virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-06-19 19:03:00 +02:00
Code Issues Releases Activity
87,675 Commits 39 Branches 425 Tags
c37138e01a93da2f9dd2cc5d4b77e5a38581d130
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer c37138e01a avcodec/proresdec2: SKIP_BITS() does not work with len=32 
Fixes: invalid shift
Fixes: 3482/clusterfuzz-testcase-minimized-5446915875405824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-03 20:34:35 +02:00
Michael Niedermayer fbdab6eca7 avcodec/hevcdsp_template: Fix undefined shift 
Fixes: runtime error: left shift of negative value -255
Fixes: 3373/clusterfuzz-testcase-minimized-5604083912146944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-03 20:34:35 +02:00
Michael Niedermayer ef973bd98d avformat/mxfenc: Fix labels for IEC PAL DV 420 2017-10-03 18:34:37 +02:00
Michael Niedermayer a56ec48d42 avformat/mxfenc: Add IEC DV25 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-03 18:34:37 +02:00
Michael Niedermayer d679f3d021 avfilter/vf_thumbnail_cuda: Avoid mixing declaration and statements 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-01 02:36:00 +02:00
Michael Niedermayer b81b8a76b5 avcodec/v4l2_context: Reduce spelling variations 
Reviewed-by: Lou Logan <lou@lrcd.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-01 02:37:57 +02:00
Michael Niedermayer 4bb8013335 avcodec/v4l2_buffers: More clear return code documentation 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-10-01 02:35:15 +02:00
Michael Niedermayer 64e034da95 avcodec/jpeg2000: Check that codsty->log2_prec_widths/heights has been initialized 
Fixes: OOM
Fixes: 2225/clusterfuzz-testcase-minimized-5505632079708160

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-30 23:35:45 +02:00
Michael Niedermayer 5d31f03a02 avcodec/takdec: Fix integer overflow in decode_lpc() 
Fixes: runtime error: signed integer overflow: 16748560 + 2143729712 cannot be represented in type 'int'
Fixes: 3202/clusterfuzz-testcase-minimized-4988291642294272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-24 21:54:13 +02:00
Michael Niedermayer 4f5eaf0b59 avcodec/proresdec2: Check bits in DECODE_CODEWORD(), fixes invalid shift 
Fixes: runtime error: shift exponent 42 is too large for 32-bit type 'unsigned int'
Fixes: 3410/clusterfuzz-testcase-minimized-5313377960198144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-24 21:54:13 +02:00
Michael Niedermayer 3dabb9c69d avcodec/takdec: Fix integer overflows in decode_subframe() 
Fixes: runtime error: signed integer overflow: -1562477869 + -691460395 cannot be represented in type 'int'
Fixes: 3196/clusterfuzz-testcase-minimized-4528307146063872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-24 21:54:13 +02:00
Michael Niedermayer d8ef5a47bb avcodec/flacenc: Replace "return -1" by named constant 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-24 02:33:48 +02:00
Michael Niedermayer 9cec174247 avcodec/snowenc: Replace "return -1" by named constants 
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-24 02:33:48 +02:00
Michael Niedermayer 67da2685e0 avcodec/dirac_dwt: Fix integer overflow in COMPOSE_FIDELITYi*() 
Fixes: runtime error: signed integer overflow: 161 * 13872281 cannot be represented in type 'int'

Fixes: 3295/clusterfuzz-testcase-minimized-4738998142500864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-22 12:19:07 +02:00
Michael Niedermayer d00fc952b6 avcodec/ffv1dec: Fix integer overflow in read_quant_table() 
Fixes: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 3361/clusterfuzz-testcase-minimized-5065842955911168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-22 12:19:07 +02:00
Michael Niedermayer 2c933c5168 avcodec/svq3: Fix overflow in svq3_add_idct_c() 
Fixes: runtime error: signed integer overflow: 2147392585 + 524288 cannot be represented in type 'int'
Fixes: 3348/clusterfuzz-testcase-minimized-4809500517203968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-22 12:19:07 +02:00
Michael Niedermayer 5480e82d77 avcodec/pngdec: Clean up on av_frame_ref() failure 
Fixes: memleak
Fixes: 3203/clusterfuzz-testcase-minimized-4514553595428864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-20 02:56:20 +02:00
Michael Niedermayer 08ec828de9 avcodec/vorbisenc: Fix mixed declaration and statements 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-16 19:55:03 +02:00
Michael Niedermayer d76838c1ad avcodec/fits: Fix include type 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-16 19:55:03 +02:00
Michael Niedermayer 0f5576a22b avutil/imgutils: Fix warning: missing braces around initializer 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-16 19:55:03 +02:00
Michael Niedermayer de03eb622d avformat/mxfenc: Correct the Sample rate for PCM outside D10 
Based on mail from IRT

