highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
92,755 Commits 36 Branches 392 Tags
45836a60f5b6326c7896a413e651aa35c8cc45dc
Commit Graph

92755 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer
45836a60f5 avcodec/dxv: Check op_offset in dxv_decompress_yo() 
Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type 'int'
Fixes: 17745/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_fuzzer-5734628463214592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 97450d2b6a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
5e3a827e9d avcodec/utils: Check sample_rate before opening the decoder 
Fixes: signed integer overflow: 2 * -1306460384 cannot be represented in type 'int'
Fixes: 17685/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_fuzzer-5747390337777664
Fixes: 17688/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5739287210885120
Fixes: 17699/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5678394531905536
Fixes: 17738/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5763415733174272
Fixes: 17746/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINKAUDIO_RDFT_fuzzer-5703008159006720

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 75fefb1fb7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
f5636c5b20 avcodec/aptx: Fix multiple shift anomalies 
Fixes: left shift of negative value -24576
Fixes: 17719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APTX_fuzzer-5710508002377728

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 675f62a202)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
James Almer
781a4a43b5 avcodec/fitsdec: fix use of uninitialised values 
header.data_max and header.data_min are not necessarely set on all decoding scenarios.

Fixes a Valgrind reported regression since cfa1937791.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit e3f0ecfc57)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
dc5760a909 avcodec/motionpixels: Mark 2 functions as always_inline 
Fixes: Timeout (30sec -> 25sec)
Fixes: 17050/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOTIONPIXELS_fuzzer-5719149803732992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 017884bdc3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
20a923a3ae avcodec/ituh263dec: Make the condition for the studio slice start code match between ff_h263_resync() and ff_mpeg4_decode_studio_slice_header() 
If they mismatch an infinite loop can occur
Fixes: Timeout (infinite loop)
Fixes: 17043/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5695051748868096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8335ba8ae9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
6b9a6088d6 avcodec/ralf: Fix integer overflow in decode_channel() 
Fixes: signed integer overflow: -1094995519 * 64 cannot be represented in type 'int'
Fixes: 17030/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5640695838146560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fbb314b6f2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
d3f8892249 vcodec/vc1: compute rangex/y only for P/B frames 
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int'
Fixes: 16976/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-4847262047404032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e75e7fe160)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
26db773767 avcodec/vc1_pred: Fix invalid shifts in scaleforopp() 
Fixes: left shift of negative value -2
Fixes: 16964/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5757853565976576

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ced9a1cd0a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
a9788d00ee avcodec/vc1_block: Fix invalid shift with rangeredfrm 
Fixes: left shift of negative value -7
Fixes: 16959/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-5200360825683968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c722a69253)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
cd949baefd avcodec/vc1: Check for excessive resolution 
Fixes: overflow in aspect ratio calculation
Fixes: signed integer overflow: 393215 * 14594 cannot be represented in type 'int'
Fixes: 15728/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5661588893204480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 181e138da7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
79dffb7f2c avcodec/vc1: check REFDIST 
"9.1.1.43 P Reference Distance (REFDIST)"
"The value of REFDIST shall be less than, or equal to, 16."

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7f7af9e294)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
fe51b4d5a0 avcodec/apedec: Fix several integer overflows in predictor_update_filter() and do_apply_filter() 
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: signed integer overflow: -14527961 - 2147483425 cannot be represented in type 'int'
Fixes: 16380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5645957131141120
Fixes: 16968/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5716169901735936
Fixes: 17074/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5198710497083392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1e95a3e8a7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
588c735ce5 avcodec/hevc_cabac: Tighten the limit on k in ff_hevc_cu_qp_delta_abs() 
Values larger would fail subsequent tests.

