Dale Curtis
32d1657192
Don't manipulate duration when it's AV_NOPTS_VALUE.
...
This leads to signed integer overflow.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit c5fd57f483
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Dale Curtis
e1a854da2d
avcodec/vorbis: 1 << 31 > int32_t::max(), so use 1u << 31 instead.
...
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9648cc6d7f
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Dale Curtis
fc3e4c9ab3
avformat/utils: Prevent undefined shift with wrap_bits > 64.
...
2LL << (wrap_bits=64 - 1) does not fit in int64_t; change the
code to use a uint64_t (2ULL) and add an av_assert2() to
ensure wrap_bits <= 64.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 03fbc0daa7
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
50dd0e43af
avcodec/j2kenc: Fix out of array access in encode_cblk()
...
Fixes: 4427/clusterfuzz-testcase-minimized-5106919271301120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0674087004
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
e8a3b17dd4
avcodec/hevcdsp_template: Fix undefined shift in put_hevc_epel_bi_w_h()
...
Fixes: runtime error: left shift of negative value -127
Fixes: 4397/clusterfuzz-testcase-minimized-4779061080489984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0409d33311
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
5ee4c376d0
avcodec/mlpdsp: Fix signed integer overflow, 2nd try
...
The outputted bits should match what is used in the lossless check
Fixes: runtime error: signed integer overflow: -538697856 * 256 cannot be represented in type 'int'
Fixes: 4326/clusterfuzz-testcase-minimized-5689449645080576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 97c00edaa0
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
857c5fa976
avcodec/kgv1dec: Check that there is enough input for maximum RLE compression
...
Fixes: Timeout
Fixes: 4271/clusterfuzz-testcase-4676667768307712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3aad94bf2b
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
42b9df5a98
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_FIDELITYi*
...
Fixes: runtime error: signed integer overflow: -2143827186 - 7404944 cannot be represented in type 'int'
Fixes: 4354/clusterfuzz-testcase-minimized-4671122764201984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b6964f764
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
b48a36e773
avcodec/mpeg4videodec: Check also for negative versions in the validity check
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0e7865ce41
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Dale Curtis
02d11e616a
Close ogg stream upon error when using AV_EF_EXPLODE.
...
Without this there can be multiple memory leaks for unrecognized
ogg streams.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bce8fc0754
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Dale Curtis
13763f7192
Fix undefined shift on assumed 8-bit input.
...
decode_user_data() attempts to create an integer |build|
value with 8 bits of spacing for 3 components. However
each component is an int32_t, so shifting each component
is undefined for values outside of the 8 bit range.
This patch simply clamps input to 8-bits per component
and prints out a warning that the values were clamped.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7010dd98b5
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Dale Curtis
380515e5b9
Use ff_thread_once for fixed, float table init.
...
These tables are static so they should only be initialized once
instead of on every call to ff_mpadsp_init().
Signed-off-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5eaaffaf64
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Jacob Trimble
a03d488ae2
avformat/mov: Propagate errors in mov_switch_root.
...
Signed-off-by: Jacob Trimble <modmaker@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d9cf3bf16
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
c09c0ce374
avcodec/hevcdsp_template: Fix invalid shift in put_hevc_epel_bi_w_v()
...
Fixes: runtime error: left shift of negative value -255
Fixes: 4037/clusterfuzz-testcase-minimized-5290998163832832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d88586e47
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
81bf24a827
avcodec/mlpdsp: Fix undefined shift ff_mlp_pack_output()
...
Fixes: runtime error: left shift of negative value -7862264
Fixes: 4074/clusterfuzz-testcase-minimized-4516104123711488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f7f70738e
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
d6ff6dc56b
avcodec/zmbv: Check that the buffer is large enough for mvec
...
Fixes: Timeout
Fixes: 4143/clusterfuzz-testcase-4736864637419520
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ab9568a2c
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
37a14a3d83
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD137iL0()
...
Fixes: 4035/clusterfuzz-testcase-minimized-6479308925173760
Fixes: runtime error: signed integer overflow: 9 * 402653183 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73964680d7
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
5fdc679561
avcodec/wmv2dec: Check end of bitstream in parse_mb_skip() and ff_wmv2_decode_mb()
...
Fixes: Timeout
Fixes: 3200/clusterfuzz-testcase-5750022136135680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 65e0a7c473
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
b24b316e30
avcodec/snowdec: Check for remaining bitstream in decode_blocks()
...
