Michael Niedermayer
91e39dd6f3
avcodec/g2meet: Check tile_width in epic_jb_decode_tile()
...
Fixes: out of array access
Fixes: 21469/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5199357982015488
Alternatively the arrays can be made bigger or the index can be clipped.
In case a real file with such huge tiles exist we ask the user to upload it.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5501bb28ddmichael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
0678c4d350
avcodec/hapdec: Check tex_size more strictly and before using it
...
Fixes: OOM
Fixes: 20774/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5678608951803904
Fixes: 20956/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5713643025203200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 81fe316ad9michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
0f4944512f
avcodec/vp9dsp_template: Fix integer overflows in idct32_1d()
...
Fixes: signed integer overflow: -193177 * 11585 cannot be represented in type 'int'
Fixes: 20557/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5704852816789504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e16e3e63f0michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
737f15af60
avcodec/alacdsp: Fix invalid shift in append_extra_bits()
...
Fixes: left shift of negative value -1
Fixes: 21390/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-6242539519868928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 49ae034b42michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
1b2bb4877b
libavcodec/wmalosslessdec: prevent sum of positive numbers from becoming negative
...
Fixes: left shift of negative value -8321365
Fixes: 20506/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-4798062906310656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 62e4003780michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
00aec6d9ba
avcodec/dstdec: Fix integer overflow in read_table()
...
Fixes: signed integer overflow: -16 * 134217879 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5639509530378240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d465a401dmichael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
0e0edbc8b1
avcodec/txd: Check for input size against the header size.
...
Fixes: Timeout (21sec -> 80ms)
Fixes: 20673/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TXD_fuzzer-5177453863763968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit aeb4e43584michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
b888db4367
avcodec/svq1dec: Check that there is data left after the header
...
Fixes: Timeout (21sec -> 255ms)
Fixes: 20709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ1_fuzzer-5085075089915904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 55e344ee5amichael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
8ce3cf4343
avcodec/cbs_h265_syntax_template: Check num_negative/positive_pics when inter_ref_pic_set_prediction_flag is set
...
Fixes: out of array access
Fixes: 20446/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-5707770718584832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 588114cea4michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
f358a4d68d
avcodec/intrax8: Check for end of bitstream in ff_intrax8_decode_picture()
...
Fixes: Timeout (105sec -> 1sec)
Fixes: 20479/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5769846937878528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a9ccc2514michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
0613282686
avcodec/hevc_mp4toannexb_bsf: Check nalu_size
...
Fixes: Timeout (29sec -> 5ms)
Fixes: 20237/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_MP4TOANNEXB_fuzzer-5165615044362240
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ae2537f53emichael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
c12d62bf77
avcodec/iff: Check length before memcpy() in decode_deep_rle32()
...
Fixes: out of array read
Fixes: 20796/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5111364702175232.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b4a33387cbmichael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
101f32f843
avcodec/iff: Fix invalid pointer intermediates in decode_deep_rle32()
...
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc41a29a5amichael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
2f487066ed
avcodec/pngdec: Pass ret from decode_iccp_chunk()
...
Found while reviewing a patch fixing a similar issue
Reviewed-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4c7bcaa385michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
d97cfd89eb
avcodec/rv40dsp: Fix integer overflows in rv40_weight_func_*()
...
Fixes: signed integer overflow: 40550400 * 128 cannot be represented in type 'int'
Fixes: 20331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV40_fuzzer-5676685725007872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 13171ad2e3michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
3336567ec4
avcodec/ac3dec_fixed: Fix several invalid left shifts in scale_coefs()
...
Fixes: left shift of negative value -14336
Fixes: 20298/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AC3_FIXED_fuzzer-5675484201615360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e30502abemichael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
b499a73396
avcodec/flac_parser: Do not lose header count in find_headers_search()
...
Fixes: Timeout
Fixes: out of array access
Fixes: 20274/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5649631988154368
Fixes: 19275/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5757535722405888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 55f9683cf6michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
c298f94143
avcodec/audiodsp: Fix integer overflow in scalarproduct_int16_c()
...
