virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-06-19 19:03:00 +02:00
Code Issues Releases Activity
87,187 Commits 39 Branches 425 Tags
05b1c606870cc4646da8197a86e9af5301654499
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer c595139f1f avcodec/dirac_vlc: Fix invalid shift in ff_dirac_golomb_read_32bit() 
Fixes: runtime error: shift exponent 64 is too large for 64-bit type 'residual' (aka 'unsigned long')
Fixes: 2838/clusterfuzz-testcase-minimized-6260066086813696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-02 23:50:28 +02:00
Michael Niedermayer f71cd44147 avcodec/dirac_dwt: Fix multiple overflows in 9/7 lifting 
Fixes: runtime error: signed integer overflow: 1073901567 + 1073901567 cannot be represented in type 'int'
Fixes: 3124/clusterfuzz-testcase-minimized-454643435752652

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-02 23:50:28 +02:00
Michael Niedermayer 2a0823ae96 avcodec/diracdec: Fix integer overflow in INTRA_DC_PRED() 
Fixes: runtime error: signed integer overflow: 1168175789 + 1168178473 cannot be represented in type 'int'
Fixes: 3081/clusterfuzz-testcase-minimized-4807564879462400
Fixes: 2844/clusterfuzz-testcase-minimized-5561715838156800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-02 23:50:28 +02:00
Michael Niedermayer f762555a90 avformat/mxfenc: Replace literal numbers by named enum values. 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-30 02:15:36 +02:00
Michael Niedermayer 732f976456 avcodec/snowdec: Fix integer overflow in decode_subband_slice_buffered() 
Fixes: runtime error: signed integer overflow: 267 * 8388608 cannot be represented in type 'int'
Fixes: 2743/clusterfuzz-testcase-minimized-5820652076400640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-29 21:16:32 +02:00
Michael Niedermayer 2a83866c9f avcodec/hevc_ps: Fix undefined shift in pcm code 
Fixes: runtime error: shift exponent -1 is negative
Fixes: 3091/clusterfuzz-testcase-minimized-6229767969832960

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-29 21:16:32 +02:00
Michael Niedermayer 6def8b8d92 avcodec/h264idct_template: Fix integer overflow in ff_h264_idct8_add() 
Fixes: 2891/clusterfuzz-testcase-minimized-5881795457318912
Fixes: runtime error: signed integer overflow: 1551827968 - -775913984 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-29 21:16:32 +02:00
Michael Niedermayer 429f3266c1 avformat/mxfenc: Check that the video codec in D-10 is MPEG-2 
Others do not work, but nothing rejects them prior to this patch if the
parameters otherwise match

Reviewed-by: Matthieu Bouron <matthieu.bouron@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-29 21:16:32 +02:00
Michael Niedermayer aa26258faa avfilter/vf_zoompan: remove AVFILTER_FLAG_SUPPORT_TIMELINE_GENERIC 
Suggested-by: <durandal_1707>
Fixes: assertion failure

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-27 20:41:56 +02:00
Michael Niedermayer 0181b202cc avcodec/aacpsdsp_template: Fix undefined integer overflow in ps_add_squares_c() 
Fixes runtime error: signed integer overflow: 1997494407 + 613252359 cannot be represented in type 'int'
Fixes: 2014/clusterfuzz-testcase-minimized-5186337030275072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-27 19:40:28 +02:00
Michael Niedermayer eefb68c9c3 avcodec/sbrdsp_fixed: Fix undefined overflows in autocorrelate() 
Fixes: runtime error: signed integer overflow: 8903997421129740175 + 354481484684609529 cannot be represented in type 'long'
Fixes: 2045/clusterfuzz-testcase-minimized-6751255865065472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-27 19:40:23 +02:00
Michael Niedermayer 4f05e2e2dc avformat/mvdec: Fix DoS due to lack of eof check 
Fixes: loop.mv

