virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-06-19 19:03:00 +02:00
Code Issues Releases Activity
86,545 Commits 39 Branches 425 Tags
9d11fedd1129565c8ba9e90b08b43e06f441b4fb
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer ae6f6d4e34 avcodec/x86/mpegvideo: Use intra scantable in dct_unquantize_h263_intra_mmx() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-20 00:07:51 +02:00
Michael Niedermayer 5f89747086 avcodec/wavpack: Fix undefined integer negation 
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 2291/clusterfuzz-testcase-minimized-5538453481586688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-19 17:54:40 +02:00
Michael Niedermayer cf7edbd6c5 avcodec/aacdec_fixed: Check s for being too small 
Fixes: runtime error: shift exponent -8 is negative
Fixes: 2286/clusterfuzz-testcase-minimized-5711764169687040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-19 17:54:40 +02:00
Michael Niedermayer f670c13f13 avcodec: Rename ff_mpv_decode_mb() to ff_mpv_reconstruct_mb 
The new name more accuratly describes what the function does

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-19 17:54:40 +02:00
Michael Niedermayer 14b834c45a avcodec/htmlsubtitles: Factor open brace handling into its own function 
Suggested-by: wm4
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-18 14:50:35 +02:00
Michael Niedermayer 4132218b87 avcodec/htmlsubtitles: Replace very slow redundant sscanf() calls by cleaner and faster code 
This reduces the worst case from O(n²) to O(n) time

Fixes Timeout
Fixes: 2127/clusterfuzz-testcase-minimized-6595787859427328

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-18 14:50:30 +02:00
Michael Niedermayer 27c2006805 avcodec/takdec: Fixes: integer overflow in AV_SAMPLE_FMT_U8P output 
Fixes: runtime error: signed integer overflow: 2147483543 + 128 cannot be represented in type 'int'
Fixes: 2234/clusterfuzz-testcase-minimized-6266896041115648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-18 14:38:41 +02:00
Michael Niedermayer 9a6503f496 avcodec/iff: Cleanup on init failure 
Fixes: memleak
Fixes: 2272/clusterfuzz-testcase-minimized-5059103858622464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-18 14:05:57 +02:00
Michael Niedermayer c746f92a8e avcodec/jpeg2000dsp: Reorder operations in ict_int() to avoid 2 integer overflows 
Fixes: runtime error: signed integer overflow: 58065 * 51981 cannot be represented in type 'int'
Fixes: 2271/clusterfuzz-testcase-minimized-5778297776504832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-17 22:36:54 +02:00
Michael Niedermayer c94326c1fc avcodec/hevcpred_template: Fix left shift of negative value 
Fixes: runtime error: left shift of negative value -1
Fixes: 2250/clusterfuzz-testcase-minimized-5693382112313344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-17 22:36:54 +02:00
Michael Niedermayer 1edbf5e20c avcodec/hevcdec: Fix signed integer overflow in decode_lt_rps() 
Fixes: runtime error: signed integer overflow: 2147483647 + 6 cannot be represented in type 'int'
Fixes: 2263/clusterfuzz-testcase-minimized-4800359627227136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-17 00:34:48 +02:00
Michael Niedermayer 9b65dbf734 avcodec/gdv: Fix undefined shift 
Fixes: runtime error: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 2249/clusterfuzz-testcase-minimized-5388542379294720

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 23:32:28 +02:00
Michael Niedermayer dfb61ea263 avcodec/jpeg2000dec: Check nonzerobits more completely 
Fixes: runtime error: shift exponent 36 is too large for 32-bit type 'int'
Fixes: 2239/clusterfuzz-testcase-minimized-5639766592716800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 20:32:39 +02:00
Michael Niedermayer 16d6cc2168 avcodec/wavpack: Change wp_log2() to unsigned 
Fixes: runtime error: signed integer overflow: 2143315325 + 4186162 cannot be represented in type 'int'
Fixes: 2134/clusterfuzz-testcase-minimized-4619258405322752

