highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
95,555 Commits 36 Branches 392 Tags
a5930f43687d575d16e0d95b4a859d5358059c80
Commit Graph

95555 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer
a5930f4368 Use https for repository links 
Reviewed-by: Stefano Sabatini <stefasab@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 011f30fc82)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:16 +02:00
Michael Niedermayer
8215c6b21c avcodec/motionpixels: Mask pixels to valid values 
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOTIONPIXELS_fuzzer-6724203352555520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ac6eec1fc2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:16 +02:00
Michael Niedermayer
fbe41b907a avcodec/xpmdec: Check size before allocation to avoid truncation 
Fixes:OOM
Fixes:out of array access (no testcase)
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XPM_fuzzer-6573323838685184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 95f0f84dae)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:16 +02:00
Michael Niedermayer
83e73df00e avcodec/bink: Avoid undefined out of array end pointers in binkb_decode_plane() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ea9deafd3b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:15 +02:00
Michael Niedermayer
7cba5ebd7d avcodec/bink: Fix off by 1 error in ref end 
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6657932926517248

Alterantivly to this it is possibly to allocate a bigger array

Note: oss-fuzz assigned this issue to a unrelated theora bug so the bug number matches that

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 49487045dd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:15 +02:00
Michael Niedermayer
94687a5eff avcodec/utils: Ensure linesize for SVQ3 
Fixes: Assertion block_w * sizeof(uint8_t) <= ((buf_linesize) >= 0 ? (buf_linesize) : (-(buf_linesize))
Fixes: 54861/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-5352418248622080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4eef658ca5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:15 +02:00
Michael Niedermayer
0c30285132 avcodec/utils: allocate a line more for VC1 and WMV3 
Fixes: out of array read on 32bit
Fixes: 54857/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5840588224462848

The chroma MC code reads over the currently allocated frame.
Alternative fixes would be allocating a few bytes more at the end instead of a whole
line extra or to adjust the threshold where the edge emu code is activated

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 01636a63d4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:14 +02:00
Michael Niedermayer
ed78f71c6a avcodec/videodsp_template: Adjust pointers to avoid undefined pointer things 
Fixes: subtraction of unsigned offset from 0xf6602770 overflowed to 0xf6638c80
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-495074400600064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f0150cd41c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:14 +02:00
Michael Niedermayer
6875531f44 avcodec/pngdec: Check deloco index more exactly 
Fixes: out of array access:
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PNG_fuzzer-6716193709096960

Alternatively it should be possible to limit this to 3 plane RGB 8 /16bit to ensure the size is what it should be

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d5bae70406)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:14 +02:00
Michael Niedermayer
747cefb8e6 avcodec/ffv1dec: Check that num h/v slices is supported 
Fixes: out of array access
Fixes: 55597/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-4898293416329216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8ead0ae68e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:13 +02:00
Michael Niedermayer
26a98f0dba avformat/mov: Check samplesize and offset to avoid integer overflow 
Fixes: signed integer overflow: 9223372036854775584 + 536870912 cannot be represented in type 'long'
Fixes: 55844/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-510613920664780

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 53c1f5c2e2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:13 +02:00
Michael Niedermayer
1e6d77a4ce avcodec/pictordec: Remove mid exit branch 
This causes the RLE decoder to exit before applying the last RLE run
All images i tested with are unchanged, this makes the special case
for handling the last run unused for non truncated images.

Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 88f0e05c72)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:13 +02:00
Michael Niedermayer
f952c536ef avcodec/eac3dec: avoid float noise in fixed mode addition to overflow 
Fixes: 2.28595e+09 is outside the range of representable values of type 'int'
Fixes: 54644/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AC3_FIXED_fuzzer-4816961584627712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2f48d227c1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:12 +02:00
Michael Niedermayer
22cca60c21 avcodec/utils: use 32pixel alignment for bink 
bink supports 16x16 blocks in chroma planes thus we need to allocate enough.
Fixes: out of array access
Fixes: 55026/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6013915371012096
Reviewed-by: Peter Ross <pross@xvid.org>

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b95b2c8492)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:12 +02:00
Michael Niedermayer
1f8a4e35a1 avcodec/scpr3: Check bx 
Fixes: Out of array access
Fixes: 55102/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-4877396618903552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cc7e984a05)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:12 +02:00
Michael Niedermayer
85b4c5c106 avcodec/012v: Order operations for odd size handling 
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZERO12V_fuzzer-6714182078955520.fuzz
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZERO12V_fuzzer-6698145212137472.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4d42d82563)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:11 +02:00
Michael Niedermayer
102384cd7d avcodec/eatgq: : Check index increments in tgq_decode_block() 
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATGQ_fuzzer-6743211456724992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e7755b433e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:11 +02:00
Michael Niedermayer
5cc68bb176 avcodec/scpr: Test bx before use 
Fixes: out of array access on 32bit
Fixes: 54850/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-5302669294305280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b59de3770)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:11 +02:00
Michael Niedermayer
255794f034 avcodec/sunrast: Fix maplength check 
Fixes: out of bounds read

