virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity
76,674 Commits 37 Branches 400 Tags 465 MiB
4f566654e7
Commit Graph

76674 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer
480a9a4b1d avformat/wtvdec: Check len in parse_chunks() to avoid overflow 
Fixes: signed integer overflow: 2147483647 + 7 cannot be represented in type 'int'
Fixes: 30084/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-6192261941559296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5552ceaf56)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
1eb919aa6f avformat/4xm: Make audio_frame_count 64bit 
Fixes: signed integer overflow: 2099257366 * 2 cannot be represented in type 'int'
Fixes: 27486/clusterfuzz-testcase-minimized-ffmpeg_dem_FOURXM_fuzzer-5112179134824448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 842c268c64)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
b206d775b6 avcodec/vp9dsp_template: Fix integer overflows in itxfm_wrapper 
Fixes: signed integer overflow: 2147483641 + 32 cannot be represented in type 'int'
Fixes: 27452/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5078752576667648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4dfb7ff528)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
b61436f918 avformat/rmdec: Reorder operations to avoid overflow 
Fixes: signed integer overflow: -2147483648 - 14 cannot be represented in type 'int'
Fixes: 27659/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-5697250168406016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b12e713b80)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
4a2738c68b avcodec/mxpegdec: fix SOF counting 
Fixes: Timeout (>10sec -> 15ms)
Fixes: 27652/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-5125920868007936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 401495def6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
d75428c9b7 avformat/rmdec: Fix codecdata_length overflow check 
Fixes: signed integer overflow: 2147483647 + 64 cannot be represented in type 'int'
Fixes: 28509/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-6310969680723968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3c41d0bfd6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
299da66195 avcodec/simple_idct: Fix undefined integer overflow in idct4row() 
Fixes: signed integer overflow: -1498310196 - 902891776 cannot be represented in type 'int'
Fixes: 28445/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5075163389493248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 57f7e5caa3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
9df52e5e46 avformat/tta: Use 64bit intermediate for index 
Fixes: signed integer overflow: 42032 * 51092 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_TTA_fuzzer-6679539648430080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fd61b42b4c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
b5af4e2398 avcodec/vp3: Check input amount in theora_decode_header() 
Fixes: Timeout
Fixes: 29226/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-6195092572471296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 869fe41d10)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
8d7c7fc253 avformat/wavdec: Check avio_get_str16le() for failure 
Fixes: out of array access
Fixes: 29195/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5037853281222656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d7594ee751)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
4ccca39927 avformat/flvdec: Check for EOF in amf_skip_tag() 
Fixes: Timeout
Fixes: 29070/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5650106766458880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9725d07a17)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
32d3a76d93 avformat/tedcaptionsdec: Check for overflow in parse_int() 
Fixes: signed integer overflow: 1111111111111111111 * 10 cannot be represented in type 'long'
Fixes: 26892/clusterfuzz-testcase-minimized-ffmpeg_dem_TEDCAPTIONS_fuzzer-5756045055754240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b0f8586ca9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
18775fa63c avformat/mpc8: Check size before implicitly converting to int 
Fixes: Timeout
Fixes: 28551/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6229183210586112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 78d6d8ddb5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
2d03bbcd78 avformat/nutdec: Fix integer overflow in count computation 
Note, the value is checked a few lines later already

