virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-06-19 19:03:00 +02:00
Code Issues Releases Activity
112,787 Commits 39 Branches 425 Tags
c8907643fb3d665273d0ddf8cbaf1843bde5c3e4
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer c8907643fb avcodec/tiff: Assert init_get_bits8() success in horizontal_fill() 
Helps: CID1441167 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8814cedb07)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-07-24 16:52:09 +02:00
Michael Niedermayer 6b89f87fd9 tools/decode_simple: Check avcodec_send_packet() for errors on flushing 
This will not error but the API allows errors so we should check it
Fixes: CID1489999 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6df8bd64ff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-07-24 16:52:08 +02:00
Michael Niedermayer 188ffc18ef swscale/yuv2rgb: Use 64bit for brightness computation 
This will not overflow for normal values
Fixes: CID1500280 Unintentional integer overflow

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bfc22f364d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-07-24 16:52:08 +02:00
Michael Niedermayer cb2f3ec5cb swscale/x86/swscale: use a clearer name for INPUT_PLANER_RGB_A_FUNC_CASE 
related: CID1497114 Missing break in switch

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3f9daf1c18)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-07-24 16:52:08 +02:00
Michael Niedermayer f1de1a9d80 avutil/tests/opt: Check av_set_options_string() for failure 
This is test code after all so it should test things

Fixes: CID1518990 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e3481730ed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-07-24 16:52:07 +02:00
Michael Niedermayer 3edd95e79e avutil/tests/dict: Check av_dict_set() before get for failure 
Failure is possible due to strdup()

Fixes: CID1516764 Dereference null return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e8a1e1899d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-07-24 16:52:07 +02:00
Michael Niedermayer 1b67de255f avdevice/dshow: fix badly indented line 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c4004605b2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-07-24 16:52:07 +02:00
Michael Niedermayer 6feea4ada8 avformat/demux: resurrect dead stores 
Fixes: CID1473512 Unused value
Fixes: CID1529228 Unused value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 33da5f4e27)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-07-24 16:52:06 +02:00
Michael Niedermayer 66a140c0c0 avcodec/tests/bitstream_template: Assert bits_init8() return 
Helps: CID1518967 Unchecked return value
Helps: CID1518968 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e7775973f0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-07-24 16:52:06 +02:00
Michael Niedermayer 59029c2b16 tools/enc_recon_frame_test: Assert that av_image_get_linesize() succeeds 
Helps: CID1524598 Improper use of negative value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b6fa2ed77e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-07-24 16:52:06 +02:00
Michael NiedermayerandTimo Rothenpieler e3711d18f3 qsv: Initialize impl_value 
Fixes: The warnings from CID1598553 Uninitialized scalar variable

Passing partly initialized structs is ugly and asking for hard to rieproduce bugs,
The uninitialized fields where not used

Reviewed-by: "Xiang, Haihao" <haihao.xiang-at-intel.com@ffmpeg.org>
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c841cb45e8)
 2024-06-24 00:14:04 +02:00
Michael Niedermayer 4e53ea496c avcodec/mscc & mwsc: Check loop counts before use 
This could cause timeouts

Fixes: CID1439568 Untrusted loop bound

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e35fe3d8b9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:21 +02:00
Michael Niedermayer 7cc79bfda9 avcodec/mpegvideo_enc: Fix potential overflow in RD 
Fixes: CID1500285 Unintentional integer overflow

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b6b2b01025)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:21 +02:00
Michael Niedermayer 8174b4206d avcodec/mpeg4videodec: assert impossible wrap points 
Helps: CID1473517 Uninitialized scalar variable
Helps: CID1473497 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8fc649b931)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:21 +02:00
Michael Niedermayer 94849755fb avcodec/mpeg12dec: Use 64bit in bit computation 
I dont think this can actually overflow but 64bit seems reasonable to use

Fixes: CID1521983 Unintentional integer overflow

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4c725df059)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:20 +02:00
Michael Niedermayer d54198256e avcodec/vqcdec: Check init_get_bits8() for failure 
Fixes: CID1516090 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6a9302739f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:20 +02:00
Michael Niedermayer cc78679c84 avcodec/vble: Check av_image_get_buffer_size() for failure 
Fixes: CID1461482 Improper use of negative value

