highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
92,803 Commits 36 Branches 392 Tags
43988fffd9eee4fe573574d5ce3136f9d1bf0ae9
Commit Graph

92803 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer
544ad51ad6 avcodec/ralf: fix undefined shift 
Fixes: left shift of negative value -2
Fixes: 16145/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5146671058518016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ee886988e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
a78128bf0a avcodec/bgmc: Check input space in ff_bgmc_decode_init() 
Fixes: Infinite loop
Fixes: 16608/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5636229827133440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b54031a6e9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
422d57feb2 avcodec/truemotion2: Fix multiple integer overflows in tm2_null_res_block() 
Fixes: signed integer overflow: 1795032576 + 598344192 cannot be represented in type 'int'
Fixes: 16196/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5636723419119616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cc78783ce5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
74836bb41b avcodec/vc1_block: Check the return code from vc1_decode_p_block() 
Fixes: left shift of negative value -1
Fixes: 16424/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-5656579055026176
Fixes: 16358/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5714436358144000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fe536b6d99)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
4b4586db12 avcodec/vc1dec: Require res_sprite for wmv3images 
non res_sprite leads to decoder delay which leads to assertion failure
Fixes: Assertion failure
Fixes: 16402/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5704510034411520
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int'
Fixes: 16425/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5692858838810624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9c6b400492)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
58a7f109a9 avcodec/vc1_block: Check for double escapes 
Fixes: out of array read
Fixes: 16331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5672735195267072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6962fd586e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
586a79190c avcodec/vorbisdec: Check get_vlc2() failure 
Fixes: out of array read
Fixes: 16510/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5754510382727168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 07b948fe60)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
70255c1e48 avcodec/tta: Fix integer overflow in prediction 
Fixes: signed integer overflow: -395281576 + -1827578048 cannot be represented in type 'int'
Fixes: 16038/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5646109705240576

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7e9aecc9f3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
db421282be avcodec/vb: Check input packet size to be large enough to contain flags 
Fixes: Timeout (->9sec)
Fixes: 16292/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VB_fuzzer-5747063496638464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dea2591d4f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
f4431b6b0c avcodec/cavsdec: Limit the number of access units per packet to 2 
Fixes: Timeout (122sec -> 13ms)
Fixes: 15978/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5148925004087296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 37bc8e3249)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
14616c63df avcodec/atrac9dec: Check block_align 
Fixes: Infinite loop
Fixes: 16260/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5676365617037312
Fixes: 16260/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5768093879500800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dead949a1f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
95e414dc5d avcodec/alac: Check for bps of 0 
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 15764/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5102101203517440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8f49176e84)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
d0563bdf5f avcodec/alac: Fix multiple integer overflows in lpc_prediction() 
Fixes: signed integer overflow: 2088795537 + 2147254401 cannot be represented in type 'int'
Fixes: signed integer overflow: -1500363496 + -1295351808 cannot be represented in type 'int'
Fixes: signed integer overflow: -79560 * 32640 cannot be represented in type 'int'
Fixes: signed integer overflow: 2088910005 + 2088796058 cannot be represented in type 'int'
Fixes: signed integer overflow: -117258064 - 2088725225 cannot be represented in type 'int'
Fixes: signed integer overflow: 2088725225 - -117258064 cannot be represented in type 'int'
Fixes: 15739/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5630664122040320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ae3d6a337a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
f4319997ad avcodec/rl2: set dimensions 
The dimensions are always 320x200 they are hardcoded in the demuxer.
Hardcode them instead in the decoder.

