fixes: memleak
Fixes: 26937/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5763003338981376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b373b41d9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
41d3d169b4
libavformat/utils: consider avio_size() failure in ffio_limit()
...
Fixes: Timeout (>20sec -> 3ms)
Fixes: 26918/clusterfuzz-testcase-minimized-ffmpeg_dem_THP_fuzzer-5750425191710720
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b1dac2716 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
1f29e97714
avformat/nistspheredec: Check bits_per_coded_sample and channels
...
Fixes: signed integer overflow: 80 * 92233009 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_NISTSPHERE_fuzzer-6669100654919680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 60770a50fb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
21b22a76d6
avformat/asfdec_o: Check size vs. offset in detect_unknown_subobject()
...
Fixes: signed integer overflow: 2314885530818453566 + 7503032301549264928 cannot be represented in type 'long'
Fixes: 26639/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6024222100684800
Alternatively this could be ignored but then the end condition of the loop
would be hard to reach as avio_tell() is int64_t
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0bee216ad4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
13c058d51c
avformat/utils: check for integer overflow in av_get_frame_filename2()
...
Fixes: signed integer overflow: 317316873 * 10 cannot be represented in type 'int'
Fixes: 24708/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5731180885049344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 03c479ce23 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
3cd7db6c4f
avutil/timecode: Avoid undefined behavior with large framenum
...
Fixes: signed integer overflow: 2147462079 + 2149596 cannot be represented in type 'int'
Fixes: 27565/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5091972813160448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b19057396 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
2e239cbcb8
avformat/sbgdec: Reduce the amount of floating point in str_to_time()
...
Fixes: 1e+75 is outside the range of representable values of type 'long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6626834808700928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ac6c8993f7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
4f4d738dea
avformat/mxfdec: Free all types for both Descriptors
...
Fixes: memleak
Fixes: 26352/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5201158714687488
Suggested-by: Tomas Härdin <tjoppen@acc.umu.se >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 88519be8db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
26c82e3038
uavformat/rsd: check for EOF in extradata
...
Fixes: OOM
Fixes: 26503/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-6530816735444992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7186ec88b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
63ea2114e3
avcodec/wmaprodec: Check packet size
...
Fixes: left shift of negative value -25824
Fixes: 27754/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA2_fuzzer-5760255962906624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 69aeba8a19 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
226aa33f06
avcodec/alsdec: Fix integer overflow with quant_cof
...
Fixes: signed integer overflow: -210824 * 16384 cannot be represented in type 'int'
Fixes: 28670/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5682310846480384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ce40dde03 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
c9b74bbec2
avformat/mpegts: Fix argument type for av_log
...
Reviewed-by: Marton Balint <cus@passwd.hu >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 654b21ef17 )
2021-09-11 21:23:48 +02:00
Michael Niedermayer
607098b74a
avformat/cafdec: clip sample rate
...
Fixes: 1.21126e+111 is outside the range of representable values of type 'int'
Fixes: 27398/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5412960339755008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 684aec6a68 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
6e093adccc
avcodec/ffv1dec: Fix off by 1 error with quant tables
...
Fixes: assertion failure
Fixes: 28447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-5369575948550144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5cae71d2b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
3049331a49
avformat/mpegts: Increase pcr_incr width to 64bit
...
Fixes: division by zero
Fixes: 26459/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5666350112178176
Fixes: 28154/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5195728439476224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ef7b117b7b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
6c179e5933
avcodec/utils: Check bitrate for overflow in get_bit_rate()
...
Fixes: signed integer overflow: 617890810133996544 * 16 cannot be represented in type 'long'
Fixes: 26565/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5092054700654592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8aadae670f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
8a3b513aa7
avformat/mov: Check if hoov is at the end
...
Fixes: Timeout, probably infinite loop
Fixes: 26559/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5391165484171264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0afbaabdca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
339f357bbc
avcodec/hevc_ps: check scaling_list_dc_coef
...
Fixes: signed integer overflow: 2147483640 + 8 cannot be represented in type 'int'
Fixes: 28449/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5686013259284480
Reviewed-by: James Almer <jamrial@gmail.com >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f1700bd8bb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
eeb387c9a5
avformat/iff: Check data_size
...
Fixes: infinite loop
Fixes: 27834/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5694930919620608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 001bc594d8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
38e6692a31
avformat/matroskadec: Sanity check codec_id/track type
...
Fixes: memleak
Fixes: 27766/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-5198300814508032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b88dd8f0c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
f817e1396e
avformat/rpl: Check the number of streams
...
Fixes: out of memory access
Fixes: 27787/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-4743666463408128.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0677bdb1f5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
d4eaf3346f
avcodec/h264idct_template: Fix integer overflow in ff_h264_chroma422_dc_dequant_idct()
...
Fixes: signed integer overflow: -2105540608 - 2105540608 cannot be represented in type 'int'
Fixes: 26870/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5656647567147008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 51dfd6f1bd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
6996bf684e
avformat/dsfdec: Check block_align more completely
...
Fixes: infinite loop
Fixes: 26865/clusterfuzz-testcase-minimized-ffmpeg_dem_DSF_fuzzer-5649473830912000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65b8974d54 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
a8584c6cbf
avformat/mpc8: Check remaining space in mpc8_parse_seektable()
...
Fixes: Fixes infinite loop
Fixes: 26704/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6327056939614208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f66dd13d0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
7dcf0f1ebb
avformat/id3v2: Sanity check tlen before alloc and uncompress
...
Fixes: Timeout (>20sec -> 65ms)
Fixes: 26896/clusterfuzz-testcase-minimized-ffmpeg_dem_DAUD_fuzzer-5691024049176576
Fixes: 27627/clusterfuzz-testcase-minimized-ffmpeg_dem_AEA_fuzzer-4907019324358656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d7f87a4b9e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
8d4d02c13a
avformat/vqf: Check len for COMM chunks
...
Fixes: Infinite loop
Fixes: 26696/clusterfuzz-testcase-minimized-ffmpeg_dem_VQF_fuzzer-5648269168082944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a834af133b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
9a523ef89f
avcodec/hevc_cabac: Limit value in coeff_abs_level_remaining_decode() tighter
...
The max depth is 16bps, the max allowed coefficient depth is depth+6
Fixes: signed integer overflow: 1074266112 + 1073725439 cannot be represented in type 'int'
Fixes: 26493/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5657763331702784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7cf852b03c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
9b82853d3c
avformat/cafdec: Check the return code from av_add_index_entry()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9dc3301745 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
a0f3a049e6
avformat/cafdec: Check for EOF in index read loop
...
Fixes: OOM
Fixes: 27398/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-541296033975500
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eb46939e3a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
f7fe3969ef
avformat/cafdec: Check that bytes_per_packet and frames_per_packet are non negative
...
These fields are not signed in the spec (1.0) so they cannot be negative
Changing bytes_per_packet to unsigned would not solve this as it is exported
as block_align which is signed
Fixes: Infinite loop
Fixes: 26492/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5632087614554112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5eed718087 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
3293cf065e
avformat/mpc8: correct integer overflow in mpc8_parse_seektable()
...
Fixes: signed integer overflow: -4683718486770919638 * 2 cannot be represented in type 'long'
Fixes: 26704/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6327056939614208
Fixes: 27550/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6259212652642304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0897402ac8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
9162b1a60d
avformat/mpc8: correct 32bit timestamp truncation
...
Fixes: left shift of 65536 by 15 places cannot be represented in type 'int'
Fixes: 26801/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-5164313092030464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ad3e495657 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
00115573e3
avcodec/exr: Check ymin vs. h
...
Fixes: out of array access
Fixes: 26532/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5613925708857344
Fixes: 27443/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5631239813595136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3e5959b345 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
caefd7a3ba
avformat/avs: Use 64bit for the avio_tell() output
...
Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented in type 'long'
Fixes: 26549/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS_fuzzer-4844306424397824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1278f117d7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
9ca75063ea
avformat/wavdec: More complete size check in find_guid()
...
Fixes: signed integer overflow: 9223372036854775807 + 8 cannot be represented in type 'long'
Fixes: 27341/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5442833206738944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a207df2acb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
b9df29a393
avformat/iff: Check size before skip
...
Fixes: Infinite loop
Fixes: 27292/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5731168991051776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b50e8bc29 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
5515c34baf
avformat/rmdec: Check for EOF in index packet reading
...
Fixes: Timeout(>10sec -> 1ms)
Fixes: 27284/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6304211110985728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ebf4bc629e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
ea83351a49
avformat/icodec: Check for zero streams and stream creation failure
...
Fixes: NULL pointer dereference
Fixes: 26814/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-5758487797432320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b33233bd53 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
ee7cdaaa3f
avformat/icodec: Factor failure code out in read_header()
...
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 27ee67c00f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
1703863faa
avformat/bintext: Check width
...
Fixes: division by 0
Fixes: 26780/clusterfuzz-testcase-minimized-ffmpeg_dem_ADF_fuzzer-5117945027756032
Fixes: 26998/clusterfuzz-testcase-minimized-ffmpeg_dem_ADF_fuzzer-5119352359354368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f6dc285fb5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
3dc3b95910
avformat/sbgdec: Check that end is not before start
...
Fixes: signed integer overflow: -9223372036854775808 + -5279949906739200 cannot be represented in type 'long'
Fixes: 26908/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6329610851319808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9ef60a66f1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
3454254eb4
avformat/lvfdec: Check stream_index before use
...
Fixes: assertion failure
Fixes: 26905/clusterfuzz-testcase-minimized-ffmpeg_dem_LVF_fuzzer-5724267599364096.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b1d99ab14f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
78f990e9bd
avformat/au: cleanup on EOF return in au_read_annotation()
...
Fixes: memleak
Fixes: 26841/clusterfuzz-testcase-minimized-ffmpeg_dem_AU_fuzzer-5174166309044224
Regression since: e680d50eb4
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d16974c3dd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
bec8415990
avformat/mpegts: Limit copied data to space
...
Fixes: out of array access
Fixes: 26816/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-6282861159907328.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 79cf7c7191 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
e51ff9d5fd
avformat/bintext: Check width in idf_read_header()
...
Fixes: division by 0
Fixes: 26802/clusterfuzz-testcase-minimized-ffmpeg_dem_IDF_fuzzer-5180591554953216.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 442d53f409 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
992fd3262d
avformat/iff: check size against INT64_MAX
...
Bigger sizes are misinterpreted as negative numbers by the API
Fixes: infinite loop
Fixes: 26611/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4890614975692800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f291cd681b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
774b06e252
avformat/paf: Check for EOF in read_table()
...
Fixes: OOM
Fixes: 26528/clusterfuzz-testcase-minimized-ffmpeg_dem_PAF_fuzzer-5081929248145408
Fixes: 26584/clusterfuzz-testcase-minimized-ffmpeg_dem_PAF_fuzzer-5172661183053824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 437b7302b0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
570884a6c4
avformat/gxf: Check pkt_len
...
Fixes: Infinite loop
Fixes: 26576/clusterfuzz-testcase-minimized-ffmpeg_dem_GXF_fuzzer-4823080360476672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dad9a86ca7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
025be7dfca
avformat/aiffdec: Check packet size
...
Fixes: Fixes infinite loop
Fixes: 26575/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-5727522236661760
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ba71a72d3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
7186ab2b7d
avformat/concatdec: use av_strstart()
...
Fixes: out array read
Fixes: 26610/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-5631838049271808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2610acb49a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
633f4568be
avformat/wavdec: Refuse to read chunks bigger than the filesize in w64_read_header()
...
Fixes: OOM
Fixes: 26414/clusterfuzz-testcase-minimized-ffmpeg_dem_FWSE_fuzzer-5070632544632832
Fixes: 26475/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5770207722995712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b2244565a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
92aece7e5a
avformat/rsd: Check size and start before computing duration
...
Fixes: signed integer overflow: 100794754 * 28 cannot be represented in type 'int'
Fixes: 26474/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-5181797606096896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c79d8a6851 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
e03a2c7106
avformat/iff: More completely check body_size
...
Fixes: infinite loop
Fixes: 26485/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5126561373880320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3588e2e6b0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
48fbee3b44
avformat/xwma: Check for EOF in dpds_table read code
...
Fixes: Timeout (>30 -> 140ms)
Fixes: 26478/clusterfuzz-testcase-minimized-ffmpeg_dem_XWMA_fuzzer-5918147066200064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 44b18a76b8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
b42f802a38
avcodec/utils: Check sample rate before use for AV_CODEC_ID_BINKAUDIO_DCT in get_audio_frame_duration()
...
Fixes: shift exponent 95 is too large for 32-bit type 'int'
Fixes: 26590/clusterfuzz-testcase-minimized-ffmpeg_dem_SMACKER_fuzzer-5120609937522688
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec7e0d4288 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
ec94d7545e
avcodec/dirac_parser: do not offset AV_NOPTS_OFFSET
...
Fixes: signed integer overflow: -9223372036854775807 - 48000 cannot be represented in type 'long long'
Fixes: 26521/clusterfuzz-testcase-minimized-ffmpeg_dem_DIRAC_fuzzer-5635536506847232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 343c3149ab )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
3e9e5344ed
avformat/rmdec: Make expected_len 64bit
...
Fixes: signed integer overflow: 1347551268 * 14 cannot be represented in type 'int'
Fixes: 26458/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-5655364324032512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 728330462c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
29745dda10
avformat/lrcdec: Clip timestamps
...
Fixes: signed integer overflow: 7111111111111531010 - -7335632962598013506 cannot be represented in type 'long'
Fixes: 26463/clusterfuzz-testcase-minimized-ffmpeg_dem_LRC_fuzzer-6015558333759488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 80bc2ac3c0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
42604d3676
avformat/electronicarts: Check for EOF in each iteration of the loop in ea_read_packet()
...
Fixes: timeout(>20sec -> 1ms)
Fixes: 26526/clusterfuzz-testcase-minimized-ffmpeg_dem_EA_fuzzer-5672328069120000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 857aba7c45 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
b1117dd702
avcodec/vp9dsp_template: Fix some overflows in iadst8_1d()
...
Fixes: signed integer overflow: 190587 * 11585 cannot be represented in type 'int'
Fixes: 26407/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5086348408782848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bca0735be5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
6557a72a0b
avcodec/fits: Check bscale
...
Fixes: division by 0
Fixes: 26208/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-6270472117026816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c2ccd76fd0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
bcad7fceb1
avformat/nistspheredec: Check bps
...
Fixes: left shift of 1111111190 by 3 places cannot be represented in type 'int'
Fixes: 26437/clusterfuzz-testcase-minimized-ffmpeg_dem_NISTSPHERE_fuzzer-4886896091856896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7c144b363e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
bed66afc0b
avformat/jacosubdec: Use 64bit inside get_shift()
...
Fixes: signed integer overflow: 111111111 * 30 cannot be represented in type 'int'
Fixes: 26448/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-5638440374501376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 715ff75e5d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
80983b7bb3
avformat/genh: Check block_align
...
Fixes: infinite loop
Fixes: 26440/clusterfuzz-testcase-minimized-ffmpeg_dem_GENH_fuzzer-5632134020333568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 37396e9ba8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
3c9806077a
avformat/mvi: Check count for overflow
...
Fixes: left shift of 21378748 by 10 places cannot be represented in type 'int'
Fixes: 26449/clusterfuzz-testcase-minimized-ffmpeg_dem_MVI_fuzzer-5680463374712832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a413ed9863 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
9c00ffb073
avcodec/magicyuv: Check slice size before reading flags and pred
...
Fixes: heap-buffer-overflow
Fixes: 26487/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_fuzzer-5742553675333632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0dc42147b6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
31e7609491
avformat/asfdec_f: Check for negative ext_len
...
Fixes: Infinite loop
Fixes: 26376/clusterfuzz-testcase-minimized-ffmpeg_dem_PCM_U32LE_fuzzer-6050518830678016
Fixes: 26377/clusterfuzz-testcase-minimized-ffmpeg_dem_TY_fuzzer-4838195726123008
Fixes: 26384/clusterfuzz-testcase-minimized-ffmpeg_dem_G729_fuzzer-5173450337157120
Fixes: 26396/clusterfuzz-testcase-minimized-ffmpeg_dem_PCM_S24BE_fuzzer-5071092206796800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 209b9ff5c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
c43e2980c7
avformat/bethsoftvid: Check image dimensions before use
...
Fixes: signed integer overflow: 55255 * 53207 cannot be represented in type 'int'
Fixes: 26387/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS2_fuzzer-5684222226071552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 50b29f081e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
cd158183e2
avformat/genh: Check block_align for how it will be used in SDX2_DPCM
...
Fixes: signed integer overflow: 19922944 * 1024 cannot be represented in type 'int'
Fixes: 26402/clusterfuzz-testcase-minimized-ffmpeg_dem_VMD_fuzzer-5745470053548032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c95b47e18f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
0303836e31
avformat/au: Check for EOF in au_read_annotation()
...
Fixes: Timeout (too looong -> 1 ms)
Fixes: 26366/clusterfuzz-testcase-minimized-ffmpeg_dem_SDX_fuzzer-5655584843759616
Fixes: 26391/clusterfuzz-testcase-minimized-ffmpeg_dem_ALP_fuzzer-5484026133217280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e680d50eb4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
dcb461aef5
avformat/segafilm: Do not assume AV_CODEC_ID_NONE is 0
...
Suggested-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d34e4904cd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
7d539878ca
avformat/segafilm: Check that there is a stream
...
Fixes: assertion failure
Fixes: 26472/clusterfuzz-testcase-minimized-ffmpeg_dem_SEGAFILM_fuzzer-5759751591559168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c0d7fd269b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
4a9b5ec1e8
avformat/wtvdec: Check dir_length
...
Fixes: Infinite loop
Fixes: 26445/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5125558331244544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1868cb7316 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
bb7ad5c128
avcodec/exr: Check limits to avoid overflow in delta computation
...
Fixes: signed integer overflow: 553590816 - -2145378049 cannot be represented in type 'int'
Fixes: 26315/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5938755121446912
Fixes: 26340/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5644316208529408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6910e0f4e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
907cfa45bb
avformat/boadec: Check that channels and block_align are set
...
Fixes: Infinite loop
Fixes: 26381/clusterfuzz-testcase-minimized-ffmpeg_dem_BOA_fuzzer-5745789089087488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 44ff5a1bff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
2912ec5909
avformat/asfdec_f: Check name_len for overflow
...
Fixes: signed integer overflow: -1172299744 * 2 cannot be represented in type 'int'
Fixes: 26258/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5672758488596480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0d088a47ca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
6d69eaa0a6
avcodec/h264idct_template: Fix integer overflow in ff_h264_chroma422_dc_dequant_idct()
...
Fixes: signed integer overflow: 241173056 + 1953511200 cannot be represented in type 'int'
Fixes: 26086/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5068366420901888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d198362839 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
517b62a5a9
avcodec/aacdec_fixed: Limit index in vector_pow43()
...
Fixes: out of array access
Fixes: 26087/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5724825462767616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f83a53638 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
be635d2bfb
avformat/rmdec: sanity check coded_framesize
...
Fixes: signed integer overflow: -14671840 * 8224 cannot be represented in type 'int'
Fixes: 24793/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5101884323659776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aee8477c6b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
26bda210ee
avformat/flvdec: Check for EOF in amf_parse_object()
...
Fixes: Timeout (too long -> 1ms)
Fixes: 26108/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5653887668977664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 33624f4f2e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
a73090f2e1
avcodec/smacker: Check remaining bits in SMK_BLK_FULL
...
Fixes: out of array access
Fixes: 26047/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKER_fuzzer-5083031667474432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 42ded4d1e6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
9190bd717b
avcodec/cook: Check subpacket index against max
...
Fixes: off by 1 error
Fixes: index 5 out of bounds for type 'COOKSubpacket [5]'
Fixes: 25772/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5762459498184704.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5a2a7604da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
49492d6ce9
avcodec/hevcpred_template: Fix diagonal chroma availability in 4:2:2 edge case in intra_pred
...
Fixes: pixel decode issue.ts
Fixes: raw frame.hevc
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3fbf873792 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
99f6a8ed8a
avformat/icodec: Change order of operations to avoid NULL dereference
...
Fixes: SEGV on unknown address 0x000000000000
Fixes: 26379/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-5709011753893888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3300f5c133 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
feab2fb911
avcodec/exr: Fix overflow with many blocks
...
Fixes: signed integer overflow: 1073741827 * 8 cannot be represented in type 'int'
Fixes: 25621/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6304841641754624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7265b7d904 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
4a6d3375c3
avcodec/vp9dsp_template: Fix integer overflows in idct16_1d()
...
Fixes: signed integer overflow: -190760 * 11585 cannot be represented in type 'int'
Fixes: 25471/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5743354917421056
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 394e8bb385 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
e2e1d13191
avcodec/ansi: Check initial dimensions
...
Fixes: Timeout (minutes to less than 1sec)
Fixes: 25682/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ANSI_fuzzer-6320712032452608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 949f0a6be9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
df983bd5e6
avcodec/hevcdec: Check slice_cb_qp_offset / slice_cr_qp_offset
...
Fixes: signed integer overflow: 29 + 2147483640 cannot be represented in type 'int'
Fixes: 25413/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5697909331591168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 106f11f68a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
d09bc9fe7f
avcodec/sonic: Check for overread
...
Fixes: Timeout (too long -> 1.3 sec)
Fixes: 24358/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5107284099989504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eeabdef1bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
2659b0f180
avformat/subviewerdec: fail on AV_NOPTS_VALUE
...
Such values are not supported by ff_subtitles_queue*
Fixes: signed integer overflow: 10 - -9223372036854775808 cannot be represented in type 'long'
Fixes: 24193/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5714901855895552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b7f51428b1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
ff531c345c
avcodec/exr: Check line size for overflow
...
Fixes: signed integer overflow: 570425356 * 6 cannot be represented in type 'int
Fixes: 25929/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5099197739827200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9b72cea446 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
c4c59c19c2
avcodec/exr: Check xdelta, ydelta
...
Fixes: assertion failure
Fixes: 25617/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5648746061496320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6949df35d0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
18967c9784
avcodec/celp_filters: Avoid invalid negation in ff_celp_lp_synthesis_filter()
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 25675/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G729_fuzzer-4786580731199488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 11a6347f9e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
6d9a3bb1df
avcodec/takdsp: Fix negative shift in decorrelate_sf()
...
Fixes: left shift of negative value -4
Fixes: 25723/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-6250580752990208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f54f53003 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
d9b610ee71
avcodec/dxtory: Fix negative stride shift in dx2_decode_slice_420()
...
Fixes: left shift of negative value -640
Fixes: 26044/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXTORY_fuzzer-5631057602543616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3291d994b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
ef3fee893d
avformat/asfdec_f: Change order or operations slightly
...
Fixes: signed integer overflow: 20 * 5184056935931942919 cannot be represented in type 'long'
Fixes: 25466/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4798660247552000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 686f015190 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
67c5f747d1
avformat/dxa: Use av_rescale() for duration computation
...
Fixes: signed integer overflow: 8224000000 * 1629552639 cannot be represented in type 'long'
Fixes: 24908/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4658478506049536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c313089fbe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
13c542795e
avcodec/vc1_block: Fix integer overflow in ac value
...
Fixes: signed integer overflow: 25488 * 87381 cannot be represented in type 'int'
Fixes: 24765/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5108259565076480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3056e19e68 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
6c8dd66977
avformat/iff: Check data_size not overflowing int64
...
Fixes: Infinite loop
Fixes: 25844/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5660803318153216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 24352ca792 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
b2a793369b
avcodec/dxtory: Fix negative shift in dx2_decode_slice_410()
...
Fixes: left shift of negative value -768
Fixes: 25574/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXTORY_fuzzer-6012596027916288
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit abebd87764 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
dcf59c522c
avcodec/sonic: Check channels before deallocating
...
Fixes: heap-buffer-overflow
Fixes: 25744/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5172961169113088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f249981976 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
6c9f2d9ef4
avcodec/ansi: Check nb_args for overflow
...
Fixes: Integer overflow (no testcase)
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc0e776c9a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
0f280bb038
avcodec/diracdsp: Fix integer anomaly in dequant_subband_*
...
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: 23760/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-604209011412172
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ca3c6c981a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
fb2f9fd67d
avutil/fixed_dsp: Fix integer overflows in butterflies_fixed_c()
...
Fixes: signed integer overflow: 0 - -2147483648 cannot be represented in type 'int'
Fixes: 23646/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5480991098667008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a02ae49c2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
0d0a60070f
avcodec/wmalosslessdec: Check remaining space before padding and channel residue
...
Fixes: Timeout (1101sec -> 0.4sec)
Fixes: 24491/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5725337036783616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c467adf3bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
98c1938fa9
avformat/cdg: Fix integer overflow in duration computation
...
Fixes: signed integer overflow: 8398407 * 300 cannot be represented in type 'int'
Fixes: 23914/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4702539290509312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa8935b395 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
c232e5e375
avcodec/mpc: Fix multiple numerical overflows in ff_mpc_dequantize_and_synth()
...
Fixes: -2.4187e+09 is outside the range of representable values of type 'int'
Fixes: signed integer overflow: -14512205 + -2147483648 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC7_fuzzer-5747263166480384
Fixes: 23528/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC7_fuzzer-5747263166480384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b9f39689a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
5dad9581f6
avformat/electronicarts: Check if there are any streams
...
Fixes: Assertion failure (invalid stream index)
Fixes: 25120/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6565251898933248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 39a98623ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
7a6863501b
avcodec/ffwavesynth: Fix integer overflow in wavesynth_synth_sample / WS_SINE
...
Fixes: signed integer overflow: -1429092 * -32596 cannot be represented in type 'int'
Fixes: 24419/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5157849974702080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a0da95df77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
9904e30c80
avcodec/vp9dsp_template: Fix integer overflow in iadst8_1d()
...
Fixes: signed integer overflow: 998938090 + 1169275991 cannot be represented in type 'int'
Fixes: 23411/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-4644692330545152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d182d8f10c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
59c25dd671
avformat/avidec: Fix io_fsize overflow
...
Fixes: signed integer overflow: 7958120835074169528 * 9 cannot be represented in type 'long long'
Fixes: 23382/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6230683226996736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf0c700b0c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
de5349f0cf
avcodec/cfhd: Check transform type
...
Fixes: out of array access
Fixes: 24823/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-4855119863349248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 659658d08b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
ea43ce9aa9
avcodec/tiff: Restrict tag order based on specification
...
"The entries in an IFD must be sorted in ascending order by Tag. Note that this is
not the order in which the fields are described in this document."
This way various dimensions, sample and bit sizes cannot be changed at
arbitrary times which reduces the potential for bugs.
The tag reading code also on various places assumes that numerically previous
tags have already been parsed, so this needs to be enforced one way or another.
If this commit causes problems with real world files which are not easy to fix
then some other form of checks are needed to ensure the various dependencies
in the tag reading are not violated.
Fixes: out of array access
Fixes: 24825/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-6326925027704832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ad29f9e47c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
ea12dd67ee
avformat/siff: Reject audio packets without audio stream
...
Fixes: Assertion failure
Fixes: 24612/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6600899842277376.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8931c55789 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
4052877612
avformat/mpeg: Check avio_read() return value in get_pts()
...
Found-by: Thierry Foucu <tfoucu@gmail.com >
Fixes: Use-of-uninitialized-value
Reviewed-by: Thierry Foucu <tfoucu@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e8a88a16f7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
190c2f40cf
avcodec/tiff: Check bpp/bppcount for 0
...
Fixes: division by zero
Fixes: 24253/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-6250318007107584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be090da25f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
4155510f74
avcodec/snowdec: Sanity check hcoeff
...
Fixes: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
Fixes: 24011/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5486376610168832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d51d569cf6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
475cfa1218
avformat/mov: Check comp_brand_size
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 24457/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5760093644390400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ffa6072fc7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
e9edf11076
avcodec/alac: Check decorr_shift to avoid invalid shift
...
Later the decorrelate_stereo call is guarded by channels == 2
and non-zero decorr_left_weight. Make sure decorr_shift is in
the expected shift range for that case.
Fixes: shift exponent 128 is too large for 32-bit type 'int'
Fixes: 23860/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5751138914402304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Alexander Strasser <eclipse7@gmx.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4333718b35 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
baeec0cba9
avcodec/tdsc: Fix tile checks
...
Fixes: out of array access
Fixes: crash.asf
Found-by: anton listov <greyfarn7@yandex.ru >
Reviewed-by: anton listov <greyfarn7@yandex.ru >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 081e3001ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Andreas Rheinhardt
d46b698478
avformat/mm: Check for existence of audio stream
...
No audio stream is created unconditionally and if none has been created,
no packet with stream_index 1 may be returned. This fixes an assert in
ff_read_packet() in libavformat/utils reported in ticket #8782 .
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit ec59dc73f0 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2021-09-11 21:23:48 +02:00
Zhao Zhili
a79700555f
avformat/mov: Fix unaligned read of uint32_t and endian-dependance in mov_read_default
...
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 806a4d5187 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
2a34d7476d
avcodec/apedec: Fix undefined integer overflow with 24bit
...
Fixes: signed integer overflow: 8683744 * 256 cannot be represented in type 'int'
Fixes: 23527/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5679885932822528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9f7b252cdf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
bd2c09a5c5
avcodec/loco: Fix integer overflow with large values from loco_get_rice()
...
Fixes: signed integer overflow: 155 + 2147483647 cannot be represented in type 'int'
Fixes: 23421/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5652849097965568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ddc5e1f3c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
a86e6a6a98
avformat/smjpegdec: Check the existence of referred streams
...
Fixes: Assertion failure
Fixes: 23758/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5160954605338624.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 321ea59dac )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Michael Niedermayer
fa3702fbaf
avcodec/pnmdec: Fix misaligned reads
...
Found-by: "Steinar H. Gunderson" <steinar+ffmpeg@gunderson.no >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea28ce9bc1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-09-11 21:23:48 +02:00
Timo Rothenpieler
8f5e16b5f1
avcodec/cuviddec: backport extradata fixes
2020-10-01 22:30:36 +02:00
Timo Rothenpieler
891a7c3765
avcodec/cuviddec: handle arbitrarily sized extradata
2020-09-30 14:22:36 +02:00
Jan Ekström
a6006fe047
avformat/tls_schannel: immediately return decrypted data if available
...
Until now, we would have only attempted to utilize already decrypted
data if it was enough to fill the size of buffer requested, that could
very well be up to 32 kilobytes.
With keep-alive connections this would just lead to recv blocking
until rw_timeout had been reached, as the connection would not be
officially closed after each transfer. This would also lead to a
loop, as such timed out I/O request would just be attempted again.
By just returning the available decrypted data, keep-alive based
connectivity such as HLS playback is fixed with schannel.
(cherry picked from commit 6f8826e4aa )
2020-09-04 20:46:29 +03:00
Jan Ekström
895f67bbed
avformat/tls_schannel: always decrypt all received data
...
The dec_buf seems to be properly managed between read calls,
and we have no logic to decrypt before attempting socket I/O.
Thus - until now - such data would not be decrypted in case of
connections such as HTTP keep-alive, as the recv call would
always get executed first, block until rw_timeout, and then get
retried by retry_transfer_wrapper.
Thus - if data is received - decrypt all of it right away. This way
it is available for the following requests in case they can be
satisfied with it.
(cherry picked from commit 39977fff20 )
2020-09-04 20:46:29 +03:00
Paweł Wegner
30891d0932
avformat/tls_schannel: Fix use of uninitialized variable
...
Fixes: runtime error: passing uninitialized value to FreeContextBuffer
causes a crash
Signed-off-by: Paweł Wegner <pawel.wegner95@gmail.com >
(cherry picked from commit 85c00643b7 )
2020-09-04 20:46:28 +03:00
Michael Niedermayer
567c20f781
Update for 3.4.8
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-03 12:05:27 +02:00
Andreas Rheinhardt
b66884f4aa
avcodec/hevc_mp4toannexb_bsf: Check NAL size against available input
...
The hevc_mp4toannexb bsf does not explicitly check whether a NAL unit
is so big that it extends beyond the end of the input packet; it does so
only implicitly by using the checked version of the bytestream2 API.
But this has downsides compared to real checks: It can lead to huge
allocations (up to 2GiB) even when the input packet is just a few bytes.
And furthermore it leads to uninitialized data being output.
So add a check to error out early if it happens.
Also check directly whether there is enough data for the length field.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit ea1b71e82f )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:04:06 +02:00
Andreas Rheinhardt
a3a2e782c2
lavf/webm_chunk: Fix NULL dereference
...
The earlier version of the webm_chunk muxer had several bugs:
1. If the first packet of an audio stream didn't have a PTS of zero,
then no chunk will be started before a packet is delivered to the
underlying Matroska/WebM muxer, i.e. the AVFormatContext used to write
these packets had a NULL as AVIOContext for output. This is behind the
crash in ticket #5752 .
2. If an error happens during writing a packet, the underlyimg
Matroska/WebM muxer context is freed. This leads to a use-after-free
coupled with a double-free in webm_chunk_write_trailer (which supposes
that the underlying AVFormatContext is still valid).
3. Even when no error occurs at all, webm_chunk_write_trailer is still
buggy: After the underlying Matroska/WebM muxer has written its trailer,
ending the chunk implicitly flushes it again which is illegal at this
point.
These bugs have been fixed.
Fixes #5752 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 8c6ee7626b )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:03:45 +02:00
Andreas Rheinhardt
d6d41db435
avcodec/ttaenc: Fix undefined shift
...
ttaenc contained (1 << unary) - 1 as an argument for a function
expecting an unsigned int. unary can be as big as 31 in this case.
The type of the shift and the whole expression is int, because 1 fits
into an integer, so that the behaviour is undefined if unary == 31
as the result of the shift can't be represented in an int §. Subtraction
by 1 (which makes the result of the whole expression representable in
an int) doesn't change that this is undefined (it usually leads to
signed integer overflow which is undefined, too).
The solution is simple: Make 1 unsigned to change the type of the
whole expression to unsigned int (as the function expects anyway).
Fixes ticket #8153 .
§: This of course presupposes the common int range of -2^31..2^31-1
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ab488a540 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:03:45 +02:00
Andreas Rheinhardt
ec43a80774
fftools/ffmpeg: Free swresample dictionary during cleanup
...
Freeing this was forgotten in ad899522 .
Fixes #8315 and #8316 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6f2a3958cf )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:03:45 +02:00
Andreas Rheinhardt
59b73dc1f3
avfilter/vf_xbr: Fix left shift of negative number
...
