1
0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-29 22:00:58 +02:00

88620 Commits

Author SHA1 Message Date
Michael Niedermayer
07f16ceb8e avcodec/cook: Move up and extend block_align check
Fixes: signed integer overflow: 2046820356 * 8 cannot be represented in type 'int'
Fixes: 18391/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5631674666188800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1c63edcdd208bf18a3be66e94deb6ac115f6364e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:47 +01:00
Michael Niedermayer
d737429008 avcodec/twinvq: Check block_align
Fixes: signed integer overflow: 538976288 * 8 cannot be represented in type 'int'
Fixes: 18348/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_METASOUND_fuzzer-6681325716635648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 97f778e9c55328e8b48f4b8b4171245e5f2232f6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:47 +01:00
Michael Niedermayer
d3fe22a1dc avcodec/cook: Enlarge gain table
Fixes: index 25 out of bounds for type 'float [23]'
Fixes: 18355/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5641398941908992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 50001cd440ac89ed125f0154dedbcfa2718d2d68)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:47 +01:00
Michael Niedermayer
a76e4ba104 avcodec/cook: Check samples_per_channel earlier
Fixes: division by zero
Fixes: 18362/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5653727679086592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 57750bb629a145326e20b8760f21f1041464a937)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:47 +01:00
Michael Niedermayer
25727befcc avcodec/atrac3plus: Check split point in fill mode 3
Fixes: index 32 out of bounds for type 'int [32]'
Fixes: 18350/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3P_fuzzer-5643794862571520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit de5102fd92de8d353fdf060375ed3ce859c83977)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:47 +01:00
Michael Niedermayer
8255244f19 avcodec/wmavoice: Check sample_rate
Fixes: left shift of 538976288 by 8 places cannot be represented in type 'int'
Fixes: 18376/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5741645391200256

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 55c97a763783540ee48a326a3e82fbdea42f8280)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:47 +01:00
Michael Niedermayer
f94127a40e avcodec/xsubdec: fix overflow in alpha handling
Fixes: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 18368/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XSUB_fuzzer-5702665442426880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9ea997395909907f569787d4ba5b96352ad31a80)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:47 +01:00
Michael Niedermayer
4b8a0ce8f7 avcodec/iff: Check available space before entering loop in decode_long_vertical_delta2() / decode_long_vertical_delta()
Fixes: Timeout (31sec -> 41ms)
Fixes: 18380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5645210121404416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 32b3c8ce7d050210d210511cdb8c6644664a70ab)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:47 +01:00
Michael Niedermayer
ffc4603e61 avcodec/apedec: Fix integer overflow in filter_3800()
Fixes: signed integer overflow: 2117181180 + 60483298 cannot be represented in type 'int'
Fixes: 18344/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5685327791915008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1c038c5c63375883a8a94332cffd701c4cb1301a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:47 +01:00
Michael Niedermayer
5ebee49b34 avutil/lfg: Document the AVLFG struct
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d6fea2ef221a2f438cc55e82c61d0375750edf94)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:47 +01:00
Michael Niedermayer
a687664dd4 avcodec/ffv1dec: Use a different error message for the slice level CRC
This way they can be told apart easily

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit df498cf544fd4690e5a246925e4de1125b57795b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:47 +01:00
Michael Niedermayer
aaa9b96cf6 avcodec/apedec: Fix undefined integer overflow in long_filter_ehigh_3830()
Fixes: signed integer overflow: -1094995529 * 2 cannot be represented in type 'int'
Fixes: 18281/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5692589180715008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1d1719a44dd43b2d9d8ccd26e3b2854e675a7bd7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:47 +01:00
Michael Niedermayer
3de0c702bd avcodec/dstdec: Check that AC probabilities are within range
ISO/IEC 14496-3:2005(E): "Each entry of P_one[ ][ ] is in the range of 1 to
128, corresponding to a probability of 1/256 to 128/256 of the next error bit (bit E, See Figure 10.5)..."

Fixes: Timeout (42sec ->1sec)
Fixes: 18181/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5736646250594304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0c3e1b395b47fac44397604b2a3343c4bd92561c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:47 +01:00
Michael Niedermayer
2258982c8b avcodec/dstdec: Check read_table() for failure
Fixes: Timeout (too long -> 42sec)
Fixes: 18181/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5736646250594304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 03ea8d8cd45e55eeb9675c38184dc2149710a557)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:47 +01:00
Michael Niedermayer
e0d167051e avcodec/snowenc: Set mb_num to avoid ratecontrol floating point divisions by 0.0
Fixes: Ticket7990

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 55279d699fa64d8eb1185d8db04ab4ed92e8dea2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:47 +01:00
Michael Niedermayer
0c9ad1c746 avcodec/snowenc: Fix 2 undefined shifts
Fixes: Ticket7990

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8802e329c8317ca5ceb929df48a23eb0f9e852b2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:47 +01:00
Michael Niedermayer
f4103876f9 avformat/nutenc: Do not pass NULL to memcmp() in get_needed_flags()
This compared to the other suggestions is cleaner and easier to understand
keeping the condition in the if() simple.

