Commit Graph

82770 Commits

Author SHA1 Message Date
Dale Curtis
32d1657192 Don't manipulate duration when it's AV_NOPTS_VALUE.
This leads to signed integer overflow.

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit c5fd57f483)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Dale Curtis
e1a854da2d avcodec/vorbis: 1 << 31 > int32_t::max(), so use 1u << 31 instead.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9648cc6d7f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Dale Curtis
fc3e4c9ab3 avformat/utils: Prevent undefined shift with wrap_bits > 64.
2LL << (wrap_bits=64 - 1) does not fit in int64_t; change the
code to use a uint64_t (2ULL) and add an av_assert2() to
ensure wrap_bits <= 64.

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 03fbc0daa7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
50dd0e43af avcodec/j2kenc: Fix out of array access in encode_cblk()
Fixes: 4427/clusterfuzz-testcase-minimized-5106919271301120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0674087004)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
e8a3b17dd4 avcodec/hevcdsp_template: Fix undefined shift in put_hevc_epel_bi_w_h()
Fixes: runtime error: left shift of negative value -127
Fixes: 4397/clusterfuzz-testcase-minimized-4779061080489984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0409d33311)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
5ee4c376d0 avcodec/mlpdsp: Fix signed integer overflow, 2nd try
The outputted bits should match what is used in the lossless check

Fixes: runtime error: signed integer overflow: -538697856 * 256 cannot be represented in type 'int'
Fixes: 4326/clusterfuzz-testcase-minimized-5689449645080576

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 97c00edaa0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
857c5fa976 avcodec/kgv1dec: Check that there is enough input for maximum RLE compression
Fixes: Timeout
Fixes: 4271/clusterfuzz-testcase-4676667768307712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3aad94bf2b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
42b9df5a98 avcodec/dirac_dwt: Fix integer overflow in COMPOSE_FIDELITYi*
Fixes: runtime error: signed integer overflow: -2143827186 - 7404944 cannot be represented in type 'int'
Fixes: 4354/clusterfuzz-testcase-minimized-4671122764201984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2b6964f764)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
b48a36e773 avcodec/mpeg4videodec: Check also for negative versions in the validity check
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0e7865ce41)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Dale Curtis
02d11e616a Close ogg stream upon error when using AV_EF_EXPLODE.
Without this there can be multiple memory leaks for unrecognized
ogg streams.

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bce8fc0754)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Dale Curtis
13763f7192 Fix undefined shift on assumed 8-bit input.
decode_user_data() attempts to create an integer |build|
value with 8 bits of spacing for 3 components. However
each component is an int32_t, so shifting each component
is undefined for values outside of the 8 bit range.

This patch simply clamps input to 8-bits per component
and prints out a warning that the values were clamped.

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7010dd98b5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Dale Curtis
380515e5b9 Use ff_thread_once for fixed, float table init.
These tables are static so they should only be initialized once
instead of on every call to ff_mpadsp_init().

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5eaaffaf64)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Jacob Trimble
a03d488ae2 avformat/mov: Propagate errors in mov_switch_root.
Signed-off-by: Jacob Trimble <modmaker@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2d9cf3bf16)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
c09c0ce374 avcodec/hevcdsp_template: Fix invalid shift in put_hevc_epel_bi_w_v()
Fixes: runtime error: left shift of negative value -255
Fixes: 4037/clusterfuzz-testcase-minimized-5290998163832832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7d88586e47)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
81bf24a827 avcodec/mlpdsp: Fix undefined shift ff_mlp_pack_output()
Fixes: runtime error: left shift of negative value -7862264
Fixes: 4074/clusterfuzz-testcase-minimized-4516104123711488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4f7f70738e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
d6ff6dc56b avcodec/zmbv: Check that the buffer is large enough for mvec
Fixes: Timeout
Fixes: 4143/clusterfuzz-testcase-4736864637419520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2ab9568a2c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
37a14a3d83 avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD137iL0()
Fixes: 4035/clusterfuzz-testcase-minimized-6479308925173760
Fixes: runtime error: signed integer overflow: 9 * 402653183 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 73964680d7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
5fdc679561 avcodec/wmv2dec: Check end of bitstream in parse_mb_skip() and ff_wmv2_decode_mb()
Fixes: Timeout
Fixes: 3200/clusterfuzz-testcase-5750022136135680