Affected every usage of vf_xbr, e.g. the FATE-tests filter-2xbr,
filter-3xbr, filter-4xbr.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4294dc3589 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:03:45 +02:00
Andreas Rheinhardt
9eeef68b50
avfilter/vf_hqx: Fix undefined left shifts of negative numbers
...
Affected every usage of this filter; in particular, it affected the
FATE-tests filter-2xbr, filter-3xbr and filter-4xbr.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fa21194326 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:03:45 +02:00
Andreas Rheinhardt
5367c91e02
avcodec/jpeg2000dwt: Fix undefined shifts of negative numbers
...
Affected the vsynth*-jpeg2000 and the vsynth*-jpeg2000-97 FATE tests
(where * ranges over { 1, 2, 3, _lena }) as well as ticket #7983 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5cf593adcd )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:03:45 +02:00
Andreas Rheinhardt
2faaf92e3f
avcodec/ituh263dec: Fix undefined left shift of negative number
...
Fixes ticket #8160 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 324487b596 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:03:45 +02:00
Andreas Rheinhardt
d9ceecc51f
avcodec/dnxhdenc: Fix undefined left shifts of negative numbers
...
Affected 61 FATE-tests: 60 vsynth tests and lavf-mxf_opatom.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b7f156e8cb )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:03:45 +02:00
Andreas Rheinhardt
188a773d0f
swscale/utils: Fix invalid left shifts of negative numbers
...
Affected the FATE-tests vsynth_lena-dv-411, vsynth1-dv-411,
vsynth2-dv-411 and hevc-paramchange-yuv420p.yuv420p10.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e2646e23be )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:03:45 +02:00
Andreas Rheinhardt
9ed82df0f3
swscale/x86/swscale: Fix undefined left shifts of negative numbers
...
This affected many FATE-tests: The number of failing tests went down
from 663 to 344. (Both numbers exclude tests that failed because of
unaligned accesses in code that is inside #if HAVE_FAST_UNALIGNED.)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 736c7c20e7 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:03:44 +02:00
Andreas Rheinhardt
00d98fa057
avcodec/exr: Fix undefined left shifts of negative numbers
...
Affected the FATE-tests exr-rgb-scanline-pxr24-half-uint32-13x9 and
exr-rgb-scanline-pxr24-uint32.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b0f949906 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:03:44 +02:00
Andreas Rheinhardt
e1577085a9
avformat/movenc: Fix undefined shift
...
Fixes the movenc FATE-test.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 646799b42f )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:03:44 +02:00
Andreas Rheinhardt
8c49f5715c
avcodec/pcm: Fix undefined shifts
...
Fixes the acodec-pcm-u16[lb]e FATE-tests.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 69473bec6f )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:03:44 +02:00
Andreas Rheinhardt
7a6c286d1f
avcodec/wavpackenc: Fix undefined shifts
...
Fixes ticket #8161 and the acodec-wavpack FATE-test.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 84974c6fb5 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:03:44 +02:00
Andreas Rheinhardt
d4824eec3b
avcodec/ac3enc: Fix invalid shift
...
Fixes the FATE-tests unknown_layout-ac3, ac3-fixed-encode, ac3-encode
and eac3-encode. It furthermore fixes the ac3-encoder bugs mentioned in
tickets #7994 , #8144 and #8159 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f289ec914 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:03:44 +02:00
Andreas Rheinhardt
aed40628d4
avcodec/tdsc: Fix undefined shifts
...
Fixes the tdsc FATE-test.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 86bef10e7a )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:03:44 +02:00
Andreas Rheinhardt
00e52eff65
fftools/ffmpeg_opt: Fix signed integer overflow
...
Fixes ticket #8154 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b1fcba8dd )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:02:25 +02:00
Andreas Rheinhardt
d925a11a80
avformat/mov: Fix reel_name size check
...
Only read str_size bytes from offset 30 of extradata if the extradata is
indeed at least 30 + str_size bytes long.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit ff3fad6b0e )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:02:15 +02:00
Andreas Rheinhardt
62cf20e0eb
avformat/mov: Fix memleak upon encountering repeating tags
...
mov_read_custom tries to read three strings belonging to three different
tags. When an already encountered tag is encountered again, a new buffer
for the string to be read is allocated and stored in the pointer
destined for this particular tag. But in this scenario, said pointer
already holds the address of the string read earlier, leading to a leak.
This commit therefore aborts the reading process upon encountering
an already encountered tag.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit dfef1d5e3c )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:02:14 +02:00
Andreas Rheinhardt
961f21ffba
avformat/matroskaenc: Don't use NULL for %s format string
...
The argument pertaining to a printf %s conversion specifier must not
be NULL, even if the precision (i.e. the number of characters to write)
is zero. If it is NULL, it is undefined behaviour.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 6de6ce7bc8 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:02:14 +02:00
Andreas Rheinhardt
5b4b24b4c0
avformat/webvttdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit c784fe8b86 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:02:14 +02:00
Andreas Rheinhardt
1bd3683a41
avformat/vplayerdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 67434afa7f )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:02:14 +02:00
Andreas Rheinhardt
2dcc447410
avformat/tedcaptionsdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if allocating the AVStream for the subtitles fails.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 337783b118 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:02:14 +02:00
Andreas Rheinhardt
b429a8e13f
avformat/subviewerdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit a708f65273 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:02:14 +02:00
Andreas Rheinhardt
db23ea60ef
avformat/subviewer1dec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 9751d75152 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:02:14 +02:00
Andreas Rheinhardt
f596a73255
avformat/stldec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit e13874b9ea )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:02:14 +02:00
Andreas Rheinhardt
280f6bcddd
avformat/srtdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit c70409957c )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:02:13 +02:00
Andreas Rheinhardt
abf63fef43
avformat/sccdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit f3c63e67bb )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:02:13 +02:00
Andreas Rheinhardt
97e3d91f4d
avformat/samidec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle
or when creating extradata.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit f161f8e4ad )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:02:13 +02:00
Andreas Rheinhardt
7b5f24a142
avformat/pjsdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 9df560e898 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:02:13 +02:00
Andreas Rheinhardt
d3dab0886f
avformat/mpsubdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon creating an AVStream.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit a5ed8aeea4 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:02:13 +02:00
Andreas Rheinhardt
036c52f2d6
avformat/mpl2dec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 331799747e )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:02:13 +02:00
Andreas Rheinhardt
a7309ecc32
avformat/microdvddec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle
or when allocating extradata.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit b12014a5b8 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:02:13 +02:00
Andreas Rheinhardt
9b021e24f7
avformat/lrcdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit d38694cea9 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:02:13 +02:00
Andreas Rheinhardt
bde71f0c9b
avformat/jacosubdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit c13a752733 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:02:13 +02:00
Andreas Rheinhardt
91016727dc
avformat/assdec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle
or if creating the extradata failed.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 5ab39c2d8c )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:02:12 +02:00
Andreas Rheinhardt
58fd406e27
avformat/aqtitledec: Fix memleak upon read header failure
...
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit a86a5d06d8 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:02:12 +02:00
Andreas Rheinhardt
9e404b60b1
avformat/mov: Fix memleaks upon read_header failure
...
By default, a demuxer's read_close function is not called automatically
if an error happens when reading the header; instead it is up to the
demuxer to clean up after itself in this case. The mov demuxer did this
by calling its read_close function when it encountered some errors when
reading the header. Yet for other errors (mostly adding side-data to
streams) this has been forgotten, so that all the internal structures
of the demuxer leak.
This commit fixes this by making sure mov_read_close is called when
necessary.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit ac378c535b )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-03 00:02:07 +02:00
Andreas Rheinhardt
2e68c8442f
avformat/omadec: Fix memleaks upon read_header failure
...
Fixes possible leaks of id3v2 metadata as well as an AVDES struct in
case the content is encrypted and an error happens lateron.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 3d3ba43bc6 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:58:21 +02:00
Andreas Rheinhardt
7230f09866
avformat/matroskadec: Fix memleaks in WebM DASH manifest demuxer
...
In certain error scenarios, the underlying Matroska demuxer was not
properly closed, causing leaks.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 0841063ce6 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:58:21 +02:00
Andreas Rheinhardt
9a72122a98
avformat/matroskadec: Use right number of tracks
...
When demuxing a Matroska/WebM file, streams are added for tracks and for
attachments, so that the array containing the former can be NULL even
when the corresponding AVFormatContext has streams. So check for there
to be tracks in the MatroskaDemuxContext instead of just streams in the
AVFormatContext before dereferencing the pointer to the tracks.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 1ef30571a0 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:58:21 +02:00
Andreas Rheinhardt
86a30618c9
avformat/matroskadec: Fix handling gigantic durations
...
matroska_parse_block currently asserts that the duration is not equal to
AV_NOPTS_VALUE, but there is nothing that actually guarantees this. It
is easy to create (spec-compliant) files which run into this assert;
so replace it and instead cap the duration to INT64_MAX, as the duration
field of an AVPacket is an int64_t.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 3714d452b8 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:58:21 +02:00
Andreas Rheinhardt
6132ea3daf
avformat/aviobuf: Don't check for overflow after it happened
...
If adding two ints overflows, it doesn't matter whether the result will
be stored in an unsigned or not; and checking afterwards does not make it
retroactively defined.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 28a078eded )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:56:13 +02:00
Andreas Rheinhardt
b7d11cc6e8
avformat/matroskaenc: Fix memleak upon encountering bogus chapter
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit cb255b616c )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:56:13 +02:00
Andreas Rheinhardt
32467cfc07
fftools/ffmpeg_opt: Check attachment filesize
...
The data of an attachment file is put into an AVCodecParameter's
extradata. The corresponding size field has type int, yet there was no
check for the size to fit into an int. As a consequence, it was possible
to create extradata with negative size (by using a big enough max_alloc).
Other errors were also possible: If SIZE_MAX < INT64_MAX (e.g. on 32bit
systems) then the file size might be truncated before the allocation;
and avio_read() takes an int, too, so one would not have read as much
as one desired.
Furthermore, the extradata is now padded as is required.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 889ad93c88 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:56:13 +02:00
Andreas Rheinhardt
a7e278e467
avformat/webmdashenc: Check codec types
...
The WebM DASH Manifest muxer only supports VP8, VP9, Vorbis and Opus,
but there was no check for this. The codec type is used to get a pointer
to a string containing the codec name or NULL if it is not one of those
four codecs. Said pointer has then been used without further checks as
string for the %s conversion specifier in an avio_printf()) call which
is undefined behaviour.
This commit adds a check for the supported codec types.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit cbea58b2b3 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:56:13 +02:00
Andreas Rheinhardt
c4c3d3bc1d
avformat/avidec: Fix memleak with embedded GAB2 subtitles
...
The code for GAB2 subtitles predates refcounting AVPackets. So in order
to transfer the ownership of a packet's data pkt->data was simply stored
and the packet zeroed; in the end (i.e. in the read_close-function) this
data was then simply freed with av_freep(). This of course leads to a leak
of an AVBufferRef and an AVBuffer. It has been fixed by keeping and
eventually unreferencing the packet's buf instead.
Additionally, the packet is now reset via av_packet_unref().
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit da44bbefaa )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:56:13 +02:00
Andreas Rheinhardt
f34d5ab876
avformat/webmdashenc: Fix memleak upon realloc failure
...
The classical ptr = av_realloc(ptr, size).
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 418e468699 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:56:13 +02:00
Andreas Rheinhardt
9d1d4ba63e
avformat/matroskadec: Don't discard the upper 32bits of TrackNumber
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit ba36a07734 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:56:13 +02:00
Andreas Rheinhardt
766b1b6a25
avformat/hnm: Check for extradata allocation failure
...
and also add padding to it; moreover, don't use memcpy to write one byte
to extradata.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e0f3352d1 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:56:12 +02:00
Andreas Rheinhardt
d001c06f82
avformat/subtitles: Don't increment packet counter prematurely
...
Do it only if the packet has been successfully allocated in
av_new_packet() -- otherwise on error a completely uninitialized packet
would be unreferenced later.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6bd8bcc2ac )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:56:12 +02:00
Andreas Rheinhardt
97e0ff9793
avformat/bethsoftvid: Fix potential memleak upon reallocation failure
...
The classical ptr = av_realloc(ptr, size), just with av_fast_realloc().
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5acef12061 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:56:12 +02:00
Andreas Rheinhardt
d7fa4cadea
avformat/smoothstreaming: Fix memleaks on errors
...
If an AVFormatContext could be allocated, but white-/blacklists couldn't
be copied, the AVFormatContext would leak as it was only accessible
through a local variable that goes out of scope when one goes to fail.
Furthermore, in case writing a header of a submuxer failed, the options
used for said call could leak.
Both of these memleaks have been fixed.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit abbb466368 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:56:12 +02:00
Andreas Rheinhardt
94ca3a00c8
avformat/matroskaenc: Check BlockAdditional size before use
...
Don't read a 64bit number before having checked that the data is at
least 8 bytes long.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6e9cc96429 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:56:12 +02:00
Andreas Rheinhardt
4ed977bbe5
avformat/utils: Fix memleaks in avformat_open_input()
...
A demuxer might have allocated memory while reading the header. If
reading the header was successfull and an error happens before returning
(e.g. when queueing the attached pictures), the read_close function
would have never been called, so that all those allocations would leak.
This commit changes this.
Furthermore, there would be even more memleaks if the error level was
set to AV_EF_EXPLODE in case there is both metadata and id3v2 metadata.
This has been fixed, too.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit e2307f4ff1 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:56:07 +02:00
Andreas Rheinhardt
0c104fc424
avcodec/cavsdsp: Fix undefined left shifts of negative numbers
...
Affected the ffmpeg-filter_colorkey FATE-test (but only if the C version
of idct8_add is used and not e.g. the x86 SSE2 version).
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Fixes: left shift of negative value -107
Fixes: 20398/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5725389278412800
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0f0f2ab0c3 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:51:10 +02:00
Andreas Rheinhardt
826c929751
avformat/hevc: Fix potential leak in case of ff_hevc_annexb2mp4_buf failure
...
ff_hevc_annexb2mp4_buf() could indicate an error, yet leave cleaning
after itself to the caller, so that a caller could not simply return the
error, but had to free the buffer first.
(Given that all current callers have set filter_ps = 0, this error can
currently not be triggered.)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 680cd59bb2 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:44:51 +02:00
Andreas Rheinhardt
e66185eaef
avformat/matroskaenc: Check for reformatting errors
...
This is needed especially for AV1: If a reformatting error happens (e.g.
if the length field of an OBU contained in the current packet indicates
that said OBU extends beyond the current packet), the data pointer is
still NULL, yet the size is unchanged, so that writing the data leads
to a segmentation fault.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 58428bef4b )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:44:51 +02:00
Andreas Rheinhardt
4374da638e
avcodec/ra144enc: Fix invalid left shift of negative number
...
by replacing it with a multiplication. Said multiplication can't
overflow an int32_t because lpc_coefs is limited to 16 bit precision.
Fixes the FACE-test acodec-ra144 as well as part of #8217 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e3fb9af6f1 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:44:51 +02:00
Andreas Rheinhardt
30cf495505
avcodec/adxenc: Avoid undefined left shift of negative numbers
...
Replace "((a << shift) + b) >> shift" by "a + (b >> shift)". This avoids
a left shift which also happens to trigger undefined behaviour in case "a"
is negative. This affected the FATE-tests acodec-adpcm-adx and
acodec-adpcm-adx-trellis; it also fixes ticket #8008 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 59a9d65e0d )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:44:51 +02:00
Andreas Rheinhardt
040a93fe0a
avcodec/adpcm: Fix undefined left shifts of negative numbers
...
Affected the adpcm-afc, adpcm-ea-1, adpcm-ea-2, adpcm-ea-maxis-xa,
adpcm-thp and ea-cdata FATE-tests. Also fixes ticket #8487 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ad8af51b7 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:44:50 +02:00
Andreas Rheinhardt
7d51f4d891
avcodec/proresenc_anatoliy: Fix invalid left shift of negative number
...
This fixes ticket #7997 as well as the vsynth*-prores_# FATE-tests
(where * ranges over { 1, 2, 3, _lena } and # over { , _int, _444,
_444_int }).
(Given that prev_dc is in the range -0xC000..0x3FFF, no overflow can
happen upon multiplication with 2.)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 198081efb7 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:44:23 +02:00
Andreas Rheinhardt
f078e40282
avformat/wtvdec: Fix memleak when reading header fails
...
Fixes #8314 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 373c1c9b69 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:44:23 +02:00
Andreas Rheinhardt
674cbe52e9
avformat/fitsdec: Fix potential leak of string in AVBPrint
...
by freeing it a bit earlier.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bb20f3dd73 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:44:23 +02:00
Zhao Zhili
2766061901
avformat/mov: fix memleaks
...
Fix two cases of memleaks:
1. The leak of dv_demux
2. The leak of dv_fctx upon dv_demux allocate failure
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit f3dc38a186 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:34:54 +02:00
Andreas Rheinhardt
41a3aab5da
libavformat/mov: Fix memleaks when demuxing DV audio
...
The code for demuxing DV audio predates the introduction of refcounted
packets and when the latter was added, changes to the former were
forgotten. This meant that when avpriv_dv_produce_packet initialized the
packet containing the AVBufferRef, the AVBufferRef as well as the
underlying AVBuffer leaked; the actual packet data didn't leak: They
were directly freed, but not via their AVBuffer's free function.
https://samples.ffmpeg.org/ffmpeg-bugs/trac/ticket4671/dir1.tar.bz2
contains samples for this (enable_drefs needs to be enabled for them).
Moreover, errors in avpriv_dv_produce_packet were ignored; this has been
changed, too.
Furthermore, in the hypothetical scenario that the track has a palette,
this would leak, too, so reorder the code so that the palette code
appears after the DV audio code.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 61f5c6ab06 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 23:08:44 +02:00
Andreas Rheinhardt
660c42ca19
avcodec/bitstream: Don't check for undefined behaviour after it happened
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 5e196dac22 )
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
2020-07-02 22:48:32 +02:00
Michael Niedermayer
5b8e98c0d5
avcodec/dstdec: Replace AC overread check by sample rate check
...
Real files do skip coding 0 bits at the end, thus this kind of check
does not work reliable.
Fixes: Ticket 8770
Fixes: dst-256fs44-6ch-refdstencoder.dff
The samplerate is specified in ISO/IEC 14496-3:2005(E) as one of 3 fixed
values, this also can be used to limit the duration and avoid the timeout
This reverts commit f6df99dba1 .
(cherry picked from commit 1679f23beb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
2a4edfd64c
avformat/utils: reorder duration computation to avoid overflow
...
Fixes: signed integer overflow: 8 * 9223372036854774783 cannot be represented in type 'long'
Fixes: 23381/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4818340509122560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 10cc82c35b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
6674fb44f1
avcodec/pngdec: Check for fctl after idat
...
Fixes: out of array access
Fixes: 23554/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-4796622520451072.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65b1ba680f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
21ce988f98
avformat/hls: Pass a copy of the URL for probing
...
The segments / url can be modified by the io read when reloading
This may be an alternative or additional fix for Ticket8673
as a further alternative the reload stuff could be disabled during
probing
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5e39880fb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Steven Liu
bd09c9d46c
avformat/hls: check segment duration value of EXTINF
...
fix ticket: 8673
set the default EXTINF duration to 1ms if duration is smaller than 1ms
Signed-off-by: Steven Liu <lq@chinaffmpeg.org >
(cherry picked from commit 9dfb19baeb )
2020-07-02 19:55:10 +02:00
Michael Niedermayer
12c61c2fda
avutil/common: Fix integer overflow in av_ceil_log2_c()
...
Fixes: left shift of 1913647649 by 1 places cannot be represented in type 'int'
Fixes: 23572/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5082619795734528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e409262837 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
f8f2629b4e
avcodec/wmalosslessdec: fix overflow with pred in revert_cdlms
...
Fixes: signed integer overflow: 2048 + 2147483646 cannot be represented in type 'int'
Fixes: 23538/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5227567073460224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 21598d711d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
9953671609
avformat/mvdec: Fix integer overflow with billions of channels
...
Fixes: signed integer overflow: 1394614304 * 2 cannot be represented in type 'int'
Fixes: 23491/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5697377020411904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b6fbbe08c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
3d888131d1
avformat/microdvddec: skip malformed lines without frame number.
...
Fixes: signed integer overflow: 1 - -9223372036854775808 cannot be represented in type 'long'
Fixes: 23490/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5133490093031424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8fb7612a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
73a41531e5
avformat/mxfdec: free duplicated utf16 strings
...
Fixes: memleak
Fixes: 23415/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5124814510751744
Suggested-by: Marton Balint <cus@passwd.hu >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0aa2768cb2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
2e3f6afda5
avformat/4xm: Check that a video stream was created before returning packets for it
...
Fixes: assertion failure
Fixes: 23434/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5227750851084288.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c517c3f474 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
bd103bd3fe
avcodec/ffwavesynth: Avoid undefined operation on ts overflow
...
Alternatively these conditions could be treated as errors
Fixes: 23147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5639254549200896
Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'int64_t' (aka 'long')
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 584d334afd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
d9629dcd5d
avcodec/mpeg4videodec: Fix 2 integer overflows in get_amv()
...
Fixes: signed integer overflow: -144876608 * 16 cannot be represented in type 'int'
Fixes: 22782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-6039584977977344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e361785ee0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
b27f530916
avcodec/lossless_audiodsp: Fix undefined overflows in scalarproduct_and_madd_int16_c()
...
Fixes: signed integer overflow: 2142077091 + 6881070 cannot be represented in type 'int'
Fixes: 22737/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5958388889681920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c0dfe134be )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
78c0117119
avcodec/sonic: Fix several integer overflows
...
Fixes: signed integer overflow: 2129689466 + 2129689466 cannot be represented in type 'int'
Fixes: 20715/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5155263109922816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 75d520e337 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
2f25de29cf
avcodec/pixlet: Fix log(0) check
...
Fixes: passing zero to clz(), which is not a valid argument
Fixes: 23337/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PIXLET_fuzzer-5179131989065728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bd0f81526d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
91f56dc647
avcodec/iff: Fix off by x error
...
Fixes: out of array access
Fixes: 23245/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5723121327013888.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 51225dee0a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
58997137b4
avcodec/wmalosslessdec: Check block_align maximum
...
Fixes: Assertion failure
Fixes: 22737/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5958388889681920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 314d10f7a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
9765341d64
avcodec/loco: Fix signed integer overflow in loco_get_rice()
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 22975/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5658160970072064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa88cdfd90 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
685a7d6718
avformat/thp: Check fps
...
Fixes: division by zero
Fixes: 23162/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4856420817436672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e15b01b4e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
54b8ce27f4
avformat/mpl2dec: Fix integer overflow with duration
...
Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented in type 'long'
Fixes: 23167/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6425051741290496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9a42a67c5c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
248048d53f
avcodec/mpeg12dec: remove outdated comments
...
Found-by: Kieran
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 48de8f5816 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
06298dbe8f
avcodec/snowdec: Avoid integer overflow with huge qlog
...
Fixes: integer overflow
Fixes: 22285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5682428762128384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38fbf33c72 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Dale Curtis
39a986a5c2
avformat/mov: Check if DTS is AV_NOPTS_VALUE in mov_find_next_sample().
...
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf446711bc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
e30f9de087
avcodec/mpeg12dec: Fix got_output
...
This makes got_output consistent with the code in slice_end() which sets the output
in slice_end()
if (s->pict_type == AV_PICTURE_TYPE_B || s->low_delay) {
int ret = av_frame_ref(pict, s->current_picture_ptr->f);
...
} else {
Fixes: assertion failure
Fixes: 22178/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5664234440753152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f33a9803a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
794d40a500
avformat/4xm: Cleanup on GET_LIST_HEADER() failure
...
Fixes: memleak
Fixes: 23142/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5932860820422656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5313ce654 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:10 +02:00
Michael Niedermayer
7ba0435959
avcodec/lzf: Consider the needed size in reallocation
...
Fixes: NULL pointer dereference
Fixes: 22381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-5659879921680384.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 292b9b93a5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
9718178930
avformat/mlvdec: fail reading a packet with 0 streams
...
Fixes: NULL pointer dereference
Fixes: 22604/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5667739074297856.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5bd5c31087 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
d46f466bb7
avformat/thp: Check compcount
...
Fixes: out of array access
Fixes: 22520/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5100297658826752
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1ba8484559 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
33b0592bfe
avcodec/adpcm: XA: Check shift similar to filter
...
Fixes: negative shift
Fixes: 22499/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_XA_fuzzer-5765452130418688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6d96bae9c4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
2f51ee968c
avcodec/huffyuvdec: Test vertical coordinate more often
...
Fixes: out of array access
Fixes: 22892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-5135996772679680.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1223ddc56 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
6f6066ef09
avcodec/hq_hqa: Check info size
...
Fixes: assertion failure
Fixes: 21079/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-5737046523248640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf28521fee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
762daa3975
avcodec/wmalosslessdec: Fix integer overflow in mclms_predict()
...
Fixes: signed integer overflow: 2147483636 + 2048 cannot be represented in type 'int'
Fixes: 22016/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5109395618004992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c42ed06695 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
0f39caec99
avcodec/vp9dsp_template: Fix integer overflow(s) in iadst16_1d()
...
Fixes: signed integer overflow: 1080285923 - -1130879337 cannot be represented in type 'int'
Fixes: 22002/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-6260237310099456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 071e293723 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
d36e98b072
avcodec/h264dec: Disable forced small_padding on flag2 fast
...
Fixes: 20978/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5746381832847360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
d08b1cec2c
avformat/oggparsevorbis: Error out on double init of vp
...
Fixes: memleak
Fixes: 19949/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5743636058210304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2a3bbc0086 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
9798000199
avcodec/pnmdec: Use unsigned for maxval rescaling
...
Fixes: signed integer overflow: 65535 * 55335 cannot be represented in type 'int'
Fixes: 21955/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-5669206981083136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 49459aca47 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
f568530573
avcodec/ivi: Clear got_p_frame before decoding a new frame using it
...
Fixes: assertion failure
Fixes: 21666/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-5706468994318336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1d633e6a0a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
e1f9f5168b
avcodec/dsddec: Check channels
...
Fixes: division by zero
Fixes: 21677/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DSD_MSBF_fuzzer-5712547983654912
Fixes: 21751/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DSD_LSBF_fuzzer-5197097180856320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2570a8777e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
a8b61aaa11
avcodec/xvididct: Fix integer overflow in idct_row()
...
Fixes: signed integer overflow: -1238335488 + -1003634688 cannot be represented in type 'int'
Fixes: 21649/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5112005765890048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 620236e4d2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
af354a91d3
avcodec/wmalosslessdec: Fix integer overflows in revert_inter_ch_decorr()
...
Fixes: signed integer overflow: -717241856 + -1434459904 cannot be represented in type 'int'
Fixes: 21405/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5677143666458624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e9a4c4fe99 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
738e284ff9
avformat/mpegenc: Fix integer overflow with AV_NOPTS_VALUE
...
Fixes: signed integer overflow: -9223372036854775808 - 45000 cannot be represented in type 'long'
Fixes: ticket8187
Found-by: Suhwan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9874815b1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
4dd9ae41a2
avformat/swfenc: Fix integer overflow in frame rate handling
...
Fixes: signed integer overflow: 30000299 * 256 cannot be represented in type 'int'
Fixes: ticket8184
Found-by: Suhwan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 31f956acad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
42d2468ce4
avformat/aadec: Check toc_size to contain the minimum to demuxer uses
...
Fixes: out of array access
Fixes: stack-buffer-overflow-READ-0x0831fff1
Found-by: GalyCannon <galycannon@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit daa2482871 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Dale Curtis
c9672ca363
avformat/mov: Don't allow negative sample sizes.
...
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d8d554f15 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Vitaly Buka
34c4c9114c
mpeg4videoenc: Don't crash with -fsanitize=bounds
...
Also the patch makes this code consistent with mpeg4videodec.c
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f163d30de2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
57ef3712d7
avformat/mpegts: Shuffle avio_seek
...
This avoids accessing an old, no longer valid buffer.
Fixes: out of array access
Fixes: crash_audio-2020
Found-by: le wu <shoulewoba@gmail.com >
Reviewed-by: Marton Balint <cus@passwd.hu >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cd74af1416 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
4077647a8f
avcodec/binkaudio: Fix 2Ghz sample_rate
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 19950/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINKAUDIO_DCT_fuzzer-5765514337189888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Paul
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f603d10b1e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
5e4238c3fd
avcodec/adpcm: Fix integer overflow in ADPCM THP
...
The reference (thp.txt) uses floats so wrap around would seem incorrect.
Fixes: signed integer overflow: 1073741824 + 1073741824 cannot be represented in type 'int'
Fixes: 20658/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_THP_fuzzer-5646302555930624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b12b05374f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
68ecaacbac
avcodec/ralf: Check num_blocks before use
...
Fixes: out of array access
Fixes: 20659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5739471895265280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f0c0471075 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
9aaf2c77db
avcodec/iff: Test video_size being non zero
...
Fixes: Out of array access
Fixes: 20659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5658548592967680
Fixes: 20659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5723561177382912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a035fd88ae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
15062f6466
avcodec/utvideodec: Fix integer overflow in decode_plane()
...
Fixes: signed integer overflow: 2147483594 + 142 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_fuzzer-5658568101724160
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 876cfa67f3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
8858e92b7a
avcodec/ttadsp: Fix several integer overflows in tta_filter_process_c()
...
Fixes: signed integer overflow: 1931744255 + 252497024 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5763348114440192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8627885172 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
14b955ba85
avcodec/ralf: Fix integer overflow in decode_block()
...
Fixes: signed integer overflow: 289082077 - -2003141111 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5196077752123392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c4330847c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
1ddde7f986
avcodec/nuv: widen buf_size type
...
Fixes: signed integer overflow: 65312 * 65312 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-5740176118906880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1ac106bf56 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
926bec89cc
avcodec/iff: Fix several integer overflows
...
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int32_t' (aka 'int')
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5764066459254784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7a92147f87 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
c7d003e0b7
avcodec/g729postfilter: Clip gain before scaling with AGC_FAC1
...
The fixed point integer reference specifies the multiplication used
to have 16bit input and clips so we need to clip the input
The floating point implementation does not seem to do that.
Fixes: signed integer overflow: 6317568 * 410 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G729_fuzzer-5700189272932352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 82d4c7b95e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
1974e661b0
avcodec/alac: Fix integer overflow with 24/20bps samples
...
Fixes: signed integer overflow: 1020048 * 4096 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5753877751660544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 22e51e95ac )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
3168a4aeea
avcodec/dstdec: Check sample rate
...
Fixes: out of array access
Fixes: 20659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5735812071424000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5727b1f13f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
f698ec9a23
avformat/thp: Require a video stream
...
The demuxer code assumes the existence of a video stream
Fixes: assertion failure
Fixes: 21512/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5699660783288320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 97c78caf3e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
d98833eb79
avformat/mpeg: Decrease score by 1 for files with very little valid data
...
Fixes: 8233/PPY6574574605_cut.mp3
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 20f7b4dfc9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
997d5b45b5
avcodec/pngdec: Check length in fdAT
...
Fixes: 21089/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-5135981419429888
Fixes: out of array read
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 79e5c2ee2b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
77751f6053
avcodec/g2meet: Check tile_width in epic_jb_decode_tile()
...
Fixes: out of array access
Fixes: 21469/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5199357982015488
Alternatively the arrays can be made bigger or the index can be clipped.
In case a real file with such huge tiles exist we ask the user to upload it.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5501bb28dd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
264f478274
avcodec/vp9dsp_template: Fix integer overflows in idct32_1d()
...
Fixes: signed integer overflow: -193177 * 11585 cannot be represented in type 'int'
Fixes: 20557/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5704852816789504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e16e3e63f0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
9ee52de7af
avcodec/alacdsp: Fix invalid shift in append_extra_bits()
...
Fixes: left shift of negative value -1
Fixes: 21390/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-6242539519868928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 49ae034b42 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
6feb24a336
libavcodec/wmalosslessdec: prevent sum of positive numbers from becoming negative
...
Fixes: left shift of negative value -8321365
Fixes: 20506/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-4798062906310656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 62e4003780 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
0e7a8c9665
avcodec/dstdec: Fix integer overflow in read_table()
...
Fixes: signed integer overflow: -16 * 134217879 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5639509530378240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d465a401d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
53b2e32688
avcodec/txd: Check for input size against the header size.
...
Fixes: Timeout (21sec -> 80ms)
Fixes: 20673/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TXD_fuzzer-5177453863763968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aeb4e43584 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
96d4183cd2
avcodec/svq1dec: Check that there is data left after the header
...
Fixes: Timeout (21sec -> 255ms)
Fixes: 20709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ1_fuzzer-5085075089915904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 55e344ee5a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
90cbc65f4f
avcodec/intrax8: Check for end of bitstream in ff_intrax8_decode_picture()
...
Fixes: Timeout (105sec -> 1sec)
Fixes: 20479/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5769846937878528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a9ccc2514 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
9ce7c9c463
avcodec/hevc_mp4toannexb_bsf: Check nalu_size
...
Fixes: Timeout (29sec -> 5ms)
Fixes: 20237/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_MP4TOANNEXB_fuzzer-5165615044362240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ae2537f53e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
2f1bf34522
avcodec/iff: Check length before memcpy() in decode_deep_rle32()
...
Fixes: out of array read
Fixes: 20796/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5111364702175232.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b4a33387cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
e038ecf707
avcodec/iff: Fix invalid pointer intermediates in decode_deep_rle32()
...
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc41a29a5a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
f0f164f8c5
avcodec/pngdec: Pass ret from decode_iccp_chunk()
...
Found while reviewing a patch fixing a similar issue
Reviewed-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4c7bcaa385 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
4e4fc148d0
avcodec/rv40dsp: Fix integer overflows in rv40_weight_func_*()
...
Fixes: signed integer overflow: 40550400 * 128 cannot be represented in type 'int'
Fixes: 20331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV40_fuzzer-5676685725007872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 13171ad2e3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
5c1985f22b
avcodec/ac3dec_fixed: Fix several invalid left shifts in scale_coefs()
...
Fixes: left shift of negative value -14336
Fixes: 20298/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AC3_FIXED_fuzzer-5675484201615360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e30502abe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
725a2495f8
avcodec/flac_parser: Do not lose header count in find_headers_search()
...
Fixes: Timeout
Fixes: out of array access
Fixes: 20274/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5649631988154368
Fixes: 19275/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5757535722405888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 55f9683cf6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
4eccd91899
avcodec/audiodsp: Fix integer overflow in scalarproduct_int16_c()
...
