virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-06-19 19:03:00 +02:00
Code Issues Releases Activity
86,912 Commits 39 Branches 425 Tags
b664d1f3ffbce07c206d679cc09a1fd29955de44
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer bf8ab72ae9 avcodec/dirac_dwt: Fix multiple integer overflows in COMPOSE_DD97iH0() 
Fixes: runtime error: signed integer overflow: 9 * 335544320 cannot be represented in type 'int'
Fixes: 2739/clusterfuzz-testcase-minimized-6737297955356672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-29 16:28:22 +02:00
Michael Niedermayer c0220c768c avcodec/diracdec: Fix integer overflow in divide3() 
Fixes: runtime error: signed integer overflow: -1073746548 * 21845 cannot be represented in type 'int'
Fixes: 2729/clusterfuzz-testcase-minimized-5902915464069120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-29 04:05:53 +02:00
Michael Niedermayer 2c630d159f avcodec/takdec: Fix integer overflow in decode_subframe() 
Fixes: runtime error: signed integer overflow: -536870912 - 1972191120 cannot be represented in type 'int'
Fixes: 2711/clusterfuzz-testcase-minimized-4975142398590976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-29 04:05:53 +02:00
Michael Niedermayer ffcc82219c avformat/rtmppkt: Convert ff_amf_get_field_value() to bytestream2 
Fixes: out of array accesses

Found-by: JunDong Xie of Ant-financial Light-Year Security Lab
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-29 04:05:53 +02:00
Michael Niedermayer 08c073434e avformat/rtmppkt: Convert ff_amf_tag_size() to bytestream2 
Fixes: out of array accesses
Fixes: crash-9238fa9e8d4fde3beda1f279626f53812cb001cb-SEGV

Found-by: JunDong Xie of Ant-financial Light-Year Security Lab
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-29 03:54:39 +02:00
Michael Niedermayer 8e275a74b0 avcodec/diracdec: Fix integer overflow in signed multiplication in UNPACK_ARITH() 
Fixes: runtime error: signed integer overflow: 1073741823 * 4 cannot be represented in type 'int'
Fixes: 2729/clusterfuzz-testcase-minimized-5902915464069120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-28 03:35:22 +02:00
Michael Niedermayer aeddb3607b avcodec/pixlet: Simplify nbits computation 
Fixes multiple integer overflows
Fixes: runtime error: signed integer overflow: 1 + 2147483647 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-28 03:35:22 +02:00
Michael Niedermayer 296debd213 avcodec/dnxhddec: Move mb height check out of non hr branch 
Fixes: out of array access
Fixes: poc.dnxhd

Found-by: Bingchang, Liu@VARAS of IIE
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-27 03:07:12 +02:00
Michael Niedermayer 5d0b69f3b7 avcodec/jpeg2000dec: Fix h/vden typo 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-27 00:01:27 +02:00
Michael Niedermayer 1b00600319 avcodec/jpeg2000dec: Fix division by zero in jp2_find_codestream() 
Fixes: 2707/clusterfuzz-testcase-minimized-5179636394754048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-26 17:06:29 +02:00
Michael Niedermayer 74c1c22d7f avcodec/hevc_ps: fix integer overflow in log2_parallel_merge_level_minus2 
Fixes: runtime error: signed integer overflow: -2147483647 - 2 cannot be represented in type 'int'
Fixes: 2702/clusterfuzz-testcase-minimized-4511932591636480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-26 17:06:29 +02:00
Michael Niedermayer 7140761481 avformat/oggparsecelt: Do not re-allocate os->private 
Fixes: double free
Fixes: clusterfuzz-testcase-minimized-5080550145785856

Found-by: ClusterFuzz
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-25 22:04:34 +02:00
Michael Niedermayer 03a9e6ff30 avcodec/ylc: Fix shift overflow 
Fixes: runtime error: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 2698/clusterfuzz-testcase-minimized-4713541443518464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-24 17:52:42 +02:00
Michael Niedermayer 0764fe1d09 avcodec/aacps: Fix multiple integer overflow in map_val_34_to_20() 
Fixes: avcodec/aacps.c:511:40: runtime error: signed integer overflow: 1509077651 + 758068176 cannot be represented in type 'int'
Fixes: 2678/clusterfuzz-testcase-minimized-4702787684270080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-24 17:52:42 +02:00
Michael Niedermayer aff93e1929 avcodec/mpegvideo_enc: Use intra/inter scantable matching mb type in quantization 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-24 02:42:33 +02:00
Michael Niedermayer 2dfb8c4178 avcodec/aacdec_fixed: fix: left shift of negative value -1 
Fixes: 2699/clusterfuzz-testcase-minimized-5631303862976512

