1
0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-02-04 06:08:26 +02:00

88409 Commits

Author SHA1 Message Date
Michael Niedermayer
98e712bd1c avcodec/ffwavesynth: Fix backward lcg_seek()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cf2bd3ce79b12256d7d129b2ada5ee649b9a27eb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
eb7a4a27c4 avcodec/flicvideo: Fix off by 1 error in flic_decode_frame_24BPP()
Fixes: out of array access
Fixes: 15360/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-5653837190266880
Fixes: 15412/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-5740537648250880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 37708cbae8d6887b80f58a70a1dfa01af6ea2c85)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
8548434337 avcodec/vc1_block: Check for vlc error in vc1_decode_ac_coeff()
Fixes: index -1 out of bounds for type 'const uint8_t [185][2]'
Fixes: 15250/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5648992869810176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 79204a1fc8f1988f7d7e6cae2c3b68f513444d38)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
ea7aadd74a avcodec/alac: Check lpc_quant
lpc_quant of 0 produces undefined behavior, thus disallow this.
If valid samples use this then such a sample would be quite
usefull to confirm the correct&lossles handling of this.

Fixes: libavcodec/alac.c:218:25: runtime error: shift exponent -1 is negative
Fixes: 15273/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5656388535058432
Fixes: 15276/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5761238417539072
Fixes: 15315/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5767260766994432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a6474b899c1153e3bb95e399b6605c3507aea0d0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
5190d3a2f7 avcodec/alsdec: Add FF_CODEC_CAP_INIT_CLEANUP
Fixes: multiple memleaks
Fixes: 15293/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5642409288925184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b7b6ddd59693008c35b3247496ecc946331d0856)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
4852df4a21 avcodec/alsdec: Fix integer overflow with buffer number
Fixes: signed integer overflow: 65313 * 65313 cannot be represented in type 'int'
Fixes: 15290/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5738074249625600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f64f6058e0c23641a68ce7dfe47b1f55efd401c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
3e491e9c59 avcodec/alsdec: Fixes signed integer overflow in LSB addition
Fixes: signed integer overflow: 8 * 536870912 cannot be represented in type 'int'
Fixes: 15281/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5744458785619968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7f527021df73b4792323f38f84a4bf2fbe5a2052)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
36c278078d avcodec/alsdec: Check opt_order / sb_length in ra_block handling
Fixes: out of array access
Fixes: 15277/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5184853437317120
Fixes: 15280/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5741062137577472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0794494c8f2f756e3c9384dba21c54f7d4ba9286)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
49cb2d44a4 avcodec/alsdec: Fix integer overflow with shifting samples
Fixes: signed integer overflow: -346039050 * 8 cannot be represented in type 'int'
Fixes: 15283/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5692700268953600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a3bd4b260eb9f0d5817f9b3d672844f127c51a0b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
1ebd25b1f1 avcodec/alsdec: Fix undefined behavior in decode_rice()
Fixes: left shift of 72 by 26 places cannot be represented in type 'int'
Fixes: 15279/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5700665621348352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 51f6870c37cc29e1ea7e0c66df2fe505938b7561)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
5f5766691d avcodec/alsdec: Fixes invalid shifts in read_var_block_data() and INTERLEAVE_OUTPUT()
Fixes: left shift of negative value -6
Fixes: 15275/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5742361767837696
Fixes: signed integer overflow: 41582592 * 256 cannot be represented in type 'int'
Fixes: 15296/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5739558227935232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e131568752ad41222946304c61eadb87b0a24791)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
ec9a2cb48b avcodec/hevc_ps: Change num_tile_rows/columns checks to sps->ctb_height/weight
Suggested-by: James Almer <jamrial@gmail.com>
Reviewed-by: James Almer <jamrial@gmail.com
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3b2082c663dac93fd722289a540c1b1e24a12564)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
3bdd16fd68 avcodec/hevc_ps: Fix integer overflow with num_tile_rows and num_tile_columns
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 14880/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5130977304641536

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c692051252693155c4eecd16f4f8a79caf66cd54)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
9a7d3304ff avcodec/apedec: Add k < 24 check to the only k++ case which lacks such a check
Fixes: 15255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5718831688843264
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3d4f4f4a15e79c96c3613e5c252b2f5cc4190e18)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
241f59eb8b avformat/aviobuf: Delay buffer downsizing until asserts are met
Fixes: Assertion failure
Fixes: 15151/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5757079496687616
Fixes: 15205/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5767573242642432
May fix: Ticket7094