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 20:32:39 +02:00
Michael Niedermayer e77ddd31a8 avcodec/shorten: Sanity check maxnlpc 
Fixes OOM
Fixes: 2131/clusterfuzz-testcase-minimized-4718045157130240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 20:32:39 +02:00
Michael Niedermayer c0607d88ee avcodec/parser: assert that there is a past buffer if theres a reference into the past 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 01:35:35 +02:00
Michael Niedermayer 3c716682a8 avcodec/truemotion2: Move skip computation after checks 
Fixes: runtime error: signed integer overflow: 630067357 * 4 cannot be represented in type 'int'
Fixes: 2233/clusterfuzz-testcase-minimized-5943031318446080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 00:21:30 +02:00
Michael Niedermayer e3fadc57c5 avcodec/jpeg2000: Fixes integer overflow in ff_jpeg2000_ceildivpow2() 
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 2231/clusterfuzz-testcase-minimized-4565181982048256

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 00:21:30 +02:00
Michael Niedermayer 611b356274 avcodec/dnxhd_parser: Do not return invalid value from dnxhd_find_frame_end() on error 
Fixes: Null pointer dereference

Fixes: CVE-2017-9608
Found-by: Yihan Lian
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 00:21:30 +02:00
Michael Niedermayer bc40674462 avcodec/hevcdec: Check nb_sps 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-15 03:09:40 +02:00
Michael Niedermayer 1cb4ef526d avcodec/hevc_refs: Check nb_refs in add_candidate_ref() 
Fixes: runtime error: index 16 out of bounds for type 'int [16]'
Fixes: 2209/clusterfuzz-testcase-minimized-5012343912136704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-15 03:09:40 +02:00
Michael Niedermayer 12245ab1f6 avcodec/mpeg4videodec: Check sprite delta upshift against overflowing. 
Fixes: runtime error: signed integer overflow: -268386304 * 16 cannot be represented in type 'int'
Fixes: 2204/clusterfuzz-testcase-minimized-5616756909408256

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-15 00:16:20 +02:00
Michael Niedermayer 0a87be404a avcodec/mpeg4videodec: Fix integer overflow in num_sprite_warping_points=2 case 
Fixes: runtime error: signed integer overflow: 131072 + 2147352576 cannot be represented in type 'int'
Fixes: 2192/clusterfuzz-testcase-minimized-5370387988742144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-15 00:16:20 +02:00
Michael Niedermayer 900fe8ee5d avcodec/dnxhdenc: Assert that frame size is not assigned an error code 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-15 00:16:20 +02:00
Michael Niedermayer 4cc2a357f5 avcodec/aacsbr_fixed: Fix signed integer overflow in sbr_hf_inverse_filter() 
Fixes: runtime error: signed integer overflow: 2147483584 + 128 cannot be represented in type 'int'
Fixes: 2164/clusterfuzz-testcase-minimized-4715936172998656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-13 17:39:13 +02:00
Michael Niedermayer d1992448d3 avcodec/aacsbr_fixed: Check shift in sbr_hf_assemble() 
Fixes: runtime error: shift exponent -10 is negative

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-13 17:39:13 +02:00
Michael Niedermayer d549f026d8 avcodec/sbrdsp_fixed: Return an error from sbr_hf_apply_noise() if operations are impossible 
Fixes: 1775/clusterfuzz-testcase-minimized-5330288148217856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-13 17:39:13 +02:00
Michael Niedermayer 4f9e958b04 avcodec/put_bits: Implement put_bits32() in a single pass instead of 2 passes writing 16bits each 
820 cpu cycles -> 660 cpu cycles for 100 put_bits32()

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-13 04:17:13 +02:00
Michael Niedermayer db93fd74e4 avcodec/golomb: Assert that the input is not too large in set_ue_golomb() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-13 04:17:13 +02:00
Michael Niedermayer f8593c2f49 avcodec/libvpxdec: Check that display dimensions fit in the storage dimensions 
Fixes assertion failure
Fixes: 2112/clusterfuzz-testcase-minimized-4526878557732864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-11 22:41:26 +02:00
Michael Niedermayer 07339a45a0 avcodec/avpacket: Limit iterations in ff_packet_split_and_drop_side_data() 
This avoids scaning beyond what a valid packet can contain
Fixes: Timeout
Fixes: 541/clusterfuzz-testcase-610189291657625