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-27 19:23:37 +02:00
Michael Niedermayer 7ec414892d avformat/hls: Fix DoS due to infinite loop 
Fixes: loop.m3u

The default max iteration count of 1000 is arbitrary and ideas for a better solution are welcome

Found-by: Xiaohei and Wangchu from Alibaba Security Team

Previous version reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-27 19:19:00 +02:00
Michael Niedermayer 7c10068da1 avcodec/dvbsubdec: Check for duplicate regions in dvbsub_parse_page_segment() 
Fixes: OOM
Fixes: 3051/clusterfuzz-testcase-minimized-5745818336231424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-25 23:38:24 +02:00
Michael Niedermayer 351e28f9a7 ffprobe: Fix NULL pointer handling in color parameter printing 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-24 11:41:00 +02:00
Michael Niedermayer 837cb4325b ffprobe: Fix null pointer dereference with color primaries 
Found-by: AD-lab of venustech
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-24 11:31:03 +02:00
Michael Niedermayer 2b44dcbc44 avcodec/hevc_ps: Check delta_pocs in ff_hevc_decode_short_term_rps() 
Fixes: integer overflow
Fixes: 2893/clusterfuzz-testcase-minimized-5809330567774208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-24 11:29:40 +02:00
Michael Niedermayer c42a1388a6 avformat/rtpdec_h264: Fix heap-buffer-overflow 
Fixes: rtp_sdp/poc.sdp

Found-by: Bingchang <l.bing.chang.bc@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-23 22:19:33 +02:00
Michael Niedermayer 6f03ffb47d avcodec/aacdec_template: Fix running cleanup in decode_ics_info() 
Fixes: out of array read
Fixes: 2873/clusterfuzz-testcase-minimized-5924145713905664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Previous version reviewed-by: Alex Converse <alex.converse@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-22 20:01:31 +02:00
Michael Niedermayer a2e444d5bb avcodec/pngdec: Fix () placement 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-22 18:55:11 +02:00
Michael Niedermayer bc488ec28a avcodec/me_cmp: Fix crashes on ARM due to misalignment 
Adds a diff_pixels_unaligned()

Fixes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872503

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-21 23:19:18 +02:00
Michael Niedermayer 8754ccd3b3 avcodec/pixlet: Fixes: undefined shift in av_mod_uintp2() 
Fixes: runtime error: shift exponent 4294967289 is too large for 32-bit type 'int'
Fixes: 3030/clusterfuzz-testcase-minimized-4649809254285312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-20 21:14:47 +02:00
Michael Niedermayer a165b53daa avcodec/dirac_dwt_template: Fix integer overflow in vertical_compose53iL0() 
Fixes: runtime error: signed integer overflow: 2147483646 + 2 cannot be represented in type 'int'
Fixes: 3013/clusterfuzz-testcase-minimized-4644084197097472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-20 21:14:47 +02:00
Michael Niedermayer e7b9d136a1 avcodec/cngdec: Check skip_samples 
Without this its possible to make the new decode API decode billions of samples
out of a empty input and never return to the caller before all samples have been
created and discarded.

Fixes: Timeout
Fixes: 2992/clusterfuzz-testcase-6649611793989632

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-20 02:59:57 +02:00
Michael Niedermayer 0c9d5b015c avcodec/fic: Fixes signed integer overflow 
Fixes: runtime error: signed integer overflow: 1037142357 + 1227025305 cannot be represented in type 'int'
Fixes: 3024/clusterfuzz-testcase-minimized-5885660323905536