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-12 19:24:25 +02:00
Michael Niedermayer 4c33ec004f avformat/mxfenc: Comment edit rate write code like the surrounding code 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-12 19:24:25 +02:00
Michael Niedermayer 4c88087f93 avformat/mxfenc: Replace more literal magic numbers by enum values. 
This also moves the enum table up as it is needed earlier

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-12 19:24:25 +02:00
Michael Niedermayer e952d4b7ac avcodec/hevc_ps: Fix limit of chroma_qp_offset_list_len_minus1 
A value of 5 is allowed

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-12 01:52:14 +02:00
Michael Niedermayer abf3f9fa23 avcodec/hevc_ps: Fix c?_qp_offset_list size 
Fixes: runtime error: index 5 out of bounds for type 'int8_t const[5]'
Fixes:3175/clusterfuzz-testcase-minimized-4736774054084608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-12 01:52:14 +02:00
Michael Niedermayer 380659604f avcodec/shorten: Move buffer allocation and offset init to end of read_header() 
They are time consuming operations, performing them after the other checks
improves the speed with damaged input dramatically.

Fixes: Timeout
Fixes: 2928/clusterfuzz-testcase-4992812120539136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-12 01:52:14 +02:00
Michael Niedermayer 2d025e7428 avcodec/jpeg2000dsp: Fix multiple integer overflows in ict_int() 
Fixes: runtime error: signed integer overflow: 22553 * -188962 cannot be represented in type 'int'
Fixes: 3042/clusterfuzz-testcase-minimized-5174210131394560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-11 12:28:23 +02:00
Michael Niedermayer f0efd795f4 avcodec/clearvideo: Only output a frame if one is coded in the packet 
Fixes: Timeout (183 ms instead of about 20 sec)
Fixes: 3147/clusterfuzz-testcase-4870592182353920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-11 12:23:59 +02:00
Michael Niedermayer c225da68cf avcodec/hevcdsp_template: Fix undefined shift in put_hevc_pel_bi_w_pixels 
Fixes: runtime error: left shift of negative value -95
Fixes: 3077/clusterfuzz-testcase-minimized-4684917524922368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-11 12:23:58 +02:00
Michael Niedermayer b5995856a4 avcodec/diracdec: Fix overflow in DC computation 
Fixes: runtime error: signed integer overflow: 11896 + 2147483646 cannot be represented in type 'int'
Fixes: 3053/clusterfuzz-testcase-minimized-6355082062856192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-11 12:23:53 +02:00
Michael Niedermayer 981f04b2ae avcodec/scpr: optimize shift loop. 
Speeds code up from 50sec to 15sec

Fixes Timeout
Fixes: 3242/clusterfuzz-testcase-5811951672229888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-10 19:08:23 +02:00
Michael Niedermayer d98d29a775 avcodec/dirac_vlc: limit res_bits in APPEND_RESIDUE() 
Fixes: runtime error: left shift of 1073741838 by 1 places cannot be represented in type 'int32_t' (aka 'int')
Fixes: 3279/clusterfuzz-testcase-minimized-4564805744590848

Suggested-by: <atomnuker>
Reviewed-by: <atomnuker>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-09 18:55:47 +02:00
Michael Niedermayer afc9c683ed avformat/asfdec: Fix DoS in asf_build_simple_index() 
Fixes: Missing EOF check in loop
No testcase

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-07 15:19:22 +02:00
Michael Niedermayer 9cb4eb7728 avformat/mov: Fix DoS in read_tfra() 
Fixes: Missing EOF check in loop
No testcase

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-07 15:19:22 +02:00
Michael Niedermayer 913feb6263 avformat/gdv: Make FixedSize static 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-07 15:19:22 +02:00
Michael Niedermayer d8bc198d09 avfilter/vf_overlay: Restore shorthand option order 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-05 23:55:19 +02:00
Michael Niedermayer c595139f1f avcodec/dirac_vlc: Fix invalid shift in ff_dirac_golomb_read_32bit() 
Fixes: runtime error: shift exponent 64 is too large for 64-bit type 'residual' (aka 'unsigned long')
Fixes: 2838/clusterfuzz-testcase-minimized-6260066086813696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-02 23:50:28 +02:00
Michael Niedermayer f71cd44147 avcodec/dirac_dwt: Fix multiple overflows in 9/7 lifting 
Fixes: runtime error: signed integer overflow: 1073901567 + 1073901567 cannot be represented in type 'int'
Fixes: 3124/clusterfuzz-testcase-minimized-454643435752652

