virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-06-19 19:03:00 +02:00
Code Issues Releases Activity
86,662 Commits 39 Branches 425 Tags
9c604b34d435d14d077cb52432dbc13d5b59d9a3
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer 9c604b34d4 avcodec/utvideodec: hardcode vlc bits 
2.5% faster vlc decoding

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-28 14:08:21 +02:00
Michael Niedermayer 1835c5e7a4 avcodec/utvideodec: Move bitstream end check out of inner loop 
This is not needed when the buffer is large enough for the worst case of a line

2% faster vlc reading

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-28 14:08:21 +02:00
Michael Niedermayer 516c213f08 avcodec/x86/vp9dsp_init_16bpp: Fix linking to missing ff_vp9_ipred_dr_32x32_16_avx2() on 32bit 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-28 00:31:33 +02:00
Michael Niedermayer c578c9c229 libswresample/swresample: remove obsolete code 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-27 23:21:53 +02:00
Michael Niedermayer 2c874548d6 avcodec/hevcdec: do basic validity check on delta_chroma_weight and offset 
Fixes: runtime error: signed integer overflow: 2147483520 + 128 cannot be represented in type 'int'
Fixes: 2385/clusterfuzz-testcase-minimized-6594333576790016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-27 23:21:12 +02:00
Michael Niedermayer 0f8d3d8a46 avcodec/ffv1enc: compute the max number of slices and limit by that 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-27 13:09:58 +02:00
Michael Niedermayer 430d4f2bb5 avcodec/ffv1enc: Allow less than 2 rows of slices for low vertical resolution 
Fixes: Ticket5548

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-27 12:54:06 +02:00
Michael Niedermayer 3c70251780 avcodec/jpeg2000dwt: Fix integer overflows in sr_1d97_int() 
Fixes: runtime error: signed integer overflow: 1157259380 + 1157259380 cannot be represented in type 'int'
Fixes: 2365/clusterfuzz-testcase-minimized-6020421927305216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-26 16:06:25 +02:00
Michael Niedermayer ea5366670e avcodec/jpeg2000dwt: Fix integer overflow in dwt_decode97_int() 
Fixes: runtime error: signed integer overflow: -163654656 * 256 cannot be represented in type 'int'
Fixes: 2367/clusterfuzz-testcase-minimized-4648678897745920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-26 16:06:25 +02:00
Michael Niedermayer 4147bb9053 avcodec/ffv1enc: Try to choose slice count so that slice packet sizes are within the supported size 
Fixes assertion failure

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-26 16:06:25 +02:00
Michael Niedermayer 449cdfa687 avcodec/ffv1: Increase the maximum number of slices to 1024 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-26 16:06:25 +02:00
Michael Niedermayer 7d317d4706 avcodec/frame_thread_encoder: Fix AV_OPT_TYPE_STRING handling in priv_data 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-26 01:06:04 +02:00
Michael Niedermayer 89f8bff798 avcodec/hevcdec: Do not check the first ff_init_cabac_decoder() call in hls_decode_entry_wpp() for failure 
The result of the call is not used in any testcase but breaks some cases if
its failure is considered.

