highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
102,068 Commits 36 Branches 392 Tags
e9e2ddbc6c78cc18b76093617f82c920e58a8d1f
Commit Graph

102068 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer
e9e2ddbc6c avcodec/g729_parser: Check channels 
Fixes: signed integer overflow: 10 * 808464428 cannot be represented in type 'int'
Fixes: assertion failure
Fixes: ticket9651

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 757da974b2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
061f8b941e avformat/avidec: Check height 
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: Ticket8486

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ec8ff659f5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
261557160f avformat/rmdec: Better duplicate tags check 
Fixes: memleaks
Fixes: 44810/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5619494647627776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 15a646e501)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
338444c016 avformat/mov: Disallow empty sidx 
It appears this is not allowed "Each Segment Index box documents how a (sub)segment is divided into one or more subsegments
(which may themselves be further subdivided using Segment Index boxes)."
Fixes: Null pointer dereference
Fixes: Ticket9517

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4419433d77)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
811047f7c2 avformat/argo_asf: Fix order of operations in error check in argo_asf_write_trailer() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c8c12fb5d6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
5cdceec2f2 avformat/matroskadec: Check duration 
Fixes: -nan is outside the range of representable values of type 'long'
Fixes: 44614/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6216204841254912

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 36680078ca)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
166ee5fa68 avformat/mov: Corner case encryption error cleanup in mov_read_senc() 
Fixes: memleak
Fixes: 42341/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4566632823914496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8ee0e4abcb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
badf284b52 avcodec/jpeglsdec: Fix if( code style 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f306b8e80a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
1caf4f91fb avcodec/jpeglsdec: Check get_ur_golomb_jpegls() for error 
Fixes: Timeout
Fixes: Invalid shift
Fixes: 44548/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-556487680891289
Fixes: 44569/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMV_fuzzer-6302543246917632
Fixes: 44570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-4550196556595200
Fixes: 44592/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5651610385121280
Fixes: 44571/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5094698987945984
Fixes: 44607/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5341352013987840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 151f83584e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
1d8caf2e1f avcodec/motion_est: fix indention of ff_get_best_fcode() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce43e1c581)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
f73e9b73ce avcodec/motion_est: Fix xy indexing on range violation in ff_get_best_fcode() 
This codepath seems untested, no testcases change

Found-by: <mkver>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 634312a70f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
faf66d99c0 avformat/hls: Use unsigned for iv computation 
Fixes: signed integer overflow: 9223372036854775748 + 60 cannot be represented in type 'long'
Fixes: 44417/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-5802443881971712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bf33a38499)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
b356dcb2fe avcodec/jpeglsdec: Increase range for N in ls_get_code_runterm() by using unsigned 
Fixes: left shift of 32768 by 16 places cannot be represented in type 'int'
Fixes: Timeout
Fixes: 44219/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-4679455379947520
Fixes: 44088/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-4885976600674304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6ee283d7d0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
cc4707601d avformat/matroskadec: Check desc_bytes 
Fixes: Division by 0
Fixes: 44035/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4826721386364928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5038933977)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
032672a8f1 avformat/utils: Fix invalid NULL pointer operation in ff_parse_key_value() 
Fixes: pointer index expression with base 0x000000000000 overflowed to 0xffffffffffffffff
Fixes: 44012/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-5670607746891776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 59328aabd2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
d3456a374d avformat/matroskadec: Fix infinite loop with bz decompression 
The same check is added to zlib too, it seems not needed there though