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-11 22:09:15 +02:00
Michael Niedermayer d24043e1a2 avcodec/jpeg2000dwt: Fix runtime error: left shift of negative value -123 
Fixes: 2208/clusterfuzz-testcase-minimized-5976593765761024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-11 20:52:47 +02:00
Michael Niedermayer c996374d4d avcodec/wavpack: Fix runtime error: signed integer overflow: 1886191616 + 277872640 cannot be represented in type 'int' 
Fixes: 2181/clusterfuzz-testcase-minimized-6314784322486272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-11 20:52:47 +02:00
Michael Niedermayer 2e44126363 avcodec/snowdec: Fix runtime error: left shift of negative value -1 
Fixes: 2197/clusterfuzz-testcase-minimized-6010716676947968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-11 15:22:07 +02:00
Michael Niedermayer 6d499ecef9 avcodec/aacdec_fixed: Fix runtime error: left shift of negative value -1297616 
Fixes: 2195/clusterfuzz-testcase-minimized-4736721533009920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-11 15:22:07 +02:00
Michael Niedermayer 22a25ab389 avcodec/tiff: Fix leak of geotags[].val 
Fixes: 2176/clusterfuzz-testcase-minimized-5908197216878592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-11 01:06:08 +02:00
Michael Niedermayer 1197c04896 avcodec/fft_template: Fix multiple runtime error: signed integer overflow: -1943918714 - 1935113003 cannot be represented in type 'int' 
Fixes: 1735/clusterfuzz-testcase-minimized-5350472347025408

This uses unsigned instead of SUINT because the later was rejected by multiple developers
See: [FFmpeg-devel] [PATCH] avcodec/fft_template: Fix multiple runtime error: signed integer overflow: -1943918714 - 1935113003 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-11 00:56:33 +02:00
Michael Niedermayer 71da0a5c97 avcodec/ra144: Fix runtime error: signed integer overflow: -2200 * 1033073 cannot be represented in type 'int' 
Fixes: 2175/clusterfuzz-testcase-minimized-5809657849315328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-11 00:47:29 +02:00
Michael Niedermayer 90e8317b3b avcodec/flicvideo: Fix runtime error: signed integer overflow: 4864 * 459296 cannot be represented in type 'int' 
Fixes: 2174/clusterfuzz-testcase-minimized-5739234533048320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-10 19:46:04 +02:00
Michael Niedermayer 54aaadf648 avcodec/cfhd: Check band parameters before storing them 
Fixes out of array read
Fixes: 2169/clusterfuzz-testcase-minimized-5688641642823680

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-10 18:46:27 +02:00
Michael Niedermayer 09096fb687 avcodec/h264_parse: Check picture structure when initializing weight table 
Fixes: runtime error: index 49 out of bounds for type 'int [48][2][2]'
Fixes: 2159/clusterfuzz-testcase-minimized-5267945972301824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-10 00:48:23 +02:00
Michael Niedermayer e1b0044c23 avcodec/dvbsubdec: Check pixel buffer size constraint from ETSI EN 300 743 V1.3.1 
Fixes: OOM
Fixes: 2143/clusterfuzz-testcase-minimized-5482288060039168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-10 00:48:07 +02:00
Michael Niedermayer 4bcde26172 avcodec/dvbsubdec: Use av_image_check_size2() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-10 00:48:07 +02:00
Michael Niedermayer a3b5b60bdf avcodec/indeo4: Check remaining data in Pic hdr extension parsing code 
Fixes: Timeout
Fixes: 2115/clusterfuzz-testcase-minimized-6594111748440064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-08 17:37:16 +02:00
Michael Niedermayer 4e3ab1a5c1 avcodec/ac3dec_fixed: Fix multiple runtime error: signed integer overflow: -39271008 * 59 cannot be represented in type 'int' 
Fixes: 2113/clusterfuzz-testcase-minimized-6510704959946752