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-24 02:42:33 +02:00
Michael Niedermayer 69e7daf6ce avcodec/dirac_vlc: Fix undefined shift 
Fixes: runtime error: shift exponent 64 is too large for 64-bit type 'residual' (aka 'unsigned long')
Fixes: 2674/clusterfuzz-testcase-minimized-4999700518273024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-24 02:42:33 +02:00
Michael Niedermayer edc88646ee avcodec/diracdec: Check dimensions which are closer to what is allocated in alloc_sequence_buffers() 
Fixes OOM
Fixes: 2674/clusterfuzz-testcase-minimized-4999700518273024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-21 17:37:05 +02:00
Michael Niedermayer 1196e53b70 doc: Add initial documentation explaining undefined behavior and SUINT 
Requested-by: Kieran Kunhya <kierank@obe.tv>

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-21 17:37:05 +02:00
Michael Niedermayer c61715e2c5 avcodec/htmlsubtitles: Be a bit more picky on syntax 
This reduces the number of strstr() calls per byte
This diasalows empty tags like '< >' as well as '<' in tags like '<ab<cd<<ef>'

Fixes timeout
Fixes: 1817/clusterfuzz-testcase-minimized-5104230530547712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-18 22:14:16 +02:00
Michael Niedermayer 2886142e0c avcodec/aacdec_template (fixed point): Check gain in decode_cce() to avoid undefined shifts later 
Fixes: runtime error: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 2581/clusterfuzz-testcase-minimized-4681474395602944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-18 22:14:16 +02:00
Michael Niedermayer ba4beaf614 avcodec/apedec: Fix integer overflow 
Fixes: out of array access
Fixes: PoC.ape and others

Found-by: Bingchang, Liu@VARAS of IIE
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-16 16:53:02 +02:00
Michael Niedermayer 4de4308d2a avcodec/ffv1dec_template: Fix signed integer overflow 
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 2634/clusterfuzz-testcase-minimized-4540890636877824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-16 02:09:43 +02:00
Michael Niedermayer 0ef8f03133 avcodec/aacdec_template: Fix undefined integer overflow in apply_tns() 
Fixes: runtime error: signed integer overflow: -2147483648 - 1202286525 cannot be represented in type 'int'
Fixes: 2071/clusterfuzz-testcase-minimized-6036414271586304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-16 01:07:27 +02:00
Michael Niedermayer d0ba0be355 fate: add sub-srt-badsyntax test 
Based-on: srt sample by ubitux

