19 Commits

Author SHA1 Message Date
Michael Niedermayer
8af33f41f7 avcodec/agm: Fix off by 1 error in decode_inter_plane()
Fixes: Regression since 1f2096945709a32315da740691b5716da55893c3
Found-by: Paul B Mahol <onemda@gmail.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6d71a25cc460960c49997d52c1d1f1c39ccc38b4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-10-05 21:28:08 +02:00
Michael Niedermayer
6a4b26eaf6 avcodec/agm: YUV420 without DCT needs even dimensions
Fixes: out of array access
Fixes: 19892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5707525924323328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a98eeb0c1e867238905ed095b48184f706adf328)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-05-19 17:17:35 +02:00
Michael Niedermayer
e6567ca7dc avcodec/agm: Test remaining data in decode_raw_intra_rgb()
Fixes: Timeout (270sec -> 25ms)
Fixes: 20485/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5636954207289344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5c151e1491dd609ac5c8a8fbea42f21178a682db)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-05-19 17:17:35 +02:00
Michael Niedermayer
067b2c0c28 avcodec/agm: Include block size in the MV check for flags == 3
Fixes: out of array read
Fixes: 19331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5644115983466496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1f2096945709a32315da740691b5716da55893c3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31 19:51:57 +01:00
Michael Niedermayer
1f88bbc9f2 avcodec/agm: Do not allow MVs out of the picture area as no edge is allocated
Fixes: out of array access
Fixes: 18499/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5749038406434816

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7a1b30c871c873e97c93af75f925c854de7b75f2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31 19:51:57 +01:00
Michael Niedermayer
1c24ab39b6 vcodec/agm: Alloc based on coded dimensions
Fixes: out of array read
Fixes: 18715/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5659333417500672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bfa8272f405314582e8f099ec1a9249232553c9c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31 19:51:56 +01:00
Michael Niedermayer
a93c1d1e83 avcodec/agm: Check for reference frame earlier
Fixes: Timeout (14sec -  120ms)
Fixes: 17824/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5639825457152000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 315a4459334fdc1e6b18733fb63439e9d090cebd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31 19:51:56 +01:00
Michael Niedermayer
6ebbfb377f avcodec/agm: Fix overflow of signed shift
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 15328/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5637545171353600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-07-19 21:42:38 +02:00
Michael Niedermayer
19af948e53 avcodec/agm: Check output size before allocation
Fixes: OOM
Fixes: 14198/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5723579234123776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-04-30 21:25:01 +02:00
Michael Niedermayer
caa9b4ff89 avcodec/agm: Check that there is available input in read_code()
Fixes: Timeout (46sec -> 7ms)
Fixes: 14030/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5721258760601600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-04-24 17:05:02 +02:00
Michael Niedermayer
df9ef925f9 avcodec/agm: remove ;;
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-04-21 23:29:04 +02:00
Michael Niedermayer
7ee7bb92e6 avcodec/agm: Check for too many too short codes in make_new_tree()
Fixes: SEGV on unknown address
Fixes: 14198/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5723579234123776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-04-21 23:29:04 +02:00
Michael Niedermayer
158efc045c avcodec/agm: Do not crash on invalid codes
I do not know if such vlc trees are allowed in agm, I have no specification
So i do not know if these should be treated as error, or not.
But the code does contain a check for idx < 0 already ...

Fixes: Stack-buffer-overflow in get_tree_codes
Fixes: 14189/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5745747003179008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-04-21 23:29:04 +02:00
Michael Niedermayer
3308e3da04 avcodec/agm: Check frame dimensions
Fixes: out of array access
Fixes: 14110/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5649184864075776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-04-11 19:25:42 +02:00
Paul B Mahol
7be8f7ac81 avcodec/agm: add support for non-dct coding 2019-04-11 11:49:43 +02:00
Paul B Mahol
0f28355974 avcodec/agm: add support for higher compression 2019-04-11 11:49:43 +02:00
Michael Niedermayer
2169a3f262 avcodec/agm: Fix integer overflow with w/h
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 13999/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5644405991538688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-04-05 12:05:47 +02:00
Michael Niedermayer
8e3b01e20e avcodec/agm: More completely check size before using it
Fixes: out of array access
Fixes: 13997/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5701427252428800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-04-04 11:31:17 +02:00
Paul B Mahol
4e8cbbf70e avcodec: add Amuse Graphics decoder
This work is sponsored by VideoLAN.
2019-03-31 10:48:43 +02:00