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-02 23:50:28 +02:00
Michael Niedermayer 2a0823ae96 avcodec/diracdec: Fix integer overflow in INTRA_DC_PRED() 
Fixes: runtime error: signed integer overflow: 1168175789 + 1168178473 cannot be represented in type 'int'
Fixes: 3081/clusterfuzz-testcase-minimized-4807564879462400
Fixes: 2844/clusterfuzz-testcase-minimized-5561715838156800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-09-02 23:50:28 +02:00
Michael Niedermayer f762555a90 avformat/mxfenc: Replace literal numbers by named enum values. 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-30 02:15:36 +02:00
Michael Niedermayer 732f976456 avcodec/snowdec: Fix integer overflow in decode_subband_slice_buffered() 
Fixes: runtime error: signed integer overflow: 267 * 8388608 cannot be represented in type 'int'
Fixes: 2743/clusterfuzz-testcase-minimized-5820652076400640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-29 21:16:32 +02:00
Michael Niedermayer 2a83866c9f avcodec/hevc_ps: Fix undefined shift in pcm code 
Fixes: runtime error: shift exponent -1 is negative
Fixes: 3091/clusterfuzz-testcase-minimized-6229767969832960

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-29 21:16:32 +02:00
Michael Niedermayer 6def8b8d92 avcodec/h264idct_template: Fix integer overflow in ff_h264_idct8_add() 
Fixes: 2891/clusterfuzz-testcase-minimized-5881795457318912
Fixes: runtime error: signed integer overflow: 1551827968 - -775913984 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-29 21:16:32 +02:00
Michael Niedermayer 429f3266c1 avformat/mxfenc: Check that the video codec in D-10 is MPEG-2 
Others do not work, but nothing rejects them prior to this patch if the
parameters otherwise match

Reviewed-by: Matthieu Bouron <matthieu.bouron@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-29 21:16:32 +02:00
Michael Niedermayer aa26258faa avfilter/vf_zoompan: remove AVFILTER_FLAG_SUPPORT_TIMELINE_GENERIC 
Suggested-by: <durandal_1707>
Fixes: assertion failure

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-27 20:41:56 +02:00
Michael Niedermayer 0181b202cc avcodec/aacpsdsp_template: Fix undefined integer overflow in ps_add_squares_c() 
Fixes runtime error: signed integer overflow: 1997494407 + 613252359 cannot be represented in type 'int'
Fixes: 2014/clusterfuzz-testcase-minimized-5186337030275072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-27 19:40:28 +02:00
Michael Niedermayer eefb68c9c3 avcodec/sbrdsp_fixed: Fix undefined overflows in autocorrelate() 
Fixes: runtime error: signed integer overflow: 8903997421129740175 + 354481484684609529 cannot be represented in type 'long'
Fixes: 2045/clusterfuzz-testcase-minimized-6751255865065472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-27 19:40:23 +02:00
Michael Niedermayer 4f05e2e2dc avformat/mvdec: Fix DoS due to lack of eof check 
Fixes: loop.mv

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-27 19:23:37 +02:00
Michael Niedermayer 7ec414892d avformat/hls: Fix DoS due to infinite loop 
Fixes: loop.m3u

The default max iteration count of 1000 is arbitrary and ideas for a better solution are welcome

Found-by: Xiaohei and Wangchu from Alibaba Security Team

Previous version reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-27 19:19:00 +02:00
Michael Niedermayer 7c10068da1 avcodec/dvbsubdec: Check for duplicate regions in dvbsub_parse_page_segment() 
Fixes: OOM
Fixes: 3051/clusterfuzz-testcase-minimized-5745818336231424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-25 23:38:24 +02:00
Michael Niedermayer 351e28f9a7 ffprobe: Fix NULL pointer handling in color parameter printing 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-24 11:41:00 +02:00
Michael Niedermayer 837cb4325b ffprobe: Fix null pointer dereference with color primaries 
Found-by: AD-lab of venustech
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-24 11:31:03 +02:00
Michael Niedermayer 2b44dcbc44 avcodec/hevc_ps: Check delta_pocs in ff_hevc_decode_short_term_rps() 
Fixes: integer overflow
Fixes: 2893/clusterfuzz-testcase-minimized-5809330567774208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-24 11:29:40 +02:00
Michael Niedermayer c42a1388a6 avformat/rtpdec_h264: Fix heap-buffer-overflow 
Fixes: rtp_sdp/poc.sdp

