virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-06-19 19:03:00 +02:00
Code Issues Releases Activity
112,696 Commits 39 Branches 425 Tags
ab84c37d63f31383bf3c4db537be954a7bf5b6d8
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer ab84c37d63 avcodec/jpeg2000htdec: warn about non zero roi shift 
Suggested-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7b7eea8e63)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:58 +02:00
Michael Niedermayer 78e54e1361 avcodec/jpeg2000htdec: Check magp before using it in a shift 
Fixes: shift exponent -1 is negative
Fixes: 65378/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5457678193197056

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 19ad05e9e0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:58 +02:00
Michael Niedermayer 5bb9d8affe avfilter/vf_signature: Dont crash on no frames 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3d5f03bbc8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:57 +02:00
Michael Niedermayer 243359fc78 avformat/westwood_vqa: Fix 2g packets 
Fixes: signed integer overflow: 2147483424 * 2 cannot be represented in type 'int'
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_WSVQA_fuzzer-4576211411795968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 86f73277bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:57 +02:00
Michael Niedermayer 41f9156856 avformat/matroskadec: Check timescale 
Fixes: 3.82046e+18 is outside the range of representable values of type 'unsigned int'
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6381436594421760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e849eb2343)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:57 +02:00
Michael Niedermayer a42a5e692d avformat/wavdec: satuarte next_tag_ofs, data_end 
Fixes: signed integer overflow: 5053074104798691550 + 5053074104259715104 cannot be represented in type 'long'
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-6515315309936640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 61dca9e150)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:56 +02:00
Michael Niedermayer 6d92f9a85e avformat/wavdec: sanity check channels and bps before using them for block_align 
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-4704044498944000
Fixes: signed integer overflow: 520464 * 8224 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 75317ec442)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:56 +02:00
Michael Niedermayer d492fc3e5e avformat/sbgdec: Check for negative duration 
Fixes: signed integer overflow: 9223372036854775807 - -8000000 cannot be represented in type 'long'
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-5133181743136768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0bed22d597)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:56 +02:00
Michael Niedermayer 4a618246cd avformat/rpl: Use 64bit for total_audio_size and check it 
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-4677434693517312
Fixes: signed integer overflow: 5555555555555555556 * 8 cannot be represented in type 'long long'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 878625812f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:55 +02:00
Michael Niedermayer 7af16852cb avformat/timecode: use 64bit for intermediate for rounding in fps_from_frame_rate() 
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4802790784303104
Fixes: signed integer overflow: 1768972133 + 968491058 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3d8d778a68)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:55 +02:00
Michael Niedermayer db7a80c3ca avformat/mov: use 64bit for intermediate for rounding 
Fixes: signed integer overflow: 1768972133 + 968491058 cannot be represented in type 'int'
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4802790784303104

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f01a89c5a3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:55 +02:00
Michael Niedermayer 6cc785c255 avformat/jacosubdec: Use 64bit for abs 
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-5401294942371840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 746203af31)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:54 +02:00
Michael Niedermayer 0a64d77be9 avformat/concatdec: Check user_duration sum 
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-6434245599690752
Fixes: signed integer overflow: 9223372026773000000 + 22337000000 cannot be represented in type 'long'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 007486058c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:54 +02:00
Michael Niedermayer e709315488 avcodec/wavarc: avoid signed integer overflow in AC code 
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-659847401740697
Fixes: signed integer overflow: 65312 * 34078 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1eb8cbd09c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:54 +02:00
Michael Niedermayer 9062d89849 avcodec/wavarc: Avoid signed integer overflow in sample 
Fixes: signed integer overflow: -2147483648 + -25122315 cannot be represented in type 'int'
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-6199806972198912

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6009dd07bd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:53 +02:00
Michael Niedermayer 4cbc9bb2c9 avcodec/truemotion1: Height not being a multiple of 4 is unsupported 
mb_change_bits is given space based on height >> 2, while more data is read

