virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-06-19 19:03:00 +02:00
Code Issues Releases Activity
114,203 Commits 39 Branches 425 Tags
2df103528c175cfe2d9d3b63c57f17a1fb3a1d46
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer e0e30e07a1 avcodec/proresenc_kostya: Remove bug similarity text 
According to kostya, it is not based on Wassermans encoder

CC: Kostya Shishkov <kostya.shishkov@gmail.com>
CC: Anatoliy Wasserman <anatoliy.wasserman@yandex.ru>

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-03-10 19:49:05 +01:00
Michael Niedermayer dc89cf804a avcodec/vorbisdec: Check remaining data in vorbis_residue_decode_internal() 
Fixes: timeout
Fixes: 66326/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-6295291863040000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-03-10 19:49:04 +01:00
Michael Niedermayer b2d7cbc378 avformat/concatdec: Check in and outpoints to be to produce a positive representable duration 
Fixes: signed integer overflow: -93000000 - 9223372036839000000 cannot be represented in type 'long'
Fixes: 64546/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-5110813828186112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-03-10 19:49:04 +01:00
Michael Niedermayer 5db09574df avcodec/8bps: Consider width in the minimal size check 
Fixes: Timeout
Fixes: 64479/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EIGHTBPS_fuzzer-5434435386081280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-03-10 19:49:03 +01:00
Michael Niedermayer b95c0d93ff avcodec/vvc/vvcdec: allow vvc_decode_close() on failed open 
Fixes: division by 0
Fixes: 67008/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-5873503163187200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-03-02 13:29:07 +08:00
Michael Niedermayer 22845fbb80 doc: Add infra.txt 2024-02-24 15:05:19 +01:00
Michael Niedermayer e9cc9e492f libswscale/utils: Fix bayer to yuvj 
Fixes: out of array access.

Earlier code assumes that a unscaled bayer to yuvj420 converter exists
but the later code then skips yuvj420

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-02-21 18:24:17 +01:00
Michael Niedermayer f9906911f0 Revert "swscale: fix sws_setColorspaceDetails after sws_init_context" 
Suggested by: Niklas Haas in Ticket10824

Fixes: Assertion failure
Fixes: Ticket10824

This reverts commit cedf589c09.
 2024-02-21 18:24:17 +01:00
Michael Niedermayer 8caa84cec7 tools: Add target_sws_fuzzer.c 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-02-21 18:24:17 +01:00
Michael Niedermayer 64098d0cd8 swscale/swscale: Check srcSliceH for bayer 
Fixes: Assertion srcSliceH > 1 failed at libswscale/swscale_unscaled.c:1359
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-02-21 18:24:16 +01:00
Michael Niedermayer 18f26f8a2f swscale/utils: Allocate more dithererror 
Fixes: out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-02-21 18:24:16 +01:00
Michael Niedermayer 7f36127595 avfilter/v360: Use AV_VIDEO_MAX_PLANES 
Issue found through Coverity CID1457948

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-02-16 21:34:38 +01:00
Michael Niedermayer eea9bd88a5 avutil/pixfmt: Add AV_VIDEO_MAX_PLANES 
It seems we do not have a named identifier for the maximum planes of pixel formats

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-02-16 21:34:38 +01:00
Michael Niedermayer ebb7dffa97 swscale/tests/swscale: Add help text 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-02-15 23:07:44 +01:00
Michael Niedermayer 6ebe4ebee3 swscale/tests/swscale: Highlight cases that worsened 
also highlight cases that worsened alot in uppercase

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-02-15 23:07:44 +01:00
Michael Niedermayer f7770ec9a4 swscale/tests/swscale: Allow comparing a subset of cases to a reference file 
Testing all cases exhaustively is slow

