virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-06-19 19:03:00 +02:00
Code Issues Releases Activity
88,535 Commits 39 Branches 425 Tags
6a50a8f340161a0b65feb3537591b0381a6a6b38
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer cf5a6c754a avcodec/gdv: Check compression before allocating frame 
Fixes: 2926/clusterfuzz-testcase-4987110014582784

This reduces decoding time from 7 to 4 seconds

The timeout should have been fixed in 0561bd2fc2 but ossfuzz did not close this issue

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-11-03 00:56:30 +01:00
Michael Niedermayer 2b739e1cb8 avcodec/h264idct_template: Fix integer overflows in ff_h264_idct8_add() 
Fixes: runtime error: signed integer overflow: 924846844 + 1457520640 cannot be represented in type 'int'
Fixes: 3416/clusterfuzz-testcase-minimized-6125587682820096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-11-01 22:11:10 +01:00
Michael Niedermayer e8fafef1db avcodec/xan: Improve overlapping check 
Fixes: memcpy-param-overlap
Fixes: 3612/clusterfuzz-testcase-minimized-6393461273001984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-11-01 22:11:10 +01:00
Michael Niedermayer 41d96af2a7 avcodec/aacdec_fixed: Fix integer overflow in apply_dependent_coupling_fixed() 
Fixes: runtime error: signed integer overflow: 623487 * 536870912 cannot be represented in type 'int'
Fixes: 3594/clusterfuzz-testcase-minimized-4650622935629824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-30 21:32:26 +01:00
Michael Niedermayer 0976752420 avcodec/aacdec_fixed: Fix integer overflow in predict() 
Fixes: runtime error: signed integer overflow: -2110708110 + -82837504 cannot be represented in type 'int'
Fixes: 3547/clusterfuzz-testcase-minimized-6009386439802880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-30 21:32:26 +01:00
Michael Niedermayer f1251a6b9c ffmpeg: Fix stored encoder metadata with -bitexact 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-30 21:32:26 +01:00
Michael Niedermayer f80224ed19 avcodec/jpeglsdec: Check for end of bitstream in ls_decode_line() 
Fixes: 1773/clusterfuzz-testcase-minimized-4832523987189760

Fixes: Timeout

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-29 18:28:40 +01:00
Michael Niedermayer fe533628b9 avcodec/jpeglsdec: Check ilv for being a supported value 
Fixes: 1773/clusterfuzz-testcase-minimized-4832523987189760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-29 18:28:40 +01:00
Michael Niedermayer eb54efc1e1 avformat/ac3dec: Check buf2 before adding 16 in ac3_eac3_probe() 
This is needed since e0250cf365 as that uses end-buf2
Note, there are more than 16 bytes allocated beyond "end"

Fixes: regression (segfault) with probetest

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-28 20:24:04 +02:00
Michael Niedermayer c23209f63d tools/target_dec_fuzzer: Fix build after AV_CODEC_CAP_HWACCEL_VDPAU was removed 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-25 21:50:37 +02:00
Michael Niedermayer e6debcaaed tools/target_dec_fuzzer: Fix build after FF_INPUT_BUFFER_PADDING_SIZE was removed 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-25 21:50:37 +02:00
Michael Niedermayer 431eccd61e tests/ffserver.regression.ref: update checksums to what ffserver currently produces 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-25 00:18:33 +02:00
Michael Niedermayer 617f0c65e1 ffserver: Fix off by 1 error in path 
Code suggested by ubitux

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-25 00:18:33 +02:00
Michael Niedermayer 2c9fa4162b ffmpeg: add -bitexact flag to simplify enabling bitexact mode in (de)muxer and (de/en)coder 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-23 12:41:04 +02:00
Michael Niedermayer 963247b5f3 avcodec/dvbsubdec: Split best score computation out of loop in compute_default_clut() 
3% faster

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-14 23:23:25 +02:00
Michael Niedermayer cd2f69cdd6 avcodec/dvbsubdec: Factor a few expressions out of compute_default_clut() 
32% faster loop

