82412 Commits

Author SHA1 Message Date
Michael Niedermayer
37d51c242f avcodec/g723_1: Fix multiple runtime error: left shift of negative value
Fixes: 1367/clusterfuzz-testcase-minimized-571496882346393

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4ace2d22192f3995911ec926940125dcb29d606a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
054a16d375 avcodec/mimic: Fix runtime error: left shift of negative value -1
Fixes: 1365/clusterfuzz-testcase-minimized-5624158450876416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fc2c420b82939a8f30838a6aa08bfd936099d3ce)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
aa39ca14d6 avcodec/fic: Fix multiple left shift of negative value -15
Fixes: 1356/clusterfuzz-testcase-minimized-6008489086287872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b20c71409b24460983ba5d9afa0716714f9e0f7d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
4ee1e00f08 avcodec/mlpdec: Fix runtime error: left shift of negative value -22
Fixes: 1355/clusterfuzz-testcase-minimized-6662205472768000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c535436cbeeab89be64e9f3fd652bc736f2f3245)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
2d3da218ce avcodec/snowdec: Check qbias
Fixes: signed integer overflow: -1094995529 * 131 cannot be represented in type 'int'
Fixes: 1353/clusterfuzz-testcase-minimized-5208180449607680

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 523205ce1ed9415183c162998c68f573479e78fe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
cff78c4cc4 avutil/softfloat: Fix multiple runtime error: left shift of negative value -8
Fixes: 1352/clusterfuzz-testcase-minimized-5757565017260032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 35f3df0d76e28969fa77f2b865e2e40b3ba69722)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
2a6cad221b avcodec/aacsbr_template: Do not leave bs_num_env invalid
Fixes out of array read
Fixes: 1349/clusterfuzz-testcase-minimized-5370707196248064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a8ad83b793e883b8c6d114f81073a4e40c0308a3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
1f91d66a62 avcodec/mdec: Fix signed integer overflow: 28835400 * 83 cannot be represented in type 'int'
Fixes: 1346/clusterfuzz-testcase-minimized-5776732600664064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a234b5ade3ca6cde805b92b8b6ecacf693460a8c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
536af42121 avcodec/dfa: Fix off by 1 error
Fixes out of array access
Fixes: 1345/clusterfuzz-testcase-minimized-6062963045695488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f52fbf4f3ed02a7d872d8a102006f29b4421f360)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
9c7184ae63 avcodec/nellymoser: Fix multiple left shift of negative value -8591
Fixes: 1342/clusterfuzz-testcase-minimized-5490842129137664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0953736b7e97f6e121a0587a95434bf1857a27da)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
0f6f163922 avcodec/cdxl: Fix signed integer overflow: 14243456 * 164 cannot be represented in type 'int'
Fixes: 1341/clusterfuzz-testcase-minimized-5441502618583040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1002932a3b16d35c46a08455f76462909eebb5aa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
db8f28fd3f avcodec/g722: Fix multiple runtime error: left shift of negative value -1
Fixes: 1340/clusterfuzz-testcase-minimized-4669892148068352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f55df62998681c7702f008ce7c12a00b15e33f53)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
77aa9eddbc avcodec/dss_sp: Fix multiple left shift of negative value -466
Fixes: 1339/clusterfuzz-testcase-minimized-4614671485108224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 38152d9368beb080b4acd6cd9e5ccc89b3f733bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
5fb14cc889 avcodec/wnv1: Fix runtime error: left shift of negative value -1
Fixes: 1338/clusterfuzz-testcase-minimized-6485546354343936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9fac508ca46f93450ec232299dfd15ac70b6f326)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
a78cfe84f9 avcodec/tiertexseqv: set the fixed dimenasions, do not depend on the demuxer doing so
Fixes: out of array access
Fixes: 1348/clusterfuzz-testcase-minimized-6195673642827776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce551a3925a1cf9c7824e26a246b99b6773bda4b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
b0d6bff2f2 avcodec/mjpegdec: Fix runtime error: signed integer overflow: -24543 * 2031616 cannot be represented in type 'int'
Fixes: 943/clusterfuzz-testcase-5114865297391616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a78ae465fda902565ed041d93403e04490b4be0d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
231e242ed2 avcodec/cavsdec: Fix undefined behavior from integer overflow
Fixes: 1335/clusterfuzz-testcase-minimized-5566961566089216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a0e5f7f363555d2befafb1c9e1579dbe0a2fbca7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
58b05f8720 avcodec/dvdsubdec: Fix runtime error: left shift of 242 by 24 places cannot be represented in type 'int'
Fixes: 1080/clusterfuzz-testcase-5353236754071552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce7098b8f2b59c62b5abdb3d74819db75cf67698)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
5aa97eb1a6 libavcodec/mpeg4videodec: Convert sprite_offset to 64bit
This avoids intermediates from overflowing (the final values are checked)
Fixes: runtime error: signed integer overflow: -167712 + -2147352576 cannot be represented in type 'int'

