highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
83,687 Commits 36 Branches 392 Tags
981624face9c9ac8fc7920ac976d56e475ba7ce2
Commit Graph

83687 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer
981624face avformat/mpegts: Fix argument type for av_log 
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 654b21ef17)
 2021-10-09 22:02:20 +02:00
Michael Niedermayer
d53d36e93d avformat/cafdec: clip sample rate 
Fixes: 1.21126e+111 is outside the range of representable values of type 'int'
Fixes: 27398/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5412960339755008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 684aec6a68)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:20 +02:00
Michael Niedermayer
6cdbedbfb7 avcodec/ffv1dec: Fix off by 1 error with quant tables 
Fixes: assertion failure
Fixes: 28447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-5369575948550144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5cae71d2b7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:20 +02:00
Michael Niedermayer
10b493af68 avformat/mpegts: Increase pcr_incr width to 64bit 
Fixes: division by zero
Fixes: 26459/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5666350112178176
Fixes: 28154/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5195728439476224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ef7b117b7b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:20 +02:00
Michael Niedermayer
150c66f775 avformat/mov: Check if hoov is at the end 
Fixes: Timeout, probably infinite loop
Fixes: 26559/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5391165484171264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0afbaabdca)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:20 +02:00
Michael Niedermayer
e46b067199 avcodec/hevc_ps: check scaling_list_dc_coef 
Fixes: signed integer overflow: 2147483640 + 8 cannot be represented in type 'int'
Fixes: 28449/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5686013259284480

Reviewed-by: James Almer <jamrial@gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f1700bd8bb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:20 +02:00
Michael Niedermayer
a9fe6abe0a avformat/iff: Check data_size 
Fixes: infinite loop
Fixes: 27834/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5694930919620608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 001bc594d8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:20 +02:00
Michael Niedermayer
fe15426edd avformat/matroskadec: Sanity check codec_id/track type 
Fixes: memleak
Fixes: 27766/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-5198300814508032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7b88dd8f0c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:20 +02:00
Michael Niedermayer
a4be820f99 avformat/rpl: Check the number of streams 
Fixes: out of memory access
Fixes: 27787/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-4743666463408128.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0677bdb1f5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
896720925a avcodec/h264idct_template: Fix integer overflow in ff_h264_chroma422_dc_dequant_idct() 
Fixes: signed integer overflow: -2105540608 - 2105540608 cannot be represented in type 'int'
Fixes: 26870/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5656647567147008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 51dfd6f1bd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
05ca3ac921 avformat/dsfdec: Check block_align more completely 
Fixes: infinite loop
Fixes: 26865/clusterfuzz-testcase-minimized-ffmpeg_dem_DSF_fuzzer-5649473830912000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 65b8974d54)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
62ccd6b820 avformat/mpc8: Check remaining space in mpc8_parse_seektable() 
Fixes: Fixes infinite loop
Fixes: 26704/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6327056939614208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4f66dd13d0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
5929303897 avformat/id3v2: Sanity check tlen before alloc and uncompress 
Fixes: Timeout (>20sec -> 65ms)
Fixes: 26896/clusterfuzz-testcase-minimized-ffmpeg_dem_DAUD_fuzzer-5691024049176576
Fixes: 27627/clusterfuzz-testcase-minimized-ffmpeg_dem_AEA_fuzzer-4907019324358656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d7f87a4b9e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
20a2a36571 avformat/vqf: Check len for COMM chunks 
Fixes: Infinite loop
Fixes: 26696/clusterfuzz-testcase-minimized-ffmpeg_dem_VQF_fuzzer-5648269168082944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a834af133b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
4314f97f65 avcodec/hevc_cabac: Limit value in coeff_abs_level_remaining_decode() tighter 
The max depth is 16bps, the max allowed coefficient depth is depth+6
Fixes: signed integer overflow: 1074266112 + 1073725439 cannot be represented in type 'int'
Fixes: 26493/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5657763331702784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7cf852b03c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
4622b9359a avformat/cafdec: Check the return code from av_add_index_entry() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9dc3301745)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
b25aae7253 avformat/cafdec: Check for EOF in index read loop 
Fixes: OOM
Fixes: 27398/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-541296033975500