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-02-15 23:07:44 +01:00
Michael Niedermayer 885a802f24 swscale/tests/swscale: Test a wider range of flag combinations 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-02-15 23:07:43 +01:00
Michael Niedermayer 35ab103c30 swscale/tests/swscale: Compute chroma and alpha between gray and opaque frames too 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-02-15 23:07:43 +01:00
Michael Niedermayer 247f485448 swscale/tests/swscale: Split sws_getContext() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-02-15 23:07:43 +01:00
Michael Niedermayer 1055ece30b swscale/tests/swscale: Implement isALPHA() using AVPixFmtDescriptor 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-02-15 23:07:42 +01:00
Michael Niedermayer 3be80ce299 avcodec/indeo3: Round dimensions up in allocate_frame_buffers() 
Fixes: Ticket6581

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-02-12 00:50:47 +01:00
Michael Niedermayer f465badb06 avutil/rational: Document what is to be expected from av_d2q() of doubles representing rational numbers 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-02-12 00:50:46 +01:00
Michael Niedermayer 66f60a2355 avcodec/ac3enc_template: add fbw_channels assert 
fbw_channels must be > 0 as teh code is only run if cpl_enabled is set and that requires mode >= AC3_CHMODE_STEREO

CID 718138 Uninitialized scalar variable
	assumes this assert to be false

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-02-12 00:50:46 +01:00
Michael Niedermayer 98ae1ad7cf avfilter/signature_lookup: Do not dereference NULL pointers after malloc failure 
Fixes: CID 1403229 Dereference after null check

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-02-12 00:50:46 +01:00
Michael Niedermayer 6c50482951 avfilter/signature_lookup: dont leave uncleared pointers in sll_free() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-02-12 00:50:45 +01:00
Michael Niedermayer d6c62b4bce tests/checkasm/aacencdsp: Use float_near_ulp_array() for abs_pow34() test 
Fixes: ticket/10818
Approved-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-01-24 00:42:13 +01:00
Michael Niedermayer 88a9142cac avformat/mxfenc: Remove AVERROR² 
Reviewed-by: James Almer <jamrial@gmail.com>
Reviewed-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-01-24 00:42:13 +01:00
Michael Niedermayer 278fea3664 avutil/eval: Use even better PRNG 
This is the 64bit version of Chris Doty-Humphreys SFC64

Compared to the LCGs these produce much better quality numbers.
Compared to LFGs this needs less state. (our LFG has 224 byte
state for its 32bit version) this has 32byte state
Also the initialization for our LFG is slower.
This is also much faster than KISS or PCG.

This commit replaces the broken LCG used before.
(broken as it had only a period ~200M due to being put in a double)

This changes the output from random() which is why libswresample.mak
is updated, update was done using the command in libswresample.mak

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-01-16 01:34:57 +01:00
Michael Niedermayer e063c1d079 avcodec/mpegvideo_enc: Use ptrdiff_t for stride 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-30 21:50:05 +01:00
Michael Niedermayer a066b8a809 avcodec/mpegvideo_enc: Dont copy beyond the image 
Fixes: out of array access
Fixes: tickets/10754/poc17ffmpeg

Discovered by Zeng Yunxiang.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-30 21:50:04 +01:00
Michael Niedermayer 68146f06f8 avfilter/vf_minterpolate: Check pts before division 
Fixes: FPE
Fixes: tickets/10758/poc20ffmpeg

Discovered by Zeng Yunxiang

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-30 21:50:04 +01:00
Michael Niedermayer 08bd2cbfeb avfilter/avf_showwaves: Check history_nb_samples 
Fixes: out of array access
Fixes: tickets/10756/poc18ffmpeg

Discovered by Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-30 21:50:04 +01:00
Michael Niedermayer 029294ff54 avformat/flacdec: Avoid double AVERRORS 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 21:36:03 +01:00
Michael Niedermayer bb04235d72 avfilter/vf_vidstabdetect: Avoid double AVERRORS 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 21:36:03 +01:00
Michael Niedermayer bf1159774b avcodec/vaapi_encode: Avoid double AVERRORS 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 21:36:02 +01:00
Michael Niedermayer 7deaca71b3 avfilter/vf_swaprect: round coordinates down 
Fixes: out of array access:
Fixes: tickets/10745/poc12ffmpeg

