highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
98,782 Commits 36 Branches 392 Tags
134b4d85a1a18e5de7bcec5483fe8d616e8efa7a
Commit Graph

98782 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer
134b4d85a1 avcodec/apedec: Fix undefined integer overflow in long_filter_ehigh_3830() 
Fixes: signed integer overflow: -2145648640 - 3357696 cannot be represented in type 'int'
Fixes: 38899/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5358815017566208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ad517ee6e4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-20 23:11:11 +02:00
Michael Niedermayer
9d4a293b42 oavformat/avidec: Check offset in odml 
Fixes: signed integer overflow: 9223372036854775807 + 8 cannot be represented in type 'long'
Fixes: 38787/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-4859845799444480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 255a7b423e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-20 23:11:11 +02:00
Michael Niedermayer
bfc04caa2f avformat/mpegts: use actually read packet size in mpegts_resync special case 
Fixes: infinite loop
Fixes: 37986/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5292311517462528 -

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 83b2e4c8f1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-20 23:11:11 +02:00
Timo Rothenpieler
d9cb7c62b6 avfilter/scale_npp: fix non-aligned output frame dimensions 2021-10-07 18:23:18 +02:00
Michael Niedermayer
8f6b124bac Update for 4.3.3 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 15:46:14 +02:00
Michael Niedermayer
676dad0aeb swscale/alphablend: Fix slice handling 
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 06d6726588)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:42 +02:00
Michael Niedermayer
e0791ea1b1 avcodec/apedec: Fix integer overflow in filter_fast_3320() 
Fixes: signed integer overflow: 2145649668 + 3956526 cannot be represented in type 'int'
Fixes: 38351/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-4647077926273024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0e45886e6e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:42 +02:00
Michael Niedermayer
d2b1cad8b3 avcodec/mxpegdec: Check for AVDISCARD_ALL 
Fixes: Fixes NULL pointer dereference
Fixes: 36610/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-6052641783283712
Fixes: 37907/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-4725170850365440
Fixes: 37904/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-6367889262247936
Fixes: 38085/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-5175270823297024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 20afd3a63a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:42 +02:00
Michael Niedermayer
568cccce00 avcodec/flicvideo: Check remaining bytes in FLI*COPY 
Fixes: Timeout
Fixes: 37795/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-4846536543043584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f835efbca)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:42 +02:00
Michael Niedermayer
10f73661a2 avcodec/cbs_h265_syntax_template: Limit sps_num_palette_predictor_initializer_minus1 to 127 
Fixes: index 128 out of bounds for type 'uint16_t [128]'
Fixes: 38651/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-6296416058736640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 85413a5ae6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:42 +02:00
Michael Niedermayer
d9bfc347b3 avcodec/snowdec: Maintain avmv buffer 
This avoids reallocating per frame

Fixes: Assertion failure
Fixes: 36359/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-6733238591684608
Fixes: 38623/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-6098656512573440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0faf04e807)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:42 +02:00
Michael Niedermayer
b66384b77f avcodec/mpeg12dec: Do not put mpeg_f_code into an invalid state on error return 
Fixes: invalid shift
Fixes: 37018/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG2VIDEO_fuzzer-5290280902328320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5a95abcce4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:42 +02:00
Michael Niedermayer
6238b5bab5 avcodec/mpegvideo_enc: Limit bitrate tolerance to the representable 
Fixes: error: 1.66789e+11 is outside the range of representable values of type 'int'
Fixes: Ticket8201

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 245017ec8a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:42 +02:00
Michael Niedermayer
b87d26675d avcodec/apedec: Fix integer overflow in intermediate 
Fixes: signed integer overflow: 559334865 * 4 cannot be represented in type 'int'
Fixes: 37929/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6751932295806976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 90da43557f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:42 +02:00
Michael Niedermayer
e2bba86f27 avformat/mvdec: Do not set invalid sample rate 
Fixes: signed integer overflow: -682581959642593728 * 16 cannot be represented in type 'long'
Fixes: 37883/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5311691517198336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 737e6bf216)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:42 +02:00
Michael Niedermayer
1b4ab72ad6 avformat/sbgdec: Check for t0 overflow in expand_tseq() 
Fixes: signed integer overflow: 4611686025627387904 + 4611686025627387904 cannot be represented in type 'long'
Fixes: 35489/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-4862678601433088