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-20 02:59:57 +02:00
Michael Niedermayer d132683ddd avcodec/snowdec: Fix off by 1 error 
Fixes: runtime error: index 4 out of bounds for type 'int8_t [4]'
Fixes: 3023/clusterfuzz-testcase-minimized-6421736130084864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-20 02:59:57 +02:00
Michael Niedermayer cadab5a2a7 avcodec/pixlet: fixes integer overflow in read_highpass() 
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: 2879/clusterfuzz-testcase-minimized-6317542639403008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-18 11:34:01 +02:00
Michael Niedermayer b9f92093a1 avcodec/ffv1dec: Check for bitstream end in decode_line() 
Fixes: timeout
Fixes: 2971/clusterfuzz-testcase-6130678276030464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-18 11:33:16 +02:00
Michael Niedermayer c359c51947 avcodec/rangecoder: Do not increase the pointer beyond the buffer 
Fixes: undefined behavior

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-18 11:33:14 +02:00
Michael Niedermayer 931c0ac95c avcodec/zmbv: Check decomp_size 
Fixes: OOM
Fixes: 2710/clusterfuzz-testcase-minimized-4750001420894208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-17 16:30:06 +02:00
Michael Niedermayer 92da23093c avcodec/diracdec: Fixes integer overflow 
Fixes: runtime error: signed integer overflow: 340018243 * 27 cannot be represented in type 'int'
Fixes: 2861/clusterfuzz-testcase-minimized-5361070510178304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-17 00:23:01 +02:00
Michael Niedermayer 1e6cab8745 avcodec/diracdec: Check perspective_exp and zrs_exp. 
Fixes: undefined shift
Fixes: runtime error: shift exponent 264 is too large for 32-bit type 'int'
Fixes: 2860/clusterfuzz-testcase-minimized-4672811689836544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-17 00:23:01 +02:00
Michael Niedermayer 0ac8fce267 swresample/resample: Fix flush refelction length 
Reviewed-by: atomnuker
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-16 00:54:17 +02:00
Michael Niedermayer b9ce43625c avcodec/cavsdec: Check P/B frame mb decode which return error codes 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-15 01:27:36 +02:00
Michael Niedermayer 426a322aa2 avcodec/cavsdec: Check I frame mb decode for errors 
Fixes: timeout
Fixes: 2943/clusterfuzz-testcase-5430257156882432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-15 01:27:36 +02:00
Michael Niedermayer 5859b5b439 avcodec/lagarith: Detect end of input in lag_decode_line() loop 
Fixes: timeout
Fixes: 2933/clusterfuzz-testcase-5124990208835584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-11 22:02:38 +02:00
Michael Niedermayer 0561bd2fc2 avcodec/gdv: Check available space before reading palette 
Fixes: Timeout
Fixes: 2926/clusterfuzz-testcase-498711001458278

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-11 19:27:52 +02:00
Michael Niedermayer 62702eebde avcodec/ffv1dec_template: Fix undefined shift 
Fixes: runtime error: left shift of negative value -127
Fixes: 2834/clusterfuzz-testcase-minimized-5988039123795968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-11 18:21:06 +02:00
Michael Niedermayer 7735ed2974 avcodec/mpeg4videodec: Clear mcsel before decoding an image 
Fixes: runtime error: signed integer overflow: 2146467840 + 1032192 cannot be represented in type 'int'
Fixes: 2826/clusterfuzz-testcase-minimized-5901511613743104

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-11 12:07:16 +02:00
Michael Niedermayer 511e10f673 avformat/avidec: Move packet skip after prefix and related checks 
This fixes loosing packets
Fixes: big.avi

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-11 12:07:08 +02:00
Michael Niedermayer 84786e928f avcodec/tests/dct: Add Mean square error test 
based on quotes of IEEE 1180 / ISO/IEC 23002-1

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-11 12:06:41 +02:00
Michael Niedermayer 86cbffdc4d avcodec/tests/dct: Add peak mean error check 
based on quotes of IEEE 1180 / ISO/IEC 23002-1

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-11 12:06:40 +02:00
Michael Niedermayer abaeeb3ce0 avcodec/dvenc: Change quantizer dead zone default to 7 
This improves the quality and reduces the "blocking" in flat areas