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-15 04:16:44 +02:00
Michael Niedermayer a824685140 avcodec/ivi: Use av_image_check_size2() 
Fixes OOM
Fixes: 1514/clusterfuzz-testcase-minimized-6437666243477504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-12 20:36:13 +02:00
Michael Niedermayer 341f01290c avcodec/magicyuv: Check that vlc len is not too large 
Fixes: runtime error: shift exponent -95 is negative
Fixes: 2568/clusterfuzz-testcase-minimized-4926115716005888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-12 17:26:18 +02:00
Michael Niedermayer c28f648b19 avcodec/mjpegdec: Clip DC also on the negative side. 
Fixes: runtime error: signed integer overflow: -16711425 + -2130772346 cannot be represented in type 'int'
Fixes: 2533/clusterfuzz-testcase-minimized-5372857678823424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-12 16:32:27 +02:00
Michael Niedermayer 80b9e40b6f avcodec/aacps (fixed point): Fix multiple signed integer overflows 
Fixes: runtime error: signed integer overflow: 1421978265 - -1810326882 cannot be represented in type 'int'
Fixes: 2527/clusterfuzz-testcase-minimized-5260915396050944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-12 04:20:21 +02:00
Michael Niedermayer fe9242204d avcodec/ylc: Fix vlc of 31 bits 
Fixes: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 2515/clusterfuzz-testcase-minimized-6197200012967936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-08 23:45:47 +02:00
Michael Niedermayer 2061de8a3f avcodec/sbrdsp_fixed: Fix integer overflow in sbr_hf_apply_noise() 
Fixes: runtime error: signed integer overflow: -2049425300 + -117591631 cannot be represented in type 'int'
Fixes: part of 2096/clusterfuzz-testcase-minimized-4901566068817920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-08 23:45:41 +02:00
Michael Niedermayer f1baafac71 avcodec/interplayvideo: Clean up frames on parameter change 
Fixes: out of array access
Fixes: 2467/clusterfuzz-testcase-minimized-4755798049685504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-06 03:59:09 +02:00
Michael Niedermayer c8cfbc6629 avcodec/hevcdec: do not let updated extradata corrupt state 
Fixes: out of array access
Fixes: 2451/clusterfuzz-testcase-minimized-4781613957251072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Hendrik Leppkes <h.leppkes@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-05 04:37:57 +02:00
Michael Niedermayer c07af72098 avcodec/wavpack: Fix invalid shift 
Fixes: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 2377/clusterfuzz-testcase-minimized-6108505935183872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-05 03:19:27 +02:00
Michael Niedermayer 7592d97f10 avcodec/h264_slice: Fix signed integer overflow 
Fixes: runtime error: signed integer overflow: 26 + 2147483644 cannot be represented in type 'int'
Fixes: 2456/clusterfuzz-testcase-minimized-4822695051001856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-05 03:19:27 +02:00
Michael Niedermayer de54a37c1d avcodec/hevc_ps: Fix integer overflow with beta/tc offsets 
Fixes: runtime error: signed integer overflow: 2113929216 * 2 cannot be represented in type 'int'
Fixes: 2422/clusterfuzz-testcase-minimized-5242114713583616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-30 16:24:16 +02:00
Michael Niedermayer ecc16d893d avfilter/vf_geq: >8 bps support 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-30 12:34:34 +02:00
Michael Niedermayer 60a45713e7 avcodec/interplayvideo: Check ff_get_buffer() for failure 
Fixes: runtime error: division by zero
Fixes: 2408/clusterfuzz-testcase-minimized-5432734438653952
Fixes: 2415/clusterfuzz-testcase-minimized-4672827619803136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-30 03:34:58 +02:00
Michael Niedermayer 0b180d2066 fate: Add fate-copy-trac3074 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-30 03:03:08 +02:00
Michael Niedermayer c709f009da avcodec/cfhd: Fix invalid left shift of negative value 
Fixes: runtime error: left shift of negative value -1
Fixes: 2395/clusterfuzz-testcase-minimized-6540529313513472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-28 23:39:11 +02:00
Michael Niedermayer bc6ab72bc7 avcodec/vb: Check vertical GMC component before multiply 
Fixes: runtime error: signed integer overflow: 8224 * 663584 cannot be represented in type 'int'
Fixes: 2393/clusterfuzz-testcase-minimized-6128334993883136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-28 23:39:11 +02:00
Michael Niedermayer 850c6db97d avcodec/utvideodec: Factor multiply out of inner loop 
0.5% faster loop

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-28 14:08:21 +02:00
Michael Niedermayer 5eb4701b7d avcodec/utvideodec: bswap directly without memcpy 
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-28 14:08:21 +02:00
Michael Niedermayer 676a589c93 avcodec/utvideodec: enable unchecked bitreader 
inner reader loop becomes 16% faster

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-28 14:08:21 +02:00
Michael Niedermayer 9c604b34d4 avcodec/utvideodec: hardcode vlc bits 
2.5% faster vlc decoding

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-28 14:08:21 +02:00
Michael Niedermayer 1835c5e7a4 avcodec/utvideodec: Move bitstream end check out of inner loop 
This is not needed when the buffer is large enough for the worst case of a line

2% faster vlc reading

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-28 14:08:21 +02:00
Michael Niedermayer 516c213f08 avcodec/x86/vp9dsp_init_16bpp: Fix linking to missing ff_vp9_ipred_dr_32x32_16_avx2() on 32bit 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-28 00:31:33 +02:00
Michael Niedermayer c578c9c229 libswresample/swresample: remove obsolete code 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-27 23:21:53 +02:00
Michael Niedermayer 2c874548d6 avcodec/hevcdec: do basic validity check on delta_chroma_weight and offset 
Fixes: runtime error: signed integer overflow: 2147483520 + 128 cannot be represented in type 'int'
Fixes: 2385/clusterfuzz-testcase-minimized-6594333576790016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-27 23:21:12 +02:00
Michael Niedermayer 0f8d3d8a46 avcodec/ffv1enc: compute the max number of slices and limit by that 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-27 13:09:58 +02:00
Michael Niedermayer 430d4f2bb5 avcodec/ffv1enc: Allow less than 2 rows of slices for low vertical resolution 
Fixes: Ticket5548