Fixes regression found by jamrial

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-25 04:25:56 +02:00
Michael Niedermayer 73ea2a028e avcodec/wavpack: Fix integer overflow in wv_unpack_stereo() 
Fixes: runtime error: signed integer overflow: 2080374785 + 2080374784 cannot be represented in type 'int'
Fixes: 2351/clusterfuzz-testcase-minimized-5359403240783872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-25 01:13:17 +02:00
Michael Niedermayer 63e7bfe78e avcodec/hevc_ps: Fix max_dec_buffer check 
Fixes: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 2339/clusterfuzz-testcase-minimized-6663164320022528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-25 01:13:17 +02:00
Michael Niedermayer 2476067680 avcodec/hevcdec: Use error path if init_get_bits8() fails 
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-24 22:17:15 +02:00
Michael Niedermayer 933aa91e31 avcodec/hevcdec: check ff_init_cabac_decoder() for failure 
Fixes: runtime error: left shift of 1965559808 by 4 places cannot be represented in type 'int'
Fixes: 2333/clusterfuzz-testcase-minimized-5223935677300736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-24 22:17:15 +02:00
Michael Niedermayer 4976a3411f avcodec/mpeg4videodec: Fix GMC with videos of dimension 1 
Fixes: runtime error: shift exponent -1 is negative
Fixes: 2338/clusterfuzz-testcase-minimized-5153426541379584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-24 14:48:13 +02:00
Michael Niedermayer 24e95f9d4d avcodec/wavpack: Fix integer overflow 
Fixes: runtime error: signed integer overflow: 227511904 + 1964113935 cannot be represented in type 'int'
Fixes: 2331/clusterfuzz-testcase-minimized-6182185830711296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-23 03:03:04 +02:00
Michael Niedermayer 0c2ef4f6b4 avcodec/takdec: Fix integer overflow 
Fixes: runtime error: signed integer overflow: 512 + 2147483146 cannot be represented in type 'int'
Fixes: 2314/clusterfuzz-testcase-minimized-4519333877252096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-23 03:03:04 +02:00
Michael Niedermayer 27f80ab016 avcodec/tiff: Update pointer only when the result is used 
Fixes: runtime error: signed integer overflow: 538976288 * 32 cannot be represented in type 'int'
Fixes: 2310/clusterfuzz-testcase-minimized-4534784887881728

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-23 03:03:04 +02:00
Michael Niedermayer 6f1d2355a7 avcodec/cfhd: Check bpc before setting bpc in context 
Fixes: runtime error: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 2306/clusterfuzz-testcase-minimized-5002997392211968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-22 01:54:40 +02:00
Michael Niedermayer 5a950f4e32 avcodec/cfhd: Fix undefined shift 
Fixes: runtime error: left shift of negative value -1
Fixes: 2303/clusterfuzz-testcase-minimized-5529675273076736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-22 01:54:40 +02:00
Michael Niedermayer 70a7df049c avcodec/mpegvideo: Use intra_scantable in dct_unquantize_h263_intra_c() 
Reviewed-by: James Darnley <jdarnley@obe.tv>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-21 02:25:23 +02:00
Michael Niedermayer d7b3d5c3f2 avcodec/hevc_filter: Fix invalid shift 
Fixes: runtime error: left shift of negative value -1

Fixes: 2299/clusterfuzz-testcase-minimized-4843509351710720

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-21 02:25:23 +02:00
Michael Niedermayer fdfbcbdd14 avcodec/hevcdec: Check beta and tc offset in hls_slice_header() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-21 02:25:23 +02:00
Michael Niedermayer 5443c4bdf4 avcodec/mpeg4videodec: Fix overflow in virtual_ref computation 
Fixes: runtime error: signed integer overflow: 262144 * -16120 cannot be represented in type 'int'
Fixes: 2292/clusterfuzz-testcase-minimized-6156080415506432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-21 02:25:23 +02:00
Michael Niedermayer e95fcfe8fb avcodec/lpc: signed integer overflow in compute_lpc_coefs() (aacdec_fixed) 
Fixes: runtime error: signed integer overflow: -1575818955 + -915383657 cannot be represented in type 'int'
Fixes: 2224/clusterfuzz-testcase-minimized-6208559949807616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-21 02:25:23 +02:00
Michael Niedermayer ae6f6d4e34 avcodec/x86/mpegvideo: Use intra scantable in dct_unquantize_h263_intra_mmx() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-20 00:07:51 +02:00
Michael Niedermayer 5f89747086 avcodec/wavpack: Fix undefined integer negation 
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 2291/clusterfuzz-testcase-minimized-5538453481586688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-19 17:54:40 +02:00
Michael Niedermayer cf7edbd6c5 avcodec/aacdec_fixed: Check s for being too small 
Fixes: runtime error: shift exponent -8 is negative
Fixes: 2286/clusterfuzz-testcase-minimized-5711764169687040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-19 17:54:40 +02:00
Michael Niedermayer f670c13f13 avcodec: Rename ff_mpv_decode_mb() to ff_mpv_reconstruct_mb 
The new name more accuratly describes what the function does