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f624c92d4c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:42 +02:00
Michael Niedermayer
70291713b0 avformat/rmdec: Use 64bit for intermediate for DEINT_ID_INT4 
Fixes: runtime error: signed integer overflow: 65312 * 65535 cannot be represented in type 'int'
Fixes: 32832/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-4817710040088576

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e2c2872393)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:42 +02:00
Michael Niedermayer
953f316b1b avformat/sbgdec: Check opt_duration and start for overflow 
Fixes: signed integer overflow: 2788626175500000000 + 7118941284000000000 cannot be represented in type 'long'
Fixes: 35215/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6123272247836672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2768928624)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:42 +02:00
Michael Niedermayer
bd947157eb avformat/mov: Check for duplicate clli 
Fixes: memleak
Fixes: 35261/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4869656287510528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9a222f140e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:42 +02:00
Michael Niedermayer
b9c0ba3939 avformat/jacosubdec: Check for min in t overflow in get_shift() 
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 34651/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-5157941012463616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 989febfbd0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:42 +02:00
Michael Niedermayer
84cb6b75d6 avformat/mxfdec: check channel number in mxf_get_d10_aes3_packet() 
Fixes: Out of array access
Fixes: 37030/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5387719147651072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3dd5a8a135)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:42 +02:00
James Almer
76470ae27f avcodec/utils: don't return negative values in av_get_audio_frame_duration() 
In some extrme cases, like with adpcm_ms samples with an extremely high channel
count, get_audio_frame_duration() may return a negative frame duration value.
Don't propagate it, and instead return 0, signaling that a duration could not
be determined.

Fixes ticket #9312

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit e01d306c64)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:42 +02:00
Michael Niedermayer
8be49a6c64 avcodec/jpeg2000dec: Check that atom header is within bytsetream 
Fixes: Infinite loop
Fixes: 36666/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5912760671141888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3c659f8618)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
bdc6377bd1 avcodec/apedec: Fix 2 integer overflows in filter_3800() 
Fixes: signed integer overflow: 1683879955 - -466265224 cannot be represented in type 'int'
Fixes: 37419/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6074294407921664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 33feb527ff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
cce6d86418 avcodec/xpmdec: Move allocations down after more error checks 
Fixes: Timeout
Fixes: 37035/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XPM_fuzzer-5142718576721920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e58692837c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
684a8847e3 avformat/mov: Check dts for overflow in mov_read_trun() 
Fixes: signed integer overflow: 9223372034248226491 + 3275247799 cannot be represented in type 'long'
Fixes: clusterfuzz-testcase-minimized-audio_decoder_fuzzer-4538729166077952

Reported-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4de4bc06fd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
d24e2c121b avformat/avidec: Use 64bit for frame number in odml index parsing 
Fixes: signed integer overflow: 1179337772 + 1392508928 cannot be represented in type 'int'
Fixes: 34088/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5846945303232512

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a4c98c507e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
7db92df664 avcodec/mjpegbdec: Skip SOS on AVDISCARD_ALL as does mjpeg 
Fixes: NULL pointer dereference
Fixes: 36342/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEGB_fuzzer-4579188072906752
Fixes: 36344/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEGB_fuzzer-5049579300061184
Fixes: 36345/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEGB_fuzzer-5301149845553152
Fixes: 36374/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEGB_fuzzer-6056312352931840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 104a8399ae)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
7c388310c8 avcodec/mjpegdec: Check for bits left in mjpeg_decode_scan_progressive_ac() 
Fixes: Timeout
Fixes: 36262/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-4969052454912000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 909faca929)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
maryam ebrahimzadeh
9f38effa59 avformat/adtsenc: return value check for init_get_bits in adts_decode_extradata 
As the second argument for init_get_bits (buf) can be crafted, a return value check for this function call is necessary.
'buf' is  part of  'AVPacket pkt'.
replace init_get_bits with init_get_bits8.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9ffa49496d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
425005f255 avcodec/webp: Check available space in loop in decode_entropy_coded_image() 
Fixes: Timeout
Fixes: 35401/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WEBP_fuzzer-5714401821851648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5e00eab611)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
7edfec235c avcodec/h264dec: use picture parameters in ff_print_debug_info2() 
Fixes: out of array read
Fixes: 36341/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-6737583085322240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 65892516d5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
f0c046464a avcodec/vc1dec: ff_print_debug_info() does not support WMV3 field_mode 
Fixes: out of array read
Fixes: 36331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-5140494328922112.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c59b5e3d1e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
c6e7b345f5 avcodec/frame_thread_encoder: Free AVCodecContext structure on error during init 
Fixes: MemLeak
Fixes: 8281
Fixes: PoC_option158.jpg
Fixes: CVE-2020-22037

Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7bba0dd638)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
b10507d155 avcodec/faxcompr: Check for end of input in cmode == 1 in decode_group3_2d_line() 
Fixes: Infinite loop
Fixes: 35591/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4503764022198272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f803635c4f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
79495f4f40 avcodec/vc1dec: Disable error concealment for *IMAGE 
The existing error concealment makes no sense for the image formats, they
use transformed source images which is different from keyframe + MC+difference
for which the error concealment is designed.
Of course feel free to re-enable this if you have a case where it works and
improves vissual results

Fixes: Timeout
Fixes: 36234/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-6300306743885824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 643b2d49bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
4cbc32889b avcodec/sbrdsp_fixed: Fix negation overflow in sbr_neg_odd_64_c() 
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 35593/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5182217725804544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8f2856a1da)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
6cf3643195 avformat/wtvdec: Check for EOF before seeking back in parse_media_type() 
Fixes: Infinite loop
Fixes: 36311/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-4889181296918528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 89505d38de)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
ac76b104c5 avformat/mpc8: Check first keyframe position for overflow 
Fixes: signed integer overflow: 9223372036854775791 + 18 cannot be represented in type 'long'
Fixes: 36307/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-4917863877050368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2bbef69b0b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
b539d641b0 avformat/wavdec: Use 64bit in new_pos computation 
Fixes: signed integer overflow: 129 * 16711680 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-6742285317439488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9b57d2f0a9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
b0e211ae39 avformat/sbgdec: Check for overflow in timestamp preparation 
Fixes: signed integer overflow: 9223372036854775807 + 86400000000 cannot be represented in type 'long'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6731040263634944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9dbed90840)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
5b679de458 avformat/dsicin: Check packet size for overflow 
Fixes: signed integer overflow: 24672 + 2147483424 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_DSICIN_fuzzer-6731325979623424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9d1c47ec03)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
9e2cc2b6ec avformat/dsfdec: Change order of operations in bitrate computation 
Fixes: signed integer overflow: 538976288 * 67372036 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_DSF_fuzzer-6751696819716096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5e38eff284)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
7db392e6f8 avformat/bfi: check nframes 
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_BFI_fuzzer-6737028768202752

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b4e77dfca1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
9793ebdfb4 avformat/avidec: fix position overflow in avi_load_index() 
Fixes: signed integer overflow: 9223372033098784808 + 4294967072 cannot be represented in type 'long'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6732488912273408

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 527821a2dd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
da825c61f4 avformat/asfdec_f: Check sizeX against padding 
Fixes: signed integer overflow: 2147483607 + 64 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-6753897878257664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f034c2e36a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
d84c0fa6f9 avformat/aiffdec: Check for size overflow in header parsing 
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6723467048255488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bae2e19777)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
58700716b1 avcodec/aaccoder: Add minimal bias in search_for_ms() 
Fixes: floating point division by 0
Fixes: Ticket8218

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 75a099fc73)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
8c2ba20612 avformat/mov: Avoid undefined overflow in time_offset calculation 
Fixes: signed integer overflow: 8511838621821575200 - -3954125146725285889 cannot be represented in type 'long'
Fixes: 33414/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6610119325515776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7666d588ba)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00
Michael Niedermayer
3a5dc113ef avfilter/af_drmeter: Check that there is data 
Fixes: floating point division by 0
Fixes: -nan is outside the range of representable values of type 'int'
Fixes: Ticket8307

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4f49fa6abe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-06 14:41:41 +02:00