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-27 12:54:06 +02:00
Michael Niedermayer 3c70251780 avcodec/jpeg2000dwt: Fix integer overflows in sr_1d97_int() 
Fixes: runtime error: signed integer overflow: 1157259380 + 1157259380 cannot be represented in type 'int'
Fixes: 2365/clusterfuzz-testcase-minimized-6020421927305216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-26 16:06:25 +02:00
Michael Niedermayer ea5366670e avcodec/jpeg2000dwt: Fix integer overflow in dwt_decode97_int() 
Fixes: runtime error: signed integer overflow: -163654656 * 256 cannot be represented in type 'int'
Fixes: 2367/clusterfuzz-testcase-minimized-4648678897745920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-26 16:06:25 +02:00
Michael Niedermayer 4147bb9053 avcodec/ffv1enc: Try to choose slice count so that slice packet sizes are within the supported size 
Fixes assertion failure

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-26 16:06:25 +02:00
Michael Niedermayer 449cdfa687 avcodec/ffv1: Increase the maximum number of slices to 1024 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-26 16:06:25 +02:00
Michael Niedermayer 7d317d4706 avcodec/frame_thread_encoder: Fix AV_OPT_TYPE_STRING handling in priv_data 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-26 01:06:04 +02:00
Michael Niedermayer 89f8bff798 avcodec/hevcdec: Do not check the first ff_init_cabac_decoder() call in hls_decode_entry_wpp() for failure 
The result of the call is not used in any testcase but breaks some cases if
its failure is considered.

Fixes regression found by jamrial

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-25 04:25:56 +02:00
Michael Niedermayer 73ea2a028e avcodec/wavpack: Fix integer overflow in wv_unpack_stereo() 
Fixes: runtime error: signed integer overflow: 2080374785 + 2080374784 cannot be represented in type 'int'
Fixes: 2351/clusterfuzz-testcase-minimized-5359403240783872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-25 01:13:17 +02:00
Michael Niedermayer 63e7bfe78e avcodec/hevc_ps: Fix max_dec_buffer check 
Fixes: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 2339/clusterfuzz-testcase-minimized-6663164320022528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-25 01:13:17 +02:00
Michael Niedermayer 2476067680 avcodec/hevcdec: Use error path if init_get_bits8() fails 
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-24 22:17:15 +02:00
Michael Niedermayer 933aa91e31 avcodec/hevcdec: check ff_init_cabac_decoder() for failure 
Fixes: runtime error: left shift of 1965559808 by 4 places cannot be represented in type 'int'
Fixes: 2333/clusterfuzz-testcase-minimized-5223935677300736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-24 22:17:15 +02:00
Michael Niedermayer 4976a3411f avcodec/mpeg4videodec: Fix GMC with videos of dimension 1 
Fixes: runtime error: shift exponent -1 is negative
Fixes: 2338/clusterfuzz-testcase-minimized-5153426541379584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-24 14:48:13 +02:00
Michael Niedermayer 24e95f9d4d avcodec/wavpack: Fix integer overflow 
Fixes: runtime error: signed integer overflow: 227511904 + 1964113935 cannot be represented in type 'int'
Fixes: 2331/clusterfuzz-testcase-minimized-6182185830711296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-23 03:03:04 +02:00
Michael Niedermayer 0c2ef4f6b4 avcodec/takdec: Fix integer overflow 
Fixes: runtime error: signed integer overflow: 512 + 2147483146 cannot be represented in type 'int'
Fixes: 2314/clusterfuzz-testcase-minimized-4519333877252096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-23 03:03:04 +02:00
Michael Niedermayer 27f80ab016 avcodec/tiff: Update pointer only when the result is used 
Fixes: runtime error: signed integer overflow: 538976288 * 32 cannot be represented in type 'int'
Fixes: 2310/clusterfuzz-testcase-minimized-4534784887881728

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-23 03:03:04 +02:00
Michael Niedermayer 6f1d2355a7 avcodec/cfhd: Check bpc before setting bpc in context 
Fixes: runtime error: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 2306/clusterfuzz-testcase-minimized-5002997392211968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-22 01:54:40 +02:00
Michael Niedermayer 5a950f4e32 avcodec/cfhd: Fix undefined shift 
Fixes: runtime error: left shift of negative value -1
Fixes: 2303/clusterfuzz-testcase-minimized-5529675273076736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-22 01:54:40 +02:00
Michael Niedermayer 70a7df049c avcodec/mpegvideo: Use intra_scantable in dct_unquantize_h263_intra_c() 
Reviewed-by: James Darnley <jdarnley@obe.tv>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-21 02:25:23 +02:00
Michael Niedermayer d7b3d5c3f2 avcodec/hevc_filter: Fix invalid shift 
Fixes: runtime error: left shift of negative value -1