Fixes: Infinite loop
Fixes: 43932/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-6175167573786624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9c3d2cbb51)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
673f8d3641 avformat/mov: Check size before subtraction 
Fixes: signed integer overflow: -9223372036854775808 - 8 cannot be represented in type 'long'
Fixes: 43542/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5237670148702208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d8d9d506a3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
447b9a0f03 avcodec/cfhd: Avoid signed integer overflow in coeff 
Fixes: signed integer overflow: 15244032 * 256 cannot be represented in type 'int'
Fixes: 43504/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-4865014842916864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cd6ac013a0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
65d8418e11 avcodec/apedec: Fix integer overflows in predictor_update_3930() 
Fixes: signed integer overflow: 1074134419 - -1075212485 cannot be represented in type 'int'
Fixes: 43273/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-4706880883130368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0c9c9bbd01)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
6c5e26821e avcodec/apedec: fix integer overflow in 8bit samples 
Fixes: signed integer overflow: 2147483542 + 128 cannot be represented in type 'int'
Fixes: 42812/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6344057861832704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7cee3b3718)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
be0109b881 avformat/flvdec: timestamps cannot use the full int64 range 
We do not support this as we multiply by 1000
Fixes: signed integer overflow: -45318575073853696 * 1000 cannot be represented in type 'long'
Fixes: 42804/clusterfuzz-testcase-minimized-ffmpeg_dem_LIVE_FLV_fuzzer-4630325425209344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c217ca7718)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
3fe61f91b3 avcodec/tiff: Remove messing with jpeg context 
The whole concept is just not correct, also as it seems not to be needed
at all, all dng files i have decode without this.

Fixes: various crashes
Fixes: 42937/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4625073334517760
Fixes: 42938/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4643368217477120
Fixes: 42939/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4925325908246528
Fixes: 42940/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4925378806808576
Fixes: 42941/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-6202009265504256
Fixes: 42944/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-6076860998483968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit afdbc940c6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
14249d8a03 avcodec/tiff: Use ff_set_dimensions() for setting up mjpeg context dimensions 
sets coded_width / coded_height too to keep them consistent with
width / height

Fixes: OOM
Fixes: 42263/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5653333619113984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cfa1f0e214)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
24da8685f0 avcodec/tiff: Pass max_pixels to mjpeg context 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d6c16f42cc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
e2ae9adbe1 avcodec/vqavideo: reset accounting on error 
Fixes: Timeout (same growing chunk is decoded to failure repeatedly)
Fixes: 42582/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-6531195591065600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d8ea7a67ba)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
02b0143522 avcodec/alacdsp: fix integer overflow in decorrelate_stereo() 
Fixes: signed integer overflow: -16777216 * 131 cannot be represented in type 'int'
Fixes: 23835/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5669943160078336
Fixes: 41101/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-4636330705944576

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 68457c1e85)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
59287d3880 avformat/4xm: Check for duplicate track ids 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dd94912479)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
8f83d2a94a avformat/4xm: Consider max_streams on reallocating tracks array 
Fixes: OOM
Fixes: 41595/clusterfuzz-testcase-minimized-ffmpeg_dem_FOURXM_fuzzer-6355979363549184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0dcd95ef8a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
223b5abcb1 avformat/mov: Check next offset in mov_read_dref() 
Fixes: signed integer overflow: 9223372036200463215 + 1109914409 cannot be represented in type 'long'
Fixes: 41480/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6553086177443840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 562021e2fd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
bbea2c47c7 avformat/vivo: Favor setting fps from explicit fractions 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bf1e93bdc9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
88f619726c avformat/vivo: Do not use the general expression evaluator for parsing a floating point value 
Fixes: Timeout
Fixes: 41564/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVO_fuzzer-6309014024093696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7b24615565)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
f4f397ebc1 avformat/mxfdec: Check for duplicate mxf_read_index_entry_array() 
Fixes: memleak
Fixes: 41596/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6439060204290048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4f44a218e5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
4023a8af63 avcodec/apedec: Change avg to uint32_t 
Fixes: Integer overflow
Fixes: 40973/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6739312704618496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ec75723a4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
8720b1b480 avformat/mxfdec: Check component_depth in mxf_get_color_range() 
Fixes: shift exponent 4294967163 is too large for 32-bit type 'int'
Fixes: 41449/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-6183636217495552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a4af92d7cb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
4846536e67 avformat/mov: Disallow duplicate smdm 
Fixes: memleak
Fixes: 39879/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5327819907923968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b5ba74053c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
a2b5ffb4ac avformat/mov: Check for EOF in mov_read_glbl() 
Fixes: Infinite loop
Fixes: 41351/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5433895854669824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 59b4e7cbd8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
a3041cf48b avcodec/vp3: Check version in all cases when VP4 code is not built 
Fixes: out of array read
Fixes: 40284/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP3_fuzzer-4599568176644096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 96caa01f13)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
4ff9f77240 avformat/mov: Check channels for mov_parse_stsd_audio() 
Fixes: signed integer overflow: -776522110086937600 * 16 cannot be represented in type 'long'
Fixes: 40563/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6644829447127040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3a64a4c582)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
d4ff904e30 avformat/avidec: Check read_odml_index() for failure 
Fixes: Timeout
Fixes: 40950/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6478873068437504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 57adb26d05)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
a4015d432b avformat/aiffdec: Use av_rescale() for bitrate 
Fixes: integer overflow
Fixes: 40313/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-4814761406103552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 905588df97)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
d0a99fdfc6 avformat/aiffdec: sanity check block_align 
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 93f7776921)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
Michael Niedermayer
287389faec avformat/aiffdec: Check sample_rate 
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b04836dff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-04-06 20:27:35 +02:00
James Almer
a4e1dd6940 avcodec/libdav1d: free the Dav1dData packet on dav1d_send_data() failure 
We still own it on failure, and there's no point trying to feed it again.

