virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-06-19 19:03:00 +02:00
Code Issues Releases Activity
83,734 Commits 39 Branches 425 Tags
13332504c98918447159da2a1a34e377dca360e2
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer 55196e5d10 Revert "avutil/frame: Disallow zero sized frame side data" 
Found a case where we use size==0, the other related commits
remain needed, and should be sufficient to fix the original issue

This reverts commit 7e4f32f4e4.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-03 01:03:29 +01:00
Michael Niedermayer 6191198c21 avcodec/interplayvideo: Fix timeout from lack of bitstream end check 
Fixes: 697/clusterfuzz-testcase-6111250582863872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-03 01:03:29 +01:00
Michael Niedermayer 3b0b35150d avcodec/mpegaudiodec_template: Fix runtime error: signed integer overflow: 2053224902 + 2053224902 cannot be represented in type 'int' 
Fixes: 696/clusterfuzz-testcase-5853632270434304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-03 01:03:29 +01:00
Michael Niedermayer 4b72d5cd6f avcodec/mjpegdec: Fix runtime error: left shift of negative value -511 
Fixes: 693/clusterfuzz-testcase-6109776066904064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-03 01:03:29 +01:00
Michael Niedermayer 4bed066377 avcodec/vp56: Clear dimensions in case of failure in the middle of a resolution change 
Similar code is used elsewhere in vp56 to force a more complete reinit in the future.
Fixes null pointer dereference
Fixes: 707/clusterfuzz-testcase-4717453097566208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-02 03:16:18 +01:00
Michael Niedermayer f8060ab927 avcodec/wavpack: Check value before shift in wp_exp2() 
Fixes undefined shift, all callers should be changed to check the value
they use with wp_exp2() or its return value.

Fixes: 692/clusterfuzz-testcase-5757381516460032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-02 03:16:15 +01:00
Michael Niedermayer 12c3e120fe avcodec/ituh263dec: Use 0xffff as error code in h263p_decode_umotion() 
This matches ff_h263_decode_motion() both functions error codes are interpreted by the same common code

Fixes: 690/clusterfuzz-testcase-4744944981901312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-02 03:16:12 +01:00
Michael Niedermayer 04c99c8042 avcodec/h264idct_template: Fix several runtime error: signed integer overflow 
Fixes: 689/clusterfuzz-testcase-6029352737177600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-02 03:16:10 +01:00
Michael Niedermayer e46ab99750 avformat/oggdec: fix leak in ogg_restore() 
Fixes: asan_bug_leak

Found-by: Thomas Guilbert <tguilbert@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-02 03:12:26 +01:00
Michael Niedermayer fb6fa48fce avformat/oggdec: Factor free_stream out 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-02 03:12:25 +01:00
Michael Niedermayer 3250d4b39c avformat/oggdec: remove unused parameter of ogg_restore() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-02 03:12:25 +01:00
Michael Niedermayer 7b5ff7d573 avcodec/vp8: Check for bitsteam end in decode_mb_row_no_filter() 
Fixes timeout with 686/clusterfuzz-testcase-5853946876788736

this shortcuts (i.e. speeds up) the error and
return-to-user when decoding a truncated frame

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Previous version reviewed by: "Ronald S. Bultje" <rsbultje@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-01 14:07:33 +01:00
Michael Niedermayer 4bd3f1ce3e avcodec/h264_direct: Fix runtime error: left shift of negative value -14 
Fixes: 682/clusterfuzz-testcase-4799120021651456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-01 14:07:33 +01:00
Michael Niedermayer 2c00b37302 avcodec/avpacket: Check metadata key in av_packet_unpack_dictionary() 
Fixes timeout
Fixes: 501/clusterfuzz-testcase-5672752870588416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-01 14:07:33 +01:00
Michael Niedermayer 7f62368bac MAINTAINERS: Add Rodger Combs to ffmpeg-security 
Rodger Combs will be added to the ffmpeg-security alias when this patch is applied