Fixes: signed integer overflow: 2145417478 + 76702564 cannot be represented in type 'int'
Fixes: 20313/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-5734487724130304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit abb5762e98michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
b26458b046
avformat/oggdec: Check for EOF after page header
...
Fixes: Infinite loop
Fixes: Ticket8594
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f1589be9fdmichael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
15e323fee1
swscale/yuv2rgb: Fix vertical dither offset with slices
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit be3c29e379michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
c1a6a35bdd
avcodec/dpcm: clip exponent into supported range in XAN DPCM
...
Fixes: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 21200/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XAN_DPCM_fuzzer-5754704894361600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 20ade59d96michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
4e834d7139
avcodec/flacdsp_template: Fix invalid shifts in decorrelate
...
Fixes: left shift of negative value -2
Fixes: 20303/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5096829297623040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3935c891e9michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
987ec5f1d0
avcodec/xvididct: Fix integer overflow in MULT()
...
Fixes: signed integer overflow: 23170 * 95058 cannot be represented in type 'int'
Fixes: 20295/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5800212870463488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ccb576191michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
89860dd068
avcodec/ffwavesynth: Correct undefined overflow of PINK_UNIT
...
Fixes: signed integer overflow: 9223372036854775775 + 128 cannot be represented in type 'long'
Fixes: 20054/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5686385113825280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 187161d62fmichael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
9342a639a7
avcodec/cbs_h264_syntax_template: fix off by 1 error with slice_group_change_cycle
...
Fixes: assertion failure
Fixes: 20390/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_REDUNDANT_PPS_fuzzer-5683400772157440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 741565a1e6michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
531b3300a7
swscale/output: Fix integer overflow in yuv2rgb_write_full() with out of range input
...
Fixes: signed integer overflow: 1169365504 + 981452800 cannot be represented in type 'int'
Fixes: ticket8293
Found-by: Suhwan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e057e83a4fmichael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
81f9e29bc9
swscale/output: Fix integer overflow in alpha computation in yuv2gbrp16_full_X_c()
...
Fixes: signed integer overflow: 524280 * 4432 cannot be represented in type 'int'
Fixes: ticket8322
Found-by: Suhwan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 49ba1879admichael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
John Rummell
e75f8b51ea
libavformat/amr.c: Check return value from avio_read()
...
If the buffer doesn't contain enough bytes when reading a stream,
fail rather than continuing on with initialized data. Caught by
Chromium fuzzeras (crbug.com/1065731).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5b967f56b6michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
John Rummell
9954fbe273
libavformat/mov.c: Free aes_decrypt to avoid leaking memory
...
Found by Chromium fuzzers (crbug.com/1057205).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ad91cf1f2fmichael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
John Rummell
b561b503ff
libavformat/oggdec.c: Check return value from avio_read()
...
If the buffer doesn't contain enough bytes when reading a stream,
fail rather than continuing on with unitialized data. Caught by
Chromium fuzzers (crbug.com/1054229).
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b7c67b1ae3michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
116b777775
avformat/asfdec_f: Fix overflow check in get_tag()
...
Fixes: signed integer overflow: 2 * 1210064928 cannot be represented in type 'int'
Fixes: 20873/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5761116909338624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c8140fe732michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
2bef1bba73
avformat/nsvdec: Fix memleaks on errors while reading the header
...
Fixes: memleaks
Fixes: 21084/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5655975492321280
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 96c0469455michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
c352052457
avcodec/ffwavesynth: Fix integer overflow in computation of ddphi
...
Fixes: signed integer overflow: 1302123111085380114 - -8319005078741256972 cannot be represented in type 'long'
Fixes: 20991/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5148554161291264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c85bf16318michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
bf696d436e
avcodec/adpcm: Fix invalid shift in AV_CODEC_ID_ADPCM_PSX
...