Fixes: out of array access
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION1_fuzzer-5201925062590464.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ebdcf98499)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:53 +02:00
Michael Niedermayer 9a5f191bfb avcodec/rtv1: fix undefined FFALIGN 
Fixes: signed integer overflow: 2147483647 + 4 cannot be represented in type 'int'
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RTV1_fuzzer-6324303861514240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d188a86730)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:53 +02:00
Michael Niedermayer aa4cf7a584 avcodec/hcadec: do not allow code to continue after failed init 
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCA_fuzzer-6247136417087488
Fixes: out of array write

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 48eeb198a5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:52 +02:00
Michael Niedermayer 30fe9d3511 avcodec/hcadec: do not set hfr_group_count to invalid values 
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCA_fuzzer-6247136417087488
Fixes: out of array write

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit addb85ea39)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:52 +02:00
Michael Niedermayer 435f172b5d avformat/concatdec: clip outpoint - inpoint overflow in get_best_effort_duration() 
An alternative would be to limit all time/duration fields to below 64bit

Fixes: signed integer overflow: -93000000 - 9223372036839000000 cannot be represented in type 'long long'
Fixes: 64546/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-5110813828186112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dd733b2be4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:52 +02:00
Michael Niedermayer 21ff582aec avcodec/osq: avoid several signed integer overflows 
Fixes: signed integer overflow: 178459578 + 2009763270 cannot be represented in type 'int'
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-5013423686287360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b54c9a9c8f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:51 +02:00
Michael Niedermayer f0c08506f5 avformat/jacosubdec: clarify code 
add comments, rename variables and indent things differently

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e83e8d443b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:51 +02:00
Michael Niedermayer 356251d750 avformat/cafdec: Check that data chunk end fits within 64bit 
Fixes: signed integer overflow: 64 + 9223372036854775803 cannot be represented in type 'long long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6536881135550464
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6536881135550464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b792e4d4c7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:51 +02:00
Michael Niedermayer 9459a45036 avformat/iff: Saturate avio_tell() + 12 
Fixes: signed integer overflow: 9223372036854775796 + 12 cannot be represented in type 'long long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4898373660704768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b8e754525c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:50 +02:00
Michael Niedermayer 521347ee0b avformat/dxa: Adjust order of operations around block align 
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-5730576523198464
Fixes: signed integer overflow: 2147483566 + 82 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 50d8e4f273)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:50 +02:00
Michael Niedermayer d66b1af8df avformat/cafdec: dont seek beyond 64bit 
Fixes: signed integer overflow: 64 + 9223372036854775807 cannot be represented in type 'long long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6418242730328064
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6418242730328064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d973fcbcc2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:50 +02:00
Michael Niedermayer 19ea7b0409 avformat/id3v2: read_uslt() check for the amount read 
Fixes: timeout
Fixes: 66783/clusterfuzz-testcase-minimized-ffmpeg_dem_GENH_fuzzer-5356884892647424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c0f4abe2aa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:49 +02:00
Michael Niedermayer e2a58916b1 avcodec/vmixdec: Check shift before use 
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 65909/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMIX_fuzzer-519459745831321

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 70b26b693e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:49 +02:00
Michael Niedermayer b171edca3c avformat/mov: Check sample_count and auxiliary_info_default_size to be 0 
This combination causes 0 size arrays to be allocated and to leak later

Fixes: memleak
Fixes: 64342/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4520993686945792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3c43299e9e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:49 +02:00
Michael Niedermayer 8464563b80 avformat/wady: Check >0 samplerate and channels 1 || 2. 
The WADY decoder only supports mono and stereo

This fixes a probetest failure

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6f9e90ab0b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:48 +02:00
Michael Niedermayer a2ceca5cf6 avcodec/cbs_h266_syntax_template: Check tile_y 
Fixes: out of array access
Fixes: 67021/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4883576579489792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 57f252b2d1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:48 +02:00
Michael Niedermayer 24367ad563 avcodec/proresenc_kostya: Remove bug similarity text 
According to kostya, it is not based on Wassermans encoder

CC: Kostya Shishkov <kostya.shishkov@gmail.com>
CC: Anatoliy Wasserman <anatoliy.wasserman@yandex.ru>

