virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-06-19 19:03:00 +02:00
Code Issues Releases Activity
84,299 Commits 39 Branches 425 Tags
98f89d615b6490a5b93930c7bfa74c427dedf04e
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer 23f3f92361 avcodec/mjpegdec: quant_matrixes can be up to 65535, use uint16_t 
Fixes invalid shift
Fixes: 870/clusterfuzz-testcase-5649105424482304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-20 01:38:04 +01:00
Michael Niedermayer 656a17e126 avcodec/mjpegdec: Check quant_matrixes values for being non zero 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-20 01:38:02 +01:00
Michael Niedermayer 98da63b3f5 avcodec/vp56: Check avctx->error_concealment before enabling EC 
Fixes timeout with 847/clusterfuzz-testcase-5291877358108672
Fixes timeout with 850/clusterfuzz-testcase-5721296509861888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-20 01:33:08 +01:00
Michael Niedermayer a84d610b37 avcodec/h264_direct: Fix runtime error: signed integer overflow: -9 - 2147483647 cannot be represented in type 'int' 
Fixes: 864/clusterfuzz-testcase-4774385942528000

See: [FFmpeg-devel] [PATCH 1/2] avcodec/h264_direct: Fix runtime error: signed integer overflow: 2147483647 - -14133 cannot be represented in type 'int'
See: [FFmpeg-devel] [PATCH 2/2] avcodec/h264_direct: Fix runtime error: signed integer overflow: -9 - 2147483647 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-20 01:33:08 +01:00
Michael Niedermayer 5d996b5649 avcodec/tiff: Check stripsize strippos for overflow 
Fixes: 861/clusterfuzz-testcase-5688284384591872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-20 01:33:08 +01:00
Michael Niedermayer a3a4082599 avcodec/h264_cabac: Fix runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself 
Fixes: 858/clusterfuzz-testcase-5168477042114560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-16 16:16:05 +01:00
Michael Niedermayer 2898bc522d avcodec/h264idct_template: fix multiple runtime error: signed integer overflow 
Fixes: 857/clusterfuzz-testcase-5319093760557056

Benchmark changes from 335->333 (so if its not a random fluctuation then it would be faster)

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-16 16:16:05 +01:00
Michael Niedermayer cfa10e11be avcodec/tiff: Check palette shift 
Fixes multiple  runtime error: shift exponent 792 is too large for 32-bit type 'unsigned int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-16 01:04:35 +01:00
Michael Niedermayer 58e9c7f4a2 avcodec/wavpack: Fix multiple integer overflows 
Fixes: 839/clusterfuzz-testcase-4871084446842880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-16 01:04:35 +01:00
Michael Niedermayer 45198477de avcodec/simple_idct_template: Fix several integer overflows 
Benchmarks with START_TIMER indicate that the code is faster with unsigned, (that is
with the patch), there was quite some fluctuation in the numbers so this may be just
random

Fixes: 811/clusterfuzz-testcase-6465493076541440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-16 01:04:35 +01:00
Michael Niedermayer 8ebed703f1 avcodec/mpegaudiodec_template: Make l3_unscale() work with e=0 
Fixes undefined behavior
Fixes: 830/clusterfuzz-testcase-6253175327686656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-14 22:48:49 +01:00
Michael Niedermayer 108b02e547 avcodec/tiff: Check for multiple geo key directories 
Fixes memleak
Fixes: 826/clusterfuzz-testcase-5316921379520512

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-14 22:48:49 +01:00
Michael Niedermayer 0728d9a281 avcodec/pictordec: Fix runtime error: left shift of 805306368 by 2 places cannot be represented in type 'int' 
Fixes: 823/clusterfuzz-testcase-6727060074528768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-14 22:48:49 +01:00
Michael Niedermayer 7cebc5a9cc avcodec/wavpack: Fix runtime error: shift exponent 32 is too large for 32-bit type 'int' 
Fixes: 822/clusterfuzz-testcase-4873433189974016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-14 02:23:50 +01:00
Michael Niedermayer acdacb108d avcodec/targa: Skip hflip on blank images 
Fixes: timeout with 810/clusterfuzz-testcase-5249282825256960