Found-by: Li Zeyuan and Zeng Yunxiang.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 21:07:59 +01:00
Michael Niedermayer 9f4c5bd7d2 avfilter/vf_swaprect: Use height for vertical variables 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 21:07:58 +01:00
Michael Niedermayer 9d1ba698d2 avfilter/vf_swaprect: assert that rectangles are within memory 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 21:07:58 +01:00
Michael Niedermayer a88b06f9ee avfilter/af_alimiter: Check nextpos before use 
Fixes: out of array read
Fixes: tickets/10744/poc11ffmpeg

Found-by: Li Zeyuan and Zeng Yunxiang.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 21:07:57 +01:00
Michael Niedermayer 61e73851a3 avfilter/f_reverse: Apply PTS compensation only when pts is available 
Fixes: out of array access
Fixes: tickets/10753/poc16ffmpeg

Regression since: 45dc668aea
Found-by: Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 19:29:07 +01:00
Michael Niedermayer 50f0f8c53c avfilter/af_stereowiden: Check length 
Fixes: out of array access
Fixes: tickets/10746/poc13ffmpeg

Found-by: Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 19:29:06 +01:00
Michael Niedermayer 850ab8f6da avcodec/jpegxl_parser: Check get_vlc2() 
Fixes: shift exponent -1 is negative
Fixes: 63889/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6009343056936960

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 19:21:26 +01:00
Michael Niedermayer 0ecc1f0e48 avfilter/vf_weave: Fix odd height handling 
Fixes: out of array access
Fixes: tickets/10743/poc10ffmpeg

Found-by: Zeng Yunxiang and Li Zeyuan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 01:28:11 +01:00
Michael Niedermayer c443658d26 avfilter/edge_template: Fix small inputs with gaussian_blur() 
Fixes: out of array access
Fixes: Ticket10699
Fixes: poc5ffmpeg

Found-by: Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 01:28:10 +01:00
Michael Niedermayer e4d2666bdc avfilter/vf_gradfun: Do not overread last line 
The code works in steps of 2 lines and lacks support for odd height
Implementing odd height support is better but for now this fixes the
out of array access

Fixes: out of array access
Fixes: tickets/10702/poc6ffmpe

Found-by: Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 01:19:05 +01:00
Michael Niedermayer ab0fdaedd1 avfilter/avf_showspectrum: fix off by 1 error 
Fixes: out of array access
Fixes: tickets/10749/poc15ffmpeg

Regression since: 81df787b53

Found-by: Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 01:19:04 +01:00
Michael Niedermayer aec67d3d7d avfilter/af_stereowiden: Round length to nearest 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 01:19:03 +01:00
Michael Niedermayer d909d8e5e0 avcodec/leaddec: Check remaining bits in decode_block() 
Fixes: Timeout
Fixes: 64163/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LEAD_fuzzer-6418925835124736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 01:15:42 +01:00
Michael Niedermayer 5f88458bea avcodec/jpegxl_parser: Add padding to cs_buffer 
Fixes: out of array access
Fixes: 64081/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6151006496620544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 01:15:42 +01:00
Michael Niedermayer f1dc7b9257 tools/target_dec_fuzzer: Adjust threshold for QPEG 
Fixes: 63712/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QPEG_fuzzer-456353017272729
Fixes: Timeout