Fixes: signed integer overflow: -440402016 - 1879048064 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6603876618469376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0014249fd9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
6fa82a09b9 avformat/utils: Check dts in update_initial_timestamps() more 
Fixes: signed integer overflow: -9223372036853488158 - 90000000 cannot be represented in type 'long long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_MPSUB_fuzzer-6696625298866176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 29851cb840)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
790ead2326 avformat/flvdec: Check for avio_read() failure in amf_get_string() 
Suggested-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cb31667611)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
a3f58614c4 avformat/flvdec: Check for nesting depth in amf_skip_tag() 
Fixes: out of array access
Fixes: 29440/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5985279812960256.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2ef522c918)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
01cd33e59f avformat/flvdec: Check for nesting depth in amf_parse_object() 
Fixes: out of array access
Fixes: 29202/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5112845840809984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 074e204b42)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
e4bae4cb70 avformat/asfdec_o: Check for EOF in asf_read_marker() 
Fixes: Timeout
Fixes: 26460/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-5710884393189376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9e3d09f435)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
c9c3db0799 avformat/utils: Check dts - (1<<pts_wrap_bits) overflow 
Fixes: signed integer overflow: -9223372036842389247 - 2147483648 cannot be represented in type 'long long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_FLV_fuzzer-4845007531671552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d82ee907d6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
bafb1c236d avformat/bfi: Check chunk_header 
Fixes: signed integer overflow: -2147483648 - 3 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_BFI_fuzzer-6665764123836416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 638a151a87)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
ce63dc7d2e avcodec/utils: Check for integer overflow in get_audio_frame_duration() for ADPCM_DTK 
Fixes: signed integer overflow: 131203586 * 28 cannot be represented in type 'int'
Fixes: 26817/clusterfuzz-testcase-minimized-ffmpeg_dem_MSF_fuzzer-6296902548848640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2488ba85a0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
432dbb3126 avformat/mxfdec: Fix integer overflow in next position in mxf_read_local_tags() 
Fixes: signed integer overflow: 9223372036854775723 + 8192 cannot be represented in type 'long'
Fixes: 29072/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4812604904177664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d3d9b1fc8e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
b222d99f4d avformat/avidec: dv does not support palettes 
Fixes: memleak
Fixes: 26937/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5763003338981376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b373b41d9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
8691447d5d libavformat/utils: consider avio_size() failure in ffio_limit() 
Fixes: Timeout (>20sec -> 3ms)
Fixes: 26918/clusterfuzz-testcase-minimized-ffmpeg_dem_THP_fuzzer-5750425191710720

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b1dac2716)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
98ff613711 avformat/asfdec_o: Check size vs. offset in detect_unknown_subobject() 
Fixes: signed integer overflow: 2314885530818453566 + 7503032301549264928 cannot be represented in type 'long'
Fixes: 26639/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6024222100684800

Alternatively this could be ignored but then the end condition of the loop
would be hard to reach as avio_tell() is int64_t

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0bee216ad4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
8b8a912211 avformat/utils: check for integer overflow in av_get_frame_filename2() 
Fixes: signed integer overflow: 317316873 * 10 cannot be represented in type 'int'
Fixes: 24708/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5731180885049344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 03c479ce23)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
c38ef36736 avutil/timecode: Avoid undefined behavior with large framenum 
Fixes: signed integer overflow: 2147462079 + 2149596 cannot be represented in type 'int'
Fixes: 27565/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5091972813160448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b19057396)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
ac3b431483 avformat/sbgdec: Reduce the amount of floating point in str_to_time() 
Fixes: 1e+75 is outside the range of representable values of type 'long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6626834808700928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ac6c8993f7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
e45d6654fe avformat/mxfdec: Free all types for both Descriptors 
Fixes: memleak
Fixes: 26352/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5201158714687488

Suggested-by: Tomas Härdin <tjoppen@acc.umu.se>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 88519be8db)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
93cdec591b avcodec/wmaprodec: Check packet size 
Fixes: left shift of negative value -25824
Fixes: 27754/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA2_fuzzer-5760255962906624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 69aeba8a19)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
9dc6c0d8d0 avformat/mpegts: Fix argument type for av_log 
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 654b21ef17)
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
451899f9c0 avcodec/ffv1dec: Fix off by 1 error with quant tables 
Fixes: assertion failure
Fixes: 28447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-5369575948550144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5cae71d2b7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
b6b10bd6bc avformat/mpegts: Increase pcr_incr width to 64bit 
Fixes: division by zero
Fixes: 26459/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5666350112178176
Fixes: 28154/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5195728439476224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ef7b117b7b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
4fb6c6bcac avformat/mov: Check if hoov is at the end 
Fixes: Timeout, probably infinite loop
Fixes: 26559/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5391165484171264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0afbaabdca)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
79b17daba5 avcodec/hevc_ps: check scaling_list_dc_coef 
Fixes: signed integer overflow: 2147483640 + 8 cannot be represented in type 'int'
Fixes: 28449/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5686013259284480