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-08 19:39:21 +02:00
Michael Niedermayer fea7bc9e7b avcodec/dvenc: Support adjusting the quantizer deadzone 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-08 19:39:10 +02:00
Michael Niedermayer a5380f9c1c avcodec/dirac_dwt: Fixes integer overflows in COMPOSE_DAUB97* 
Fix multiple: runtime error: signed integer overflow: 6497 * 3409630 cannot be represented in type 'int'
Fixes: 2819/clusterfuzz-testcase-minimized-4743700301217792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-08 19:25:17 +02:00
Michael Niedermayer 1e443051b2 avcodec/aacdec_fixed: fix invalid shift in predict() 
Fixes: runtime error: shift exponent -2 is negative
Fixes: 2818/clusterfuzz-testcase-minimized-5062943676825600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-05 23:56:55 +02:00
Michael Niedermayer 1f53bde6d8 avcodec/h264_slice: Fix overflow in slice offset 
Fixes: runtime error: signed integer overflow: 1610612736 * 2 cannot be represented in type 'int'
Fixes: 2817/clusterfuzz-testcase-minimized-5289691240726528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-05 23:56:52 +02:00
Michael Niedermayer 4ff94558f2 avcodec/hevc_cabac: Check for ff_init_cabac_decoder() failure in cabac_reinit() 
Fixes: runtime error: left shift of negative value -967831544
Fixes: 2815/clusterfuzz-testcase-minimized-6062914471460864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-03 15:42:52 +02:00
Michael Niedermayer d1bfa80ec4 avcodec/h264idct_template: Fix integer overflow in ff_h264_idct_add() 
Fixes: runtime error: signed integer overflow: 26215360 + 2121330944 cannot be represented in type 'int'
Fixes: 2809/clusterfuzz-testcase-minimized-4785181833560064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
 2017-08-03 15:31:15 +02:00
Michael Niedermayer b2d9d72269 avcodec/diracdsp: fix integer overflow 
Fixes: runtime error: signed integer overflow: 11 * 225726413 cannot be represented in type 'int'
Fixes: 2764/clusterfuzz-testcase-minimized-5382561922547712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-01 13:54:43 +02:00
Michael Niedermayer 880f5c5913 avcodec/diracdec: Check weight_log2denom 
Fixes: runtime error: shift exponent -1 is negative
Fixes: 2742/clusterfuzz-testcase-minimized-5724322402402304
Fixes: 2744/clusterfuzz-testcase-minimized-4672435653705728
Fixes: 2749/clusterfuzz-testcase-minimized-5298741273690112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-01 13:54:43 +02:00
Michael Niedermayer 46e4075549 avcodec/dirac_vlc: Fix invalid shift 
Fixes: runtime error: shift exponent 65 is too large for 64-bit type 'residual' (aka 'unsigned long')
Fixes: 2737/clusterfuzz-testcase-minimized-4968639147016192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-01 13:54:43 +02:00
Michael Niedermayer bf8ab72ae9 avcodec/dirac_dwt: Fix multiple integer overflows in COMPOSE_DD97iH0() 
Fixes: runtime error: signed integer overflow: 9 * 335544320 cannot be represented in type 'int'
Fixes: 2739/clusterfuzz-testcase-minimized-6737297955356672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-29 16:28:22 +02:00
Michael Niedermayer c0220c768c avcodec/diracdec: Fix integer overflow in divide3() 
Fixes: runtime error: signed integer overflow: -1073746548 * 21845 cannot be represented in type 'int'
Fixes: 2729/clusterfuzz-testcase-minimized-5902915464069120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-29 04:05:53 +02:00
Michael Niedermayer 2c630d159f avcodec/takdec: Fix integer overflow in decode_subframe() 
Fixes: runtime error: signed integer overflow: -536870912 - 1972191120 cannot be represented in type 'int'
Fixes: 2711/clusterfuzz-testcase-minimized-4975142398590976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-29 04:05:53 +02:00
Michael Niedermayer ffcc82219c avformat/rtmppkt: Convert ff_amf_get_field_value() to bytestream2 
Fixes: out of array accesses