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-08 17:37:16 +02:00
Michael Niedermayer 850cbd496f avformat/utils: Slightly un-clutter code in determinable_frame_size() by using a switch 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-06 18:31:47 +02:00
Michael Niedermayer 18bca25adb avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: 53098 * 40448 cannot be represented in type 'int' 
Fixes: 2106/clusterfuzz-testcase-minimized-6136503639998464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-06 16:54:50 +02:00
Michael Niedermayer c4360559ee avcodec/pafvideo: Fix assertion failure 
Fixes: 2100/clusterfuzz-testcase-minimized-4522961547558912

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-06 16:54:50 +02:00
Michael Niedermayer e4efd41b83 avcodec/takdec: Fix multiple runtime error: signed integer overflow: 637072 * 4096 cannot be represented in type 'int' 
Fixes: 2079/clusterfuzz-testcase-minimized-5345861779324928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-06 16:54:50 +02:00
Michael Niedermayer 4705edbbb9 avcodec/mjpegdec: Check that reference frame matches the current frame 
Fixes: out of array read
Fixes: 2097/clusterfuzz-testcase-minimized-5036861833609216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-05 22:43:23 +02:00
Michael Niedermayer d7cbeab4c1 avcodec/tiff: Avoid loosing allocated geotag values 
Fixes memleak
Fixes: 2076/clusterfuzz-testcase-minimized-6542640243802112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-05 22:43:23 +02:00
Michael Niedermayer 1e6ee86d92 avcodec/cavs: Fix runtime error: signed integer overflow: -12648062 * 256 cannot be represented in type 'int' 
Fixes: 2067/clusterfuzz-testcase-minimized-5578430902960128

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-05 22:43:23 +02:00
Michael Niedermayer 189ff42196 avformat/hls: Check local file extensions 
This reduces the attack surface of local file-system
information leaking.

It prevents the existing exploit leading to an information leak. As
well as similar hypothetical attacks.

Leaks of information from files and symlinks ending in common multimedia extensions
are still possible. But files with sensitive information like private keys and passwords
generally do not use common multimedia filename extensions.
It does not stop leaks via remote addresses in the LAN.

The existing exploit depends on a specific decoder as well.
It does appear though that the exploit should be possible with any decoder.
The problem is that as long as sensitive information gets into the decoder,
the output of the decoder becomes sensitive as well.
The only obvious solution is to prevent access to sensitive information. Or to
disable hls or possibly some of its feature. More complex solutions like
checking the path to limit access to only subdirectories of the hls path may
work as an alternative. But such solutions are fragile and tricky to implement
portably and would not stop every possible attack nor would they work with all
valid hls files.

Developers have expressed their dislike / objected to disabling hls by default as well
as disabling hls with local files. There also where objections against restricting
remote url file extensions. This here is a less robust but also lower
inconvenience solution.
It can be applied stand alone or together with other solutions.
limiting the check to local files was suggested by nevcairiel

This recommits the security fix without the author name joke which was
originally requested by Nicolas.

Found-by: Emil Lerner and Pavel Cheremushkin
Reported-by: Thierry Foucu <tfoucu@google.com>

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-05 13:55:01 +02:00
Michael Niedermayer c0702ab830 Revert "avformat/hls: Check local file extensions" 
Requested-by: Paul B Mahol <onemda@gmail.com>
This reverts commit caf7d6178a.
 2017-06-05 13:55:01 +02:00
Michael Niedermayer 46b865ea9f avcodec/qdrw: Fix null pointer dereference 
The RGB555 PACKBITSRGN case tries to read a palette, if such
palette is actually stored then it accesses a null pointer.
All 16bit samples i could find use DIRECTBITSRGN.