Fixes: Timeout
Fixes: 3142/clusterfuzz-testcase-5007853163118592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4527ec2216
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
3e3e42dbc4
avcodec/snowdec: Check intra block dc differences.
...
Fixes: Timeout
Fixes: 3142/clusterfuzz-testcase-5007853163118592
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c3b9bbcc6e
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Fredrik Hubinette
7d14046740
avformat/mov: Check size of STSC allocation
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a6fdd75fe6
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
e69edb7aef
avcodec/vc2enc: Clear coef_buf on allocation
...
Fixes: Use of uninitialized memory
Fixes: assertion failure
Reviewed-by: <atomnuker>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6d00905f81
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
cbc839681b
avcodec/h264dec: Fix potential array overread
...
add padding before scantable arrays
See: 522d850e68
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 380b48fb9f
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
b51f515c5c
avcodec/x86/mpegvideodsp: Fix signedness bug in need_emu
...
Fixes: out of array read
Fixes: 3516/attachment-311488.dat
Found-by: Insu Yun, Georgia Tech.
Tested-by: wuninsu@gmail.com
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 58cf31cee7
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
4654cc8cee
avcodec/aacpsdsp_template: Fix integer overflows in ps_decorrelate_c()
...
Fixes: runtime error: signed integer overflow: 1939661764 - -454942263 cannot be represented in type 'int'
Fixes: 3191/clusterfuzz-testcase-minimized-5688798451073024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2afe05402f
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
1fc3ebbcd9
avcodec/aacdec_fixed: Fix undefined shift
...
Fixes: runtime error: left shift of negative value -801112064
Fixes: 3492/clusterfuzz-testcase-minimized-5784775283441664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fca198fb5b
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
314d78992c
avcodec/mdct_*: Fix integer overflow in addition in RESCALE()
...
Fixes: runtime error: signed integer overflow: 1219998458 - -1469874012 cannot be represented in type 'int'
Fixes: 3443/clusterfuzz-testcase-minimized-5369987105554432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 770c934fa1
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
5f58877bd9
avcodec/snowdec: Fix integer overflow in header parsing
...
Fixes: 3984/clusterfuzz-testcase-minimized-5265759929368576
Fixes: runtime error: signed integer overflow: -1085585801 + -1094995529 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c897a92858
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
d857f1035b
avcodec/cngdec: Fix integer clipping
...
Fixes: runtime error: value -36211.7 is outside the range of representable values of type 'short'
Fixes: 2992/clusterfuzz-testcase-6649611793989632
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 51090133b3
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
4730046891
avcodec/sbrdsp_fixed: Fix integer overflow in shift in sbr_hf_g_filt_c()
...
Fixes: runtime error: shift exponent 66 is too large for 64-bit type 'long long'
Fixes: 3642/clusterfuzz-testcase-minimized-5443853801750528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 981e99ab99
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
4e87ab803a
avcodec/aacsbr_fixed: Fix division by zero in sbr_gain_calc()
...
Fixes: 3642/clusterfuzz-testcase-minimized-5443853801750528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7d1dec4668
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
4d9f669a9f
avutil/softfloat: Add FLOAT_MIN
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e34fe61bf4
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
7a8b61357c
avcodec/h264idct_template: Fix integer overflows in ff_h264_idct8_add()
...
Fixes: runtime error: signed integer overflow: -503316480 + -2013265038 cannot be represented in type 'int'
Fixes: 3805/clusterfuzz-testcase-minimized-6578427831255040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e131b8cedb
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
d7c29005a4
avcodec/xan: Check for bitstream end in xan_huffman_decode()
...
Fixes: Timeout
Fixes: 3707/clusterfuzz-testcase-6465922706440192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4b51437dcc
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
8b8502a66f
avcodec/exr: fix undefined shift in pxr24_uncompress()
...
Fixes: runtime error: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 3787/clusterfuzz-testcase-minimized-5728764920070144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 66f0c958bf
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Luca Barbato
d6ecc61db8
avformat: Free the internal codec context at the end
...
Avoid a use after free in avformat_find_stream_info.
(cherry picked from commit 9e4a5eb51b
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
0bd6717c0f
avcodec/xan: Improve overlapping check
...