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e0e30e07a1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:48 +02:00
Michael Niedermayer d2f57db3ab avcodec/vorbisdec: Check remaining data in vorbis_residue_decode_internal() 
Fixes: timeout
Fixes: 66326/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-6295291863040000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dc89cf804a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:47 +02:00
Michael Niedermayer 13f0a85c2c avformat/concatdec: Check in and outpoints to be to produce a positive representable duration 
Fixes: signed integer overflow: -93000000 - 9223372036839000000 cannot be represented in type 'long'
Fixes: 64546/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-5110813828186112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b2d7cbc378)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:47 +02:00
Michael Niedermayer ae0e91150c avcodec/8bps: Consider width in the minimal size check 
Fixes: Timeout
Fixes: 64479/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EIGHTBPS_fuzzer-5434435386081280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5db09574df)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:47 +02:00
Michael Niedermayer abd835bec7 libswscale/utils: Fix bayer to yuvj 
Fixes: out of array access.

Earlier code assumes that a unscaled bayer to yuvj420 converter exists
but the later code then skips yuvj420

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e9cc9e492f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:46 +02:00
Michael Niedermayer b88210ba04 swscale/swscale: Check srcSliceH for bayer 
Fixes: Assertion srcSliceH > 1 failed at libswscale/swscale_unscaled.c:1359
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 64098d0cd8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:46 +02:00
Michael Niedermayer ce35590562 swscale/utils: Allocate more dithererror 
Fixes: out of array read
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 18f26f8a2f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:46 +02:00
Michael Niedermayer 7dbea8ef0b avcodec/indeo3: Round dimensions up in allocate_frame_buffers() 
Fixes: Ticket6581

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3be80ce299)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:45 +02:00
Michael Niedermayer e976607831 avutil/rational: Document what is to be expected from av_d2q() of doubles representing rational numbers 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f465badb06)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:45 +02:00
Michael Niedermayer fdc5b25f19 avfilter/signature_lookup: Do not dereference NULL pointers after malloc failure 
Fixes: CID 1403229 Dereference after null check

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 98ae1ad7cf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:45 +02:00
Michael Niedermayer c5dcf99399 avfilter/signature_lookup: dont leave uncleared pointers in sll_free() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6c50482951)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:44 +02:00
Michael Niedermayer 16bef72c50 avcodec/mpegvideo_enc: Use ptrdiff_t for stride 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e063c1d079)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:44 +02:00
Michael Niedermayer e38092ef93 Changelog: update 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-30 22:19:58 +01:00
Michael Niedermayer e1c2fa6b9a avcodec/mpegvideo_enc: Dont copy beyond the image 
Fixes: out of array access
Fixes: tickets/10754/poc17ffmpeg

Discovered by Zeng Yunxiang.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a066b8a809)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-30 22:13:00 +01:00
Michael Niedermayer c9e6162554 avfilter/vf_minterpolate: Check pts before division 
Fixes: FPE
Fixes: tickets/10758/poc20ffmpeg

Discovered by Zeng Yunxiang

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 68146f06f8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-30 21:59:26 +01:00
Michael Niedermayer ea276a511a avfilter/avf_showwaves: Check history_nb_samples 
Fixes: out of array access
Fixes: tickets/10756/poc18ffmpeg

Discovered by Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 08bd2cbfeb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-30 21:57:03 +01:00
Michael Niedermayer 41f32f0bc4 Changelog: update 2023-12-29 23:23:24 +01:00
Michael Niedermayer ef879f02f2 avformat/flacdec: Avoid double AVERRORS 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 029294ff54)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 23:10:10 +01:00
Michael Niedermayer f2d836819d avfilter/vf_vidstabdetect: Avoid double AVERRORS 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bb04235d72)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 23:09:03 +01:00
Michael Niedermayer 2b403b88fc avcodec/vaapi_encode: Avoid double AVERRORS 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bf1159774b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 23:08:02 +01:00
Michael Niedermayer 2450e202c4 avfilter/vf_swaprect: round coordinates down 
Fixes: out of array access:
Fixes: tickets/10745/poc12ffmpeg