Sponsored-by: Sovereign Tech Fund
Reviewed-.by: "Xiang, Haihao" <haihao.xiang@intel.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dd5379db5d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:20 +02:00
Michael Niedermayer 1b9de6ff28 avcodec/vp3: Replace check by assert 
Fixes: CID1452425 Logically dead code

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b991e77b9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:19 +02:00
Michael Niedermayer 6db10d3be0 avcodec/vp8: Forward return of ff_vpx_init_range_decoder() 
Fixes: CID1507483 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 63feed1519)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:19 +02:00
Michael Niedermayer 236001ce0b avcodec/jpeg2000dec: remove ST=3 case 
Fixes: CID1460979 Logically dead code

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4ed4f9a6c0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:19 +02:00
Michael Niedermayer 28eb4663d6 avcodec/qsvdec: Check av_image_get_buffer_size() for failure 
Fixes: CID1477406 Improper use of negative value

Sponsored-by: Sovereign Tech Fund
Reviewed-by: "Xiang, Haihao" <haihao.xiang@intel.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8789c550fa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:18 +02:00
Michael Niedermayer c10b416087 avcodec/exr: Fix preview overflow 
Fixes: CID1515456 Unintentional integer overflow

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 36126e4c14)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:18 +02:00
Michael Niedermayer 3ee5567c54 avcodec/decode: decode_simple_internal() only implements audio and video 
Fixes: CID1538861 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e9bb586543)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:18 +02:00
Michael Niedermayer 41550b0ebb avcodec/fmvc: remove dead assignment 
Fixes: CID1529220 Unused value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 96c1162545)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:17 +02:00
Michael Niedermayer b586ff2768 avcodec/h2645_sei: Remove dead checks 
Fixes: CID1596534 Dereference after null check

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fdaa6ae2b6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:17 +02:00
Michael Niedermayer 61f5019a51 avcodec/h264_slice: Remove dead sps check 
Fixes: CID1439574 Dereference after null check

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a68aa951b2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:17 +02:00
Michael Niedermayer 2de1f26366 avcodec/lpc: copy levenson coeffs only when they have been computed 
Fixes: CID1473514 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c2d897f356)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:16 +02:00
Michael Niedermayer 21efa2af53 avutil/tests/base64: Check with too short output array 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c304784a86)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:16 +02:00
Michael Niedermayer f3931154bb libavutil/base64: Try not to write over the array end 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2d216566f2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:16 +02:00
Michael Niedermayer bc08dfdf5d avcodec/cbs_av1: Avoid shift overflow 
Fixes: CID1465488 Unintentional integer overflow

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d7924a4f60)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:15 +02:00
Michael Niedermayer cc773eba6b fftools/ffplay: Check return of swr_alloc_set_opts2() 
This probably makes no difference but its more correct

Fixes: CID1503080 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f44f441555)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:15 +02:00
Michael Niedermayer b91b594dbd tools/opt_common: Check for malloc failure 
Fixes: CID1539100 Negative loop bound

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ba7038043a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:15 +02:00
Michael Niedermayer 36713f42ab doc/examples/demux_decode: Simplify loop 
Fixes: CID1463550 Logically dead code

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 91d27f7e02)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:14 +02:00
Michael Niedermayer ff547f5fd4 avformat/concatdec: Check file 
Fixes: null pointer dereference
Fixes: -stream_loop 1 -ss 00:00:05 -i zgclab/ffmpeg_crash/poc2 -codec:v copy -codec:a aac -y output.mp4