Found-by: JunDong Xie of Ant-financial Light-Year Security Lab
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-29 04:05:53 +02:00
Michael Niedermayer 08c073434e avformat/rtmppkt: Convert ff_amf_tag_size() to bytestream2 
Fixes: out of array accesses
Fixes: crash-9238fa9e8d4fde3beda1f279626f53812cb001cb-SEGV

Found-by: JunDong Xie of Ant-financial Light-Year Security Lab
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-29 03:54:39 +02:00
Michael Niedermayer 8e275a74b0 avcodec/diracdec: Fix integer overflow in signed multiplication in UNPACK_ARITH() 
Fixes: runtime error: signed integer overflow: 1073741823 * 4 cannot be represented in type 'int'
Fixes: 2729/clusterfuzz-testcase-minimized-5902915464069120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-28 03:35:22 +02:00
Michael Niedermayer aeddb3607b avcodec/pixlet: Simplify nbits computation 
Fixes multiple integer overflows
Fixes: runtime error: signed integer overflow: 1 + 2147483647 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-28 03:35:22 +02:00
Michael Niedermayer 296debd213 avcodec/dnxhddec: Move mb height check out of non hr branch 
Fixes: out of array access
Fixes: poc.dnxhd

Found-by: Bingchang, Liu@VARAS of IIE
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-27 03:07:12 +02:00
Michael Niedermayer 5d0b69f3b7 avcodec/jpeg2000dec: Fix h/vden typo 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-27 00:01:27 +02:00
Michael Niedermayer 1b00600319 avcodec/jpeg2000dec: Fix division by zero in jp2_find_codestream() 
Fixes: 2707/clusterfuzz-testcase-minimized-5179636394754048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-26 17:06:29 +02:00
Michael Niedermayer 74c1c22d7f avcodec/hevc_ps: fix integer overflow in log2_parallel_merge_level_minus2 
Fixes: runtime error: signed integer overflow: -2147483647 - 2 cannot be represented in type 'int'
Fixes: 2702/clusterfuzz-testcase-minimized-4511932591636480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-26 17:06:29 +02:00
Michael Niedermayer 7140761481 avformat/oggparsecelt: Do not re-allocate os->private 
Fixes: double free
Fixes: clusterfuzz-testcase-minimized-5080550145785856

Found-by: ClusterFuzz
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-25 22:04:34 +02:00
Michael Niedermayer 03a9e6ff30 avcodec/ylc: Fix shift overflow 
Fixes: runtime error: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 2698/clusterfuzz-testcase-minimized-4713541443518464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-24 17:52:42 +02:00
Michael Niedermayer 0764fe1d09 avcodec/aacps: Fix multiple integer overflow in map_val_34_to_20() 
Fixes: avcodec/aacps.c:511:40: runtime error: signed integer overflow: 1509077651 + 758068176 cannot be represented in type 'int'
Fixes: 2678/clusterfuzz-testcase-minimized-4702787684270080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-24 17:52:42 +02:00
Michael Niedermayer aff93e1929 avcodec/mpegvideo_enc: Use intra/inter scantable matching mb type in quantization 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-24 02:42:33 +02:00
Michael Niedermayer 2dfb8c4178 avcodec/aacdec_fixed: fix: left shift of negative value -1 
Fixes: 2699/clusterfuzz-testcase-minimized-5631303862976512