Fixes: 1298/clusterfuzz-testcase-minimized-5955580877340672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c1c3a14073b33f790075f2884ea5c64451a6c876)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
6bdc6bef2a avcodec/pngdec: Use ff_set_dimensions()
Fixes OOM
Fixes: 1314/clusterfuzz-testcase-minimized-4621997222920192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a0296fc056f0d86943c697c505a181744b07dd45)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
03dee014f4 avcodec/msvideo1: Check buffer size before re-getting the frame
Fixes timeout
Fixes: 1306/clusterfuzz-testcase-minimized-6152296217968640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cabfed6895fcc679cd6a6244a12d800e0f3f2d20)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
56f8ab1802 avcodec/h264_cavlc: Fix undefined behavior on qscale overflow
Fixes: 1214/clusterfuzz-testcase-minimized-6130606599569408

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fc8cff96ed45dfdb91ed03e9942845f28be0e770)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
4674c4594f avcodec/dcadsp: Fix runtime error: signed integer overflow
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9244b839b788e4677019041907ff5a4378a23490)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
f66140a1bd avcodec/svq3: Reject dx/dy beyond 16bit
The code does use 16bit sized arrays later so larger deltas would not work

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 48b3117844177d8442bc9fa3ede1d31ce82ae6fc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
fa595a94a1 avcodec/svq3: Increase offsets to prevent integer overflows
Fixes: 1280/clusterfuzz-testcase-minimized-6102353767825408

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 382b4fc9b5f3102f59743bf9c8619b31dd8ede1b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
8fee7589d5 avcodec/indeo2: Check remaining bits in ir2_decode_plane()
Fixes: 1290/clusterfuzz-testcase-minimized-5815578902134784
Fixes: timeout

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b29feec9829cfab2523c8d95e35bd69e689ea4af)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
bd2e3b0e90 avcodec/vp3: Check remaining bits in unpack_dct_coeffs()
Decreases the time spend decoding junk.

May fix: 1283/clusterfuzz-testcase-minimized-6221126759874560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2f00300b779e7b247c85db0d7daef448225105ff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
9f2b473fa7 doc/developer: Add terse documentation of assumed C implementation defined behavior
Suggested-by: "Ronald S. Bultje" <rsbultje@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b706ddbae3f4a11c58560b914807931556108b55)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
50cd472ce6 avcodec/mdec: Fix runtime error: left shift of negative value -127
Fixes undefined behavior
Fixes: 1275/clusterfuzz-testcase-minimized-6718162017976320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6ca82975b7a8eaf676a52738ec8e7e36732327cc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
8fb0b9ae35 avcodec/x86/vc1dsp_init: Fix build failure with --disable-optimizations and clang
compilers doing DCE at -O0 do not necessarily understand "complex" boolean expressions
Build succeeds with this change, this was the only failure

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fa8fd0808f1086fc85abba5cf123faf41da49305)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Martin Vignali
0ed8bab02f libavcodec/exr : fix float to uint16 conversion for negative float value
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e46d63745215c04637e7797228bad36bce49d881)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Derek Buitenhuis
e66548345c avformat/webmdashenc: Validate the 'streams' adaptation sets parameter
It should not be a value larger than the number of streams we have,
or it will cause invalid reads and/or SIGSEGV.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ec07efa70012845e8642df67a4a773f510a17088)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Derek Buitenhuis
1485562f6e avformat/webmdashenc: Require the 'adaptation_sets' option to be set
This seems to be non-optional, and if the muxer is run without it,
strlen() is run on NULL, causing a segfault.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cbd3a68f3e1c2d1679370301eb5e1a32a2df64fe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
bb61a31223 avformat/oggparseogm: Check ff_alloc_extradata() for failure
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9eff4b0d2b5013e1ede86cf1a152dce164217d52)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
773c55b820 avformat/oggparseogm: Check available data before reading global header
Fixes use of uninitialized data