Found-by: Li Zeyuan and Zeng Yunxiang.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7deaca71b3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 23:05:48 +01:00
Michael Niedermayer 301100ddfb avfilter/vf_swaprect: Use height for vertical variables 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9f4c5bd7d2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 23:05:20 +01:00
Michael Niedermayer 8e99388c1b avfilter/vf_swaprect: assert that rectangles are within memory 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9d1ba698d2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 23:03:32 +01:00
Michael Niedermayer e43a3d8d30 avfilter/af_alimiter: Check nextpos before use 
Fixes: out of array read
Fixes: tickets/10744/poc11ffmpeg

Found-by: Li Zeyuan and Zeng Yunxiang.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a88b06f9ee)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 22:50:30 +01:00
Michael Niedermayer e01a55c528 avfilter/f_reverse: Apply PTS compensation only when pts is available 
Fixes: out of array access
Fixes: tickets/10753/poc16ffmpeg

Regression since: 45dc668aea
Found-by: Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 61e73851a3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 22:49:48 +01:00
Michael Niedermayer 0c52543781 avfilter/af_stereowiden: Check length 
Fixes: out of array access
Fixes: tickets/10746/poc13ffmpeg

Found-by: Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 50f0f8c53c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 22:49:17 +01:00
Michael Niedermayer 2eb597816a avcodec/jpegxl_parser: Check get_vlc2() 
Fixes: shift exponent -1 is negative
Fixes: 63889/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6009343056936960

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 850ab8f6da)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 22:45:57 +01:00
Michael Niedermayer c02d56b3cf Update for 6.1.1 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 13:20:48 +01:00
Michael Niedermayer 8b8b4bdef3 avfilter/vf_weave: Fix odd height handling 
Fixes: out of array access
Fixes: tickets/10743/poc10ffmpeg

Found-by: Zeng Yunxiang and Li Zeyuan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ecc1f0e48)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 13:19:02 +01:00
Michael Niedermayer 162b4c60c8 avfilter/edge_template: Fix small inputs with gaussian_blur() 
Fixes: out of array access
Fixes: Ticket10699
Fixes: poc5ffmpeg

Found-by: Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c443658d26)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 13:19:01 +01:00
Michael Niedermayer e809c23786 avfilter/vf_gradfun: Do not overread last line 
The code works in steps of 2 lines and lacks support for odd height
Implementing odd height support is better but for now this fixes the
out of array access

Fixes: out of array access
Fixes: tickets/10702/poc6ffmpe

Found-by: Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e4d2666bdc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 13:19:01 +01:00
Michael Niedermayer 3061bf668f avfilter/avf_showspectrum: fix off by 1 error 
Fixes: out of array access
Fixes: tickets/10749/poc15ffmpeg

Regression since: 81df787b53

Found-by: Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ab0fdaedd1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 13:19:01 +01:00
Michael Niedermayer bf2d7b20ea avcodec/jpegxl_parser: Add padding to cs_buffer 
Fixes: out of array access
Fixes: 64081/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6151006496620544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f88458bea)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 13:19:00 +01:00
Michael Niedermayer 84f78ac3ea avformat/mov: do not set sign bit for chunk_offsets 
Fixes: signed integer overflow: 2314885530818453536 - -7412889664301817824 cannot be represented in type 'long'
Fixes: 64296/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6304027146846208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cfc0a68d4d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 13:19:00 +01:00
Michael Niedermayer 45cd69a276 avcodec/jpeglsdec: Check Jpeg-LS LSE 
Fixes: signed integer overflow: 2147478526 + 33924 cannot be represented in type 'int'
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 64243/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-5195717848989696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c72a20f01a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 13:19:00 +01:00
Michael Niedermayer bb84cbfd0c avcodec/osq: Implement flush() 
Fixes: out of array access
Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6227491892887552
Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6268561729126400
Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6414805046788096
Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6538151088488448
Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6608131540779008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c75fccd1d4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 13:18:59 +01:00
Michael Niedermayer fde01699eb tools/target_dec_fuzzer: Adjust threshold for VMIX 
Fixes: Timeout
Fixes: 62286/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMIX_fuzzer-5155237134204928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aa1e768120)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 13:18:58 +01:00
Michael Niedermayer d93b0009c4 avcodec/av1dec: Fix resolving zero divisor 
Fixes: Out of array read
Fixes: global-buffer-overflow-AV1

