highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
89,055 Commits 36 Branches 392 Tags
a2d45c6b9a8fb713a48c282075105f99c9f27f3b
Commit Graph

89055 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer
a2d45c6b9a avfilter/vf_ciescope: Fix undefined behavior in rgb_to_xy() with black 
Fixes: floating point division by 0
Fixes: undefined behavior in handling NaN
Fixes: Ticket 8268

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3d500e62f6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
226d608e95 avformat/rpl: Check for EOF and zero framesize 
Fixes: Infinite loop
Fixes: 34751/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-5439330800762880
Fixes: 34774/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-5851571660390400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a0a4a527c3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
2e36b0d55a avcodec/vc2enc: Check for non negative slice bounds 
Fixes: invalid shifts
Fixes: Ticket 8221

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f7862e8268)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
5f44a99a60 avformat/rpl: Use 64bit in bitrate computation and check it 
Fixes: signed integer overflow: 777777776 * 4 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-6726188921913344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 29b244ffc1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
a3f8ddabde avcodec/svq1enc: Do not print debug RD value before it has been computed 
Avoids floating point division by 0

Fixes: Ticket8191

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c297f7e57a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
92f83a2147 avcodec/aacpsy: Check bandwidth 
Fixes: Ticket8011

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 36dead4bc2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
bcab3700df avcodec/aacenc: Do not divide by lambda_count if it is 0 
Avoids Floating point division by 0

Fixes: Ticket8011

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c520b98691)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
0c71bd5ebf avcodec/aacenc: Use FLT_EPSILON for lambda minimum 
(cherry picked from commit 4b89cf7aa4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
ed9f251a5d avformat/cinedec: Fix index_entries size check 
Fixes: out of array access
Fixes: 29868/clusterfuzz-testcase-minimized-ffmpeg_dem_CINE_fuzzer-5692001957445632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
1c5391ce1c avfilter/vf_yadif: Fix handing of tiny images 
Fixes: out of array access
Fixes: Ticket8240
Fixes: CVE-2020-22021

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7971f62120)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bb08ee0c6fb7bdebd37cbf00aefed206909e8f78)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
c2ae301888 avfilter/vf_vmafmotion: Check dimensions 
Fixes: out of array access
Fixes: Ticket8241
Fixes: Ticket8246
Fixes: CVE-2020-22019
Fixes: CVE-2020-22033

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 82ad1b7675)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
a4a70c1568 avformat/movenc: Check pal_size before use 
Fixes: assertion failure
Fixes: out of array read
Fixes: Ticket8190
Fixes: CVE-2020-22015

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4c1afa2925)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
3d97ab7dad avcodec/lpc: Avoid floating point division by 0 
Fixes: Ticket7996
Fixes: CVE-2020-20445

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 38d18fb578)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
f07177cb71 avcodec/aacpsy: Avoid floating point division by 0 of norm_fac 
Fixes: Ticket7995
Fixes: CVE-2020-20446

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 223b5e8ac9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
00446f74ad avcodec/aacenc: Avoid 0 lambda 
Fixes: Ticket8003
Fixes: CVE-2020-20453

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a7a7f32c8a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
95cacdbbca avcodec/exr: x/ymax cannot be INT_MAX 
The code uses x/ymax + 1 so the maximum is INT_MAX-1

Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 33158/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5545462457303040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 48342aa075)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
fcff15dc06 avformat/avio: Check av_opt_copy() for failure 
Fixes: CID1477416 Unchecked return value

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f8611ae1ef)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
c46b016b1d avcodec/vc1: Check remaining bits in ff_vc1_parse_frame_header() 
Fixes: Timeout
Fixes: 33156/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-6259655027326976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 38c4761588)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
7ba104475a avformat/mov: Ignore duplicate CoLL 
Fixes: memleak
Fixes: 32146/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5377612845285376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9548dc74d8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
34880e3541 avformat/mov: Limit nb_chapter_tracks to input size 
Fixes: Timeout (15k loop iterations instead of 400m)
Fixes: 31368/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6601583174483968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 299a56c900)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
78f4185041 avformat/utils: Use 64bit earlier in r_frame_rate check 
Fixes: signed integer overflow: 1406796319 * 2 cannot be represented in type 'int'
Fixes: 32777/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5632576913014784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 578633fc1a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
1c48b56a0e avformat/mvdec: Check sample rate in parse_audio_var() 
Fixes: signed integer overflow: -635424002382840000 * 16 cannot be represented in type 'long'
Fixes: 33612/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5704741108711424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ff60249a5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
4da6a18395 avcodec/faxcompr: Check for end of bitstream in decode_group3_1d_line() and decode_group3_2d_line() 
Fixes: infinite loop
Fixes: 33674/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4816457818046464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 08d2df4153)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
78da48bb74 avcodec/utils: treat PAL8 for jpegs similar to other colorspaces 
Fixes: out of array access
Fixes: 33713/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5778775641030656
Fixes: 33717/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-4960397238075392
Fixes: 33718/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-5314270096130048.fuzz
Fixes: 33719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5352721864589312
Fixes: 33721/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-5938892055379968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f0ce023ddb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
2a5d44e3cb avcodec/jpeglsdec: Set alpha plane in PAL8 so image is not 100% transparent 
Fixes: tickets/3933/128.jls