Fixes: signed integer overflow: 2145417478 + 76702564 cannot be represented in type 'int'
Fixes: 20313/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-5734487724130304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit abb5762e98 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
e0c13429ca
avformat/oggdec: Check for EOF after page header
...
Fixes: Infinite loop
Fixes: Ticket8594
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f1589be9fd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
3a53f37950
swscale/yuv2rgb: Fix vertical dither offset with slices
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be3c29e379 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
63c6e55edf
avcodec/dpcm: clip exponent into supported range in XAN DPCM
...
Fixes: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 21200/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XAN_DPCM_fuzzer-5754704894361600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 20ade59d96 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
bc624d1853
avcodec/flacdsp_template: Fix invalid shifts in decorrelate
...
Fixes: left shift of negative value -2
Fixes: 20303/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5096829297623040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3935c891e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
a8ba25defd
avcodec/xvididct: Fix integer overflow in MULT()
...
Fixes: signed integer overflow: 23170 * 95058 cannot be represented in type 'int'
Fixes: 20295/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5800212870463488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ccb576191 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
4a60aa9bd3
avcodec/ffwavesynth: Correct undefined overflow of PINK_UNIT
...
Fixes: signed integer overflow: 9223372036854775775 + 128 cannot be represented in type 'long'
Fixes: 20054/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5686385113825280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 187161d62f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
64bee9c2f8
swscale/output: Fix integer overflow in yuv2rgb_write_full() with out of range input
...
Fixes: signed integer overflow: 1169365504 + 981452800 cannot be represented in type 'int'
Fixes: ticket8293
Found-by: Suhwan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e057e83a4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
d33f8f2871
swscale/output: Fix integer overflow in alpha computation in yuv2gbrp16_full_X_c()
...
Fixes: signed integer overflow: 524280 * 4432 cannot be represented in type 'int'
Fixes: ticket8322
Found-by: Suhwan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 49ba1879ad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
John Rummell
1e61cc5c51
libavformat/amr.c: Check return value from avio_read()
...
If the buffer doesn't contain enough bytes when reading a stream,
fail rather than continuing on with initialized data. Caught by
Chromium fuzzeras (crbug.com/1065731).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5b967f56b6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
John Rummell
c703bdf3c8
libavformat/mov.c: Free aes_decrypt to avoid leaking memory
...
Found by Chromium fuzzers (crbug.com/1057205).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ad91cf1f2f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
John Rummell
e9b952d283
libavformat/oggdec.c: Check return value from avio_read()
...
If the buffer doesn't contain enough bytes when reading a stream,
fail rather than continuing on with unitialized data. Caught by
Chromium fuzzers (crbug.com/1054229).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b7c67b1ae3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
47b6f07f32
avformat/asfdec_f: Fix overflow check in get_tag()
...
Fixes: signed integer overflow: 2 * 1210064928 cannot be represented in type 'int'
Fixes: 20873/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5761116909338624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8140fe732 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
e2d4a43441
avformat/nsvdec: Fix memleaks on errors while reading the header
...
Fixes: memleaks
Fixes: 21084/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5655975492321280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 96c0469455 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
658085fbcf
avcodec/ffwavesynth: Fix integer overflow in computation of ddphi
...
Fixes: signed integer overflow: 1302123111085380114 - -8319005078741256972 cannot be represented in type 'long'
Fixes: 20991/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5148554161291264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c85bf16318 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
807af72750
avcodec/adpcm: Fix invalid shift in AV_CODEC_ID_ADPCM_PSX
...
Fixes: left shift of negative value -1
Fixes: 20859/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_PSX_fuzzer-5720391507247104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a11ef68f0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
51d2137b98
avcodec/mpeg12dec: Fix invalid shift in mpeg2_fast_decode_block_intra()
...
Fixes: left shift of negative value -695
Fixes: 19232/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5702856963522560
Fixes: 19555/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5741218147598336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c40df2166c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
2e893054bf
avcodec/mpegaudioenc_template: fix invalid shift of sample
...
Fixes: Ticket8010
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a2c97a8342 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
3a2dfcf3a1
avcodec/motion_est_template: Fix invalid shifts in no_sub_motion_search()
...
Fixes: Ticket8167
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e13eee37ee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
15ca3c1c8b
libavformat/avienc: Check bits per sample for PAL8
...
Fixes: assertion failure
Fixes: Ticket 8172
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3595878281 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
50a35f0780
avformat/mpegts: Improve the position determination for avpriv_mpegts_parse_packet()
...
Fixes: assertion failure
Fixes: Ticket 8005
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e5bb48ae59 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
80d6a3c271
avcodec/magicyuv: Check that there are enough lines for interlacing to be possible
...
Fixes: out of array access
Fixes: 20763/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_fuzzer-5759562508664832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f8a0e9f9f7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
fa85195a94
avformat/mvdec: Check stream numbers
...
Fixes: null pointer dereference
Fixes: 20768/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5638648978735104.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 618a9bea65 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
8c594a9070
avcodec/pcm: Fix invalid shift in AV_CODEC_ID_PCM_LXF
...
Fixes: left shift of 233 by 24 places cannot be represented in type 'int'
Fixes: 20736/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PCM_LXF_fuzzer-4829212685107200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 051d11f659 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
b2c54369fe
avcodec/qdm2: Check fft_coefs_index
...
Fixes: out of array access
Fixes: 20660/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5658290216501248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9fc73bf022 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
cdd886b1fb
avformat/utils: Fix integer overflow with complex time bases in avformat_find_stream_info()
...
Fixes: signed integer overflow: 2045163756 * 2 cannot be represented in type 'int'
Fixes: Ticket5132
Found-by: tsmith
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f3d8f517db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
aab46bb8d6
avformat/avidec: Avoid integer overflow in NI switch check
...
Fixes: signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'long'
Fixes: Ticket8149
Found-by: Suhwan
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 347920ca21 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
49a8960cdc
fftools/ffmpeg: Fix integer overflow in duration computation in seek_to_start()
...
Fixes: signed integer overflow: -9223372036854775808 - 9223372036854775807 cannot be represented in type 'long'
Fixes: Ticket8142
Found-by: Suhwan
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f4ad33d96 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
4f04fa75dd
avfilter/vf_aspect: Fix integer overflow in compute_dar()
...
Fixes: signed integer overflow: 1562273630 * 17 cannot be represented in type 'int'
Fixes: Ticket8323
Found-by: Suhwan
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c0ca0f244 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
f6d0260a81
avcodec/apedec: Fix invalid shift with 24 bps
...
Fixes: left shift of negative value -463
Fixes: 20542/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5688714435231744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e27867229 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Dale Curtis
89c4c3c944
avformat/utils: Fix undefined behavior in ff_configure_buffers_for_index()
...
When e2_pts == INT64_MIN and e1_pts >= 0 the calculation of
e2_pts - e1_pts will overflow an int64_t.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f15007afa9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
e4921f409d
avcodec/dpcm: Fix integer overflow in AV_CODEC_ID_GREMLIN_DPCM
...
Fixes: signed integer overflow: -2147479324 + -32568 cannot be represented in type 'int'
Fixes: 20103/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_GREMLIN_DPCM_fuzzer-5667667579240448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b1aecad9ea )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
d60daf43bc
avcodec/wmalosslessdec: Fix integer overflow with sliding in padding bits
...
Fixes: signed integer overflow: -53716100 * 256 cannot be represented in type 'int'
Fixes: 20143/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5716604000403456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b8a0be9352 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
41447fcbcb
avcodec/wmalosslessdec: Fix loop in revert_acfilter()
...
Fixes: out of array read
Fixes: 20059/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5691776237305856
No testcase except the fuzzed one.
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5584c0bb94 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
b6e15c1156
avcodec/lagarith: Sanity check scale
...
A value of 24 and above can collaps the range to 0 which would not work.
Fixes: Timeout (75sec -> 21sec)
Fixes: 18707/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LAGARITH_fuzzer-5708950892969984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fb3855342b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
c3e113d705
avcodec/apedec: Fix integer overflows in predictor_decode_mono_3950()
...
Fixes: signed integer overflow: -2147407150 + -1871606 cannot be represented in type 'int'
Fixes: 18702/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5679095417667584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eb64a5c6f9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
4c1c8ea33e
avcodec/ralf: Fix integer overflow in apply_lpc()
...
Fixes: signed integer overflow: 2147482897 + 2048 cannot be represented in type 'int'
Fixes: 19240/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5743240326414336
Fixes: 19869/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5150136636538880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fd313d8cf8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
57879ec143
avcodec/dca_lbr: Fix some error codes and error passing
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bfea054a75 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
168e6748ee
avcodec/wmavoice: Fix rounding and integer anomalies in calc_input_response()
...
Fixes: out of array access
Fixes: inf is outside the range of representable values of type 'int'
Fixes: signed integer overflow: -9223372036854775808 - 1 cannot be represented in type 'long'
Fixes: 19316/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5677369365102592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38d3758444 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
a344f245c4
avcodec/wmavoice: sanity check block_align
...
This limit is roughly based on the bitreader limit, its likely a much tighter limit
could be used
Fixes: left shift of 1965039647 by 1 places cannot be represented in type 'int'
Fixes: 19545/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5695391899320320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6847e22c8c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
7a0317e38c
avcodec/pcm: Fix invalid shift in pcm_decode_frame for LXF
...
Fixes: left shift of 32 by 28 places cannot be represented in type 'int'
Fixes: 19472/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PCM_LXF_fuzzer-5704364320096256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 985d3666f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
2b57b593b5
avcodec/snappy: Sanity check bytestream2_get_levarint()
...
Fixes: left shift of 79 by 28 places cannot be represented in type 'int'
Fixes: 20202/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5719004081815552
Fixes: 20219/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5641738677125120
Fixes: 20389/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5680721517871104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be54da2117 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
afc97ceb22
avcodec/mlpdsp: Fix a invalid shift in ff_mlp_rematrix_channel()
...
Fixes: left shift of negative value -2
Fixes: 20305/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-5677196618498048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Jai Luthra <me@jailuthra.in >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fcc9f13717 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
344368df55
avcodec/avdct: Clear IDCTDSPContext context
...
Fixes use of uninitialized variable and segfault
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b82825eba8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
06f3cea696
avcodec/x86/diracdsp: Fix high bits on Windows x86_64
...
Found-by: james
(cherry picked from commit 24af459d1e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
b20f8759cd
avformat/mov: Check STCO location
...
Fixes: bypassing of checks and assertion failure
Fixes: asan_1003879.mp4
Found-by: Clusterfuzz + asan
Reported-by: Thomas Guilbert <tguilbert@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1cd4184020 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
05cafd2a0e
avcodec/wmalosslessdec: Fix multiple integer overflows
...
Fixes: left shift of 3329 by 20 places cannot be represented in type 'int'
Fixes: signed integer overflow: -199378355 + -1948950833 cannot be represented in type 'int'
Fixes: 19837/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5752565837070336
Fixes: 19839/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5767483265122304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 422202516c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
848a93b8c8
avcodec/apedec: Fix undefined integer overflow in decode_array_0000()
...
Fixes: signed integer overflow: -2143289344 - 6246400 cannot be represented in type 'int'
Fixes: 19239/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5173755680915456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a3655bb02c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
1dc2117513
avcodec/smacker: Check space before decoding type
...
Fixes: Timeout (232sec -> 280ms)
Fixes: 19682/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKER_fuzzer-5654129649385472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6f5c18da59 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
6452023550
avcodec/rawdec: Use linesize in b64a
...
Fixes: out of array access
Fixes: 19750/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RAWVIDEO_fuzzer-5074834119983104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b5b9d5dac )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
a45cc681cc
avcodec/iff: Over-allocate ham_palbuf for HAM6 IFF-PBM
...
IFF-PBM-HAM6 can read out of array without this overallocation
Fixes: Out of array read
Fixes: 19752/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5675331403120640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8652f4e7a1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
f2c99c2f88
avcodec/x86/diracdsp: Fix incorrect src addressing in dequant_subband_32()
...
Fixes: Segfault (not reproducable with asm, which made this hard to debug)
Fixes: decoding errors
Fixes: 19854/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5729372837511168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0694b60b7b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
cb9ec725c3
avfilter/vf_find_rect: Remove assert
...
A score of 0 is possible
Fixes: Ticket8500
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dfc4714886 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
bd8633d4d3
avfilter/vf_find_rect: Increase worst case score
...
score could be 1.0 which lead to uninitialized values
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ff2474e02 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
4e1480a4e8
swscale/input: Fix several invalid shifts related to rgb2yuv constants
...
Fixes: Invalid shifts
Fixes : #8140
Fixes : #8146
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d48e510124 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
65d9d164da
swscale/output: Fix several invalid shifts in yuv2rgb_full_1_c_template()
...
Fixes: Invalid shifts
Fixes : #8320
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b7f97532b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
850eec92d0
swscale/swscale: Fix several invalid shifts related to vChrDrop
...
Fixes: Invalid shifts
Fixes : #8166
Fixes: filter-crop_scale_vflip FATE-test
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6ca22c118 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
a0868285c0
avcodec/hevc_mp4toannexb_bsf: check that nalu size doesnt overflow
...
Fixes: Out of array access
Fixes: 19299/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_MP4TOANNEXB_fuzzer-5169193398042624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8ceb2a72f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
0ab57e0626
avcodec/hevc_mp4toannexb_bsf: Avoid NULL memcpy()
...
Fixes: invalid memcpy use
Fixes: 19299/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_MP4TOANNEXB_fuzzer-5169193398042624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e23b5a706 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
04ef299aa0
avcodec/wmalosslessdec: move channel check up
...
Fixes: out of array access
Fixes: 2nd part of 18429/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-6210814364614656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 891bcc4acc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
bdb0af634e
avcodec/adpcm: Fix overflow in FFABS() IMA_EA_EACS
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 19235/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_EA_EACS_fuzzer-5680878952382464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 794352ae9d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
5684147644
avcodec/alac: Fix integer overflow in LPC coefficient adaption
...
Fixes: signed integer overflow: 267693597 * 10 cannot be represented in type 'int'
Fixes: 19237/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5755407700328448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6a865cec5e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
4f739a5879
avcodec/g729postfilter: Optimize out overflowing multiplication from apply_tilt_comp()
...
Fixes: signed integer overflow: -1114392282 * 2 cannot be represented in type 'int'
Fixes: 19236/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G729_fuzzer-5741678938030080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c0bd5fa43d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
bcc836d1f2
avcodec/vc1dec: Check field_mode for sprites
...
Fixes: Out of array read
Fixes: 19263/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5389219325542400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 32fb919836 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
5e874507e1
avcodec/vc1dec: Limit bits by the actual bitstream size
...
Fixes: Timeout (350 ->19sec)
Fixes: 19249/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-6566896438870016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c56a52a82c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
b4e369cf36
avcodec/vmdaudio: Check block_align more
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 19788/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMDAUDIO_fuzzer-5743379690553344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 06f6857b54 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Gyan Doshi
b4ff849594
configure: bump year
...
(cherry picked from commit 7b58702cbd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
0b05ea827e
avcodec/pgssubdec: Free subtitle on error
...
Fixes: Assertion failure
Fixes: 19753/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGSSUB_fuzzer-5688461843759104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b0a718923b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
b9b2ac5dbb
avcodec/ffwavesynth: Fix undefined overflow in wavesynth_synth_sample()
...
Fixes: signed integer overflow: 2147464192 + 21176 cannot be represented in type 'int'
Fixes: 19042/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5719828090585088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fa47f6412d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
d22da8f54c
avcodec/cook: Use 3 stage VLC decoding for channel_coupling
...
Fixes: shift exponent -1 is negative
Fixes: out of array read
Fixes: 19028/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5759766471376896
Fixes: 19037/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5734106625474560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 89fd76db71 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
0f8f37a994
avcodec/wmalosslessdec: Fixes undefined overflow in dequantization in decode_subframe()
...
Fixes: signed integer overflow: 47875596 * 45 cannot be represented in type 'int'
Fixes: 19082/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5687766512041984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53efab44a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
5dea535114
avcodec/sonic: Check e in get_symbol()
...
Fixes: signed integer overflow: 1721520852 + 1721520852 cannot be represented in type 'int'
Fixes: 18346/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5709623893426176
Fixes: 18753/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5663299131932672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aea6755611 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
a1474a8304
avcodec/twinvqdec: Correct overflow in block align check
...
Fixes: signed integer overflow: 538976288 * 8 cannot be represented in type 'int'
Fixes: 19126/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TWINVQ_fuzzer-5687464110325760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4dc93ae3d7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
6583f572d1
avcodec/vc1dec: Fix "return -1" cases
...
Reviewed-by: "mypopy@gmail.com " <mypopy@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 26f040bcb4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
9fbd7b65d7
avcodec/vc1dec: Free sprite_output_frame on error
...
Fixes: memleaks
Fixes: 19471/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5688035714269184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ee9240be3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
6c5be12e7c
avcodec/wmadec: Keep track of exponent initialization per channel
...
Fixes: division by 0
Fixes: 19123/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5655493121146880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf5c850b79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
cda7dd2124
avcodec/iff: Check that video_size is large enough for the read parameters
...
video is allocated before parameters like bpp are read.
Fixes: out of array access
Fixes: 19084/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5718556033679360
Fixes: 19465/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5759908398235648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f1b97f62f8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
d8e5d0264e
avcodec/adpcm: Clip predictor for APC
...
Fixes: signed integer overflow: -2147483648 - 13 cannot be represented in type 'int'
Fixes: 18893/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_APC_fuzzer-5630760442920960
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9fe07908c3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
b84ab52628
avcodec/targa: Check colors vs. available space
...
Fixes: Timeout (37sec -> 52ms)
Fixes: 18892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TARGA_fuzzer-5739537854889984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 01593278ce )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
9645c0b322
avcodec/dstdec: Use get_ur_golomb_jpegls()
...
Fixes: shift exponent -4 is negative
Fixes: 17793/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5766088435957760
Fixes: 18989/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5175008116867072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a76690c02b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
71c228d2b8
avcodec/wmavoice: Check remaining input in parse_packet_header()
...
Fixes: Infinite loop
Fixes: 18914/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5731902946541568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 19c41969b2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
3191aecdfa
avcodec/wmalosslessdec: Fix 2 overflows in mclms
...
Fixes: signed integer overflow: 2038337026 + 109343477 cannot be represented in type 'int'
Fixes: 18886/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5673660505653248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 92455c8c65 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
5f820ffe81
avcodec/wmaprodec: Fixes integer overflow with 32bit samples
...
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 18860/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAPRO_fuzzer-5755223125786624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a9cc69c0d5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
9776bc1125
avcodec/adpcm: Fix invalid shift in xa_decode()
...
Fixes: left shift of negative value -1
Fixes: 18859/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_XA_fuzzer-5748474213040128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 50db30b47d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
18a6ff88ce
avcodec/wmalosslessdec: Fix several integer issues
...
Fixes: shift exponent -1 is negative (and others)
Fixes: 18852/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5660855295541248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec3fe67074 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
699a6dddc7
avcodec/wmalosslessdec: Check that padding bits is not more than sample bits
...
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 18817/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5713317180211200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d42826580 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
2309850cb9
avcodec/iff: Skip overflowing runs in decode_delta_d()
...
Fixes: Timeout (107sec - 75ms>
Fixes: 18812/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-6295585225441280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 185f441ba2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:09 +02:00
Michael Niedermayer
bbae90e2cb
avcodec/pnm: Check that the header is not truncated
...
Fixes: Ticket8430
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c94cb8d9b2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:08 +02:00
Michael Niedermayer
41fc3f3851
avcodec/mp3_header_decompress_bsf: Check sample_rate_index
...
Fixes: out of array read
Fixes: 19309/clusterfuzz-testcase-minimized-ffmpeg_BSF_MP3_HEADER_DECOMPRESS_fuzzer-5651002950942720
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f064c7c449 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:08 +02:00
Michael Niedermayer
57c602ab24
avformat/rmdec: Initialize and sanity check offset in ivr_read_header()
...
Fixes: signed integer overflow: -9223372036854775808 - 17 cannot be represented in type 'long'
Fixes: 18768/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5674385247830016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7e665e4a81 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:08 +02:00
Michael Niedermayer
bc73f923e2
avcodec/apedec: Fix 2 integer overflows
...
Fixes: signed integer overflow: 2119056926 - -134217728 cannot be represented in type 'int'
Fixes: 18728/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5747539563511808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6e15ba2d1f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:08 +02:00
Michael Niedermayer
081aa19ac9
avcodec/wmaprodec: Set packet_loss when we error out on a sanity check
...
Fixes: left shift of negative value -34
Fixes: 18719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAPRO_fuzzer-5642658173419520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a9cbd25d89 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:08 +02:00
Michael Niedermayer
47d0725b91
avcodec/wmaprodec: Check offset
...
Fixes: index 33280 out of bounds for type 'float [32768]'
Fixes: 18718/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA2_fuzzer-5635373899710464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5473c7825e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:08 +02:00
Michael Niedermayer
6d3a91c49d
avcodec/truemotion2: Fix 2 integer overflows in tm2_low_res_block()
...
Fixes: signed integer overflow: 1778647621 + 574372924 cannot be represented in type 'int'
Fixes: 18692/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-6248679635943424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93d52a181e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:08 +02:00
Michael Niedermayer
63bad93076
avcodec/wmaprodec: Check if the channel sum of all internal contexts match the external
...
Fixes: NULL pointer dereference
Fixes: 18689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA1_fuzzer-5715114640015360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 090ac57997 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2020-07-02 19:55:08 +02:00
Andreas Rheinhardt
a1a6336a58
libavcodec/libvpxenc: Don't free user-provided AVPacket
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 26b4509690 )
2020-05-23 20:43:23 +02:00
Andreas Rheinhardt
f7dc65d74f
libavcodec/libmp3lame: Don't free user-provided AVPacket
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 7e6941e185 )
2020-05-23 20:43:22 +02:00
Andreas Rheinhardt
b9aaa444e1
avcodec/libopusenc: Don't free user-provided AVPacket
...
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit b803993b6d )
2020-05-23 20:43:22 +02:00
Andreas Rheinhardt
164bafe8b1
avformat/matroskadec: Fix default value of BlockAddID
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit dbc50f8a93 )
2020-04-03 21:57:34 +02:00
Michael Niedermayer
289a79d545
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-01 18:24:40 +01:00
Michael Niedermayer
0b49c74fe1
avcodec/g729dec: require buf_size to be non 0
...
The 0 case was added with the support for multiple packets. It
appears unintended and causes extra complexity and out of array
accesses (though within padding)
No testcase
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f64be9da4c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-01 18:00:10 +01:00
Michael Niedermayer
4d932eb66b
avcodec/alac: Fix integer overflow in lpc_prediction() with sign
...
Fixes: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
Fixes: 18643/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5672182449700864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7686ba1f14 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-01 17:55:30 +01:00
Michael Niedermayer
f4daf42c1a
avcodec/wmaprodec: Fix buflen computation in save_bits()
...
Fixes: Assertion failure
Fixes: 18630/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAPRO_fuzzer-5201588654440448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 589cb44498 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-01 17:54:56 +01:00
Michael Niedermayer
5b43aa7a80
avcodec/vc1_block: Fix integer overflow in AC rescaling in vc1_decode_i_block_adv()
...
Fixes: signed integer overflow: 50176 * 262144 cannot be represented in type 'int'
Fixes: 18629/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5182370286403584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e010e489b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-01 17:54:30 +01:00
Michael Niedermayer
2f942ddf74
avcodec/vmdaudio: Check chunk counts to avoid integer overflow
...
Fixes: signed integer overflow: 4 * 538976288 cannot be represented in type 'int'
Fixes: 18622/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMDAUDIO_fuzzer-5092166174507008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47d963335e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-01 17:54:07 +01:00
Michael Niedermayer
0eff731d8d
avformat/mxfdec: Clear metadata_sets_count in mxf_read_close()
...
This avoids problems if the function is called twice
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 13816a1d08 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-01 17:53:27 +01:00
Michael Niedermayer
db659cdf47
avcodec/nuv: Use ff_set_dimensions()
...
Fixes: OOM
Fixes: 18956/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-5766505644163072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1ca978d636 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-01 17:53:01 +01:00
Michael Niedermayer
ed4f485353
avcodec/ffwavesynth: Fix integer overflow with pink_ts_cur/next
...
Fixes: signed integer overflow: 6175076100092079360 - -5034989061050195840 cannot be represented in type 'long'
Fixes: 18614/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5704508847423488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d82ab96e76 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-01 17:51:36 +01:00
Michael Niedermayer
6ce5379105
avcodec/ralf: Fix integer overflows with the filter coefficient in decode_channel()
...
Fixes: signed integer overflow: 1145975808 - -1146173210 cannot be represented in type 'int'
Fixes: 18616/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5121296757424128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 721624c2f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-01 17:50:16 +01:00
Michael Niedermayer
a67d997ad7
avcodec/g729dec: Use 64bit and clip in scalar product
...
The G729 reference decoder clips after each individual operation and keeps track if overflow
occurred (in the fixed point implementation), this here is
simpler and faster but not 1:1 the same what the reference does.
Non fuzzed samples which trigger any such overflow are welcome, so
the need and impact of different clipping solutions can be evaluated.
Fixes: signed integer overflow: 1271483721 + 1073676289 cannot be represented in type 'int'
Fixes: 18617/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5137705679978496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf9c4a1275 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-01 17:49:31 +01:00
Michael Niedermayer
3f18698652
avcodec/mxpegdec: Check for multiple SOF
...
Fixes: Timeout (14sec -> 9ms)
Fixes: 18598/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-5726095261564928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 75b64e5aa3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-01 17:48:43 +01:00
Michael Niedermayer
9162df98e1
avcodec/nuv: Move comptype check up
...
Fixes: Timeout (23sec -> 5ms)
Fixes: 18517/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-5753135536013312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1138cdecbe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-01 17:47:53 +01:00
Michael Niedermayer
66e701af69
avcodec/wmavoice: Fix integer overflow in synth_frame()
...
Fixes: left shift of negative value -3
Fixes: 18518/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-6560514359951360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf323f4d38 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-01 17:47:07 +01:00
Michael Niedermayer
f3e553e36a
avcodec/rawdec: Check bits_per_coded_sample more pedantically for 16bit cases
...
Fixes: shift exponent -14 is negative
Fixes: 18335/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RAWVIDEO_fuzzer-5723267192586240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5634e20525 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-01 17:46:48 +01:00
Michael Niedermayer
650ce5047c
avutil/lfg: Correct index increment type to avoid undefined behavior
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 18333/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COMFORTNOISE_fuzzer-5668481831272448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6014bcf1b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-01 17:45:46 +01:00
Michael Niedermayer
e2def5f382
avcodec/cngdec: Remove AV_CODEC_CAP_DELAY
...
As is the decoder will never stop, it will cause an infinite loop. The RFC seems only
to speak of non empty packets so endlessly generating noise from the last empty flush
packets seems wrong.
Fixes: infinite loop
Fixes: 18333/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COMFORTNOISE_fuzzer-5668481831272448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 327a968817 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-12-01 17:44:36 +01:00
Michael Niedermayer
e5baac772c
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-22 22:46:42 +01:00
Michael Niedermayer
b9735a0271
avcodec/iff: Move index use after check in decodeplane8()
...
Fixes: index 9 out of bounds for type 'const uint64_t [8][256]'
Fixes: 18409/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5767030560522240
Fixes: 18720/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5651995784642560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1f8b36cc4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-21 23:44:49 +01:00
Michael Niedermayer
eabece8639
avcodec/atrac3: Check for huge block aligns
...
The largest documented frame size = block align is 1024 bytes
(https://wiki.multimedia.cx/index.php/ATRAC3 )
Without a limit this can allocate arbitrary memory and trigger OOM
Fixes: OOM
Fixes: 18337/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3_fuzzer-5763861478637568
Fixes: 18556/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3AL_fuzzer-5646183334936576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f09151fff9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-21 23:44:21 +01:00
Michael Niedermayer
978aa2ae50
avcodec/ralf: use multiply instead of shift to avoid undefined behavior in decode_block()
...
Fixes: left shift of negative value -249
Fixes: 18566/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5649394561187840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b7d02642b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-21 23:43:52 +01:00
Michael Niedermayer
b385b34761
avcodec/wmadec: Require previous exponents for reuse
...
Fixes: division by zero
Fixes: 18474/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5764986962182144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c54b9fc42f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-21 23:43:14 +01:00
Michael Niedermayer
313af22942
avcodec/vc1_block: Fix undefined behavior in ac prediction rescaling
...
The intermediates are required to fit in 12bit (8.1.3.9 Coefficient Scaling)
See SMPTE 421M-2006 and Amendment 1-2007
Fixes: signed integer overflow: -20691 * 262144 cannot be represented in type 'int'
Fixes: 18479/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5128912371187712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7fc1baf0ca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-21 23:42:51 +01:00
Michael Niedermayer
0e96cffff6
avcodec/qdm2: The smallest header seems to have 2 bytes so treat 1 as invalid
...
Fixes: Timeout (217sec -> 2ms)
Fixes: 18488/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5708293662310400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e36ccb5048 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-21 23:42:36 +01:00
Michael Niedermayer
5222756b36
avcodec/apedec: Fixes integer overflow of res+*data in do_apply_filter()
...
Fixes: signed integer overflow: 7400 + 2147482786 cannot be represented in type 'int'
Fixes: 18405/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5708834760294400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dc3f327e74 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-21 23:41:47 +01:00
Michael Niedermayer
c2f81cfc78
avcodec/sonic: Fix integer overflow in predictor_calc_error()
...
Fixes: signed integer overflow: 5 * -1094995529 cannot be represented in type 'int'
Fixes: 18346/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5709623893426176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8c17b8cef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-21 23:40:46 +01:00
Michael Niedermayer
0a4d2b5f67
avformat/mp3dec: Check that the frame fits within the probe buffer
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e9a335150a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-21 23:27:24 +01:00
Michael Niedermayer
6e208e78d3
Update for 3.4.7
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 17:19:45 +01:00
Carl Eugen Hoyos
1b814e6aff
lavc/tableprint_vlc: Remove avpriv_request_sample() from included files.
...
Fixes compilation with --enable-hardcoded-tables.
Fixes ticket #7962 .
(cherry picked from commit c8232e5007 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 17:03:14 +01:00
Michael Niedermayer
955c310b75
avcodec/wmaprodec: get frame during frame decode
...
Fixes: memleak
Fixes: 17615/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA2_fuzzer-5681306024804352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0f89a2293e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:47 +01:00
Michael Niedermayer
9e635252fb
avcodec/interplayacm: Fix overflow of last unused value
...
Fixes: signed integer overflow: -2147450880 - 65535 cannot be represented in type 'int'
Fixes: 18393/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5667520110919680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 10eabb8e40 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:47 +01:00
Michael Niedermayer
965b610359
avcodec/adpcm: Fix undefined behavior with negative predictions in IMA OKI
...
Fixes: left shift of negative value -30
Fixes: 18392/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_OKI_fuzzer-5631771831435264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7786f6c30e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:47 +01:00
Michael Niedermayer
07f16ceb8e
avcodec/cook: Move up and extend block_align check
...
Fixes: signed integer overflow: 2046820356 * 8 cannot be represented in type 'int'
Fixes: 18391/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5631674666188800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1c63edcdd2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:47 +01:00
Michael Niedermayer
d737429008
avcodec/twinvq: Check block_align
...
Fixes: signed integer overflow: 538976288 * 8 cannot be represented in type 'int'
Fixes: 18348/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_METASOUND_fuzzer-6681325716635648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 97f778e9c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:47 +01:00
Michael Niedermayer
d3fe22a1dc
avcodec/cook: Enlarge gain table
...
Fixes: index 25 out of bounds for type 'float [23]'
Fixes: 18355/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5641398941908992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 50001cd440 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:47 +01:00
Michael Niedermayer
a76e4ba104
avcodec/cook: Check samples_per_channel earlier
...
Fixes: division by zero
Fixes: 18362/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5653727679086592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 57750bb629 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:47 +01:00
Michael Niedermayer
25727befcc
avcodec/atrac3plus: Check split point in fill mode 3
...
Fixes: index 32 out of bounds for type 'int [32]'
Fixes: 18350/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3P_fuzzer-5643794862571520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit de5102fd92 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:47 +01:00
Michael Niedermayer
8255244f19
avcodec/wmavoice: Check sample_rate
...
Fixes: left shift of 538976288 by 8 places cannot be represented in type 'int'
Fixes: 18376/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5741645391200256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 55c97a7637 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:47 +01:00
Michael Niedermayer
f94127a40e
avcodec/xsubdec: fix overflow in alpha handling
...
Fixes: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 18368/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XSUB_fuzzer-5702665442426880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9ea9973959 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:47 +01:00
Michael Niedermayer
4b8a0ce8f7
avcodec/iff: Check available space before entering loop in decode_long_vertical_delta2() / decode_long_vertical_delta()
...
Fixes: Timeout (31sec -> 41ms)
Fixes: 18380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5645210121404416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 32b3c8ce7d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:47 +01:00
Michael Niedermayer
ffc4603e61
avcodec/apedec: Fix integer overflow in filter_3800()
...
Fixes: signed integer overflow: 2117181180 + 60483298 cannot be represented in type 'int'
Fixes: 18344/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5685327791915008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1c038c5c63 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:47 +01:00
Michael Niedermayer
5ebee49b34
avutil/lfg: Document the AVLFG struct
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d6fea2ef22 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:47 +01:00
Michael Niedermayer
a687664dd4
avcodec/ffv1dec: Use a different error message for the slice level CRC
...
This way they can be told apart easily
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df498cf544 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:47 +01:00
Michael Niedermayer
aaa9b96cf6
avcodec/apedec: Fix undefined integer overflow in long_filter_ehigh_3830()
...
Fixes: signed integer overflow: -1094995529 * 2 cannot be represented in type 'int'
Fixes: 18281/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5692589180715008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1d1719a44d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:47 +01:00
Michael Niedermayer
3de0c702bd
avcodec/dstdec: Check that AC probabilities are within range
...
ISO/IEC 14496-3:2005(E): "Each entry of P_one[ ][ ] is in the range of 1 to
128, corresponding to a probability of 1/256 to 128/256 of the next error bit (bit E, See Figure 10.5)..."
Fixes: Timeout (42sec ->1sec)
Fixes: 18181/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5736646250594304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c3e1b395b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:47 +01:00
Michael Niedermayer
2258982c8b
avcodec/dstdec: Check read_table() for failure
...
Fixes: Timeout (too long -> 42sec)
Fixes: 18181/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5736646250594304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 03ea8d8cd4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:47 +01:00
Michael Niedermayer
e0d167051e
avcodec/snowenc: Set mb_num to avoid ratecontrol floating point divisions by 0.0
...