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Reviewed-by: Clément Bœsch <u@pkh.me>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-28 01:13:52 +01:00
Michael Niedermayer 4f21868207 MAINTAINERS: add wm4 to ffmpeg-security 
wm4 will be added to the ffmpeg-security alias when this patch is applied

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Reviewed-by: Clément Bœsch <u@pkh.me>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-28 01:13:52 +01:00
Michael Niedermayer 3d66eb6ec3 MAINTAINERS: Make formating of ffmpeg-security entry the same as others 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-28 01:13:52 +01:00
Michael Niedermayer 4c0139463c avcodec/vp56: Factorize vp56_render_mb() out 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-28 01:13:52 +01:00
Michael Niedermayer 949d2176ef avcodec/dca: Fix multiple runtime error: signed integer overflow 
Fixes: 680/clusterfuzz-testcase-5416627266912256
Fixes: 681/clusterfuzz-testcase-5013323462475776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-28 01:13:52 +01:00
Michael Niedermayer 63e400a880 avcodec/pictordec: Check plane value before doing value/mask computations 
Fixes integer overflow
Fixes: 675/clusterfuzz-testcase-6722971232108544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-28 01:13:52 +01:00
Michael Niedermayer 25e93aacc2 avcodec/mpeg4videodec: Fix runtime error: left shift of negative value -2650 
Fixes: 674/clusterfuzz-testcase-6713275880308736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-28 01:13:52 +01:00
Michael Niedermayer 4ea7744859 avcodec/h264idct_template: Fix multiple runtime error: signed integer overflow 
Fixes: 677/clusterfuzz-testcase-6635120628858880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-28 01:13:52 +01:00
Michael Niedermayer 7e9ba78f6b avcodec/flacdsp: Fix: runtime error: signed integer overflow: -1027555328 + -1226681270 cannot be represented in type 'int' 
Fixes: 673/clusterfuzz-testcase-5948736536576000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-26 17:16:22 +01:00
Michael Niedermayer 87eb374970 avcodec/eac3dec: Fix runtime error: left shift of negative value -3 
Fixes: 672/clusterfuzz-testcase-5595018867769344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-26 17:16:22 +01:00
Michael Niedermayer aff8cf18cb avcodec/mpeg12dec: Fix runtime error: left shift of negative value -2 
671/clusterfuzz-testcase-4990381827555328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-26 17:16:22 +01:00
Michael Niedermayer 0716bcce5b avcodec/ituh263dec: Check for the bitstream end in ff_h263_decode_mb() 
Fixes invalid shift

Fixes: 670/clusterfuzz-testcase-4852021066727424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-26 17:16:22 +01:00
Michael Niedermayer 7e4f32f4e4 avutil/frame: Disallow zero sized frame side data 
There should be no case that needs this and its a potential for
creating corner cases

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-25 22:02:23 +01:00
Michael Niedermayer 5804201cba avutil/frame: Reimplement av_frame_new_side_data() without size=0 special case 
The size 0 special case causes side data to be created which is
different and a special case if for any reasons size = 0 is passed

Fixes: multiple runtime error: null pointer passed as argument 1, which is declared to never be null
Fixes: 653/clusterfuzz-testcase-5773837415219200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-25 22:02:23 +01:00
Michael Niedermayer 58f3469cc6 avcodec/wavpack: Fix 280:22: runtime error: left shift of negative value -1 
Fixes: 653/clusterfuzz-testcase-5773837415219200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-25 22:02:23 +01:00
Michael Niedermayer 5eb04570f6 avcodec/wavpack: Check post_shift 
Fixes: runtime error: shift exponent 34 is too large for 32-bit type 'int'