Found-by: Bingchang <l.bing.chang.bc@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-23 22:19:33 +02:00
Michael Niedermayer 6f03ffb47d avcodec/aacdec_template: Fix running cleanup in decode_ics_info() 
Fixes: out of array read
Fixes: 2873/clusterfuzz-testcase-minimized-5924145713905664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Previous version reviewed-by: Alex Converse <alex.converse@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-22 20:01:31 +02:00
Michael Niedermayer a2e444d5bb avcodec/pngdec: Fix () placement 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-22 18:55:11 +02:00
Michael Niedermayer bc488ec28a avcodec/me_cmp: Fix crashes on ARM due to misalignment 
Adds a diff_pixels_unaligned()

Fixes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872503

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-21 23:19:18 +02:00
Michael Niedermayer 8754ccd3b3 avcodec/pixlet: Fixes: undefined shift in av_mod_uintp2() 
Fixes: runtime error: shift exponent 4294967289 is too large for 32-bit type 'int'
Fixes: 3030/clusterfuzz-testcase-minimized-4649809254285312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-20 21:14:47 +02:00
Michael Niedermayer a165b53daa avcodec/dirac_dwt_template: Fix integer overflow in vertical_compose53iL0() 
Fixes: runtime error: signed integer overflow: 2147483646 + 2 cannot be represented in type 'int'
Fixes: 3013/clusterfuzz-testcase-minimized-4644084197097472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-20 21:14:47 +02:00
Michael Niedermayer e7b9d136a1 avcodec/cngdec: Check skip_samples 
Without this its possible to make the new decode API decode billions of samples
out of a empty input and never return to the caller before all samples have been
created and discarded.

Fixes: Timeout
Fixes: 2992/clusterfuzz-testcase-6649611793989632

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-20 02:59:57 +02:00
Michael Niedermayer 0c9d5b015c avcodec/fic: Fixes signed integer overflow 
Fixes: runtime error: signed integer overflow: 1037142357 + 1227025305 cannot be represented in type 'int'
Fixes: 3024/clusterfuzz-testcase-minimized-5885660323905536

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-20 02:59:57 +02:00
Michael Niedermayer d132683ddd avcodec/snowdec: Fix off by 1 error 
Fixes: runtime error: index 4 out of bounds for type 'int8_t [4]'
Fixes: 3023/clusterfuzz-testcase-minimized-6421736130084864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-20 02:59:57 +02:00
Michael Niedermayer cadab5a2a7 avcodec/pixlet: fixes integer overflow in read_highpass() 
Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: 2879/clusterfuzz-testcase-minimized-6317542639403008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-18 11:34:01 +02:00
Michael Niedermayer b9f92093a1 avcodec/ffv1dec: Check for bitstream end in decode_line() 
Fixes: timeout
Fixes: 2971/clusterfuzz-testcase-6130678276030464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-18 11:33:16 +02:00
Michael Niedermayer c359c51947 avcodec/rangecoder: Do not increase the pointer beyond the buffer 
Fixes: undefined behavior