Found-by: Ibrahim Mohamed <ielsayed@meta.com>
Reviewed-by; Ibrahim Mohamed <ielsayed@meta.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f8a2a65078)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:10 +02:00
Michael Niedermayer
e02bd11090 avcodec/wavpack: Avoid undefined shift in get_tail() 
Fixes: left shift of 1208485947 by 1 places cannot be represented in type 'int'
Fixes: 54058/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5827521084260352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8374a747af)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:10 +02:00
Michael Niedermayer
9980d388b9 avformat/id3v2: Check taglen in read_uslt() 
Fixes: Timeout (read mostly the same data repeatly)
Fixes: 52457/clusterfuzz-testcase-minimized-ffmpeg_dem_ALP_fuzzer-6610706313379840
Fixes: 53098/clusterfuzz-testcase-minimized-ffmpeg_dem_SOL_fuzzer-6481382981632000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a798af91d7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:10 +02:00
Michael Niedermayer
c4c1c28207 avcodec/ffv1dec: restructure slice coordinate reading a bit 
Fixes: signed integer overflow: -1094995528 * 8224 cannot be represented in type 'int'
Fixes: 53508/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-474551033462784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 74b6ac7ebb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:09 +02:00
Michael Niedermayer
60d1f87b30 avcodec/mlpdec: Check max matrix instead of max channel in noise check 
This is a regression since: adaa06581c
Before this, max_channel and  max_matrix_channel where compared for equality

Fixes: out of array access
Fixes: 53340/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-514959011885875

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aa79560de5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:09 +02:00
Michael Niedermayer
a604063ede swscale/input: Use more unsigned intermediates 
Same principle as previous commit, with sufficiently huge rgb2yuv table
values this produces wrong results and undefined behavior.
The unsigned produces the same incorrect results. That is probably
ok as these cases with huge values seem not to occur in any real
use case.

Fixes: signed integer overflow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ba209e3d51)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:09 +02:00
Michael Niedermayer
5f61c15e3c avcodec/alsdec: The minimal block is at least 7 bits 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5280947fb6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:08 +02:00
Michael Niedermayer
e205351fa9 avformat/replaygain: avoid undefined / negative abs 
Fixes: signed integer overflow: -2147483648 * 100000 cannot be represented in type 'int'
Fixes: 52060/clusterfuzz-testcase-minimized-ffmpeg_dem_MP3_fuzzer-5131616708329472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2532b20b17)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:08 +02:00
Michael Niedermayer
87df8385b8 swscale/output: Bias 16bps output calculations to improve non overflowing range 
Fixes: integer overflow
Fixes: ./ffmpeg   -f rawvideo -video_size 66x64 -pixel_format yuva420p10le   -i ~/videos/overflow_input_w66h64.yuva420p10le   -filter_complex "scale=flags=bicubic+full_chroma_int+full_chroma_inp+bitexact+accurate_rnd:in_color_matrix=bt2020:out_color_matrix=bt2020:in_range=full:out_range=full,format=rgba64[out]"   -pixel_format rgba64 -map '[out]'   -y overflow_w66h64.png

Found-by: Drew Dunne <asdunne@google.com>
Tested-by: Drew Dunne <asdunne@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0f0afc7fb5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:08 +02:00
Michael Niedermayer
4d5e869ea7 avcodec/speedhq: Check buf_size to be big enough for DC 
Fixes: Timeout
Fixes: 51919/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-6023716480090112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9184d3d7b6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:55:07 +02:00
Michael Niedermayer
f0e536f603 avcodec/ffv1dec: Fail earlier if prior context is corrupted 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4df91e2215)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-21 01:54:53 +02:00
Timo Rothenpieler
a1b534bf83 avcodec/nvenc: fix vbv buffer size in cq mode 
The CQ calculation gets thrown off and behaves very nonsensical
if it isn't set to 0.
 2022-12-08 12:40:51 +01:00
James Almer
e228a0cccd avcodec/mjpegenc: take into account component count when writing the SOF header size 
Fixes ticket #10069

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 1009396953)
 2022-11-28 08:48:07 -03:00
Martin Storsjö
b4f2eb31dd checkasm: float_dsp: Scale FLT/DBL_EPSILON sufficiently when comparing 
As the values generated by av_bmg_get can be arbitrarily large
(only the stddev is specified), we can't use a fixed tolerance.

This matches what was done for test_vector_dmul_scalar in
38f966b222.