Fixes: 653/clusterfuzz-testcase-5773837415219200

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-25 22:02:23 +01:00
Michael Niedermayer d34bf886e9 avcodec/vp56: Implement very basic error concealment 
This should fix the fate failure due to a truncated last frame.
Alternatively the frame could be dropped.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-25 13:09:50 +01:00
Michael Niedermayer 6bd79ba59f avcodec/amrwbdec: Fix 2 runtime errors: left shift of negative value -1 
Fixes: 669/clusterfuzz-testcase-4847965409640448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-25 02:20:35 +01:00
Michael Niedermayer 310d2af319 avcodec/pngdec: Fix runtime error: left shift of 152 by 24 places cannot be represented in type 'int' 
Fixes: 666/clusterfuzz-testcase-6581447227867136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-25 01:43:53 +01:00
Michael Niedermayer 513a349439 avcodec/vp56: Fix sign typo 
Fixes: 664/clusterfuzz-testcase-4917047475568640

The change to fate is due to a truncated last frames which is now detected as damaged.

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-24 22:23:53 +01:00
Michael Niedermayer 5d81616be3 avcodec/mpegaudiodec_template: Correct return code on id3 tag discarding 
Fixes: 665/clusterfuzz-testcase-4863789881098240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-24 22:23:53 +01:00
Michael Niedermayer c87ea47481 tools/target_dec_fuzzer: Fix misaligned read 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-24 14:12:13 +01:00
Michael Niedermayer 2b8b7921c5 avcodec/vp3dsp: Fix multiple signed integer overflow: 46341 * 47523 cannot be represented in type 'int' 
Fixes: 664/clusterfuzz-testcase-4917047475568640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-24 14:12:13 +01:00
Michael Niedermayer 8696f25444 avcodec/rv34: Simplify and factor get_slice_offset() code 
This also fixes several integer overflows by checking each value before
use.
Fixes: 662/clusterfuzz-testcase-4898131432964096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-24 14:12:12 +01:00
Michael Niedermayer 0d85c7bb5a avcodec/ituh263dec: Fix runtime error: left shift of 1342177279 by 1 places cannot be represented in type 'int' 
Fixes: 659/clusterfuzz-testcase-5866673603084288

Huge DMV could be created by an encoder ignoring the spec

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-24 00:38:45 +01:00
Michael Niedermayer e98dfeb27c avcodec/jpeglsdec: check shift for values that cause overflow later 
Fixes: 657/clusterfuzz-testcase-6674741433729024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-24 00:38:45 +01:00
Michael Niedermayer 76ba09d182 avcodec/mpeg4videodec: Check the other 3 sprite points for intermediate overflows 
This is not necessarily specific to fuzzed files

Fixes: Multiple integer overflows
Fixes: 656/clusterfuzz-testcase-6463814516080640
Fixes: 658/clusterfuzz-testcase-6691260146384896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-24 00:38:45 +01:00
Michael Niedermayer 9568b2e425 avcodec/h264_ps: Check chroma_qp_index_offset 
Fixes: 647/clusterfuzz-testcase-5195745823031296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: BBB
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-23 02:37:55 +01:00
Michael Niedermayer ec849f637e avcodec/h264idct_template: Fix several runtime error: signed integer overflow 
Fixes: 652/clusterfuzz-testcase-6174944410992640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-22 22:29:03 +01:00
Michael Niedermayer 6871df02d9 avcodec/mpeg4videodec: Check sprite_offset in addition to shifts 
Fixes: 651/clusterfuzz-testcase-5710668915277824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-22 22:29:03 +01:00
Michael Niedermayer 5a8fec1b33 avcodec/mpegaudiodec_template: Fix multiple runtime error: signed integer overflow 
Fixes: 648/clusterfuzz-testcase-5337961317007360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-22 22:29:03 +01:00
Michael Niedermayer c93a07070a MAINTAINERS: Add ffmpeg-security alias members 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-22 13:44:34 +01:00
Michael Niedermayer c9e3952b82 avcodec/rv34: Forward error from rv34_decode_mv() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-22 02:42:48 +01:00
Michael Niedermayer 6179dc8aa7 avcodec/mpeg4video: Fix runtime error: left shift of negative value 
Fixes: 644/clusterfuzz-testcase-4726434209726464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-22 02:42:48 +01:00
Michael Niedermayer 92188c8f57 avcodec/dcadsp: Fix runtime error: signed integer overflow: 394625024 * 8 cannot be represented in type 'int' 
Fixes: 643/clusterfuzz-testcase-5209078743695360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-22 02:42:48 +01:00
Michael Niedermayer 24f6559bd2 avcodec/rv34: Fix runtime error: signed integer overflow: -2 + -2147483648 cannot be represented in type 'int' 
Fixes: 642/clusterfuzz-testcase-558358808074649