Fixes: Timeout (16sec -> 400ms)
Fixes: 15574/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RL2_fuzzer-5158614072819712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 965e766e48)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
a05d292756 avcodec/aacdec: Add FF_CODEC_CAP_INIT_CLEANUP 
Fixes: memleaks
Fixes: 16289/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5200695692623872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 48b86dd8a6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
f3bb030fb9 avcodec/idcinvideo: Add 320x240 default maximum resolution 
Fixes: Timeout (128sec -> 2ms)
Fixes: 16568/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IDCIN_fuzzer-5675004095627264

See: [FFmpeg-devel] [PATCH 4/4] tools/target_dec_fuzzer: Adjust max_pixels for IDCIN

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c9fcf881e6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
4400d1b6e5 avformat/realtextdec: free queue on error 
Fixes: memleak
Fixes: 16277/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5696629440512000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 493438fafc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
0f0d00e96e avcodec/vp5/6/8: use vpX_rac_is_end() 
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ab56e62e8f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
4e3e2788da avcodec/alsdec: Fix integer overflow in decode_var_block_data() 
Fixes: signed integer overflow: 1927975249 - -514719744 cannot be represented in type 'int'
Fixes: 16413/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5651206856245248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 661a9b274b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
600675e11b avcodec/alsdec: Limit maximum channels to 512 
There seems to be no limit in the specification and upto 64k could be stored
512 is choosen as limit as thats the maximum in a conformance sample

An alternative to this patch would be a max_channels variable

Fixes: OOM
Fixes: 16200/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5764788793114624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Thilo Borgmann <thilo.borgmann@mail.de>
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f51e4d026c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
e31e1d75d1 avcodec/anm: Check input size for a frame with just a stop code 
Fixes: Timeout (11sec -> 6sec)
Fixes: 16344/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ANM_fuzzer-5673032000995328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1965161ef6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
3760c85b88 avcodec/flicvideo: Optimize and Simplify FLI_COPY in flic_decode_frame_24BPP() by using bytestream2_get_buffer() 
Fixes: Timeout (31sec  -> 22sec)
Fixes: 16217/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-5658084189405184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e301736862)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
ec72482fc0 avcodec/loco: Check left column value 
Fixes: Timeout (42sec -> 379 ms)
Fixes: 16323/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5679178099195904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c812db814e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
9c6c85f539 avcodec/ffwavesynth: Fixes invalid shift with pink noise seeking 
Fixes: left shift of negative value -961533698048
Fixes: 16242/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5738550670131200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cdea0206ef)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
3b011b34dc avcodec/ffwavesynth: Fix integer overflow for some corner case values 
Fixes: left shift of negative value -14671840
Fixes: 16000/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5145977817661440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c4a88fb546)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
28efd41bbc avcodec/indeo2: Check remaining input more often 
Fixes: Timeout (95sec -> 30ms)
Fixes: 14765/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO2_fuzzer-5692455527120896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpe
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 52939a2c57)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
15219e3692 avcodec/diracdec: Check that slices are fewer than pixels 
Fixes: Timeout (197sec ->144ms)
Fixes: 15034/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5733549405110272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fbbc8ba67f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
9a4cec81dc avcodec/vp56: Consider the alpha start as end of the prior header 
Fixes: Timeout (23sec -> 71ms)
Fixes: 15661/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP6A_fuzzer-6257865947348992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit db78bc1297)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
4d523742e3 avcodec/4xm: Check for end of input in decode_p_block() 
Fixes: Timeout (81sec -> 0.2sec)
Fixes: 16169/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5662570416963584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8f92eb05e0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
a2be37ac9d avcodec/hevcdec: Check delta_luma_weight_l0/1 
Fixes: signed integer overflow: 1 + 2147483647 cannot be represented in type 'int'
Fixes: 16041/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5685680656613376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 021f29506b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
cc0e1474f1 avcodec/hnm4video: Optimize postprocess_current_frame() 
Improves: Timeout (220sec -> 108sec)
Improves: 15570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HNM4_VIDEO_fuzzer-5085482213441536

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cd460f4da0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
7d4e27ca90 avcodec/hevc_refs: Optimize 16bit generate_missing_ref() 
Fixes: Timeout (86sec -> 8sec) [these numbers assume also "[FFmpeg-devel] [PATCH 2/5] [RFC] avcodec/hevcdec: Check for overread in hls_decode_entry()"]
Fixes: 15702/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5657764929470464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit da8936969f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
21b72d8f6c avcodec/scpr: Use av_memcpy_backptr() in type 17 and 33 
This makes the changed code-path faster.