This affects alot of fate tests.

See: [FFmpeg-devel] [PATCH 05/11] avformat/nutenc: Don't pass NULL to memcmp
See: [FFmpeg-devel] [PATCH]lavf/nutenc: Do not call memcmp() with NULL argument

Fixes: Ticket 7980

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e4fdeb3fcefeb98f2225f7ccded156fb175959c5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:47 +01:00
Michael Niedermayer
eda9406895 avcodec/aacdec_template: Check samplerate
Fixes: signed integer overflow: 2 * 1881153568 cannot be represented in type 'int'
Fixes: 17996/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5687126468853760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7730bacb413fcb59f30acef0b2c6d50c5e6382d6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:47 +01:00
Michael Niedermayer
a154ec5f43 avcodec/truemotion2: Fix several integer overflows in tm2_low_res_block()
Fixes: signed integer overflow: 1077952576 + 1355863565 cannot be represented in type 'int'
Fixes: 16196/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5679842317565952

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2b655f55eaf09eb99b5e694dba2c0cf73fa2c646)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
64b961273a avcodec/utils: Check block_align
Fixes: out of array access
Fixes: 18432/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5675574936207360
Fixes: 18326/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5071752362721280
Fixes: 18384/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV1_fuzzer-5769439500304384

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f011572e66c8dd2f0ac3cb147a769e91f24e0202)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
2635bfb2b3 avcodec/wmalosslessdec: Fix some integer anomalies
Fixes: left shift of negative value -341180
Fixes: 18401/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5686380134400000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d3dee676b8a8ab6752c599e25c9b5461f06a3959)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
7369aa201e avcodec/adpcm: Fix invalid shifts in ADPCM DTK
Fixes: left shift of negative value -1
Fixes: 18397/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_DTK_fuzzer-5675653487132672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 34e701ff93b664703e1bc1b1a6073fa058b02f34)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
132e4e5460 avcodec/apedec: Only clear the needed buffer space, instead of all
Fixes: Timeout (15sec -> 0.4sec)
Fixes: 18396/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5730080487112704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f17ea0200178a4dae446a6bec2f68312f41714a0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
490f931494 avcodec/libvorbisdec: Fix insufficient input checks leading to out of array reads
Fixes: 16144/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVORBIS_fuzzer-5638618940440576
Fixes: out of array read

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 069be4aa5ddce4479b18896d80a852b144e680df)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
a1d6813649 avcodec/g723_1dec: fix invalid shift with negative sid_gain
Fixes: left shift of negative value -1
Fixes: 18395/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G723_1_fuzzer-5710313034350592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1850c3feaa1c7b5b63a55c61075029fa59c84e66)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
68274f568e avcodec/vp5: Check render_x/y
Fixes: Timeout (15sec -> 91ms)
Fixes: 18353/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP5_fuzzer-5704150326706176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 698e042c77ecb5b0d616de254adc783e8b61b9c4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
7b0ad24b10 avcodec/qdrw: Check input for header/skiped space before get_buffer()
Fixes: Timeout (21sec -> 0.8sec)
Fixes: 17990/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDRAW_fuzzer-5200374436200448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b63fbc19c09d0b42da4f83c21fcf362d6ed7c545)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
4ed397df65 avcodec/ralf: Skip initializing unused filter variables
Fixes: left shift of negative value -1
Fixes: 17890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5643307467669504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f4ecf6c39de9a7cc1dae70cf87c225771001e883)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
e02dedf267 avcodec/takdec: Fix overflow with large sample rates
Fixes: signed integer overflow: 2147483647 + 511 cannot be represented in type 'int'
Fixes: 17899/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5719753322135552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 42eb78059d149abcd994f46c8b8a0dd98e86b594)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
09e942aa4d avcodec/alsdec: Check that input space for header exists in read_diff_float_data()
Fixes: Timeout (21sec -> 8sec)
Fixes: 17832/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5737092172218368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 09581f7923ed9af7719762868e8f1ff626ea8374)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
b3d6eabd78 avformat/pjsdec: Check duration for overflow
Fixes: signed integer overflow: -3 - 9223372036854775807 cannot be represented in type 'long'
Fixes: 17828/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5645915116797952

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1efaac69328bdc17680924c71be7ec990f0e8f2c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
8d483f9849 avcodec/ptx: Check that the input contains at least one line
Fixes: Timeout (19sec -> 44ms)
Fixes: 17816/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PTX_fuzzer-5704459950227456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a6ad328256fe6a6ace7d1e15f3515afccf1247fc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
958cc68d51 avcodec/alac: Fix integer overflow in LPC
Fixes: signed integer overflow: 2147483628 + 128 cannot be represented in type 'int'
Fixes: 17783/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5146470595952640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 44b73a0568f8ad5993ec79b29873151f316bf95c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
b58e7868f2 avcodec/smacker: Fix integer overflows in pred[] in smka_decode_frame()
Fixes: signed integer overflow: -2147481503 + -32732 cannot be represented in type 'int'
Fixes: 17782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKAUD_fuzzer-5769672225456128