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-14 23:23:25 +02:00
Michael Niedermayer 393d6fc739 avcodec/snowdec: Check mv_scale 
Fixes: runtime error: signed integer overflow: 2 * -1094995530 cannot be represented in type 'int'
Fixes: 3512/clusterfuzz-testcase-minimized-4812747210489856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-14 23:23:25 +02:00
Michael Niedermayer 9c85329cd0 avcodec/pafvideo: Check for bitstream end in decode_0() 
Fixes: Timeout
Fixes: 3529/clusterfuzz-testcase-5057068371279872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-14 23:23:25 +02:00
Michael Niedermayer e4d5310a50 RELEASE: update for git after 3.4 branchpoint 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-11 02:46:23 +02:00
Michael Niedermayer 80154b1b3a Bump version for master after 3.4 branchpoint 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-11 02:45:37 +02:00
Michael Niedermayer 7bec3f78da avcodec/rkmppdec: check wether typo 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-11 02:15:21 +02:00
Michael Niedermayer 74d2bbb70d avcodec/opusenc_psy: Fix mixed declaration and statement 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-11 02:13:16 +02:00
Michael Niedermayer 92ae4ab56d doc/APIchanges: Add 3.4 cut point 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-11 01:23:49 +02:00
Michael Niedermayer e1de9eab3a Bump minor versions for branching 3.4 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-11 01:23:47 +02:00
Michael Niedermayer ed8ff608b2 doc/APIchanges: Update 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-11 00:16:15 +02:00
Michael Niedermayer 832fc05a9b avutil/frame: Fix project name 
Issue introduced in: caa12027ba

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-11 00:02:07 +02:00
Michael Niedermayer c20f4fcb74 avcodec/ffv1dec: Fix out of array read in slice counting 
Fixes: test-201710.mp4

Found-by: 连一汉 <lianyihan@360.cn> and Zhibin Hu
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-10 23:58:41 +02:00
Michael Niedermayer bdee75a4e7 avcodec/dirac_dwt: Fix integer overflow in COMPOSE_53iL0() 
Fixes: runtime error: signed integer overflow: 2147483646 + 2 cannot be represented in type 'int'
Fixes: 3485/clusterfuzz-testcase-minimized-4940429332054016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-10 23:58:40 +02:00
Michael Niedermayer 127a362630 avcodec/mpeg_er: Clear mcsel in mpeg_er_decode_mb() 
Fixes out of array read
Should fix: 3516/clusterfuzz-testcase-minimized-4608518562775040 (not reprodoceable)

Found-by: Insu Yun, Georgia Tech.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-10 23:58:40 +02:00
Michael Niedermayer e38f280fec avcodec/mpeg4videodec: Use 64 bit intermediates for sprite delta 
Fixes: runtime error: signed integer overflow: -104713 * 65536 cannot be represented in type 'int'
Fixes: 3453/clusterfuzz-testcase-minimized-5555554657239040
Fixes: 3528/clusterfuzz-testcase-minimized-6283628420005888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-10 23:58:40 +02:00
Michael Niedermayer 26ea142658 avcodec/x86/lossless_videoencdsp: Fix warning: signed dword value exceeds bounds 
Add () to regsize define

Suggested-by: Henrik Gramner <henrik@gramner.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-05 01:22:44 +02:00
Michael Niedermayer df62b70de8 avcodec/x86/lossless_videoencdsp: Fix handling of small widths 
Fixes out of array access
Fixes: crash-huf.avi

Regression since: 6b41b44149

This could also be fixed by adding checks in the C code that calls the dsp

Found-by: Zhibin Hu and 连一汉 <lianyihan@360.cn>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-05 01:22:44 +02:00
Michael Niedermayer d662143f06 avcodec/dxv: Check for end of input in dxv_decompress_dxt5() 
Fixes: Timeout
Fixes: 3291/clusterfuzz-testcase-4630024655208448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-04 02:16:11 +02:00
Michael Niedermayer 44874b4f5e avcodec/truemotion2: Fix integer overflows in tm2_high_chroma() 
Fixes: runtime error: signed integer overflow: -1408475220 + -1408475220 cannot be represented in type 'int'
Fixes: 3336/clusterfuzz-testcase-minimized-5656839179993088