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-19 17:54:40 +02:00
Michael Niedermayer 14b834c45a avcodec/htmlsubtitles: Factor open brace handling into its own function 
Suggested-by: wm4
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-18 14:50:35 +02:00
Michael Niedermayer 4132218b87 avcodec/htmlsubtitles: Replace very slow redundant sscanf() calls by cleaner and faster code 
This reduces the worst case from O(n²) to O(n) time

Fixes Timeout
Fixes: 2127/clusterfuzz-testcase-minimized-6595787859427328

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-18 14:50:30 +02:00
Michael Niedermayer 27c2006805 avcodec/takdec: Fixes: integer overflow in AV_SAMPLE_FMT_U8P output 
Fixes: runtime error: signed integer overflow: 2147483543 + 128 cannot be represented in type 'int'
Fixes: 2234/clusterfuzz-testcase-minimized-6266896041115648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-18 14:38:41 +02:00
Michael Niedermayer 9a6503f496 avcodec/iff: Cleanup on init failure 
Fixes: memleak
Fixes: 2272/clusterfuzz-testcase-minimized-5059103858622464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-18 14:05:57 +02:00
Michael Niedermayer c746f92a8e avcodec/jpeg2000dsp: Reorder operations in ict_int() to avoid 2 integer overflows 
Fixes: runtime error: signed integer overflow: 58065 * 51981 cannot be represented in type 'int'
Fixes: 2271/clusterfuzz-testcase-minimized-5778297776504832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-17 22:36:54 +02:00
Michael Niedermayer c94326c1fc avcodec/hevcpred_template: Fix left shift of negative value 
Fixes: runtime error: left shift of negative value -1
Fixes: 2250/clusterfuzz-testcase-minimized-5693382112313344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-17 22:36:54 +02:00
Michael Niedermayer 1edbf5e20c avcodec/hevcdec: Fix signed integer overflow in decode_lt_rps() 
Fixes: runtime error: signed integer overflow: 2147483647 + 6 cannot be represented in type 'int'
Fixes: 2263/clusterfuzz-testcase-minimized-4800359627227136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-17 00:34:48 +02:00
Michael Niedermayer 9b65dbf734 avcodec/gdv: Fix undefined shift 
Fixes: runtime error: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 2249/clusterfuzz-testcase-minimized-5388542379294720

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 23:32:28 +02:00
Michael Niedermayer dfb61ea263 avcodec/jpeg2000dec: Check nonzerobits more completely 
Fixes: runtime error: shift exponent 36 is too large for 32-bit type 'int'
Fixes: 2239/clusterfuzz-testcase-minimized-5639766592716800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 20:32:39 +02:00
Michael Niedermayer 16d6cc2168 avcodec/wavpack: Change wp_log2() to unsigned 
Fixes: runtime error: signed integer overflow: 2143315325 + 4186162 cannot be represented in type 'int'
Fixes: 2134/clusterfuzz-testcase-minimized-4619258405322752

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 20:32:39 +02:00
Michael Niedermayer e77ddd31a8 avcodec/shorten: Sanity check maxnlpc 
Fixes OOM
Fixes: 2131/clusterfuzz-testcase-minimized-4718045157130240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 20:32:39 +02:00
Michael Niedermayer c0607d88ee avcodec/parser: assert that there is a past buffer if theres a reference into the past 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 01:35:35 +02:00
Michael Niedermayer 3c716682a8 avcodec/truemotion2: Move skip computation after checks 
Fixes: runtime error: signed integer overflow: 630067357 * 4 cannot be represented in type 'int'
Fixes: 2233/clusterfuzz-testcase-minimized-5943031318446080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 00:21:30 +02:00
Michael Niedermayer e3fadc57c5 avcodec/jpeg2000: Fixes integer overflow in ff_jpeg2000_ceildivpow2() 
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 2231/clusterfuzz-testcase-minimized-4565181982048256