Fixes: left shift of negative value -1
Fixes: 20859/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_PSX_fuzzer-5720391507247104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0a11ef68f0michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
178f6ae983
avcodec/mpeg12dec: Fix invalid shift in mpeg2_fast_decode_block_intra()
...
Fixes: left shift of negative value -695
Fixes: 19232/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5702856963522560
Fixes: 19555/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5741218147598336
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c40df2166cmichael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Andreas Rheinhardt
3b4eae4cae
avcodec/cbs_h2645: Treat slices without data as invalid
...
Slices that end after their header (meaning slices after the header
without any data before the rbsp_stop_one_bit or possibly without any
rbsp_stop_one_bit at all) are invalid and are now dropped. This ensures
that one doesn't run into two asserts in cbs_h2645_write_slice_data().
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Fixes: 19629/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_METADATA_fuzzer-5676822528524288
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 66fac1ff7cmichael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Andreas Rheinhardt
e9b4383712
avcodec/cbs_h2645: Remove dead code to delete trailing zeroes
...
Trailing zeroes are already discarded when splitting a fragment, which
makes the code to remove them when decomposing slices dead code.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8f701932b3michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
abd6b0f913
avcodec/mpegaudioenc_template: fix invalid shift of sample
...
Fixes: Ticket8010
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a2c97a8342michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
e2979378ff
avcodec/motion_est_template: Fix invalid shifts in no_sub_motion_search()
...
Fixes: Ticket8167
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e13eee37eemichael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
84be21040e
libavformat/avienc: Check bits per sample for PAL8
...
Fixes: assertion failure
Fixes: Ticket 8172
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3595878281michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
3509ad1b06
avformat/mpegts: Improve the position determination for avpriv_mpegts_parse_packet()
...
Fixes: assertion failure
Fixes: Ticket 8005
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e5bb48ae59michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
447e97e510
avcodec/magicyuv: Check that there are enough lines for interlacing to be possible
...
Fixes: out of array access
Fixes: 20763/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_fuzzer-5759562508664832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f8a0e9f9f7michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
07a265b140
avformat/mvdec: Check stream numbers
...
Fixes: null pointer dereference
Fixes: 20768/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5638648978735104.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 618a9bea65michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
702ce6c8ee
avcodec/pcm: Fix invalid shift in AV_CODEC_ID_PCM_LXF
...
Fixes: left shift of 233 by 24 places cannot be represented in type 'int'
Fixes: 20736/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PCM_LXF_fuzzer-4829212685107200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 051d11f659michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
ec3635caf6
avcodec/qdm2: Check fft_coefs_index
...
Fixes: out of array access
Fixes: 20660/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5658290216501248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9fc73bf022michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
c901cc287f
avformat/utils: Fix integer overflow with complex time bases in avformat_find_stream_info()
...
Fixes: signed integer overflow: 2045163756 * 2 cannot be represented in type 'int'
Fixes: Ticket5132
Found-by: tsmith
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f3d8f517dbmichael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
ac4fb0935a
avformat/avidec: Avoid integer overflow in NI switch check
...
Fixes: signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'long'
Fixes: Ticket8149
Found-by: Suhwan
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 347920ca21michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
759febd880
fftools/ffmpeg: Fix integer overflow in duration computation in seek_to_start()
...
Fixes: signed integer overflow: -9223372036854775808 - 9223372036854775807 cannot be represented in type 'long'
Fixes: Ticket8142
Found-by: Suhwan
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f4ad33d96michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
1bcbe5bc9b
avfilter/vf_aspect: Fix integer overflow in compute_dar()
...
Fixes: signed integer overflow: 1562273630 * 17 cannot be represented in type 'int'
Fixes: Ticket8323
Found-by: Suhwan
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c0ca0f244michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
Michael Niedermayer
14ed91c123
avcodec/apedec: Fix invalid shift with 24 bps
...
Fixes: left shift of negative value -463
Fixes: 20542/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5688714435231744
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e27867229michael@niedermayer.cc >
2020-07-01 13:33:44 +02:00