This should address the issue reported in dav1d #383 and part of VLC #26259.

Signed-off-by: James Almer <jamrial@gmail.com>
Reviewed-by: Ronald S. Bultje <rsbultje@gmail.com>
 2022-02-01 13:05:14 -03:00
Andreas Rheinhardt
3e539d11e4 avcodec/zmbvenc: Fix memleak upon init error 
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 141f3053ba)
 2022-01-11 22:37:58 +01:00
Andreas Rheinhardt
2de8235791 avcodec/dnxhdenc: Fix segfault when using too many slice threads 
The DNXHD encoder's context contains an array of 32 pointers to
DNXHDEncContexts used in case of slice threading; when trying
to use more than 32 threads with slice threading, the encoder's init
function errors out, but the close function takes avctx->thread_count
at face value and tries to free inexistent elements of the array,
leading to potential crashes.

Fix this by modifying the check used to decide whether the slice
contexts should be freed.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit eb583b3cb9)
 2022-01-11 22:37:58 +01:00
Andreas Rheinhardt
44f830e7f0 avcodec/wma(dec|enc): Fix memleaks upon allocation error 
ff_wma_init() can fail without freeing everything it has allocated;
so add the FF_CODEC_CAP_INIT_CLEANUP to the codecs using it.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit fcdb012a10)
 2022-01-11 22:37:58 +01:00
Andreas Rheinhardt
c256491f96 avfilter/avfilter: Actually error out on init error 
Currently an error from init could be overwritten by successfully
setting the enable expression.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 10ad3cd798)
 2022-01-11 22:37:58 +01:00
Andreas Rheinhardt
edaf8c9615 avcodec/opus_silk: Remove wrong size information in function declaration 
silk_lsp2poly()'s declaration contained arrays with array sizes;
yet these array sizes exceeded the number of actually accessed array
elements (which is related to another parameter) and this leads to
-Wstringop-overflow= warnings from GCC 11, because the arrays provided
by callers are only large enough for the actually used elements.

So replace the incorrect array sizes with comments containing
the correct array sizes. Given that these sizes are not compile-time
constants, they can only be communicated via a comment.

Reported by Paul B Mahol.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 4b15474316)
 2022-01-11 22:37:58 +01:00
Andreas Rheinhardt
953ad7b362 avformat/omadec: Don't output uninitialized values 
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 874f03fae7)
 2022-01-11 22:37:58 +01:00
Andreas Rheinhardt
9abd7d144d avformat/jacosubenc: Fix writing extradata 
The terminating '\0' is no longer included in the size of
the extradata output by the demuxer since commit
36e61e24e7.
E.g. if one remuxes the JACOsub sample JACOsub_capability_tester.jss
from the FATE suite, one receives a file not recognized as JACOsub
before this patch.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 54e8dcce8e)
 2022-01-11 22:37:58 +01:00