highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
83,993 Commits 36 Branches 392 Tags
Commit Graph

83993 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer
ac301bcf8e avformat/utils: check for integer overflow in av_get_frame_filename2() 
Fixes: signed integer overflow: 317316873 * 10 cannot be represented in type 'int'
Fixes: 24708/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5731180885049344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 03c479ce236955fc329c7f9f4765ee1ec256bb73)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:20 +02:00
Michael Niedermayer
090893695e avutil/timecode: Avoid undefined behavior with large framenum 
Fixes: signed integer overflow: 2147462079 + 2149596 cannot be represented in type 'int'
Fixes: 27565/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5091972813160448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b1905739638c22b476c99c679b41f29fa00bf07)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:20 +02:00
Michael Niedermayer
fa3dc72efc avformat/sbgdec: Reduce the amount of floating point in str_to_time() 
Fixes: 1e+75 is outside the range of representable values of type 'long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6626834808700928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ac6c8993f79eaefb76e1fdf0eef5373ab3a46a4e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:20 +02:00
Michael Niedermayer
bdfb379795 avformat/mxfdec: Free all types for both Descriptors 
Fixes: memleak
Fixes: 26352/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5201158714687488

Suggested-by: Tomas Härdin <tjoppen@acc.umu.se>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 88519be8db66811e203408b413d9039ac9c3fe91)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:20 +02:00
Michael Niedermayer
8715db6e6d uavformat/rsd: check for EOF in extradata 
Fixes: OOM
Fixes: 26503/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-6530816735444992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7186ec88b98bc589f1403985ab10cc7f77461ec8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:20 +02:00
Michael Niedermayer
c9138413c9 avcodec/wmaprodec: Check packet size 
Fixes: left shift of negative value -25824
Fixes: 27754/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA2_fuzzer-5760255962906624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 69aeba8a19ac2fa6e1c9bdfb19229b513f314bb1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:20 +02:00
Michael Niedermayer
981624face avformat/mpegts: Fix argument type for av_log 
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 654b21ef176a807bf4e8359a4ed52c629d766100)
 2021-10-09 22:02:20 +02:00
Michael Niedermayer
d53d36e93d avformat/cafdec: clip sample rate 
Fixes: 1.21126e+111 is outside the range of representable values of type 'int'
Fixes: 27398/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5412960339755008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 684aec6a6872c9e3bb0afee1979f1cd3edd1f8ce)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:20 +02:00
Michael Niedermayer
6cdbedbfb7 avcodec/ffv1dec: Fix off by 1 error with quant tables 
Fixes: assertion failure
Fixes: 28447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-5369575948550144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5cae71d2b722d0beed4d46f189db42fbb57d877b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:20 +02:00
Michael Niedermayer
10b493af68 avformat/mpegts: Increase pcr_incr width to 64bit 
Fixes: division by zero
Fixes: 26459/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5666350112178176
Fixes: 28154/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5195728439476224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ef7b117b7be8a81d6b245cadf096cbe4b1a12987)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:20 +02:00
Michael Niedermayer
150c66f775 avformat/mov: Check if hoov is at the end 
Fixes: Timeout, probably infinite loop
Fixes: 26559/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5391165484171264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0afbaabdca2730d3f8d88719d64802d50b92d351)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:20 +02:00
Michael Niedermayer
e46b067199 avcodec/hevc_ps: check scaling_list_dc_coef 
Fixes: signed integer overflow: 2147483640 + 8 cannot be represented in type 'int'
Fixes: 28449/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5686013259284480