Fixes: signed integer overflow: 5 + 2147483646 cannot be represented in type 'int'
Fixes: 16966/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5695709549953024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f63cd1963e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
9691f42ae9 avcodec/4xm: Check index in decode_i_block() also in the path where its not used. 
Fixes: Infinite loop
Fixes: signed integer overflow: 2147483644 + 16 cannot be represented in type 'int'
Fixes: 16169/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5662570416963584
Fixes: 16782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5743163859271680
Fixes: 17641/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5711603562971136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 87ddf9f1ef)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
b0c5ec9ab4 avcodec/loco: Check for end of input in the first line 
Fixes: Timeout (85sec -> 0.1sec)
Fixes: 17634/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5666410809786368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c5a52eb5cd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
ba148f2329 avcodec/atrac3: Check block_align 
Fixes: Infinite loop
Fixes: 17620/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3_fuzzer-5086123012915200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2acbbe2623)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
559280043d avcodec/alsdec: Avoid dereferencing context pointer in inner interleave loop 
This makes the decoder faster

Improves/Fixes: Timeout (22sec -> 20sec)
Testcase: 17619/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5078510820917248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 581a895c5c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
7e4d850a9f avcodec/fitsdec: Prevent division by 0 with huge data_max 
Fixes: division by 0
Fixes: 15657/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5738154838982656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cfa1937791)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
2567675f00 avcodec/dstdec: Fix integer overflow in samples_per_frame computation 
Fixes: Timeout (? -> 2ms)
Fixes: 17616/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5198057947267072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7dc0943d4a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
86acbb0350 avcodec/g729_parser: Check block_size 
Fixes: Infinite loop
Fixes: 17611/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5765134928052224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 972a0a818f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
a3f6f21506 avcodec/sbcdec: Initialize number of channels 
Fixes: out of array access
Fixes: 17609/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SBC_fuzzer-5758729319874560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Reviewed-by: Moritz Barsnick <barsnick@gmx.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 02fb6a2147)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
18e5ce4d0d avcodec/utils: Optimize ff_color_frame() using memcpy() 
4650975 -> 4493240 dezicycles

This optimizes lines 2 and later. Line 1 still uses av_memcpy_backptr()
This change originally fixed ossfuzz 10790 but this is now fixed by other
optimizations already

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 95e5396919)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
e6cff05bef avcodec/aacdec: Check if we run out of input in read_stream_mux_config() 
Fixes: Infinite loop
Fixes: 16920/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5653421289373696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3dce4d03d5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
5d49cf9ac2 avcodec/utils: Use av_memcpy_backptr() in ff_color_frame() 
Fixes: Timeout (191sec -> 53sec)
Fixes: 16908/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5711207859748864
Fixes: 10709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5630617975259136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 340ab13504)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
d07669ebc6 avcodec/smacker: Fix integer overflow in signed int multiply in SMK_BLK_FILL 
Fixes: signed integer overflow: 238 * 16843009 cannot be represented in type 'int'
Fixes: 16958/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKER_fuzzer-5193905355620352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 033d2c4884)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
24b0e33b8b avcodec/alac: Fix invalid shifts in 20/24 bps 
Fixes: left shift of negative value -256
Fixes: 16892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-4880802642395136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b30c07cc2b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
60993e367f avcodec/alac: fix undefined behavior with INT_MIN in lpc_prediction() 
Fixes: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
Fixes: 16786/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5632818851348480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0831cbfe09)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
718eab1733 avcodec/ffwavesynth: Fix integer overflow in timestamps 
Fixes: signed integer overflow: 9223371075321077760 * 2 cannot be represented in type 'long'
Fixes: 16447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5698937431785472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c7ccbf40ed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
07b6caa309 avcodec/dxv: Check op_offset in both directions 
Fixes: signed integer overflow: 61 + 2147483647 cannot be represented in type 'int'
Fixes: 15311/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_fuzzer-5742552826773504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8c7d5fcfc3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
3f2f2b18c8 avcodec/adpcm: Check number of channels for MTAF 
Fixes: out of array access
Fixes: 17608/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_MTAF_fuzzer-5074936267276288