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-14 02:23:50 +01:00
Michael Niedermayer 1467143a6e avcodec/wavpack: Fix runtime error: shift exponent 137 is too large for 32-bit type 'int' 
Fixes: 808/clusterfuzz-testcase-4715513349406720

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-14 02:23:50 +01:00
Michael Niedermayer a557ae8d52 avcodec/h264_direct: Fix runtime error: signed integer overflow: 2147483647 - -14133 cannot be represented in type 'int' 
Fixes: 755/clusterfuzz-testcase-5369072516595712

See: [FFmpeg-devel] [PATCH 1/2] avcodec/h264_direct: Fix runtime error: signed integer overflow: 2147483647 - -14133 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-14 02:23:50 +01:00
Michael Niedermayer 967feea5eb avcodec/vp6: clear dimensions on failed resolution change in vp6_parse_header() 
Fixes: 807/clusterfuzz-testcase-6470061042696192
Fixes null pointer dereference

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-13 04:48:43 +01:00
Michael Niedermayer a66c6e28b5 avcodec/rv34: Fix runtime error: signed integer overflow: 36880 * 66288 cannot be represented in type 'int' 
Fixes: 768/clusterfuzz-testcase-4807444305805312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-13 04:48:43 +01:00
Michael Niedermayer a720b854b0 avcodec/mpeg12dec: Fix runtime error: left shift of negative value -1 
Fixes: 764/clusterfuzz-testcase-6273034652483584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-13 04:48:43 +01:00
Michael Niedermayer ce010655a6 avcodec/dca_xll: Fix runtime error: signed integer overflow: 2147286116 + 6298923 cannot be represented in type 'int' 
Fixes: 732/clusterfuzz-testcase-4872990070145024

See: [FFmpeg-devel] [PATCH 2/6] avcodec/dca_xll: Fix runtime error: signed integer overflow: 2147286116 + 6298923 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-12 04:38:14 +01:00
Michael Niedermayer 44e2105189 avcodec/amrwbdec: Fix runtime error: left shift of negative value -1 
Fixes: 763/clusterfuzz-testcase-6007567320875008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-12 04:38:14 +01:00
Michael Niedermayer f4c2302ee2 avcodec/dca_xll: Fix runtime error: signed integer overflow: 1762028192 + 698372290 cannot be represented in type 'int' 
Fixes: 762/clusterfuzz-testcase-5927683747741696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-12 04:38:14 +01:00
Michael Niedermayer 47cc9c1d77 avcodec/wavpack: Fix runtime error: signed integer overflow: -2147483648 + -83886075 cannot be represented in type 'int' 
Fixes: 761/clusterfuzz-testcase-5442222252097536

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-12 04:38:14 +01:00
Michael Niedermayer 6e913f2129 avcodec/vp56: Reset have_undamaged_frame on resolution changes 
Fixes: timeout in 758/clusterfuzz-testcase-4720832028868608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-11 02:50:22 +01:00
Michael Niedermayer dc0b9b218c avcodec/h264_ps: Forward errors from decode_scaling_list() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-11 02:50:22 +01:00
Michael Niedermayer bac9c03ed9 avcodec/movtextdec: run mov_text_cleanup() before overwriting pointers 
Fixes: memleak
Fixes: 741/clusterfuzz-testcase-586996200452915

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-09 23:28:10 +01:00
Michael Niedermayer e2a4f1a9eb avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: -135088512 * 16 cannot be represented in type 'int' 
Fixes: 736/clusterfuzz-testcase-5580263943831552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-09 23:28:10 +01:00
Michael Niedermayer 222c9f031d avcodec/h264_mvpred: Fix runtime error: left shift of negative value -1 
Fixes: 734/clusterfuzz-testcase-4821293192970240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-09 23:28:10 +01:00
Michael Niedermayer 800d02abe0 avcodec/mjpegdec: Fix runtime error: left shift of negative value -127 
Fixes: 733/clusterfuzz-testcase-4682158096515072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-09 23:28:10 +01:00
Michael Niedermayer 58dd25f8ad avcodec/mpegaudiodec_template: Check for negative e 
Fixes: undefined shift
Fixes: 631/clusterfuzz-testcase-6725491035734016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-09 20:37:10 +01:00
Michael Niedermayer 3016e919d4 avcodec/wavpack: Fix runtime error: left shift of negative value -5 
Fixes: 729/clusterfuzz-testcase-5154831595470848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-08 21:15:07 +01:00
Michael Niedermayer 01a33b835f avcodec/pictordec: Fix runtime error: left shift of 64 by 25 places cannot be represented in type 'int' 
Fixes: 724/clusterfuzz-testcase-6738249571631104

