1
0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-07-16 22:42:38 +02:00
Commit Graph

112814 Commits

Author SHA1 Message Date
d54198256e avcodec/vqcdec: Check init_get_bits8() for failure
Fixes: CID1516090 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6a9302739f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:20 +02:00
cc78679c84 avcodec/vble: Check av_image_get_buffer_size() for failure
Fixes: CID1461482 Improper use of negative value

Sponsored-by: Sovereign Tech Fund
Reviewed-.by: "Xiang, Haihao" <haihao.xiang@intel.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dd5379db5d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:20 +02:00
1b9de6ff28 avcodec/vp3: Replace check by assert
Fixes: CID1452425 Logically dead code

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b991e77b9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:19 +02:00
6db10d3be0 avcodec/vp8: Forward return of ff_vpx_init_range_decoder()
Fixes: CID1507483 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 63feed1519)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:19 +02:00
236001ce0b avcodec/jpeg2000dec: remove ST=3 case
Fixes: CID1460979 Logically dead code

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4ed4f9a6c0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:19 +02:00
28eb4663d6 avcodec/qsvdec: Check av_image_get_buffer_size() for failure
Fixes: CID1477406 Improper use of negative value

Sponsored-by: Sovereign Tech Fund
Reviewed-by: "Xiang, Haihao" <haihao.xiang@intel.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8789c550fa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:18 +02:00
c10b416087 avcodec/exr: Fix preview overflow
Fixes: CID1515456 Unintentional integer overflow

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 36126e4c14)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:18 +02:00
3ee5567c54 avcodec/decode: decode_simple_internal() only implements audio and video
Fixes: CID1538861 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e9bb586543)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:18 +02:00
41550b0ebb avcodec/fmvc: remove dead assignment
Fixes: CID1529220 Unused value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 96c1162545)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:17 +02:00
b586ff2768 avcodec/h2645_sei: Remove dead checks
Fixes: CID1596534 Dereference after null check

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fdaa6ae2b6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:17 +02:00
61f5019a51 avcodec/h264_slice: Remove dead sps check
Fixes: CID1439574 Dereference after null check

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a68aa951b2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:17 +02:00
2de1f26366 avcodec/lpc: copy levenson coeffs only when they have been computed
Fixes: CID1473514 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c2d897f356)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:16 +02:00
21efa2af53 avutil/tests/base64: Check with too short output array
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c304784a86)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:16 +02:00
f3931154bb libavutil/base64: Try not to write over the array end
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2d216566f2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:16 +02:00
bc08dfdf5d avcodec/cbs_av1: Avoid shift overflow
Fixes: CID1465488 Unintentional integer overflow

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d7924a4f60)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:15 +02:00
cc773eba6b fftools/ffplay: Check return of swr_alloc_set_opts2()
This probably makes no difference but its more correct

Fixes: CID1503080 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f44f441555)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:15 +02:00
b91b594dbd tools/opt_common: Check for malloc failure
Fixes: CID1539100 Negative loop bound

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ba7038043a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:15 +02:00
36713f42ab doc/examples/demux_decode: Simplify loop
Fixes: CID1463550 Logically dead code

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 91d27f7e02)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:14 +02:00
ff547f5fd4 avformat/concatdec: Check file
Fixes: null pointer dereference
Fixes: -stream_loop 1 -ss 00:00:05 -i zgclab/ffmpeg_crash/poc2 -codec:v copy -codec:a aac -y output.mp4

Found-by: Wang Dawei and Zhou Geng, from Zhongguancun Laboratory
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a5d1497f33)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:14 +02:00
1cb422a0ad avcodec/mpegvideo_enc: Fix 1 line and one column images
Fixes: Ticket10952
Fixes: poc21ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 96449cfeae)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:14 +02:00
e2afcd74ce avcodec/amrwbdec: assert mode to be valid in decode_fixed_vector()
Inspired-by: CID1473499 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a3bb269db9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:13 +02:00
5017839ca0 avcodec/wavarc: fix integer overflow in decode_5elp() block type 2
Fixes: signed integer overflow: 2097152000 + 107142979 cannot be represented in type 'int'
Fixes: 67919/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-5955101769400320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a2ec2bd493)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:13 +02:00
6ed54900f7 swscale/output: Fix integer overflow in yuv2rgba64_full_1_c_template()
Fixes: signed integer overflow: -1082982400 + -1079364728 cannot be represented in type 'int'
Fixes: 67910/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5329011971522560
The input is 9bit in 16bit, the fuzzer fills all 16bit thus generating "invalid" input
No overflow should happen with valid input.