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-22 02:42:48 +01:00
Michael Niedermayer 631f748491 avcodec/ituh263dec: Fix runtime error: left shift of negative value -22 
Fixes: 639/clusterfuzz-testcase-5143866241974272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-21 19:05:04 +01:00
Michael Niedermayer a59505ca76 avcodec/gsmdec_template: Fix runtime error: signed integer overflow: -22527 * 99113 cannot be represented in type 'int' 
Fixes: 636/clusterfuzz-testcase-6520876646268928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-21 19:05:04 +01:00
Michael Niedermayer 0c42d0add3 avcodec/bmp: Fix runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself 
There is code checking height and width later, leaving an invalid value invalid
is thus fine.

Fixes: 635/clusterfuzz-testcase-6225161437052928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-21 19:05:04 +01:00
Michael Niedermayer cbd622be99 avcodec/h264_ps: Check delta scale for validity 
Fixes: signed integer overflow: 5 + 2147483646 cannot be represented in type 'int'
Fixes: 634/clusterfuzz-testcase-5285420445204480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-21 15:31:06 +01:00
Michael Niedermayer 28dc6e7291 avcodec/simple_idct: Fix runtime error: left shift of negative value -6395 
Fixes: 633/clusterfuzz-testcase-4553133554401280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-21 15:31:06 +01:00
Michael Niedermayer 956472a323 avcodec/rv40: Fix runtime error: left shift of negative value 
Fixes: 630/clusterfuzz-testcase-6608718928019456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-21 15:31:06 +01:00
Michael Niedermayer e8a3498f24 avcodec/dca_xll: Fix runtime error: signed integer overflow: -1073741824 * 32768 cannot be represented in type 'int' 
Fixes: 629/clusterfuzz-testcase-6697457381539840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-21 00:40:20 +01:00
Michael Niedermayer 0a65dae9d0 avcodec/flacdec: reduce limit for golomb so that the max value does not overflow 
Fixes: runtime error: left shift of 32 by 26 places cannot be represented in type 'int'

