virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-06-19 19:03:00 +02:00
Code Issues Releases Activity
109,222 Commits 39 Branches 425 Tags
8ee071122806724a00eecb6b1eff639890c4be48
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer ba209e3d51 swscale/input: Use more unsigned intermediates 
Same principle as previous commit, with sufficiently huge rgb2yuv table
values this produces wrong results and undefined behavior.
The unsigned produces the same incorrect results. That is probably
ok as these cases with huge values seem not to occur in any real
use case.

Fixes: signed integer overflow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-11-20 21:55:06 +01:00
Michael Niedermayer 0871cb9499 avcodec/vqcdec: Check for end of input in decode_vectors() 
Fixes: Timeout
Fixes: 52695/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQC_fuzzer-4882310386548736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-11-20 21:23:57 +01:00
Michael Niedermayer 6634b6ae5f avcodec/apac: reset buffer on error 
Fixes: repeatly parsing the same data after each 1 byte packet
Fixes: Timeout
Fixes: 51943/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APAC_fuzzer-5779018251370496

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-11-20 21:23:35 +01:00
Michael Niedermayer 104b516a13 avcodec/bonk: step cannot become 0 without overflowing which is undefined 
also the original reference code does not contain a 0 check

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-11-14 21:52:51 +01:00
Michael Niedermayer 5df8c300a9 avcodec/bonk: actual_run seems not able to become negative 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-11-14 21:52:51 +01:00
Michael Niedermayer 00b489b168 avcodec/bonk: Remove special 32bit case from read_uint_max() 
This case seems not to match the reference decoder and it also
seems not reachable

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-11-14 21:52:51 +01:00
Michael Niedermayer 8e59e72041 avcodec/bonk: steplet cannot become negative 
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-11-10 21:14:23 +01:00
Michael Niedermayer 3263185225 avcodec/bonk: Check step against overflow 
No testcase

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-11-10 21:14:23 +01:00
Michael Niedermayer 9f00286c4c avcodec/bonk: Simplify read_uint_max() 
The max == 0 case can be removed too but i left it as 50% of the cases use it

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-11-10 21:14:23 +01:00
Michael Niedermayer f4df49eb48 avcodec/bonk: Use unsigned in predictor_calc_error() to avoid undefined overflows 
Fixes: signed integer overflow: 22 * -2107998208 cannot be represented in type 'int'
Fixes: 51363/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BONK_fuzzer-5660734784143360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-11-10 21:14:22 +01:00
Michael Niedermayer 024c5b4ab4 avcodec/dts2pts_bsf: Check ctx for NULL before ff_cbs_flush() 
Fixes: null pointer dereference
Fixes: 52155/clusterfuzz-testcase-minimized-ffmpeg_BSF_DTS2PTS_fuzzer-5760107527143424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-11-10 21:14:22 +01:00
Michael Niedermayer 1dc8d82da9 avcodec/alsdec: Check bits left before block decoding in non multi channel coding loop 
Fixes: Timeout
Fixes: 52161/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-6440216563154944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
 2022-11-04 22:47:19 +01:00
Michael Niedermayer 5280947fb6 avcodec/alsdec: The minimal block is at least 7 bits 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-11-04 22:47:19 +01:00
Michael Niedermayer 2532b20b17 avformat/replaygain: avoid undefined / negative abs 
Fixes: signed integer overflow: -2147483648 * 100000 cannot be represented in type 'int'
Fixes: 52060/clusterfuzz-testcase-minimized-ffmpeg_dem_MP3_fuzzer-5131616708329472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-11-04 22:44:16 +01:00
Michael Niedermayer b74f89caae swscale/output: Bias 16bps output calculations to improve non overflowing range for GBRP16/GBRPF32 
Fixes: integer overflow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-11-04 22:44:16 +01:00
Michael Niedermayer 0f0afc7fb5 swscale/output: Bias 16bps output calculations to improve non overflowing range 
Fixes: integer overflow
Fixes: ./ffmpeg   -f rawvideo -video_size 66x64 -pixel_format yuva420p10le   -i ~/videos/overflow_input_w66h64.yuva420p10le   -filter_complex "scale=flags=bicubic+full_chroma_int+full_chroma_inp+bitexact+accurate_rnd:in_color_matrix=bt2020:out_color_matrix=bt2020:in_range=full:out_range=full,format=rgba64[out]"   -pixel_format rgba64 -map '[out]'   -y overflow_w66h64.png