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-08 21:15:07 +01:00
Michael Niedermayer 1d0bad421c avutil/tests/lfg: Remove debugging start/stop timer 
Fixes code with qemu ARM

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-08 14:32:00 +01:00
Michael Niedermayer 1afd246960 avcodec/vp8: Check for the bitstream end per MB in decode_mb_row_no_filter() 
Fixes: timeout in 730/clusterfuzz-testcase-5265113739165696 (part 2 of 2)

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: BBB
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-07 21:29:43 +01:00
Michael Niedermayer 55d7371fe0 avcodec/vp568: Check that there is enough data for ff_vp56_init_range_decoder() 
Fixes: timeout in 730/clusterfuzz-testcase-5265113739165696 (part 1 of 2)

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: BBB
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-07 21:29:12 +01:00
Michael Niedermayer 5098a6f627 avcodec/vp8: remove redundant check 
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-07 19:13:19 +01:00
Michael Niedermayer 8aa4f3bb4f avcodec/proresdec2: Do not discard frames with bad slices 
The code previously completely discarded frames that had any error in a slice

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-06 16:47:17 +01:00
Michael Niedermayer 835d9f299c avcodec/x86/cavsdsp: Put MMX code under mmx check 
Without this the FPU state becomes trashed and causes mysterious
fate failures with cpuflags=0

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-06 16:47:17 +01:00
Michael Niedermayer a9f9b7f5c7 avcodec/movtextdec: Call mov_text_cleanup() on close 
Fixes memleak
Fixes: 548/clusterfuzz-testcase-5511470875934720

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-06 16:47:17 +01:00
Michael Niedermayer ba15005132 avcodec/wavpack: Fix runtime error: left shift of negative value -2 
Fixes: 723/clusterfuzz-testcase-6471394663596032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-05 12:03:15 +01:00
Michael Niedermayer 29638d4db9 avcodec/dcadsp: Fix 2 runtime error: signed integer overflow: -1958094138 - 1078906344 cannot be represented in type 'int' 
Fixes: 722/clusterfuzz-testcase-5711268868521984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-05 12:01:48 +01:00
Michael Niedermayer d03d386162 avcodec/wavpack: Check bitrate_acc for overflow 
Fixes: undefined behavior in 717/clusterfuzz-testcase-5434924129583104

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-05 12:01:46 +01:00
Michael Niedermayer fab13bbbcd avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: 134527392 * 16 cannot be represented in type 'int' 
This checks the sprite delta intermediates for overflow
Fixes: 716/clusterfuzz-testcase-4890287480504320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-05 12:01:41 +01:00
Michael Niedermayer d757ddbaab avcodec/mpeg12dec: Fix runtime error: left shift of negative value -13 
Fixes: 709/clusterfuzz-testcase-4789836449841152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-04 17:48:04 +01:00
Michael Niedermayer ab998f4c7f avcodec/h264_mvpred: Fix multiple runtime error: left shift of negative value 
Fixes: 710/clusterfuzz-testcase-5091051431788544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-04 17:48:04 +01:00
Michael Niedermayer d23727e042 avcodec/adxdec: Fix runtime error: left shift of negative value -1 
Fixes: 705/clusterfuzz-testcase-5129572590813184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-04 17:48:04 +01:00
Michael Niedermayer eb41956636 avcodec/mpeg4videodec: Improve the overflow checks in mpeg4_decode_sprite_trajectory() 
Also clear the state on errors