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 65e0a7c473)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
b24b316e30 avcodec/snowdec: Check for remaining bitstream in decode_blocks()
Fixes: Timeout
Fixes: 3142/clusterfuzz-testcase-5007853163118592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4527ec2216)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
3e3e42dbc4 avcodec/snowdec: Check intra block dc differences.
Fixes: Timeout
Fixes: 3142/clusterfuzz-testcase-5007853163118592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c3b9bbcc6e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Fredrik Hubinette
7d14046740 avformat/mov: Check size of STSC allocation
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a6fdd75fe6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
e69edb7aef avcodec/vc2enc: Clear coef_buf on allocation
Fixes: Use of uninitialized memory
Fixes: assertion failure

Reviewed-by: <atomnuker>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6d00905f81)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
cbc839681b avcodec/h264dec: Fix potential array overread
add padding before scantable arrays

See: 522d850e68

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 380b48fb9f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
b51f515c5c avcodec/x86/mpegvideodsp: Fix signedness bug in need_emu
Fixes: out of array read
Fixes: 3516/attachment-311488.dat

Found-by: Insu Yun, Georgia Tech.
Tested-by: wuninsu@gmail.com
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 58cf31cee7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
4654cc8cee avcodec/aacpsdsp_template: Fix integer overflows in ps_decorrelate_c()
Fixes: runtime error: signed integer overflow: 1939661764 - -454942263 cannot be represented in type 'int'
Fixes: 3191/clusterfuzz-testcase-minimized-5688798451073024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2afe05402f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
1fc3ebbcd9 avcodec/aacdec_fixed: Fix undefined shift
Fixes: runtime error: left shift of negative value -801112064
Fixes: 3492/clusterfuzz-testcase-minimized-5784775283441664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fca198fb5b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
314d78992c avcodec/mdct_*: Fix integer overflow in addition in RESCALE()
Fixes: runtime error: signed integer overflow: 1219998458 - -1469874012 cannot be represented in type 'int'
Fixes: 3443/clusterfuzz-testcase-minimized-5369987105554432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 770c934fa1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
5f58877bd9 avcodec/snowdec: Fix integer overflow in header parsing
Fixes: 3984/clusterfuzz-testcase-minimized-5265759929368576
Fixes: runtime error: signed integer overflow: -1085585801 + -1094995529 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c897a92858)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
d857f1035b avcodec/cngdec: Fix integer clipping
Fixes: runtime error: value -36211.7 is outside the range of representable values of type 'short'
Fixes: 2992/clusterfuzz-testcase-6649611793989632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 51090133b3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
4730046891 avcodec/sbrdsp_fixed: Fix integer overflow in shift in sbr_hf_g_filt_c()
Fixes: runtime error: shift exponent 66 is too large for 64-bit type 'long long'
Fixes: 3642/clusterfuzz-testcase-minimized-5443853801750528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 981e99ab99)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
4e87ab803a avcodec/aacsbr_fixed: Fix division by zero in sbr_gain_calc()
Fixes: 3642/clusterfuzz-testcase-minimized-5443853801750528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7d1dec4668)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
4d9f669a9f avutil/softfloat: Add FLOAT_MIN
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e34fe61bf4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
7a8b61357c avcodec/h264idct_template: Fix integer overflows in ff_h264_idct8_add()
Fixes: runtime error: signed integer overflow: -503316480 + -2013265038 cannot be represented in type 'int'
Fixes: 3805/clusterfuzz-testcase-minimized-6578427831255040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e131b8cedb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
d7c29005a4 avcodec/xan: Check for bitstream end in xan_huffman_decode()
Fixes: Timeout
Fixes: 3707/clusterfuzz-testcase-6465922706440192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4b51437dcc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
8b8502a66f avcodec/exr: fix undefined shift in pxr24_uncompress()
Fixes: runtime error: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 3787/clusterfuzz-testcase-minimized-5728764920070144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 66f0c958bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Luca Barbato
d6ecc61db8 avformat: Free the internal codec context at the end
Avoid a use after free in avformat_find_stream_info.