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 00:21:30 +02:00
Michael Niedermayer 611b356274 avcodec/dnxhd_parser: Do not return invalid value from dnxhd_find_frame_end() on error 
Fixes: Null pointer dereference

Fixes: CVE-2017-9608
Found-by: Yihan Lian
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 00:21:30 +02:00
Michael Niedermayer bc40674462 avcodec/hevcdec: Check nb_sps 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-15 03:09:40 +02:00
Michael Niedermayer 1cb4ef526d avcodec/hevc_refs: Check nb_refs in add_candidate_ref() 
Fixes: runtime error: index 16 out of bounds for type 'int [16]'
Fixes: 2209/clusterfuzz-testcase-minimized-5012343912136704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-15 03:09:40 +02:00
Michael Niedermayer 12245ab1f6 avcodec/mpeg4videodec: Check sprite delta upshift against overflowing. 
Fixes: runtime error: signed integer overflow: -268386304 * 16 cannot be represented in type 'int'
Fixes: 2204/clusterfuzz-testcase-minimized-5616756909408256

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-15 00:16:20 +02:00
Michael Niedermayer 0a87be404a avcodec/mpeg4videodec: Fix integer overflow in num_sprite_warping_points=2 case 
Fixes: runtime error: signed integer overflow: 131072 + 2147352576 cannot be represented in type 'int'
Fixes: 2192/clusterfuzz-testcase-minimized-5370387988742144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-15 00:16:20 +02:00
Michael Niedermayer 900fe8ee5d avcodec/dnxhdenc: Assert that frame size is not assigned an error code 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-15 00:16:20 +02:00
Michael Niedermayer 4cc2a357f5 avcodec/aacsbr_fixed: Fix signed integer overflow in sbr_hf_inverse_filter() 
Fixes: runtime error: signed integer overflow: 2147483584 + 128 cannot be represented in type 'int'
Fixes: 2164/clusterfuzz-testcase-minimized-4715936172998656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-13 17:39:13 +02:00
Michael Niedermayer d1992448d3 avcodec/aacsbr_fixed: Check shift in sbr_hf_assemble() 
Fixes: runtime error: shift exponent -10 is negative

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-13 17:39:13 +02:00
Michael Niedermayer d549f026d8 avcodec/sbrdsp_fixed: Return an error from sbr_hf_apply_noise() if operations are impossible 
Fixes: 1775/clusterfuzz-testcase-minimized-5330288148217856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-13 17:39:13 +02:00
Michael Niedermayer 4f9e958b04 avcodec/put_bits: Implement put_bits32() in a single pass instead of 2 passes writing 16bits each 
820 cpu cycles -> 660 cpu cycles for 100 put_bits32()

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-13 04:17:13 +02:00
Michael Niedermayer db93fd74e4 avcodec/golomb: Assert that the input is not too large in set_ue_golomb() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-13 04:17:13 +02:00
Michael Niedermayer f8593c2f49 avcodec/libvpxdec: Check that display dimensions fit in the storage dimensions 
Fixes assertion failure
Fixes: 2112/clusterfuzz-testcase-minimized-4526878557732864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-11 22:41:26 +02:00
Michael Niedermayer 07339a45a0 avcodec/avpacket: Limit iterations in ff_packet_split_and_drop_side_data() 
This avoids scaning beyond what a valid packet can contain
Fixes: Timeout
Fixes: 541/clusterfuzz-testcase-610189291657625