Fixes: 2065/clusterfuzz-testcase-minimized-6298930457346048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-04 23:41:35 +02:00
Michael Niedermayer b315a3cf42 avcodec/sbrdsp_fixed: Fix assertion failure in sbr_sum_square_c() 
This also increases the range of input values supported as well as
decreasing the operation dependencies in the main loop, improving
speed on modern CPUs.

Fixes part of: 2045/clusterfuzz-testcase-minimized-6751255865065472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-04 23:41:35 +02:00
Michael Niedermayer 6019d721d4 avutil/softfloat: Fix sign error in and improve documentation of av_int2sf() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-04 23:41:08 +02:00
Michael Niedermayer e2bbb95d58 avcodec/wavpack: Fix runtime error: signed integer overflow: 2081021665 - -130689706 cannot be represented in type 'int' 
Fixes: 2038/clusterfuzz-testcase-minimized-4521466148159488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-04 17:51:02 +02:00
Michael Niedermayer 29808fff33 avcodec/hevc_ps: Fix runtime error: index 32 out of bounds for type 'uint8_t [32]' 
Fixes: 2010/clusterfuzz-testcase-minimized-6209288450080768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-04 17:51:02 +02:00
Michael Niedermayer eb50492270 avcodec/dxv: Check remaining bytes in dxv_decompress_raw() 
Fixes: Timeout
Fixes: 2006/clusterfuzz-testcase-minimized-5766515037044736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-04 17:51:02 +02:00
Michael Niedermayer faa5a2181d avcodec/pafvideo: Check packet size and frame code before ff_reget_buffer() 
Fixes 1745/clusterfuzz-testcase-minimized-6160693365571584
Fixes: Timeout

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-04 13:40:54 +02:00
Michael Niedermayer 136ce8baa4 avcodec/ac3dec_fixed: Fix runtime error: left shift of 419 by 23 places cannot be represented in type 'int' 
Fixes: 1352/clusterfuzz-testcase-minimized-5757565017260032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-04 13:04:46 +02:00
Michael Niedermayer 98256595fa avcodec/tiff: Clear deinvert_buf_size on deallocation 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-04 00:25:09 +02:00
Michael Niedermayer 9221445fa0 avcodec/tiff: Use av_fast_padded_malloc() in tiff_unpack_fax() 
Fixes: Timeout
Fixes: 1213/clusterfuzz-testcase-minimized-6022987469815808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-03 23:58:46 +02:00
Michael Niedermayer 361e0310d9 avcodec/mlpdec: Check quant_step_size against huff_lsbs 
This reorders the operations so as to avoid computations with the above arguments
before they have been initialized.
Fixes part of 1708/clusterfuzz-testcase-minimized-5035111957397504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-03 23:30:31 +02:00
Michael Niedermayer 53e0d5d724 avformat/options: log filename on open 
The loglevel is choosen so that the main filename and any images of
multi image sequences are shown only at debug level to avoid
clutter.

This makes exploits in playlists more visible. As they would show
accesses to private/sensitive files

