Fixes: Infinite loop
Fixes: signed integer overflow: 2147483644 + 16 cannot be represented in type 'int'
Fixes: 16169/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5662570416963584
Fixes: 16782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5743163859271680
Fixes: 17641/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5711603562971136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 87ddf9f1ef17726fd4235f2e7aed8334d0ff231b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: Timeout (81sec -> 0.2sec)
Fixes: 16169/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5662570416963584
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8f92eb05e063e6c4d6e36521020620d4e6e1c21d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: signed integer overflow: 20242 * 121095 cannot be represented in type 'int'
Fixes: 15310/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5737051745419264
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2bbea155bf7c6ce6d5ae53cc41e44798cad2f39c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 07607a1db879d0d96e2c91e1354bc4e425937d3a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* commit '68a35473ed423a14731c418939fba7913647979a':
4xm: more thorought check for negative index and negative shift
Conflicts:
libavcodec/4xm.c
Mostly not merged, the added checks, check for impossible conditions
for paranoias sake they are replaced by asserts but thats probably overkill
the vlc table does not contain out of range values or holes,
nor does it permit the log2 values to become negative. Whenever a
log2 value reaches 0 the selected table no longer contains an entry to trigger
the case that would decrease it further
Adding such impossible checks would confuse the reader
Merged-by: Michael Niedermayer <michaelni@gmx.at>
The decoder currently sets CODEC_FLAG_EMU_EDGE and relies on
get_buffer2() to always provide buffers with linesize == 2 * width.
This is wrong, since we place no such restriction on get_buffer2()
implementations.
Fix this by decoding into internal buffers and copying them to output
frames. Since this is a very obscure decoder, the performance hit should
not be an issue.
* commit '2f034f255c49050e894ab9b88087c09ebe249f3f':
4xm: Reject not a multiple of 16 dimension
The newly added checks are redundant and thus replaced by asserts
See: db5b4875514eb7740844f514dbf236c9179a6a93
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/master:
4xm: check bitstream_size boundary before using it
Conflicts:
libavcodec/4xm.c
See: 9c661e95
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '94aefb1932be882fd93f66cf790ceb19ff575c19':
4xm: do not overread the source buffer in decode_p_block
Conflicts:
libavcodec/4xm.c
The checks are replaced by av_assert0() as the conditions should
be impossible. If these asserts fail, there is a bug elsewhere
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'be373cb50d3c411366fec7eef2eb3681abe48f96':
4xm: do not overread the prestream buffer
Conflicts:
libavcodec/4xm.c
See: 9c661e95
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'de2e5777e225e75813daf2373c95e223651fd89a':
4xm: validate the buffer size before parsing it
Conflicts:
libavcodec/4xm.c
See: 9c661e95
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '145023f57262d21474e35b4a6069cf95136339d4':
4xm: reject frames not compatible with the declared version
See: c433823750bf096187e70c22822431a7c0bb4202
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '1f0c6075604c271d5627480f1243d22795f9a315':
4xm: drop pointless assert
Conflicts:
libavcodec/4xm.c
The added condition is impossible to occur and thus is added to the assert.
The assert is not removed from the default case, as the default case cannot
occur. Thus either it should stay as is or the case as a whole be removed.
For extra safety, to ensure this doesnt change the assert is changed to
av_assert0()
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'b8b809908ec547b2609dbac24194f4fd2df61aea':
4xm: forward errors from decode_p_block
Conflicts:
libavcodec/4xm.c
Impossible to be false check has been replaced by av_assert0()
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '08859d19b429c522d6494c186656f4a2d3ff8e21':
4xm: use the correct logging context
g2meet: Fix a typo in the height comparison
Merged-by: Michael Niedermayer <michaelni@gmx.at>