Fixes: Ticket7990
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 55279d699f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:47 +01:00
Michael Niedermayer
0c9ad1c746
avcodec/snowenc: Fix 2 undefined shifts
...
Fixes: Ticket7990
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8802e329c8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:47 +01:00
Michael Niedermayer
f4103876f9
avformat/nutenc: Do not pass NULL to memcmp() in get_needed_flags()
...
This compared to the other suggestions is cleaner and easier to understand
keeping the condition in the if() simple.
This affects alot of fate tests.
See: [FFmpeg-devel] [PATCH 05/11] avformat/nutenc: Don't pass NULL to memcmp
See: [FFmpeg-devel] [PATCH]lavf/nutenc: Do not call memcmp() with NULL argument
Fixes: Ticket 7980
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e4fdeb3fce )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:47 +01:00
Michael Niedermayer
eda9406895
avcodec/aacdec_template: Check samplerate
...
Fixes: signed integer overflow: 2 * 1881153568 cannot be represented in type 'int'
Fixes: 17996/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5687126468853760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7730bacb41 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:47 +01:00
Michael Niedermayer
a154ec5f43
avcodec/truemotion2: Fix several integer overflows in tm2_low_res_block()
...
Fixes: signed integer overflow: 1077952576 + 1355863565 cannot be represented in type 'int'
Fixes: 16196/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5679842317565952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b655f55ea )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
64b961273a
avcodec/utils: Check block_align
...
Fixes: out of array access
Fixes: 18432/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5675574936207360
Fixes: 18326/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5071752362721280
Fixes: 18384/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV1_fuzzer-5769439500304384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f011572e66 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
2635bfb2b3
avcodec/wmalosslessdec: Fix some integer anomalies
...
Fixes: left shift of negative value -341180
Fixes: 18401/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5686380134400000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d3dee676b8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
7369aa201e
avcodec/adpcm: Fix invalid shifts in ADPCM DTK
...
Fixes: left shift of negative value -1
Fixes: 18397/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_DTK_fuzzer-5675653487132672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 34e701ff93 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
132e4e5460
avcodec/apedec: Only clear the needed buffer space, instead of all
...
Fixes: Timeout (15sec -> 0.4sec)
Fixes: 18396/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5730080487112704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f17ea02001 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
490f931494
avcodec/libvorbisdec: Fix insufficient input checks leading to out of array reads
...
Fixes: 16144/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVORBIS_fuzzer-5638618940440576
Fixes: out of array read
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 069be4aa5d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
a1d6813649
avcodec/g723_1dec: fix invalid shift with negative sid_gain
...
Fixes: left shift of negative value -1
Fixes: 18395/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G723_1_fuzzer-5710313034350592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1850c3feaa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
68274f568e
avcodec/vp5: Check render_x/y
...
Fixes: Timeout (15sec -> 91ms)
Fixes: 18353/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP5_fuzzer-5704150326706176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 698e042c77 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
7b0ad24b10
avcodec/qdrw: Check input for header/skiped space before get_buffer()
...
Fixes: Timeout (21sec -> 0.8sec)
Fixes: 17990/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDRAW_fuzzer-5200374436200448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b63fbc19c0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
4ed397df65
avcodec/ralf: Skip initializing unused filter variables
...
Fixes: left shift of negative value -1
Fixes: 17890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5643307467669504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f4ecf6c39d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
e02dedf267
avcodec/takdec: Fix overflow with large sample rates
...
Fixes: signed integer overflow: 2147483647 + 511 cannot be represented in type 'int'
Fixes: 17899/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5719753322135552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 42eb78059d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
09e942aa4d
avcodec/alsdec: Check that input space for header exists in read_diff_float_data()
...
Fixes: Timeout (21sec -> 8sec)
Fixes: 17832/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5737092172218368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 09581f7923 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
b3d6eabd78
avformat/pjsdec: Check duration for overflow
...
Fixes: signed integer overflow: -3 - 9223372036854775807 cannot be represented in type 'long'
Fixes: 17828/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5645915116797952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1efaac6932 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
8d483f9849
avcodec/ptx: Check that the input contains at least one line
...
Fixes: Timeout (19sec -> 44ms)
Fixes: 17816/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PTX_fuzzer-5704459950227456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6ad328256 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
958cc68d51
avcodec/alac: Fix integer overflow in LPC
...
Fixes: signed integer overflow: 2147483628 + 128 cannot be represented in type 'int'
Fixes: 17783/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5146470595952640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 44b73a0568 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
b58e7868f2
avcodec/smacker: Fix integer overflows in pred[] in smka_decode_frame()
...
Fixes: signed integer overflow: -2147481503 + -32732 cannot be represented in type 'int'
Fixes: 17782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKAUD_fuzzer-5769672225456128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a76897e19c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
08972bff12
avcodec/aliaspixdec: Check input size against minimal picture size
...
Fixes: Timeout (15sec -> 72ms)
Fixes: 17774/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALIAS_PIX_fuzzer-5193929107963904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c69310477 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
8d7d6066ef
avcodec/ffwavesynth: Fix integer overflows in pink noise addition
...
Fixes: signed integer overflow: -1795675744 + -1926578528 cannot be represented in type 'int'
Fixes: 17741/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5131336402075648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7916b6863c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
0dc659b8fb
avcodec/vc1_block: Fixes integer overflow in vc1_decode_i_block_adv()
...
Fixes: signed integer overflow: 62220 * 262144 cannot be represented in type 'int'
Fixes: 17145/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5667394743173120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6fdeb20817 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
c992a8301a
avcodec/wmalosslessdec: Check block_align
...
Fixes: NULL pointer dereference
Fixes: 18331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5652847445671936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1c799271e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
f628f38f6e
avcodec/g729postfilter: Fix left shift of negative value
...
Fixes: Ticket8176
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f0acc5064 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
7c7e103729
avcodec/binkaudio: Check sample rate
...
Fixes: signed integer overflow: 1092624416 * 2 cannot be represented in type 'int'
Fixes: 18045/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINKAUDIO_RDFT_fuzzer-5718519492116480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2fca09bce4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
22336d5c48
avcodec/adpcm: Check initial predictor for ADPCM_IMA_EA_EACS
...
Fixes: signed integer overflow: -2147483360 - 631 cannot be represented in type 'int'
Fixes: 17701/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_EA_EACS_fuzzer-5711517319692288
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f66e8436d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
888df4b68c
avcodec/g723_1dec: Fix overflow in shift
...
Fixes: shift exponent 1008 is too large for 32-bit type 'int'
Fixes: 17700/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G723_1_fuzzer-5707633436131328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 07732f12a4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
0041d3ceba
avcodec/apedec: Fix integer overflow in predictor_update_3930()
...
Fixes: signed integer overflow: -69555262 * 31 cannot be represented in type 'int'
Fixes: 17698/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5728970447781888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c072c9ed7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
4b4c26ca09
avcodec/g729postfilter: Fix undefined intermediate pointers
...
Fixes: index -49 out of bounds for type 'int16_t [192]'
Fixes: 17689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5756275014500352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c61661a2c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
d998b81ce1
avcodec/g729postfilter: Fix undefined shifts
...
Fixes: left shift of negative value -12
Fixes: 17689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5756275014500352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6a4fdbf112 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
6d62dbb46b
avcodec/lsp: Fix undefined shifts in lsp2poly()
...
Fixes: left shift of negative value -30635
Fixes: 17689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5756275014500352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b93f52cd6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
6b85dc6569
avcodec/adpcm: Fix left shifts in AV_CODEC_ID_ADPCM_EA
...
Fixes: left shift of negative value -1
Fixes: 17683/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_EA_R2_fuzzer-5111690013704192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8695fbec57 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
3ba68a5400
avformat/shortendec: Check k in probe
...
Fixes: Assertion failure
Fixes: 17640/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5708767475269632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea770eb559 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
386b987f2a
avfilter/vf_geq: Use av_clipd() instead of av_clipf()
...
With floats we cannot represent all 32bit integer dimensions
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8813b1a98 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
25a917e46f
avcodec/wmaprodec: Check that the streams channels do not exceed the overall channels
...
Fixes: NULL pointer dereference
Fixes: 18075/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA1_fuzzer-5708262036471808
Fixes: 18087/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA1_fuzzer-5740627634946048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e418b315dd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
34905f7219
avcodec/qdmc: Check input space in qdmc_get_vlc()
...
Fixes: Timeout (125sec -> 0.4sec)
Fixes: 18059/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDMC_fuzzer-5656195825664000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c7975fe6f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
5577079473
avcodec/pcm: Check bits_per_coded_sample
...
Fixes: shift exponent -2 is negative
Fixes: 17736/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PCM_F16LE_fuzzer-5742815929171968
Fixes: 17998/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PCM_F24LE_fuzzer-5716980383875072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5de19160a3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
d109b2d41d
avcodec/exr: Allow duplicate use of channel indexes
...
Fixes: Ticket #8203
Reported-by: durandal_1707
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 080819b3b4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
60c8cf09df
avcodec/fitsdec: Fail on 0 naxisn
...
Fixes: Timeout (100+ sec -> 23ms)
Fixes: 17769/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5678314672357376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a3303d520 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
4b7829bf9c
avcodec/ituh263dec: Check input for minimal frame size
...
Fixes: Timeout (28sec -> 3sec)
Fixes: 17559/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H263_fuzzer-5681050776240128
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f0498ed46 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
c388edef74
avcodec/truemotion1: Check that the input has enough space for a minimal index_stream
...
Fixes: Timeout (18sec -> 0.4sec)
Fixes: 17585/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION1_fuzzer-5117015135617024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a660fac98 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
f83710ee4b
avformat/mpsubdec: Clear queue on error
...
Fixes: Memleaks
Fixes: 17219/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5720539124989952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9a0d36e562 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
9462ca109f
avcodec/sunrast: Check that the input is large enough for the maximally compressed image
...
Fixes: Timeout (17sec -> 15ms)
Fixes: 17224/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SUNRAST_fuzzer-5663218491457536
Fixes: 17224/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SUNRAST_fuzzer-5735590015795200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf0ba75c4a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
3e5316bf2f
avcodec/sunrast: Check for availability of maplength before allocating image
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 711ad71aea )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
a7e147c856
avformat/subtitles: Check nb_subs in ff_subtitles_queue_finalize()
...
Fixes: null pointer dereference
Fixes: 17828/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5645915116797952
Fixes: Ticket8147
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 81b53913bb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
d458cfdcca
avcodec/wmaprodec: Check if there is a stream
...
Fixes: null pointer dereference
Fixes: signed integer overflow: 512 * 2147483647 cannot be represented in type 'int'
Fixes: 17809/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA1_fuzzer-5634409947987968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9b533de28e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
29f07606b6
avcodec/g2meet: Check for end of input in jpg_decode_block()
...
Fixes: Timeout (100sec -> 0.7sec)
Fixes: 8668/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5174143888130048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 61dd2e07be )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
8ca3bf37ab
avcodec/g2meet: Check if adjusted pixel was on the stack
...
This basically checks if a pixel that was coded with prediction
and residual could have been stored using a previous case.
This avoids basically a string of 0 symbols stored in less than
50 bytes to hit a O(n²) codepath.
Fixes: Timeout (too slow to wait -> immediately)
Fixes: 8668/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-4895946310680576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c84c162e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
38800ac4dd
avformat/electronicarts: If no packet has been read at the end do not treat it as if theres a packet
...
Fixes: Assertion failure
Fixes: 17770/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5700606668308480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4de49edc4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
3faa5c0fec
avcodec/utils: Check sample_rate before opening the decoder
...
Fixes: signed integer overflow: 2 * -1306460384 cannot be represented in type 'int'
Fixes: 17685/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_fuzzer-5747390337777664
Fixes: 17688/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5739287210885120
Fixes: 17699/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5678394531905536
Fixes: 17738/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5763415733174272
Fixes: 17746/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINKAUDIO_RDFT_fuzzer-5703008159006720
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 75fefb1fb7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
James Almer
64cfde8033
avcodec/fitsdec: fix use of uninitialised values
...
header.data_max and header.data_min are not necessarely set on all decoding scenarios.
Fixes a Valgrind reported regression since cfa1937791 .
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit e3f0ecfc57 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
c6c9f2e30e
avcodec/motionpixels: Mark 2 functions as always_inline
...
Fixes: Timeout (30sec -> 25sec)
Fixes: 17050/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOTIONPIXELS_fuzzer-5719149803732992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 017884bdc3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
1f2d293fab
avcodec/ralf: Fix integer overflow in decode_channel()
...
Fixes: signed integer overflow: -1094995519 * 64 cannot be represented in type 'int'
Fixes: 17030/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5640695838146560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fbb314b6f2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
d5bca31f58
vcodec/vc1: compute rangex/y only for P/B frames
...
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int'
Fixes: 16976/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-4847262047404032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e75e7fe160 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
4ca1bcdfca
avcodec/vc1_pred: Fix invalid shifts in scaleforopp()
...
Fixes: left shift of negative value -2
Fixes: 16964/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5757853565976576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ced9a1cd0a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
c92c220d2c
avcodec/vc1_block: Fix invalid shift with rangeredfrm
...
Fixes: left shift of negative value -7
Fixes: 16959/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-5200360825683968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c722a69253 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
47e61e223d
avcodec/vc1: Check for excessive resolution
...
Fixes: overflow in aspect ratio calculation
Fixes: signed integer overflow: 393215 * 14594 cannot be represented in type 'int'
Fixes: 15728/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5661588893204480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 181e138da7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
bea0915aaf
avcodec/vc1: check REFDIST
...
"9.1.1.43 P Reference Distance (REFDIST)"
"The value of REFDIST shall be less than, or equal to, 16."
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f7af9e294 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
860ae495c7
avcodec/apedec: Fix several integer overflows in predictor_update_filter() and do_apply_filter()
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: signed integer overflow: -14527961 - 2147483425 cannot be represented in type 'int'
Fixes: 16380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5645957131141120
Fixes: 16968/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5716169901735936
Fixes: 17074/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5198710497083392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e95a3e8a7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
538bfc6053
avcodec/hevc_cabac: Tighten the limit on k in ff_hevc_cu_qp_delta_abs()
...
Values larger would fail subsequent tests.
Fixes: signed integer overflow: 5 + 2147483646 cannot be represented in type 'int'
Fixes: 16966/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5695709549953024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f63cd1963e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
5401126753
avcodec/4xm: Check index in decode_i_block() also in the path where its not used.
...
Fixes: Infinite loop
Fixes: signed integer overflow: 2147483644 + 16 cannot be represented in type 'int'
Fixes: 16169/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5662570416963584
Fixes: 16782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5743163859271680
Fixes: 17641/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5711603562971136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 87ddf9f1ef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
6c93707b9f
avcodec/atrac3: Check block_align
...
Fixes: Infinite loop
Fixes: 17620/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3_fuzzer-5086123012915200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2acbbe2623 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
4aedbf234c
avcodec/alsdec: Avoid dereferencing context pointer in inner interleave loop
...
This makes the decoder faster
Improves/Fixes: Timeout (22sec -> 20sec)
Testcase: 17619/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5078510820917248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 581a895c5c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
b6a62d5bd4
avcodec/fitsdec: Prevent division by 0 with huge data_max
...
Fixes: division by 0
Fixes: 15657/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5738154838982656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cfa1937791 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
f29bd3930f
avcodec/dstdec: Fix integer overflow in samples_per_frame computation
...
Fixes: Timeout (? -> 2ms)
Fixes: 17616/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5198057947267072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7dc0943d4a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
d7d7c9b2ca
avcodec/g729_parser: Check block_size
...
Fixes: Infinite loop
Fixes: 17611/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5765134928052224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 972a0a818f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
7bc4f1452f
avcodec/utils: Optimize ff_color_frame() using memcpy()
...
4650975 -> 4493240 dezicycles
This optimizes lines 2 and later. Line 1 still uses av_memcpy_backptr()
This change originally fixed ossfuzz 10790 but this is now fixed by other
optimizations already
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 95e5396919 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
b5a8b3883e
avcodec/aacdec: Check if we run out of input in read_stream_mux_config()
...
Fixes: Infinite loop
Fixes: 16920/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5653421289373696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3dce4d03d5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
51618d1cbf
avcodec/utils: Use av_memcpy_backptr() in ff_color_frame()
...
Fixes: Timeout (191sec -> 53sec)
Fixes: 16908/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5711207859748864
Fixes: 10709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5630617975259136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 340ab13504 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
6c4d2cc992
avcodec/smacker: Fix integer overflow in signed int multiply in SMK_BLK_FILL
...
Fixes: signed integer overflow: 238 * 16843009 cannot be represented in type 'int'
Fixes: 16958/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKER_fuzzer-5193905355620352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 033d2c4884 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
9b73ca0bca
avcodec/alac: Fix invalid shifts in 20/24 bps
...
Fixes: left shift of negative value -256
Fixes: 16892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-4880802642395136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b30c07cc2b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
8831d1c850
avcodec/alac: fix undefined behavior with INT_MIN in lpc_prediction()
...
Fixes: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
Fixes: 16786/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5632818851348480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0831cbfe09 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
ad7b379e42
avcodec/ffwavesynth: Fix integer overflow in timestamps
...
Fixes: signed integer overflow: 9223371075321077760 * 2 cannot be represented in type 'long'
Fixes: 16447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5698937431785472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c7ccbf40ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
8567a86195
avcodec/adpcm: Check number of channels for MTAF
...
Fixes: out of array access
Fixes: 17608/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_MTAF_fuzzer-5074936267276288
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 74bbf9bc82 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
1eb05c3bbb
avcodec/sunrast: Fix indention
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0728d64497 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
0b8b5fea94
avcodec/sunrast: Fix return type for "unsupported (compression) type"
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e8b7709a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
b1f0a2bdef
avformat/mov: Check for EOF in mov_read_meta()
...
Fixes: Timeout (195sec -> 2ms)
Fixes: 16735/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5090676403863552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 093d1f4250 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
c888b34b1c
avcodec/hevcdec: Fix memleak of a53_caption
...
Fixes: 15295/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5675655187922944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ef50cf7b32 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
f369b5b287
avformat/cdxl: Fix integer overflow in intermediate
...
Fixes: signed integer overflow: 65535 * 65312 cannot be represented in type 'int'
Fixes: 16704/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6294115603447808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c5575c8dc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
a77652e93e
avcodec/hevcdec: repeat character in skiped
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d2d8e797cc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
71e74978b4
avcodec/gdv: Replace assert() checking bitstream by if()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a9fae76370 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
1b90d7bbde
libavcodec/utils: Free threads on init failure
...
Fixes: Multiple memleaks
Fixes: ffmpeg-memory-leak
Found-by: Francis Provencher <francis@protekresearchlab.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 61b055bed0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
a663d186a6
avcodec/htmlsubtitles: Avoid locale dependant isdigit()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b94cf549e2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
a003c985bb
avcodec/alsdec: Check k from being outside what our implementation can handle
...
The specification does not seem to list what the maximum valid
value is
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 16268/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5638164544225280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e125578994 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
da76ca5551
avcodec/takdec: Fix integer overflow in decorrelate()
...
Fixes: signed integer overflow: -2424832 - 2145653689 cannot be represented in type 'int'
Fixes: 16138/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5643451346976768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f119273649 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
089b1e1677
avcodec/aacps: Fix integer overflows in hybrid_synthesis()
...
Fixes: signed integer overflow: -822667928 + -1399761199 cannot be represented in type 'int'
Fixes: 15756/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5645182051024896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec749ed222 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
bc2fb4cf8a
avcodec/vp56rac: delay signaling an error on truncated input
...
A threshold of 1 is sufficient for simple_dump_cut.webm, 10 is used
just to be sure the next truncated file doesnt cause the same issue
Obvious alternative fixes are to simply accept that the file is broken or to
write some advanced error concealment or to
simply accept that the decoder wont stop at the end of input.
Fixes: Ticket 8069 (artifacts not the differing md5 which was there before 1afd246960 )
Fixes: simple_dump_cut.webm
Fixes: regression of 1afd246960
fate-vp5 changes because the last frame is truncated and now handled
differently.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b6b9ac5698 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 70fb3fa990d604211d5b24fc43cdfe31560de250)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:46 +01:00
Michael Niedermayer
8e41f41077
avcodec/vp5/6/8: use vpX_rac_is_end()
...
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab56e62e8f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1dd89192c59df0d6655e9308a0782d8c7b259b18)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
ad3452eb25
avcodec/vp56: Add vpX_rac_is_end() to check for the end of input
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0fb83b4c91 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
f1b943df92
avcodec/qdm2: Check frame size
...
Fixes: index 2304 out of bounds for type 'float [2304]'
Fixes: 16332/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5679142481166336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 12b909ba31 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
18c0c14a05
avcodec/vc1_pred: Fix refdist in scaleforopp()
...
Fixes: out of array access
Fixes: 16601/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5656105392275456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 413e0f2516 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
eeb1e37e76
avcodec/vorbisdec: fix FASTDIV usage for vr_type == 2
...
This reverts a hunk from f1ca40ee00
Fixes: out of array read
Fixes: 16924/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5157893162139648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 722fd46965 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
79e06f4d31
avcodec/iff: Check for overlap in cmap_read_palette()
...
Fixes: undefined memcpy() use
Fixes: 16302/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5678750575886336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dfa5d1a366 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
6d1f143ae1
avcodec/apedec: Fix 32bit int overflow in do_apply_filter()
...
Fixes: signed integer overflow: 2147480546 + 4096 cannot be represented in type 'int'
Fixes: 16280/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5123442566758400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d3ddef519 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
aefa5dd5a4
avcodec/ralf: fix undefined shift in extend_code()
...
Fixes: left shift of negative value -3
Fixes: 16147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5658392722407424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4778407ab3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
7096eb193c
avcodec/ralf: fix undefined shift
...
Fixes: left shift of negative value -2
Fixes: 16145/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5146671058518016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ee886988e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
cb1af09dd0
avcodec/bgmc: Check input space in ff_bgmc_decode_init()
...
Fixes: Infinite loop
Fixes: 16608/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5636229827133440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b54031a6e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
0ccc7efc4d
avcodec/truemotion2: Fix multiple integer overflows in tm2_null_res_block()
...
Fixes: signed integer overflow: 1795032576 + 598344192 cannot be represented in type 'int'
Fixes: 16196/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5636723419119616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cc78783ce5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
befb2f717b
avcodec/vc1dec: Require res_sprite for wmv3images
...
non res_sprite leads to decoder delay which leads to assertion failure
Fixes: Assertion failure
Fixes: 16402/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5704510034411520
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int'
Fixes: 16425/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5692858838810624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c6b400492 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
29765b3be3
avcodec/vc1_block: Check for double escapes
...
Fixes: out of array read
Fixes: 16331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5672735195267072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6962fd586e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
62afc95281
avcodec/vorbisdec: Check get_vlc2() failure
...
Fixes: out of array read
Fixes: 16510/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5754510382727168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 07b948fe60 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
1b4b7a7de1
avcodec/tta: Fix integer overflow in prediction
...
Fixes: signed integer overflow: -395281576 + -1827578048 cannot be represented in type 'int'
Fixes: 16038/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5646109705240576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7e9aecc9f3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
697383e178
avcodec/vb: Check input packet size to be large enough to contain flags
...
Fixes: Timeout (->9sec)
Fixes: 16292/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VB_fuzzer-5747063496638464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dea2591d4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
891508dd88
avcodec/cavsdec: Limit the number of access units per packet to 2
...
Fixes: Timeout (122sec -> 13ms)
Fixes: 15978/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5148925004087296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 37bc8e3249 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
1f47a0135e
avcodec/alac: Check for bps of 0
...
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 15764/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5102101203517440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8f49176e84 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
cc70b01c39
avcodec/alac: Fix multiple integer overflows in lpc_prediction()
...
Fixes: signed integer overflow: 2088795537 + 2147254401 cannot be represented in type 'int'
Fixes: signed integer overflow: -1500363496 + -1295351808 cannot be represented in type 'int'
Fixes: signed integer overflow: -79560 * 32640 cannot be represented in type 'int'
Fixes: signed integer overflow: 2088910005 + 2088796058 cannot be represented in type 'int'
Fixes: signed integer overflow: -117258064 - 2088725225 cannot be represented in type 'int'
Fixes: signed integer overflow: 2088725225 - -117258064 cannot be represented in type 'int'
Fixes: 15739/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5630664122040320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ae3d6a337a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
793ff83b16
avcodec/rl2: set dimensions
...
The dimensions are always 320x200 they are hardcoded in the demuxer.
Hardcode them instead in the decoder.
Fixes: Timeout (16sec -> 400ms)
Fixes: 15574/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RL2_fuzzer-5158614072819712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 965e766e48 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
3381c2bd9b
avcodec/aacdec: Add FF_CODEC_CAP_INIT_CLEANUP
...
Fixes: memleaks
Fixes: 16289/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5200695692623872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 48b86dd8a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
b72b3d43ed
avcodec/idcinvideo: Add 320x240 default maximum resolution
...
Fixes: Timeout (128sec -> 2ms)
Fixes: 16568/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IDCIN_fuzzer-5675004095627264
See: [FFmpeg-devel] [PATCH 4/4] tools/target_dec_fuzzer: Adjust max_pixels for IDCIN
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9fcf881e6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
032fc5b082
avformat/realtextdec: free queue on error
...
Fixes: memleak
Fixes: 16277/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5696629440512000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 493438fafc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
9dd231c42c
avcodec/alsdec: Fix integer overflow in decode_var_block_data()
...
Fixes: signed integer overflow: 1927975249 - -514719744 cannot be represented in type 'int'
Fixes: 16413/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5651206856245248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 661a9b274b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
e37b9df6c9
avcodec/alsdec: Limit maximum channels to 512
...
There seems to be no limit in the specification and upto 64k could be stored
512 is choosen as limit as thats the maximum in a conformance sample
An alternative to this patch would be a max_channels variable
Fixes: OOM
Fixes: 16200/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5764788793114624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Thilo Borgmann <thilo.borgmann@mail.de >
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f51e4d026c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
12f5cb95f8
avcodec/anm: Check input size for a frame with just a stop code
...
Fixes: Timeout (11sec -> 6sec)
Fixes: 16344/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ANM_fuzzer-5673032000995328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1965161ef6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
5349964e02
avcodec/flicvideo: Optimize and Simplify FLI_COPY in flic_decode_frame_24BPP() by using bytestream2_get_buffer()
...
Fixes: Timeout (31sec -> 22sec)
Fixes: 16217/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-5658084189405184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e301736862 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
36e3470195
avcodec/loco: Check left column value
...
Fixes: Timeout (42sec -> 379 ms)
Fixes: 16323/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5679178099195904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c812db814e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
50b07e145b
avcodec/ffwavesynth: Fixes invalid shift with pink noise seeking
...
Fixes: left shift of negative value -961533698048
Fixes: 16242/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5738550670131200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cdea0206ef )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
a2d0ed8718
avcodec/ffwavesynth: Fix integer overflow for some corner case values
...
Fixes: left shift of negative value -14671840
Fixes: 16000/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5145977817661440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c4a88fb546 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
66e60b3c96
avcodec/indeo2: Check remaining input more often
...
Fixes: Timeout (95sec -> 30ms)
Fixes: 14765/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO2_fuzzer-5692455527120896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpe
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 52939a2c57 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
87a4871571
avcodec/diracdec: Check that slices are fewer than pixels
...
Fixes: Timeout (197sec ->144ms)
Fixes: 15034/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5733549405110272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fbbc8ba67f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
b9b9106f25
avcodec/vp56: Consider the alpha start as end of the prior header
...
Fixes: Timeout (23sec -> 71ms)
Fixes: 15661/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP6A_fuzzer-6257865947348992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit db78bc1297 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
32b4512aec
avcodec/4xm: Check for end of input in decode_p_block()
...
Fixes: Timeout (81sec -> 0.2sec)
Fixes: 16169/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5662570416963584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8f92eb05e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
1adb5720a2
avcodec/hevcdec: Check delta_luma_weight_l0/1
...
Fixes: signed integer overflow: 1 + 2147483647 cannot be represented in type 'int'
Fixes: 16041/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5685680656613376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 021f29506b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
0ca85d1326
avcodec/hnm4video: Optimize postprocess_current_frame()
...
Improves: Timeout (220sec -> 108sec)
Improves: 15570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HNM4_VIDEO_fuzzer-5085482213441536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cd460f4da0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
23f54b4db2
avcodec/hevc_refs: Optimize 16bit generate_missing_ref()
...
Fixes: Timeout (86sec -> 8sec) [these numbers assume also "[FFmpeg-devel] [PATCH 2/5] [RFC] avcodec/hevcdec: Check for overread in hls_decode_entry()"]
Fixes: 15702/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5657764929470464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit da8936969f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
fd897acc35
avcodec/scpr: Use av_memcpy_backptr() in type 17 and 33
...
This makes the changed code-path faster.
Change not tested except with the fuzzer testcase as I found no other testcase.
Improves: Timeout (136sec -> 74sec)
Improves: 16040/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-5705876062601216
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit 950a21e83c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
26d48144e5
avcodec/dds: Use ff_set_dimensions()
...
Fixes: signed integer overflow: 2082471995 * 36 cannot be represented in type 'int'
Fixes: 16025/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DDS_fuzzer-5136663778426880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9cd1e939cf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
dbc9f38aac
avcodec/mpc8: Fix 32bit mask/enum
...
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 15817/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC8_fuzzer-5636626409062400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e8bb949ade )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
e80c90eadb
avcodec/alsdec: Fix integer overflows of raw_samples in decode_var_block_data()
...
This also makes the code consistent with the existing similar MUL64()
in decode_var_block_data()
Fixes: signed integer overflow: -7277630735906765035 + -3272193951413647896 cannot be represented in type 'long'
Fixes: 16015/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5666552818434048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fad3ec89b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
fb12d635c5
avcodec/alsdec: Fix integer overflow of raw_samples in decode_blocks()
...
Fixes: signed integer overflow: 2147483424 - -1772303236 cannot be represented in type 'int'
Fixes: 15708/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5067890362941440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ce65232406 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
351381a3e3
avcodec/alsdec: fix mantisse shift
...
Fixes: shift exponent -1 is negative
Fixes: 16039/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5656825657032704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 02346292a3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
e5661aa706
avcodec/aacdec_template: fix integer overflow in imdct_and_windowing()
...
Fixes: signed integer overflow: 2147483645 + 4 cannot be represented in type 'int'
Fixes: 15418/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5685269069561856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit da93e2b142 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Andreas Rheinhardt
dbc9034dc2
libavcodec/iff: Use unsigned to avoid undefined behaviour
...
The initialization of the uint32_t plane32_lut matrix uses left shifts
of the form 1 << plane; plane can be as big as 31 which means that this
is undefined behaviour as 1 will be simply an int. So make it unsigned
to avoid this.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f12e662a3d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
c3ab134903
avcodec/alsdec: Check for block_length <= 0 in read_var_block_data()
...
Fixes: left shift of negative value -1
Fixes: 15719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5685731105701888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be4fb282f9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
4aaf644892
avcodec/vqavideo: Set video size
...
Fixes: out of array access
Fixes: 15919/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-5657368257363968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 02f909dc24 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
e17bf0ab54
avcodec/sanm: Check extradata_size before allocations
...
Fixes: Leaks
Fixes: 15349/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5102530557640704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 172a43ce36 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
703ddaeac2
avcodec/mss1: check for overread and forward errors
...
Fixes: Timeout (106sec -> 14ms)
Fixes: 15576/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSS1_fuzzer-5688080461201408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 43015afd7c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
fbb686fe1a
avcodec/dirac_parser: Fix overflow in dts
...
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 15568/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5634719611355136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 549fcba8fc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
499ec067ad
avcodec/ralf: Fix undefined pointer in decode_channel()
...
Fixes: 16203/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5086088934195200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3c06ba1716 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
0f11aa263e
avcodec/ralf: Fix integer overflow in apply_lpc()
...
Fixes: signed integer overflow: 1603085316 + 1238786562 cannot be represented in type 'int'
Fixes: 16203/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5086088934195200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ccca484324 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
5a16b294ed
avcodec/vorbisdec: Implement vr->classifications = 1
...
It appears no valid file uses this, so this is not testable with
a valid file.
Fixes: assertion failure
Fixes: 16187/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5638880618872832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5a5f12e3b3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
8f14f06595
avcodec/vorbisdec: Check parameters in vorbis_floor0_decode() before divide
...
Fixes: division by zero
Fixes: 16183/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5688966782648320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aecc9b96d6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
b7fcf8bf26
avformat/realtextdec: Check for duplicate extradata in realtext_read_header()
...
Fixes: memleak
Fixes: 16140/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5684008052064256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 652ea23cb3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
e7efe2aacf
avcodec/apedec: Fix 2 signed overflows
...
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int'
Fixes: signed integer overflow: 2049431315 + 262759074 cannot be represented in type 'int'
Fixes: 16012/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5719016003338240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 392c028cd2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
003bb6616c
avcodec/mss3: Check for the rac stream being invalid in rac_normalize()
...
Fixes: out of array read
Fixes: 15982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSA1_fuzzer-5630676251967488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 99a172f3f4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
5d353f32c6
avcodec/vc1_block: Check get_vlc2() return before use
...
Fixes: index -1 out of bounds for type 'const uint8_t [185][2]'
Fixes: 15720/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSS2_fuzzer-5666071933091840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2cb1f79735 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
bf3520cd64
avcodec/apedec: Do not partially clear data array
...
Fixes: Assertion failure and memleak
Fixes: 15709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5182435093905408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e4b522c91 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
d218b9e067
avcodec/hnm4video: Forward errors of decode_interframe_v4()
...
Fixes: Timeout (108sec -> 160ms)
Fixes: 15570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HNM4_VIDEO_fuzzer-5085482213441536
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9af8ce754b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
8b525ccd36
avcodec/vp3: Check that theora is theora
...
Theora is forced to be non zero if it is zero and a sample
is asked for, as suggested by reimar
Fixes: Timeout (2min -> 600ms)
Fixes: 15366/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-5737849938247680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b4bf7226af )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
2dadc27de2
avcodec/vc1_pred: Fix invalid shift in scaleforsame()
...
Fixes: left shift of negative value -1
Fixes: 15531/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5759556258365440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6dfda35dd2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
06ad829800
avcodec/vc1_block: Fix integer overflow in ff_vc1_pred_dc()
...
Fixes: signed integer overflow: 32796 * 65536 cannot be represented in type 'int'
Fixes: 15430/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5735424087031808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f31ed8f3b0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
9ba145e243
avcodec/truemotion2: Fix several integer overflows in tm2_motion_block()
...