Found-by: Wang Dawei and Zhou Geng, from Zhongguancun Laboratory
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a5d1497f33)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:14 +02:00
Michael Niedermayer 1cb422a0ad avcodec/mpegvideo_enc: Fix 1 line and one column images 
Fixes: Ticket10952
Fixes: poc21ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 96449cfeae)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:14 +02:00
Michael Niedermayer e2afcd74ce avcodec/amrwbdec: assert mode to be valid in decode_fixed_vector() 
Inspired-by: CID1473499 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a3bb269db9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:13 +02:00
Michael Niedermayer 5017839ca0 avcodec/wavarc: fix integer overflow in decode_5elp() block type 2 
Fixes: signed integer overflow: 2097152000 + 107142979 cannot be represented in type 'int'
Fixes: 67919/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-5955101769400320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a2ec2bd493)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:13 +02:00
Michael Niedermayer 6ed54900f7 swscale/output: Fix integer overflow in yuv2rgba64_full_1_c_template() 
Fixes: signed integer overflow: -1082982400 + -1079364728 cannot be represented in type 'int'
Fixes: 67910/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5329011971522560
The input is 9bit in 16bit, the fuzzer fills all 16bit thus generating "invalid" input
No overflow should happen with valid input.

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1330a73cca)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:13 +02:00
Michael Niedermayer e434c789af swscale/output: Fix integer overflow in yuv2rgba64_1_c_template 
Fixes: signed integer overflow: -831176 * 9539 cannot be represented in type 'int'
Fixes: 67869/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5117342091640832

The input is 9bit in 16bit, the fuzzer fills all 16bit thus generating "invalid" input
No overflow should happen with valid input.

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a56559e688)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:12 +02:00
Michael Niedermayer c42b520ba5 avcodec/av1dec: Change bit_depth to int 
Suggested-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 69b4d9736b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:12 +02:00
Michael Niedermayer 270ad2fd2f avcodec/av1dec: bit_depth cannot be another values than 8,10,12 
Fixes: CID1544265 Logically dead code

Sponsored-by: Sovereign Tech Fund
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fd7d24fa3f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:12 +02:00
Michael Niedermayer 77d5f217f3 avcodec/avs3_parser: assert the return value of init_get_bits() 
Fixes: CID1492867 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f9218e4d52)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:11 +02:00
Michael Niedermayer e886fe5542 avcodec/avs2_parser: Assert init_get_bits8() success with const size 15 
Fixes: CID1506708 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a7c4f119c9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:11 +02:00
Michael Niedermayer 19e6b871b6 avformat/mxfdec: Check body_offset 
Fixes: signed integer overflow: 538976288 - -9223372036315799520 cannot be represented in type 'long'
Fixes: 68060/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5523457266745344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 20a6bfda0f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:11 +02:00
Michael Niedermayer 115853a821 avformat/kvag: Check sample_rate 
Fixes: Division by 0
Fixes: -copyts -start_at_zero -itsoffset 00:00:01 -itsscale 1 -ss 00:00:02  -i zgclab/ffmpeg_crash/poc1 output.mp4

Found-by: Wang Dawei and Zhou Geng, from Zhongguancun Laboratory
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c26a762ea1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:10 +02:00
Michael Niedermayer e67741feea avcodec/atrac9dec: Check init_get_bits8() for failure 
Fixes: CID1439569 Unchecked return value
Fixes: CID1439578 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 615c994739)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:10 +02:00
Michael Niedermayer b8d75b8ebc avcodec/ac3_parser: Check init_get_bits8() for failure 
Fixes: CID1420393 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 63415168db)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:10 +02:00
Michael Niedermayer 554787a53e avcodec/pngdec: Check last AVFrame before deref 
Fixes: NULL pointer dereference
Fixes: 68184/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-4926478069334016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 091fdce87e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:09 +02:00
Michael Niedermayer 1f090edd02 avcodec/hevcdec: Check ref frame 
Fixes: NULL pointer dereferences
Fixes: 68197/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6382538823106560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5eb05f4450)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:09 +02:00
Michael Niedermayer 69e12a3f43 doc/examples/qsv_transcode: Initialize pointer before free 
Fixees: CID1517023 Uninitialized pointer read

Sponsored-by: Sovereign Tech Fund
Reviewed-by: "Xiang, Haihao" <haihao.xiang@intel.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cae0f2bc55)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:09 +02:00
Michael Niedermayer 9493a2d066 doc/examples/qsv_transcode: Simplify str_to_dict() loop 
Fixes: CID1517022 Logically dead code