Fixes integer overflows in 701/clusterfuzz-testcase-6594719951880192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-04 03:05:15 +01:00
Michael Niedermayer 2ce4f28431 avcodec/vp56: Require a correctly decoded frame before using vp56_conceal_mb() 
Fixes timeout with 700/clusterfuzz-testcase-5660909504561152
Fixes timeout with 702/clusterfuzz-testcase-4553541576294400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-04 03:05:15 +01:00
Michael Niedermayer d8094a303b avcodec/vp3: Do not return random positive values but the buf size 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-03 17:17:53 +01:00
Michael Niedermayer 55196e5d10 Revert "avutil/frame: Disallow zero sized frame side data" 
Found a case where we use size==0, the other related commits
remain needed, and should be sufficient to fix the original issue

This reverts commit 7e4f32f4e4.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-03 01:03:29 +01:00
Michael Niedermayer 6191198c21 avcodec/interplayvideo: Fix timeout from lack of bitstream end check 
Fixes: 697/clusterfuzz-testcase-6111250582863872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-03 01:03:29 +01:00
Michael Niedermayer 3b0b35150d avcodec/mpegaudiodec_template: Fix runtime error: signed integer overflow: 2053224902 + 2053224902 cannot be represented in type 'int' 
Fixes: 696/clusterfuzz-testcase-5853632270434304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-03 01:03:29 +01:00
Michael Niedermayer 4b72d5cd6f avcodec/mjpegdec: Fix runtime error: left shift of negative value -511 
Fixes: 693/clusterfuzz-testcase-6109776066904064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-03 01:03:29 +01:00
Michael Niedermayer 4bed066377 avcodec/vp56: Clear dimensions in case of failure in the middle of a resolution change 
Similar code is used elsewhere in vp56 to force a more complete reinit in the future.
Fixes null pointer dereference
Fixes: 707/clusterfuzz-testcase-4717453097566208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-02 03:16:18 +01:00
Michael Niedermayer f8060ab927 avcodec/wavpack: Check value before shift in wp_exp2() 
Fixes undefined shift, all callers should be changed to check the value
they use with wp_exp2() or its return value.

Fixes: 692/clusterfuzz-testcase-5757381516460032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-02 03:16:15 +01:00
Michael Niedermayer 12c3e120fe avcodec/ituh263dec: Use 0xffff as error code in h263p_decode_umotion() 
This matches ff_h263_decode_motion() both functions error codes are interpreted by the same common code

Fixes: 690/clusterfuzz-testcase-4744944981901312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-02 03:16:12 +01:00
Michael Niedermayer 04c99c8042 avcodec/h264idct_template: Fix several runtime error: signed integer overflow 
Fixes: 689/clusterfuzz-testcase-6029352737177600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-02 03:16:10 +01:00
Michael Niedermayer e46ab99750 avformat/oggdec: fix leak in ogg_restore() 
Fixes: asan_bug_leak

Found-by: Thomas Guilbert <tguilbert@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-02 03:12:26 +01:00
Michael Niedermayer fb6fa48fce avformat/oggdec: Factor free_stream out 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-02 03:12:25 +01:00
Michael Niedermayer 3250d4b39c avformat/oggdec: remove unused parameter of ogg_restore() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-02 03:12:25 +01:00
Michael Niedermayer 7b5ff7d573 avcodec/vp8: Check for bitsteam end in decode_mb_row_no_filter() 
Fixes timeout with 686/clusterfuzz-testcase-5853946876788736

this shortcuts (i.e. speeds up) the error and
return-to-user when decoding a truncated frame

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Previous version reviewed by: "Ronald S. Bultje" <rsbultje@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-01 14:07:33 +01:00
Michael Niedermayer 4bd3f1ce3e avcodec/h264_direct: Fix runtime error: left shift of negative value -14 
Fixes: 682/clusterfuzz-testcase-4799120021651456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-01 14:07:33 +01:00
Michael Niedermayer 2c00b37302 avcodec/avpacket: Check metadata key in av_packet_unpack_dictionary() 
Fixes timeout
Fixes: 501/clusterfuzz-testcase-5672752870588416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-03-01 14:07:33 +01:00
Michael Niedermayer 7f62368bac MAINTAINERS: Add Rodger Combs to ffmpeg-security 
Rodger Combs will be added to the ffmpeg-security alias when this patch is applied

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Reviewed-by: Clément Bœsch <u@pkh.me>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-28 01:13:52 +01:00
Michael Niedermayer 4f21868207 MAINTAINERS: add wm4 to ffmpeg-security 
wm4 will be added to the ffmpeg-security alias when this patch is applied