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-04 02:16:11 +02:00
Michael Niedermayer dcf9bae4a9 avcodec/aacdec_template: Clear tns present flag on error 
Fixes: 3444/clusterfuzz-testcase-minimized-6270352105668608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-04 02:16:11 +02:00
Michael Niedermayer 4ee77cefae avcodec/proresdec2: Use LAST_SKIP_BITS where possible 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-03 20:34:35 +02:00
Michael Niedermayer c37138e01a avcodec/proresdec2: SKIP_BITS() does not work with len=32 
Fixes: invalid shift
Fixes: 3482/clusterfuzz-testcase-minimized-5446915875405824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-03 20:34:35 +02:00
Michael Niedermayer fbdab6eca7 avcodec/hevcdsp_template: Fix undefined shift 
Fixes: runtime error: left shift of negative value -255
Fixes: 3373/clusterfuzz-testcase-minimized-5604083912146944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-03 20:34:35 +02:00
Michael Niedermayer ef973bd98d avformat/mxfenc: Fix labels for IEC PAL DV 420 2017-10-03 18:34:37 +02:00
Michael Niedermayer a56ec48d42 avformat/mxfenc: Add IEC DV25 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-03 18:34:37 +02:00
Michael Niedermayer d679f3d021 avfilter/vf_thumbnail_cuda: Avoid mixing declaration and statements 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-01 02:36:00 +02:00
Michael Niedermayer b81b8a76b5 avcodec/v4l2_context: Reduce spelling variations 
Reviewed-by: Lou Logan <lou@lrcd.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-01 02:37:57 +02:00
Michael Niedermayer 4bb8013335 avcodec/v4l2_buffers: More clear return code documentation 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-01 02:35:15 +02:00
Michael Niedermayer 64e034da95 avcodec/jpeg2000: Check that codsty->log2_prec_widths/heights has been initialized 
Fixes: OOM
Fixes: 2225/clusterfuzz-testcase-minimized-5505632079708160

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-30 23:35:45 +02:00
Michael Niedermayer 5d31f03a02 avcodec/takdec: Fix integer overflow in decode_lpc() 
Fixes: runtime error: signed integer overflow: 16748560 + 2143729712 cannot be represented in type 'int'
Fixes: 3202/clusterfuzz-testcase-minimized-4988291642294272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-24 21:54:13 +02:00
Michael Niedermayer 4f5eaf0b59 avcodec/proresdec2: Check bits in DECODE_CODEWORD(), fixes invalid shift 
Fixes: runtime error: shift exponent 42 is too large for 32-bit type 'unsigned int'
Fixes: 3410/clusterfuzz-testcase-minimized-5313377960198144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-24 21:54:13 +02:00
Michael Niedermayer 3dabb9c69d avcodec/takdec: Fix integer overflows in decode_subframe() 
Fixes: runtime error: signed integer overflow: -1562477869 + -691460395 cannot be represented in type 'int'
Fixes: 3196/clusterfuzz-testcase-minimized-4528307146063872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-24 21:54:13 +02:00
Michael Niedermayer d8ef5a47bb avcodec/flacenc: Replace "return -1" by named constant 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-24 02:33:48 +02:00
Michael Niedermayer 9cec174247 avcodec/snowenc: Replace "return -1" by named constants 
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-24 02:33:48 +02:00
Michael Niedermayer 67da2685e0 avcodec/dirac_dwt: Fix integer overflow in COMPOSE_FIDELITYi*() 
Fixes: runtime error: signed integer overflow: 161 * 13872281 cannot be represented in type 'int'

Fixes: 3295/clusterfuzz-testcase-minimized-4738998142500864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-22 12:19:07 +02:00
Michael Niedermayer d00fc952b6 avcodec/ffv1dec: Fix integer overflow in read_quant_table() 
Fixes: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 3361/clusterfuzz-testcase-minimized-5065842955911168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-22 12:19:07 +02:00
Michael Niedermayer 2c933c5168 avcodec/svq3: Fix overflow in svq3_add_idct_c() 
Fixes: runtime error: signed integer overflow: 2147392585 + 524288 cannot be represented in type 'int'
Fixes: 3348/clusterfuzz-testcase-minimized-4809500517203968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-22 12:19:07 +02:00
Michael Niedermayer 5480e82d77 avcodec/pngdec: Clean up on av_frame_ref() failure 
Fixes: memleak
Fixes: 3203/clusterfuzz-testcase-minimized-4514553595428864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-20 02:56:20 +02:00
Michael Niedermayer 08ec828de9 avcodec/vorbisenc: Fix mixed declaration and statements 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-16 19:55:03 +02:00
Michael Niedermayer d76838c1ad avcodec/fits: Fix include type 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-16 19:55:03 +02:00
Michael Niedermayer 0f5576a22b avutil/imgutils: Fix warning: missing braces around initializer 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-16 19:55:03 +02:00
Michael Niedermayer de03eb622d avformat/mxfenc: Correct the Sample rate for PCM outside D10 
Based on mail from IRT