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0334632d5c02720f1829d59cd20c009584b5b163)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
6aaca5234d avcodec/fitsdec: Check data_min/max
Fixes: division by 0
Fixes: 15206/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5657260212092928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eb82d19f035f59edf0aee215f02baaea908875de)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
80bbb8b851 avcodec/m101: Fix off be 2 error
Fixes: out of array read
Fixes: 15263/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_M101_fuzzer-5728999453491200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 89b96900fa7c17d0770c9af26af7c3ae36ae0253)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
d84f4c0c25 avcodec/qdm2: Move fft_order check up
This avoids undefined computations with unchecked values

Fixes: shift exponent -21 is negative
Fixes: 15262/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5651261753393152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8d8b8c4ac6fb5b5d40bd131f2d2ea9d85b8759a6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
9856f1f615 avcodec/libvorbisdec: Check extradata size
Fixes: out of array read
Fixes: 15261/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVORBIS_fuzzer-5764908467093504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cf3c245566e8a8d45ed2ad9fdff9ef50327ba2d3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
93baaaaa8c avformat/vqf: Check header_size
Fixes: 15271/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5735262606327808
Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7c30ff38880570377168096417f714b21102b343)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
ec2b12fa05 avcodec/utils: Check bits_per_coded_sample
This avoids the need for each decoder separately having to handle this case

Fixes: shift exponent -100663046 is negative
Fixes: out of array access
Fixes: 15270/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5727829913763840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d33414d2ad27a5d2193c9ab0948ba7a282c2f910)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
f1400191c6 avcodec/videodsp_template: Fix overflow of addition
Fixes: addition of unsigned offset to 0x7f56fc26a9b6 overflowed to 0x7f56fc26a8be*
Fixes: clusterfuzz-testcase-minimized-mediasource_MP4_AVC1_pipeline_integration_fuzzer-4917949056679936

Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 247a1de7f7d9c5628cf188e677d10ce9e12bd2f2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
55fca6e6e5 avcodec/alsdec: Fix invalid shift in multiply()
Fixes: shift exponent -24 is negative
Fixes: 15292/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5768533318828032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f30be1ec9856551d96f3876eec5f8b8abf456b81)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
fb81fd52d3 avcodec/ffwavesynth: Check ts_end - ts_start for overflow
Fixes: signed integer overflow: 2314885530818453536 - -8926099139098304480 cannot be represented in type 'long'
Fixes: 15259/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5764366093254656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2db7a3bc4acdd293ed10b71e55f16a45ca28b629)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
0409e5fe36 avcodec/vc1dsp: Avoid undefined shifts in vc1_v_s_overlap_c / vc1_h_s_overlap_c
Fixes: left shift of negative value -13
Fixes: 15260/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5702076048343040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 507ca66ee41aa8a95b75654163f77af0a99a25b1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
5a49cad78a avcodec/tta: Fix undefined shift
Fixes: left shift of negative value -4483
Fixes: 15256/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5738691617619968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ebccd2f778a861b41ad38a8464ea120d4f16b2d7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
7887aa79de avcodec/qdmc: Fix integer overflows in PRNG
Fixes: signed integer overflow: 214013 * 2531011 cannot be represented in type 'int'
Fixes: 15254/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDMC_fuzzer-5698137026461696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2921b45a388a81968d946996bb32e72d7bb5d5b7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
6aa01c0625 avcodec/bintext: Check font height
Fixes: division by zero
Fixes: 15257/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINTEXT_fuzzer-5757352881422336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bfb58bdd7015a6df2d130c92cf284d6a2362f3df)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
00d5a47039 avcodec/binkdsp: Fix integer overflows in idct
Fixes: signed integer overflow: 3784 * 682038 cannot be represented in type 'int'
Fixes: 15265/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5088311799971840
Fixes: 15268/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5666502344179712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7a072fbcc4c6f8ddbf37b131c2d141589118abcd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
ed92170916 avcodec/motionpixels: Check for vlc error in mp_get_vlc()
Fixes: 15246/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOTIONPIXELS_fuzzer-5168534407086080
Fixes: runtime error: index -1 out of bounds for type 'HuffCode [16]'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 930cdef80ab695132d3de2128c3c23f2d698918b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
65326b27b6 avcodec/loco: Limit lossy parameter so it is sane and does not overflow
Fixes: 15248/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5087440458481664
Fixes: signed integer overflow: 3 + 2147483647 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce3b0b9066b433564ed3ee3eed3a1e8f2c0834a1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
a77473d040 avformat/mov: Set fragment.found_tfhd only after TFHD has been parsed
Fixes: Assertion failure
Fixes: crbug971646.mp4

Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 696312c487d9d8c49a087017a829d1cdcbd68651)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
eca9b4022b avcodec/xpmdec: Do not use context dimensions as temporary variables
Fixes: Integer overflow
Fixes: 15134/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XPM_fuzzer-5722635939348480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5ea7f2050050fd6a9177a9b618f2bb2d4add9230)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
91348aa5ba avcodec/fitsdec: Fix division by 0 in size check
Fixes: division by zero
Fixes: 15210/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5746033243455488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 07ffe94c172041cfb03109b9bb6b8bf577332bda)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
36f8bb1261 avcodec/aacpsdsp_template: Fix integer overflow in ps_hybrid_analysis_c()
Fixes: signed integer overflow: -1539565182 + -798086761 cannot be represented in type 'int'
Fixes: 14807/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-564925382682214

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f8f5668df590d853429586e1f95cbd9cee38920e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
7ca17d973b avcodec/truemotion2: Fix integer overflow in last loop in tm2_update_block()
Fixes: signed integer overflow: -1727985666 - 538976288 cannot be represented in type 'int'
Fixes: 15031/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5100228035739648

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3aecd0170413c7e56f19de4e34d093a2c4027c2a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
d88be9bc67 avcodec/iff: finetune the palette size check in the mask case
Fixes: out of array access
Fixes: 15381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5668057826983936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0f9789c8e37eb6d166729e876729beb21b7d5647)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
67ad2f201c avcodec/iff: Fix mask_buf / mask_palbuf leak
Fixes: 15372/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5708881759567872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 92e8db532cdee3c73913174413428ffdc35032e2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
1246e38511 avformat/icodec: Free ico->images on error paths
Fixes: 15116/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5715173567889408
Fixes: memleak

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 54918b51161610a364de697b80acb9583eecf41b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
25d3ae9697 avformat/wsddec: Fix undefined shift
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 15123/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5738039235575808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 112eb17a2bbf6d02f81fdf0743b353a6b010aedc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
30047c052d avcodec/fmvc: Check if header fields are available before allocating the image
Fixes: Timeout (15sec -> 0.5sec)
Fixes: 14846/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FMVC_fuzzer-5068322120400896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 561cc161ca617c1b8d48fef0f02d56c0f1af0486)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
039c7d21f6 avcodec/bink: Reorder operations in init to avoid memleak on error
Fixes: Direct leak of 536 byte(s) in 1 object(s)
Fixes: 15266/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5629530426834944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2603f25d326476a83f5d093b522590b05b6e703b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
a8ff09d7b7 avformat/wtvdec: Avoid (32bit signed) sectors
Fixes: left shift of negative value -14614752
Fixes: 15174/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5670543606415360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dd357d76e5faf3ce6fc46ffb924cf30f1cb54af9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
c8f7f583c0 avcodec/bitstream: Check for more conflicting codes in build_table()
Fixes: out of array read
Fixes: 14563/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5646451545210880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a7e3b271fc9a91c5d2e4df32e70e525c15c6d3ef)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
8d2d04569a avcodec/bitstream: Check for integer code truncation in build_table()
Fixes: out of array read
Fixes: 14563/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5646451545210880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e78b0f83748f92ea9e93b21c36082e0dd04d7cb1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
5b4ceb45e3 avformat/sbgdec: Fixes integer overflow in str_to_time() with hours
Fixes: signed integer overflow: 904444 * 3600 cannot be represented in type 'int'
Fixes: 15113/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5764083346833408

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2a0f23b9d647ad84e0351b43ca4b552add00c8dc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
62c408412f avformat/vpk: Check offset for validity
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aa003019ab9ec5ef7e7b3ff9d6262d3472b427eb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
d14dd61a3d avformat/vpk: Fix integer overflow in samples_per_block computation
Fixes: signed integer overflow: 84026453 * 28 cannot be represented in type 'int'
Fixes: 15111/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5675630072430592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8c6c4129b4cc3b9e0b3a527a5a15c904ec6ae3b6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
b8bb86efe7 avcodec/mjpegdec: Check for non ls PAL8
Fixes: Null-dereference READ in av_malloc
Fixes: 15002/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-5643474625363968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 442375fee7f1fb15e42fbc128dc38bdfcc2cc105)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00
Michael Niedermayer
84b444aa78 avcodec/interplayvideo: check decoding_map_size with video_data_size
Fixes: Timeout (90543 ms -> 59 ms)
Fixes: 14721/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_VIDEO_fuzzer-5697492148027392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 914d6a7c1a7a1850b4053847a784b174c9146c55)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-14 23:30:37 +01:00