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1330a73cca)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:13 +02:00
e434c789af swscale/output: Fix integer overflow in yuv2rgba64_1_c_template
Fixes: signed integer overflow: -831176 * 9539 cannot be represented in type 'int'
Fixes: 67869/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5117342091640832

The input is 9bit in 16bit, the fuzzer fills all 16bit thus generating "invalid" input
No overflow should happen with valid input.

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a56559e688)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:12 +02:00
c42b520ba5 avcodec/av1dec: Change bit_depth to int
Suggested-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 69b4d9736b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:12 +02:00
270ad2fd2f avcodec/av1dec: bit_depth cannot be another values than 8,10,12
Fixes: CID1544265 Logically dead code

Sponsored-by: Sovereign Tech Fund
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fd7d24fa3f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:12 +02:00
77d5f217f3 avcodec/avs3_parser: assert the return value of init_get_bits()
Fixes: CID1492867 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f9218e4d52)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:11 +02:00
e886fe5542 avcodec/avs2_parser: Assert init_get_bits8() success with const size 15
Fixes: CID1506708 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a7c4f119c9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:11 +02:00
19e6b871b6 avformat/mxfdec: Check body_offset
Fixes: signed integer overflow: 538976288 - -9223372036315799520 cannot be represented in type 'long'
Fixes: 68060/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5523457266745344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 20a6bfda0f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:11 +02:00
115853a821 avformat/kvag: Check sample_rate
Fixes: Division by 0
Fixes: -copyts -start_at_zero -itsoffset 00:00:01 -itsscale 1 -ss 00:00:02  -i zgclab/ffmpeg_crash/poc1 output.mp4

Found-by: Wang Dawei and Zhou Geng, from Zhongguancun Laboratory
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c26a762ea1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:10 +02:00
e67741feea avcodec/atrac9dec: Check init_get_bits8() for failure
Fixes: CID1439569 Unchecked return value
Fixes: CID1439578 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 615c994739)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:10 +02:00
b8d75b8ebc avcodec/ac3_parser: Check init_get_bits8() for failure
Fixes: CID1420393 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 63415168db)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:10 +02:00
554787a53e avcodec/pngdec: Check last AVFrame before deref
Fixes: NULL pointer dereference
Fixes: 68184/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-4926478069334016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 091fdce87e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:09 +02:00
1f090edd02 avcodec/hevcdec: Check ref frame
Fixes: NULL pointer dereferences
Fixes: 68197/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6382538823106560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5eb05f4450)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:09 +02:00
69e12a3f43 doc/examples/qsv_transcode: Initialize pointer before free
Fixees: CID1517023 Uninitialized pointer read

Sponsored-by: Sovereign Tech Fund
Reviewed-by: "Xiang, Haihao" <haihao.xiang@intel.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cae0f2bc55)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:09 +02:00
9493a2d066 doc/examples/qsv_transcode: Simplify str_to_dict() loop
Fixes: CID1517022 Logically dead code

Sponsored-by: Sovereign Tech Fund
Reviewed-by: "Xiang, Haihao" <haihao.xiang@intel.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 191950d1bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:08 +02:00
f72b41c421 doc/examples/vaapi_transcode: Simplify loop
Fixes: CID1428858(1/2) Logically dead code

Sponsored-by: Sovereign Tech Fund
Reviewed-by: "mypopy@gmail.com" <mypopy@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c9c11a0866)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:08 +02:00
66bcc6463e doc/examples/qsv_transcode: Simplify loop
Fixes: CID1428858(2/2) Logically dead code