Found-by: "Leonelli, Matteo" <matteo.leonelli@cispa.de>
Tested-by: "Wang, Fei W" <fei.w.wang@intel.com>
Reviewed-by: "Wang, Fei W" <fei.w.wang@intel.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 22daf2148f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 13:18:58 +01:00
Michael Niedermayer f946c6c2f0 avformat/mov: Ignore duplicate ftyp 
Fixes: switch_1080p_720p.mp4
Found-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4cdf2c7f76)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-12-29 13:18:57 +01:00
Michael Niedermayer 61df86efdd RELEASE_NOTES: Based on the version from 5.1 
Name taken to match the suggested news posted by lynne

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-10 23:32:04 +01:00
Michael Niedermayer b8eefd0061 Update for 6.1 2023-11-10 02:18:55 +01:00
Michael Niedermayer e1bbae68fc doc/APIchanges: Fill in missing values 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-10 02:06:21 +01:00
Michael Niedermayer 56b50b945b avcodec/evc_parse: Check num_remaining_tiles_in_slice_minus1 
Fixes: out of array access
Fixes: 62467/clusterfuzz-testcase-minimized-ffmpeg_BSF_EVC_FRAME_MERGE_fuzzer-6092990982258688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: "Dawid Kozinski/Multimedia (PLT) /SRPOL/Staff Engineer/Samsung Electronics" <d.kozinski@samsung.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ac4e3e188a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-10 02:06:21 +01:00
Michael Niedermayer d57ea70234 avcodec/4xm: Check for cfrm exhaustion 
Fixes: index -1 out of bounds for type 'CFrameBuffer [100]'
Fixes: 63877/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5854263397711872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bb0a684d93)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-10 02:06:21 +01:00
Michael Niedermayer 422ce1f21a avformat/mov: Disallow FTYP after streams 
Fixes: Assertion !c->fc->nb_streams failed at libavformat/mov.c:7799
Fixes: 63875/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5479178702815232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 19fcf43131)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-10 02:06:20 +01:00
Michael Niedermayer 9ee0cd2190 avformat/lafdec: Check for 0 parameters 
Fixes: Timeout
Fixes: 63661/clusterfuzz-testcase-minimized-ffmpeg_dem_LAF_fuzzer-6615365234589696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Sean McGovern <gseanmcg@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4fb9d94688)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-10 02:06:19 +01:00
Michael Niedermayer 962d667964 avcodec/flicvideo: consider width in copy loops 
Fixes: out of array write
Fixes: 63520/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-4876198087622656
Regression since: c7f8d42c12 (was not posted to ffmpeg-devel)

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Sean McGovern <gseanmcg@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 03a4aa9699)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-10 02:06:19 +01:00
Michael Niedermayer 2929465718 avfilter/buffersink: fix order of operation with = and <0 
Reviewed-by: Sean McGovern <gseanmcg@gmail.com>
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c0a18e884c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-10 02:06:19 +01:00
Michael Niedermayer d660dd1e0a avfilter/framesync: fix order of operation with = and <0 
Reviewed-by: Sean McGovern <gseanmcg@gmail.com>
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9450a4a7fe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-10 02:06:18 +01:00
Michael Niedermayer a1d9e28272 avcodec/vlc: Pass VLC_MULTI_ELEM directly not by pointer 
This makes the code more testable as uninitialized fields are 0
and not random values from the last call

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a5259f326b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-10 02:06:18 +01:00
Michael Niedermayer 597d574480 avcodec/vlc: Replace mysterious max computation code in multi vlc 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8516609edd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-10 02:06:18 +01:00
Michael Niedermayer e8541ed9f1 avcodec/vlc: Skip subtable entries in multi VLC 
These entries do not correspond to VLC symbols that can be used
they do corrupt various variables like min/max bits

This also no longer assumes that there is a single non subtable
entry
Probably fixes some infinite loops too

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 356b1ba765)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-10 02:06:17 +01:00
Michael Niedermayer 4f863e52dd tools/target_dec_fuzzer: Adjust threshold for CSCD 
Fixes: Timeout
Fixes: 63362/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CSCD_fuzzer-4694620065628160