Found-by: Drew Dunne <asdunne@google.com>
Tested-by: Drew Dunne <asdunne@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-11-04 22:44:16 +01:00
Michael Niedermayer 9184d3d7b6 avcodec/speedhq: Check buf_size to be big enough for DC 
Fixes: Timeout
Fixes: 51919/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-6023716480090112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-20 21:42:21 +02:00
Michael Niedermayer 148b98a429 tools/target_dec_fuzzer: Adjust threshold for FFV1 
Fixes: Timeout
Fixes: 49446/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-5085639783088128

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-20 21:42:21 +02:00
Michael Niedermayer 4df91e2215 avcodec/ffv1dec: Fail earlier if prior context is corrupted 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-20 21:42:20 +02:00
Michael Niedermayer 557aa7772e avformat/asfdec_o: Check offset before adding index entry 
Fixes: signed integer overflow: 9223372036854550860 + 530259564 cannot be represented in type 'long'
Fixes: 49093/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-4697179192688640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-20 21:42:20 +02:00
Michael Niedermayer f1f78e3cf4 avcodec/mlpdec: add max channels check 
Fixes: out of array access
Fixes: 51648/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-4644322217164800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-04 23:47:54 +02:00
Michael Niedermayer 77164b2344 avcodec/speexdec: Check channels > 2 
More than 2 channels seems unsupported, the code seems to just output empty extra channels

Fixes: Timeout
Fixes: 51569/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEX_fuzzer-5511509165342720

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-04 23:47:54 +02:00
Michael Niedermayer 5f44489cc5 avformat/vividas: Check packet size 
Fixes: signed integer overflow: 119760682 - -2084600173 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-6745781167587328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-04 23:47:54 +02:00
Michael Niedermayer c5f61c99f9 tests/fate/truehd: Add test for shortened Ticket1726 testcase 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-10-04 23:47:53 +02:00
Michael Niedermayer 8008940da5 avcodec/dstdec: Check for overflow in build_filter() 
Fixes: signed integer overflow: 1917019860 + 265558963 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-4833165046317056

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 18:31:06 +02:00
Michael Niedermayer aa441ac105 avformat/matroskadec: Error out if a timestamp is beyond duration 
Maybe timestamp / duration validity should be checked earlier

Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6586894739177472
Fixes: signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'long'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 18:29:43 +02:00
Michael Niedermayer 4075f0cec1 avformat/spdifdec: Use 64bit to compute bit rate 
Fixes: signed integer overflow: 32 * 553590816 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-6564974517944320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 18:29:32 +02:00
Michael Niedermayer 529f64b2eb avformat/rpl: Use 64bit for duration computation 
Fixes: signed integer overflow: 24709512 * 88 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6737973728641024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 18:29:08 +02:00
Michael Niedermayer 2c789f753c avformat/xwma: Use av_rescale() for duration computation 
Fixes: signed integer overflow: 34242363648 * 538976288 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6577923913547776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 18:28:57 +02:00
Michael Niedermayer aa8eb1bed0 avformat/sdsdec: Use av_rescale() to avoid intermediate overflow in duration calculation 
Fixes: signed integer overflow: 72128794995445727 * 240 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_SDS_fuzzer-6628185583779840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 18:28:51 +02:00
Michael Niedermayer 5f529e9147 avformat/sbgdec: Check ts_int in genrate_intervals 
There is probably a better place to check for this, but better
here than nowhere