Sponsored-by: Sovereign Tech Fund
Reviewed-by: "Xiang, Haihao" <haihao.xiang@intel.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 82cce20934)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:08 +02:00
3d742d20ab avcodec/cbs_h2645: Check NAL space
Found-by-reviewing: CID1419833 Untrusted loop bound

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b91e3c4c90)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:07 +02:00
d92ef4f846 avfilter/vf_thumbnail_cuda: Set ret before checking it
Fixes: CID1418336 Logically dead code

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Timo Rothenpieler <timo@rothenpieler.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 02301017d2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:07 +02:00
057b8d65e3 avfilter/signature_lookup: Dont copy uninitialized stuff around
Fixes: CID1403238 Uninitialized pointer read
Fixes: CID1403239 Uninitialized pointer read

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e7174e66ac)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:07 +02:00
572985605f avfilter/signature_lookup: Fix 2 differences to the refernce SW
Fixes: CID1403227 Division or modulo by float zero

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 25cb66369e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2024-05-25 00:31:06 +02:00
ab4fcc06ce avcodec/x86/vp3dsp_init: Set correct function pointer, fix crash
Regression since fd172185580c1ccdcfb90bbfdb59fa806fad3117;
triggered by vp4/KTkvw8dg1J8.avi in the FATE suite, but not
when running fate as this code is not used when the bitexact
flag is set.

Bisecting done by ami_stuff, patch from user Mika Fischer
in ticket #10027 (which this commit fixes).

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit c3ca90a92e)
2024-05-22 16:53:27 +02:00
fcce528713 avformat/mp3dec: change bogus error message if read_header encounters EOF
Because of ffio_ensure_seekback() a seek error normally should only happen if
the end of file is reached during checking for the junk run-in. Also use proper
error code.

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit 49e018d6fe)
2024-05-21 08:44:07 +02:00
306ed3f301 avformat/mp3dec: simplify inner frame size check in mp3_read_header
We are protecting the checked buffer with ffio_ensure_seekback(), so if the
inner check fails with a seek error, that likely means the end of file was
reached when checking for the next frame. This could also be the result of a
wrongly guessed (larger than normal) frame size, so let's continue the loop
instead of breaking out early. It will end sooner or later anyway.

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit b75e604fe5)
2024-05-21 08:43:56 +02:00
b4681bd6ec avformat/mp3dec: only call ffio_ensure_seekback once
Otherwise the subsequent ffio_ensure_seekback calls destroy the buffer of the
earlier. The worst case ~66kB seekback is so small it is easier to request it
entirely.

Fixes ticket #10837, a regression since
0d17f5228f.

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit b005317219)
2024-05-21 08:43:51 +02:00
2aad37688c avutil/thread: fix pthread_setname_np parameters for NetBSD and Apple
Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit 71ea90638e)
Signed-off-by: Brad Smith <brad@comstyle.com>
2024-05-19 02:41:11 -04:00
66f2cf8958 avutil/thread: add support for setting thread name on *bsd and solaris
FreeBSD/DragonFly/Solaris use pthread_setname_np(). OpenBSD uses pthread_set_name_np().

Signed-off-by: Brad Smith <brad@comstyle.com>
Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit fd16d8c68c)
Signed-off-by: Brad Smith <brad@comstyle.com>
2024-05-19 02:40:19 -04:00
a01ed52733 avutil/ppc/cpu: Also use the machdep.altivec sysctl on NetBSD
Use the machdep.altivec sysctl on NetBSD for AltiVec detection
as is done with OpenBSD.

(cherry picked from commit 115c96b9bd)
Signed-off-by: Brad Smith <brad@comstyle.com>
2024-05-18 19:31:57 -04:00
ebb406db7c lavd/v4l2: Use proper field type for second parameter of ioctl() with BSD's
The proper type was used until 73251678c8.

This covers all of the OS's that currently have V4L2 support, permutations
of Linux glibc/musl, Android bionic, FreeBSD, NetBSD, OpenBSD, Solaris.

Copied from FreeBSD ports patch.

Signed-off-by: Brad Smith <brad@comstyle.com>
Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit 9e674b3160)
Signed-off-by: Brad Smith <brad@comstyle.com>
2024-05-18 19:31:30 -04:00