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 01:15:41 +01:00
Michael Niedermayer cfc0a68d4d avformat/mov: do not set sign bit for chunk_offsets 
Fixes: signed integer overflow: 2314885530818453536 - -7412889664301817824 cannot be represented in type 'long'
Fixes: 64296/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6304027146846208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 01:00:49 +01:00
Michael Niedermayer c72a20f01a avcodec/jpeglsdec: Check Jpeg-LS LSE 
Fixes: signed integer overflow: 2147478526 + 33924 cannot be represented in type 'int'
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 64243/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-5195717848989696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 01:00:48 +01:00
Michael Niedermayer d344a4191c tools/target_dec_fuzzer: Adjust Threshold for VP6A 
Fixes: Timeout
Fixes: 64220/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP6A_fuzzer-5653856213925888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 01:00:48 +01:00
Michael Niedermayer c75fccd1d4 avcodec/osq: Implement flush() 
Fixes: out of array access
Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6227491892887552
Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6268561729126400
Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6414805046788096
Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6538151088488448
Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6608131540779008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 00:45:20 +01:00
Michael Niedermayer a6a553ba94 avcodec/cbs_vp8: fix GetBitContext setup 
Fixes: abort()
Fixes: 64232/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5417957987319808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-19 00:27:26 +01:00
Michael Niedermayer aa1e768120 tools/target_dec_fuzzer: Adjust threshold for VMIX 
Fixes: Timeout
Fixes: 62286/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMIX_fuzzer-5155237134204928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-14 23:34:46 +01:00
Michael Niedermayer 22daf2148f avcodec/av1dec: Fix resolving zero divisor 
Fixes: Out of array read
Fixes: global-buffer-overflow-AV1

Found-by: "Leonelli, Matteo" <matteo.leonelli@cispa.de>
Tested-by: "Wang, Fei W" <fei.w.wang@intel.com>
Reviewed-by: "Wang, Fei W" <fei.w.wang@intel.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-05 12:38:16 +01:00
Michael Niedermayer 4cdf2c7f76 avformat/mov: Ignore duplicate ftyp 
Fixes: switch_1080p_720p.mp4
Found-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-05 12:12:10 +01:00
Michael Niedermayer 3c154e8579 doc/git-howto: use less weird username for git URL 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: J. Dekker <jdek@itanimul.li>
 2023-11-22 10:21:50 +01:00
Michael Niedermayer fb52070848 avcodec/h264dec: use BOOL for skip_gray, noref_gray 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-22 01:22:31 +01:00
Michael Niedermayer e56d91f8a8 avcodec/h264dec: Support skipping frames that used gray gap frames 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-20 00:19:25 +01:00
Michael Niedermayer 6364fa9e9a avcodec/h264: Avoid using gray gap frames as references 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-20 00:19:25 +01:00
Michael Niedermayer 29f6c9b04d avcodec/h264: keep track of which frames used gray references 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-20 00:19:04 +01:00
Michael Niedermayer e4337606e1 avcodec/h264dec: More elaborate documentation for frame_recovered 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-20 00:12:30 +01:00
Michael Niedermayer 68e1cf204a avcodec/h264: Use FRAME_RECOVERED_HEURISTIC instead of IDR/SEI 
This keeps IDR/SEI and heuristically detected recovery points cleaner seperated

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-20 00:12:30 +01:00
Michael Niedermayer 3f4a1a24a5 avcodec/h264: Seperate SEI and IDR recovery handling 
This avoids SEI and IDR recovery flags affecting each other

Also eliminate litteral numbers from recovery handling
This should make the code clearer

Improves: tickets/4738/tickets_cut.ts

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-20 00:12:29 +01:00
Michael Niedermayer 409b29d3f9 doc/APIchanges: Fill in missing values 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-10 02:04:25 +01:00
Michael Niedermayer ac4e3e188a avcodec/evc_parse: Check num_remaining_tiles_in_slice_minus1 
Fixes: out of array access
Fixes: 62467/clusterfuzz-testcase-minimized-ffmpeg_BSF_EVC_FRAME_MERGE_fuzzer-6092990982258688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: "Dawid Kozinski/Multimedia (PLT) /SRPOL/Staff Engineer/Samsung Electronics" <d.kozinski@samsung.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-10 00:15:28 +01:00
Michael Niedermayer bb0a684d93 avcodec/4xm: Check for cfrm exhaustion 
Fixes: index -1 out of bounds for type 'CFrameBuffer [100]'
Fixes: 63877/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5854263397711872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-10 00:14:02 +01:00
Michael Niedermayer 19fcf43131 avformat/mov: Disallow FTYP after streams 
Fixes: Assertion !c->fc->nb_streams failed at libavformat/mov.c:7799
Fixes: 63875/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5479178702815232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-10 00:14:02 +01:00
Michael Niedermayer 4fb9d94688 avformat/lafdec: Check for 0 parameters 
Fixes: Timeout
Fixes: 63661/clusterfuzz-testcase-minimized-ffmpeg_dem_LAF_fuzzer-6615365234589696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Sean McGovern <gseanmcg@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-03 22:16:33 +01:00
Michael Niedermayer 03a4aa9699 avcodec/flicvideo: consider width in copy loops 
Fixes: out of array write
Fixes: 63520/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-4876198087622656
Regression since: c7f8d42c12 (was not posted to ffmpeg-devel)