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Reviewed-by: Clément Bœsch <u@pkh.me>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-28 01:13:52 +01:00
Michael Niedermayer 3d66eb6ec3 MAINTAINERS: Make formating of ffmpeg-security entry the same as others 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-28 01:13:52 +01:00
Michael Niedermayer 4c0139463c avcodec/vp56: Factorize vp56_render_mb() out 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-28 01:13:52 +01:00
Michael Niedermayer 949d2176ef avcodec/dca: Fix multiple runtime error: signed integer overflow 
Fixes: 680/clusterfuzz-testcase-5416627266912256
Fixes: 681/clusterfuzz-testcase-5013323462475776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-28 01:13:52 +01:00
Michael Niedermayer 63e400a880 avcodec/pictordec: Check plane value before doing value/mask computations 
Fixes integer overflow
Fixes: 675/clusterfuzz-testcase-6722971232108544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-28 01:13:52 +01:00
Michael Niedermayer 25e93aacc2 avcodec/mpeg4videodec: Fix runtime error: left shift of negative value -2650 
Fixes: 674/clusterfuzz-testcase-6713275880308736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-28 01:13:52 +01:00
Michael Niedermayer 4ea7744859 avcodec/h264idct_template: Fix multiple runtime error: signed integer overflow 
Fixes: 677/clusterfuzz-testcase-6635120628858880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-28 01:13:52 +01:00
Michael Niedermayer 7e9ba78f6b avcodec/flacdsp: Fix: runtime error: signed integer overflow: -1027555328 + -1226681270 cannot be represented in type 'int' 
Fixes: 673/clusterfuzz-testcase-5948736536576000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-26 17:16:22 +01:00
Michael Niedermayer 87eb374970 avcodec/eac3dec: Fix runtime error: left shift of negative value -3 
Fixes: 672/clusterfuzz-testcase-5595018867769344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-26 17:16:22 +01:00
Michael Niedermayer aff8cf18cb avcodec/mpeg12dec: Fix runtime error: left shift of negative value -2 
671/clusterfuzz-testcase-4990381827555328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-26 17:16:22 +01:00
Michael Niedermayer 0716bcce5b avcodec/ituh263dec: Check for the bitstream end in ff_h263_decode_mb() 
Fixes invalid shift

Fixes: 670/clusterfuzz-testcase-4852021066727424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-26 17:16:22 +01:00
Michael Niedermayer 7e4f32f4e4 avutil/frame: Disallow zero sized frame side data 
There should be no case that needs this and its a potential for
creating corner cases

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-25 22:02:23 +01:00
Michael Niedermayer 5804201cba avutil/frame: Reimplement av_frame_new_side_data() without size=0 special case 
The size 0 special case causes side data to be created which is
different and a special case if for any reasons size = 0 is passed

Fixes: multiple runtime error: null pointer passed as argument 1, which is declared to never be null
Fixes: 653/clusterfuzz-testcase-5773837415219200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-25 22:02:23 +01:00
Michael Niedermayer 58f3469cc6 avcodec/wavpack: Fix 280:22: runtime error: left shift of negative value -1 
Fixes: 653/clusterfuzz-testcase-5773837415219200
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-25 22:02:23 +01:00
Michael Niedermayer 5eb04570f6 avcodec/wavpack: Check post_shift 
Fixes: runtime error: shift exponent 34 is too large for 32-bit type 'int'

Fixes: 653/clusterfuzz-testcase-5773837415219200

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-25 22:02:23 +01:00
Michael Niedermayer d34bf886e9 avcodec/vp56: Implement very basic error concealment 
This should fix the fate failure due to a truncated last frame.
Alternatively the frame could be dropped.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-25 13:09:50 +01:00
Michael Niedermayer 6bd79ba59f avcodec/amrwbdec: Fix 2 runtime errors: left shift of negative value -1 
Fixes: 669/clusterfuzz-testcase-4847965409640448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-25 02:20:35 +01:00
Michael Niedermayer 310d2af319 avcodec/pngdec: Fix runtime error: left shift of 152 by 24 places cannot be represented in type 'int' 
Fixes: 666/clusterfuzz-testcase-6581447227867136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-25 01:43:53 +01:00
Michael Niedermayer 513a349439 avcodec/vp56: Fix sign typo 
Fixes: 664/clusterfuzz-testcase-4917047475568640

The change to fate is due to a truncated last frames which is now detected as damaged.