Fixes: 15524/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5173148372172800
Fixes: signed integer overflow: 13701388 - -2134868270 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9a353ea876 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
ef6ca6adff
avcodec/apedec: make left/right unsigned to avoid undefined behavior
...
Fixes: signed integer overflow: 755176387 + 1515360583 cannot be represented in type 'int'
Fixes: 15506/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5706859232624640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf778af149 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
363dd60366
avcodec/apedec: Fix multiple integer overflows and undefined behaviorin filter_3800()
...
Fixes: left shift of negative value -4
Fixes: signed integer overflow: -15091694 * 167 cannot be represented in type 'int'
Fixes: signed integer overflow: 1898547155 + 453967445 cannot be represented in type 'int'
Fixes: 15258/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5759095564402688
Fixes: signed integer overflow: 962196438 * 31 cannot be represented in type 'int'
Fixes: 15364/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5718799845687296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 267eb2ab7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
29fe37850a
avformat/mpc: deallocate frames array on errors
...
Fixes: memleak on error path
Fixes: 15984/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5679918412726272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit da5039415c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
b4edee5cab
avcodec/eatqi: Check for minimum frame size
...
The minimum header is 8 bytes, the smallest bitstream that is passed to
the MB decode code is 4 bytes
Fixes: Timeout (35sec -> 18sec)
Fixes: 15800/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATQI_fuzzer-5684154517159936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5ffb8e8793 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
2a43d9f882
avcodec/eatgv: Check remaining size after the keyframe header
...
The minimal size which unpack() will not fail on is 5 bytes
Fixes: Timeout (14sec -> 77ms) (testcase 15508)
Fixes: 15508/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATGV_fuzzer-5700053513011200
Fixes: 15996/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATGV_fuzzer-5751353223151616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 009ec8dc33 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
a71f9aaf42
avcodec/assdec: undefined use of memcpy()
...
Fixes: null pointer passed as argument 2, which is declared to never be null
Fixes: 16008/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SSA_fuzzer-5650582821404672 (this is a separate issue found in this testcase)
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47b6ca0b02 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
86549d839f
avcodec/brenderpix: Check input size before allocating image
...
An incomplete image is not supported prior to this and will
not produce any output. This commit moves the failure before
time consuming operations.
Fixes: Timeout (81sec -> 76ms)
Fixes: 15723/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BRENDER_PIX_fuzzer-5147265653538816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38b6c48c43 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Matt Wolenetz
c88d2c4e2f
lafv/wavdec: Fail bext parsing on incomplete reads
...
avio_read can successfully return even when less than the requested
amount of input was read. wavdec's bext parsing mistakenly assumed a
successful avio_read always read the full amount that was requested.
The result could be dictionary tags populated with partially
uninitialized values.
This change also fixes a broken assertion in wav_parse_bext_string that
was off-by-one, though no known current usage of that method hits that
broken case.
Chromium bug: 987270
Signed-off-by: Matt Wolenetz <wolenetz@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 052d41377a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
5088a3e2d3
avcodec/utils: fix leak of subtitle_header on error path
...
Fixes: memleak
Fixes: 15528/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_STL_fuzzer-5735993371525120
Fixes: 15792/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SAMI_fuzzer-5737754232619008
Fixes: 16008/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SSA_fuzzer-5650582821404672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 923d5c489f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:45 +01:00
Michael Niedermayer
c3b7afa4e9
avcodec/utils: Check close before calling it
...
Fixes: NULL pointer dereference
Fixes: 15733/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IDF_fuzzer-5658616977162240
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8df6884832 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-15 12:25:39 +01:00
Michael Niedermayer
baa8bca448
avcodec/vorbisdec: Check vlc for floor0 dec vector offset
...
Fixes: out of array access
Fixes: 15649/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5729191309344768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 99f95f39c6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:38 +01:00
Michael Niedermayer
8666a635fd
avcodec/vorbisdec: amplitude bits can be more than 25 bits
...
Fixes: assertion failure, invalid shift
Fixes: 15583/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5640157484548096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 308771a738 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:38 +01:00
Michael Niedermayer
175def86b7
avutil/softfloat_ieee754: Fix odd bit position for exponent and sign in av_bits2sf_ieee754()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 82e389d066 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:38 +01:00
Michael Niedermayer
1dcb1dd490
avcodec/apedec: Fix various integer overflows
...
Fixes: signed integer overflow: -538976267 * 31 cannot be represented in type 'int'
Fixes: left shift of 65312 by 16 places cannot be represented in type 'int'
Fixes: 15255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5718831688843264
Fixes: 15547/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5691384901664768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 240bf0e596 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:38 +01:00
Michael Niedermayer
91abbbda59
avcodec/apedec: Fix multiple integer overflows in predictor_update_filter()
...
Fixes: signed integer overflow: -829262115 + -1410750414 cannot be represented in type 'int'
Fixes: 15251/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5651742252859392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0af08cb803 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:38 +01:00
Michael Niedermayer
428dee1a03
avcodec/alsdec: fix undefined shift in multiply()
...
Fixes: left shift of negative value -6
Fixes: 15564/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5701655938465792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b880b3b236 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:38 +01:00
Michael Niedermayer
71fd020197
avcodec/alsdec: Fix 2 integer overflows
...
Fixes: signed integer overflow: 1270564968 + 904828220 cannot be represented in type 'int'
Fixes: 15402/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5755426823471104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9cd0d94f59 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:38 +01:00
Michael Niedermayer
b3d8b99a28
avcodec/flicvideo: Make line_packets int
...
Fixes: signed integer overflow: -32768 * 196032 cannot be represented in type 'int'
Fixes: 15300/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-5733319519502336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 54bd47f861 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:38 +01:00
Michael Niedermayer
03ea84792a
avcodec/dvbsubdec: Use ff_set_dimensions()
...
Fixes: signed integer overflow: 65313 * 65313 cannot be represented in type 'int'
Fixes: 15740/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVBSUB_fuzzer-5641749164195840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5941b7f615 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:38 +01:00
Michael Niedermayer
2d86e41d45
avcodec/ffwavesynth: Check if there is enough extradata before allocation
...
Fixes: OOM
Fixes: 15750/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5702090367696896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65bac4a782 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:38 +01:00
Michael Niedermayer
6e1b07c0b2
avcodec/ffwavesynth: More correct cast in wavesynth_seek()
...
Fixes: signed integer overflow: 553590816 - -9223372036315799520 cannot be represented in type 'long'
Fixes: 15743/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5705835377852416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f4605770af )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:38 +01:00
Michael Niedermayer
68ee6f4d8b
avcodec/ffwavesynth: Check sample rate before use
...
Fixes: division by zero
Fixes: 15725/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5641231956180992
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c95857a423 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:38 +01:00
Michael Niedermayer
190b92359b
avcodec/dnxhd_parser: Fix parser when input does not have nicely sized packets
...
Fixes: out of array access
Fixes: 15522/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DNXHD_fuzzer-5747756078989312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d900d8fe0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:38 +01:00
Michael Niedermayer
6118362864
avcodec/dnxhd_parser: remove unneeded code
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1707dbdf49 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:38 +01:00
Michael Niedermayer
774d23af2f
avformat/utils: Check rfps_duration_sum for overflow
...
Fixes: signed integer overflow: 9151595917793558550 + 297519050751678697 cannot be represented in type 'long'
Fixes: 15496/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5722866475073536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c46fdf305 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:38 +01:00
Michael Niedermayer
12dfbefda2
avcodec/h264_refs: Also check reference in ff_h264_build_ref_list()
...
Fixes: out of array read
Fixes: 15409/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5758846959616000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d3581e6bb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:38 +01:00
Michael Niedermayer
5bcced7bea
avcodec/parser: Check next index validity in ff_combine_frame()
...
Fixes: out of array access
Fixes: 15522/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DNXHD_fuzzer-5747756078989312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 15008db0fa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:38 +01:00
Michael Niedermayer
c2507e1946
avcodec/ivi: Ask for samples with odd tiles
...
Fixes: Assertion failure
Fixes: 15422/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO5_fuzzer-5676625481433088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a7e02cf3ad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:38 +01:00
Michael Niedermayer
cda23a57cc
avformat/xmv: Make bitrate 64bit
...
Fixes: signed integer overflow: 32 * 538976288 cannot be represented in type 'int'
Fixes: 15633/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5752273981931520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 39a6a79bcb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
0af60924ea
avcodec/pngdec: Check that previous_picture has same w/h/format
...
Fixes: out of array access
Fixes: 15540/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-5684905029140480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 18c808ffbe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
2b0180f80b
avcodec/huffyuv: remove gray8a (the format is listed but not supported by the implementation)
...
Fixes: null pointer dereference
Fixes: 15464/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-5681391150301184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6aaa01afe4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
db136657d4
avcodec/mpc8: Fixes invalid shift in mpc8_decode_frame()
...
Fixes: left shift of negative value -456
Fixes: 15561/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC8_fuzzer-5758130404720640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1dbb67d39b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
James Zern
7a026998b0
avcodec/utils, avcodec_open2: close codec on failure
...
after a successful init if the function fails for another reason close
the codec without requiring FF_CODEC_CAP_INIT_CLEANUP which is meant to
cover init failures themselves. fixes a memory leak in those cases.
BUG=oss-fuzz:15529
Signed-off-by: James Zern <jzern@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b1febda061 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
49b4d41ec1
avcodec/golomb: Correct the doxy about get_ue_golomb() and errors
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1bb3b3f11c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
bcc19ab7b7
avformat/utils: Check timebase before use in estimate_timings()
...
Fixes: division by 0
Fixes: 15480/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5746727434321920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f57e97dfd9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
f095734005
avcodec/hq_hqa: Use ff_set_dimensions()
...
Fixes: 15530/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-5637370344374272
Fixes: signed integer overflow: 65312 * 65312 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6229fcd40 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
99c45c0c82
avcodec/rv10: Fix integer overflow in aspect ratio compare
...
Fixes: signed integer overflow: 2040 * 1187872 cannot be represented in type 'int'
Fixes: 15368/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV20_fuzzer-5681657136283648
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 14fcf42958 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
a7acecb0d9
avcodec/4xm: Fix signed integer overflows in idct()
...
Fixes: signed integer overflow: 20242 * 121095 cannot be represented in type 'int'
Fixes: 15310/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5737051745419264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2bbea155bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
c698d9e46b
avcodec/qdm2: Check checksum_size for 0
...
Fixes: Infinite loop
Fixes: 15337/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5757428949319680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b2ebf89a4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
a85e0a0b8d
avcodec/qdm2: error out of qdm2_fft_decode_tones() before entering endless loop
...
Fixes: signed integer overflow: 2147483646 + 2 cannot be represented in type 'int'
Fixes: infinite loop
Fixes: 15396/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5116605501014016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 694be24bd6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
32902cc988
avcodec/qdm2: Do not read out of array in fix_coding_method_array()
...
Instead we ask for a sample, its unclear what to do in this case.
Fixes: index 30 out of bounds for type 'int8_t [30][64]'
Fixes: 15339/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5749441484554240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ae021c1239 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
388d36101b
avcodec/svq3: Use ff_set_dimension()
...
Fixes: OOM
Fixes: 15410/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-5659464805384192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b114d7687 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
d0651f24ba
avcodec/iff: Check ham vs bpp
...
This checks the ham value much stricter and avoids hitting cases which cannot be reached
with data from the libavformat demuxer.
Fixes: out of array access
Fixes: 15320/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5080476840099840
Fixes: 15423/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5630765833912320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f76d7352e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
69a7633a76
avcodec/ffwavesynth: use uint32_t to compute difference, it is enough
...
Fixes: signed integer overflow: 6494225984479297536 - -6043795377581187040 cannot be represented in type 'long'
Fixes: 15285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5632780307791872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e9dd3c7126 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
6e050fc931
avcodec/ffwavesynth: Simplify lcg_seek(), avoid negative case
...
Fixes: negation of -9223372036854775808 cannot be represented in type 'int64_t' (aka 'long'); cast to an unsigned type to negate this value to itself
Fixes: 15289/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5709034499342336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c02209935 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
98e712bd1c
avcodec/ffwavesynth: Fix backward lcg_seek()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf2bd3ce79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
eb7a4a27c4
avcodec/flicvideo: Fix off by 1 error in flic_decode_frame_24BPP()
...
Fixes: out of array access
Fixes: 15360/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-5653837190266880
Fixes: 15412/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-5740537648250880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 37708cbae8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
8548434337
avcodec/vc1_block: Check for vlc error in vc1_decode_ac_coeff()
...
Fixes: index -1 out of bounds for type 'const uint8_t [185][2]'
Fixes: 15250/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5648992869810176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 79204a1fc8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
ea7aadd74a
avcodec/alac: Check lpc_quant
...
lpc_quant of 0 produces undefined behavior, thus disallow this.
If valid samples use this then such a sample would be quite
usefull to confirm the correct&lossles handling of this.
Fixes: libavcodec/alac.c:218:25: runtime error: shift exponent -1 is negative
Fixes: 15273/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5656388535058432
Fixes: 15276/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5761238417539072
Fixes: 15315/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5767260766994432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6474b899c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
5190d3a2f7
avcodec/alsdec: Add FF_CODEC_CAP_INIT_CLEANUP
...
Fixes: multiple memleaks
Fixes: 15293/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5642409288925184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b7b6ddd596 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
4852df4a21
avcodec/alsdec: Fix integer overflow with buffer number
...
Fixes: signed integer overflow: 65313 * 65313 cannot be represented in type 'int'
Fixes: 15290/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5738074249625600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f64f6058e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
3e491e9c59
avcodec/alsdec: Fixes signed integer overflow in LSB addition
...
Fixes: signed integer overflow: 8 * 536870912 cannot be represented in type 'int'
Fixes: 15281/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5744458785619968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f527021df )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
36c278078d
avcodec/alsdec: Check opt_order / sb_length in ra_block handling
...
Fixes: out of array access
Fixes: 15277/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5184853437317120
Fixes: 15280/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5741062137577472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0794494c8f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
49cb2d44a4
avcodec/alsdec: Fix integer overflow with shifting samples
...
Fixes: signed integer overflow: -346039050 * 8 cannot be represented in type 'int'
Fixes: 15283/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5692700268953600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a3bd4b260e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
1ebd25b1f1
avcodec/alsdec: Fix undefined behavior in decode_rice()
...
Fixes: left shift of 72 by 26 places cannot be represented in type 'int'
Fixes: 15279/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5700665621348352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 51f6870c37 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
5f5766691d
avcodec/alsdec: Fixes invalid shifts in read_var_block_data() and INTERLEAVE_OUTPUT()
...
Fixes: left shift of negative value -6
Fixes: 15275/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5742361767837696
Fixes: signed integer overflow: 41582592 * 256 cannot be represented in type 'int'
Fixes: 15296/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5739558227935232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e131568752 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
ec9a2cb48b
avcodec/hevc_ps: Change num_tile_rows/columns checks to sps->ctb_height/weight
...
Suggested-by: James Almer <jamrial@gmail.com >
Reviewed-by: James Almer <jamrial@gmail.com
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3b2082c663 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
3bdd16fd68
avcodec/hevc_ps: Fix integer overflow with num_tile_rows and num_tile_columns
...
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 14880/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5130977304641536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c692051252 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
9a7d3304ff
avcodec/apedec: Add k < 24 check to the only k++ case which lacks such a check
...
Fixes: 15255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5718831688843264
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d4f4f4a15 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
241f59eb8b
avformat/aviobuf: Delay buffer downsizing until asserts are met
...
Fixes: Assertion failure
Fixes: 15151/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5757079496687616
Fixes: 15205/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5767573242642432
May fix: Ticket7094
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0334632d5c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
6aaca5234d
avcodec/fitsdec: Check data_min/max
...
Fixes: division by 0
Fixes: 15206/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5657260212092928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eb82d19f03 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
80bbb8b851
avcodec/m101: Fix off be 2 error
...
Fixes: out of array read
Fixes: 15263/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_M101_fuzzer-5728999453491200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 89b96900fa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
d84f4c0c25
avcodec/qdm2: Move fft_order check up
...
This avoids undefined computations with unchecked values
Fixes: shift exponent -21 is negative
Fixes: 15262/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5651261753393152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8d8b8c4ac6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
9856f1f615
avcodec/libvorbisdec: Check extradata size
...
Fixes: out of array read
Fixes: 15261/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVORBIS_fuzzer-5764908467093504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf3c245566 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
93baaaaa8c
avformat/vqf: Check header_size
...
Fixes: 15271/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5735262606327808
Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7c30ff3888 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
ec2b12fa05
avcodec/utils: Check bits_per_coded_sample
...
This avoids the need for each decoder separately having to handle this case
Fixes: shift exponent -100663046 is negative
Fixes: out of array access
Fixes: 15270/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5727829913763840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d33414d2ad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
f1400191c6
avcodec/videodsp_template: Fix overflow of addition
...
Fixes: addition of unsigned offset to 0x7f56fc26a9b6 overflowed to 0x7f56fc26a8be*
Fixes: clusterfuzz-testcase-minimized-mediasource_MP4_AVC1_pipeline_integration_fuzzer-4917949056679936
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 247a1de7f7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
55fca6e6e5
avcodec/alsdec: Fix invalid shift in multiply()
...
Fixes: shift exponent -24 is negative
Fixes: 15292/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5768533318828032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f30be1ec98 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
fb81fd52d3
avcodec/ffwavesynth: Check ts_end - ts_start for overflow
...
Fixes: signed integer overflow: 2314885530818453536 - -8926099139098304480 cannot be represented in type 'long'
Fixes: 15259/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5764366093254656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2db7a3bc4a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
0409e5fe36
avcodec/vc1dsp: Avoid undefined shifts in vc1_v_s_overlap_c / vc1_h_s_overlap_c
...
Fixes: left shift of negative value -13
Fixes: 15260/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5702076048343040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 507ca66ee4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
5a49cad78a
avcodec/tta: Fix undefined shift
...
Fixes: left shift of negative value -4483
Fixes: 15256/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5738691617619968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ebccd2f778 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
7887aa79de
avcodec/qdmc: Fix integer overflows in PRNG
...
Fixes: signed integer overflow: 214013 * 2531011 cannot be represented in type 'int'
Fixes: 15254/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDMC_fuzzer-5698137026461696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2921b45a38 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
6aa01c0625
avcodec/bintext: Check font height
...
Fixes: division by zero
Fixes: 15257/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINTEXT_fuzzer-5757352881422336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bfb58bdd70 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
00d5a47039
avcodec/binkdsp: Fix integer overflows in idct
...
Fixes: signed integer overflow: 3784 * 682038 cannot be represented in type 'int'
Fixes: 15265/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5088311799971840
Fixes: 15268/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5666502344179712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7a072fbcc4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
ed92170916
avcodec/motionpixels: Check for vlc error in mp_get_vlc()
...
Fixes: 15246/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOTIONPIXELS_fuzzer-5168534407086080
Fixes: runtime error: index -1 out of bounds for type 'HuffCode [16]'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 930cdef80a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
65326b27b6
avcodec/loco: Limit lossy parameter so it is sane and does not overflow
...
Fixes: 15248/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5087440458481664
Fixes: signed integer overflow: 3 + 2147483647 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ce3b0b9066 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
a77473d040
avformat/mov: Set fragment.found_tfhd only after TFHD has been parsed
...
Fixes: Assertion failure
Fixes: crbug971646.mp4
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 696312c487 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
eca9b4022b
avcodec/xpmdec: Do not use context dimensions as temporary variables
...
Fixes: Integer overflow
Fixes: 15134/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XPM_fuzzer-5722635939348480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5ea7f20500 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
91348aa5ba
avcodec/fitsdec: Fix division by 0 in size check
...
Fixes: division by zero
Fixes: 15210/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5746033243455488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 07ffe94c17 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
36f8bb1261
avcodec/aacpsdsp_template: Fix integer overflow in ps_hybrid_analysis_c()
...
Fixes: signed integer overflow: -1539565182 + -798086761 cannot be represented in type 'int'
Fixes: 14807/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-564925382682214
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f8f5668df5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
7ca17d973b
avcodec/truemotion2: Fix integer overflow in last loop in tm2_update_block()
...
Fixes: signed integer overflow: -1727985666 - 538976288 cannot be represented in type 'int'
Fixes: 15031/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5100228035739648
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3aecd01704 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
d88be9bc67
avcodec/iff: finetune the palette size check in the mask case
...
Fixes: out of array access
Fixes: 15381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5668057826983936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0f9789c8e3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
67ad2f201c
avcodec/iff: Fix mask_buf / mask_palbuf leak
...
Fixes: 15372/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5708881759567872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 92e8db532c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
1246e38511
avformat/icodec: Free ico->images on error paths
...
Fixes: 15116/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5715173567889408
Fixes: memleak
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 54918b5116 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
25d3ae9697
avformat/wsddec: Fix undefined shift
...
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 15123/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5738039235575808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 112eb17a2b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
30047c052d
avcodec/fmvc: Check if header fields are available before allocating the image
...
Fixes: Timeout (15sec -> 0.5sec)
Fixes: 14846/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FMVC_fuzzer-5068322120400896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 561cc161ca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
039c7d21f6
avcodec/bink: Reorder operations in init to avoid memleak on error
...
Fixes: Direct leak of 536 byte(s) in 1 object(s)
Fixes: 15266/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5629530426834944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2603f25d32 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
a8ff09d7b7
avformat/wtvdec: Avoid (32bit signed) sectors
...
Fixes: left shift of negative value -14614752
Fixes: 15174/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5670543606415360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dd357d76e5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
c8f7f583c0
avcodec/bitstream: Check for more conflicting codes in build_table()
...
Fixes: out of array read
Fixes: 14563/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5646451545210880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a7e3b271fc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
8d2d04569a
avcodec/bitstream: Check for integer code truncation in build_table()
...
Fixes: out of array read
Fixes: 14563/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5646451545210880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e78b0f8374 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
5b4ceb45e3
avformat/sbgdec: Fixes integer overflow in str_to_time() with hours
...
Fixes: signed integer overflow: 904444 * 3600 cannot be represented in type 'int'
Fixes: 15113/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5764083346833408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2a0f23b9d6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
62c408412f
avformat/vpk: Check offset for validity
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa003019ab )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
d14dd61a3d
avformat/vpk: Fix integer overflow in samples_per_block computation
...
Fixes: signed integer overflow: 84026453 * 28 cannot be represented in type 'int'
Fixes: 15111/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5675630072430592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c6c4129b4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
b8bb86efe7
avcodec/mjpegdec: Check for non ls PAL8
...
Fixes: Null-dereference READ in av_malloc
Fixes: 15002/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-5643474625363968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 442375fee7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
84b444aa78
avcodec/interplayvideo: check decoding_map_size with video_data_size
...
Fixes: Timeout (90543 ms -> 59 ms)
Fixes: 14721/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_VIDEO_fuzzer-5697492148027392
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 914d6a7c1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
a2927d38cb
avcodec/h264_parse: Use 64bit for expectedpoc and expected_delta_per_poc_cycle
...
Fixes: signed integer overflow: -2142516591 + -267814575 cannot be represented in type 'int'
Fixes: 14450/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5716105319940096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4896fa18ad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
ac7d876723
avcodec/mss4: Check input size against skip bits
...
Fixes: Timeout (17sec -> 20ms)
Fixes: 14615/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MTS2_fuzzer-5093007763701760
Fixes: 14797/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MTS2_fuzzer-5651696119709696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0fef412dff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
ddf153b139
avcodec/diracdec: Fix integer overflow in global_mv()
...
Fixes: signed integer overflow: 16384 * 196607 cannot be represented in type 'int'
Fixes: 14810/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5091232683917312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a99ffb5bb4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
14a62019bb
avcodec/vmnc: Check available space against chunks before reget_buffer()
...
Fixes: Timeout (16sec -> 60ms)
Fixes: 14673/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMNC_fuzzer-5640217517621248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 279d9a84af )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
5866e20b01
avcodec/aacdec_template: skip apply_tns() if max_sfb is 0 (from previous header decode failure)
...
Fixes: NULL pointer dereference
Fixes: 14723/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5654612436058112
Fixes: 14724/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5712607111020544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cf3156e762 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
1dc80a7d4e
avcodec/aacdec_fixed: Handle more extreem cases in noise_scale()
...
Its unclear if these cases have any relevance in real files
Fixes: shift exponent -2 is negative
Fixes: 14489/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5681941631729664
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d14663f83 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
1b2691fe1a
avcodec/aacdec_template: Merge 3 #ifs related to noise handling
...
Fewer #if and fewer lines
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc33c99d56 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
e575ac8d84
avcodec/aacdec_fixed: ssign seems always -1 in noise_scale(), simplify
...
(cherry picked from commit 3d5863d739 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
20ecac12c9
avformat/mp3enc: Avoid SEEK_END as it is unsupported
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf3ee6a130 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
eec89990b5
avcodec/truemotion2: Fix several integer overflows in tm2_update_block()
...
Fixes: signed integer overflow: -1877966852 + -469491713 cannot be represented in type 'int'
Fixes: 14561/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5167608359288832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8eecf761a6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
e1ceb17ee3
avformat/webm_chunk: Specify expected argument length of get_chunk_filename()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1a74b04737 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
abb7d3f1d0
avformat/webm_chunk: Check header filename length
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3b5b977c9f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
0ecde06ee7
avcodec/cpia: Check input size also against linesizes and EOL
...
Fixes: Timeout (14sec -> 29ms)
Fixes: 14733/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CPIA_fuzzer-5707022445576192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Carl Eugen Hoyos <ceffmpeg@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3c0bfa7d1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
900c0ecaed
swscale/tests/swscale: Lengthen pixfmt name buffer to 21 bytes
...
Some formats use longer names than 12.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d269301f0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Adam Richter
a0966c15b1
libswcale: Fix possible string overflow in test.
...
In libswcale/tests/swcale.c, the function fileTest() calls sscanf in
an argument of "%12s" on character srcStr[] and dstStr[], which are
only 12 bytes. So, if the input string is 12 characters, a
terminating null byte can be written past the end of these arrays.
This bug was found by cppcheck.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b8ed493061 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
9f8d2716a6
avcodec/hq_hqa: Check available space before reading slice offsets
...
Fixes: Timeout (43sec -> 18sec)
Fixes: 14556/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-5673543024508928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 407e7c34ca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Andreas Rheinhardt
81b5f4fac7
lavf/webm_chunk: Respect buffer size
...
The last argument of av_strlcpy is supposed to contain the size of the
destination buffer, but it was filled with the size of the source
string, effectively negating its very purpose.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73ef1f47f5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
ae1c6169b6
avcodec/fits: Check bitpix
...
Reference: Table 8: Interpretation of valid BITPIX value from FITS standard 4.0
Fixes: runtime error: division by zero
Fixes: 14581/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5652382425284608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0b5c93b276 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
cc5257aa27
avcodec/jvdec: Use ff_get_buffer() when the content is not reused
...
Fixes: Timeout (11sec -> 5sec)
Fixes: 14473/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JV_fuzzer-5761630857592832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 09edcd3572 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
0fe00cdc54
avcodec/truemotion2: Fix 2 integer overflows in tm2_update_block()
...
Fixes: signed integer overflow: -2147483648 + -1 cannot be represented in type 'int'
Fixes: 14107/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5694078680825856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f4a1b8d409 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
b131d7653e
avcodec/jpeg2000: Check stepsize before using it
...
Fixes: value 1.87633e+10 is outside the range of representable values of type 'int'
Fixes: Undefined behavior
Fixes: 14246/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5758393601490944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 06ef186fa1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
85b8a4d2c7
avcodec/aacdec_fixed: Fix undefined shift in noise_scale()
...
Fixes: 13655/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5120559430500352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ea211ab79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
bbbe82b142
avutil/avstring: Fix bug and undefined behavior in av_strncasecmp()
...
The function in case of n=0 would read more bytes than 0.
The end pointer could be beyond the allocated space, which
is undefined.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6f0e9a8634 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
26d7824352
avformat/mov: Skip stsd adjustment without chunks
...
Fixes: Assertion failure
Fixes: clusterfuzz-testcase-minimized-media_pipeline_integration_fuzzer-5683096400822272
Found-by: Clusterfuzz
Reported-by: Dan Sanders <sandersd@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 18a567c369 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
59ac418258
avformat/aadec: Check for scanf() failure
...
Fixes: use of uninitialized variables
Fixes: blank.aa
Found-by: Chamal De Silva <chamal.desilva@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ed188f6dcd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
7751626787
avcodec/ccaption_dec: Add a blank like at the end to avoid rollup reading from outside
...
Fixes: index 20 out of bounds for type 'const char *[4][128]'
Fixes: 14367/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CCAPTION_fuzzer-5718819672162304
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f17e8e90bb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
b27afd717d
avcodec/ivi: Move buffer/block end check to caller of ivi_dc_transform()
...
Fixes: assertion failure
Fixes: 14078/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO5_fuzzer-5760571284127744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 110dce9633 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
76f6712057
avcodec/diracdec: Use 64bit in intermediate of global motion vector field generation
...
It seems the specification does not limit the value to 32bit
Fixes: signed integer overflow: -109611143 * 24 cannot be represented in type 'int'
Fixes: 13477/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5648337460527104
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 837820f385 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
12a6305799
avcodec/truemotion2: Fix integer overflow in tm2_decode_blocks()
...
Fixes: signed integer overflow: 255 + 2147483634 cannot be represented in type 'int'
Fixes: 13472/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5712444142387200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ad0533e91 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
Michael Niedermayer
1a71be4eaa
avcodec/rscc: Check that the to be uncompressed input is large enough
...
Fixes: Out of array access
Fixes: 13984/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RSCC_fuzzer-5734128093233152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a0ec1511e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-11-14 23:30:37 +01:00
James Almer
45bf2f4d72
avcodec/bsf: check that AVBSFInternal was allocated before dereferencing it
...
This can happen when av_bsf_free() is called on av_bsf_alloc() failure.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit d889ae3396 )
2019-09-23 10:09:16 -03:00
Carl Eugen Hoyos
cfa7c079f7
lavf/rawenc: Only accept the appropriate stream type for raw muxers.
...
This does not affect the rawvideo muxer.
Fixes ticket #7979 .
(cherry picked from commit aef24efb0c )
2019-09-06 19:01:27 -03:00
Stefan Schoenefeld
31161bc969
avcodec/h263dec: fix hwaccel decoding
...
Recently we encountered an issue when decoding a h.263 file:
FFmpeg will freeze when decoding h.263 video with NVDEC. Turns out this is not directly related to NVDEC but is a problem that shows with several other HW decoders like VDPAU, though the exact kind of error is different (either error messages or freezing[1]). The root cause is that ff_thread_finish_setup() is called twice per frame from ff_h263_decode_frame(). This is not supported by ff_thread_finish_setup() and specifically checked for and warned against in the functions code. The issue is also specific to hw accelerated decoding only as the second call to ff_thread_finish_setup() is only issued when hw acceleration is on. The fix is simple: add a check that the first call is only send when hw acceleration is off, and the second call only when hw acceleration is on (see attached patch). This works fine as far as I was able to test with vdpau and nvdec/nvcuvid hw decoding. The patch also adds NVDEC to the hw config list if available.
I also noticed a secondary issue when browsing through the code which is that, according to documentation, ff_thread_finish_setup() should only be called if the codec implements update_thread_context(), which h263dec does not. The patch does not address this and I'm not sure any action needs to be taken here at all.
[1] This is depending on whether or not the hw decoder sets the HWACCEL_CAPS_ASYNC_SAFE flag
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2019-08-04 16:24:54 +02:00
Mark Harris
29362d5f9a
avutil/mem: Fix invalid use of av_alloc_size
...
The alloc_size attribute is valid only on functions that return a
pointer. GCC 9 (not yet released) warns about invalid usage:
./libavutil/mem.h:342:1: warning: 'alloc_size' attribute ignored on a function returning int' [-Wattributes]
342 | av_alloc_size(2, 3) int av_reallocp_array(void *ptr, size_t nmemb, size_t size);
| ^~~~~~~~~~~~~
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4361293fcf )
2019-07-23 01:18:40 -03:00
James Almer
bb22b9ce21
avformat/aacdec: resync to the next adts frame on invalid data instead of aborting
...
Should fix ticket #6634
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 881e1f5a62 )
2019-07-23 01:13:41 -03:00
James Almer
a9282fc964
avformat/aacdec: factorize the adts frame resync code
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit a38eab8b75 )
2019-07-23 00:46:46 -03:00
Michael Niedermayer
0ac9001ab9
Update for 3.4.6
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-28 10:23:26 +01:00
Michael Niedermayer
9ccc633068
avcodec/hevcdec: Avoid only partly skiping duplicate first slices
...
Fixes: NULL pointer dereference and out of array access
Fixes: 13871/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5746167087890432
Fixes: 13845/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5650370728034304
This also fixes the return code for explode mode
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 54655623a8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-27 08:48:30 +01:00
Carl Eugen Hoyos
d31940f04e
lavc/bmp: Avoid a heap buffer overwrite for 1bpp input.
...
Found by Mingi Cho, Seoyoung Kim, and Taekyoung Kwon
of the Information Security Lab, Yonsei University.
(cherry picked from commit 1e34014010 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-27 08:47:30 +01:00
Michael Niedermayer
807d443c7e
avcodec/truemotion2: Fix integer overflow in tm2_null_res_block()
...
Fixes: signed integer overflow: 1111638592 - -2122219136 cannot be represented in type 'int'
Fixes: 13441/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5732769815068672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1223696c72 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-25 15:32:07 +01:00
Michael Niedermayer
5e09dc8afe
avcodec/dfa: Check the chunk header is not truncated
...
Fixes: Timeout (11sec -> 3sec)
Fixes: 13218/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DFA_fuzzer-5661074316066816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f20760fadb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:52 +01:00
Michael Niedermayer
51d29541cb
avcodec/dvbsubdec: Check object position
...
Reference: ETSI EN 300 743 V1.2.1 7.2.2 Region composition segment
Fixes: Timeout
Fixes: 13325/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVBSUB_fuzzer-5143979392237568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8c5ae4511 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:52 +01:00
Michael Niedermayer
d2fd2921e3
avcodec/cdgraphics: Use ff_set_dimensions()
...
Fixes: Timeout (17 sec -> 65 milli sec)
Fixes: 13264/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CDGRAPHICS_fuzzer-5711167941509120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9a9f0e239c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:52 +01:00
Michael Niedermayer
2d825946a3
avformat/gdv: Check fps
...