Sponsored-by: Sovereign Tech Fund
Reviewed-by: "Xiang, Haihao" <haihao.xiang@intel.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 191950d1bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:08 +02:00
Michael Niedermayer f72b41c421 doc/examples/vaapi_transcode: Simplify loop 
Fixes: CID1428858(1/2) Logically dead code

Sponsored-by: Sovereign Tech Fund
Reviewed-by: "mypopy@gmail.com" <mypopy@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c9c11a0866)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:08 +02:00
Michael Niedermayer 66bcc6463e doc/examples/qsv_transcode: Simplify loop 
Fixes: CID1428858(2/2) Logically dead code

Sponsored-by: Sovereign Tech Fund
Reviewed-by: "Xiang, Haihao" <haihao.xiang@intel.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 82cce20934)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:08 +02:00
Michael Niedermayer 3d742d20ab avcodec/cbs_h2645: Check NAL space 
Found-by-reviewing: CID1419833 Untrusted loop bound

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b91e3c4c90)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:07 +02:00
Michael Niedermayer d92ef4f846 avfilter/vf_thumbnail_cuda: Set ret before checking it 
Fixes: CID1418336 Logically dead code

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Timo Rothenpieler <timo@rothenpieler.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 02301017d2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:07 +02:00
Michael Niedermayer 057b8d65e3 avfilter/signature_lookup: Dont copy uninitialized stuff around 
Fixes: CID1403238 Uninitialized pointer read
Fixes: CID1403239 Uninitialized pointer read

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e7174e66ac)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:07 +02:00
Michael Niedermayer 572985605f avfilter/signature_lookup: Fix 2 differences to the refernce SW 
Fixes: CID1403227 Division or modulo by float zero

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 25cb66369e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-05-25 00:31:06 +02:00
Michael Niedermayer 9593b727e2 Update for 6.1.2 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-15 01:02:08 +02:00
Michael Niedermayer eb480d1872 avformat/mxfdec: Check index_edit_rate 
Fixes: Assertion b >=0 failed at libavutil/mathematics.c:62
Fixes: 67811/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5108429687422976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ed49391961)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-04 21:10:39 +02:00
Michael Niedermayer 610da8475f swscale/utils: Fix xInc overflow 
Fixes: signed integer overflow: 2 * 1073741824 cannot be represented in type 'int'
Fixes: 67802/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-6249515855183872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1a9eda65d0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-04 21:09:43 +02:00
Michael Niedermayer b94d2dd59a avcodec/wavarc: fix signed integer overflow in block type 6/19 
Fixes: signed integer overflow: -2088796289 + -91276551 cannot be represented in type 'int'
Fixes: 67772/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-6533568953122816

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 28c7094b25)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-04 21:04:36 +02:00
Michael Niedermayer b38902646c doc/developer: (security) researchers should be credited 
Reviewed-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5a5422196d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-04 20:58:21 +02:00
Michael Niedermayer 7c8c94279c avformat/isom: Uninit layout in ff_mp4_read_dec_config_descr() 
Fixes: memleak
Fixes: 67442/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5068813261406208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit d157725cf7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-04 20:55:26 +02:00
Michael Niedermayer 58475c6988 avcodec/exr: Dont use 64bits to hold 6bits 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e3984de6ff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:09:58 +02:00
Michael Niedermayer e85ea8baaa avcodec/exr: Check for remaining bits in huf_unpack_enc_table() 
Fixes: Timeout
Fixes: 67645/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6308760977997824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 589fa8a027)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:09:04 +02:00
Michael Niedermayer 72b27f4f70 avcodec/apedec: Use NABS to avoid undefined negation 
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: 67738/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5444313212321792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1887ff250c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:07:40 +02:00
Michael Niedermayer 2da196b39a avformat/mpegts: Reset local nb_prg on add_program() failure 
add_program() will deallocate the whole array on failure so
we must clear nb_prgs

Fixes: null pointer dereference
Fixes: crash-35a3b39ddcc5babeeb005b7399a3a1217c8781bc