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-12 19:24:25 +02:00
Michael Niedermayer 4c33ec004f avformat/mxfenc: Comment edit rate write code like the surrounding code 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-12 19:24:25 +02:00
Michael Niedermayer 4c88087f93 avformat/mxfenc: Replace more literal magic numbers by enum values. 
This also moves the enum table up as it is needed earlier

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-12 19:24:25 +02:00
Michael Niedermayer e952d4b7ac avcodec/hevc_ps: Fix limit of chroma_qp_offset_list_len_minus1 
A value of 5 is allowed

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-12 01:52:14 +02:00
Michael Niedermayer abf3f9fa23 avcodec/hevc_ps: Fix c?_qp_offset_list size 
Fixes: runtime error: index 5 out of bounds for type 'int8_t const[5]'
Fixes:3175/clusterfuzz-testcase-minimized-4736774054084608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-12 01:52:14 +02:00
Michael Niedermayer 380659604f avcodec/shorten: Move buffer allocation and offset init to end of read_header() 
They are time consuming operations, performing them after the other checks
improves the speed with damaged input dramatically.

Fixes: Timeout
Fixes: 2928/clusterfuzz-testcase-4992812120539136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-12 01:52:14 +02:00
Michael Niedermayer 2d025e7428 avcodec/jpeg2000dsp: Fix multiple integer overflows in ict_int() 
Fixes: runtime error: signed integer overflow: 22553 * -188962 cannot be represented in type 'int'
Fixes: 3042/clusterfuzz-testcase-minimized-5174210131394560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-11 12:28:23 +02:00
Michael Niedermayer f0efd795f4 avcodec/clearvideo: Only output a frame if one is coded in the packet 
Fixes: Timeout (183 ms instead of about 20 sec)
Fixes: 3147/clusterfuzz-testcase-4870592182353920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-11 12:23:59 +02:00
Michael Niedermayer c225da68cf avcodec/hevcdsp_template: Fix undefined shift in put_hevc_pel_bi_w_pixels 
Fixes: runtime error: left shift of negative value -95
Fixes: 3077/clusterfuzz-testcase-minimized-4684917524922368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-11 12:23:58 +02:00
Michael Niedermayer b5995856a4 avcodec/diracdec: Fix overflow in DC computation 
Fixes: runtime error: signed integer overflow: 11896 + 2147483646 cannot be represented in type 'int'
Fixes: 3053/clusterfuzz-testcase-minimized-6355082062856192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-11 12:23:53 +02:00
Michael Niedermayer 981f04b2ae avcodec/scpr: optimize shift loop. 
Speeds code up from 50sec to 15sec

Fixes Timeout
Fixes: 3242/clusterfuzz-testcase-5811951672229888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-10 19:08:23 +02:00
Michael Niedermayer d98d29a775 avcodec/dirac_vlc: limit res_bits in APPEND_RESIDUE() 
Fixes: runtime error: left shift of 1073741838 by 1 places cannot be represented in type 'int32_t' (aka 'int')
Fixes: 3279/clusterfuzz-testcase-minimized-4564805744590848

Suggested-by: <atomnuker>
Reviewed-by: <atomnuker>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-09 18:55:47 +02:00
Michael Niedermayer afc9c683ed avformat/asfdec: Fix DoS in asf_build_simple_index() 
Fixes: Missing EOF check in loop
No testcase

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-07 15:19:22 +02:00
Michael Niedermayer 9cb4eb7728 avformat/mov: Fix DoS in read_tfra() 
Fixes: Missing EOF check in loop
No testcase