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Sean McGovern <gseanmcg@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-03 22:16:33 +01:00
Michael Niedermayer c0a18e884c avfilter/buffersink: fix order of operation with = and <0 
Reviewed-by: Sean McGovern <gseanmcg@gmail.com>
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-03 22:17:18 +01:00
Michael Niedermayer 9450a4a7fe avfilter/framesync: fix order of operation with = and <0 
Reviewed-by: Sean McGovern <gseanmcg@gmail.com>
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-03 22:16:33 +01:00
Michael Niedermayer a5259f326b avcodec/vlc: Pass VLC_MULTI_ELEM directly not by pointer 
This makes the code more testable as uninitialized fields are 0
and not random values from the last call

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-01 16:40:22 +01:00
Michael Niedermayer 8516609edd avcodec/vlc: Replace mysterious max computation code in multi vlc 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-01 16:40:21 +01:00
Michael Niedermayer 356b1ba765 avcodec/vlc: Skip subtable entries in multi VLC 
These entries do not correspond to VLC symbols that can be used
they do corrupt various variables like min/max bits

This also no longer assumes that there is a single non subtable
entry
Probably fixes some infinite loops too

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-01 16:40:21 +01:00
Michael Niedermayer c2f2bf82c1 tools/target_dec_fuzzer: Adjust threshold for CSCD 
Fixes: Timeout
Fixes: 63362/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CSCD_fuzzer-4694620065628160

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-01 16:40:21 +01:00
Michael Niedermayer 2817efbba3 avcodec/dovi_rpu: Use 64 bit in get_us/se_coeff() 
Fixes: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 63151/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5067531154751488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-01 16:40:20 +01:00
Michael Niedermayer 2def617787 avcodec/apedec: Fix integer overflow in predictor_decode_stereo_3950() 
Fixes: signed integer overflow: 1900031961 + 553590817 cannot be represented in type 'int'
Fixes: 63061/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5166188298371072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-01 16:40:20 +01:00
Michael Niedermayer 98c2711b58 avformat/mov: Check that is_still_picture_avif has no trak based streams 
Fixes: Assertion failure in mov_read_iloc( in mov_read_iloc())
Fixes: 62866/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5282997370486784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-01 16:40:20 +01:00
Michael Niedermayer 68cc1744db avcodec/evc_parse: Check tid 
The check is based on not infinite looping. It is likely
a more strict check can be done

Fixes: Infinite loop
Fixes: 62473/clusterfuzz-testcase-minimized-ffmpeg_BSF_EVC_FRAME_MERGE_fuzzer-5719883750703104
Fixes: 62765/clusterfuzz-testcase-minimized-ffmpeg_dem_EVC_fuzzer-6448531252314112
Fixes: 63378/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGPS_fuzzer-6504993844494336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: "Dawid Kozinski/Multimedia (PLT) /SRPOL/Staff Engineer/Samsung Electronics" <d.kozinski@samsung.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-01 16:40:19 +01:00
Michael Niedermayer d35eecd24f avcodec/evc_parse: remove pow() and log2() 
The use of float based functions is both unneeded and wrong due to unpredictable rounding