Fixes: memcpy-param-overlap
Fixes: 3612/clusterfuzz-testcase-minimized-6393461273001984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e8fafef1db
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
8bd2ba44a1
avcodec/aacdec_fixed: Fix integer overflow in apply_dependent_coupling_fixed()
...
Fixes: runtime error: signed integer overflow: 623487 * 536870912 cannot be represented in type 'int'
Fixes: 3594/clusterfuzz-testcase-minimized-4650622935629824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 41d96af2a7
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
fcfa854abd
avcodec/aacdec_fixed: Fix integer overflow in predict()
...
Fixes: runtime error: signed integer overflow: -2110708110 + -82837504 cannot be represented in type 'int'
Fixes: 3547/clusterfuzz-testcase-minimized-6009386439802880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0976752420
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
7373064247
avcodec/jpeglsdec: Check for end of bitstream in ls_decode_line()
...
Fixes: 1773/clusterfuzz-testcase-minimized-4832523987189760
Fixes: Timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f80224ed19
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Michael Niedermayer
374a2d2250
avcodec/jpeglsdec: Check ilv for being a supported value
...
Fixes: 1773/clusterfuzz-testcase-minimized-4832523987189760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fe533628b9
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2018-01-08 23:19:14 +01:00
Rostislav Pehlivanov
519a54cc19
vc2enc_dwt: pad the temporary buffer by the slice size
...
Since non-Haar wavelets need to look into pixels outside the frame, we
need to pad the buffer. The old factor of two seemed to be a workaround
that fact and only padded to the left and bottom. This correctly pads
by the slice size and as such reduces memory usage and potential
exploits.
Reported by Liu Bingchang.
Ideally, there should be no temporary buffer but the encoder is designed
to deinterleave the coefficients into the classical wavelet structure
with the lower frequency values in the top left corner.
Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com >
(cherry picked from commit 3228ac730c
)
2017-11-09 02:10:46 +00:00
Michael Niedermayer
4b1e87dc32
Update for 3.2.9
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
n3.2.9
2017-10-26 21:48:07 +02:00
Fredrik Hubinette
b76dcd0786
avformat/id3v2: fix leak in chapter parsing
...
Reviewed-on: https://chromium-review.googlesource.com/439405
Reviewed-by: Dale Curtis <dalecurtis@chromium.org >
Signed-off-by: James Almer <jamrial@gmail.com >
2017-10-26 21:47:41 +02:00
Michael Niedermayer
70d0cc8221
avcodec/snowdec: Check mv_scale
...
Fixes: runtime error: signed integer overflow: 2 * -1094995530 cannot be represented in type 'int'
Fixes: 3512/clusterfuzz-testcase-minimized-4812747210489856
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 393d6fc739
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-15 00:45:24 +02:00
Michael Niedermayer
1959c0f9f9
avcodec/pafvideo: Check for bitstream end in decode_0()
...
Fixes: Timeout
Fixes: 3529/clusterfuzz-testcase-5057068371279872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c85329cd0
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-15 00:45:10 +02:00
Michael Niedermayer
f052d1df3e
avcodec/ffv1dec: Fix out of array read in slice counting
...
Fixes: test-201710.mp4
Found-by: 连一汉 <lianyihan@360.cn > and Zhibin Hu
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c20f4fcb74
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-13 13:02:23 +02:00
Michael Niedermayer
11f5a13196
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_53iL0()
...
Fixes: runtime error: signed integer overflow: 2147483646 + 2 cannot be represented in type 'int'
Fixes: 3485/clusterfuzz-testcase-minimized-4940429332054016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bdee75a4e7
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-13 13:01:58 +02:00
Michael Niedermayer
b2c9771dd4
avcodec/mpeg_er: Clear mcsel in mpeg_er_decode_mb()
...
Fixes out of array read
Should fix: 3516/clusterfuzz-testcase-minimized-4608518562775040 (not reprodoceable)
Found-by: Insu Yun, Georgia Tech.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 127a362630
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-13 12:59:47 +02:00
Michael Niedermayer
16b07d59de
avcodec/mpeg4videodec: Use 64 bit intermediates for sprite delta
...
Fixes: runtime error: signed integer overflow: -104713 * 65536 cannot be represented in type 'int'
Fixes: 3453/clusterfuzz-testcase-minimized-5555554657239040
Fixes: 3528/clusterfuzz-testcase-minimized-6283628420005888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e38f280fec
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2017-10-13 12:58:58 +02:00