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 011006874c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
0a123f3b67 avformat/asfdec_o: Use ff_get_extradata() 
Fixes: OOM
Fixes: 27240/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-5937469859823616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 098314e1e5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
13a3dc95b9 avformat/id3v2: Check end for overflow in id3v2_parse() 
Fixes: signed integer overflow: 9223372036840103978 + 67637280 cannot be represented in type 'long'
Fixes: 33341/clusterfuzz-testcase-minimized-ffmpeg_dem_DSF_fuzzer-6408154041679872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit efdb564504)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
069ea22b51 avformat/wtvdec: Improve size overflow checks in parse_chunks() 
Fixes: signed integer overflow: 32 + 2147483647 cannot be represented in type 'int
Fixes: 32967/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5132856218222592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f8ec1da8ac)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
7cd4ac4b2d avcodec/faxcompr: Check remaining bits on error in decode_group3_1d_line() 
Fixes: Timeout
Fixes: 32886/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4779761466474496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7b3881f0da)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
175c3a0904 avcodec/utils: Check ima wav duration for overflow 
Fixes: signed integer overflow: 44331634 * 65 cannot be represented in type 'int'
Fixes: 32120/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-5760221223583744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f40e9b1355)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
b4eeac2a1b avformat/cafdec: Check channels 
Fixes: signed integer overflow: -1184429040541376544 * 32 cannot be represented in type 'long'
Fixes: 31788/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6236746338664448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 641c1db22b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
6128c6f338 avcodec/dpx: Check bits_per_color earlier 
Fixes: shift exponent 251 is too large for 32-bit type 'int'
Fixes: 32147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DPX_fuzzer-5519111675314176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c093eb3031)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
f4916e5c97 avcodec/pnm_parser: Check image size addition for overflow 
Fixes: assertion failure
Fixes: out of array access
Fixes: 32664/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-6533642202513408.fuzz
Fixes: 32669/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-6001928875147264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 79ac8d5546)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
3264d9f546 avformat/rmdec: use larger intermediate type for audio_framesize * sub_packet_h check 
Fixes: signed integer overflow: 65535 * 65535 cannot be represented in type 'int'
Fixes: 31406/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5024692843970560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cf2fd9204b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
5911f7bbf1 avcodec/h264_slice: Check input SPS in ff_h264_update_thread_context() 
Fixes: crash
Fixes: check_pkt.mp4

Found-by: Rafael Dutra <rafael.dutra@cispa.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ceae92cb29)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
9689bc0c5c avcodec/mpegvideo: Update chroma_?_shift in ff_mpv_common_frame_size_change() 
Fixes: out of array access
Fixes: 31201/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4627865612189696.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 87d87e6587)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
e6d3ace07e avformat/mov: Ignore multiple STSC / STCO 
Fixes: STSC / STCO inconsistency and assertion failure
Fixes: crbug1184666.mp4

Found-by: Chromium ASAN fuzzer
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2611d20d35)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
5c9eaff60c avformat/utils: Extend overflow check in dts wrap in compute_pkt_fields() 
Fixes: signed integer overflow: -9223372032574480351 - 4294967296 cannot be represented in type 'long long'
Fixes: 30022/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5568610275819520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b37ff29e0e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
5ca2ee38e8 avfilter/vf_scale: Fix adding 0 to NULL (which is UB) in scale_slice() 
Found-by: Jeremy Leconte <jleconte@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1cf96ce269)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
8adb20d3de avutil/common: Add FF_PTR_ADD() 
Suggested-by: Andreas Rheinhardt
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 522a5259e9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
bc4a1f63fb avformat/wtvdec: Check size in SBE2_STREAM_DESC_EVENT / stream2_guid 
Fixes: signed integer overflow: 539033600 - -1910497124 cannot be represented in type 'int'
Fixes: 30928/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5922630966312960

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1f74661543)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
578b4ce853 avformat/cafdec: Do not build an index if all packets are the same 
Fixes: Timeout
Fixes: 28214/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6495999421579264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ea12590c8e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
843437a14a avcodec/sonic: Use unsigned temporary in predictor_calc_error() 
Fixes: signed integer overflow: -2147471366 - 18638 cannot be represented in type 'int'
Fixes: 30157/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5171199746506752

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 075d793ba8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
f5e2d548f1 avformat/flvdec: Check array entry number 
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 30209/clusterfuzz-testcase-minimized-ffmpeg_dem_FLV_fuzzer-5724831658147840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b5d8fe1c87)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
564a4331fd avcodec/h264_slice: Check sps in h264_slice_header_init() 
Fixes: null pointer dereference
Fixes: h264_slice_header_init.mp4

Found-by: Rafael Dutra <rafael.dutra@cispa.de>
Tested-by: Rafael Dutra <rafael.dutra@cispa.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8047243899)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
c932b82cc9 avformat/movenc: Avoid loosing cluster array on failure 
Fixes: crash
Fixes: check_pkt.mp4

Found-by: Rafael Dutra <rafael.dutra@cispa.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5c2ff44f91)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
225d542c34 avformat/avidec: Check for dv streams before using priv_data in parse ##dc/##wb 
Fixes: null pointer dereference
Fixes: 31588/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6165716135968768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f733688d30)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
cf88ca01da avformat/mov: Check sample size for overflow in mov_parse_stsd_audio() 
Fixes: signed integer overflow: 2 * 1914708000 cannot be represented in type 'int'
Fixes: 31639/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6303428239294464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d35677736a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
6114ba9ee1 avcodec/ffwavesynth: Avoid signed integer overflow in phi_at() 
Fixes: signed integer overflow: 2314885530818453536 - -9070214327174160352 cannot be represented in type 'long'
Fixes: 31000/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-6558389742206976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit be08b84f8b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00
Michael Niedermayer
5c3e640624 avcodec/mpeg4videoenc: Check extradata malloc() 
Fixes: Null pointer dereference
Fixes: any mpeg4 testcase which fails the malloc at that exact spot

Found-by: Rafael Dutra <rafael.dutra@cispa.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 33a1687bf6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:49 +02:00