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-07 15:19:22 +02:00
Michael Niedermayer 913feb6263 avformat/gdv: Make FixedSize static 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-07 15:19:22 +02:00
Michael Niedermayer d8bc198d09 avfilter/vf_overlay: Restore shorthand option order 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-05 23:55:19 +02:00
Michael Niedermayer c595139f1f avcodec/dirac_vlc: Fix invalid shift in ff_dirac_golomb_read_32bit() 
Fixes: runtime error: shift exponent 64 is too large for 64-bit type 'residual' (aka 'unsigned long')
Fixes: 2838/clusterfuzz-testcase-minimized-6260066086813696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-02 23:50:28 +02:00
Michael Niedermayer f71cd44147 avcodec/dirac_dwt: Fix multiple overflows in 9/7 lifting 
Fixes: runtime error: signed integer overflow: 1073901567 + 1073901567 cannot be represented in type 'int'
Fixes: 3124/clusterfuzz-testcase-minimized-454643435752652

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-02 23:50:28 +02:00
Michael Niedermayer 2a0823ae96 avcodec/diracdec: Fix integer overflow in INTRA_DC_PRED() 
Fixes: runtime error: signed integer overflow: 1168175789 + 1168178473 cannot be represented in type 'int'
Fixes: 3081/clusterfuzz-testcase-minimized-4807564879462400
Fixes: 2844/clusterfuzz-testcase-minimized-5561715838156800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-02 23:50:28 +02:00
Michael Niedermayer f762555a90 avformat/mxfenc: Replace literal numbers by named enum values. 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-30 02:15:36 +02:00
Michael Niedermayer 732f976456 avcodec/snowdec: Fix integer overflow in decode_subband_slice_buffered() 
Fixes: runtime error: signed integer overflow: 267 * 8388608 cannot be represented in type 'int'
Fixes: 2743/clusterfuzz-testcase-minimized-5820652076400640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-29 21:16:32 +02:00
Michael Niedermayer 2a83866c9f avcodec/hevc_ps: Fix undefined shift in pcm code 
Fixes: runtime error: shift exponent -1 is negative
Fixes: 3091/clusterfuzz-testcase-minimized-6229767969832960

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-29 21:16:32 +02:00
Michael Niedermayer 6def8b8d92 avcodec/h264idct_template: Fix integer overflow in ff_h264_idct8_add() 
Fixes: 2891/clusterfuzz-testcase-minimized-5881795457318912
Fixes: runtime error: signed integer overflow: 1551827968 - -775913984 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-29 21:16:32 +02:00
Michael Niedermayer 429f3266c1 avformat/mxfenc: Check that the video codec in D-10 is MPEG-2 
Others do not work, but nothing rejects them prior to this patch if the
parameters otherwise match

Reviewed-by: Matthieu Bouron <matthieu.bouron@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-29 21:16:32 +02:00
Michael Niedermayer aa26258faa avfilter/vf_zoompan: remove AVFILTER_FLAG_SUPPORT_TIMELINE_GENERIC 
Suggested-by: <durandal_1707>
Fixes: assertion failure

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-27 20:41:56 +02:00
Michael Niedermayer 0181b202cc avcodec/aacpsdsp_template: Fix undefined integer overflow in ps_add_squares_c() 
Fixes runtime error: signed integer overflow: 1997494407 + 613252359 cannot be represented in type 'int'
Fixes: 2014/clusterfuzz-testcase-minimized-5186337030275072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-27 19:40:28 +02:00
Michael Niedermayer eefb68c9c3 avcodec/sbrdsp_fixed: Fix undefined overflows in autocorrelate() 
Fixes: runtime error: signed integer overflow: 8903997421129740175 + 354481484684609529 cannot be represented in type 'long'
Fixes: 2045/clusterfuzz-testcase-minimized-6751255865065472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-27 19:40:23 +02:00
Michael Niedermayer 4f05e2e2dc avformat/mvdec: Fix DoS due to lack of eof check 
Fixes: loop.mv

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-27 19:23:37 +02:00
Michael Niedermayer 7ec414892d avformat/hls: Fix DoS due to infinite loop 
Fixes: loop.m3u