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-01 16:40:03 +01:00
Michael Niedermayer 47e784f881 Bump versions after 6.1 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-29 16:19:14 +01:00
Michael Niedermayer 0e15b2b828 doc/APIchanges: Add 6.1 cut point 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-29 16:19:14 +01:00
Michael Niedermayer 9d3a7d30c4 Bump versions prior to 6.1 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-29 15:34:05 +01:00
Michael Niedermayer e4d5ac8d7d avformat/rtsp: Use rtsp_st->stream_index 
Fixes: out of array access
Fixes: rtpdec_h264.c149/poc

Found-by: Hardik Shah of Vehere
Reviewed-by: Martin Storsjö <martin@martin.st>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-27 18:10:47 +02:00
Michael Niedermayer 907743239d avutil/tx_template: fix integer ovberflwo in fft3() 
Fixes: signed integer overflow: -1028966111 + -1314089526 cannot be represented in type 'int'
Fixes: 63174/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5853273711837184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-27 18:10:47 +02:00
Michael Niedermayer 88453250db avcodec/jpeg2000dec: Check image offset 
Fixes: left shift of negative value -538967841
Fixes: 62447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-6427134337613824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-27 18:10:47 +02:00
Michael Niedermayer 9690d71f11 avcodec/vlc: dont pass nb_elems into multi vlc code 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-27 18:10:46 +02:00
Michael Niedermayer 9b546a0717 avcodec/vlc: merge lost 16bit end of array check 
Also cleanup related code

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-27 18:10:46 +02:00
Michael Niedermayer a23d527ec5 avcodec/magicyuv: remove redundant check in inner loop 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-27 18:10:46 +02:00
Michael Niedermayer 4ddf4f5001 avcodec/magicyuv: correct end of array check in multi VLC parsing 
Fixes: out of array write
Fixes: 63390/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_fuzzer-5144552979431424.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-27 18:10:45 +02:00
Michael Niedermayer ffac64a270 avcodec/bitstream_template: Basic documentation for read_vlc_multi() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-27 18:10:28 +02:00
Michael Niedermayer 5feceed008 avcodec/hevc_ps: Check cpb_cnt_minus1 before storing it 
Fixes: index 32 out of bounds for type 'uint32_t [32]'
Fixes: 63003/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4685160840560640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-19 20:46:55 +02:00
Michael Niedermayer 70f5fa6325 avformat/mxfdec: Check klv offset 
Fixes: Assertion klv_offset >= mxf->run_in failed at libavformat/mxfdec.c:736
Fixes: 62936/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5778404366221312.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-19 20:44:56 +02:00
Michael Niedermayer 5ddab49d48 avcodec/h2645_parse: Avoid EAGAIN 
EAGAIN causes an assertion failure when it is returned from the decoder

Fixes: Assertion consumed != (-(11)) failed at libavcodec/decode.c:462
Fixes: assertion_IOT_instruction_decode_c_462/poc

Found-by: Hardik Shah of Vehere (Dawn Treaders team)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-16 01:16:19 +02:00
Michael Niedermayer f7e5537dc1 avcodec/xvididct: Make c* unsigned to avoid undefined overflows 
Fixes: signed integer overflow: 1496950099 + 728014168 cannot be represented in type 'int'
Fixes: 62667/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEGB_fuzzer-6511785170305024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-16 01:14:10 +02:00
Michael Niedermayer 61b86add52 avcodec/cbs_h2645: Fix showing bits at the end in cbs_read_se_golomb() 
Fixes: Assertion n>0 && n<=25 failed at libavcodec/get_bits.h:375
Fixes: 62618/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_REDUNDANT_PPS_fuzzer-5145745046765568

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-16 01:14:09 +02:00
Michael Niedermayer 75eb698bdc avcodec/cbs_h2645: Fix showing bits at the end in cbs_read_ue_golomb() 
Fixes: Assertion n>0 && n<=25 failed at libavcodec/get_bits.h:375
Fixes: 62617/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5156555663998976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-16 01:14:08 +02:00