Fixes: signed integer overflow: -9223372036824775808 - 86400000000 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6601162580688896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 18:28:41 +02:00
Michael Niedermayer 981f5e46af avformat/sbgdec: clamp end_ts 
Fixes: signed integer overflow: 9223372036851135042 + 15666854 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6573717339111424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 18:28:29 +02:00
Michael Niedermayer 2cb7ee8a36 avformat/rmdec: check tag_size 
Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6598073725353984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 18:28:19 +02:00
Michael Niedermayer 2c146406ea avformat/nutdec: Check fields 
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6566001610719232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 18:28:10 +02:00
Michael Niedermayer 7124f10c1d avformat/flvdec: Use 64bit for sum_flv_tag_size 
Fixes: signed integer overflow: 2138820085 + 16130322 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_LIVE_FLV_fuzzer-6704728165187584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 18:27:43 +02:00
Michael Niedermayer b1a68127bb avformat/jacosubdec: Fix overflow in get_shift() 
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-6722544461283328
Fixes: signed integer overflow: 48214448 * 60 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 17:57:37 +02:00
Michael Niedermayer 0345a88545 avformat/genh: Check nb_channels for IMA ADPCM 
The check could be made more strict

Fixes: signed integer overflow: 36 * 538976288 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_GENH_fuzzer-6539389873815552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 17:57:37 +02:00
Michael Niedermayer 93db0f0740 avformat/dxa: avoid bpc overflows 
Fixes: signed integer overflow: 2147483647 + 32 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-6639823726706688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 17:57:37 +02:00
Michael Niedermayer 10453f5192 avformat/dhav: Use 64bit seek_back 
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_DHAV_fuzzer-6604736532447232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 17:57:36 +02:00
Michael Niedermayer d4bb4e3759 avformat/cafdec: Check that nb_frasmes fits within 64bit 
Fixes: signed integer overflow: 1099511693312 * 538976288 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6565048815845376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 17:57:36 +02:00
Michael Niedermayer 736e9e69d5 avformat/asfdec_o: Limit packet offset 
avoids overflows with it

Fixes: signed integer overflow: 9223372036846866010 + 4294967047 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6538296768987136
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-657169555665715

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 17:57:36 +02:00
Michael Niedermayer 5b23cab5c7 avformat/apm: Use 64bit for bit_rate computation 
Fixes: signed integer overflow: -1155522528 * 4 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_APM_fuzzer-6580670570299392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 17:57:35 +02:00
Michael Niedermayer d0349c9929 avformat/ape: Check frames size 
Fixes: signed integer overflow: 9223372036854775806 + 3 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_APE_fuzzer-6389264140599296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 17:57:35 +02:00
Michael Niedermayer db73ae0dc1 avformat/icodec: Check nb_pal 
Fixes: signed integer overflow: 538976288 * 4 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-6690068904935424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-22 17:44:05 +02:00
Michael Niedermayer 9303ba272e avformat/aiffdec: Use 64bit for block_duration use 
Fixes: signed integer overflow: 3 * -2147483648 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6668935979728896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-22 17:44:05 +02:00
Michael Niedermayer 1c2b6265c8 avformat/aiffdec: Check block_duration 
Fixes: signed integer overflow: 3 * -2147483648 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6668935979728896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-22 17:44:04 +02:00
Michael Niedermayer c5bd689655 avformat/mxfdec: Avoid some redundant writing to tables in mxf_compute_ptses_fake_index() 
offsets suggested by Tomas Härdin
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-22 17:44:04 +02:00
Michael Niedermayer 1182bbb2c3 avformat/mxfdec: only probe max run in 
Suggested-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-22 17:44:04 +02:00
Michael Niedermayer 7786097825 avformat/mxfdec: Check run_in is within 65536 
Fixes: signed integer overflow: 9223372036854775807 - -2146905566 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6570996594769920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-22 17:44:03 +02:00
Michael Niedermayer dd81cc22b3 avcodec/mjpegdec: Check for unsupported bayer case 
Fixes: out of array access
Fixes: 51462/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-662559341582745

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-22 17:44:03 +02:00
Michael Niedermayer f05247f6a4 avcodec/apedec: Fix integer overflow in filter_3800() 
Fixes: signed integer overflow: -2147448926 + -198321 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5739619273015296
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6744428485672960