Reviewed-by: James Almer <jamrial@gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f1700bd8bb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
76e156555e avformat/matroskadec: Sanity check codec_id/track type 
Fixes: memleak
Fixes: 27766/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-5198300814508032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7b88dd8f0c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
74063774e2 avformat/rpl: Check the number of streams 
Fixes: out of memory access
Fixes: 27787/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-4743666463408128.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0677bdb1f5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
852f1ebe9c avcodec/h264idct_template: Fix integer overflow in ff_h264_chroma422_dc_dequant_idct() 
Fixes: signed integer overflow: -2105540608 - 2105540608 cannot be represented in type 'int'
Fixes: 26870/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5656647567147008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 51dfd6f1bd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
86d0295f38 avformat/mpc8: Check remaining space in mpc8_parse_seektable() 
Fixes: Fixes infinite loop
Fixes: 26704/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6327056939614208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4f66dd13d0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
54a85a4d4f avformat/id3v2: Sanity check tlen before alloc and uncompress 
Fixes: Timeout (>20sec -> 65ms)
Fixes: 26896/clusterfuzz-testcase-minimized-ffmpeg_dem_DAUD_fuzzer-5691024049176576
Fixes: 27627/clusterfuzz-testcase-minimized-ffmpeg_dem_AEA_fuzzer-4907019324358656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d7f87a4b9e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
a6a2c67023 avformat/vqf: Check len for COMM chunks 
Fixes: Infinite loop
Fixes: 26696/clusterfuzz-testcase-minimized-ffmpeg_dem_VQF_fuzzer-5648269168082944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a834af133b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
ac42b64fec avcodec/hevc_cabac: Limit value in coeff_abs_level_remaining_decode() tighter 
The max depth is 16bps, the max allowed coefficient depth is depth+6
Fixes: signed integer overflow: 1074266112 + 1073725439 cannot be represented in type 'int'
Fixes: 26493/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5657763331702784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7cf852b03c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
ee570d535d avformat/cafdec: Check the return code from av_add_index_entry() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9dc3301745)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
a6fc6c9f96 avformat/cafdec: Check for EOF in index read loop 
Fixes: OOM
Fixes: 27398/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-541296033975500

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eb46939e3a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
b8fe632a73 avformat/cafdec: Check that bytes_per_packet and frames_per_packet are non negative 
These fields are not signed in the spec (1.0) so they cannot be negative
Changing bytes_per_packet to unsigned would not solve this as it is exported
as block_align which is signed

Fixes: Infinite loop
Fixes: 26492/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5632087614554112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5eed718087)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
4371d51f1b avcodec/exr: Check ymin vs. h 
Fixes: out of array access
Fixes: 26532/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5613925708857344
Fixes: 27443/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5631239813595136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3e5959b345)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
2051ed938c avformat/avs: Use 64bit for the avio_tell() output 
Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented in type 'long'
Fixes: 26549/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS_fuzzer-4844306424397824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1278f117d7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
98ae46133c avformat/wavdec: More complete size check in find_guid() 
Fixes: signed integer overflow: 9223372036854775807 + 8 cannot be represented in type 'long'
Fixes: 27341/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5442833206738944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a207df2acb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00
Michael Niedermayer
ba06c753dd avformat/iff: Check size before skip 
Fixes: Infinite loop
Fixes: 27292/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5731168991051776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8b50e8bc29)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-10-17 21:34:53 +02:00