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eb46939e3a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
631e300654 avformat/cafdec: Check that bytes_per_packet and frames_per_packet are non negative 
These fields are not signed in the spec (1.0) so they cannot be negative
Changing bytes_per_packet to unsigned would not solve this as it is exported
as block_align which is signed

Fixes: Infinite loop
Fixes: 26492/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5632087614554112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5eed718087)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
c9eb3dc486 avformat/mpc8: correct integer overflow in mpc8_parse_seektable() 
Fixes: signed integer overflow: -4683718486770919638 * 2 cannot be represented in type 'long'
Fixes: 26704/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6327056939614208
Fixes: 27550/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6259212652642304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0897402ac8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
fe309530ae avformat/mpc8: correct 32bit timestamp truncation 
Fixes: left shift of 65536 by 15 places cannot be represented in type 'int'
Fixes: 26801/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-5164313092030464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ad3e495657)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
30102ee94e avcodec/exr: Check ymin vs. h 
Fixes: out of array access
Fixes: 26532/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5613925708857344
Fixes: 27443/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5631239813595136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3e5959b345)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
25ed238480 avformat/avs: Use 64bit for the avio_tell() output 
Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented in type 'long'
Fixes: 26549/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS_fuzzer-4844306424397824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1278f117d7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
0ce79b95d9 avformat/wavdec: More complete size check in find_guid() 
Fixes: signed integer overflow: 9223372036854775807 + 8 cannot be represented in type 'long'
Fixes: 27341/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5442833206738944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a207df2acb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
608bb9814c avformat/iff: Check size before skip 
Fixes: Infinite loop
Fixes: 27292/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5731168991051776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8b50e8bc29)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
83e5a77c1d avformat/rmdec: Check for EOF in index packet reading 
Fixes: Timeout(>10sec -> 1ms)
Fixes: 27284/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6304211110985728

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ebf4bc629e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
33a82227ad avformat/icodec: Check for zero streams and stream creation failure 
Fixes: NULL pointer dereference
Fixes: 26814/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-5758487797432320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b33233bd53)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
de7f2908f1 avformat/icodec: Factor failure code out in read_header() 
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 27ee67c00f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
89e148cb81 avformat/bintext: Check width 
Fixes: division by 0
Fixes: 26780/clusterfuzz-testcase-minimized-ffmpeg_dem_ADF_fuzzer-5117945027756032
Fixes: 26998/clusterfuzz-testcase-minimized-ffmpeg_dem_ADF_fuzzer-5119352359354368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f6dc285fb5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
64ed3aff37 avformat/sbgdec: Check that end is not before start 
Fixes: signed integer overflow: -9223372036854775808 + -5279949906739200 cannot be represented in type 'long'
Fixes: 26908/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6329610851319808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9ef60a66f1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
ecd4013d80 avformat/lvfdec: Check stream_index before use 
Fixes: assertion failure
Fixes: 26905/clusterfuzz-testcase-minimized-ffmpeg_dem_LVF_fuzzer-5724267599364096.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b1d99ab14f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
e298bc5980 avformat/au: cleanup on EOF return in au_read_annotation() 
Fixes: memleak
Fixes: 26841/clusterfuzz-testcase-minimized-ffmpeg_dem_AU_fuzzer-5174166309044224
Regression since: e680d50eb4
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d16974c3dd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
7a395606a7 avformat/mpegts: Limit copied data to space 
Fixes: out of array access
Fixes: 26816/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-6282861159907328.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 79cf7c7191)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
978bc27c61 avformat/bintext: Check width in idf_read_header() 
Fixes: division by 0
Fixes: 26802/clusterfuzz-testcase-minimized-ffmpeg_dem_IDF_fuzzer-5180591554953216.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 442d53f409)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
2c45037a25 avformat/iff: check size against INT64_MAX 
Bigger sizes are misinterpreted as negative numbers by the API
Fixes: infinite loop
Fixes: 26611/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4890614975692800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f291cd681b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
7769ab9393 avformat/paf: Check for EOF in read_table() 
Fixes: OOM
Fixes: 26528/clusterfuzz-testcase-minimized-ffmpeg_dem_PAF_fuzzer-5081929248145408
Fixes: 26584/clusterfuzz-testcase-minimized-ffmpeg_dem_PAF_fuzzer-5172661183053824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 437b7302b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
c9c4b480c6 avformat/gxf: Check pkt_len 
Fixes: Infinite loop
Fixes: 26576/clusterfuzz-testcase-minimized-ffmpeg_dem_GXF_fuzzer-4823080360476672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dad9a86ca7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
10cfdf25af avformat/aiffdec: Check packet size 
Fixes: Fixes infinite loop
Fixes: 26575/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-5727522236661760