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a76897e19ca96127e07f5acc5a773b904dcf6124)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
08972bff12 avcodec/aliaspixdec: Check input size against minimal picture size
Fixes: Timeout (15sec -> 72ms)
Fixes: 17774/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALIAS_PIX_fuzzer-5193929107963904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8c693104779830028bd5f76bf32a93e059c04d2c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
8d7d6066ef avcodec/ffwavesynth: Fix integer overflows in pink noise addition
Fixes: signed integer overflow: -1795675744 + -1926578528 cannot be represented in type 'int'
Fixes: 17741/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5131336402075648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7916b6863caec55d7e64758a1bfe436834f2faf6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
0dc659b8fb avcodec/vc1_block: Fixes integer overflow in vc1_decode_i_block_adv()
Fixes: signed integer overflow: 62220 * 262144 cannot be represented in type 'int'
Fixes: 17145/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5667394743173120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6fdeb208172dc95b29b965a0cc365ca0925e151e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
c992a8301a avcodec/wmalosslessdec: Check block_align
Fixes: NULL pointer dereference
Fixes: 18331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5652847445671936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c1c799271eefb8afe22804a710baa5cbaad57d91)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
f628f38f6e avcodec/g729postfilter: Fix left shift of negative value
Fixes: Ticket8176

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f0acc5064ed501cb40d4aaccae2b3ce5c4552fd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
7c7e103729 avcodec/binkaudio: Check sample rate
Fixes: signed integer overflow: 1092624416 * 2 cannot be represented in type 'int'
Fixes: 18045/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINKAUDIO_RDFT_fuzzer-5718519492116480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2fca09bce49c7de590560d9517fd2414b6c0c14f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
22336d5c48 avcodec/adpcm: Check initial predictor for ADPCM_IMA_EA_EACS
Fixes: signed integer overflow: -2147483360 - 631 cannot be represented in type 'int'
Fixes: 17701/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_EA_EACS_fuzzer-5711517319692288

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2f66e8436d89963362acf533a60ed4fedb42546e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
888df4b68c avcodec/g723_1dec: Fix overflow in shift
Fixes: shift exponent 1008 is too large for 32-bit type 'int'
Fixes: 17700/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G723_1_fuzzer-5707633436131328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 07732f12a43ac3048e44c086c9a8c811452ba31c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
0041d3ceba avcodec/apedec: Fix integer overflow in predictor_update_3930()
Fixes: signed integer overflow: -69555262 * 31 cannot be represented in type 'int'
Fixes: 17698/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5728970447781888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5c072c9ed7c6f173b8a0a886fb7fe1e8e4c1fadd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
4b4c26ca09 avcodec/g729postfilter: Fix undefined intermediate pointers
Fixes: index -49 out of bounds for type 'int16_t [192]'
Fixes: 17689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5756275014500352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0c61661a2cbe1b8b284c80ada1c2fdddf4992cad)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
d998b81ce1 avcodec/g729postfilter: Fix undefined shifts
Fixes: left shift of negative value -12
Fixes: 17689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5756275014500352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6a4fdbf112385824fc9b7d7739685359213b579a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
6d62dbb46b avcodec/lsp: Fix undefined shifts in lsp2poly()
Fixes: left shift of negative value -30635
Fixes: 17689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5756275014500352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2b93f52cd635f372b7b22396939e840c63e8edf3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
6b85dc6569 avcodec/adpcm: Fix left shifts in AV_CODEC_ID_ADPCM_EA
Fixes: left shift of negative value -1
Fixes: 17683/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_EA_R2_fuzzer-5111690013704192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8695fbec573b0d434cf2e703a0d45742a09a5d94)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
3ba68a5400 avformat/shortendec: Check k in probe
Fixes: Assertion failure
Fixes: 17640/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5708767475269632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ea770eb55941a6ed7b86828d6ea2f4e718a4b337)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
386b987f2a avfilter/vf_geq: Use av_clipd() instead of av_clipf()
With floats we cannot represent all 32bit integer dimensions

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c8813b1a984714f0027cabeea2394035df20cf38)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00
Michael Niedermayer
25a917e46f avcodec/wmaprodec: Check that the streams channels do not exceed the overall channels
Fixes: NULL pointer dereference
Fixes: 18075/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA1_fuzzer-5708262036471808
Fixes: 18087/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA1_fuzzer-5740627634946048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e418b315ddd0505e707860f8cc8b796ce06f3458)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 12:25:46 +01:00