Fixes: Division by 0
Fixes: ffmpeg_zero_division.bin
Found-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38381400fc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:52 +01:00
Michael Niedermayer
6689435190
avcodec/scpr: Fix use of uninitialized variable
...
Fixes: Undefined shift
Fixes: 12911/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-5677102915911680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53248acfb3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:52 +01:00
Michael Niedermayer
f2e3eae204
avcodec/qpeg: Limit copy in qpeg_decode_intra() to the available bytes
...
Fixes: Timeout (27 sec -> 39 milli sec)
Fixes: 13151/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QPEG_fuzzer-5717536023248896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b819472995 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
7cc9a20791
avcodec/aic: Check remaining bits in aic_decode_coeffs()
...
Fixes: Timeout (78 seconds -> 2 seconds)
Fixes: 13186/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AIC_fuzzer-5639516533030912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 951bb7632f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
98fa61c020
avcodec/gdv: Check for truncated tags in decompress_5()
...
Testcase: 13169/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_GDV_fuzzer-5666354038833152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5cf42f65b6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
6abc6acd50
avcodec/bethsoftvideo: Check block_type
...
Fixes: Timeout (17 seconds -> 1 second)
Fixes: 13184/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BETHSOFTVID_fuzzer-5711446296494080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b8ecadec05 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
7a25b3192d
avcodec/jpeg2000dwt: Fix integer overflow in dwt_decode97_int()
...
Fixes: runtime error: signed integer overflow: 2147483598 + 128 cannot be represented in type 'int'
Fixes: 12926/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5705100733972480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4801eea0d4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
902c96ae16
avcodec/error_resilience: Use a symmetric check for skipping MV estimation
...
This speeds up the testcase by a factor of 4
Fixes: Timeout
Fixes: 13100/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV2_fuzzer-5767533905313792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e4289cb253 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
49f8873f8b
avcodec/mlpdec: Insuffient typo
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fc32e08941 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
edf0297c61
avcodec/zmbv: obtain frame later
...
The frame is not needed that early so obtaining it later avoids
the costly operation in case other checks fail.
Fixes: Timeout (14sec -> 4sec)
Fixes: 13140/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZMBV_fuzzer-5738330308739072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 177b40890c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
3891dbf4cf
avcodec/jvdec: Check available input space before decode8x8()
...
Fixes: Timeout (78 sec -> 15 millisec)
Fixes: 13147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JV_fuzzer-5727107827630080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 61523683c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
8ddad9f9cd
avcodec/h264_direct: Fix overflow in POC comparission
...
Fixes: runtime error: signed integer overflow: 2147421862 - -33624063 cannot be represented in type 'int'
Fixes: 12885/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5733516975800320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5ccf296e74 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
1613b1669d
avformat/webmdashenc: Check id in adaption_sets
...
Fixes: out of array access
Found-by: Wenxiang Qian
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b687b549aa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Wenxiang Qian
3b4630c181
avformat/http: Fix Out-of-Bounds access in process_line()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 85f91ed760 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Wenxiang Qian
e62abf9398
avformat/ftp: Fix Out-of-Bounds Access and Information Leak in ftp.c:393
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a142ffdcae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Kevin Backhouse via RT
e2ae3419ff
avcodec/htmlsubtitles: Fixes denial of service due to use of sscanf in inner loop for handling braces
...
Fixes: [Semmle Security Reports #19439 ]
Fixes: dos_sscanf2.mkv
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 894995c41e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Kevin Backhouse via RT
9191218d11
avcodec/htmlsubtitles: Fixes denial of service due to use of sscanf in inner loop for tag scaning
...
Fixes: [Semmle Security Reports #19438 ]
Fixes: dos_sscanf1.mkv
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f00c97bc3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
f906710870
avformat/matroskadec: Do not leak queued packets on sync errors
...
Fixes: memleak
Fixes: clusterfuzz-testcase-minimized-audio_decoder_fuzzer-5649187601121280
Reported-by: Chris Cunningham <chcunningham@google.com >
Tested-by: Chris Cunningham <chcunningham@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d1afa7284c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
3ae6063f5a
avformat/mov: Do not use reference stream in mov_read_sidx() if there is no reference stream
...
Fixes: NULL pointer dereference
Fixes: clusterfuzz-testcase-minimized-audio_decoder_fuzzer-5634316373721088
Reported-by: Chris Cunningham <chcunningham@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b0d8b7cb8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
80603682ff
avcodec/sbrdsp_fixed.c: remove input value limit for sbr_sum_square_c()
...
Fixes: 1377/clusterfuzz-testcase-minimized-5487049807233024
Fixes: assertion failure in sbr_sum_square_c()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4cde7e62db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
chcunningham
08b159fd0d
avformat/mov: validate chunk_count vs stsc_data
...
Bad content may contain stsc boxes with a first_chunk index that
exceeds stco.entries (chunk_count). This ammends the existing check to
include cases where chunk_count == 0. It also patches up the case
when stsc refers to unknown chunks, but stts has no samples (so we
can simply ignore stsc).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1c15449ca9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
chcunningham
0063964f84
avformat/mov.c: require tfhd to begin parsing trun
...
Detecting missing tfhd avoids re-using tfhd track info from the previous
moof. For files with multiple tracks, this may make a mess of the
avindex and fragindex, which can later trigger av_assert0 in
mov_read_trun().
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3ea87e5d9e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
4946bda473
avcodec/pgssubdec: Check for duplicate display segments
...
In such a duplication the previous gets overwritten and leaks
Fixes: memleak
Fixes: 12510/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGSSUB_fuzzer-5694439226343424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e35c3d887b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
136ec39a2f
avformat/rtsp: Check number of streams in sdp_parse_line()
...
Fixes: OOM
Found-by: Michael Hanselmann <public@hansmi.ch >
Reviewed-by: Michael Hanselmann <public@hansmi.ch >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 497c9b0cce )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
d3aab63320
avformat/rtsp: Clear reply in every iteration in ff_rtsp_connect()
...
Fixes: Infinite loop
Found-by: Michael Hanselmann <public@hansmi.ch >
Reviewed-by: Michael Hanselmann <public@hansmi.ch >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0b50f27635 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
ae4148b895
avcodec/fic: Check that there is input left in fic_decode_block()
...
Fixes: Timeout
Fixes: 12450/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FIC_fuzzer-5661984622641152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit db1c4acd02 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
23f6170f1b
avcodec/tiff: Check for 12bit gray fax
...
Fixes: Assertion failure
Fixes: 11898/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5759794191794176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec28a85107 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
532b6c2b25
avutil/imgutils: Optimize memset_bytes() by using av_memcpy_backptr()
...
This is strongly based on code by Marton Balint, and depends on the previous commit
Fixes: Timeout
Fixes: 11502/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WCMV_fuzzer-5664893810769920
Before: Executed clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WCMV_fuzzer-5664893810769920 in 11209 ms
After: Executed clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WCMV_fuzzer-5664893810769920 in 4104 ms
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f64c0dffa1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
9e5cb0df49
avutil/mem: Optimize fill32() by unrolling and using 64bit
...
Reviewed-by: Marton Balint <cus@passwd.hu >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 12b1338be3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
James Almer
6c2e465f62
configure: bump year
...
Happy new year!
(cherry picked from commit 3209d7b393 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
e726cd332d
avcodec/diracdec: Check component quant
...
Fixes: Timeout
Fixes: 10708/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5730140957442048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 28c96c2ce2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
c4f2a8c6c1
avcodec/tests/rangecoder: initialize array to avoid valgrind warning
...
Found-by: jamrial
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c15972f0af )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
84ef2bba6c
avcodec/h264_slice: Fix integer overflow in implicit_weight_table()
...
Fixes: signed integer overflow: 2 * 2132811760 cannot be represented in type 'int'
Fixes: 11156/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-6237685933408256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 77e56d74f9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
980ad51291
avcodec/exr: set layer_match in all branches
...
Otherwise it is left to the value from the previous iteration
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 433d2ae435 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
b2fd3250c4
avcodec/exr: Check for duplicate channel index
...
Fixes: Out of memory
Fixes: 11582/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5730204559867904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f9728feaf9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
d43b488340
avcodec/4xm: Fix returned error codes
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 07607a1db8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
8349bcb526
avcodec/v4l2_m2m: fix cant typo
...
Reviewed-by: Lou Logan <lou@lrcd.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 062bf56393 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
8490652c9c
avcodec/mjpegbdec: Fix some misplaced {} and spaces
...
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 11a8d2ccab )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
David Bryant
24438427ef
avformat/wvdec: detect and error out on WavPack DSD files
...
Not currently supported.
(cherry picked from commit db109373d8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
gxw
4656ad1e96
avcodec/mips: Fix failed case: hevc-conformance-AMP_A_Samsung_* when enable msa
...
The AV_INPUT_BUFFER_PADDING_SIZE has been increased to 64, but the value is still 32
in function ff_hevc_sao_edge_filter_8_msa. So, use AV_INPUT_BUFFER_PADDING_SIZE directly.
Also, use MAX_PB_SIZE directly instead of 64. Fate tests passed.
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f652c7a45c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
d99a3f9792
avcodec/fic: Fail on invalid slice size/off
...
Fixes: Timeout
Fixes: 11486/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FIC_fuzzer-5677133863583744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 30a7a81cdc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
30046553a5
postproc/postprocess_template: remove FF_REG_sp from clobber list
...
Future gcc may no longer support this
Tested-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1cbeb87db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
7df1c93619
postproc/postprocess_template: Avoid using %4 for the threshold compare
...
This avoids problems if %4 is the stack pointer
the constraints do not allow %4 to be the stack pointer but gcc 9 may
no longer support specifying such constraints
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4325527e1c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
728f142651
avcodec/rpza: Check that there is enough data for all the blocks
...
Fixes: Timeout
Fixes: 11547/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RPZA_fuzzer-5678435842654208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e63517e00a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
3ca0a8e077
avcodec/rpza: Move frame allocation to a later point
...
This will allow performing some fast checks before the slow allocation
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8a708aa99c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
4556f7c8a2
avcodec/avcodec: Document the data type for AV_PKT_DATA_MPEGTS_STREAM_ID
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 68e011e410 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
f51a271f20
avformat/mpegts: Fix side data type for stream id
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab1319d82f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
53d34fad0d
tests/fate/filter-video: increase fuzz for fate-filter-refcmp-psnr-rgb
...
Fixes: test failure on powerpc
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f8f762c300 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
e657e8e8d6
avcodec/mjpegdec: Fix indention of ljpeg_decode_yuv_scan()
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea30ac1e40 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
chcunningham
96062eb3cc
lavf/id3v2: fail read_apic on EOF reading mimetype
...
avio_read may return EOF, leaving the mimetype array unitialized. fail
early when this occurs to avoid using the array in an unitialized state.
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ee1e39a576 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
f9b7c87145
avformat/nutenc: Document trailer index assert better
...
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a95b73abc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
chcunningham
cb901e1836
lavf/mov: ensure only one tkhd per trak
...
Chromium fuzzing produced a whacky file with extra tkhds. This caused
an AVStream that was already in use to be corrupted by assigning it a
new id, which blows up later in mov_read_trun because the
MOVFragmentStreamInfo.index_entry now points OOB.
Reviewed-by: Baptiste Coudurier <baptiste.coudurier@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9f7b6f7a9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
04fe02bd80
avcodec/ppc/hevcdsp: Fix build failures with powerpc-linux-gnu-gcc-4.8 with --disable-optimizations
...
The affected functions could also be changed into macros, this is the
smaller change to fix it though. And avoids (probably) less readable macros
The extra code should be optimized out when optimizations are done as all values
are known at build after inlining.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c64a6bcd2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
a6d25b6ba5
avcodec/msvideo1: Check for too small dimensions
...
Such low resolution would result in empty output as a minimum of 4x4 is needed
We could also check for multiple of 4 dimensions but that is not needed
Fixes: Timeout
Fixes: 11191/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSVIDEO1_fuzzer-5739529588178944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 953bd58861 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
d6aac086b6
avcodec/wmv2dec: Skip I frame if its smaller than 1/8 of the minimal size
...
Frames that small are not valid and of limited use for error concealment, while
being very computationally intensive to process.
Fixes: Timeout
Fixes: 11168/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV2_fuzzer-5733782032744448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d6f4341522 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
f06485063d
avcodec/msmpeg4dec: Skip frame if its smaller than 1/8 of the minimal size
...
Frames that small are not valid and of limited use for error concealment, while
being very computationally intensive to process.
Fixes: Timeout
Fixes: 11318/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSMPEG4V1_fuzzer-5710884555456512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 09ec182864 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
506b9c88c7
avcodec/truemotion2rt: Fix rounding in input size check
...
Fixes: Timeout
Fixes: 11332/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2RT_fuzzer-5678456612847616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7f22a4ebc9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
940c6f3fb1
avcodec/truemotion2: fix integer overflows in tm2_low_chroma()
...
Fixes: 11295/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-4888953459572736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ae39d7956 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
5e1133920f
avcodec/pngdec: Check compression method
...
method 0 (inflate/deflate) is the only specified in the specification and the only supported
Fixes: Timeout
Fixes: 10976/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PNG_fuzzer-5729372588736512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f99674ddd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
4376377c51
fftools/ffmpeg: Repair reinit_filter feature
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3504004879 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
e8aaadd41e
avcodec/shorten: Fix integer overflow with offset
...
Fixes: signed integer overflow: -1625810908 - 582229060 cannot be represented in type 'int'
Fixes: 10977/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5732602018267136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f888771cd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
a6e6b86669
avcodec/cavsdec: Propagate error codes inside decode_mb_i()
...
Fixes: Timeout
Fixes: 10702/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5669940938407936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1cee05656 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
Michael Niedermayer
f3404f6b90
avcodec/mpegaudio_parser: Consume more than 0 bytes in case of the unsupported mp3adu case
...
Fixes: Timeout
Fixes: 10966/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP3ADU_fuzzer-5348695024336896
Fixes: 10969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP3ADUFLOAT_fuzzer-5691669402877952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df91af140c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2019-03-24 10:38:51 +01:00
James Almer
da6a61606a
avcodec/hevcdec: decode at most one slice reporting being the first in the picture
...
Fixes deadlocks when decoding packets containing more than one of the aforementioned
slices when using frame threads.
Tested-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 70c8c8a818 )
2019-03-20 21:03:48 -03:00
Paul B Mahol
15b385efca
avfilter/af_silenceremove: fix possible crash if supplied duration is negative
...
Signed-off-by: Paul B Mahol <onemda@gmail.com >
Fixes ticket #7697 .
(cherry picked from commit 2d1594a8d6 )
2019-01-25 01:01:42 +01:00
Michael Niedermayer
cb74b3ff27
Update for 3.4.5
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-11-01 15:40:09 +01:00
Michael Niedermayer
0e853b61e6
avutil/integer: Fix integer overflow in av_mul_i()
...
Found-by: fate
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3cc3cb663b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
707ec3cfc0
avcodec/msrle: Check that the input is large enough to contain a end of picture code
...
Fixes: Timeout
Fixes: 10625/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSRLE_fuzzer-5659651283091456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 203ccb8746 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
1bcc79db44
avcodec/jpeg2000dec: Fix off by 1 error in JPEG2000_PGOD_CPRL handling
...
Fixes: assertion failure
Fixes: 10785/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5672160496975872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 305e523105 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
6763ff890e
avcodec/mpeg4videodec: Fix typo in sprite delta check
...
Fixes: Integer overflow
Fixes: 10890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5636062181851136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b737317a88 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
ced37ef52c
avcodec/h264_cavlc: Check mb_skip_run
...
Fixes: 10300/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-6292205497483264
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f72b9904fe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
a3ef90a73c
avcodec/ra144: Fix integer overflow in add_wav()
...
Fixes: signed integer overflow: -2144033225 + -5208934 cannot be represented in type 'int'
Fixes: 10633/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-5679133791617024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c6282141cb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
d17d08035c
avformat/utils: Never store negative values in last_IP_duration
...
Fixes: integer overflow compute_pkt_fields()
Fixes: compute_pkt_usan
Reported-by: Thomas Guilbert <tguilbert@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 079d1a7175 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
e9975d1b51
avformat/utils: Fix integer overflow in discontinuity check
...
Fixes: signed integer overflow: 7738135736989908991 - -7954308516317364223 cannot be represented in type 'long'
Fixes: find_stream_info_usan
Reported-by: Thomas Guilbert <tguilbert@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4e19cfcfa3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
0cbd4fb995
avcodec/unary: Improve get_unary() docs
...
Found-by: kierank
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ad89e203bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
848726afc6
avcodec/gdv: Replace divisions by shifts in rescale()
...
Divisions tend to be slower than shifts unless the compiler optimizes them out.
And some of these are in inner loops.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b90d8cc746 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
50aa132f4d
avcodec/dvdsubdec: Sanity check len in decode_rle()
...
Fixes: Timeout
Fixes: 9778/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVDSUB_fuzzer-5186007132536832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e7b023e1db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
f80da843b2
avcodec/mpeg4videodec: Fix undefined shift in get_amv()
...
Fixes: runtime error: shift exponent -1 is negative
Fixes: 9938/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5653783529914368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c88afa44c4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
127ec77e8c
avcodec/zmbv: Check that the decompressed data size is correct
...
This checks the value exactly for intra frames and checks it against a
minimum for inter frames as they can be variable.
Fixes: Timeout
Fixes: 10182/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZMBV_fuzzer-6245951174344704
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e33b28cc79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
80af29f32e
avcodec/zmbv: Update decomp_len in raw frames
...
decomp_len is used in raw frames, so it should not be left at the value from
whatever was decoded previously (which may be any other frame)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d201b83cd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
98709a1244
avcodec/shorten: Fix bitstream end check in read_header()
...
Fixes: Timeout
Fixes: 9961/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5687856176562176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 28b80c2d52 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
1a106752f3
avcodec/dvdsubdec: Avoid branch in decode_run_8bit()
...
Speed improvment 35.5 sec -> 34.7sec
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 71bf033050 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
ab5d930762
avcodec/h264_refs: Document last if() in ff_h264_execute_ref_pic_marking()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 697984b9db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
ee8b4c16d7
avcodec/ra144: Fix undefined integer overflow in add_wav()
...
Fixes: signed integer overflow: -26884 * 91439 cannot be represented in type 'int'
Fixes: 9687/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-4995588121690112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 93a203662f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
073a65aefc
avcodec/indeo4: Check dimensions in decode_pic_hdr()
...
Fixes: Timeout
Fixes: 9654/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-6289863463665664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7592e88bfe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Dale Curtis
eab5f6e419
avformat/mov: Error on too large stsd entry counts.
...
Entries are always at least 8 bytes per the parsing code, so if we
see an impossible entry count avoid massive allocations. This is
similar to an existing check in mov_read_stsc().
Since ff_mov_read_stsd_entries() does eof checks, an alternative
approach could be to clamp the entry count to atom.size / 8.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 320b631a99 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Bunk
462edf5b94
examples: Fix use of AV_CODEC_FLAG_GLOBAL_HEADER
...
AV_CODEC_FLAG_GLOBAL_HEADER should be set before calling avcodec_open2() to have any effect.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a82e4fb8c6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
b61b38766e
avcodec/hq_hqa: Check remaining input bits in hqa_decode_mb()
...
Fixes: Timeout
Fixes: 9634/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-6267852259590144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9222b972d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
88afcff2f5
avcodec/vb: Check for end of bytestream before reading blocktype
...
Fixes: Timeout
Fixes: 9601/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VB_fuzzer-4550228702134272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1cbac9ce20 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
812f7fae35
avcodec/snowdec: Fix integer overflow with motion vector residual
...
Fixes: signed integer overflow: -19818 + -2147483648 cannot be represented in type 'int'
Fixes: 9545/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-4928769537081344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit acba153a14 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
0ef49c0818
avformat/nsvdec: Do not parse multiple NSVf
...
The specification states "NSV files may contain a single file header. "
Fixes: out of array access
Fixes: nsv-asan-002f473f726a0dcbd3bd53e422c4fc40b3cf3421
Found-by: Paul Ch <paulcher@icloud.com >
Tested-by: Paul Ch <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 78d4b6bd43 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
ff5196a98a
avformat/mlvdec: read_string() received unsigned size, make the argument unsigned
...
Fixes: infinite loop
Fixes: mlv-timeout-e3b8cab9835edecad6823baa057e029671329d04
Found-by: Paul Ch <paulcher@icloud.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e71cb2c8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
17c0347977
avformat/rmdec: Fix EOF check in the stream loop in ivr_read_header()
...
Fixes: long running loop
Fixes: ivr-timeout-42468cb797f52f025fb329394702f5d4d64322d6
Found-by: Paul Ch <paulcher@icloud.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c2eec1762d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
007da8396f
avcodec/scpr: Check for min > max in decompress_p()
...
Fixes: Timeout
Fixes: 9342/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-4795990841229312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3378194ce8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
e3cc5e81ab
avcodec/shorten: Fix signed 32bit overflow in shift in shorten_decode_frame()
...
Fixes: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 9480/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-6647324284551168 -rss_limit_mb=2000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9b604e96a5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
ec573bd2eb
avcodec/shorten: Fix integer overflow in residual/LPC combination
...
Fixes: signed integer overflow: -540538872 + -2012739576 cannot be represented in type 'int'
Fixes: 9255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5758630052757504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit db7e9082e1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
7f480bedd0
avcodec/shorten: Check verbatim length
...
Fixes: Timeout
Fixes: 9252/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5780720709533696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7007dabec0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
4df3a367df
avcodec/mpegaudio_parser: Initialize poutbuf*
...
Possibly fixes: null pointer dereference
Possibly fixes: 9352/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP3ADUFLOAT_fuzzer-5146068961460224
Fixes: Heap-use-after-free
Fixes: 9453/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP3ADUFLOAT_fuzzer-5137954375729152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0f4c3b0b8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
b6098dd17f
avcodec/aacpsdsp_template: Fix integer overflow in ps_stereo_interpolate_c()
...
Fixes: signed integer overflow: -1813244069 + -1407981383 cannot be represented in type 'int'
Fixes: 8823/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5643295618236416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47db5763e2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
44e878d086
avformat/flvenc: Check audio packet size
...
Fixes: Assertion failure
Fixes: assert_flvenc.c:941_1.swf
Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6b67d7f059 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Nikolas Bowe
c90457a95e
lavc/svq3: Fix regression decoding some files.
...
Fixes some SVQ3 encoded files which fail to decode correctly after 6d6faa2a2d .
These files exhibit lots of artifacts and logs show "Media key encryption is not implemented".
However they decode without artifacts before 6d6faa2a2d .
The attatched patch allows these files to successfully decode, but also reject media key files.
Tested on the files in #6094 and http://samples.mplayerhq.hu/V-codecs/SVQ3/Vertical400kbit.sorenson3.mov
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5aeb3b0080 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
7abc4445f9
avcodec/qtrle: Check remaining bytestream in qtrle_decode_XYbpp()
...
Fixes: Timeout
Fixes: 9213/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QTRLE_fuzzer-5649753332252672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7dd836a3f9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
9abcade734
avcodec/diracdec: Check bytes count in else branch in decode_lowdelay() too
...
Fixes: signed integer overflow: 8 * 340018243 cannot be represented in type 'int'
Fixes: 9441/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5194665207791616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bed125b710 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
a594ce26ce
avcodec/diracdec: Check slice numbers for overflows in relation to picture dimensions
...
Fixes: signed integer overflow: 88 * 33685506 cannot be represented in type 'int'
Fixes: 9433/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5725943535501312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f457c0ad7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
7068bcf58a
avcodec/diracdec: Change frame_number to 64bit as its a 32bit from the bitstream and we also have a -1 special case
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 9291/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-6324345860259840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 462d1be6de )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
330ed0772c
avcodec/dirac_dwt_template: Fix several integer overflows in horizontal_compose_daub97i()
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 8926/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-6047609228623872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 69cac9e130 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
9da24737a3
avcodec/diracdec: Prevent integer overflow in intermediate in global_mv()
...
Fixes: signed integer overflow: -393471 * 5460 cannot be represented in type 'int'
Fixes: 8890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-6299775379963904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5129040646 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
5cbf4849e3
swresample/swresample: Fix input channel count in resample_first computation
...
Found-by: Marcin Gorzel <gorzel@google.com >
Reviewed-by: Marcin Gorzel <gorzel@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bce4da85e8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Michael Niedermayer
7489a527f0
avutil/pixfmt: Document chroma plane size for odd resolutions
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be0b77e6e8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-10-28 02:22:42 +02:00
Timo Rothenpieler
e225db5d75
avcodec/cuviddec: properly take deinterlacing and display delay into account for buffer_full check
...
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2018-10-14 18:21:11 +02:00
Giulio Benetti
c50dc77ac7
configure: add LIBDRM to extralibs_avutil
...
When static linking programs using ffmpeg libraries, if linking against
libavutil, -ldrm is listed before -lavutil. This leads to linking failure
due to undefined reference of drmGetVersion() and drmFreeVersion().
This is why when pkg-config create libavutil.pc doesn't append -ldrm
after -lavutil.
Create LIBDRM=-ldrm in case libdrm is enabled and add $LIBDRM to
extralibs_avutil.
Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com >
Signed-off-by: James Almer <jamrial@gmail.com >
2018-09-11 18:31:34 -03:00
James Almer
bc2301429e
avcodec/bitstream_filters: check the input argument of av_bsf_get_by_name() for NULL
...
Fixes crashes like "ffmpeg -h bsf" caused by passing NULL to strcmp()
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 3258cc6507 )
2018-07-28 22:44:14 -03:00
Michael Niedermayer
8df2c7dde6
Update for 3.4.4
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-18 15:07:41 +02:00
Michael Niedermayer
6f354ca5fd
avcodec/dvdsub_parser: Allocate input padding
...
Fixes: out of array read
Fixes: 9350/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVDSUB_fuzzer-5746777750765568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cd86b5cfe2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-17 11:46:33 +02:00
Michael Niedermayer
6ea8b39c90
avcodec/dvdsub_parser: Init output buf/size
...
No testcase
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e6c843776 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-17 11:46:33 +02:00
Michael Niedermayer
15990a43b0
avcodec/dirac_dwt_template: Fix signedness regression in interleave()
...
Found-by: <jdarnley>
Tested-by: James Darnley <james.darnley@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 181435a4de )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-17 11:46:33 +02:00
Michael Niedermayer
2b8d4f6f01
avformat/movenc: Write version 2 of audio atom if channels is not known
...
The version 1 needs the channel count and would divide by 0
Fixes: division by 0
Fixes: fpe_movenc.c_1108_1.ogg
Fixes: fpe_movenc.c_1108_2.ogg
Fixes: fpe_movenc.c_1108_3.wav
Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fa19fbcf71 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-17 11:46:33 +02:00
Rahul Chaudhry
a8c5c71a04
swresample/arm: rename labels to fix xcode build error
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e84212b78e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-17 11:46:33 +02:00
Simon Thelen
c1e172c2e1
avcodec/imgconvert: fix possible null pointer dereference
...
regression since 354b26a394
(cherry picked from commit 8c2c97403b )
2018-07-15 16:33:08 +03:00
Michael Niedermayer
8935558536
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-08 11:37:06 +02:00
Michael Niedermayer
20ad61ffb7
avformat/movenc: Check input sample count
...
Fixes: division by 0
Fixes: fpe_movenc.c_199_1.wav
Fixes: fpe_movenc.c_199_2.wav
Fixes: fpe_movenc.c_199_3.wav
Fixes: fpe_movenc.c_199_4.wav
Fixes: fpe_movenc.c_199_5.wav
Fixes: fpe_movenc.c_199_6.wav
Fixes: fpe_movenc.c_199_7.wav
Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3a2d21bc5f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-08 01:37:54 +02:00
Michael Niedermayer
9fc60cebe4
avcodec/mjpegdec: Check for odd progressive RGB
...
Fixes: out of array access
Fixes: 9225/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-5684770334834688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ee1e3ca5eb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-08 01:37:11 +02:00
Michael Niedermayer
cb21af2844
update for 3.4.3
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-07 18:20:18 +02:00
Michael Niedermayer
36c779bffe
avformat/movenc: Check that frame_types other than EAC3_FRAME_TYPE_INDEPENDENT have a supported substream id
...
Fixes: out of array access
Fixes: ffmpeg_bof_1.avi
Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ed22dc2221 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-07 12:27:14 +02:00
Michael Niedermayer
93a77afdac
avcodec/vp8_parser: Do not leave data/size uninitialized
...
This is identical to what the VP9 parser does
Fixes: 9215/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVPX_VP8_fuzzer-5768227253649408
Fixes: out of memory access
This may also fix oss fuzz issue 9212
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 284dde24da )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-07 12:27:00 +02:00
Michael Niedermayer
5da77e7e9e
avformat/mms: Add missing chunksize check
...
Fixes: out of array read
Fixes: mms-crash-01b6c5d85f9d9f40f4e879896103e9f5b222816a
Found-by: Paul Ch <paulcher@icloud.com >
1st hunk by Paul Ch <paulcher@icloud.com >
Tested-by: Paul Ch <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cced03dd66 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-07 12:27:00 +02:00
Michael Niedermayer
717ece29fd
avformat/pva: Check for EOF before retrying in read_part_of_packet()
...
Fixes: Infinite loop
Fixes: pva-4b1835dbc2027bf3c567005dcc78e85199240d06
Found-by: Paul Ch <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9807d3976b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-07 12:27:00 +02:00
Michael Niedermayer
09401d0a0a
avformat/rmdec: Do not pass mime type in rm_read_multi() to ff_rm_read_mdpr_codecdata()
...
Fixes: use after free()
Fixes: rmdec-crash-ffe85b4cab1597d1cfea6955705e53f1f5c8a362
Found-by: Paul Ch <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a7e032a277 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-07 12:27:00 +02:00
Michael Niedermayer
9dea41eac7
avformat/asfdec_o: Check size_bmp more fully
...
Fixes: integer overflow and out of array access
Fixes: asfo-crash-46080c4341572a7137a162331af77f6ded45cbd7
Found-by: Paul Ch <paulcher@icloud.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b46ebdbff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-07 12:27:00 +02:00
Michael Niedermayer
78aa78410b
avcodec/indeo4: Check for end of bitstream in decode_mb_info()
...
Fixes: Timeout
Fixes: 8776/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-5361788798369792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 267ba2aa96 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-07 12:27:00 +02:00
Michael Niedermayer
4ca95e64db
avcodec/shorten: Fix undefined addition in shorten_decode_frame()
...
Fixes: signed integer overflow: 1139785606 + 1454196085 cannot be represented in type 'int'
Fixes: 8937/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-6202943597445120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3b10bb8772 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-07 12:27:00 +02:00
Michael Niedermayer
2f51a56ec9
avcodec/shorten: Fix undefined integer overflow
...
Fixes: signed integer overflow: 8454144 * 256 cannot be represented in type 'int'
Fixes: 8788/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5728205041303552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 70832333bb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-07 12:27:00 +02:00
Michael Niedermayer
e6db9900ef
avcodec/jpeg2000dec: Fixes invalid shifts in jpeg2000_decode_packets_po_iteration()
...
Fixes: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 9163/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5661750182543360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 652d7c6348 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-07 12:27:00 +02:00
Michael Niedermayer
428c3e5975
avcodec/jpeg2000dec: Check that there are enough bytes for all tiles
...
Fixes: OOM
Fixes: 8781/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5810709081358336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0898a3d990 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-07 12:27:00 +02:00
Michael Niedermayer
3a04f518ac
avformat/movenc: Do not pass AVCodecParameters in avpriv_request_sample
...
Fixes: out of array read
Fixes: ffmpeg_crash_8.avi
Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 95556e27e2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-07-07 12:27:00 +02:00
Michael Niedermayer
c218ae2ade
avcodec/escape124: Fix spelling errors in comment
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f59c4e4391 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-27 13:54:15 +02:00
Michael Niedermayer
80b2041c8c
avcodec/ra144: Fix integer overflow in ff_eval_refl()
...
Fixes: signed integer overflow: -4096 * -524288 cannot be represented in type 'int'
Fixes: 8650/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-5734816036159488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b31189881a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-27 13:53:46 +02:00
Michael Niedermayer
35c365f6ef
avcodec/cscd: Check output buffer size for lzo.
...
Fixes: Timeout
Fixes: 8665/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CSCD_fuzzer-5768442610188288
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit 78167b498f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-27 13:52:53 +02:00
Michael Niedermayer
dc41504521
avcodec/escape124: Check buf_size against num_superblocks
...
Fixes: Timeout
Fixes: 8722/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-4843268402577408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6677c98626 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-25 23:25:01 +02:00
Michael Niedermayer
0fce2872e4
avcodec/h264_parser: Reduce needed history for parsing mb index
...
This fixes a bug/regression with very small packets
Fixes: output_file
Regression since: 0782fb6bcb
Reported-by: Thierry Foucu <tfoucu@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d25c945247 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-25 02:13:53 +02:00
Michael Niedermayer
d56eed37d1
avcodec/magicyuv: Check bits left in flags&1 branch
...
Fixes: Timeout
Fixes: 8690/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_fuzzer-6542020913922048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7719b8ccc7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-25 02:12:37 +02:00
Michael Niedermayer
126d3bdb04
avcodec/mjpegdec: Check for end of bitstream in ljpeg_decode_rgb_scan()
...
Fixes: Timeout
Fixes: 8648/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5108395525799936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 540e8c2d64 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-23 01:16:59 +02:00
Michael Niedermayer
41315d5c7d
avcodec/aacdec_fixed: Fix undefined integer overflow in apply_independent_coupling_fixed()
...
Fixes: signed integer overflow: 1195517 * 2048 cannot be represented in type 'int'
Fixes: 8636/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-4695836326887424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8bd514d934 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
d946e7b805
avcodec/dirac_dwt_template: Fix undefined behavior in interleave()
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 8697/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5197148130902016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 575d8ca026 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
84d473a9cf
avutil/common: Fix undefined behavior in av_clip_uintp2_c()
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 8521/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5639024952737792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aa41d322be )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
f35fb0c826
fftools/ffmpeg: Fallback to duration if sample rate is unavailable
...
Regression since: af1761f7
Fixes: Division by 0
Fixes: ffmpeg_crash_1
Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 16d8b13b3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
532ba2e4ae
avformat/mov: Only set pkt->duration to non negative values
...
Reviewed-by: Sasi Inguva <isasi@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8176799f31 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
78fe6f7c32
avcodec/h264_slice: Fix overflow in recovery_frame computation
...
