Michael Niedermayer
44fd563376
avcodec/svq3: Increase offsets to prevent integer overflows
...
Fixes: 1280/clusterfuzz-testcase-minimized-6102353767825408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 382b4fc9b5michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
132796f1d1
avcodec/indeo2: Check remaining bits in ir2_decode_plane()
...
Fixes: 1290/clusterfuzz-testcase-minimized-5815578902134784
Fixes: timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b29feec982michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
2b733acce9
avcodec/vp3: Check remaining bits in unpack_dct_coeffs()
...
Decreases the time spend decoding junk.
May fix: 1283/clusterfuzz-testcase-minimized-6221126759874560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f00300b77michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
f3d300497f
doc/developer: Add terse documentation of assumed C implementation defined behavior
...
Suggested-by: "Ronald S. Bultje" <rsbultje@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b706ddbae3michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
388ef988f8
avcodec/mdec: Fix runtime error: left shift of negative value -127
...
Fixes undefined behavior
Fixes: 1275/clusterfuzz-testcase-minimized-6718162017976320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ca82975b7michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
52d07518a3
avcodec/x86/vc1dsp_init: Fix build failure with --disable-optimizations and clang
...
compilers doing DCE at -O0 do not necessarily understand "complex" boolean expressions
Build succeeds with this change, this was the only failure
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fa8fd0808fmichael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Martin Vignali
b391e4c8f4
libavcodec/exr : fix float to uint16 conversion for negative float value
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e46d637452michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Derek Buitenhuis
82e5f2c76b
avformat/webmdashenc: Validate the 'streams' adaptation sets parameter
...
It should not be a value larger than the number of streams we have,
or it will cause invalid reads and/or SIGSEGV.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec07efa700michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Derek Buitenhuis
a1d740ff09
avformat/webmdashenc: Require the 'adaptation_sets' option to be set
...
This seems to be non-optional, and if the muxer is run without it,
strlen() is run on NULL, causing a segfault.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cbd3a68f3emichael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
a46e0879b9
avformat/oggparseogm: Check ff_alloc_extradata() for failure
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9eff4b0d2bmichael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
5002123109
avformat/oggparseogm: Check available data before reading global header
...
Fixes use of uninitialized data
Found-by: Thomas Guilbert <tguilbert@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 170d864d2cmichael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
da25519aff
avcodec/dvdsubdec: Fixes 2 runtime error: left shift of 170 by 24 places cannot be represented in type 'int'
...
Fixes: 619/clusterfuzz-testcase-5803914534322176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 61ee2ca775michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
0a966b056f
avformat/oggparsedaala: Do not leave an invalid value in gpshift
...
Fixes: undefined behavior
Fixes: 702974
Found-by: Thomas Guilbert <tguilbert@google.com >
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 23ae3cc822michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
dc4fc25200
avformat/oggparsedaala: Check duration for AV_NOPTS_VALUE
...
This avoids an integer overflow
the solution matches oggparsevorbis.c and 45581ed15dtguilbert@google.com >
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 679a315424michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
e80a525934
avfilter/af_sofalizer: Fix bad shift
...
Fixes CID1396835
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4064f3f0dfmichael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
wm4
2f8356df12
avcodec: fix uninitialized variable read
...
This cna happen if the user tries to call the new decode API for
subtitles.
Fixes CID 1402071.
(cherry picked from commit b4b8ca24f6michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
8c54c29343
avfilter/avfiltergraph: Add assert to write down in machine readable form what is assumed about sample rates in swap_samplerates_on_filter()
...
Fixes CID1397292
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f2b360fc0michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
d4aea81f2c
avcodec/tiff: Perform multiply in tiff_unpack_lzma() as 64bit
...
This should make no difference as the value should not be able to be that large
but its more correct this way
Fixes CID1348138
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f48b6b8b91michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Timothy Gu
6522a5dcf0
omx: Fix OOM check
...
Also use av_mallocz_array().
Fixes CID1396839.
(cherry picked from commit 16a75304femichael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Philip Langdale
987675ba0d
avcodec/vdpau_hevc: Fix potential out-of-bounds write
...
The maximum number of references is 16, so the index value cannot
exceed 15.
Fixes Coverity CID 1348139, 1348140, 1348141
(cherry picked from commit 4e6d1c1f4emichael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
840d5bf994
avcodec/h264_ps: Fix runtime error: signed integer overflow: 2147483647 + 26 cannot be represented in type 'int'
...
Fixes: 902/clusterfuzz-testcase-4561155144024064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f727fbc73michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
8fc7fd63f2
avcodec/tiff: Check geotag count for being non zero
...
Fixes memleak
Fixes: 874/clusterfuzz-testcase-5252796175613952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3182e19c1cmichael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
184d957b54
avcodec/vp56: Check avctx->error_concealment before enabling EC
...
Fixes timeout with 847/clusterfuzz-testcase-5291877358108672
Fixes timeout with 850/clusterfuzz-testcase-5721296509861888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 98da63b3f5michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
91f821ed5d
avcodec/tiff: Check stripsize strippos for overflow
...
Fixes: 861/clusterfuzz-testcase-5688284384591872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d996b5649michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
f4b8e7f2c6
avcodec/mpegaudiodec_template: Make l3_unscale() work with e=0
...