Fixes: 628/clusterfuzz-testcase-6187747641393152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-21 00:40:20 +01:00
Michael Niedermayer e04108dfa6 avcodec/dca_xll: signed integer overflow: 255251 * 32768 cannot be represented in type 'int' 
Fixes: 627/clusterfuzz-testcase-5020897033322496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-21 00:40:20 +01:00
Michael Niedermayer 4614bf2caf Factorize CHECK/SUINT code 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-21 00:40:20 +01:00
Michael Niedermayer ed69cb83f8 fate/source: Check for cases that could use av_clip_uintp2() and av_clip_intp2() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-21 00:40:20 +01:00
Michael Niedermayer 15ccaa344c avcodec/mpegaudiodec: Eliminate many undefined operations 
Fixes: 625/clusterfuzz-testcase-4574924406521856
Fixes: 626/clusterfuzz-testcase-4738718621499392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-20 17:14:54 +01:00
Michael Niedermayer 01d196a67d avcodec/pictordec: Do not read more than nb_planes 
Fixes undefined behavior
Fixes: 622/clusterfuzz-testcase-5745722022428672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-20 17:14:54 +01:00
Michael Niedermayer b7d9b4a1f1 avcodec/ituh263dec: Check cbpy in ff_h263_decode_mb() 
Fixes: 618/clusterfuzz-testcase-6594990333493248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-20 00:49:44 +01:00
Michael Niedermayer c11d3634b0 avcodec/srtdec: Fix signed integer overflow: 1811992524 * 384 cannot be represented in type 'int' 
Fixes: 617/clusterfuzz-testcase-6413875723370496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-19 23:38:46 +01:00
Michael Niedermayer 59e5b05ef6 avcodec/h264_ps: Fix runtime error: signed integer overflow: -1094995528 * 2 cannot be represented in type 'int' 
Fixes: 615/clusterfuzz-testcase-5488002644049920
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-19 22:55:04 +01:00
Michael Niedermayer 258763ad0e avcodec/h264_cabac: runtime error: signed integer overflow: 2147483647 + 14 cannot be represented in type 'int' 
Fixes: 614/clusterfuzz-testcase-4931860079575040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-19 22:41:40 +01:00
Michael Niedermayer aa2b75263e avcodec/mpeg4videodec: Fix runtime error: shift exponent -2 is negative 
Fixes: 612/clusterfuzz-testcase-4707817137111040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-19 21:49:03 +01:00
Michael Niedermayer c91bdd4524 avcodec/mjpegdec: Fix runtime error: left shift of negative value -507 
Fixes: 611/clusterfuzz-testcase-5613455820193792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-19 21:49:03 +01:00
Michael Niedermayer 067485b673 avcodec/eac3dec: Fix runtime error: left shift of negative value 
Fixes: 610/clusterfuzz-testcase-4831030085156864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-19 21:49:03 +01:00
Michael Niedermayer 4279613a26 avcodec/pngdec: Check bit depth for validity 
Fixes: runtime error: shift exponent 132 is too large for 32-bit type 'int'
Fixes: 609/clusterfuzz-testcase-4825202619842560

See 11.2.2 IHDR Image header

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-19 19:48:57 +01:00
Michael Niedermayer 706757d26d avcodec/mpeg12dec: Fix runtime error: left shift of negative value 
Fixes: 608/clusterfuzz-testcase-603978286392934

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-19 19:48:57 +01:00
Michael Niedermayer 12eebb845a avcodec/wavpacl: Fix runtime error: left shift of negative value -1 
Fixes: 607/clusterfuzz-testcase-5108792465293312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-19 15:58:30 +01:00
Michael Niedermayer 3e1028c625 avcodec/flac: Fix several integer overflows 
Fixes: 686513-media
Found-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-19 15:58:30 +01:00
Michael Niedermayer e8d4eacc07 Factor CHECKED out of DEBUG so it can be set seperatly 
Suggested-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-19 15:39:36 +01:00
Michael Niedermayer 2ac6eedac5 avcodec/pngdec: Store metadata directly into AVFrame 
Fixes memleak
Fixes: 500/clusterfuzz-testcase-6315221727576064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-19 15:39:36 +01:00
Michael Niedermayer 3206ea4ba3 avformat/utils: Also fill dts==RELATIVE_TS_BASE packets in update_initial_durations() 
This dts value can end up in the list in the absence of durations and is in that
case semantically identical to AV_NOPTS_VALUE. We can alternatively prevent
storing RELATIVE_TS_BASE if there is no duration.

Fixes Ticket3640

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-19 02:07:12 +01:00
Michael Niedermayer 3f28caf720 avcodec/mpeg12dec: Provide debug level log on skiped P/B frames 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-19 02:07:12 +01:00
Michael Niedermayer 56803218db tests/fate/hevc: remove vsync drop from where it is not needed anymore 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-18 17:26:31 +01:00
Michael Niedermayer 6baee21eb7 avformat/m4vdec: Detect raw mpeg4video with unidentified non mpeg headers with a very low score 
Fixes Ticket 6018

This fixes a regression, and allows playback of files containing mpeg4video that are otherwise
not supported