Fixes: 2299/clusterfuzz-testcase-minimized-4843509351710720

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-21 02:25:23 +02:00
Michael Niedermayer fdfbcbdd14 avcodec/hevcdec: Check beta and tc offset in hls_slice_header() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-21 02:25:23 +02:00
Michael Niedermayer 5443c4bdf4 avcodec/mpeg4videodec: Fix overflow in virtual_ref computation 
Fixes: runtime error: signed integer overflow: 262144 * -16120 cannot be represented in type 'int'
Fixes: 2292/clusterfuzz-testcase-minimized-6156080415506432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-21 02:25:23 +02:00
Michael Niedermayer e95fcfe8fb avcodec/lpc: signed integer overflow in compute_lpc_coefs() (aacdec_fixed) 
Fixes: runtime error: signed integer overflow: -1575818955 + -915383657 cannot be represented in type 'int'
Fixes: 2224/clusterfuzz-testcase-minimized-6208559949807616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-21 02:25:23 +02:00
Michael Niedermayer ae6f6d4e34 avcodec/x86/mpegvideo: Use intra scantable in dct_unquantize_h263_intra_mmx() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-20 00:07:51 +02:00
Michael Niedermayer 5f89747086 avcodec/wavpack: Fix undefined integer negation 
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 2291/clusterfuzz-testcase-minimized-5538453481586688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-19 17:54:40 +02:00
Michael Niedermayer cf7edbd6c5 avcodec/aacdec_fixed: Check s for being too small 
Fixes: runtime error: shift exponent -8 is negative
Fixes: 2286/clusterfuzz-testcase-minimized-5711764169687040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-19 17:54:40 +02:00
Michael Niedermayer f670c13f13 avcodec: Rename ff_mpv_decode_mb() to ff_mpv_reconstruct_mb 
The new name more accuratly describes what the function does

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-19 17:54:40 +02:00
Michael Niedermayer 14b834c45a avcodec/htmlsubtitles: Factor open brace handling into its own function 
Suggested-by: wm4
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-18 14:50:35 +02:00
Michael Niedermayer 4132218b87 avcodec/htmlsubtitles: Replace very slow redundant sscanf() calls by cleaner and faster code 
This reduces the worst case from O(n²) to O(n) time

Fixes Timeout
Fixes: 2127/clusterfuzz-testcase-minimized-6595787859427328

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-18 14:50:30 +02:00
Michael Niedermayer 27c2006805 avcodec/takdec: Fixes: integer overflow in AV_SAMPLE_FMT_U8P output 
Fixes: runtime error: signed integer overflow: 2147483543 + 128 cannot be represented in type 'int'
Fixes: 2234/clusterfuzz-testcase-minimized-6266896041115648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-18 14:38:41 +02:00
Michael Niedermayer 9a6503f496 avcodec/iff: Cleanup on init failure 
Fixes: memleak
Fixes: 2272/clusterfuzz-testcase-minimized-5059103858622464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-18 14:05:57 +02:00
Michael Niedermayer c746f92a8e avcodec/jpeg2000dsp: Reorder operations in ict_int() to avoid 2 integer overflows 
Fixes: runtime error: signed integer overflow: 58065 * 51981 cannot be represented in type 'int'
Fixes: 2271/clusterfuzz-testcase-minimized-5778297776504832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-17 22:36:54 +02:00
Michael Niedermayer c94326c1fc avcodec/hevcpred_template: Fix left shift of negative value 
Fixes: runtime error: left shift of negative value -1
Fixes: 2250/clusterfuzz-testcase-minimized-5693382112313344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-17 22:36:54 +02:00
Michael Niedermayer 1edbf5e20c avcodec/hevcdec: Fix signed integer overflow in decode_lt_rps() 
Fixes: runtime error: signed integer overflow: 2147483647 + 6 cannot be represented in type 'int'
Fixes: 2263/clusterfuzz-testcase-minimized-4800359627227136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-17 00:34:48 +02:00
Michael Niedermayer 9b65dbf734 avcodec/gdv: Fix undefined shift 
Fixes: runtime error: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 2249/clusterfuzz-testcase-minimized-5388542379294720