Fixes: signed integer overflow: 15 + 2147483646 cannot be represented in type 'int'
Fixes: 8381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-6225533137321984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c20ea8ee0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
3be0549029
avcodec/h264_ps: Move MAX_LOG2_MAX_FRAME_NUM to header so it can be used in h264_sei
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b796c5ae92 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
28f0449659
avcodec/h264_mc_template: Only prefetch motion if the list is used.
...
Fixes: index 59 out of bounds for type 'H264Ref [48]'
Fixes: 8232/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5703295145345024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b55591757 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
5d6d0d20fe
avcodec/xwddec: Use ff_set_dimensions()
...
Fixes: OOM
Fixes: 8178/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XWD_fuzzer-4844793342459904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c2852e4e00 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
b60a750af7
avcodec/wavpack: Fix overflow in adding tail
...
Fixes: signed integer overflow: 2146907204 + 26846088 cannot be represented in type 'int'
Fixes: 8105/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-6233036682166272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d13379fb79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
5d61400740
avcodec/shorten: Fix multiple integer overflows
...
Fixes: signed integer overflow: 3 * 1006632960 cannot be represented in type 'int'
Fixes: 8278/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5692857166856192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f2abd36b38 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
62e1c5db4a
avcodec/shorten: Fix undefined shift in fix_bitshift()
...
Fixes: left shift of negative value -9
Fixes: 8571/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5715966875926528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 606c714823 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
8b6c773fe8
avcodec/shorten: Fix a negative left shift in shorten_decode_frame()
...
Fixes: left shift of negative value -9057
Fixes: 8527/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5666853924896768
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a711efe922 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
3f5bc91be3
avcodec/shorten: Sanity check nmeans
...
Fixes: OOM
Fixes: 8195/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5179785826271232
The reference software appears to use longs for 32bits and it uses int for nmeans
hinting that the intended maximum size was not 32bit.
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d91a0b503d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
7598b161f4
avcodec/shorten: Check non COMM chunk len before skip in decode_aiff_header()
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 8024/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5109204648984576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 424a81df10 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
aa30aa8c13
avcodec/mjpegdec: Fix integer overflow in ljpeg_decode_rgb_scan()
...
Fixes: signed integer overflow: 32768 + 2147450880 cannot be represented in type 'int'
Fixes: 7885/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-5298834394578944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 936f4a2c2e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
c4c56eb839
avcodec/truemotion2: Fix overflow in tm2_apply_deltas()
...
Fixes: signed integer overflow: 1077952576 + 1077952576 cannot be represented in type 'int'
Fixes: 7712/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5056281753681920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 79c6047c36 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
df7d70272e
avcodec/opus_silk: Change silk_lsf2lpc() slightly toward silk/NLSF2A.c
...
Fixes: runtime error: signed integer overflow: -1440457022 - 785819492 cannot be represented in type 'int'
Fixes: 7700/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OPUS_fuzzer-6595838684954624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e7dda51150 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
f0c60a91ae
avcodec/amrwbdec: Fix division by 0 in find_hb_gain()
...
This restructures the code slightly toward D_UTIL_dec_synthesis()
Fixes: 7420/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMRWB_fuzzer-6577305112543232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dce80a4b47 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
adea365be9
avformat/mov: replace a value error by clipping into valid range in mov_read_stsc()
...
Fixes : #7165
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fe84f70819 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
ce7be9cdc5
avformat/mov: Break out early if chunk_count is 0 in mov_build_index()
...
Without this some operations might overflow (undefined behavior)
even though the index adding loop would never execute
No testcase known
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 56e76bd057 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
26667dc5ba
avcodec/fic: Avoid some magic numbers related to cursors
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c6a11714c4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
12f0cfede6
avcodec/g2meet: ask for sample with overflowing RGB
...
Suggested-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab834b8f36 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
ada22c1c0f
avcodec/aacdec_fixed: use 64bit to avoid overflow in rounding in apply_dependent_coupling_fixed()
...
Fixes: signed integer overflow: -2141499320 + -14469590 cannot be represented in type 'int'
Fixes: 7351/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-6351214791884800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 90475db97e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
b7b178fd0f
oavcodec/aacpsdsp_template: Use unsigned for hs0X to prevent undefined behavior
...
Fixes: signed integer overflow: 1073741842 + 1784008138 cannot be represented in type 'int'
Fixes: 6792/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5677589835284480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 62cb6fadf3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
c91f199f5d
avcodec/g723_1dec: Clip bits2 in both directions
...
Fixes: shift exponent 33 is too large for 32-bit type 'int'
Fixes: 6743/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G723_1_fuzzer-5823772687859712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 53f241218d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
bd1fd3ff4b
avcodec/mpeg4videoenc: Use 64 bit for times in mpeg4_encode_gop_header()
...
Fixes truncation
Fixes Assertion n <= 31 && value < (1U << n) failed at libavcodec/put_bits.h:169
Fixes: ffmpeg_crash_2.avi
Found-by: Thuan Pham <thuanpv@comp.nus.edu.sg >, Marcel Böhme, Andrew Santosa and Alexandru RazvanCaciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e1182fac1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
4cbd92baa3
avcodec/mlpdec: Only change noise_type if the related fields are valid
...
Fixes: inconsistency
Fixes:runtime error: index 8 out of bounds for type 'int32_t [8]'
Fixes: 6686/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-5191383498358784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 63c4a4b0d6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
9d3ae90516
indeo4: Decode all or nothing of a band header.
...
This avoids inconsistent value combinations.
Alternatively it would be possible to add more checks and careful use of
temporary variables, but my try of this quickly seemed to become
a rather large change.
The disadvantage of this, is that the struct is copied back and forth.
Fixes: index 6 out of bounds for type 'const uint16_t [5][16]'
Fixes: 6557/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-4787296550256640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 10c8521265 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
3712d4da1e
avformat/mov: Only fail for STCO/STSC contradictions if both exist
...
Fixes regression with playback of GF9720Repeal20the20Eighth20with20Helen20Linehan.m4a
See: crbug 822666
Found-by: "Mattias Wadman <mattias.wadman@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c2d689c56 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
22b3e924df
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD97iH0 / COMPOSE_DD137iL0
...
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int');
Fixes: 6500/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-4523620274536448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cb944fc7f1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
14cea44018
avcodec/fic: Check available input space for cursor
...
Fixes: out of array read
Fixes: 6546/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FIC_fuzzer-6317064647081984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cb2f7ea96b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
b802baadfd
avcodec/g2meet: Check RGB upper limit
...
Fixes: runtime error: left shift of 1876744317 by 16 places cannot be represented in type 'int'
Fixes: 6799/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5115274731716608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4dd2c8b9ea )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
022c8c07f8
avcodec/jpeg2000dec: Fix undefined shift in the jpeg2000_decode_packets_po_iteration() CPRL case
...
Fixes: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 7955/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-6016721977606144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 652ba72ed3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
f4d90a36c5
avcodec/jpeg2000dec: Skip init for component in CPRL if nothing is to be done
...
Fixes: assertion failure
Fixes: 7949/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-4819602782552064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a96c131eb5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
2cb3dff0f9
avcodec/g2meet: Change order of operations to avoid undefined behavior
...
Fixes: signed integer overflow: 65280 * 196032 cannot be represented in type 'int'
Fixes: 7279/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5977332473921536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a47451458 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
5d1c783bf0
avcodec/flac_parser: Fix infinite loop
...
Fixes: crbug/827204
Reported-by: Frank Liberato <liberato@google.com >
Reviewed-by: Frank Liberato <liberato@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 15a2e35e9e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
909c1aa0ec
avcodec/wavpack: Fix integer overflow in DEC_MED() / INC_MED()
...
Fixes: runtime error: signed integer overflow: 2147483637 + 128 cannot be represented in type 'int'
Fixes: 6701/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5358324934508544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6e95d80e6f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
c437510d5c
avcodec/wavpack: Fix integer overflow in wv_unpack_stereo()
...
Fixes: runtime error: signed integer overflow: 2147483531 + 16384 cannot be represented in type 'int'
Fixes: 6615/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5165715515506688
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit da038c07f0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
30ec2357c9
avcodec/error_resilience: Fix integer overflow in filter181()
...
Fixes: runtime error: signed integer overflow: 197710 * 10923 cannot be represented in type 'int'
Fixes: 7010/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5667127596941312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1c97035e3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
3b23dd4b91
avcodec/h263dec: Check slice_ret in mspeg4 slice loop
...
Fixes infinite loop
Fixes: 6858/clusterfuzz-testcase-ffmpeg_AV_CODEC_ID_MSMPEG4V3_fuzzer-4681563766784000
Fixes: 6890/clusterfuzz-testcase-ffmpeg_AV_CODEC_ID_WMV1_fuzzer-4756103142309888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit de841fbea7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
24947b3f7d
avcodec/elsdec: Fix memleaks
...
Fixes: 6798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5135899701542912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0bd0401336 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
f31ead3f76
avcodec/vc1_block: simplify ac_val computation
...
also fixes: runtime error: index 1456 out of bounds for type 'int16_t [16]'
Found-by: durandal_1707
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d06b01fc2d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Michael Niedermayer
be9c4cc0e6
avcodec/ffv1enc: Check that the crc + version combination is supported
...
The crc flag is only stored since version 3 thus before this crcs do not
work. We increase the version as needed same as we do with pix_fmts
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d9706f79c1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:04 +02:00
Stephan Holljes
1d5694ba11
lavf/http.c: Free allocated client URLContext in case of error.
...
Signed-off-by: Stephan Holljes <klaxa1337@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b6b8c9265 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
f93d7a0c0a
avcodec/dsicinvideo: Fail if there is only a small fraction of the data available that comprises a full frame
...
Fixes: Timeout
Fixes: 6306/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DSICINVIDEO_fuzzer-5079253549842432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5549488bbf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
81d8bd6f42
avcodec/dsicinvideo: Propagate errors from cin_decode_rle()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 942217b153 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
86c7035646
avcodec/dfa: Check dimension against maximum
...
The headers from where the dimensions are read in actual files
are limited to 16bit per component.
Fixes: Timeout
Fixes: 6305/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DFA_fuzzer-4824270749302784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9d5a4fcfbb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
a6db663a31
avcodec/cinepak: Skip empty frames
...
Speeds up decoding from 3 to 0.1 seconds for 6302/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CINEPAK_fuzzer-5626371985375232
Fixes: Timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9033920bec )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
205e93fa0d
avcodec/cinepak: move some checks prior to frame allocation
...
Speeds up decoding from 8 to 3 seconds for 6302/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CINEPAK_fuzzer-5626371985375232
Fixes: Timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2324ef1ff3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Rahul Chaudhry
47c3d2459e
swresample/arm: remove unintentional relocation.
...
Branch to global symbol results in reference to PLT, and when compiling
for THUMB-2 - in a R_ARM_THM_JUMP19 relocation. Some linkers don't
support this relocation (ld.gold), while others can end up truncating
the relocation to fit (ld.bfd).
Convert this branch through PLT into a direct branch that the assembler
can resolve locally.
See https://github.com/android-ndk/ndk/issues/337 for background.
The current workaround is to disable neon during gstreamer build,
which is not optimal and can be reverted after this patch:
41556c4157
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b22db4f465 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
86a6e700e1
doc/APIchanges: Fix typos in hashes
...
Thanks-to: Moritz Barsnick <barsnick@gmx.net > for finding the correct ones
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec8a5262b0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
0b5a2c9a52
avformat/utils: Check cur_dts in update_initial_timestamps() more
...
Fixes: runtime error: signed integer overflow: 18133149658382192 - -9223090561878065151 cannot be represented in type 'long long'
Fixes: crbug 831552
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 37d46dc21d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
22a4b599f0
avcodec/utils: Enforce minimum width also for VP5/6
...
Fixes: out of array access
Fixes: poc_0411
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Tested-by: GwanYeong Kim <gy741.kim@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 544324827e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
8d05a802dd
avcodec/truemotion2: Propagate out of bounds error from GET_TOK()
...
Fixes: Timeout
Fixes: 6389/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5695918121680896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f6304af234 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
ca119e9456
avformat/utils: Fix integer overflow in end time calculation in update_stream_timings()
...
Fixes: crbug 829153
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c48ceff786 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
78c8e77c86
avcodec/mjpegdec: Check input buffer size.
...
Fixes: Timeout
Fixes: 6381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-5665032743419904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8d381b57fd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
fffc77b472
avcodec/h264_slice: Fix integer overflow with last_poc
...
Fixes: signed integer overflow: 2147483646 - -2816 cannot be represented in type 'int'
Fixes: crbug 823145
Reported-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c02cd8ca0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
0f868badcf
avformat/mov: Fix extradata memleak
...
Fixes: crbug 822705
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a8133119c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Matt Wolenetz
ae136f8d64
lavc/libopusdec: Allow avcodec_open2 to call .close
...
If there is a decoder initialization failure detected in avcodec_open2
after .init is called, allow graceful decoder .close to prevent leaking
libopus decoder allocations.
BUG=828526
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e43e97f0e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
c44244424f
avcodec/movtextdec: Check style_start/end
...
Limits based on 3GPP TS 26.245 V14.0.0
Fixes: Timeout
Fixes: 6377/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOVTEXT_fuzzer-5175929115508736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Philip Langdale <philipl@overt.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 249aca8f98 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
053b9766b4
avcodec/aacsbr_fixed: Fix integer overflow in sbr_hf_assemble()
...
Fixes: runtime error: signed integer overflow: 2052929346 + 204817098 cannot be represented in type 'int'
This was missed in b1bef755f6
Fixes: 5275/clusterfuzz-testcase-minimized-5367635958038528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c837918f50 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
c8f700975e
libavcodec/rv34: error out earlier on missing references
...
Fixes visual corruption on seeking
Fixes: downloadTest_clip_24M.rmvb
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6cd81d68c5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Hendrik Schreiber
3e6adf0842
swresample/swresample: Fix for seg fault in swr_convert_internal() -> sum2_float during dithering.
...
Removed +len1 in call to s->mix_2_1_f() as I found no logical explanation for it. After removal, problem was gone.
Signed-off-by: Hendrik Schreiber <hs@tagtraum.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 647fd4b829 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
46db1182da
avcodec/aacdec_fixed: Fix integer overflow in apply_independent_coupling_fixed()
...
I was not able to reproduce this, this fix is based on just the fuzzer log.
Fixes: 4959/clusterfuzz-testcase-minimized-6035350934781952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 197a4e8fee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
f4e01b87f2
avcodec/cscd: Error out when LZ* decompression fails
...
Fixes: Timeout
Fixes: 6304/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CSCD_fuzzer-5754772461191168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d52be5d4e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
heimdallr
2c2ab85562
avcodec/imgconvert: Fix loss mask bug in avcodec_find_best_pix_fmt_of_list()
...
example:
AVPixelFormat pixFmts[] = { AV_PIX_FMT_RGB24, AV_PIX_FMT_RGBA };
int loss = 0;
AVPixelFormat best = avcodec_find_best_pix_fmt_of_list(pixFmts, AV_PIX_FMT_BGRA, 1, &loss);
best is AV_PIX_FMT_RGB24. But AV_PIX_FMT_RGBA is better.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 354b26a394 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
43916494f8
avfilter/vf_signature: use av_strlcpy()
...
Fixes: out of array access
Found-by: Kira <kira_cxy@foxmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 35eeff30ca )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
51035698bd
avcodec/utvideodec: Set pro flag based on fourcc
...
This avoids mixing 8bit variants with pro and 10bit with non pro mode.
Fixes: out of array read
Fixes: poc_03_30.avi
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47b7c68ae5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
fdf56c5654
avcodec/wmalosslessdec: Fix null pointer dereference in decode_frame()
...
Fixes: 2018_03_23_poc.wav
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ea15915b2d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
2be397e234
avcodec/tableprint_vlc: Fix build failure with --enable-hardcoded-tables
...
Found-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5c75438b89 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
9b2ce61155
avformat/mov: Move +1 in check to avoid hypothetical overflow in add_ctts_entry()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eb60b9d3aa )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
26fcff1eb4
avcodec/get_bits: Make sure the input bitstream with padding can be addressed
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e529fe7633 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
e26ae6e6ce
avformat/mov: Check STSC and remove invalid entries
...
Fixes assertion failure
Fixes: crbug 822547, crbug 822666 and crbug 823009
Affects: aark15sd_9A62E2FA.mp4
Found-by: ClusterFuzz
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e67447a4f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
46ed4d5282
avcodec/nuv: rtjpeg with dimensions less than 16 would result in no decoded pixels thus reject it
...
Fixes: Timeout
Fixes: 6297/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-4882404863901696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 939440ad1a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
0312060329
avcodec/nuv: Check for minimum input size for uncomprssed and rtjpeg
...
Fixes: Timeout
Fixes: 6297/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-4882404863901696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ee3265dbe )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
8ba8e0a1c7
avcodec/wmalosslessdec: Reset num_saved_bits on error path
...
Fixes: NULL pointer dereference
Fixes: poc-201803.wav
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 64c9ce0abc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
8280448784
avformat/mov: Fix integer overflows related to sample_duration
...
Fixes: runtime error: signed integer overflow: -9166684017437101870 + -2495066639299164439 cannot be represented in type
Fixes: Chromium bug 791349
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f37082827 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
3fa6e594a0
avformat/img2dec: fix infinite loop
...
Fixes: kira-poc
Found-by: Kira <kira_cxy@foxmail.com >
Change suggested by Kira
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6cba06205 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
24c627a900
avformat/oggparsedaala: Do not adjust AV_NOPTS_VALUE
...
Fixes: potential signed integer overflow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f655ddfb47 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
0cdc3e05cb
avformat/oggparseogm: Check lb against psize
...
No testcase, this was found during code review
Found-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3e7c847aaf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
a376fcaa39
avformat/oggparseogm: Fix undefined shift in ogm_packet()
...
Fixes: shift exponent 48 is too large for 32-bit type 'int'
Fixes: Chromium bug 786793
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 010b7b30b7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
79efbd547e
avformat/avidec: Fix integer overflow in cum_len check
...
Fixes: signed integer overflow: 3775922176 * 4278190080 cannot be represented in type 'long'
Fixes: Chromium bug 791237
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 06e092e781 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
60f6767126
avformat/oggparsetheora: Do not adjust AV_NOPTS_VALUE
...
Fixes: Chromium bug 795653
Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'long'
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 02ecda4aba )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
fea47f6941
avformat/utils: Fix integer overflow of fps_first/last_dts
...
Fixes: runtime error: signed integer overflow: 7738135736989908991 - -7898362169240453118 cannot be represented in type 'long'
Fixes: Chromium bug 796778
Reported-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1b1362e408 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
cd7a2954ae
avformat/oggdec: Fix metadata memleak on multiple headers
...
Fixes: Chromium bug 800123
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit da069e9c68 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
a05d577068
libavformat/oggparsevorbis: Fix memleak on multiple headers
...
Fixes: Chromium bug 800123
Reported-by: Matt Wolenetz <wolenetz@google.com >
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3934aa495d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
7a713cea22
avformat/mov: Fix integer overflow in mov_get_stsc_samples()
...
Fixes: runtime error: signed integer overflow: 5 * -2147483647 cannot be represented in type 'int'
Fixes: Chromium bug 817338
Reviewed-by: Matt Wolenetz <wolenetz@google.com >
Reported-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 367929bed9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
8456bba362
avcodec/truemotion2rt: Check input buffer size
...
Fixes: Timeout
Fixes: 6250/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2RT_fuzzer-5479814011027456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b5c29b6c2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
9cc83b94a1
avcodec/g2meet: Check tile dimensions with av_image_check_size2()
...
Fixes: OOM
Fixes: 6216/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-4983807968018432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3981fb8d2a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
60bd8316db
avcodec/exr: fix invalid shift in unpack_14()
...
Fixes: 6154/clusterfuzz-testcase-minimized-5762231061970944
Fixes: runtime error: shift exponent 63 is too large for 32-bit type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 49062a9017 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
ee33e79b25
avcodec/bintext: sanity check dimensions
...
Fixes: Timeout
Fixes: 6277/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XBIN_fuzzer-6047202288861184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 090c0abff9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
ae49cc73f2
avcodec/utvideodec: Check subsample factors
...
Fixes: Out of array read
Fixes: heap_poc
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7414d0bda7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
30a718c38b
avcodec/smc: Check input packet size
...
Fixes: Timeout
Fixes: 6261/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMC_fuzzer-5811309653262336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0293663483 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
4113106595
avcodec/cavsdec: Check alpha/beta offset
...
Fixes: Integer overflow
Fixes: 6183/clusterfuzz-testcase-minimized-6269224436629504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ae2eb04648 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
2b5c0fdaac
avcodec/diracdec: Fix integer overflow in mv computation
...
Fixes: signed integer overflow: -2072 + -2147483646 cannot be represented in type 'int'
Fixes: 6097/clusterfuzz-testcase-minimized-5034145253163008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47e65ad63b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
bc194927e4
avcodec/h264_parse: Clear invalid chroma weights in ff_h264_pred_weight_table()
...
Fixes: 6037/clusterfuzz-testcase-minimized-5030249784934400
Fixes: signed integer overflow: 256 * 16992036 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 85c85fffff )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
28398a70a9
avcodec/aacdec_templat: Fix integer overflow in apply_ltp()
...
Fixes: signed integer overflow: -1625276744 + -1041893960 cannot be represented in type 'int'
Fixes: 5948/clusterfuzz-testcase-minimized-5791479856365568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 33fe17bdc8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
c8f54bf87c
avcodec/jpeg2000dwt: Fix integer overflows in sr_1d53()
...
Fixes: 5918/clusterfuzz-testcase-minimized-5120505435652096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 793347a545 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
5c2e61f1f5
avcodec/diracdec: Use int64 in global mv to prevent overflow
...
Fixes: runtime error: signed integer overflow: 361 * -6295541 cannot be represented in type 'int'
Fixes: 5911/clusterfuzz-testcase-minimized-6450382197751808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cbcbefdc3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
3fc7e88bfd
avcodec/dxtory: Remove code that corrupts dimensions
...
Fixes: Timeout
Fixes: 5796/clusterfuzz-testcase-minimized-5206729085157376
Does someone have a valid sample that triggers this path ?
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3748746a4d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
ad3ef9e896
avcodec/dirac_dwt_template: Fix Integer overflow in horizontal_compose_dd137i()
...
Fixes: 5894/clusterfuzz-testcase-minimized-5315325420634112
Fixes: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 647fa49495 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
4597b51e8a
avcodec/hevcdec: Check luma/chroma_log2_weight_denom
...
Fixes: signed integer overflow: 3 + 2147483647 cannot be represented in type 'int'
Fixes: 5888/clusterfuzz-testcase-minimized-5634701067812864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f82dd4c09b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
fcc6932e09
avcodec/jpeg2000dec: Use av_image_check_size2()
...
Fixes: OOM
Fixes: 5733/clusterfuzz-testcase-minimized-4906757966004224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 01370b31ac )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
3f6f1c24eb
avcodec/vp8: Check for bitstream end before vp7_fade_frame()
...
Fixes: Timeout
Fixes: 5653/clusterfuzz-testcase-5497680018014208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit de675648ce )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
fe435d11fb
avcodec/exr: Check remaining bits in last get code loop
...
Fixes: runtime error: shift exponent -7 is negative
Fixes: 3902/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6081926122176512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dd8351b118 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
3c001b18ce
avutil/common: Fix integer overflow in av_clip_uint8_c() and av_clip_uint16_c()
...
Fixes: 5567/clusterfuzz-testcase-minimized-5769966247739392
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab6f571ef7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
1a8265487b
avdevice/decklink_dec: Fix ;;
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 75027066d8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Michael Niedermayer
a1e983111e
avcodec/h264_cabac: Tighten allowed coeff_abs range
...
Fixes: integer overflows
Reported-by: "Xiaohan Wang (王消寒)" <xhwang@chromium.org >
Based on limits in "8.5 Transform coefficient decoding process and picture
construction process prior to deblocking filter process"
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f26a63c4ee )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
Xiaohan Wang
988e7a8fea
avcodec/h264_cavlc: Set valid qscale value in ff_h264_decode_mb_cavlc()
...
When ff_h264_decode_mb_cavlc() failed due to wrong sl->qscale values,
e.g. dquant out of range, set the qscale to be a valid value before
returning -1 and exiting the function. The qscale value can be used
later e.g. in loop filter.
BUG=806122
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 71f39de2a5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-06-18 01:16:03 +02:00
James Almer
a877ab75eb
avdevice/iec61883: free the private context at the end
...
Fixes part of ticket #7146 .
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 5079e96bcc )
2018-04-18 23:03:17 -03:00
James Almer
4264723b0e
avdevice/iec61883: return reference counted packets
...
Fixes part of ticket #7146 , dealing with leaks of packet data since
commit 87c8812270 .
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit b8629654c6 )
2018-04-18 23:03:14 -03:00
Timo Rothenpieler
4faa01f20c
configure: add nvcc to CMDLINE_SET
...
This was somehow forgotten and nobody noticed until now.
2018-04-16 22:38:11 +02:00
James Almer
1b9b469cdb
avcodec/mpeg4_unpack_bframes: make sure the packet is writable when data needs to be changed
...
Nothing currently guarantees that the packet passed to the bsf will
be writable.
Based on commit 4f2ff3a53e
Signed-off-by: James Almer <jamrial@gmail.com >
2018-03-28 01:42:33 -03:00
James Almer
a45ba0881c
avcodec/mp3_header_decompress: don't free the user provided packet on error
...
It's owned by the caller.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit f18f973469 )
2018-03-28 01:17:51 -03:00
James Almer
c289f4b6c9
avcodec/extract_extradata: zero initalize the padding bytes in all allocated buffers
...
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit d168e78eff )
2018-03-10 09:55:36 -03:00
James Almer
e4b95f710b
avformat/hvcc: zero initialize the nal buffers past the last written byte
...
Prevents use of uninitialized values.
Fixes ticket #7038 .
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 9482ec1b20 )
2018-02-24 00:38:15 -03:00
Tobias Rapp
8be1edf47b
swresample/rematrix: fix update of channel matrix if input or output layout is undefined
...
Prefer direct in/out channel count values over channel layout, when
available. Fixes a pan filter bug (ticket #6790 ).
Signed-off-by: Tobias Rapp <t.rapp@noa-archive.com >
(cherry picked from commit 6325bd3717 )
2018-02-20 08:47:48 +01:00
James Almer
3fdff40a32
avformat/matroskadec: ignore CodecPrivate if the stream is VP9
...
Defined in a recent revision of https://www.webmproject.org/docs/container/
This prevents storing the contents of CodecPrivate into extradata for
a codec that doesn't need nor expect any. It will among other things
prevent matroska specific binary data from being dumped onto other
formats during remuxing.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit acdea9e7c5 )
2018-02-19 22:16:58 -03:00
Michael Niedermayer
6a97ba5215
Changelog: update
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-11 22:30:54 +01:00
Michael Niedermayer
2ad23b93b5
avcodec/vp3: Error out on invalid num_coeffs in unpack_vlcs()
...
This fixes a hypothetical integer overflow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f2318aee8c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-11 19:41:43 +01:00
Michael Niedermayer
cec38382db
avcodec/mpeg4videodec: Ignore multiple VOL headers
...
Fixes: Ticket7005
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 63a4bdbf3b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-11 19:41:43 +01:00
Michael Niedermayer
0ff1825ea3
avcodec/vp3: Check eob_run
...
Fixes: out of array access
Fixes: 5919/clusterfuzz-testcase-minimized-5859311382167552
Fixes: special case for theora (untested due to lack of sample)
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 570023eab3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-11 19:41:43 +01:00
Michael Niedermayer
4423cbf1b4
avcodec/pafvideo: Check allocated frame size
...
Fixes: OOM
Fixes: 5549/clusterfuzz-testcase-minimized-5390553567985664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 66acb63028 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-11 19:41:43 +01:00
Michael Niedermayer
c4153d40d5
avcodec/scpr: Fix reading a pixel before the first
...
Fixes: 5540/clusterfuzz-testcase-minimized-6122458273808384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0fb33a8289 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-11 19:41:43 +01:00
Nekopanda
cc0d2f110d
avcodec/mpeg2dec: Fix field selection for skipped macroblocks
...
For B field pictures, the spec says,
> The prediction shall be made from the field of the same parity as the field being predicted.
I did it.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8b154cb3e9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-11 19:41:43 +01:00
Michael Niedermayer
86296fe24d
avcodec/huffyuvdec: Check input buffer size
...
Fixes: Timeout
Fixes: 5487/clusterfuzz-testcase-4696837035393024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 08c220d26c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-11 19:41:43 +01:00
Michael Niedermayer
342f1da134
avcodec/utvideodec: Fix bytes left check in decode_frame()
...
Fixes: out of array read
Fixes: poc-2017.avi
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 118e1b0b33 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-11 19:41:43 +01:00
Michael Niedermayer
5e67a2e13a
avcodec/wavpack: Fix integer overflow in FFABS
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 5396/clusterfuzz-testcase-minimized-6558555529281536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e50bd61e4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-11 19:41:43 +01:00
Michael Niedermayer
9efd80dc09
avcodec/aacsbr_fixed: Fix overflows in rounding in sbr_hf_assemble()
...
Fixes: runtime error: signed integer overflow: 2052929346 + 204817098 cannot be represented in type 'int'
Fixes: 5275/clusterfuzz-testcase-minimized-5367635958038528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b1bef755f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-11 19:41:43 +01:00
Michael Niedermayer
ce7f65be6e
avcodec/exr: Fix memleaks in decode_header()
...
Fixes: 4793/clusterfuzz-testcase-minimized-5707366629638144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a2560a977 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-02-11 19:41:43 +01:00
James Almer
9b97afe7ad
Changelog: update for the previous four commits
...
Signed-off-by: James Almer <jamrial@gmail.com >
2018-01-30 22:13:05 -03:00
James Almer
af54886de8
avcodec/mediacodecdec: use ff_hevc_ps_uninit()
...
Fixes memleaks.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 782e066e3e )
2018-01-30 22:07:35 -03:00
James Almer
e5bbb52194
avcodec/hevc_parser: use ff_hevc_uninit_parameter_sets()
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 2159d4bbc3 )
2018-01-30 22:07:28 -03:00
James Almer
d7d5a3379d
avcodec/hevcdec: use ff_hevc_uninit_parameter_sets()
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 1f0cf1b2f4 )
2018-01-30 22:07:21 -03:00
James Almer
64f0fd5998
avcodec/hevc_ps: add a function to uninitialize parameter set buffers
...
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 9462b2b820 )
2018-01-30 22:06:59 -03:00
Michael Niedermayer
dd93df46a6
Update for 3.4.2
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-31 01:09:12 +01:00
Michael Niedermayer
c1c50fc4a7
avcodec/dirac_dwt: Fix several integer overflows
...
Fixes: runtime error: signed integer overflow: -2146071175 + -268479557 cannot be represented in type 'int'
Fixes: 5237/clusterfuzz-testcase-minimized-4569895275593728
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fe1e6c06d0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-30 23:55:43 +01:00
Michael Niedermayer
d06972535e
avcodec/indeo5: Do not leave frame_type set to an invalid value
...
Fixes: null pointer dereference
Fixes: 5264/clusterfuzz-testcase-minimized-4621956621008896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ff9f17851 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-30 23:45:10 +01:00
Michael Niedermayer
93437a18d8
avcodec/hevc_ps: Check log2_sao_offset_scale_*
...
Fixes: 4868/clusterfuzz-testcase-minimized-6236542906400768
Fixes: runtime error: shift exponent 126 is too large for 32-bit type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a75a75c62 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-30 23:26:03 +01:00
Michael Niedermayer
d07f78ae72
avcodec/mpeg4videodec: Avoid possibly aliasing violating casts
...
Found-by: kierank
Reviewed-by: Kieran Kunhya <kieran618@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d4967c04e0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-30 23:08:58 +01:00
Michael Niedermayer
cd478122b0
avcodec/get_bits: Document the return code of get_vlc2()
...
Found-by: kierank
Reviewed-by: Kieran Kunhya <kieran618@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4a94ff4ccd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-30 22:50:23 +01:00
Michael Niedermayer
6723a43609
avcodec/mpeg4videodec: Check mb_num also against 0
...
The spec implies that 0 is invalid in addition to the existing checks
Found-by: <kierank>
Reviewed-by: Kieran Kunhya <kieran618@googlemail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 05f4703a16 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-30 22:49:55 +01:00
Michael Niedermayer
2980b95faf
avfilter/vf_transpose: Fix used plane count.
...
Fixes out of array access
Fixes: poc.mp4
Found-by: GwanYeong Kim <gy741.kim@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c6939f65a1 )
(cherry picked from commit 3f621455d6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:09 +01:00
Michael Niedermayer
11498c22a0
avcodec/hevc_cabac: Check prefix so as to avoid invalid shifts in coeff_abs_level_remaining_decode()
...
I suspect that this can be limited tighter, but i failed to find anything
in the spec that would confirm that.
Fixes: 4833/clusterfuzz-testcase-minimized-5302840101699584
Fixes: runtime error: left shift of 134217730 by 4 places cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a026a3efae )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:09 +01:00
Michael Niedermayer
2fdb27b512
avcodec/mjpegdec: Fix integer overflow in DC dequantization
...
Fixes: runtime error: signed integer overflow: -65535 * 65312 cannot be represented in type 'int'
Fixes: 4900/clusterfuzz-testcase-minimized-5769019744321536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1bfc1aa004 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:09 +01:00
Michael Niedermayer
c1b74d608c
avcodec/dxtory: Fix bits left checks
...
Fixes: Timeout
Fixes: 4863/clusterfuzz-testcase-6347354178322432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6e1a167c55 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:09 +01:00
Michael Niedermayer
edf200e2bc
avcodec/hevc_cabac: Move prefix check in coeff_abs_level_remaining_decode() down
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 94d4237a7a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:09 +01:00
Michael Niedermayer
6ed5e44998
avcodec/truemotion2: Fix integer overflow in TM2_RECALC_BLOCK()
...
Fixes: signed integer overflow: 1477974040 - -1877995504 cannot be represented in type 'int'
Fixes: 4861/clusterfuzz-testcase-minimized-4570316383715328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 56a53340ed )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:09 +01:00
Michael Niedermayer
aed915b8a6
avcodec/snowdec: Fix integer overflow before htaps check
...
Fixes: runtime error: signed integer overflow: -1094995529 * 2 cannot be represented in type 'int'
Fixes: 4828/clusterfuzz-testcase-minimized-5100849937252352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2eecf3cf8e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:09 +01:00
Michael Niedermayer
540f4467c8
avcodec/ulti: Check number of blocks at init
...