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-18 11:33:14 +02:00
Michael Niedermayer 931c0ac95c avcodec/zmbv: Check decomp_size 
Fixes: OOM
Fixes: 2710/clusterfuzz-testcase-minimized-4750001420894208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-17 16:30:06 +02:00
Michael Niedermayer 92da23093c avcodec/diracdec: Fixes integer overflow 
Fixes: runtime error: signed integer overflow: 340018243 * 27 cannot be represented in type 'int'
Fixes: 2861/clusterfuzz-testcase-minimized-5361070510178304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-17 00:23:01 +02:00
Michael Niedermayer 1e6cab8745 avcodec/diracdec: Check perspective_exp and zrs_exp. 
Fixes: undefined shift
Fixes: runtime error: shift exponent 264 is too large for 32-bit type 'int'
Fixes: 2860/clusterfuzz-testcase-minimized-4672811689836544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-17 00:23:01 +02:00
Michael Niedermayer 0ac8fce267 swresample/resample: Fix flush refelction length 
Reviewed-by: atomnuker
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-16 00:54:17 +02:00
Michael Niedermayer b9ce43625c avcodec/cavsdec: Check P/B frame mb decode which return error codes 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-15 01:27:36 +02:00
Michael Niedermayer 426a322aa2 avcodec/cavsdec: Check I frame mb decode for errors 
Fixes: timeout
Fixes: 2943/clusterfuzz-testcase-5430257156882432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-15 01:27:36 +02:00
Michael Niedermayer 5859b5b439 avcodec/lagarith: Detect end of input in lag_decode_line() loop 
Fixes: timeout
Fixes: 2933/clusterfuzz-testcase-5124990208835584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-11 22:02:38 +02:00
Michael Niedermayer 0561bd2fc2 avcodec/gdv: Check available space before reading palette 
Fixes: Timeout
Fixes: 2926/clusterfuzz-testcase-498711001458278

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-11 19:27:52 +02:00
Michael Niedermayer 62702eebde avcodec/ffv1dec_template: Fix undefined shift 
Fixes: runtime error: left shift of negative value -127
Fixes: 2834/clusterfuzz-testcase-minimized-5988039123795968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-11 18:21:06 +02:00
Michael Niedermayer 7735ed2974 avcodec/mpeg4videodec: Clear mcsel before decoding an image 
Fixes: runtime error: signed integer overflow: 2146467840 + 1032192 cannot be represented in type 'int'
Fixes: 2826/clusterfuzz-testcase-minimized-5901511613743104

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-11 12:07:16 +02:00
Michael Niedermayer 511e10f673 avformat/avidec: Move packet skip after prefix and related checks 
This fixes loosing packets
Fixes: big.avi

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-11 12:07:08 +02:00
Michael Niedermayer 84786e928f avcodec/tests/dct: Add Mean square error test 
based on quotes of IEEE 1180 / ISO/IEC 23002-1

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-11 12:06:41 +02:00
Michael Niedermayer 86cbffdc4d avcodec/tests/dct: Add peak mean error check 
based on quotes of IEEE 1180 / ISO/IEC 23002-1

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-11 12:06:40 +02:00
Michael Niedermayer abaeeb3ce0 avcodec/dvenc: Change quantizer dead zone default to 7 
This improves the quality and reduces the "blocking" in flat areas