Reviewed-by: James Almer <jamrial@gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f1700bd8bb983bb3b56c3a1f8b9078cb62a44f65)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:20 +02:00
Michael Niedermayer
a9fe6abe0a avformat/iff: Check data_size 
Fixes: infinite loop
Fixes: 27834/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5694930919620608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 001bc594d82f3df67a6e96c6ea022f4e39002385)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:20 +02:00
Michael Niedermayer
fe15426edd avformat/matroskadec: Sanity check codec_id/track type 
Fixes: memleak
Fixes: 27766/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-5198300814508032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7b88dd8f0cb48b46f3178d274a9117a3d2307f4e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:20 +02:00
Michael Niedermayer
a4be820f99 avformat/rpl: Check the number of streams 
Fixes: out of memory access
Fixes: 27787/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-4743666463408128.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0677bdb1f522d0d25b47bca3d8e09ece83083678)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
896720925a avcodec/h264idct_template: Fix integer overflow in ff_h264_chroma422_dc_dequant_idct() 
Fixes: signed integer overflow: -2105540608 - 2105540608 cannot be represented in type 'int'
Fixes: 26870/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5656647567147008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 51dfd6f1bdb03bfc7574b12e921fb3b8639ba5cf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
05ca3ac921 avformat/dsfdec: Check block_align more completely 
Fixes: infinite loop
Fixes: 26865/clusterfuzz-testcase-minimized-ffmpeg_dem_DSF_fuzzer-5649473830912000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 65b8974d54455adc7a462f0f7385b76e1d08101c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
62ccd6b820 avformat/mpc8: Check remaining space in mpc8_parse_seektable() 
Fixes: Fixes infinite loop
Fixes: 26704/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6327056939614208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4f66dd13d08d063e2748d172239df595078ff624)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
5929303897 avformat/id3v2: Sanity check tlen before alloc and uncompress 
Fixes: Timeout (>20sec -> 65ms)
Fixes: 26896/clusterfuzz-testcase-minimized-ffmpeg_dem_DAUD_fuzzer-5691024049176576
Fixes: 27627/clusterfuzz-testcase-minimized-ffmpeg_dem_AEA_fuzzer-4907019324358656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d7f87a4b9ef18a9846439b7787874cc11e5940de)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
20a2a36571 avformat/vqf: Check len for COMM chunks 
Fixes: Infinite loop
Fixes: 26696/clusterfuzz-testcase-minimized-ffmpeg_dem_VQF_fuzzer-5648269168082944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a834af133b1fe8f29b4075808710ffd98abcac40)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
4314f97f65 avcodec/hevc_cabac: Limit value in coeff_abs_level_remaining_decode() tighter 
The max depth is 16bps, the max allowed coefficient depth is depth+6
Fixes: signed integer overflow: 1074266112 + 1073725439 cannot be represented in type 'int'
Fixes: 26493/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5657763331702784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7cf852b03c3ae6b61f89614371d2cb308d0b7f86)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
4622b9359a avformat/cafdec: Check the return code from av_add_index_entry() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9dc3301745d8271ae3ba0f1b998d8e6a0aa01bc1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
b25aae7253 avformat/cafdec: Check for EOF in index read loop 
Fixes: OOM
Fixes: 27398/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-541296033975500

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eb46939e3ab3e0e4df69486b1a037bffc50493bd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
631e300654 avformat/cafdec: Check that bytes_per_packet and frames_per_packet are non negative 
These fields are not signed in the spec (1.0) so they cannot be negative
Changing bytes_per_packet to unsigned would not solve this as it is exported
as block_align which is signed

Fixes: Infinite loop
Fixes: 26492/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5632087614554112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5eed718087f2ba307a3d1d294016d2ebae9230f3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
c9eb3dc486 avformat/mpc8: correct integer overflow in mpc8_parse_seektable() 
Fixes: signed integer overflow: -4683718486770919638 * 2 cannot be represented in type 'long'
Fixes: 26704/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6327056939614208
Fixes: 27550/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6259212652642304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0897402ac8a2045691395380a9fd2ea88c0d3798)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
fe309530ae avformat/mpc8: correct 32bit timestamp truncation 
Fixes: left shift of 65536 by 15 places cannot be represented in type 'int'
Fixes: 26801/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-5164313092030464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ad3e495657eaa24cba9251c2379797c208998201)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
30102ee94e avcodec/exr: Check ymin vs. h 
Fixes: out of array access
Fixes: 26532/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5613925708857344
Fixes: 27443/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5631239813595136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3e5959b3457f7f1856d997261e6ac672bba49e8b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
25ed238480 avformat/avs: Use 64bit for the avio_tell() output 
Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented in type 'long'
Fixes: 26549/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS_fuzzer-4844306424397824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1278f117d75ab9238ef181ba29b31c6ea569571b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
0ce79b95d9 avformat/wavdec: More complete size check in find_guid() 
Fixes: signed integer overflow: 9223372036854775807 + 8 cannot be represented in type 'long'
Fixes: 27341/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5442833206738944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a207df2acb92d6366ab2f0f18ba35709066b8eec)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
608bb9814c avformat/iff: Check size before skip 
Fixes: Infinite loop
Fixes: 27292/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5731168991051776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8b50e8bc2975fad85e0713e05940ee9ecb5e8a18)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
83e5a77c1d avformat/rmdec: Check for EOF in index packet reading 
Fixes: Timeout(>10sec -> 1ms)
Fixes: 27284/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6304211110985728