Fixes: Timeout
Fixes: 4832/clusterfuzz-testcase-4699096590843904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 725353525e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:09 +01:00
Michael Niedermayer
bae4d39437
avcodec/wavpack: Fix integer overflows in wv_unpack_stereo / mono
...
Fixes: runtime error: signed integer overflow: 2146276249 + 1487583 cannot be represented in type 'int'
Fixes: 4823/clusterfuzz-testcase-minimized-4551896611160064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 83e34ae3c2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:09 +01:00
Michael Niedermayer
f56215d3ff
avcodec/jpeg2000: Check sum of sizes of band->prec before allocating
...
Fixes: OOM
Fixes: 4810/clusterfuzz-testcase-minimized-6034253235093504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6887e41243 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:09 +01:00
Michael Niedermayer
56b0179b6a
avcodec/ac3dec_fixed: Fix integer overflow in scale_coefs()
...
Fixes: runtime error: signed integer overflow: 2147483520 + 128 cannot be represented in type 'int'
Fixes: 4800/clusterfuzz-testcase-minimized-6110372403609600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1f38c7589 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:09 +01:00
Nikolas Bowe
e755482d36
avformat/lrcdec: Fix memory leak in lrc_read_header()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ef5994e09d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:09 +01:00
Nikolas Bowe
facd0521e4
avformat/matroskadec: Fix float-cast-overflow undefined behavior in matroska_parse_tracks()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e07649e618 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:09 +01:00
Jun Zhao
7b56d6584c
lavfi/deinterlace_vaapi: fix can't show full option information.
...
use ffmpeg -h filter=deinterlace_vaapi can't get full help information,
the root cause is not setting the flags fileld in options.
Signed-off-by: Jun Zhao <jun.zhao@intel.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 383804edd8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:09 +01:00
Carl Eugen Hoyos
092febb2ad
configure: bump year
...
Happy new year!
(cherry picked from commit bddf31ba75 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:09 +01:00
Michael Niedermayer
04949cc08e
avcodec/utils: Avoid hardcoding duplicated types in sizeof()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 860d991fcd )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:09 +01:00
Michael Niedermayer
ece7879992
avcodec/arm/sbrdsp_neon: Use a free register instead of putting 2 things in one
...
Fixes high pitched shriek
Fixes: 25420848_1478428308873746_4255813235963330560_n.mp4
Reported-by: Dale Curtis <dalecurtis@google.com >
Reviewed-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7dbbb75ee3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:09 +01:00
Michael Niedermayer
4715ef27a0
avcodec/h264addpx_template: Fixes integer overflows
...
Fixes: signed integer overflow: 512 + 2147483491 cannot be represented in type 'int'
Fixes: 4780/clusterfuzz-testcase-minimized-4709066174627840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d6945aeee4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:09 +01:00
Michael Niedermayer
8263246ba8
avcodec/dirac_dwt: Fix overflows in COMPOSE_HAARiH0/COMPOSE_HAARiL0
...
Fixes: 4830/clusterfuzz-testcase-minimized-5255392054476800
Fixes: signed integer overflow: 2147483646 - -7 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e62a23734 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:08 +01:00
Michael Niedermayer
097bc4d32d
avcodec/diracdec: Fix integer overflow with quant
...
Fixes: signed integer overflow: 2 + 2147483646 cannot be represented in type 'int'
Fixes: 4792/clusterfuzz-testcase-minimized-6322450775146496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eaa9317589 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:08 +01:00
Michael Niedermayer
a3add19240
avcodec/opus_parser: Check payload_len in parse_opus_ts_header()
...
Fixes: clusterfuzz-testcase-minimized-6134545979277312
Fixes: crbug 797469
Reported-by: Matt Wolenetz <wolenetz@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1bcd7fefcb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:08 +01:00
Michael Niedermayer
5365904e96
avcodec/jpeg2000dsp: Fix integer overflows in ict_int()
...
Fixes: signed integer overflow: 46802 * -71230 cannot be represented in type 'int'
Fixes: 4756/clusterfuzz-testcase-minimized-4812495563784192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b3192c64b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:08 +01:00
Michael Niedermayer
62024c1277
avcodec/h264_slice: Do not attempt to render into frames already output
...
Fixes: null pointer dereference
Fixes: 4698/clusterfuzz-testcase-minimized-5096956322906112
This testcase does not reproduce the issue before 03b82b3ab9
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 476665d4de )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:08 +01:00
Michael Niedermayer
b1af55778b
avcodec/dnxhddec: Check dc vlc
...
Fixes: signed integer overflow: 1024 + 2147483640 cannot be represented in type 'int'
Fixes: 4671/clusterfuzz-testcase-minimized-6027464343027712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b2be76c0a4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:33:08 +01:00
Michael Niedermayer
6abe1e06f5
avcodec/exr: Check buf_size more completely
...
Fixes: Out of heap array read
Fixes: 4683/clusterfuzz-testcase-minimized-6152313673613312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 903be5e4f6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:31:14 +01:00
Michael Niedermayer
91f5a2b7b8
avcodec/flacdec: Fix overflow in multiplication in decode_subframe_fixed()
...
Fixes: signed integer overflow: 2 * 1629495328 cannot be represented in type 'int'
Fixes: 4716/clusterfuzz-testcase-minimized-5835915940331520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3d23f7a096 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:31:14 +01:00
Michael Niedermayer
7e402c31ef
avcodec/hevcdsp_template: Fix Invalid shifts in put_hevc_qpel_bi_w_h() and put_hevc_qpel_bi_w_w()
...
Fixes: left shift of negative value -1
Fixes: 4690/clusterfuzz-testcase-minimized-6117482428366848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d135f3c514 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:31:14 +01:00
Michael Niedermayer
fb9560b366
avcodec/flacdec: avoid undefined shift
...
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 4688/clusterfuzz-testcase-minimized-6572210748653568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 560daf8891 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:31:14 +01:00
Michael Niedermayer
0e7d8ce37c
avcodec/hevcdsp_template.c: Fix undefined shift in FUNC(dequant)
...
Fixes: runtime error: left shift of negative value -180
Fixes: 4626/clusterfuzz-testcase-minimized-5647837887987712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c9ab5ef9c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:31:14 +01:00
Michael Niedermayer
e55a6c5f05
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD97iH0() and COMPOSE_DD137iL0()
...
Fixes: runtime error: signed integer overflow: 2147483646 + 33554433 cannot be represented in type 'int'
Fixes: 4563/clusterfuzz-testcase-minimized-5438979567517696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4d70fbeec8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:31:14 +01:00
Michael Niedermayer
0288d15cdd
avcodec/hevc_cabac: Fix integer overflow in ff_hevc_cu_qp_delta_abs()
...
Fixes: signed integer overflow: 2147483647 + 1073741824 cannot be represented in type 'int'
Fixes: 4555/clusterfuzz-testcase-minimized-4505532481142784
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ee143558d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:31:14 +01:00
Michael Niedermayer
43c03866b2
tests/audiomatch: Add missing return code at the end of main()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65da5c56e6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:31:13 +01:00
Michael Niedermayer
2e426fae43
avcodec/hevc_sei: Fix integer overflows in decode_nal_sei_message()
...
Fixes: signed integer overflow: 2147483520 + 255 cannot be represented in type 'int'
Fixes: 4554/clusterfuzz-testcase-minimized-4843714515042304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 991ef6e5b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:31:13 +01:00
Michael Niedermayer
d147e2d55d
avcodec/hevcdsp_template: Fix undefined shift in put_hevc_qpel_bi_w_hv()
...
Fixes: runtime error: left shift of negative value -3
Fixes: 4524/clusterfuzz-testcase-minimized-6055590120914944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 439fbb9c8b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:31:13 +01:00
Michael Niedermayer
d6a13f031c
avcodec/h264_parse: Treat escaped and unescaped decoding error equal in decode_extradata_ps_mp4()
...
Fixes: lorex.mp4
Fixes: ticket6762
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4bb7d72bcf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:31:13 +01:00
Michael Niedermayer
0f0a2ff5a0
avcodec/vp9: mark frame as finished on decode_tiles() failure
...
Fixes deadlock with framethreads
Fixes: Netflix_Aerial_1080p_60fps_8bit_420.y4m.vp9.noaltref.webm.ivf.s69372_r01-05_b6-.ivf
Fixes: Netflix_Aerial_1080p_60fps_10bit_420.y4m.vp9.noaltref.webm.ivf.s149104_r01-05_b6-.ivf
Fixes: ducks_take_off_444_720p50.y4m.vp9.webm.ivf.s107375_r01-05_b6-.ivf
Reported-by: James Zern <jzern@google.com >
Reviewed-by: James Zern <jzern@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5e03eea673 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:31:13 +01:00
Kelly Ledford
a3832486e4
libavfilter/af_dcshift.c: Fixed repeated spelling error
...
'threshhold' should be 'threshold'
Signed-off-by: Kelly Ledford <kelly.ledford@intel.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc219082bb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:31:13 +01:00
Jun Zhao
9aa0ed850b
avfilter/formats: fix wrong function name in error message
...
Use perdefined micro __FUNCTION__ rather than hard coding function name
to fix wrong function name in error message.
Signed-off-by: Jun Zhao <jun.zhao@intel.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4280948702 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-28 15:31:13 +01:00
Timo Rothenpieler
93c8720b91
avcodec/nvenc: also clear data pointer after unregistering a resource
...
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2018-01-28 13:34:24 +01:00
Timo Rothenpieler
d36714f727
avcodec/nvenc: add some more error case checks
...
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2018-01-28 13:32:39 +01:00
Timo Rothenpieler
a7c60c5b7b
avcodec/nvenc: unregister input resource when unmapping
...
Currently the resource is only ever unregistered when the
registered_frames array is fully in use and an unmapped entry is re-used
and cleaned up.
I'm pretty sure the frame will have been cleaned up before that happens,
so I'm kinda surprised this never blew up.
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2018-01-28 13:32:14 +01:00
Timo Rothenpieler
fbb27e2911
avcodec/nvenc: refcount input frame mappings
...
If some logic like vsync in ffmpeg.c duplicates frames, it might pass
the same frame twice, which will result in a crash due it being
effectively mapped and unmapped twice.
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org >
2018-01-28 13:27:24 +01:00
Rodger Combs
ad85d9af13
lavc/aarch64/sbrdsp_neon: fix build on old binutils
...
(cherry picked from commit 7723750475 )
2018-01-26 13:31:46 -03:00
wm4
4a53ecb12e
hwcontext_dxva2: initialize D3DDISPLAYMODEEX correctly
...
(cherry picked from commit 18fbfd7bf8 )
2018-01-04 18:20:54 -03:00
Humberto Ribeiro
7c3d519df9
libavutil/hwcontext_dxva2: Add check for possible errors from GetAdapterDisplayModeEx
...
This prevents a possible crash in CreateDeviceEx when using faulty
response from GetAdapterDisplayModeEx and allows ffmpeg to fallback to
classic d3d9.
Signed-off-by: wm4 <nfxjfg@googlemail.com >
(cherry picked from commit 59b126f922 )
2018-01-04 18:20:43 -03:00
James Almer
d8104977bb
avcodec/libx264: set supported pix_fmts at runtime rather than build time
...
This partially reverts a change in behavior introduced in 2a111c99a6 .
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 7e60c74329 )
2017-12-26 19:45:29 -03:00
James Almer
650cb712ef
avcodec/libx264: fix compilation with x264 builds >= 153
...
x264 now supports multibitdepth builds, with a slightly changed API to
request bitdepth during initialization.
Reviewed-by: Ricardo Constantino <wiiaboo@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 2a111c99a6 )
2017-12-26 12:56:02 -03:00
James Almer
31d6f3df25
avcodec/libx264: use the pixfmt descriptor to check for high bit depths
...
The x264_bit_depth constant has been removed in newer x264 builds.
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 89f704caba )
2017-12-26 12:55:54 -03:00
Michael Niedermayer
bc839fb39d
Changelog: Update for the last 3 commits
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-10 21:20:05 +01:00
Michael Niedermayer
1fab842fbb
avcodec/vp9_superframe_split_bsf: Fix integer overflow in frame_size/total_size checks
...
Fixes: signed integer overflow: -1698586465 + -551542752 cannot be represented in type 'int'
Fixes: 4490/clusterfuzz-testcase-minimized-5210014592532480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eaff5fcb7c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-10 20:25:14 +01:00
Michael Niedermayer
60d250386b
avcodec/amrwbdec: Fix division by 0 in voice_factor()
...
The added value matches "Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS); LTE; Extended Adaptive Multi-Rate - Wideband (AMR-WB+) codec; Floating-point ANSI-C code (3GPP TS 26.304 version 14.0.0 Release 14)
Extended Adaptive Multi-Rate - Wideband (AMR-WB+) codec; Floating-point ANSI-C code"
Fixes: runtime error: division by zero
Fixes: 4415/clusterfuzz-testcase-minimized-4677752314658816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1d0817d56b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-10 20:25:14 +01:00
Michael Niedermayer
c5fd23879a
avformat/utils: Fix warning: ISO C90 forbids mixed declarations and code
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-10 20:25:14 +01:00
James Cowgill
d8d1689f92
avcodec/decode: reset codec on receiving packet after EOF in compat_decode
...
In commit 061a0c14bb ("decode: restructure the core decoding code"), the
deprecated avcodec_decode_* APIs were reworked so that they called into the
new avcodec_send_packet / avcodec_receive_frame API. This had the side effect
of prohibiting sending new packets containing data after a drain
packet, but in previous versions of FFmpeg this "worked" and some
applications relied on it.
To restore some compatibility, reset the codec if we receive a new non-drain
packet using the old API after draining has completed. While this does
not give the same behaviour as the old API did, in the majority of cases
it works and it does not require changes to any other part of the decoding
code.
Fixes ticket #6775
Signed-off-by: James Cowgill <jcowgill@debian.org >
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit 02ba4b91b5 )
2017-12-09 21:40:47 +01:00
Michael Niedermayer
c741095eec
Update for 3.4.1
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-08 10:22:30 +01:00
Michael Niedermayer
b2169c8bcc
avcodec/diracdsp: Fix integer overflow in PUT_SIGNED_RECT_CLAMPED()
...
Fixes: runtime error: signed integer overflow: 2147483646 + 2048 cannot be represented in type 'int'
Fixes: 4479/clusterfuzz-testcase-minimized-6529894147162112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 610dd74502 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
3a6140e4cf
avcodec/dirac_dwt: Fix integer overflows in COMPOSE_DAUB97*
...
Fixes: 4478/clusterfuzz-testcase-minimized-4752113767809024
Fixes: runtime error: signed integer overflow: -2147483626 + -319489 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5e9a13a5a3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Nikolas Bowe
a749f4864e
avcodec/extract_extradata_bsf: Fix leak discovered via fuzzing
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5a412a5c3c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Dale Curtis
c147aefc3e
avcodec/vorbis: Fix another 1 << 31 > int32_t::max() with 1u.
...
Didn't notice this one when 9648cc6d was landed.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 95bacb521a )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Dale Curtis
23319f7764
avcodec/vorbis: 1 << 31 > int32_t::max(), so use 1u << 31 instead.
...
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9648cc6d7f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Dale Curtis
36db62ca98
avformat/utils: Prevent undefined shift with wrap_bits > 64.
...
2LL << (wrap_bits=64 - 1) does not fit in int64_t; change the
code to use a uint64_t (2ULL) and add an av_assert2() to
ensure wrap_bits <= 64.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 03fbc0daa7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
17f05ff656
avcodec/j2kenc: Fix out of array access in encode_cblk()
...
Fixes: 4427/clusterfuzz-testcase-minimized-5106919271301120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0674087004 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
0ccbbf034d
avcodec/hevcdsp_template: Fix undefined shift in put_hevc_epel_bi_w_h()
...
Fixes: runtime error: left shift of negative value -127
Fixes: 4397/clusterfuzz-testcase-minimized-4779061080489984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0409d33311 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
John Stebbins
f7357facd8
lavf/mov: fix huge alloc in mov_read_ctts
...
An invalid file may cause huge alloc. Delay expansion of ctts entries
until the number of samples is known in mov_build_index.
Fixes: 23
Found-by: zhao dongzhuo, AD-lab of Venustech
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d015d3bf9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
ed87667bd3
avcodec/mlpdsp: Fix signed integer overflow, 2nd try
...
The outputted bits should match what is used in the lossless check
Fixes: runtime error: signed integer overflow: -538697856 * 256 cannot be represented in type 'int'
Fixes: 4326/clusterfuzz-testcase-minimized-5689449645080576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 97c00edaa0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
983d119c9b
avcodec/h264idct_template: Fix integer overflow in ff_h264_idct8_add
...
Fixes: signed integer overflow: 452986184 - -2113885312 cannot be represented in type 'int'
Fixes: 4196/clusterfuzz-testcase-minimized-5580648594014208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9cc926da7d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
e56f691283
avcodec/kgv1dec: Check that there is enough input for maximum RLE compression
...
Fixes: Timeout
Fixes: 4271/clusterfuzz-testcase-4676667768307712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3aad94bf2b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
3ae71b648a
avformat/aacdec: Fix leak in adts_aac_read_packet()
...
Fixes: chromium-773637/clusterfuzz-testcase-minimized-6418078673141760
Found-by: ossfuzz/chromium
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2779d33ed9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
f2f0273588
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_FIDELITYi*
...
Fixes: runtime error: signed integer overflow: -2143827186 - 7404944 cannot be represented in type 'int'
Fixes: 4354/clusterfuzz-testcase-minimized-4671122764201984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b6964f764 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
de20dad15e
avcodec/sbrdsp_fixed: Fix integer overflow
...
Fixes: signed integer overflow: 2147483598 + 64 cannot be represented in type 'int'
Fixes: 4337/clusterfuzz-testcase-minimized-6192658616680448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 12a511f2c2 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
1549890035
avcodec/mpeg4videodec: Check also for negative versions in the validity check
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e7865ce41 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Dale Curtis
35c7a1df8a
Close ogg stream upon error when using AV_EF_EXPLODE.
...
Without this there can be multiple memory leaks for unrecognized
ogg streams.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bce8fc0754 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Dale Curtis
f8fcb6bbf0
Fix undefined shift on assumed 8-bit input.
...
decode_user_data() attempts to create an integer |build|
value with 8 bits of spacing for 3 components. However
each component is an int32_t, so shifting each component
is undefined for values outside of the 8 bit range.
This patch simply clamps input to 8-bits per component
and prints out a warning that the values were clamped.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7010dd98b5 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Dale Curtis
50c93ce5ef
Use ff_thread_once for fixed, float table init.
...
These tables are static so they should only be initialized once
instead of on every call to ff_mpadsp_init().
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5eaaffaf64 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Dale Curtis
9a00ce0ff8
Fix leak of frame_duration_buffer in mov_fix_index().
...
Should be unconditionally freed at the end of mov_fix_index() in
case it hasn't been used during the fix up.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Reviewed-by: Sasi Inguva <isasi-at-google.com@ffmpeg.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d073be2291 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Jacob Trimble
8aabc4fdb5
avformat/mov: Propagate errors in mov_switch_root.
...
Signed-off-by: Jacob Trimble <modmaker@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d9cf3bf16 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
2e58db3db0
avcodec/hevcdsp_template: Fix invalid shift in put_hevc_epel_bi_w_v()
...
Fixes: runtime error: left shift of negative value -255
Fixes: 4037/clusterfuzz-testcase-minimized-5290998163832832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d88586e47 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
4942de6f93
avcodec/mlpdsp: Fix undefined shift ff_mlp_pack_output()
...
Fixes: runtime error: left shift of negative value -7862264
Fixes: 4074/clusterfuzz-testcase-minimized-4516104123711488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f7f70738e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
cc9d1bb839
avcodec/zmbv: Check that the buffer is large enough for mvec
...
Fixes: Timeout
Fixes: 4143/clusterfuzz-testcase-4736864637419520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ab9568a2c )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
0ba93614cf
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD137iL0()
...
Fixes: 4035/clusterfuzz-testcase-minimized-6479308925173760
Fixes: runtime error: signed integer overflow: 9 * 402653183 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73964680d7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
ecf2755a41
avcodec/wmv2dec: Check end of bitstream in parse_mb_skip() and ff_wmv2_decode_mb()
...
Fixes: Timeout
Fixes: 3200/clusterfuzz-testcase-5750022136135680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65e0a7c473 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
23d5f15b42
avcodec/snowdec: Check for remaining bitstream in decode_blocks()
...
Fixes: Timeout
Fixes: 3142/clusterfuzz-testcase-5007853163118592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4527ec2216 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
77cfc820cf
avcodec/snowdec: Check intra block dc differences.
...
Fixes: Timeout
Fixes: 3142/clusterfuzz-testcase-5007853163118592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c3b9bbcc6e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Fredrik Hubinette
53715eb13e
avformat/mov: Check size of STSC allocation
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6fdd75fe6 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
7b16eacf81
avcodec/vc2enc: Clear coef_buf on allocation
...
Fixes: Use of uninitialized memory
Fixes: assertion failure
Reviewed-by: <atomnuker>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6d00905f81 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
d25736dc87
avcodec/h264dec: Fix potential array overread
...
add padding before scantable arrays
See: 522d850e68
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 380b48fb9f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
6ccf19198b
avcodec/x86/mpegvideodsp: Fix signedness bug in need_emu
...
Fixes: out of array read
Fixes: 3516/attachment-311488.dat
Found-by: Insu Yun, Georgia Tech.
Tested-by: wuninsu@gmail.com
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 58cf31cee7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
44fb120112
avcodec/aacpsdsp_template: Fix integer overflows in ps_decorrelate_c()
...
Fixes: runtime error: signed integer overflow: 1939661764 - -454942263 cannot be represented in type 'int'
Fixes: 3191/clusterfuzz-testcase-minimized-5688798451073024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2afe05402f )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
db82e4f1e0
avcodec/aacdec_fixed: Fix undefined shift
...
Fixes: runtime error: left shift of negative value -801112064
Fixes: 3492/clusterfuzz-testcase-minimized-5784775283441664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fca198fb5b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
168ee58255
avcodec/mdct_*: Fix integer overflow in addition in RESCALE()
...
Fixes: runtime error: signed integer overflow: 1219998458 - -1469874012 cannot be represented in type 'int'
Fixes: 3443/clusterfuzz-testcase-minimized-5369987105554432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 770c934fa1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
3a143bfa19
avcodec/snowdec: Fix integer overflow in header parsing
...
Fixes: 3984/clusterfuzz-testcase-minimized-5265759929368576
Fixes: runtime error: signed integer overflow: -1085585801 + -1094995529 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c897a92858 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
ed87b8b61f
avcodec/cngdec: Fix integer clipping
...
Fixes: runtime error: value -36211.7 is outside the range of representable values of type 'short'
Fixes: 2992/clusterfuzz-testcase-6649611793989632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 51090133b3 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
87f39642f3
avcodec/sbrdsp_fixed: Fix integer overflow in shift in sbr_hf_g_filt_c()
...
Fixes: runtime error: shift exponent 66 is too large for 64-bit type 'long long'
Fixes: 3642/clusterfuzz-testcase-minimized-5443853801750528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 981e99ab99 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
8ec1ff14fe
avcodec/aacsbr_fixed: Fix division by zero in sbr_gain_calc()
...
Fixes: 3642/clusterfuzz-testcase-minimized-5443853801750528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d1dec4668 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
3f2be02b4d
avutil/softfloat: Add FLOAT_MIN
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e34fe61bf4 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
56ce961cc3
avcodec/h264idct_template: Fix integer overflows in ff_h264_idct8_add()
...
Fixes: runtime error: signed integer overflow: -503316480 + -2013265038 cannot be represented in type 'int'
Fixes: 3805/clusterfuzz-testcase-minimized-6578427831255040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e131b8cedb )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
3ca4f1868d
avcodec/xan: Check for bitstream end in xan_huffman_decode()
...
Fixes: Timeout
Fixes: 3707/clusterfuzz-testcase-6465922706440192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4b51437dcc )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
0ee2cb866c
avcodec/exr: fix undefined shift in pxr24_uncompress()
...
Fixes: runtime error: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 3787/clusterfuzz-testcase-minimized-5728764920070144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 66f0c958bf )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Luca Barbato
78b8aeee58
avformat: Free the internal codec context at the end
...
Avoid a use after free in avformat_find_stream_info.
(cherry picked from commit 9e4a5eb51b )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
66e65e0a68
avcodec/h264idct_template: Fix integer overflows in ff_h264_idct8_add()
...
Fixes: runtime error: signed integer overflow: 924846844 + 1457520640 cannot be represented in type 'int'
Fixes: 3416/clusterfuzz-testcase-minimized-6125587682820096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b739e1cb8 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
6be60aedcb
avcodec/xan: Improve overlapping check
...
Fixes: memcpy-param-overlap
Fixes: 3612/clusterfuzz-testcase-minimized-6393461273001984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e8fafef1db )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
dccead84c6
avcodec/aacdec_fixed: Fix integer overflow in apply_dependent_coupling_fixed()
...
Fixes: runtime error: signed integer overflow: 623487 * 536870912 cannot be represented in type 'int'
Fixes: 3594/clusterfuzz-testcase-minimized-4650622935629824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 41d96af2a7 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
b3bdb0ddc1
avcodec/aacdec_fixed: Fix integer overflow in predict()
...
Fixes: runtime error: signed integer overflow: -2110708110 + -82837504 cannot be represented in type 'int'
Fixes: 3547/clusterfuzz-testcase-minimized-6009386439802880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0976752420 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
7a23220bf9
avcodec/jpeglsdec: Check for end of bitstream in ls_decode_line()
...
Fixes: 1773/clusterfuzz-testcase-minimized-4832523987189760
Fixes: Timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f80224ed19 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
1c931d5ab9
avcodec/jpeglsdec: Check ilv for being a supported value
...
Fixes: 1773/clusterfuzz-testcase-minimized-4832523987189760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fe533628b9 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
7ff156b112
tests/ffserver.regression.ref: update checksums to what ffserver currently produces
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 431eccd61e )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
Michael Niedermayer
561e276899
ffserver: Fix off by 1 error in path
...
Code suggested by ubitux
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 617f0c65e1 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-12-07 23:38:06 +01:00
James Almer
bcfbcbec48
avcodec/proresdec: align dequantization matrix buffers
...
Should fix ticket #6838
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit f399172d6e )
2017-12-01 01:27:24 -03:00
James Almer
2940b3e17c
avformat/matroskaenc: add missing allocation failure checks for stream durations
...
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 5f67073b4c )
2017-12-01 01:26:15 -03:00
James Almer
8d51090dcb
avformat/matroskaenc: actually enforce the stream limit
...
Prevents out of array accesses. Adressess ticket #6873
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 9d464dc3fc )
2017-12-01 01:25:45 -03:00
Jacob Trimble
5ab992cd38
configure: Fix dependencies of aac_at decoder.
...
Signed-off-by: Jacob Trimble <modmaker@google.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 83ecdc9a92 )
2017-12-01 01:24:25 -03:00
Dale Curtis
ceed79323c
Don't manipulate duration when it's AV_NOPTS_VALUE.
...
This leads to signed integer overflow.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit c5fd57f483 )
2017-12-01 01:24:17 -03:00
Michael Roitzsch
752659ff1e
lavfi/af_pan: fix sign handling in channel coefficient parser
...
When a channel formula ends with a subtraction, the next formula will
otherwise have its first coefficient negated.
(cherry picked from commit 4f4e19914d )
2017-11-21 14:04:10 +01:00
Steven Liu
67c0793835
avformat/hlsenc: write fmp4 init header after first AV frame
...
fix ticket id: 6825
Signed-off-by: Steven Liu <lq@onvideo.cn >
Tested-by: Aman Gupta <aman@tmm1.net >
2017-11-15 17:53:42 -08:00
Timo Rothenpieler
62e99f026a
avformat/hlsenc: allocate space for terminating null
...
Fixes CID #1420394
2017-11-15 17:53:38 -08:00
Steven Liu
e3c09fb986
avformat/hlsenc: reindent hlsenc code
...
Signed-off-by: Steven Liu <lq@onvideo.cn >
2017-11-15 17:53:35 -08:00
Steven Liu
fac3cfb6c1
avformat/hlsenc: check hls segment mode for ignore the init filename
...
ignore the fmp4_init_filename when in normal hls segment mode
Signed-off-by: Steven Liu <lq@onvideo.cn >
2017-11-15 17:53:27 -08:00
Steven Liu
9ccb6de56c
avformat/hlsenc: reindent hlsenc code
...
Signed-off-by: Steven Liu <lq@onvideo.cn >
2017-11-15 17:53:21 -08:00
Steven Liu
6ad4d3c92f
avformat/hlsenc: fix missing first segment bug in fmp4 mode
...
fix ticket id: #6776
fix code logic error, need not check first segment.
Signed-off-by: Steven Liu <lq@chinaffmpeg.org >
2017-11-15 17:53:18 -08:00
Steven Liu
d55794fafc
avformat/hlsenc: fix base_output_dirname is null when basename_size is 0 bug
...
fix ticket id: #6777
when use argument hls_segment_filename, the basename_size will be 0
Signed-off-by: Steven Liu <lq@onvideo.cn >
2017-11-15 17:53:14 -08:00
Marton Balint
88a6fca74d
ffplay: use SDL2 audio API
...
It allows us to specify what kind of audio parameter changes are allowed.
Should fix ticket #6721 .
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit d68a557df4 )
2017-11-12 21:00:26 +01:00
Marton Balint
46aa734646
ffplay: only use hardware accelerated SDL texture formats
...
Typically only a small subset of the SDL texture formats are supported directly
by the SDL renderer drivers, the rest is software emulated. It's better if
libswscale does the format conversion to a hardware-accelerated texture format
instead of SDL.
This should fix video render slowdowns with some texture formats after
3bd2228d05 .
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit 415038f2bd )
2017-11-12 20:59:42 +01:00
Marton Balint
0158fd5276
ffplay: create the window and the renderer before starting playback
...
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit 84d31e2475 )
2017-11-12 20:59:27 +01:00
Marton Balint
0ca0ec26a6
ffmpeg: always init output stream before reaping filters
...
Otherwise the frame size of the codec is not set in the buffersink.
Fixes ticket #6603 and the following simpler case:
ffmpeg -c aac -filter_complex "sine=d=0.1,asetnsamples=1025" out.aac
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit f4090940bd )
2017-11-12 20:58:24 +01:00
Rostislav Pehlivanov
a94cb36ab2
vc2enc_dwt: pad the temporary buffer by the slice size
...
Since non-Haar wavelets need to look into pixels outside the frame, we
need to pad the buffer. The old factor of two seemed to be a workaround
that fact and only padded to the left and bottom. This correctly pads
by the slice size and as such reduces memory usage and potential
exploits.
Reported by Liu Bingchang.
Ideally, there should be no temporary buffer but the encoder is designed
to deinterleave the coefficients into the classical wavelet structure
with the lower frequency values in the top left corner.
Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com >
(cherry picked from commit 3228ac730c )
2017-11-09 02:10:56 +00:00
Martin Storsjö
587fadaef1
lavu/arm: Check for have_vfp_vm instead of !have_vfpv3 for float_dsp_vfp
...
This was missed in e754c8e8 / e2710e790c since those functions
weren't exercised by checkasm.
Fixes ticket #6766 .
(cherry picked from commit f1fd12ef85 )
2017-10-23 13:31:37 +02:00
Mark Thompson
01e291a592
hwcontext_vaapi: Remove use of vaExportSurfaceHandle()
...
It is not present in libva 2.0.
2017-10-15 12:45:15 +01:00
Michael Niedermayer
03351cce88
Update versions for 3.4 release
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-15 02:30:15 +02:00
Michael Niedermayer
46abeb1c32
avcodec/snowdec: Check mv_scale
...
Fixes: runtime error: signed integer overflow: 2 * -1094995530 cannot be represented in type 'int'
Fixes: 3512/clusterfuzz-testcase-minimized-4812747210489856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 393d6fc739 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-15 01:43:23 +02:00
Michael Niedermayer
35e36046f1
avcodec/pafvideo: Check for bitstream end in decode_0()
...
Fixes: Timeout
Fixes: 3529/clusterfuzz-testcase-5057068371279872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c85329cd0 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-15 01:43:23 +02:00
Sasi Inguva
8500de89ea
ffmpeg.c: Fallback to duration_dts, when duration_pts can't be determined.
...
This is required for FLV files, for which duration_pts comes out to be zero.
Signed-off-by: Sasi Inguva <isasi@google.com >
Reviewed-by: Thomas Mundt <tmundt75@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b006ccf83 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-15 01:43:23 +02:00
Ivan Kalvachev
a11a18b284
Fix visual glitch with XvMC, caused by wrong idct permutation.
...
In the past XvMC forced simple_idct since
it was using FF_IDCT_PERM_NONE.
However now we have SIMD variants of simple_idct that
are using FF_IDCT_PERM_TRANSPOSE and if they are selected
XvMC would get coefficients in the wrong order.
The patch creates new FF_IDCT_NONE that
is used only for this kind of hardware decoding
and that fallbacks to the old C only simple idct.
Signed-off-by: Ivan Kalvachev <ikalvachev@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9054439bad )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-15 01:43:23 +02:00
James Almer
7deb7e6acd
configure: force erroring out in check_disable_warning() if an option doesn't exists
...
Should prevent some options from being added to cflags when they
don't exist and the compiler only warns about it.
Reviewd-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit ad56e8057d )
2017-10-13 20:57:38 -03:00
Ivan Kalvachev
7fb85ad360
Fix crash if av_vdpau_bind_context() is not used.
...
The public functions av_alloc_vdpaucontext() and
av_vdpau_alloc_context() are allocating AVVDPAUContext
structure that is supposed to be placed in avctx->hwaccel_context.
However the rest of libavcodec/vdpau.c uses avctx->hwaccel_context
as struct VDPAUHWContext, that is bigger and does contain
AVVDPAUContext as first member.
The usage includes write to the new variables in the bigger stuct,
without checking for block size.
Fix by always allocating the bigger structure.
Signed-off-by: Ivan Kalvachev <ikalvachev@gmail.com >
(cherry picked from commit 3a6ded7cfc )
2017-10-13 00:14:54 +02:00
Marton Balint
c8642473e0
configure: remove libdl dependency from libndi_newtek
...
We are not using dynamic loading for libndi.
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Marton Balint <cus@passwd.hu >
(cherry picked from commit 58143b15ad )
2017-10-11 22:50:51 +02:00
Michael Niedermayer
b1ec41a64f
add release notes based on release 3.3
...
Name suggestion was from Helmut K. C. Tessarek
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 07e7ebf52d )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-11 03:11:33 +02:00