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-16 21:30:59 +02:00
Michael Niedermayer 67250ee8d2 tools/target_dec_fuzzer: Adjust threshold for Jpeg2000 
Fixes: Timeout
Fixes: 50955/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5148704872464384

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-16 21:30:59 +02:00
Michael Niedermayer 14e99cb472 avcodec/hdrdec: Update w in inner loop of decompress() 
Fixes: out of array access
Fixes: 50936/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HDR_fuzzer-5423041009549312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-16 21:30:59 +02:00
Michael Niedermayer 3993345f91 avcodec/tta: Check 24bit scaling for overflow 
Fixes: signed integer overflow: -8427924 * 256 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5409428670644224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-16 21:30:58 +02:00
Michael Niedermayer 677e27a9af avcodec/mobiclip: Check quantizer for overflow 
Fixes: signed integer overflow: 127 + 2147483536 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-6014034970804224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-16 21:30:58 +02:00
Michael Niedermayer ac26712e35 avcodec/exr: Check preview psize 
Fixes: signed integer overflow: 17121181824 * 538976288 cannot be represented in type 'long long'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5915330316206080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-16 21:30:58 +02:00
Michael Niedermayer 43a4854510 avcodec/tiff: Fix loop detection 
Fixes regression with tickets/4364/L1004220.DNG

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-16 21:30:57 +02:00
Michael Niedermayer d32a9f3137 libavformat/hls: Free keys 
Fixes: memleak
Fixes: 50703/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-6399058578636800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-10 17:32:47 +02:00
Michael Niedermayer 9af7de0867 tools/target_dec_fuzzer: Adjust threshold for UTVIDEO 
Fixes: Timeout
Fixes: 47969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_fuzzer-5097256832860160

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-10 17:32:47 +02:00
Michael Niedermayer 9783749c66 avcodec/fmvc: Move frame allocation to a later stage 
This way more things are checked before allocation

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-10 17:32:38 +02:00
Michael Niedermayer 31581ae7ee avfilter/vf_showinfo: remove backspaces 
They mess with storing editing and comparing the results

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-08 21:29:41 +02:00
Michael Niedermayer f0395f9ef6 avcodec/speedhq: Check width 
Fixes: out of array access
Fixes: 50014/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-4748914632294400

Alternatively the buffer size can be increased

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-05 01:42:28 +02:00
Michael Niedermayer b14104a637 avcodec/bink: disallow odd positioned scaled blocks 
Fixes: out of array access
Fixes: 47911/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6194020855971840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-02 10:44:28 +02:00
Michael Niedermayer 1f1a368169 avformat/asfdec_o: limit recursion depth in asf_read_unknown() 
The threshold of 5 is arbitrary, both smaller and larger should work fine

Fixes: Stack overflow
Fixes: 50603/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6049302564175872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-31 18:03:55 +02:00
Michael Niedermayer c953baa084 avformat/mov: Check count sums in build_open_gop_key_points() 
Fixes: ffmpeg.md
Fixes: Out of array access
Fixes: CVE-2022-2566

Found-by: Andy Nguyen <theflow@google.com>
Found-by: 3pvd <3pvd@google.com>
Reviewed-by: Andy Nguyen <theflow@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-28 22:06:45 +02:00
Michael Niedermayer ced0dc807e doc/git-howto.texi: Document commit signing 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-28 22:06:45 +02:00
Michael Niedermayer 2316d5ec1a libavcodec/8bps: Check that line lengths fit within the buffer 
Fixes: Timeout
Fixes: undefined pointer arithmetic
Fixes: 50330/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EIGHTBPS_fuzzer-5436287485607936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-28 22:06:45 +02:00
Michael Niedermayer e264a4a76e tools/target_dec_fuzzer: Adjust threshold for MVDV 
Fixes: Timeout
Fixes: 50213/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MVDV_fuzzer-5228284098510848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-28 22:06:45 +02:00
Michael Niedermayer 628fb97efb avcodec/midivid: Perform lzss_uncompress() before ff_reget_buffer() 
This would avoid regeting the frame on lzss errors