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-08 19:39:21 +02:00
Michael Niedermayer fea7bc9e7b avcodec/dvenc: Support adjusting the quantizer deadzone 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-08 19:39:10 +02:00
Michael Niedermayer a5380f9c1c avcodec/dirac_dwt: Fixes integer overflows in COMPOSE_DAUB97* 
Fix multiple: runtime error: signed integer overflow: 6497 * 3409630 cannot be represented in type 'int'
Fixes: 2819/clusterfuzz-testcase-minimized-4743700301217792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-08 19:25:17 +02:00
Michael Niedermayer 1e443051b2 avcodec/aacdec_fixed: fix invalid shift in predict() 
Fixes: runtime error: shift exponent -2 is negative
Fixes: 2818/clusterfuzz-testcase-minimized-5062943676825600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-05 23:56:55 +02:00
Michael Niedermayer 1f53bde6d8 avcodec/h264_slice: Fix overflow in slice offset 
Fixes: runtime error: signed integer overflow: 1610612736 * 2 cannot be represented in type 'int'
Fixes: 2817/clusterfuzz-testcase-minimized-5289691240726528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-05 23:56:52 +02:00
Michael Niedermayer 4ff94558f2 avcodec/hevc_cabac: Check for ff_init_cabac_decoder() failure in cabac_reinit() 
Fixes: runtime error: left shift of negative value -967831544
Fixes: 2815/clusterfuzz-testcase-minimized-6062914471460864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-03 15:42:52 +02:00
Michael Niedermayer d1bfa80ec4 avcodec/h264idct_template: Fix integer overflow in ff_h264_idct_add() 
Fixes: runtime error: signed integer overflow: 26215360 + 2121330944 cannot be represented in type 'int'
Fixes: 2809/clusterfuzz-testcase-minimized-4785181833560064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
 2017-08-03 15:31:15 +02:00
Michael Niedermayer b2d9d72269 avcodec/diracdsp: fix integer overflow 
Fixes: runtime error: signed integer overflow: 11 * 225726413 cannot be represented in type 'int'
Fixes: 2764/clusterfuzz-testcase-minimized-5382561922547712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-01 13:54:43 +02:00
Michael Niedermayer 880f5c5913 avcodec/diracdec: Check weight_log2denom 
Fixes: runtime error: shift exponent -1 is negative
Fixes: 2742/clusterfuzz-testcase-minimized-5724322402402304
Fixes: 2744/clusterfuzz-testcase-minimized-4672435653705728
Fixes: 2749/clusterfuzz-testcase-minimized-5298741273690112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-01 13:54:43 +02:00
Michael Niedermayer 46e4075549 avcodec/dirac_vlc: Fix invalid shift 
Fixes: runtime error: shift exponent 65 is too large for 64-bit type 'residual' (aka 'unsigned long')
Fixes: 2737/clusterfuzz-testcase-minimized-4968639147016192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-08-01 13:54:43 +02:00
Michael Niedermayer bf8ab72ae9 avcodec/dirac_dwt: Fix multiple integer overflows in COMPOSE_DD97iH0() 
Fixes: runtime error: signed integer overflow: 9 * 335544320 cannot be represented in type 'int'
Fixes: 2739/clusterfuzz-testcase-minimized-6737297955356672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-29 16:28:22 +02:00
Michael Niedermayer c0220c768c avcodec/diracdec: Fix integer overflow in divide3() 
Fixes: runtime error: signed integer overflow: -1073746548 * 21845 cannot be represented in type 'int'
Fixes: 2729/clusterfuzz-testcase-minimized-5902915464069120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-29 04:05:53 +02:00
Michael Niedermayer 2c630d159f avcodec/takdec: Fix integer overflow in decode_subframe() 
Fixes: runtime error: signed integer overflow: -536870912 - 1972191120 cannot be represented in type 'int'
Fixes: 2711/clusterfuzz-testcase-minimized-4975142398590976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-29 04:05:53 +02:00
Michael Niedermayer ffcc82219c avformat/rtmppkt: Convert ff_amf_get_field_value() to bytestream2 
Fixes: out of array accesses

Found-by: JunDong Xie of Ant-financial Light-Year Security Lab
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-29 04:05:53 +02:00
Michael Niedermayer 08c073434e avformat/rtmppkt: Convert ff_amf_tag_size() to bytestream2 
Fixes: out of array accesses
Fixes: crash-9238fa9e8d4fde3beda1f279626f53812cb001cb-SEGV

Found-by: JunDong Xie of Ant-financial Light-Year Security Lab
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-29 03:54:39 +02:00
Michael Niedermayer 8e275a74b0 avcodec/diracdec: Fix integer overflow in signed multiplication in UNPACK_ARITH() 
Fixes: runtime error: signed integer overflow: 1073741823 * 4 cannot be represented in type 'int'
Fixes: 2729/clusterfuzz-testcase-minimized-5902915464069120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-28 03:35:22 +02:00
Michael Niedermayer aeddb3607b avcodec/pixlet: Simplify nbits computation 
Fixes multiple integer overflows
Fixes: runtime error: signed integer overflow: 1 + 2147483647 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-28 03:35:22 +02:00
Michael Niedermayer 296debd213 avcodec/dnxhddec: Move mb height check out of non hr branch 
Fixes: out of array access
Fixes: poc.dnxhd

Found-by: Bingchang, Liu@VARAS of IIE
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-27 03:07:12 +02:00
Michael Niedermayer 5d0b69f3b7 avcodec/jpeg2000dec: Fix h/vden typo 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-27 00:01:27 +02:00
Michael Niedermayer 1b00600319 avcodec/jpeg2000dec: Fix division by zero in jp2_find_codestream() 
Fixes: 2707/clusterfuzz-testcase-minimized-5179636394754048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-26 17:06:29 +02:00
Michael Niedermayer 74c1c22d7f avcodec/hevc_ps: fix integer overflow in log2_parallel_merge_level_minus2 
Fixes: runtime error: signed integer overflow: -2147483647 - 2 cannot be represented in type 'int'
Fixes: 2702/clusterfuzz-testcase-minimized-4511932591636480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-26 17:06:29 +02:00
Michael Niedermayer 7140761481 avformat/oggparsecelt: Do not re-allocate os->private 
Fixes: double free
Fixes: clusterfuzz-testcase-minimized-5080550145785856

Found-by: ClusterFuzz
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2017-07-25 22:04:34 +02:00