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-11 22:09:15 +02:00
Michael Niedermayer d24043e1a2 avcodec/jpeg2000dwt: Fix runtime error: left shift of negative value -123 
Fixes: 2208/clusterfuzz-testcase-minimized-5976593765761024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-11 20:52:47 +02:00
Michael Niedermayer c996374d4d avcodec/wavpack: Fix runtime error: signed integer overflow: 1886191616 + 277872640 cannot be represented in type 'int' 
Fixes: 2181/clusterfuzz-testcase-minimized-6314784322486272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-11 20:52:47 +02:00
Michael Niedermayer 2e44126363 avcodec/snowdec: Fix runtime error: left shift of negative value -1 
Fixes: 2197/clusterfuzz-testcase-minimized-6010716676947968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-11 15:22:07 +02:00
Michael Niedermayer 6d499ecef9 avcodec/aacdec_fixed: Fix runtime error: left shift of negative value -1297616 
Fixes: 2195/clusterfuzz-testcase-minimized-4736721533009920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-11 15:22:07 +02:00
Michael Niedermayer 22a25ab389 avcodec/tiff: Fix leak of geotags[].val 
Fixes: 2176/clusterfuzz-testcase-minimized-5908197216878592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-11 01:06:08 +02:00
Michael Niedermayer 1197c04896 avcodec/fft_template: Fix multiple runtime error: signed integer overflow: -1943918714 - 1935113003 cannot be represented in type 'int' 
Fixes: 1735/clusterfuzz-testcase-minimized-5350472347025408

This uses unsigned instead of SUINT because the later was rejected by multiple developers
See: [FFmpeg-devel] [PATCH] avcodec/fft_template: Fix multiple runtime error: signed integer overflow: -1943918714 - 1935113003 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-11 00:56:33 +02:00
Michael Niedermayer 71da0a5c97 avcodec/ra144: Fix runtime error: signed integer overflow: -2200 * 1033073 cannot be represented in type 'int' 
Fixes: 2175/clusterfuzz-testcase-minimized-5809657849315328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-11 00:47:29 +02:00
Michael Niedermayer 90e8317b3b avcodec/flicvideo: Fix runtime error: signed integer overflow: 4864 * 459296 cannot be represented in type 'int' 
Fixes: 2174/clusterfuzz-testcase-minimized-5739234533048320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-10 19:46:04 +02:00
Michael Niedermayer 54aaadf648 avcodec/cfhd: Check band parameters before storing them 
Fixes out of array read
Fixes: 2169/clusterfuzz-testcase-minimized-5688641642823680

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-10 18:46:27 +02:00
Michael Niedermayer 09096fb687 avcodec/h264_parse: Check picture structure when initializing weight table 
Fixes: runtime error: index 49 out of bounds for type 'int [48][2][2]'
Fixes: 2159/clusterfuzz-testcase-minimized-5267945972301824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-10 00:48:23 +02:00
Michael Niedermayer e1b0044c23 avcodec/dvbsubdec: Check pixel buffer size constraint from ETSI EN 300 743 V1.3.1 
Fixes: OOM
Fixes: 2143/clusterfuzz-testcase-minimized-5482288060039168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-10 00:48:07 +02:00
Michael Niedermayer 4bcde26172 avcodec/dvbsubdec: Use av_image_check_size2() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-10 00:48:07 +02:00
Michael Niedermayer a3b5b60bdf avcodec/indeo4: Check remaining data in Pic hdr extension parsing code 
Fixes: Timeout
Fixes: 2115/clusterfuzz-testcase-minimized-6594111748440064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-08 17:37:16 +02:00
Michael Niedermayer 4e3ab1a5c1 avcodec/ac3dec_fixed: Fix multiple runtime error: signed integer overflow: -39271008 * 59 cannot be represented in type 'int' 
Fixes: 2113/clusterfuzz-testcase-minimized-6510704959946752

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-08 17:37:16 +02:00
Michael Niedermayer 850cbd496f avformat/utils: Slightly un-clutter code in determinable_frame_size() by using a switch 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-06 18:31:47 +02:00
Michael Niedermayer 18bca25adb avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: 53098 * 40448 cannot be represented in type 'int' 
Fixes: 2106/clusterfuzz-testcase-minimized-6136503639998464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-06 16:54:50 +02:00
Michael Niedermayer c4360559ee avcodec/pafvideo: Fix assertion failure 
Fixes: 2100/clusterfuzz-testcase-minimized-4522961547558912