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-28 22:06:44 +02:00
Michael Niedermayer bcb4690304 libavformat/iff: Check for overflow in body_end calculation 
Fixes: signed integer overflow: -6322983228386819992 - 5557477266266529857 cannot be represented in type 'long'
Fixes: 50112/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6329186221948928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-28 22:06:44 +02:00
Michael Niedermayer 936f2d2634 tools/target_dec_fuzzer: Adjust threshold for MTS2 
Fixes: Timeout
Fixes: 50030/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MTS2_fuzzer-5767793731043328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-28 22:06:44 +02:00
Michael Niedermayer 4d5c0cca94 avcodec/m101: Move checks before ff_get_buffer() 
Fixes: Timeout
Fixes: 50109/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_M101_fuzzer-6553193986785280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-28 22:06:43 +02:00
Michael Niedermayer 049ed1dada tools/target_dec_fuzzer: Adjust threshold for bethsoftvid 
Fixes: Timeout
Fixes: 49791/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BETHSOFTVID_fuzzer-4583956145635328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-28 22:06:43 +02:00
Michael Niedermayer d93dccdc9f avcodec/bethsoftvideo: Check block_type before frame alloc 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-28 22:06:43 +02:00
Michael Niedermayer e1c0239d5a avcodec/bethsoftvideo: Pass GetByteContext into set_palette() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-28 22:06:42 +02:00
Michael Niedermayer f3e823c2aa avformat/avidec: Prevent entity expansion attacks 
Fixes: Timeout
Fixes no testcase, this is the same idea as similar attacks against XML parsers

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-28 22:06:31 +02:00
Michael Niedermayer 104804a718 tools/target_dec_fuzzer: Adjust threshold for ZLIB 
Fixes: Timeout
Fixes: 49769/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZLIB_fuzzer-6302938657587200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-23 20:03:03 +02:00
Michael Niedermayer ca4ff9c21c avcodec/h263dec: Sanity check against minimal I/P frame size 
Fixes: Timeout
Fixes: 49718/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4874987894341632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-23 20:03:03 +02:00
Michael Niedermayer 3b51e19922 avcodec/hevcdec: Check s->ref in the md5 path similar to hwaccel 
This is somewhat redundant with the is_decoded check. Maybe
there is a nicer solution

Fixes: Null pointer dereference
Fixes: 49584/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5297367351427072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-23 20:03:03 +02:00
Michael Niedermayer 7086491fa0 avcodec/mpegaudiodec_template: use unsigned shift in handle_crc() 
Fixes: left shift of 192 by 24 places cannot be represented in type 'int'
Fixes: 49577/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP1FLOAT_fuzzer-5205996678545408

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-23 20:03:03 +02:00
Michael Niedermayer 8ab944c4c3 avcodec/4xm: treat AV_LOG_ERROR cases as errors 
Fixes: Timeout
Fixes: 49504/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-570457772222054

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-23 20:03:03 +02:00
Michael Niedermayer 58a8e739ef avformat/subviewerdec: Make read_ts() more flexible 
Fixes: signed integer overflow: -1948269928 * 10 cannot be represented in type 'int'
Fixes: 49451/clusterfuzz-testcase-minimized-ffmpeg_dem_SUBVIEWER_fuzzer-6344614822412288