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 74bbf9bc82)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
c526fc591a avcodec/sunrast: Fix indention 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0728d64497)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
6579f1ac27 avcodec/sunrast: Fix return type for "unsupported (compression) type" 
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0e8b7709a9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
f34c2a9f94 avcodec/utils: Check channels fully earlier 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 83f2555e5f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
a600c6fa02 avformat/mov: Check for EOF in mov_read_meta() 
Fixes: Timeout (195sec -> 2ms)
Fixes: 16735/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5090676403863552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 093d1f4250)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
9365608099 avcodec/hevcdec: Fix memleak of a53_caption 
Fixes: 15295/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5675655187922944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ef50cf7b32)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
0801d3cfa2 avformat/cdxl: Fix integer overflow in intermediate 
Fixes: signed integer overflow: 65535 * 65312 cannot be represented in type 'int'
Fixes: 16704/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6294115603447808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5c5575c8dc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
b91ee0ce18 avcodec/hevcdec: repeat character in skiped 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d2d8e797cc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
1a224677d3 avcodec/gdv: Replace assert() checking bitstream by if() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a9fae76370)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
3b61a7732d libavcodec/utils: Free threads on init failure 
Fixes: Multiple memleaks
Fixes: ffmpeg-memory-leak

Found-by: Francis Provencher <francis@protekresearchlab.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 61b055bed0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
ccad8e7175 avcodec/htmlsubtitles: Avoid locale dependant isdigit() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b94cf549e2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
81c2cf8646 avcodec/alsdec: Check k from being outside what our implementation can handle 
The specification does not seem to list what the maximum valid
value is

Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 16268/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5638164544225280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e125578994)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
eec70d9fbe avcodec/takdec: Fix integer overflow in decorrelate() 
Fixes: signed integer overflow: -2424832 - 2145653689 cannot be represented in type 'int'
Fixes: 16138/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5643451346976768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f119273649)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
2348a24c36 avcodec/aacps: Fix integer overflows in hybrid_synthesis() 
Fixes: signed integer overflow: -822667928 + -1399761199 cannot be represented in type 'int'
Fixes: 15756/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5645182051024896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ec749ed222)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
12e035b6fa avcodec/mpeg4videodec: Fix integer overflow in mpeg4_decode_studio_block() 
Fixes: signed integer overflow: 24023040 * 112 cannot be represented in type 'int'
Fixes: 16570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5173275211071488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Kieran Kunhya <kierank@obe.tv>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0e4a0e962c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
77c60f16d7 avcodec/vp56rac: delay signaling an error on truncated input 
A threshold of 1 is sufficient for simple_dump_cut.webm, 10 is used
just to be sure the next truncated file doesnt cause the same issue

Obvious alternative fixes are to simply accept that the file is broken or to
write some advanced error concealment or to
simply accept that the decoder wont stop at the end of input.

Fixes: Ticket 8069 (artifacts not the differing md5 which was there before 1afd246960)
Fixes: simple_dump_cut.webm
Fixes: regression of 1afd246960

fate-vp5 changes because the last frame is truncated and now handled
differently.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b6b9ac5698)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
7a3223ebef avcodec/qdm2: Check frame size 
Fixes: index 2304 out of bounds for type 'float [2304]'
Fixes: 16332/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5679142481166336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 12b909ba31)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
5e4d9b6bf0 avcodec/vc1_pred: Fix refdist in scaleforopp() 
Fixes: out of array access
Fixes: 16601/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5656105392275456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 413e0f2516)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
d4442a25e1 avcodec/vorbisdec: fix FASTDIV usage for vr_type == 2 
This reverts a hunk from f1ca40ee00

Fixes: out of array read
Fixes: 16924/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-5157893162139648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 722fd46965)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00
Michael Niedermayer
6e0d6e373a avcodec/iff: Check for overlap in cmap_read_palette() 
Fixes: undefined memcpy() use
Fixes: 16302/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5678750575886336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dfa5d1a366)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-01-06 11:30:43 +01:00