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-18 04:18:30 +01:00
Michael Niedermayer 04e611474b avcodec/opus: Check count of ambisonic channels 
https://tools.ietf.org/html/draft-ietf-codec-ambisonics-01#section-3.1
specifies the maximum as 227

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-17 11:18:30 +01:00
Michael Niedermayer 1fa8884aeb avcodec/opusenc: Add () protecting macro arguments 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-16 13:24:11 +01:00
Michael Niedermayer 8365c1a15c avcodec/error_resilience: Fix "assignment from incompatible pointer type" warning 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-16 13:20:27 +01:00
Michael Niedermayer 6a37abc59a avcodec/h264_sei: Check actual presence of SEI picture timing instead of implying it 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-15 00:19:50 +01:00
Michael Niedermayer db3507a670 avcodec/hevc_parser: export framerate, remove one dependency on the decoder 
Fixes Ticket6090

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-14 17:00:30 +01:00
Michael Niedermayer 8fa18e042a avformat/http: Check for truncated buffers in http_connect() 
Reported-by: SleepProgger <security@gnutp.com>
Reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-14 04:02:51 +01:00
Michael Niedermayer 68b8be0811 doc/muxers: Fix typo, causing warnings during build 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-12 20:40:47 +01:00
Michael Niedermayer ce6e7a2db1 avcodec/mjpegenc: Simplify by moving assert into ff_mjpeg_encode_huffman_close() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-10 00:26:54 +01:00
Michael Niedermayer 3e1507a954 avcodec/mjpegenc: Bypass the 2 pass encoding when optimal tables are not requested 
This limits the bugs, speedloss and extra memory allocation to the case when
optimal tables are needed.
Fixes regressions with slice multi-threading

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-10 00:12:01 +01:00
Michael Niedermayer f57665b318 avcodec/mjpegenc: Revert some differences in ff_mjpeg_encode_mb() relative to pre optimal huffman 
The changes are not needed anymore and the return code was never used

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-10 00:12:01 +01:00
Michael Niedermayer b39129b68e avcodec/mjpegenc_huffman: remove unneeded header include 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-10 00:12:01 +01:00
Michael Niedermayer d23af72a0c avcodec/tests/mjpegenc_huffman: Remove static in main() table 
Avoids false positives when greping for non constant statics

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-10 00:12:01 +01:00
Michael Niedermayer daccbe81a2 avcodec/mjpegenc: Drop i_tex misuse, set itex/header bits correctly, fix 2pass encoding 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-10 00:12:01 +01:00
Michael Niedermayer e10bd12c25 avcodec/mjpegenc: Remove non functional huffman reallocation and error handling 
If this is wanted iam not against it but it must be designed to work with all cases
like slice threads, and a single growing buffer does not work very well with slices.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-10 00:12:01 +01:00
Michael Niedermayer c03029a835 avcodec/h264_slice: Clear ref_counts on redundant slices 
Fixes reading freed memory
Fixes: 568/clusterfuzz-testcase-6107186067406848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-08 18:31:04 +01:00
Michael Niedermayer 8c2ea3030a avcodec/pictordec: Fix logic error 
Fixes: 559/clusterfuzz-testcase-6424225917173760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-07 21:32:08 +01:00
Michael Niedermayer e248522d1b avcodec/movtextdec: Fix decode_styl() cleanup 
Fixes: null pointer dereference
Fixes: 555/clusterfuzz-testcase-5986646595993600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-06 11:19:05 +01:00
Michael Niedermayer 4fcdc9f359 avfilter/vf_midequalizer: Remove duplicate include 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-06 10:45:01 +01:00
Michael Niedermayer dfc6e30cd4 ffmpeg: Remove redundant null check 
Fixes CID1396245

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-06 01:01:33 +01:00
Michael Niedermayer 1e5cfad57e avcodec/pthread_frame: Check av_packet_ref() for failure 
Fixes CID1396242
 2017-02-06 01:01:33 +01:00