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-24 02:42:33 +02:00
Michael Niedermayer 69e7daf6ce avcodec/dirac_vlc: Fix undefined shift 
Fixes: runtime error: shift exponent 64 is too large for 64-bit type 'residual' (aka 'unsigned long')
Fixes: 2674/clusterfuzz-testcase-minimized-4999700518273024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-24 02:42:33 +02:00
Michael Niedermayer edc88646ee avcodec/diracdec: Check dimensions which are closer to what is allocated in alloc_sequence_buffers() 
Fixes OOM
Fixes: 2674/clusterfuzz-testcase-minimized-4999700518273024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-21 17:37:05 +02:00
Michael Niedermayer 1196e53b70 doc: Add initial documentation explaining undefined behavior and SUINT 
Requested-by: Kieran Kunhya <kierank@obe.tv>

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-21 17:37:05 +02:00
Michael Niedermayer c61715e2c5 avcodec/htmlsubtitles: Be a bit more picky on syntax 
This reduces the number of strstr() calls per byte
This diasalows empty tags like '< >' as well as '<' in tags like '<ab<cd<<ef>'

Fixes timeout
Fixes: 1817/clusterfuzz-testcase-minimized-5104230530547712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-18 22:14:16 +02:00
Michael Niedermayer 2886142e0c avcodec/aacdec_template (fixed point): Check gain in decode_cce() to avoid undefined shifts later 
Fixes: runtime error: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 2581/clusterfuzz-testcase-minimized-4681474395602944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-18 22:14:16 +02:00
Michael Niedermayer ba4beaf614 avcodec/apedec: Fix integer overflow 
Fixes: out of array access
Fixes: PoC.ape and others

Found-by: Bingchang, Liu@VARAS of IIE
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-16 16:53:02 +02:00
Michael Niedermayer 4de4308d2a avcodec/ffv1dec_template: Fix signed integer overflow 
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 2634/clusterfuzz-testcase-minimized-4540890636877824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-16 02:09:43 +02:00
Michael Niedermayer 0ef8f03133 avcodec/aacdec_template: Fix undefined integer overflow in apply_tns() 
Fixes: runtime error: signed integer overflow: -2147483648 - 1202286525 cannot be represented in type 'int'
Fixes: 2071/clusterfuzz-testcase-minimized-6036414271586304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-16 01:07:27 +02:00
Michael Niedermayer d0ba0be355 fate: add sub-srt-badsyntax test 
Based-on: srt sample by ubitux