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c2f2bf82c1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-10 02:06:17 +01:00
Michael Niedermayer 8904bc8e76 avcodec/dovi_rpu: Use 64 bit in get_us/se_coeff() 
Fixes: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 63151/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5067531154751488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2817efbba3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-10 02:06:17 +01:00
Michael Niedermayer c9a9dbfebf avcodec/apedec: Fix integer overflow in predictor_decode_stereo_3950() 
Fixes: signed integer overflow: 1900031961 + 553590817 cannot be represented in type 'int'
Fixes: 63061/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5166188298371072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2def617787)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-10 02:06:16 +01:00
Michael Niedermayer cebc2b3880 avformat/mov: Check that is_still_picture_avif has no trak based streams 
Fixes: Assertion failure in mov_read_iloc( in mov_read_iloc())
Fixes: 62866/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5282997370486784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 98c2711b58)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-10 02:06:16 +01:00
Michael Niedermayer 3d1ca4c3ff avcodec/evc_parse: Check tid 
The check is based on not infinite looping. It is likely
a more strict check can be done

Fixes: Infinite loop
Fixes: 62473/clusterfuzz-testcase-minimized-ffmpeg_BSF_EVC_FRAME_MERGE_fuzzer-5719883750703104
Fixes: 62765/clusterfuzz-testcase-minimized-ffmpeg_dem_EVC_fuzzer-6448531252314112
Fixes: 63378/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGPS_fuzzer-6504993844494336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: "Dawid Kozinski/Multimedia (PLT) /SRPOL/Staff Engineer/Samsung Electronics" <d.kozinski@samsung.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 68cc1744db)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-10 02:06:16 +01:00
Michael Niedermayer 38dc8767df avcodec/evc_parse: remove pow() and log2() 
The use of float based functions is both unneeded and wrong due to unpredictable rounding

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d35eecd24f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-11-10 02:06:15 +01:00
Michael Niedermayer 4d476677b0 doc/APIchanges: Add 6.1 cut point 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-29 16:19:42 +01:00
Michael Niedermayer efac4e2c44 Bump versions prior to 6.1 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-29 16:19:39 +01:00
Michael Niedermayer e4d5ac8d7d avformat/rtsp: Use rtsp_st->stream_index 
Fixes: out of array access
Fixes: rtpdec_h264.c149/poc

Found-by: Hardik Shah of Vehere
Reviewed-by: Martin Storsjö <martin@martin.st>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-27 18:10:47 +02:00
Michael Niedermayer 907743239d avutil/tx_template: fix integer ovberflwo in fft3() 
Fixes: signed integer overflow: -1028966111 + -1314089526 cannot be represented in type 'int'
Fixes: 63174/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5853273711837184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-27 18:10:47 +02:00
Michael Niedermayer 88453250db avcodec/jpeg2000dec: Check image offset 
Fixes: left shift of negative value -538967841
Fixes: 62447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-6427134337613824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-27 18:10:47 +02:00
Michael Niedermayer 9690d71f11 avcodec/vlc: dont pass nb_elems into multi vlc code 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-27 18:10:46 +02:00
Michael Niedermayer 9b546a0717 avcodec/vlc: merge lost 16bit end of array check 
Also cleanup related code

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-27 18:10:46 +02:00
Michael Niedermayer a23d527ec5 avcodec/magicyuv: remove redundant check in inner loop 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-27 18:10:46 +02:00
Michael Niedermayer 4ddf4f5001 avcodec/magicyuv: correct end of array check in multi VLC parsing 
Fixes: out of array write
Fixes: 63390/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_fuzzer-5144552979431424.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-27 18:10:45 +02:00
Michael Niedermayer ffac64a270 avcodec/bitstream_template: Basic documentation for read_vlc_multi() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-27 18:10:28 +02:00
Michael Niedermayer 5feceed008 avcodec/hevc_ps: Check cpb_cnt_minus1 before storing it 
Fixes: index 32 out of bounds for type 'uint32_t [32]'
Fixes: 63003/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4685160840560640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-10-19 20:46:55 +02:00