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-03 23:14:04 +02:00
Michael Niedermayer 9faf098163 avcodec/aacps: Fix runtime error: left shift of 1073741824 by 1 places cannot be represented in type 'INTFLOAT' (aka 'int') 
Fixes: 2005/clusterfuzz-testcase-minimized-5744226438479872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-03 00:09:58 +02:00
Michael Niedermayer 14b6adfd46 avcodec/snowdec: Fix runtime error: signed integer overflow: 1404 * 8388608 cannot be represented in type 'int' 
Fixes: 2004/clusterfuzz-testcase-minimized-5533262866808832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-03 00:09:58 +02:00
Michael Niedermayer adb4854aac avcodec/asvdec: Use rounded up dimenensions in input size check 
Fixes: Timeout
Fixes: 2001/clusterfuzz-testcase-minimized-6187599389523968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-01 22:20:16 +02:00
Michael Niedermayer 8b3e580b7f avcodec/wavpack: Fix runtime error: shift exponent 32 is too large for 32-bit type 'int' 
Fixes: 1967/clusterfuzz-testcase-minimized-5757031199801344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-01 22:20:16 +02:00
Michael Niedermayer cd6f319a74 avcodec/cfhd: Fix runtime error: signed integer overflow: 65280 * 65288 cannot be represented in type 'int' 
Fixes: 1925/clusterfuzz-testcase-minimized-5564569688735744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-01 22:20:16 +02:00
Michael Niedermayer a47273c803 avcodec/wavpack: Fix runtime error: signed integer overflow: 2013265955 - -134217694 cannot be represented in type 'int' 
Fixes: 1922/clusterfuzz-testcase-minimized-5561194112876544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-31 22:53:51 +02:00
Michael Niedermayer e47057e932 avcodec/cinepak: Check input packet size before frame reallocation 
Reduces time spend decoding 1917/clusterfuzz-testcase-minimized-5023221273329664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-31 22:24:16 +02:00
Michael Niedermayer 6726328f79 avcodec/hevc_ps: Fix runtime error: signed integer overflow: 2147483628 + 256 cannot be represented in type 'int' 
Fixes: 1909/clusterfuzz-testcase-minimized-6732072662073344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-31 22:05:32 +02:00
Michael Niedermayer 08cb69e870 avcodec/ra144: Fixes runtime error: signed integer overflow: 7160 * 327138 cannot be represented in type 'int' 
Fixes: 1908/clusterfuzz-testcase-minimized-5392712477966336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-31 16:08:46 +02:00
Michael Niedermayer a1c0d1d906 avcodec/pnm: Use ff_set_dimensions() 
Fixes: OOM
Fixes: 1906/clusterfuzz-testcase-minimized-4599315114754048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-31 16:08:46 +02:00
Michael Niedermayer 58f8cd4ac5 avcodec/cavsdec: Fix runtime error: signed integer overflow: 59 + 2147483600 cannot be represented in type 'int' 
Fixes: 1903/clusterfuzz-testcase-minimized-5359318167715840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-31 16:08:46 +02:00
Michael Niedermayer edf686f089 tests/fate/libavcodec: Test with all idct and dct modes supported in the test 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-31 02:32:42 +02:00
Michael Niedermayer a5d849b149 avformat/avidec: Limit formats in gab2 to srt and ass/ssa 
This prevents part of one exploit leading to an information leak

Found-by: Emil Lerner and Pavel Cheremushkin
Reported-by: Thierry Foucu <tfoucu@google.com>

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-31 02:32:42 +02:00
Michael Niedermayer 78f6ec32a3 avformat/avidec: Fix txts fmts parsing 
Fixes: subtitle.avi from vlc/ticket/1162