This fixes the float_dsp checkasm test for some seeds, when built
with clang for mingw/x86_32.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 8f70e261fa)

Fixes ticket #10010
 2022-11-06 20:49:24 +01:00
Martin Storsjö
9d5450b514 swscale: aarch64: Fix yuv2rgb with negative strides 
Treat the 32 bit stride registers as signed.

Alternatively, we could make the stride arguments ptrdiff_t instead
of int, and changing all of the assembly to operate on these
registers with their full 64 bit width, but that's a much larger
and more intrusive change (and risks missing some operation, which
would clamp the intermediates to 32 bit still).

Fixes: https://trac.ffmpeg.org/ticket/9985

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit cb803a0072)
Signed-off-by: Martin Storsjö <martin@martin.st>
 2022-11-04 14:32:34 +02:00
Michael Niedermayer
4fb9e37c9f Update for 4.2.8 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
n4.2.8 		2022-10-09 22:09:57 +02:00
Michael Niedermayer
6447e6bb09 avformat/vividas: Check packet size 
Fixes: signed integer overflow: 119760682 - -2084600173 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-6745781167587328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f44489cc5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-09 21:33:12 +02:00
Michael Niedermayer
23d078dbd1 avcodec/dstdec: Check for overflow in build_filter() 
Fixes: signed integer overflow: 1917019860 + 265558963 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-4833165046317056

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8008940da5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-09 21:33:11 +02:00
Michael Niedermayer
674f7c87c9 avformat/spdifdec: Use 64bit to compute bit rate 
Fixes: signed integer overflow: 32 * 553590816 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-6564974517944320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4075f0cec1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-09 21:33:11 +02:00
Michael Niedermayer
619612ac01 avformat/rpl: Use 64bit for duration computation 
Fixes: signed integer overflow: 24709512 * 88 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6737973728641024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 529f64b2eb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-09 21:33:11 +02:00
Michael Niedermayer
caa009a3fb avformat/xwma: Use av_rescale() for duration computation 
Fixes: signed integer overflow: 34242363648 * 538976288 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6577923913547776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2c789f753c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-09 21:33:10 +02:00
Michael Niedermayer
3f283529f7 avformat/sdsdec: Use av_rescale() to avoid intermediate overflow in duration calculation 
Fixes: signed integer overflow: 72128794995445727 * 240 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_SDS_fuzzer-6628185583779840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aa8eb1bed0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-09 21:33:10 +02:00
Michael Niedermayer
0a5e3c39eb avformat/rmdec: check tag_size 
Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6598073725353984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2cb7ee8a36)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-09 21:33:10 +02:00
Michael Niedermayer
8ab83a7714 avformat/nutdec: Check fields 
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6566001610719232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2c146406ea)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-09 21:33:09 +02:00
Michael Niedermayer
a3169bd843 avformat/flvdec: Use 64bit for sum_flv_tag_size 
Fixes: signed integer overflow: 2138820085 + 16130322 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_LIVE_FLV_fuzzer-6704728165187584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7124f10c1d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-09 21:33:09 +02:00
Michael Niedermayer
cc57578a35 avformat/dxa: avoid bpc overflows 
Fixes: signed integer overflow: 2147483647 + 32 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-6639823726706688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 93db0f0740)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-09 21:33:09 +02:00
Michael Niedermayer
bf1893f342 avformat/cafdec: Check that nb_frasmes fits within 64bit 
Fixes: signed integer overflow: 1099511693312 * 538976288 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6565048815845376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d4bb4e3759)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-09 21:33:08 +02:00
Michael Niedermayer
0c56afb8d6 avformat/asfdec_o: Limit packet offset 
avoids overflows with it

Fixes: signed integer overflow: 9223372036846866010 + 4294967047 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6538296768987136
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-657169555665715

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 736e9e69d5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-09 21:33:08 +02:00
Michael Niedermayer
4235afc12c avformat/ape: Check frames size 
Fixes: signed integer overflow: 9223372036854775806 + 3 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_APE_fuzzer-6389264140599296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d0349c9929)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-09 21:33:08 +02:00
Michael Niedermayer
297ef9edd9 avformat/icodec: Check nb_pal 
Fixes: signed integer overflow: 538976288 * 4 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-6690068904935424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit db73ae0dc1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-09 21:33:07 +02:00
Michael Niedermayer
9053465771 avformat/aiffdec: Use 64bit for block_duration use 
Fixes: signed integer overflow: 3 * -2147483648 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6668935979728896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9303ba272e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-09 21:33:07 +02:00
Michael Niedermayer
f129928164 avformat/aiffdec: Check block_duration 
Fixes: signed integer overflow: 3 * -2147483648 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6668935979728896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1c2b6265c8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-09 21:33:07 +02:00