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-24 22:23:53 +01:00
Michael Niedermayer 5d81616be3 avcodec/mpegaudiodec_template: Correct return code on id3 tag discarding 
Fixes: 665/clusterfuzz-testcase-4863789881098240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-24 22:23:53 +01:00
Michael Niedermayer c87ea47481 tools/target_dec_fuzzer: Fix misaligned read 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-24 14:12:13 +01:00
Michael Niedermayer 2b8b7921c5 avcodec/vp3dsp: Fix multiple signed integer overflow: 46341 * 47523 cannot be represented in type 'int' 
Fixes: 664/clusterfuzz-testcase-4917047475568640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-24 14:12:13 +01:00
Michael Niedermayer 8696f25444 avcodec/rv34: Simplify and factor get_slice_offset() code 
This also fixes several integer overflows by checking each value before
use.
Fixes: 662/clusterfuzz-testcase-4898131432964096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-24 14:12:12 +01:00
Michael Niedermayer 0d85c7bb5a avcodec/ituh263dec: Fix runtime error: left shift of 1342177279 by 1 places cannot be represented in type 'int' 
Fixes: 659/clusterfuzz-testcase-5866673603084288

Huge DMV could be created by an encoder ignoring the spec

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-24 00:38:45 +01:00
Michael Niedermayer e98dfeb27c avcodec/jpeglsdec: check shift for values that cause overflow later 
Fixes: 657/clusterfuzz-testcase-6674741433729024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-24 00:38:45 +01:00
Michael Niedermayer 76ba09d182 avcodec/mpeg4videodec: Check the other 3 sprite points for intermediate overflows 
This is not necessarily specific to fuzzed files

Fixes: Multiple integer overflows
Fixes: 656/clusterfuzz-testcase-6463814516080640
Fixes: 658/clusterfuzz-testcase-6691260146384896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-24 00:38:45 +01:00
Michael Niedermayer 9568b2e425 avcodec/h264_ps: Check chroma_qp_index_offset 
Fixes: 647/clusterfuzz-testcase-5195745823031296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: BBB
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-23 02:37:55 +01:00
Michael Niedermayer ec849f637e avcodec/h264idct_template: Fix several runtime error: signed integer overflow 
Fixes: 652/clusterfuzz-testcase-6174944410992640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-22 22:29:03 +01:00
Michael Niedermayer 6871df02d9 avcodec/mpeg4videodec: Check sprite_offset in addition to shifts 
Fixes: 651/clusterfuzz-testcase-5710668915277824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-22 22:29:03 +01:00
Michael Niedermayer 5a8fec1b33 avcodec/mpegaudiodec_template: Fix multiple runtime error: signed integer overflow 
Fixes: 648/clusterfuzz-testcase-5337961317007360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-22 22:29:03 +01:00
Michael Niedermayer c93a07070a MAINTAINERS: Add ffmpeg-security alias members 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-22 13:44:34 +01:00
Michael Niedermayer c9e3952b82 avcodec/rv34: Forward error from rv34_decode_mv() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-22 02:42:48 +01:00
Michael Niedermayer 6179dc8aa7 avcodec/mpeg4video: Fix runtime error: left shift of negative value 
Fixes: 644/clusterfuzz-testcase-4726434209726464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-22 02:42:48 +01:00
Michael Niedermayer 92188c8f57 avcodec/dcadsp: Fix runtime error: signed integer overflow: 394625024 * 8 cannot be represented in type 'int' 
Fixes: 643/clusterfuzz-testcase-5209078743695360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-22 02:42:48 +01:00
Michael Niedermayer 24f6559bd2 avcodec/rv34: Fix runtime error: signed integer overflow: -2 + -2147483648 cannot be represented in type 'int' 
Fixes: 642/clusterfuzz-testcase-558358808074649

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-02-22 02:42:48 +01:00