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ebf4bc629e6d0dbb4bb6725849bdd06456e4c8af)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
33a82227ad avformat/icodec: Check for zero streams and stream creation failure 
Fixes: NULL pointer dereference
Fixes: 26814/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-5758487797432320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b33233bd53f74f94f4cd7be0645a99a9549a913e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
de7f2908f1 avformat/icodec: Factor failure code out in read_header() 
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 27ee67c00f4402030af3b7477dd5088464d31d80)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
89e148cb81 avformat/bintext: Check width 
Fixes: division by 0
Fixes: 26780/clusterfuzz-testcase-minimized-ffmpeg_dem_ADF_fuzzer-5117945027756032
Fixes: 26998/clusterfuzz-testcase-minimized-ffmpeg_dem_ADF_fuzzer-5119352359354368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f6dc285fb5f30406b275b968ee438a738da799d1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
64ed3aff37 avformat/sbgdec: Check that end is not before start 
Fixes: signed integer overflow: -9223372036854775808 + -5279949906739200 cannot be represented in type 'long'
Fixes: 26908/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6329610851319808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9ef60a66f1f155605049402415bd901c8baf1a24)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
ecd4013d80 avformat/lvfdec: Check stream_index before use 
Fixes: assertion failure
Fixes: 26905/clusterfuzz-testcase-minimized-ffmpeg_dem_LVF_fuzzer-5724267599364096.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b1d99ab14f2fd273e678dcb618dabfb38aab91b6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
e298bc5980 avformat/au: cleanup on EOF return in au_read_annotation() 
Fixes: memleak
Fixes: 26841/clusterfuzz-testcase-minimized-ffmpeg_dem_AU_fuzzer-5174166309044224
Regression since: e680d50eb4feddafb2d8575b21fc5fc8764f4801
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d16974c3dd3a05900aa080ea0729284aea358d10)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
7a395606a7 avformat/mpegts: Limit copied data to space 
Fixes: out of array access
Fixes: 26816/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-6282861159907328.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 79cf7c71910a69b9f22b3e7ee6508a771262abaf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
978bc27c61 avformat/bintext: Check width in idf_read_header() 
Fixes: division by 0
Fixes: 26802/clusterfuzz-testcase-minimized-ffmpeg_dem_IDF_fuzzer-5180591554953216.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 442d53f409c8d84c7db120227caac00af54aa884)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
2c45037a25 avformat/iff: check size against INT64_MAX 
Bigger sizes are misinterpreted as negative numbers by the API
Fixes: infinite loop
Fixes: 26611/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4890614975692800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f291cd681b1235e150464ad83974d60d6879b492)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
7769ab9393 avformat/paf: Check for EOF in read_table() 
Fixes: OOM
Fixes: 26528/clusterfuzz-testcase-minimized-ffmpeg_dem_PAF_fuzzer-5081929248145408
Fixes: 26584/clusterfuzz-testcase-minimized-ffmpeg_dem_PAF_fuzzer-5172661183053824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 437b7302b09a04e0fbfcd594114b52c5c6d89d32)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
c9c4b480c6 avformat/gxf: Check pkt_len 
Fixes: Infinite loop
Fixes: 26576/clusterfuzz-testcase-minimized-ffmpeg_dem_GXF_fuzzer-4823080360476672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dad9a86ca7bf912289aafb33d96980630e6ec53a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
10cfdf25af avformat/aiffdec: Check packet size 
Fixes: Fixes infinite loop
Fixes: 26575/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-5727522236661760

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ba71a72d3a617b255b71988a000d5093222f779)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
f1f6d6c861 avformat/concatdec: use av_strstart() 
Fixes: out array read
Fixes: 26610/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-5631838049271808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2610acb49a140901dacbd36c598a5514cf9ade0d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
021e2b9cf1 avformat/wavdec: Refuse to read chunks bigger than the filesize in w64_read_header() 
Fixes: OOM
Fixes: 26414/clusterfuzz-testcase-minimized-ffmpeg_dem_FWSE_fuzzer-5070632544632832
Fixes: 26475/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5770207722995712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7b2244565ac8cb1eddd085e1a382a893ac03bfb4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
51cdea6e4f avformat/iff: More completely check body_size 
Fixes: infinite loop
Fixes: 26485/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5126561373880320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3588e2e6b05ba92f0907e9ffe263c2e65d53e346)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
cf572adb92 avformat/xwma: Check for EOF in dpds_table read code 
Fixes: Timeout (>30 -> 140ms)
Fixes: 26478/clusterfuzz-testcase-minimized-ffmpeg_dem_XWMA_fuzzer-5918147066200064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 44b18a76b8d4e01c7ce62474aaf196857e75e976)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
4ecce5f256 avcodec/utils: Check sample rate before use for AV_CODEC_ID_BINKAUDIO_DCT in get_audio_frame_duration() 
Fixes: shift exponent 95 is too large for 32-bit type 'int'
Fixes: 26590/clusterfuzz-testcase-minimized-ffmpeg_dem_SMACKER_fuzzer-5120609937522688

Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ec7e0d42884b40ce93b6b5e94de5f7849310f8a0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
8206115257 avcodec/dirac_parser: do not offset AV_NOPTS_OFFSET 
Fixes: signed integer overflow: -9223372036854775807 - 48000 cannot be represented in type 'long long'
Fixes: 26521/clusterfuzz-testcase-minimized-ffmpeg_dem_DIRAC_fuzzer-5635536506847232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 343c3149ab3d77be76f035d3b18bb2b2da48ce1f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00
Michael Niedermayer
39d8fb2f67 avformat/rmdec: Make expected_len 64bit 
Fixes: signed integer overflow: 1347551268 * 14 cannot be represented in type 'int'
Fixes: 26458/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-5655364324032512

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 728330462cadb765307cc132377b6b5d177a225c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-09 22:02:19 +02:00