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-06 16:54:50 +02:00
Michael Niedermayer e4efd41b83 avcodec/takdec: Fix multiple runtime error: signed integer overflow: 637072 * 4096 cannot be represented in type 'int' 
Fixes: 2079/clusterfuzz-testcase-minimized-5345861779324928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-06 16:54:50 +02:00
Michael Niedermayer 4705edbbb9 avcodec/mjpegdec: Check that reference frame matches the current frame 
Fixes: out of array read
Fixes: 2097/clusterfuzz-testcase-minimized-5036861833609216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-05 22:43:23 +02:00
Michael Niedermayer d7cbeab4c1 avcodec/tiff: Avoid loosing allocated geotag values 
Fixes memleak
Fixes: 2076/clusterfuzz-testcase-minimized-6542640243802112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-05 22:43:23 +02:00
Michael Niedermayer 1e6ee86d92 avcodec/cavs: Fix runtime error: signed integer overflow: -12648062 * 256 cannot be represented in type 'int' 
Fixes: 2067/clusterfuzz-testcase-minimized-5578430902960128

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-05 22:43:23 +02:00
Michael Niedermayer 189ff42196 avformat/hls: Check local file extensions 
This reduces the attack surface of local file-system
information leaking.

It prevents the existing exploit leading to an information leak. As
well as similar hypothetical attacks.

Leaks of information from files and symlinks ending in common multimedia extensions
are still possible. But files with sensitive information like private keys and passwords
generally do not use common multimedia filename extensions.
It does not stop leaks via remote addresses in the LAN.

The existing exploit depends on a specific decoder as well.
It does appear though that the exploit should be possible with any decoder.
The problem is that as long as sensitive information gets into the decoder,
the output of the decoder becomes sensitive as well.
The only obvious solution is to prevent access to sensitive information. Or to
disable hls or possibly some of its feature. More complex solutions like
checking the path to limit access to only subdirectories of the hls path may
work as an alternative. But such solutions are fragile and tricky to implement
portably and would not stop every possible attack nor would they work with all
valid hls files.

Developers have expressed their dislike / objected to disabling hls by default as well
as disabling hls with local files. There also where objections against restricting
remote url file extensions. This here is a less robust but also lower
inconvenience solution.
It can be applied stand alone or together with other solutions.
limiting the check to local files was suggested by nevcairiel

This recommits the security fix without the author name joke which was
originally requested by Nicolas.

Found-by: Emil Lerner and Pavel Cheremushkin
Reported-by: Thierry Foucu <tfoucu@google.com>

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-05 13:55:01 +02:00
Michael Niedermayer c0702ab830 Revert "avformat/hls: Check local file extensions" 
Requested-by: Paul B Mahol <onemda@gmail.com>
This reverts commit caf7d6178a.
 2017-06-05 13:55:01 +02:00
Michael Niedermayer 46b865ea9f avcodec/qdrw: Fix null pointer dereference 
The RGB555 PACKBITSRGN case tries to read a palette, if such
palette is actually stored then it accesses a null pointer.
All 16bit samples i could find use DIRECTBITSRGN.

Fixes: 2065/clusterfuzz-testcase-minimized-6298930457346048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-04 23:41:35 +02:00
Michael Niedermayer b315a3cf42 avcodec/sbrdsp_fixed: Fix assertion failure in sbr_sum_square_c() 
This also increases the range of input values supported as well as
decreasing the operation dependencies in the main loop, improving
speed on modern CPUs.

