91680 Commits

Author SHA1 Message Date
Michael Niedermayer
f358a4d68d avcodec/intrax8: Check for end of bitstream in ff_intrax8_decode_picture()
Fixes: Timeout (105sec -> 1sec)
Fixes: 20479/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5769846937878528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0a9ccc2514da82812584b0e49a30625151d225e9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
0613282686 avcodec/hevc_mp4toannexb_bsf: Check nalu_size
Fixes: Timeout (29sec -> 5ms)
Fixes: 20237/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_MP4TOANNEXB_fuzzer-5165615044362240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ae2537f53e8ebfa36345241b5b70c0b1aef66dd2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
c12d62bf77 avcodec/iff: Check length before memcpy() in decode_deep_rle32()
Fixes: out of array read
Fixes: 20796/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5111364702175232.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b4a33387cb1cd3f4c5036e65e0fdd953c6b5012f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
101f32f843 avcodec/iff: Fix invalid pointer intermediates in decode_deep_rle32()
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bc41a29a5aa3c3dedba0a85b4aeb79a07eeeb1b4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
2f487066ed avcodec/pngdec: Pass ret from decode_iccp_chunk()
Found while reviewing a patch fixing a similar issue

Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4c7bcaa385e5e5fda0084de2fb823ac25c0deba0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
d97cfd89eb avcodec/rv40dsp: Fix integer overflows in rv40_weight_func_*()
Fixes: signed integer overflow: 40550400 * 128 cannot be represented in type 'int'
Fixes: 20331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV40_fuzzer-5676685725007872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 13171ad2e304b2a7d959429527b98c68ec5ea320)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
3336567ec4 avcodec/ac3dec_fixed: Fix several invalid left shifts in scale_coefs()
Fixes: left shift of negative value -14336
Fixes: 20298/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AC3_FIXED_fuzzer-5675484201615360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8e30502abe62f741cfef1e7b75048ae86a99a50f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
b499a73396 avcodec/flac_parser: Do not lose header count in find_headers_search()
Fixes: Timeout
Fixes: out of array access
Fixes: 20274/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5649631988154368
Fixes: 19275/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5757535722405888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 55f9683cf6be97f4b398a7a35ee5bfd1208ac2a5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
c298f94143 avcodec/audiodsp: Fix integer overflow in scalarproduct_int16_c()
Fixes: signed integer overflow: 2145417478 + 76702564 cannot be represented in type 'int'
Fixes: 20313/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-5734487724130304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit abb5762e985f4ce34e97c1b2fa6d1108ce8a881f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
b26458b046 avformat/oggdec: Check for EOF after page header
Fixes: Infinite loop
Fixes: Ticket8594

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f1589be9fda00c417f9bcccb55dbbea998ee08ac)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
15e323fee1 swscale/yuv2rgb: Fix vertical dither offset with slices
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit be3c29e3795cb2499e3b96335286d6a8423c0bcf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
c1a6a35bdd avcodec/dpcm: clip exponent into supported range in XAN DPCM
Fixes: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 21200/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XAN_DPCM_fuzzer-5754704894361600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 20ade59d9633def4ebf84ec170f56367bfb6aa6c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
4e834d7139 avcodec/flacdsp_template: Fix invalid shifts in decorrelate
Fixes: left shift of negative value -2
Fixes: 20303/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5096829297623040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3935c891e96c0819439da43d1b862652bbbdf065)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
987ec5f1d0 avcodec/xvididct: Fix integer overflow in MULT()
Fixes: signed integer overflow: 23170 * 95058 cannot be represented in type 'int'
Fixes: 20295/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5800212870463488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7ccb576191e91b393041b14917f1b681ec75ed3b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
89860dd068 avcodec/ffwavesynth: Correct undefined overflow of PINK_UNIT
Fixes: signed integer overflow: 9223372036854775775 + 128 cannot be represented in type 'long'
Fixes: 20054/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5686385113825280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 187161d62f35c8b613c4a6739b0a6dfa9a24da60)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
9342a639a7 avcodec/cbs_h264_syntax_template: fix off by 1 error with slice_group_change_cycle
Fixes: assertion failure
Fixes: 20390/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_REDUNDANT_PPS_fuzzer-5683400772157440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 741565a1e69c45ce4848f01e45be5e66a68efa2f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
531b3300a7 swscale/output: Fix integer overflow in yuv2rgb_write_full() with out of range input
Fixes: signed integer overflow: 1169365504 + 981452800 cannot be represented in type 'int'
Fixes: ticket8293

Found-by: Suhwan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e057e83a4ff4c0eeeb78dffe58e21af951c056b6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
81f9e29bc9 swscale/output: Fix integer overflow in alpha computation in yuv2gbrp16_full_X_c()
Fixes: signed integer overflow: 524280 * 4432 cannot be represented in type 'int'
Fixes: ticket8322

Found-by: Suhwan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 49ba1879add99d3f64d70d34fb0255c8a49d4b28)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
John Rummell
e75f8b51ea libavformat/amr.c: Check return value from avio_read()
If the buffer doesn't contain enough bytes when reading a stream,
fail rather than continuing on with initialized data. Caught by
Chromium fuzzeras (crbug.com/1065731).