The default max iteration count of 1000 is arbitrary and ideas for a better solution are welcome

Found-by: Xiaohei and Wangchu from Alibaba Security Team

Previous version reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-27 19:19:00 +02:00
Michael Niedermayer 7c10068da1 avcodec/dvbsubdec: Check for duplicate regions in dvbsub_parse_page_segment() 
Fixes: OOM
Fixes: 3051/clusterfuzz-testcase-minimized-5745818336231424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-25 23:38:24 +02:00
Michael Niedermayer 351e28f9a7 ffprobe: Fix NULL pointer handling in color parameter printing 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-24 11:41:00 +02:00
Michael Niedermayer 837cb4325b ffprobe: Fix null pointer dereference with color primaries 
Found-by: AD-lab of venustech
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-24 11:31:03 +02:00
Michael Niedermayer 2b44dcbc44 avcodec/hevc_ps: Check delta_pocs in ff_hevc_decode_short_term_rps() 
Fixes: integer overflow
Fixes: 2893/clusterfuzz-testcase-minimized-5809330567774208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-24 11:29:40 +02:00
Michael Niedermayer c42a1388a6 avformat/rtpdec_h264: Fix heap-buffer-overflow 
Fixes: rtp_sdp/poc.sdp

Found-by: Bingchang <l.bing.chang.bc@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-23 22:19:33 +02:00
Michael Niedermayer 6f03ffb47d avcodec/aacdec_template: Fix running cleanup in decode_ics_info() 
Fixes: out of array read
Fixes: 2873/clusterfuzz-testcase-minimized-5924145713905664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Previous version reviewed-by: Alex Converse <alex.converse@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-22 20:01:31 +02:00
Michael Niedermayer a2e444d5bb avcodec/pngdec: Fix () placement 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-22 18:55:11 +02:00
Michael Niedermayer bc488ec28a avcodec/me_cmp: Fix crashes on ARM due to misalignment 
Adds a diff_pixels_unaligned()

Fixes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872503

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-21 23:19:18 +02:00
Michael Niedermayer 8754ccd3b3 avcodec/pixlet: Fixes: undefined shift in av_mod_uintp2() 
Fixes: runtime error: shift exponent 4294967289 is too large for 32-bit type 'int'
Fixes: 3030/clusterfuzz-testcase-minimized-4649809254285312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-20 21:14:47 +02:00
Michael Niedermayer a165b53daa avcodec/dirac_dwt_template: Fix integer overflow in vertical_compose53iL0() 
Fixes: runtime error: signed integer overflow: 2147483646 + 2 cannot be represented in type 'int'
Fixes: 3013/clusterfuzz-testcase-minimized-4644084197097472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-20 21:14:47 +02:00
Michael Niedermayer e7b9d136a1 avcodec/cngdec: Check skip_samples 
Without this its possible to make the new decode API decode billions of samples
out of a empty input and never return to the caller before all samples have been
created and discarded.

Fixes: Timeout
Fixes: 2992/clusterfuzz-testcase-6649611793989632

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-20 02:59:57 +02:00
Michael Niedermayer 0c9d5b015c avcodec/fic: Fixes signed integer overflow 
Fixes: runtime error: signed integer overflow: 1037142357 + 1227025305 cannot be represented in type 'int'
Fixes: 3024/clusterfuzz-testcase-minimized-5885660323905536

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-20 02:59:57 +02:00
Michael Niedermayer d132683ddd avcodec/snowdec: Fix off by 1 error 
Fixes: runtime error: index 4 out of bounds for type 'int8_t [4]'
Fixes: 3023/clusterfuzz-testcase-minimized-6421736130084864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-20 02:59:57 +02:00
Michael Niedermayer cadab5a2a7 avcodec/pixlet: fixes integer overflow in read_highpass() 
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: 2879/clusterfuzz-testcase-minimized-6317542639403008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-18 11:34:01 +02:00
Michael Niedermayer b9f92093a1 avcodec/ffv1dec: Check for bitstream end in decode_line() 
Fixes: timeout
Fixes: 2971/clusterfuzz-testcase-6130678276030464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-18 11:33:16 +02:00