Found-by: Catena cyber
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cb9752d897)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:04:00 +02:00
Michael Niedermayer 93d6513bbe avformat/aiffdec: Check for previously set channels 
Fixes: out of array access (av_channel_layout_copy())
Fixes: 67087/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-4920720268263424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 23b29f72ee)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:59 +02:00
Michael Niedermayer 27d48ddd8f avformat/mxfdec: Make edit_unit_byte_count unsigned 
Suggested-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f30fe5e8d0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:59 +02:00
Michael Niedermayer 56999f9353 avformat/movenc: Check that cts fits in 32bit 
Fixes: Assertion av_rescale_rnd(start_dts, mov->movie_timescale, track->timescale, AV_ROUND_DOWN) <= 0 failed at libavformat/movenc.c:3694
Fixes: poc2

Found-by: Wang Dawei and Zhou Geng, from Zhongguancun Laboratory
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d88c284c18)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:59 +02:00
Michael Niedermayer 38261d8cbd avformat/mxfdec: Check first case of offset_temp computation for overflow 
This is kind of ugly
Fixes: signed integer overflow: 255 * 1157565362826411919 cannot be represented in type 'long'
Fixes: 67313/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6250434245230592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d6ed6f6e8d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:58 +02:00
Michael Niedermayer ab84c37d63 avcodec/jpeg2000htdec: warn about non zero roi shift 
Suggested-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7b7eea8e63)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:58 +02:00
Michael Niedermayer 78e54e1361 avcodec/jpeg2000htdec: Check magp before using it in a shift 
Fixes: shift exponent -1 is negative
Fixes: 65378/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5457678193197056

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 19ad05e9e0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:58 +02:00
Michael Niedermayer 5bb9d8affe avfilter/vf_signature: Dont crash on no frames 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3d5f03bbc8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:57 +02:00
Michael Niedermayer 243359fc78 avformat/westwood_vqa: Fix 2g packets 
Fixes: signed integer overflow: 2147483424 * 2 cannot be represented in type 'int'
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_WSVQA_fuzzer-4576211411795968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 86f73277bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:57 +02:00
Michael Niedermayer 41f9156856 avformat/matroskadec: Check timescale 
Fixes: 3.82046e+18 is outside the range of representable values of type 'unsigned int'
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6381436594421760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e849eb2343)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:57 +02:00
Michael Niedermayer a42a5e692d avformat/wavdec: satuarte next_tag_ofs, data_end 
Fixes: signed integer overflow: 5053074104798691550 + 5053074104259715104 cannot be represented in type 'long'
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-6515315309936640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 61dca9e150)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:56 +02:00
Michael Niedermayer 6d92f9a85e avformat/wavdec: sanity check channels and bps before using them for block_align 
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-4704044498944000
Fixes: signed integer overflow: 520464 * 8224 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 75317ec442)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:56 +02:00
Michael Niedermayer d492fc3e5e avformat/sbgdec: Check for negative duration 
Fixes: signed integer overflow: 9223372036854775807 - -8000000 cannot be represented in type 'long'
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-5133181743136768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0bed22d597)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:56 +02:00
Michael Niedermayer 4a618246cd avformat/rpl: Use 64bit for total_audio_size and check it 
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-4677434693517312
Fixes: signed integer overflow: 5555555555555555556 * 8 cannot be represented in type 'long long'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 878625812f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:55 +02:00
Michael Niedermayer 7af16852cb avformat/timecode: use 64bit for intermediate for rounding in fps_from_frame_rate() 
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4802790784303104
Fixes: signed integer overflow: 1768972133 + 968491058 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3d8d778a68)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:55 +02:00
Michael Niedermayer db7a80c3ca avformat/mov: use 64bit for intermediate for rounding 
Fixes: signed integer overflow: 1768972133 + 968491058 cannot be represented in type 'int'
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4802790784303104

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f01a89c5a3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:55 +02:00
Michael Niedermayer 6cc785c255 avformat/jacosubdec: Use 64bit for abs 
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-5401294942371840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 746203af31)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:54 +02:00
Michael Niedermayer 0a64d77be9 avformat/concatdec: Check user_duration sum 
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-6434245599690752
Fixes: signed integer overflow: 9223372026773000000 + 22337000000 cannot be represented in type 'long'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 007486058c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:54 +02:00
Michael Niedermayer e709315488 avcodec/wavarc: avoid signed integer overflow in AC code 
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-659847401740697
Fixes: signed integer overflow: 65312 * 34078 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1eb8cbd09c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:54 +02:00
Michael Niedermayer 9062d89849 avcodec/wavarc: Avoid signed integer overflow in sample 
Fixes: signed integer overflow: -2147483648 + -25122315 cannot be represented in type 'int'
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-6199806972198912