Found-by: Thomas Guilbert <tguilbert@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 170d864d2c508ca8111b1d108e1e964007dab712)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
502313dd50 avformat/mov: Check creation_time for overflow
Fixes integer overflow
Fixes: 701640

Found-by: Found-by: Thomas Guilbert <tguilbert@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 39ee3ddff87a12e108fc4e0d36f756d0ca080472)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
0a6598536c avcodec/dvdsubdec: Fixes 2 runtime error: left shift of 170 by 24 places cannot be represented in type 'int'
Fixes: 619/clusterfuzz-testcase-5803914534322176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 61ee2ca7758672128e30b3e87908b6845e006d71)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
7655f73c45 avcodec/h264: Check weight values to be within the specs limits.
Fixes: integer overflows
Fixes: 911/clusterfuzz-testcase-5415105606975488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 08117a40157464f8a9dcc2df393fa5fe299c1e98)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Thierry Foucu
2d0c589941 libavformat/mov: Fix memory leak, need to free the chapter tracks array
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ac24a8202a6fdfb469af1fa68d537fb2f8d1ba6a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
30f20c0b93 avformat/oggparsedaala: Do not leave an invalid value in gpshift
Fixes: undefined behavior
Fixes: 702974

Found-by: Thomas Guilbert <tguilbert@google.com>
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 23ae3cc822915ede2bb4e85047ab46cc5bc71268)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
5e8786fc22 avformat/oggparsedaala: Check duration for AV_NOPTS_VALUE
This avoids an integer overflow
the solution matches oggparsevorbis.c and 45581ed15d2ad5955e24d809820c1675da68f500

Fixes: 700242

Found-by: Thomas Guilbert <tguilbert@google.com>
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 679a315424e6ffaafd21ebf7a86108bd4e743793)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
a17d258e94 avformat/libopenmpt: Check for avio_size() failure
Fixes CID1396850

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bd8201566d754384105923bb1fb3bb3a5c08cc8b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
8ce5038e99 avfilter/af_sofalizer: Fix bad shift
Fixes CID1396835

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4064f3f0dfe71f6d378b9252a390f89c4315bf54)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
wm4
4ed0177e4a avcodec: fix uninitialized variable read
This cna happen if the user tries to call the new decode API for
subtitles.

Fixes CID 1402071.

(cherry picked from commit b4b8ca24f62473528949fe047085eb084364124b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
a99a7bb071 avfilter/avfiltergraph: Add assert to write down in machine readable form what is assumed about sample rates in swap_samplerates_on_filter()
Fixes CID1397292

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f2b360fc05bbb4f21e1247d1d9af303113d6c25)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
4dcceb650d avcodec/tiff: Perform multiply in tiff_unpack_lzma() as 64bit
This should make no difference as the value should not be able to be that large
but its more correct this way

Fixes CID1348138

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f48b6b8b91d63148ef50d096688ed7226cd6ddf4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Steven Liu
7129dfdba8 avformat/test/fifo_muxer: add check for FailingMuxerPacketData alloc
CID: 1396257

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
(cherry picked from commit d1f3e475f9807b445ba37ff2fd23f71c4645de79)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Timothy Gu
efc708afae omx: Fix OOM check
Also use av_mallocz_array().

Fixes CID1396839.

(cherry picked from commit 16a75304fe42d3a007c78126b6370c94ccf891f6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Philip Langdale
d4f4fa22d7 avcodec/vdpau_hevc: Fix potential out-of-bounds write
The maximum number of references is 16, so the index value cannot
exceed 15.

Fixes Coverity CID 1348139, 1348140, 1348141

(cherry picked from commit 4e6d1c1f4ec83000a067ff14452b34c1f2d2a43a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00
Michael Niedermayer
8ee3f73464 avcodec/h264_ps: Fix runtime error: signed integer overflow: 2147483647 + 26 cannot be represented in type 'int'
Fixes: 902/clusterfuzz-testcase-4561155144024064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4f727fbc7330e726d003e2961fa676ddaf86f994)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-14 12:20:15 +02:00