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-31 02:32:42 +02:00
Michael Niedermayer 87bddba43b avcodec/acelp_pitch_delay: Fix runtime error: value 4.83233e+39 is outside the range of representable values of type 'float' 
Fixes: 1902/clusterfuzz-testcase-minimized-4762451407011840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-30 04:45:27 +02:00
Michael Niedermayer 4020b009d1 avcodec/wavpack: Check float_shift 
Fixes: runtime error: shift exponent 40 is too large for 32-bit type 'unsigned int'
Fixes: 1898/clusterfuzz-testcase-minimized-5970744880136192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-30 04:45:27 +02:00
Michael Niedermayer d90c5bf105 avcodec/wavpack: Fix runtime error: signed integer overflow: 24 * -2147483648 cannot be represented in type 'int' 
Fixes: 1894/clusterfuzz-testcase-minimized-4716739789062144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-30 04:45:27 +02:00
Michael Niedermayer e091b9b3c7 avcodec/ansi: Fix frame memleak 
Fixes: 1892/clusterfuzz-testcase-minimized-4519341733183488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-29 14:08:07 +02:00
Michael Niedermayer c49fa2a514 avcodec/dds: Fix runtime error: left shift of 145 by 24 places cannot be represented in type 'int' 
Fixes: 1891/clusterfuzz-testcase-minimized-6274417925554176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-29 13:51:42 +02:00
Michael Niedermayer f3da6fbff8 avcodec/jpeg2000dec: Use ff_set_dimensions() 
Fixes: OOM
Fixes: 1890/clusterfuzz-testcase-minimized-6329019509243904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-29 13:46:09 +02:00
Michael Niedermayer 718f8a01df tools/target_dec_fuzzer: Move the hwaccel check outside the initialization if 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-29 03:40:47 +02:00
Michael Niedermayer f6ba58d193 avcodec/aacsbr: Fix libavcodec/aacsbr.c:257:59: runtime error: division by zero 
Fixes: 1882/clusterfuzz-testcase-minimized-5539735650959360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-29 02:45:17 +02:00
Michael Niedermayer c901627918 avcodec/truemotion2: Fix passing null pointer to memset() 
Fixes part of: 1888/clusterfuzz-testcase-minimized-5237704826552320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-28 21:56:02 +02:00
Michael Niedermayer c9e884f3d9 avcodec/truemotion2: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int' 
Fixes part of: 1888/clusterfuzz-testcase-minimized-5237704826552320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-28 21:55:06 +02:00
Michael Niedermayer 7c845450d2 avcodec/ra144: Fix runtime error: signed integer overflow: -2449 * 1398101 cannot be represented in type 'int' 
Fixes: 1885/clusterfuzz-testcase-minimized-5336328549957632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-28 21:55:02 +02:00
Michael Niedermayer 4c472c5252 avcodec/ra144: Fix runtime error: signed integer overflow: 11184810 * 404 cannot be represented in type 'int' 
Fixes: 1884/clusterfuzz-testcase-minimized-4637425835966464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-28 21:38:55 +02:00
Michael Niedermayer 872bac8159 avcodec/aac_defines: Add missing () to AAC_HALF_SUM() macro 
Fixes: runtime error: shift exponent 1073741848 is too large for 32-bit type 'INTFLOAT' (aka 'int')
Fixes: 1880/clusterfuzz-testcase-minimized-4900645322620928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-28 21:20:28 +02:00
Michael Niedermayer 67020711b7 avcodec/webp: Fixes null pointer dereference 
Fixes: 1470/clusterfuzz-testcase-minimized-5404421666111488
Fixes: 1472/clusterfuzz-testcase-minimized-5677426430443520
Fixes: 1875/clusterfuzz-testcase-minimized-5536474562822144

Approved-by: BBB

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-28 21:20:09 +02:00
Michael Niedermayer 6b9cb5d26a avcodec/aacdec_fixed: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int' 
Fixes: 1878/clusterfuzz-testcase-minimized-6441918630199296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-28 18:27:43 +02:00
Michael Niedermayer 67b30decf7 avcodec/ylc: Check count in build_vlc() 
Fixes: runtime error: signed integer overflow: 211633430 + 2147483647 cannot be represented in type 'int'
Fixes: 1874/clusterfuzz-testcase-minimized-5037763613163520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-28 17:21:41 +02:00
Michael Niedermayer b9c032ebc0 avcodec/snow: Fix runtime error: signed integer overflow: 1086573993 + 1086573994 cannot be represented in type 'int' 
Fixes: 1871/clusterfuzz-testcase-minimized-5719950331215872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-28 17:13:07 +02:00
Michael Niedermayer 781f88bb26 avcodec/jpeg2000: Fix runtime error: signed integer overflow: 4185 + 2147483394 cannot be represented in type 'int' 
Fixes: 1870/clusterfuzz-testcase-minimized-4686788029317120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-28 14:01:12 +02:00
Michael Niedermayer 9c1812491f avcodec/jpeg2000dec: Check tile offsets more completely 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-28 13:52:13 +02:00
Michael Niedermayer d8030c14bd avcodec/sheervideo: Check input buffer size before allocating and decoding 
Fixes: Timeout
Fixes: 1858/clusterfuzz-testcase-minimized-6450473802399744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-05-28 13:32:12 +02:00