Fixes undefined behavior
Fixes: 830/clusterfuzz-testcase-6253175327686656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ebed703f1michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
139a539062
avcodec/tiff: Check for multiple geo key directories
...
Fixes memleak
Fixes: 826/clusterfuzz-testcase-5316921379520512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 108b02e547michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
bafec54a93
avcodec/wavpack: Fix runtime error: shift exponent 32 is too large for 32-bit type 'int'
...
Fixes: 822/clusterfuzz-testcase-4873433189974016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7cebc5a9ccmichael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
025dc25ecb
avcodec/rv34: Fix runtime error: signed integer overflow: 36880 * 66288 cannot be represented in type 'int'
...
Fixes: 768/clusterfuzz-testcase-4807444305805312
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a66c6e28b5michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
92d6b2b934
avcodec/amrwbdec: Fix runtime error: left shift of negative value -1
...
Fixes: 763/clusterfuzz-testcase-6007567320875008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 44e2105189michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
d9e54c335d
avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: -135088512 * 16 cannot be represented in type 'int'
...
Fixes: 736/clusterfuzz-testcase-5580263943831552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e2a4f1a9ebmichael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
f487f9bfdf
avcodec/h264_mvpred: Fix runtime error: left shift of negative value -1
...
Fixes: 734/clusterfuzz-testcase-4821293192970240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 222c9f031dmichael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
90c408fa65
avcodec/mjpegdec: Fix runtime error: left shift of negative value -127
...
Fixes: 733/clusterfuzz-testcase-4682158096515072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 800d02abe0michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
9beb60855b
avcodec/wavpack: Fix runtime error: left shift of negative value -5
...
Fixes: 729/clusterfuzz-testcase-5154831595470848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3016e919d4michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
e92e587cee
avcodec/wavpack: Fix runtime error: left shift of negative value -2
...
Fixes: 723/clusterfuzz-testcase-6471394663596032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ba15005132michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
49697df49c
avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: 134527392 * 16 cannot be represented in type 'int'
...
This checks the sprite delta intermediates for overflow
Fixes: 716/clusterfuzz-testcase-4890287480504320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fab13bbbcdmichael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
ce54743d82
avcodec/mpeg12dec: Fix runtime error: left shift of negative value -13
...
Fixes: 709/clusterfuzz-testcase-4789836449841152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d757ddbaabmichael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
67d84d2c48
avcodec/h264_mvpred: Fix multiple runtime error: left shift of negative value
...
Fixes: 710/clusterfuzz-testcase-5091051431788544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ab998f4c7fmichael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
b69f979331
avcodec/adxdec: Fix runtime error: left shift of negative value -1
...
Fixes: 705/clusterfuzz-testcase-5129572590813184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d23727e042michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
e34feaf93e
avcodec/mpeg4videodec: Improve the overflow checks in mpeg4_decode_sprite_trajectory()
...
Also clear the state on errors
Fixes integer overflows in 701/clusterfuzz-testcase-6594719951880192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eb41956636michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
cd09ad190f
avcodec/mjpegdec: Fix runtime error: left shift of negative value -511
...
Fixes: 693/clusterfuzz-testcase-6109776066904064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4b72d5cd6fmichael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
a72b17ca40
avcodec/h264_direct: Fix runtime error: left shift of negative value -14
...
Fixes: 682/clusterfuzz-testcase-4799120021651456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4bd3f1ce3emichael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
a0366ef7e7
avcodec/pictordec: Check plane value before doing value/mask computations
...
Fixes integer overflow
Fixes: 675/clusterfuzz-testcase-6722971232108544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 63e400a880michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
0456e2f3e0
avcodec/mpeg4videodec: Fix runtime error: left shift of negative value -2650
...
Fixes: 674/clusterfuzz-testcase-6713275880308736
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 25e93aacc2michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
fc5b7e1092
avcodec/eac3dec: Fix runtime error: left shift of negative value -3
...
Fixes: 672/clusterfuzz-testcase-5595018867769344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 87eb374970michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
b8883af656
avcodec/mpeg12dec: Fix runtime error: left shift of negative value -2
...
671/clusterfuzz-testcase-4990381827555328
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aff8cf18cbmichael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
72d01d4c14
avcodec/mpeg4videodec: Check the other 3 sprite points for intermediate overflows
...
This is not necessarily specific to fuzzed files
Fixes: Multiple integer overflows
Fixes: 656/clusterfuzz-testcase-6463814516080640
Fixes: 658/clusterfuzz-testcase-6691260146384896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 76ba09d182michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
0df55b0ffc
avcodec/mpeg4videodec: Check sprite_offset in addition to shifts
...
Fixes: 651/clusterfuzz-testcase-5710668915277824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6871df02d9michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
cae07dd27f
avcodec/mpeg4video: Fix runtime error: left shift of negative value
...
Fixes: 644/clusterfuzz-testcase-4726434209726464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6179dc8aa7michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
f0f4b66dff
avcodec/ituh263dec: Fix runtime error: left shift of negative value -22
...
Fixes: 639/clusterfuzz-testcase-5143866241974272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 631f748491michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
Michael Niedermayer
d837140eb4
avcodec/rv40: Fix runtime error: left shift of negative value
...
Fixes: 630/clusterfuzz-testcase-6608718928019456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 956472a323michael@niedermayer.cc >
2017-05-16 16:00:22 +02:00
