Michael Niedermayer
d2dba39204
avcodec/targa_y216dec: Fix width type
...
Fixes out of array access
Fixes: 1376/clusterfuzz-testcase-minimized-6361794975105024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3e56db8926michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
91394cc4da
avcodec/ivi_dsp: Fix multiple left shift of negative value -2
...
Fixes: 1385/clusterfuzz-testcase-minimized-5552882663292928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9e88cc94e5michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
833a759d40
avcodec/svq3: Fix multiple runtime error: signed integer overflow: 44161 * 61694 cannot be represented in type 'int'
...
Fixes: 1382/clusterfuzz-testcase-minimized-6013445293998080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 669419939cmichael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
906c9d0804
avcodec/msmpeg4dec: Correct table depth
...
Fixes undefined shift
Fixes: 1381/clusterfuzz-testcase-minimized-5513944540119040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1121d92707michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
5b56c2d83a
avcodec/dds: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
...
Fixes: 1380/clusterfuzz-testcase-minimized-650122545122508
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8a8335de03michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
191e0f7e2b
avcodec/cdxl: Check format parameter
...
Fixes out of array access
Fixes: 1378/clusterfuzz-testcase-minimized-5715088008806400
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e1b60aad77michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
224ed78e72
avutil/softfloat: Fix overflow in av_div_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 277e397eb5michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
d68870a606
avcodec/hq_hqa: Fix runtime error: left shift of negative value -207
...
Fixes: 1375/clusterfuzz-testcase-minimized-6070134701555712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1283c42447michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
afbe970534
avcodec/mss3: Change types in rac_get_model_sym() to match the types they are initialized from
...
Fixes integer overflow
Fixes: 1372/clusterfuzz-testcase-minimized-5712192982745088
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2ef0f39271michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
b9289fad4b
avcodec/shorten: Check k in get_uint()
...
Fixes: undefined shift
Fixes: 1371/clusterfuzz-testcase-minimized-5770822591447040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7b6a51f59cmichael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
ff27d17348
avcodec/webp: Fix null pointer dereference
...
Fixes: 1369/clusterfuzz-testcase-minimized-5048908029886464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9bf4523e40michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
1951a44d77
avcodec/dfa: Fix signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
...
Fixes: 1368/clusterfuzz-testcase-minimized-4507293276176384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 12936a4585michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
54368ac9b3
avcodec/mimic: Fix runtime error: left shift of negative value -1
...
Fixes: 1365/clusterfuzz-testcase-minimized-5624158450876416
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fc2c420b82michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
ce0db291c6
avcodec/fic: Fix multiple left shift of negative value -15
...
Fixes: 1356/clusterfuzz-testcase-minimized-6008489086287872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b20c71409bmichael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
00371aff3d
avcodec/mlpdec: Fix runtime error: left shift of negative value -22
...
Fixes: 1355/clusterfuzz-testcase-minimized-6662205472768000
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c535436cbemichael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
acb589b12d
avcodec/snowdec: Check qbias
...
Fixes: signed integer overflow: -1094995529 * 131 cannot be represented in type 'int'
Fixes: 1353/clusterfuzz-testcase-minimized-5208180449607680
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 523205ce1emichael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
5dec065a4d
avutil/softfloat: Fix multiple runtime error: left shift of negative value -8
...
Fixes: 1352/clusterfuzz-testcase-minimized-5757565017260032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 35f3df0d76michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
ddab43d3a8
avcodec/aacsbr_template: Do not leave bs_num_env invalid
...
Fixes out of array read
Fixes: 1349/clusterfuzz-testcase-minimized-5370707196248064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a8ad83b793michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
51b8a78851
avcodec/mdec: Fix signed integer overflow: 28835400 * 83 cannot be represented in type 'int'
...
Fixes: 1346/clusterfuzz-testcase-minimized-5776732600664064
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a234b5ade3michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
1e9fa7c69f
avcodec/dfa: Fix off by 1 error
...
Fixes out of array access
Fixes: 1345/clusterfuzz-testcase-minimized-6062963045695488
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f52fbf4f3emichael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
cd6c4082db
avcodec/nellymoser: Fix multiple left shift of negative value -8591
...
Fixes: 1342/clusterfuzz-testcase-minimized-5490842129137664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0953736b7emichael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
3366d18c29
avcodec/cdxl: Fix signed integer overflow: 14243456 * 164 cannot be represented in type 'int'
...
Fixes: 1341/clusterfuzz-testcase-minimized-5441502618583040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1002932a3bmichael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
cacae0656f
avcodec/g722: Fix multiple runtime error: left shift of negative value -1
...
Fixes: 1340/clusterfuzz-testcase-minimized-4669892148068352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f55df62998michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
a6e7636dac
avcodec/dss_sp: Fix multiple left shift of negative value -466
...
Fixes: 1339/clusterfuzz-testcase-minimized-4614671485108224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 38152d9368michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
2197423ec9
avcodec/wnv1: Fix runtime error: left shift of negative value -1
...
Fixes: 1338/clusterfuzz-testcase-minimized-6485546354343936
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9fac508ca4michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
e924213492
avcodec/tiertexseqv: set the fixed dimenasions, do not depend on the demuxer doing so
...
Fixes: out of array access
Fixes: 1348/clusterfuzz-testcase-minimized-6195673642827776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ce551a3925michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
7ab6224083
avcodec/mjpegdec: Fix runtime error: signed integer overflow: -24543 * 2031616 cannot be represented in type 'int'
...