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-15 04:16:44 +02:00
Michael Niedermayer a824685140 avcodec/ivi: Use av_image_check_size2() 
Fixes OOM
Fixes: 1514/clusterfuzz-testcase-minimized-6437666243477504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-12 20:36:13 +02:00
Michael Niedermayer 341f01290c avcodec/magicyuv: Check that vlc len is not too large 
Fixes: runtime error: shift exponent -95 is negative
Fixes: 2568/clusterfuzz-testcase-minimized-4926115716005888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-12 17:26:18 +02:00
Michael Niedermayer c28f648b19 avcodec/mjpegdec: Clip DC also on the negative side. 
Fixes: runtime error: signed integer overflow: -16711425 + -2130772346 cannot be represented in type 'int'
Fixes: 2533/clusterfuzz-testcase-minimized-5372857678823424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-12 16:32:27 +02:00
Michael Niedermayer 80b9e40b6f avcodec/aacps (fixed point): Fix multiple signed integer overflows 
Fixes: runtime error: signed integer overflow: 1421978265 - -1810326882 cannot be represented in type 'int'
Fixes: 2527/clusterfuzz-testcase-minimized-5260915396050944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-12 04:20:21 +02:00
Michael Niedermayer fe9242204d avcodec/ylc: Fix vlc of 31 bits 
Fixes: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 2515/clusterfuzz-testcase-minimized-6197200012967936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-08 23:45:47 +02:00
Michael Niedermayer 2061de8a3f avcodec/sbrdsp_fixed: Fix integer overflow in sbr_hf_apply_noise() 
Fixes: runtime error: signed integer overflow: -2049425300 + -117591631 cannot be represented in type 'int'
Fixes: part of 2096/clusterfuzz-testcase-minimized-4901566068817920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-08 23:45:41 +02:00
Michael Niedermayer f1baafac71 avcodec/interplayvideo: Clean up frames on parameter change 
Fixes: out of array access
Fixes: 2467/clusterfuzz-testcase-minimized-4755798049685504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-06 03:59:09 +02:00
Michael Niedermayer c8cfbc6629 avcodec/hevcdec: do not let updated extradata corrupt state 
Fixes: out of array access
Fixes: 2451/clusterfuzz-testcase-minimized-4781613957251072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Hendrik Leppkes <h.leppkes@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-05 04:37:57 +02:00
Michael Niedermayer c07af72098 avcodec/wavpack: Fix invalid shift 
Fixes: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 2377/clusterfuzz-testcase-minimized-6108505935183872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-05 03:19:27 +02:00
Michael Niedermayer 7592d97f10 avcodec/h264_slice: Fix signed integer overflow 
Fixes: runtime error: signed integer overflow: 26 + 2147483644 cannot be represented in type 'int'
Fixes: 2456/clusterfuzz-testcase-minimized-4822695051001856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-05 03:19:27 +02:00
Michael Niedermayer de54a37c1d avcodec/hevc_ps: Fix integer overflow with beta/tc offsets 
Fixes: runtime error: signed integer overflow: 2113929216 * 2 cannot be represented in type 'int'
Fixes: 2422/clusterfuzz-testcase-minimized-5242114713583616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-30 16:24:16 +02:00
Michael Niedermayer ecc16d893d avfilter/vf_geq: >8 bps support 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-30 12:34:34 +02:00
Michael Niedermayer 60a45713e7 avcodec/interplayvideo: Check ff_get_buffer() for failure 
Fixes: runtime error: division by zero
Fixes: 2408/clusterfuzz-testcase-minimized-5432734438653952
Fixes: 2415/clusterfuzz-testcase-minimized-4672827619803136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-30 03:34:58 +02:00
Michael Niedermayer 0b180d2066 fate: Add fate-copy-trac3074 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-30 03:03:08 +02:00
Michael Niedermayer c709f009da avcodec/cfhd: Fix invalid left shift of negative value 
Fixes: runtime error: left shift of negative value -1
Fixes: 2395/clusterfuzz-testcase-minimized-6540529313513472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-28 23:39:11 +02:00
Michael Niedermayer bc6ab72bc7 avcodec/vb: Check vertical GMC component before multiply 
Fixes: runtime error: signed integer overflow: 8224 * 663584 cannot be represented in type 'int'
Fixes: 2393/clusterfuzz-testcase-minimized-6128334993883136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-28 23:39:11 +02:00
Michael Niedermayer 850c6db97d avcodec/utvideodec: Factor multiply out of inner loop 
0.5% faster loop

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-28 14:08:21 +02:00
Michael Niedermayer 5eb4701b7d avcodec/utvideodec: bswap directly without memcpy 
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-28 14:08:21 +02:00
Michael Niedermayer 676a589c93 avcodec/utvideodec: enable unchecked bitreader 
inner reader loop becomes 16% faster

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-28 14:08:21 +02:00
Michael Niedermayer 9c604b34d4 avcodec/utvideodec: hardcode vlc bits 
2.5% faster vlc decoding

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-28 14:08:21 +02:00
Michael Niedermayer 1835c5e7a4 avcodec/utvideodec: Move bitstream end check out of inner loop 
This is not needed when the buffer is large enough for the worst case of a line

2% faster vlc reading

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-28 14:08:21 +02:00
Michael Niedermayer 516c213f08 avcodec/x86/vp9dsp_init_16bpp: Fix linking to missing ff_vp9_ipred_dr_32x32_16_avx2() on 32bit 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-28 00:31:33 +02:00
Michael Niedermayer c578c9c229 libswresample/swresample: remove obsolete code 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-27 23:21:53 +02:00