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ba71a72d3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
f1f6d6c861 avformat/concatdec: use av_strstart() 
Fixes: out array read
Fixes: 26610/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-5631838049271808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2610acb49a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
021e2b9cf1 avformat/wavdec: Refuse to read chunks bigger than the filesize in w64_read_header() 
Fixes: OOM
Fixes: 26414/clusterfuzz-testcase-minimized-ffmpeg_dem_FWSE_fuzzer-5070632544632832
Fixes: 26475/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5770207722995712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7b2244565a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
51cdea6e4f avformat/iff: More completely check body_size 
Fixes: infinite loop
Fixes: 26485/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5126561373880320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3588e2e6b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
cf572adb92 avformat/xwma: Check for EOF in dpds_table read code 
Fixes: Timeout (>30 -> 140ms)
Fixes: 26478/clusterfuzz-testcase-minimized-ffmpeg_dem_XWMA_fuzzer-5918147066200064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 44b18a76b8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
4ecce5f256 avcodec/utils: Check sample rate before use for AV_CODEC_ID_BINKAUDIO_DCT in get_audio_frame_duration() 
Fixes: shift exponent 95 is too large for 32-bit type 'int'
Fixes: 26590/clusterfuzz-testcase-minimized-ffmpeg_dem_SMACKER_fuzzer-5120609937522688

Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ec7e0d4288)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
8206115257 avcodec/dirac_parser: do not offset AV_NOPTS_OFFSET 
Fixes: signed integer overflow: -9223372036854775807 - 48000 cannot be represented in type 'long long'
Fixes: 26521/clusterfuzz-testcase-minimized-ffmpeg_dem_DIRAC_fuzzer-5635536506847232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 343c3149ab)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
39d8fb2f67 avformat/rmdec: Make expected_len 64bit 
Fixes: signed integer overflow: 1347551268 * 14 cannot be represented in type 'int'
Fixes: 26458/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-5655364324032512

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 728330462c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
5a1cc01fdf avformat/lrcdec: Clip timestamps 
Fixes: signed integer overflow: 7111111111111531010 - -7335632962598013506 cannot be represented in type 'long'
Fixes: 26463/clusterfuzz-testcase-minimized-ffmpeg_dem_LRC_fuzzer-6015558333759488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 80bc2ac3c0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
2c6b8fadfc avformat/electronicarts: Check for EOF in each iteration of the loop in ea_read_packet() 
Fixes: timeout(>20sec -> 1ms)
Fixes: 26526/clusterfuzz-testcase-minimized-ffmpeg_dem_EA_fuzzer-5672328069120000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 857aba7c45)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
c4b7fbc981 avcodec/vp9dsp_template: Fix some overflows in iadst8_1d() 
Fixes: signed integer overflow: 190587 * 11585 cannot be represented in type 'int'
Fixes: 26407/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5086348408782848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bca0735be5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
0abb64d8f3 avformat/jacosubdec: Use 64bit inside get_shift() 
Fixes: signed integer overflow: 111111111 * 30 cannot be represented in type 'int'
Fixes: 26448/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-5638440374501376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 715ff75e5d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
b71b8cba2e avformat/genh: Check block_align 
Fixes: infinite loop
Fixes: 26440/clusterfuzz-testcase-minimized-ffmpeg_dem_GENH_fuzzer-5632134020333568

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 37396e9ba8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
1639916eef avformat/mvi: Check count for overflow 
Fixes: left shift of 21378748 by 10 places cannot be represented in type 'int'
Fixes: 26449/clusterfuzz-testcase-minimized-ffmpeg_dem_MVI_fuzzer-5680463374712832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a413ed9863)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00