Change not tested except with the fuzzer testcase as I found no other testcase.

Improves: Timeout (136sec -> 74sec)
Improves: 16040/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-5705876062601216

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit 950a21e83c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
40c0a5a5fa avcodec/dds: Use ff_set_dimensions() 
Fixes: signed integer overflow: 2082471995 * 36 cannot be represented in type 'int'
Fixes: 16025/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DDS_fuzzer-5136663778426880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9cd1e939cf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
ffe4a51e0d avcodec/mpc8: Fix 32bit mask/enum 
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 15817/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC8_fuzzer-5636626409062400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e8bb949ade)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
2dcf33b9a9 avcodec/alsdec: Fix integer overflows of raw_samples in decode_var_block_data() 
This also makes the code consistent with the existing similar MUL64()
in decode_var_block_data()

Fixes: signed integer overflow: -7277630735906765035 + -3272193951413647896 cannot be represented in type 'long'
Fixes: 16015/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5666552818434048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fad3ec89b7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
8b156fe229 avcodec/alsdec: Fix integer overflow of raw_samples in decode_blocks() 
Fixes: signed integer overflow: 2147483424 - -1772303236 cannot be represented in type 'int'
Fixes: 15708/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5067890362941440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce65232406)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
e4ec2f5ab5 avcodec/alsdec: fix mantisse shift 
Fixes: shift exponent -1 is negative
Fixes: 16039/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5656825657032704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 02346292a3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
bfbe5fbda8 avcodec/vc1_block: Fix invalid shifts in vc1_decode_i_blocks() 
Fixes: left shift of negative value -9
Fixes: 15299/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSS2_fuzzer-5660922678345728
Fixes: 15557/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5673351911047168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c9415e815a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
62bcdd07b2 avcodec/vc1_block: fix invalid shift in vc1_decode_p_mb() 
Fixes: left shift of negative value -5
Fixes: 15294/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5733921754447872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b153ba1c2e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
29ebbe8cfe avcodec/aacdec_template: fix integer overflow in imdct_and_windowing() 
Fixes: signed integer overflow: 2147483645 + 4 cannot be represented in type 'int'
Fixes: 15418/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5685269069561856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit da93e2b142)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Andreas Rheinhardt
f482c38273 libavcodec/iff: Use unsigned to avoid undefined behaviour 
The initialization of the uint32_t plane32_lut matrix uses left shifts
of the form 1 << plane; plane can be as big as 31 which means that this
is undefined behaviour as 1 will be simply an int. So make it unsigned
to avoid this.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f12e662a3d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
0d019e2379 avcodec/alsdec: Check for block_length <= 0 in read_var_block_data() 
Fixes: left shift of negative value -1
Fixes: 15719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5685731105701888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit be4fb282f9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
731b4f7414 avcodec/vqavideo: Set video size 
Fixes: out of array access
Fixes: 15919/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-5657368257363968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 02f909dc24)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
e7c8bc5ae0 avcodec/sanm: Check extradata_size before allocations 
Fixes: Leaks
Fixes: 15349/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5102530557640704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 172a43ce36)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
1bc9b64cf4 avcodec/mss1: check for overread and forward errors 
Fixes: Timeout (106sec -> 14ms)
Fixes: 15576/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSS1_fuzzer-5688080461201408

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 43015afd7c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
145c923bfe avcodec/loco: Check for end of input in pixel decode 
Fixes: Timeout (100sec -> 5sec)
Fixes: 15509/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5724297261219840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8305a4509a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
7235bd1008 avcodec/dirac_parser: Fix overflow in dts 
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 15568/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5634719611355136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 549fcba8fc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
9aa632c530 avcodec/ralf: Fix undefined pointer in decode_channel() 
Fixes: 16203/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5086088934195200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3c06ba1716)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00
Michael Niedermayer
092bc6201f avcodec/ralf: Fix integer overflow in apply_lpc() 
Fixes: signed integer overflow: 1603085316 + 1238786562 cannot be represented in type 'int'
Fixes: 16203/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5086088934195200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ccca484324)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:42 +01:00