Fixes part of: 2045/clusterfuzz-testcase-minimized-6751255865065472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-04 23:41:35 +02:00
Michael Niedermayer 6019d721d4 avutil/softfloat: Fix sign error in and improve documentation of av_int2sf() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-04 23:41:08 +02:00
Michael Niedermayer e2bbb95d58 avcodec/wavpack: Fix runtime error: signed integer overflow: 2081021665 - -130689706 cannot be represented in type 'int' 
Fixes: 2038/clusterfuzz-testcase-minimized-4521466148159488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-04 17:51:02 +02:00
Michael Niedermayer 29808fff33 avcodec/hevc_ps: Fix runtime error: index 32 out of bounds for type 'uint8_t [32]' 
Fixes: 2010/clusterfuzz-testcase-minimized-6209288450080768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-04 17:51:02 +02:00
Michael Niedermayer eb50492270 avcodec/dxv: Check remaining bytes in dxv_decompress_raw() 
Fixes: Timeout
Fixes: 2006/clusterfuzz-testcase-minimized-5766515037044736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-04 17:51:02 +02:00
Michael Niedermayer faa5a2181d avcodec/pafvideo: Check packet size and frame code before ff_reget_buffer() 
Fixes 1745/clusterfuzz-testcase-minimized-6160693365571584
Fixes: Timeout

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-04 13:40:54 +02:00
Michael Niedermayer 136ce8baa4 avcodec/ac3dec_fixed: Fix runtime error: left shift of 419 by 23 places cannot be represented in type 'int' 
Fixes: 1352/clusterfuzz-testcase-minimized-5757565017260032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-04 13:04:46 +02:00
Michael Niedermayer 98256595fa avcodec/tiff: Clear deinvert_buf_size on deallocation 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-04 00:25:09 +02:00
Michael Niedermayer 9221445fa0 avcodec/tiff: Use av_fast_padded_malloc() in tiff_unpack_fax() 
Fixes: Timeout
Fixes: 1213/clusterfuzz-testcase-minimized-6022987469815808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-03 23:58:46 +02:00
Michael Niedermayer 361e0310d9 avcodec/mlpdec: Check quant_step_size against huff_lsbs 
This reorders the operations so as to avoid computations with the above arguments
before they have been initialized.
Fixes part of 1708/clusterfuzz-testcase-minimized-5035111957397504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-03 23:30:31 +02:00
Michael Niedermayer 53e0d5d724 avformat/options: log filename on open 
The loglevel is choosen so that the main filename and any images of
multi image sequences are shown only at debug level to avoid
clutter.

This makes exploits in playlists more visible. As they would show
accesses to private/sensitive files

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-03 23:14:04 +02:00
Michael Niedermayer 9faf098163 avcodec/aacps: Fix runtime error: left shift of 1073741824 by 1 places cannot be represented in type 'INTFLOAT' (aka 'int') 
Fixes: 2005/clusterfuzz-testcase-minimized-5744226438479872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-03 00:09:58 +02:00
Michael Niedermayer 14b6adfd46 avcodec/snowdec: Fix runtime error: signed integer overflow: 1404 * 8388608 cannot be represented in type 'int' 
Fixes: 2004/clusterfuzz-testcase-minimized-5533262866808832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-03 00:09:58 +02:00
Michael Niedermayer adb4854aac avcodec/asvdec: Use rounded up dimenensions in input size check 
Fixes: Timeout
Fixes: 2001/clusterfuzz-testcase-minimized-6187599389523968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-01 22:20:16 +02:00
Michael Niedermayer 8b3e580b7f avcodec/wavpack: Fix runtime error: shift exponent 32 is too large for 32-bit type 'int' 
Fixes: 1967/clusterfuzz-testcase-minimized-5757031199801344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-01 22:20:16 +02:00
Michael Niedermayer cd6f319a74 avcodec/cfhd: Fix runtime error: signed integer overflow: 65280 * 65288 cannot be represented in type 'int' 
Fixes: 1925/clusterfuzz-testcase-minimized-5564569688735744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-01 22:20:16 +02:00
Michael Niedermayer a47273c803 avcodec/wavpack: Fix runtime error: signed integer overflow: 2013265955 - -134217694 cannot be represented in type 'int' 
Fixes: 1922/clusterfuzz-testcase-minimized-5561194112876544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-31 22:53:51 +02:00