(cherry picked from commit 9e4a5eb51b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
0bd6717c0f avcodec/xan: Improve overlapping check
Fixes: memcpy-param-overlap
Fixes: 3612/clusterfuzz-testcase-minimized-6393461273001984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e8fafef1db)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
8bd2ba44a1 avcodec/aacdec_fixed: Fix integer overflow in apply_dependent_coupling_fixed()
Fixes: runtime error: signed integer overflow: 623487 * 536870912 cannot be represented in type 'int'
Fixes: 3594/clusterfuzz-testcase-minimized-4650622935629824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 41d96af2a7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
fcfa854abd avcodec/aacdec_fixed: Fix integer overflow in predict()
Fixes: runtime error: signed integer overflow: -2110708110 + -82837504 cannot be represented in type 'int'
Fixes: 3547/clusterfuzz-testcase-minimized-6009386439802880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0976752420)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
7373064247 avcodec/jpeglsdec: Check for end of bitstream in ls_decode_line()
Fixes: 1773/clusterfuzz-testcase-minimized-4832523987189760

Fixes: Timeout

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f80224ed19)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Michael Niedermayer
374a2d2250 avcodec/jpeglsdec: Check ilv for being a supported value
Fixes: 1773/clusterfuzz-testcase-minimized-4832523987189760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fe533628b9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-08 23:19:14 +01:00
Rostislav Pehlivanov
519a54cc19 vc2enc_dwt: pad the temporary buffer by the slice size
Since non-Haar wavelets need to look into pixels outside the frame, we
need to pad the buffer. The old factor of two seemed to be a workaround
that fact and only padded to the left and bottom. This correctly pads
by the slice size and as such reduces memory usage and potential
exploits.
Reported by Liu Bingchang.

Ideally, there should be no temporary buffer but the encoder is designed
to deinterleave the coefficients into the classical wavelet structure
with the lower frequency values in the top left corner.

Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com>
(cherry picked from commit 3228ac730c)
2017-11-09 02:10:46 +00:00
Michael Niedermayer
4b1e87dc32 Update for 3.2.9
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
n3.2.9
2017-10-26 21:48:07 +02:00
Fredrik Hubinette
b76dcd0786 avformat/id3v2: fix leak in chapter parsing
Reviewed-on: https://chromium-review.googlesource.com/439405
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: James Almer <jamrial@gmail.com>
2017-10-26 21:47:41 +02:00
Michael Niedermayer
70d0cc8221 avcodec/snowdec: Check mv_scale
Fixes: runtime error: signed integer overflow: 2 * -1094995530 cannot be represented in type 'int'
Fixes: 3512/clusterfuzz-testcase-minimized-4812747210489856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 393d6fc739)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-10-15 00:45:24 +02:00
Michael Niedermayer
1959c0f9f9 avcodec/pafvideo: Check for bitstream end in decode_0()
Fixes: Timeout
Fixes: 3529/clusterfuzz-testcase-5057068371279872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9c85329cd0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-10-15 00:45:10 +02:00
Michael Niedermayer
f052d1df3e avcodec/ffv1dec: Fix out of array read in slice counting
Fixes: test-201710.mp4

Found-by: 连一汉 <lianyihan@360.cn> and Zhibin Hu
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c20f4fcb74)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-10-13 13:02:23 +02:00
Michael Niedermayer
11f5a13196 avcodec/dirac_dwt: Fix integer overflow in COMPOSE_53iL0()
Fixes: runtime error: signed integer overflow: 2147483646 + 2 cannot be represented in type 'int'
Fixes: 3485/clusterfuzz-testcase-minimized-4940429332054016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bdee75a4e7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-10-13 13:01:58 +02:00
Michael Niedermayer
b2c9771dd4 avcodec/mpeg_er: Clear mcsel in mpeg_er_decode_mb()
Fixes out of array read
Should fix: 3516/clusterfuzz-testcase-minimized-4608518562775040 (not reprodoceable)

Found-by: Insu Yun, Georgia Tech.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 127a362630)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-10-13 12:59:47 +02:00
Michael Niedermayer
16b07d59de avcodec/mpeg4videodec: Use 64 bit intermediates for sprite delta
Fixes: runtime error: signed integer overflow: -104713 * 65536 cannot be represented in type 'int'
Fixes: 3453/clusterfuzz-testcase-minimized-5555554657239040
Fixes: 3528/clusterfuzz-testcase-minimized-6283628420005888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e38f280fec)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-10-13 12:58:58 +02:00