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6009dd07bd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:53 +02:00
Michael Niedermayer 4cbc9bb2c9 avcodec/truemotion1: Height not being a multiple of 4 is unsupported 
mb_change_bits is given space based on height >> 2, while more data is read

Fixes: out of array access
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION1_fuzzer-5201925062590464.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ebdcf98499)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:53 +02:00
Michael Niedermayer 9a5f191bfb avcodec/rtv1: fix undefined FFALIGN 
Fixes: signed integer overflow: 2147483647 + 4 cannot be represented in type 'int'
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RTV1_fuzzer-6324303861514240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d188a86730)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:53 +02:00
Michael Niedermayer aa4cf7a584 avcodec/hcadec: do not allow code to continue after failed init 
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCA_fuzzer-6247136417087488
Fixes: out of array write

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 48eeb198a5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:52 +02:00
Michael Niedermayer 30fe9d3511 avcodec/hcadec: do not set hfr_group_count to invalid values 
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCA_fuzzer-6247136417087488
Fixes: out of array write

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit addb85ea39)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:52 +02:00
Michael Niedermayer 435f172b5d avformat/concatdec: clip outpoint - inpoint overflow in get_best_effort_duration() 
An alternative would be to limit all time/duration fields to below 64bit

Fixes: signed integer overflow: -93000000 - 9223372036839000000 cannot be represented in type 'long long'
Fixes: 64546/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-5110813828186112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dd733b2be4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:52 +02:00
Michael Niedermayer 21ff582aec avcodec/osq: avoid several signed integer overflows 
Fixes: signed integer overflow: 178459578 + 2009763270 cannot be represented in type 'int'
Fixes: 62285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-5013423686287360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b54c9a9c8f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:51 +02:00
Michael Niedermayer f0c08506f5 avformat/jacosubdec: clarify code 
add comments, rename variables and indent things differently

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e83e8d443b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:51 +02:00
Michael Niedermayer 356251d750 avformat/cafdec: Check that data chunk end fits within 64bit 
Fixes: signed integer overflow: 64 + 9223372036854775803 cannot be represented in type 'long long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6536881135550464
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6536881135550464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b792e4d4c7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:51 +02:00
Michael Niedermayer 9459a45036 avformat/iff: Saturate avio_tell() + 12 
Fixes: signed integer overflow: 9223372036854775796 + 12 cannot be represented in type 'long long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4898373660704768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b8e754525c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:50 +02:00
Michael Niedermayer 521347ee0b avformat/dxa: Adjust order of operations around block align 
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-5730576523198464
Fixes: signed integer overflow: 2147483566 + 82 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 50d8e4f273)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:50 +02:00
Michael Niedermayer d66b1af8df avformat/cafdec: dont seek beyond 64bit 
Fixes: signed integer overflow: 64 + 9223372036854775807 cannot be represented in type 'long long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6418242730328064
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6418242730328064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d973fcbcc2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:50 +02:00
Michael Niedermayer 19ea7b0409 avformat/id3v2: read_uslt() check for the amount read 
Fixes: timeout
Fixes: 66783/clusterfuzz-testcase-minimized-ffmpeg_dem_GENH_fuzzer-5356884892647424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c0f4abe2aa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:49 +02:00
Michael Niedermayer e2a58916b1 avcodec/vmixdec: Check shift before use 
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 65909/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMIX_fuzzer-519459745831321

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 70b26b693e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:49 +02:00
Michael Niedermayer b171edca3c avformat/mov: Check sample_count and auxiliary_info_default_size to be 0 
This combination causes 0 size arrays to be allocated and to leak later

Fixes: memleak
Fixes: 64342/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4520993686945792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3c43299e9e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2024-04-03 02:03:49 +02:00