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
 2022-08-23 20:03:03 +02:00
Michael Niedermayer a44f5a5212 avcodec/mjpegdec: bayer and rct are incompatible 
Fixes: out of array read
Fixes: 49434/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5208501080686592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-23 20:03:03 +02:00
Michael Niedermayer 928857099c tools/target_dec_fuzzer: Adjust threshold for VB 
Fixes: Timeout
Fixes: 49372/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VB_fuzzer-5234505337667584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-23 20:03:03 +02:00
Michael Niedermayer b716ba5029 tools/target_dec_fuzzer: Adjust threshold for VMDVIDEO 
Fixes: Timeout
Fixes: 49350/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMDVIDEO_fuzzer-4554761801695232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-23 20:03:03 +02:00
Michael Niedermayer 6ba9e22f67 tools/target_dec_fuzzer: Adjust threshold for NUV 
Fixes: Timeout
Fixes: 49286/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-5856252655173632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-23 20:03:03 +02:00
Michael Niedermayer 05225180be MAINTAINERS: Add ED25519 key for signing my commits in the future 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-09 21:57:31 +02:00
Michael Niedermayer 26180e8855 MAINTAINERS: Split project server admin list 
This updates the list closer to reality.
Iam not a professional server admin, iam happy to help maintain the box as i have
done in the past. But iam not qualified nor volunteering to fix sudden problems
nor do i do major upgrades (i lack the experience to recover the box remotely if
something goes wrong) and also iam not maintaining backups ATM (our backup system
had a RAID-5 failure, raz is working on setting a new one up)

Maybe this should be signaled in a different way than spliting the lines but ATM
people ping me if something is wrong and what i do is mainly mail/ping raz
and try to find another root admin so raz is not the only active & professional
admin on the team. It would be more efficient if people contact raz and others
directly instead of depending on my waking up and forwarding a "ffmpeg.org" is down note

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-07 22:01:21 +02:00
Michael Niedermayer e6bbaa1d49 avformat/mxfdec: SMPTE RDD 48:2018 Amd 1:2022 support 
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-07 22:01:21 +02:00
Michael Niedermayer 009ef35d38 avcodec/hevc_filter: copy_CTB() only within width&height 
Fixes: out of array access
Fixes: 49271/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5424984922652672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-07-22 17:25:25 +02:00
Michael Niedermayer 76112c2b41 avcodec/tiff: Check tile_length and tile_width 
Fixes: Division by 0
Fixes: 49235/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5495613847896064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-07-22 17:25:25 +02:00
Michael Niedermayer 4e145f1dcd avcodec/mss4: Check image size with av_image_check_size2() 
Fixes: Timeout
Fixes: 48418/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MTS2_fuzzer-4834851466903552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-07-21 19:30:14 +02:00
Michael Niedermayer 8af798171b avformat/mpc8: Check and propagate more errors 
Fixes: Timeout
Fixes: 48846/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-5278532493770752

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-07-21 19:28:52 +02:00
Michael Niedermayer ceff5d7b74 avformat/flvdec: Check for EOF in index reading 
Fixes: Timeout
Fixes: 47992/clusterfuzz-testcase-minimized-ffmpeg_dem_LIVE_FLV_fuzzer-6020443879899136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-07-21 19:28:27 +02:00
Michael Niedermayer b5de084aa6 avformat/nutdec: Check get_packetheader() in mainheader 
Fixes; Timeout
Fixes: 48794/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6524604713140224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-07-21 19:27:52 +02:00
Michael Niedermayer 744ad45c44 avformat/mov: Check for EOF in mov_read_iloc() 
Fixes: Timeout
Fixes: 49216/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-6563000529584128

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-07-21 19:27:45 +02:00
Michael Niedermayer 9b23eb8a10 tools/target_dec_fuzzer: Adjust threshold for MWSC 
Fixes: Timeout
Fixes: 49172/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MWSC_fuzzer-5213749102903296

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-07-21 19:27:38 +02:00
Michael Niedermayer 8ed78486fc avformat/asfdec_f: Use 64bit for packet start time 
Fixes: signed integer overflow: 2147483647 + 32 cannot be represented in type 'int'
Fixes: 49014/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-6314973315334144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-07-21 19:27:32 +02:00
Michael Niedermayer 614a4d1476 avcodec/exr: Check x/ysize 
Fixes: OOM
Fixes: 48911/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6352002510094336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-07-21 19:27:27 +02:00
Michael Niedermayer f7d510b33f avcodec/ffv1dec: Fix AC_GOLOMB_RICE min size check 
Found-by: mkver

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-07-21 08:54:22 +02:00