Fixes: 943/clusterfuzz-testcase-5114865297391616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a78ae465fdmichael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
e45de9d279
avcodec/cavsdec: Fix undefined behavior from integer overflow
...
Fixes: 1335/clusterfuzz-testcase-minimized-5566961566089216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a0e5f7f363michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
65bc41b857
avcodec/dvdsubdec: Fix runtime error: left shift of 242 by 24 places cannot be represented in type 'int'
...
Fixes: 1080/clusterfuzz-testcase-5353236754071552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ce7098b8f2michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
7dc7d70644
libavcodec/mpeg4videodec: Convert sprite_offset to 64bit
...
This avoids intermediates from overflowing (the final values are checked)
Fixes: runtime error: signed integer overflow: -167712 + -2147352576 cannot be represented in type 'int'
Fixes: 1298/clusterfuzz-testcase-minimized-5955580877340672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c1c3a14073michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
4ea21dd574
avcodec/pngdec: Use ff_set_dimensions()
...
Fixes OOM
Fixes: 1314/clusterfuzz-testcase-minimized-4621997222920192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a0296fc056michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
0a391b738e
avcodec/msvideo1: Check buffer size before re-getting the frame
...
Fixes timeout
Fixes: 1306/clusterfuzz-testcase-minimized-6152296217968640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cabfed6895michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
533999aaad
avcodec/h264_cavlc: Fix undefined behavior on qscale overflow
...
Fixes: 1214/clusterfuzz-testcase-minimized-6130606599569408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit fc8cff96edmichael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
9d2939a791
avcodec/svq3: Increase offsets to prevent integer overflows
...
Fixes: 1280/clusterfuzz-testcase-minimized-6102353767825408
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 382b4fc9b5michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
97458a040f
avcodec/indeo2: Check remaining bits in ir2_decode_plane()
...
Fixes: 1290/clusterfuzz-testcase-minimized-5815578902134784
Fixes: timeout
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b29feec982michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
7f5c9250de
avcodec/vp3: Check remaining bits in unpack_dct_coeffs()
...
Decreases the time spend decoding junk.
May fix: 1283/clusterfuzz-testcase-minimized-6221126759874560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2f00300b77michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
37f5bfaa2b
avcodec/mdec: Fix runtime error: left shift of negative value -127
...
Fixes undefined behavior
Fixes: 1275/clusterfuzz-testcase-minimized-6718162017976320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ca82975b7michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Martin Vignali
d1b23e5c0c
libavcodec/exr : fix float to uint16 conversion for negative float value
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e46d637452michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Derek Buitenhuis
77dd220385
avformat/webmdashenc: Validate the 'streams' adaptation sets parameter
...
It should not be a value larger than the number of streams we have,
or it will cause invalid reads and/or SIGSEGV.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ec07efa700michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Derek Buitenhuis
436f1d4562
avformat/webmdashenc: Require the 'adaptation_sets' option to be set
...
This seems to be non-optional, and if the muxer is run without it,
strlen() is run on NULL, causing a segfault.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cbd3a68f3emichael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
3fd8e79dc9
avcodec/dvdsubdec: Fixes 2 runtime error: left shift of 170 by 24 places cannot be represented in type 'int'
...
Fixes: 619/clusterfuzz-testcase-5803914534322176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 61ee2ca775michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
cbd0036856
avfilter/avfiltergraph: Add assert to write down in machine readable form what is assumed about sample rates in swap_samplerates_on_filter()
...
Fixes CID1397292
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5f2b360fc0michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
344e5de993
avcodec/tiff: Perform multiply in tiff_unpack_lzma() as 64bit
...
This should make no difference as the value should not be able to be that large
but its more correct this way
Fixes CID1348138
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f48b6b8b91michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Philip Langdale
9c7730417d
avcodec/vdpau_hevc: Fix potential out-of-bounds write
...
The maximum number of references is 16, so the index value cannot
exceed 15.
Fixes Coverity CID 1348139, 1348140, 1348141
(cherry picked from commit 4e6d1c1f4emichael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
95594b9815
avcodec/tiff: Check geotag count for being non zero
...
Fixes memleak
Fixes: 874/clusterfuzz-testcase-5252796175613952
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3182e19c1cmichael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
a2a028af6e
avcodec/vp56: Check avctx->error_concealment before enabling EC
...
Fixes timeout with 847/clusterfuzz-testcase-5291877358108672
Fixes timeout with 850/clusterfuzz-testcase-5721296509861888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 98da63b3f5michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
26b2b2d052
avcodec/tiff: Check stripsize strippos for overflow
...
Fixes: 861/clusterfuzz-testcase-5688284384591872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d996b5649michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
17624e4156
avcodec/mpegaudiodec_template: Make l3_unscale() work with e=0
...
Fixes undefined behavior
Fixes: 830/clusterfuzz-testcase-6253175327686656
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ebed703f1michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
b34ca8295d
avcodec/tiff: Check for multiple geo key directories
...
Fixes memleak
Fixes: 826/clusterfuzz-testcase-5316921379520512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 108b02e547michael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
Michael Niedermayer
922013c983
avcodec/wavpack: Fix runtime error: shift exponent 32 is too large for 32-bit type 'int'
...
Fixes: 822/clusterfuzz-testcase-4873433189974016
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7cebc5a9ccmichael@niedermayer.cc >
2017-05-20 03:41:33 +02:00