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 23:32:28 +02:00
Michael Niedermayer dfb61ea263 avcodec/jpeg2000dec: Check nonzerobits more completely 
Fixes: runtime error: shift exponent 36 is too large for 32-bit type 'int'
Fixes: 2239/clusterfuzz-testcase-minimized-5639766592716800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 20:32:39 +02:00
Michael Niedermayer 16d6cc2168 avcodec/wavpack: Change wp_log2() to unsigned 
Fixes: runtime error: signed integer overflow: 2143315325 + 4186162 cannot be represented in type 'int'
Fixes: 2134/clusterfuzz-testcase-minimized-4619258405322752

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 20:32:39 +02:00
Michael Niedermayer e77ddd31a8 avcodec/shorten: Sanity check maxnlpc 
Fixes OOM
Fixes: 2131/clusterfuzz-testcase-minimized-4718045157130240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 20:32:39 +02:00
Michael Niedermayer c0607d88ee avcodec/parser: assert that there is a past buffer if theres a reference into the past 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 01:35:35 +02:00
Michael Niedermayer 3c716682a8 avcodec/truemotion2: Move skip computation after checks 
Fixes: runtime error: signed integer overflow: 630067357 * 4 cannot be represented in type 'int'
Fixes: 2233/clusterfuzz-testcase-minimized-5943031318446080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 00:21:30 +02:00
Michael Niedermayer e3fadc57c5 avcodec/jpeg2000: Fixes integer overflow in ff_jpeg2000_ceildivpow2() 
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 2231/clusterfuzz-testcase-minimized-4565181982048256

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 00:21:30 +02:00
Michael Niedermayer 611b356274 avcodec/dnxhd_parser: Do not return invalid value from dnxhd_find_frame_end() on error 
Fixes: Null pointer dereference

Fixes: CVE-2017-9608
Found-by: Yihan Lian
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-16 00:21:30 +02:00
Michael Niedermayer bc40674462 avcodec/hevcdec: Check nb_sps 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-15 03:09:40 +02:00
Michael Niedermayer 1cb4ef526d avcodec/hevc_refs: Check nb_refs in add_candidate_ref() 
Fixes: runtime error: index 16 out of bounds for type 'int [16]'
Fixes: 2209/clusterfuzz-testcase-minimized-5012343912136704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-15 03:09:40 +02:00
Michael Niedermayer 12245ab1f6 avcodec/mpeg4videodec: Check sprite delta upshift against overflowing. 
Fixes: runtime error: signed integer overflow: -268386304 * 16 cannot be represented in type 'int'
Fixes: 2204/clusterfuzz-testcase-minimized-5616756909408256

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-15 00:16:20 +02:00
Michael Niedermayer 0a87be404a avcodec/mpeg4videodec: Fix integer overflow in num_sprite_warping_points=2 case 
Fixes: runtime error: signed integer overflow: 131072 + 2147352576 cannot be represented in type 'int'
Fixes: 2192/clusterfuzz-testcase-minimized-5370387988742144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-15 00:16:20 +02:00
Michael Niedermayer 900fe8ee5d avcodec/dnxhdenc: Assert that frame size is not assigned an error code 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-15 00:16:20 +02:00
Michael Niedermayer 4cc2a357f5 avcodec/aacsbr_fixed: Fix signed integer overflow in sbr_hf_inverse_filter() 
Fixes: runtime error: signed integer overflow: 2147483584 + 128 cannot be represented in type 'int'
Fixes: 2164/clusterfuzz-testcase-minimized-4715936172998656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-13 17:39:13 +02:00
Michael Niedermayer d1992448d3 avcodec/aacsbr_fixed: Check shift in sbr_hf_assemble() 
Fixes: runtime error: shift exponent -10 is negative

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-13 17:39:13 +02:00
Michael Niedermayer d549f026d8 avcodec/sbrdsp_fixed: Return an error from sbr_hf_apply_noise() if operations are impossible 
Fixes: 1775/clusterfuzz-testcase-minimized-5330288148217856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-13 17:39:13 +02:00
Michael Niedermayer 4f9e958b04 avcodec/put_bits: Implement put_bits32() in a single pass instead of 2 passes writing 16bits each 
820 cpu cycles -> 660 cpu cycles for 100 put_bits32()

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-06-13 04:17:13 +02:00