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5b967f56b6d85f62446836fc8ef64d0dcfcbda17)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
John Rummell
9954fbe273 libavformat/mov.c: Free aes_decrypt to avoid leaking memory
Found by Chromium fuzzers (crbug.com/1057205).

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ad91cf1f2f5793db5c6dd7ab9947fcc6d7832607)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
John Rummell
b561b503ff libavformat/oggdec.c: Check return value from avio_read()
If the buffer doesn't contain enough bytes when reading a stream,
fail rather than continuing on with unitialized data. Caught by
Chromium fuzzers (crbug.com/1054229).

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b7c67b1ae3657058b32b9235119d07529ad5cce1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
116b777775 avformat/asfdec_f: Fix overflow check in get_tag()
Fixes: signed integer overflow: 2 * 1210064928 cannot be represented in type 'int'
Fixes: 20873/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5761116909338624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c8140fe7324f264faacf7395b27e12531d1f13f7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
2bef1bba73 avformat/nsvdec: Fix memleaks on errors while reading the header
Fixes: memleaks
Fixes: 21084/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5655975492321280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 96c04694550999cc214cae8c4a16d2d7ac0958bc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
c352052457 avcodec/ffwavesynth: Fix integer overflow in computation of ddphi
Fixes: signed integer overflow: 1302123111085380114 - -8319005078741256972 cannot be represented in type 'long'
Fixes: 20991/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5148554161291264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c85bf1631823e9089e59a474d5c6c0efc708c507)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
bf696d436e avcodec/adpcm: Fix invalid shift in AV_CODEC_ID_ADPCM_PSX
Fixes: left shift of negative value -1
Fixes: 20859/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_PSX_fuzzer-5720391507247104

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0a11ef68f0a85905e704e503b433f5aa645d59ac)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
178f6ae983 avcodec/mpeg12dec: Fix invalid shift in mpeg2_fast_decode_block_intra()
Fixes: left shift of negative value -695
Fixes: 19232/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5702856963522560
Fixes: 19555/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5741218147598336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c40df2166c7925fc81e1ef22563c2e32124cf1d6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Andreas Rheinhardt
3b4eae4cae avcodec/cbs_h2645: Treat slices without data as invalid
Slices that end after their header (meaning slices after the header
without any data before the rbsp_stop_one_bit or possibly without any
rbsp_stop_one_bit at all) are invalid and are now dropped. This ensures
that one doesn't run into two asserts in cbs_h2645_write_slice_data().

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Fixes: 19629/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_METADATA_fuzzer-5676822528524288
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 66fac1ff7ccbc4fb6a3aa6b9a95de7b6bc31d14e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Andreas Rheinhardt
e9b4383712 avcodec/cbs_h2645: Remove dead code to delete trailing zeroes
Trailing zeroes are already discarded when splitting a fragment, which
makes the code to remove them when decomposing slices dead code.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8f701932b39a6345f2a8bab85f48d555a98802e3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
abd6b0f913 avcodec/mpegaudioenc_template: fix invalid shift of sample
Fixes: Ticket8010

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a2c97a8342fab6393280cc2f0e2ffb39c381d29c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
e2979378ff avcodec/motion_est_template: Fix invalid shifts in no_sub_motion_search()
Fixes: Ticket8167

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e13eee37ee3268b0a985ddc74a9bde0179bd553c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
84be21040e libavformat/avienc: Check bits per sample for PAL8
Fixes: assertion failure
Fixes: Ticket 8172

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 35958782819c00211e247332ab18fbf2f28267e1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
3509ad1b06 avformat/mpegts: Improve the position determination for avpriv_mpegts_parse_packet()
Fixes: assertion failure
Fixes: Ticket 8005

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e5bb48ae5990347dff22fc38ff5a1c1f7f60a1c5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
447e97e510 avcodec/magicyuv: Check that there are enough lines for interlacing to be possible
Fixes: out of array access
Fixes: 20763/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_fuzzer-5759562508664832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f8a0e9f9f71cf5650bdc250ff7475e0f7d8e8420)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
07a265b140 avformat/mvdec: Check stream numbers
Fixes: null pointer dereference
Fixes: 20768/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5638648978735104.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 618a9bea65112a27a106e02ada3ae475cc8ac1ac)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
702ce6c8ee avcodec/pcm: Fix invalid shift in AV_CODEC_ID_PCM_LXF
Fixes: left shift of 233 by 24 places cannot be represented in type 'int'
Fixes: 20736/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PCM_LXF_fuzzer-4829212685107200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 051d11f659455f38be7ce40e2dc9d03b082dcd4d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
ec3635caf6 avcodec/qdm2: Check fft_coefs_index
Fixes: out of array access
Fixes: 20660/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5658290216501248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9fc73bf022eb781eea7f685e2d2e9de4ba8898ca)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
c901cc287f avformat/utils: Fix integer overflow with complex time bases in avformat_find_stream_info()
Fixes: signed integer overflow: 2045163756 * 2 cannot be represented in type 'int'
Fixes: Ticket5132

Found-by: tsmith
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f3d8f517dbc42de8e2f97cc01bf5171bb05fbcc7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
ac4fb0935a avformat/avidec: Avoid integer overflow in NI switch check
Fixes: signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'long'
Fixes: Ticket8149

Found-by: Suhwan
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 347920ca2102d762e4713f101a2e75811791e2b3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
759febd880 fftools/ffmpeg: Fix integer overflow in duration computation in seek_to_start()
Fixes: signed integer overflow: -9223372036854775808 - 9223372036854775807 cannot be represented in type 'long'
Fixes: Ticket8142

Found-by: Suhwan
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4f4ad33d96a01d82edf56d58599017cb0ae5bfa8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
1bcbe5bc9b avfilter/vf_aspect: Fix integer overflow in compute_dar()
Fixes: signed integer overflow: 1562273630 * 17 cannot be represented in type 'int'
Fixes: Ticket8323

Found-by: Suhwan
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0c0ca0f244b823238e5a4f5584168e620da84899)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
14ed91c123 avcodec/apedec: Fix invalid shift with 24 bps
Fixes: left shift of negative value -463
Fixes: 20542/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5688714435231744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8e278672294f28a3feaba0a38460afd51f0fadda)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Dale Curtis
4834e4ff4a avformat/utils: Fix undefined behavior in ff_configure_buffers_for_index()
When e2_pts == INT64_MIN and e1_pts >= 0 the calculation of
e2_pts - e1_pts will overflow an int64_t.

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f15007afa90a3eb3639848d9702c1cc3ac3e896b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
f1f5a2c11f avcodec/dpcm: Fix integer overflow in AV_CODEC_ID_GREMLIN_DPCM
Fixes: signed integer overflow: -2147479324 + -32568 cannot be represented in type 'int'
Fixes: 20103/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_GREMLIN_DPCM_fuzzer-5667667579240448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b1aecad9eae900b9c3054392994d150d5ae572c5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
06dcfd24e9 avcodec/wmalosslessdec: Fix integer overflow with sliding in padding bits
Fixes: signed integer overflow: -53716100 * 256 cannot be represented in type 'int'
Fixes: 20143/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5716604000403456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b8a0be93528187721a2414f66abbc252a258afa3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
9f88c50965 avcodec/wmalosslessdec: Fix loop in revert_acfilter()
Fixes: out of array read
Fixes: 20059/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5691776237305856

No testcase except the fuzzed one.

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5584c0bb945d6010a9d8c22ef3270792022e1761)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
134d579dfc avcodec/lagarith: Sanity check scale
A value of 24 and above can collaps the range to 0 which would not work.

Fixes: Timeout (75sec -> 21sec)
Fixes: 18707/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LAGARITH_fuzzer-5708950892969984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fb3855342b9e4c577c63b38a7a5a574830a21934)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
73c20eb18e avcodec/apedec: Fix integer overflows in predictor_decode_mono_3950()
Fixes: signed integer overflow: -2147407150 + -1871606 cannot be represented in type 'int'
Fixes: 18702/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5679095417667584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eb64a5c6f94981e4a68ad65a6e445557e11c08fc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
48802e370f avcodec/ralf: Fix integer overflow in apply_lpc()
Fixes: signed integer overflow: 2147482897 + 2048 cannot be represented in type 'int'
Fixes: 19240/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5743240326414336
Fixes: 19869/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5150136636538880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fd313d8cf8368918882b6de0880e44ae25cc7394)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
21c56049a2 avcodec/dca_lbr: Fix some error codes and error passing
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bfea054a75f17d140f2f171056a801c4c89f6d26)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00
Michael Niedermayer
6e9a4759e3 avcodec/wmavoice: Fix rounding and integer anomalies in calc_input_response()
Fixes: out of array access
Fixes: inf is outside the range of representable values of type 'int'
Fixes: signed integer overflow: -9223372036854775808 - 1 cannot be represented in type 'long'
Fixes: 19316/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5677369365102592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 38d37584448731f90977132b838d50ff1a28811b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01 13:33:44 +02:00