virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-06-19 19:03:00 +02:00
Code Issues Releases Activity
100,703 Commits 39 Branches 425 Tags
f35b2683275aeea8c4967877267d7376d3741a42
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Niedermayer 0bee216ad4 avformat/asfdec_o: Check size vs. offset in detect_unknown_subobject() 
Fixes: signed integer overflow: 2314885530818453566 + 7503032301549264928 cannot be represented in type 'long'
Fixes: 26639/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6024222100684800

Alternatively this could be ignored but then the end condition of the loop
would be hard to reach as avio_tell() is int64_t

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-01-20 21:26:46 +01:00
Michael Niedermayer 03c479ce23 avformat/utils: check for integer overflow in av_get_frame_filename2() 
Fixes: signed integer overflow: 317316873 * 10 cannot be represented in type 'int'
Fixes: 24708/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5731180885049344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-01-20 21:26:46 +01:00
Michael Niedermayer c48110a4a4 avformat/id3v2: Check against max compression ratio before allocation 
Fixes: Timeout (>10sec -> 12ms)
Fixes: 27612/clusterfuzz-testcase-minimized-ffmpeg_dem_PCM_S24BE_fuzzer-6605893000757248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-01-19 00:05:50 +01:00
Michael Niedermayer 7d7ae68972 avformat/avidec: Use av_sat_sub64() in check_stream_max_drift() 
Fixes: signed integer overflow: 8833900919969684211 - -9223372036854775808 cannot be represented in type 'long'
Fixes: 26726/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5669377724383232
Fixes: 27587/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6294562263531520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-01-19 00:05:50 +01:00
Michael Niedermayer 1b19057396 avutil/timecode: Avoid undefined behavior with large framenum 
Fixes: signed integer overflow: 2147462079 + 2149596 cannot be represented in type 'int'
Fixes: 27565/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5091972813160448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-01-19 00:05:50 +01:00
Michael Niedermayer 8c9a5a0fe9 avformat/mov: Check a.size before computing next_root_atom 
Fixes: signed integer overflow: 64 + 9223372036854775799 cannot be represented in type 'long'
Fixes: 27563/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6244650163372032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-01-19 00:05:50 +01:00
Michael Niedermayer ac6c8993f7 avformat/sbgdec: Reduce the amount of floating point in str_to_time() 
Fixes: 1e+75 is outside the range of representable values of type 'long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6626834808700928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-01-19 00:05:50 +01:00
Michael Niedermayer 88519be8db avformat/mxfdec: Free all types for both Descriptors 
Fixes: memleak
Fixes: 26352/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5201158714687488

Suggested-by: Tomas Härdin <tjoppen@acc.umu.se>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-01-11 23:23:36 +01:00
Michael Niedermayer 90e4862ffa avutil/eval: Unconditionally check argument of e_div 
Fixes: division by zero
Fixes: 26451/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVO_fuzzer-4756955832516608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-01-11 23:21:05 +01:00
Michael Niedermayer b0259aa248 avformat/utils: wrap_timestamp() is only needed for less than 64 bits 
Fixes: shift exponent 64 is too large for 64-bit type 'unsigned long long'
Fixes: 26497/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5690188355076096
Fixes: 26903/clusterfuzz-testcase-minimized-ffmpeg_dem_LUODAT_fuzzer-5641466929741824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-01-11 23:17:36 +01:00
Michael Niedermayer fcc263caa9 avformat/aaxdec: Check string before strcmp() 
Fixes: NULL ptr dereference
Fixes: 26508/clusterfuzz-testcase-minimized-ffmpeg_dem_AAX_fuzzer-5694725249826816

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-01-11 23:15:04 +01:00
Michael Niedermayer 7186ec88b9 uavformat/rsd: check for EOF in extradata 
Fixes: OOM
Fixes: 26503/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-6530816735444992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-01-11 23:15:04 +01:00
Michael Niedermayer 69aeba8a19 avcodec/wmaprodec: Check packet size 
Fixes: left shift of negative value -25824
Fixes: 27754/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA2_fuzzer-5760255962906624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-01-08 18:08:57 +01:00
Michael Niedermayer 0a0b92b4b2 avformat/dhav: Check position for overflow 
Fixes: signed integer overflow: 9223372036854775807 + 32768 cannot be represented in type 'long'
Fixes: 27744/clusterfuzz-testcase-minimized-ffmpeg_dem_DHAV_fuzzer-5179319491756032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-01-08 18:08:57 +01:00
Michael Niedermayer 380a3a0adf avcodec/rasc: Check frame before clearing 
Fixes: null pointer dereference
Fixes: 27737/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RASC_fuzzer-5769028685266944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-01-08 18:08:56 +01:00
Michael Niedermayer ac5a568e6d avformat/utils: Change compute_chapters_end() from O(n²) to O(n log n) 
Fixes: Timeout (49sec -> 9sec)
Fixes: 27427/clusterfuzz-testcase-minimized-ffmpeg_dem_FFMETADATA_fuzzer-5140589838073856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-01-08 18:02:55 +01:00
Michael Niedermayer 66deab3a26 avformat/vividas: Check number of audio channels 
Fixes: division by 0
Fixes: 28597/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5752201490333696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-01-05 02:00:05 +01:00
Michael Niedermayer 7ce40dde03 avcodec/alsdec: Fix integer overflow with quant_cof 
Fixes: signed integer overflow: -210824 * 16384 cannot be represented in type 'int'
Fixes: 28670/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5682310846480384

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-01-05 02:00:05 +01:00
Michael Niedermayer 58c7d4a3e3 tools/target_dem_fuzzer.c: Decrease maxblocks 
Fixes: Timeout
Fixes: 28606/clusterfuzz-testcase-minimized-ffmpeg_dem_FRM_fuzzer-5123311424110592
Fixes: 28796/clusterfuzz-testcase-minimized-ffmpeg_dem_R3D_fuzzer-5945803411685376
Fixes: 28821/clusterfuzz-testcase-minimized-ffmpeg_dem_BRSTM_fuzzer-6044239834251264
Fixes: 28841/clusterfuzz-testcase-minimized-ffmpeg_dem_SIFF_fuzzer-5485368388485120
Fixes: 28862/clusterfuzz-testcase-minimized-ffmpeg_dem_AST_fuzzer-5081306790756352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-01-05 02:00:05 +01:00
Michael Niedermayer f26b5acfc0 avformat/wavdec: Avoid zeroing written to array 
Fixes: OOM
Fixes: 26934/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5996784213819392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-01-03 01:16:25 +01:00
Michael Niedermayer 32d0561891 avcodec/notchlc: Check uncompressed size against input for LZ4 
Fixes: OOM
Fixes: 26168/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-6019839015256064
Fixes: 28397/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-5649039941042176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-01-03 01:16:25 +01:00
Michael Niedermayer 292e41ce65 avcodec/tiff: Disallow striped and tiled tiffs except for DNG 
strips + tiles is not allowed in TIFF
DNG uses a separate codepath

Regression since da5b3d0028.

Fixes: NULL pointer dereference
Fixes: poc1
Fixes: Ticket8960

Found-by: 1vanChen of NSFOCUS Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-28 19:36:57 +01:00
Michael Niedermayer 654b21ef17 avformat/mpegts: Fix argument type for av_log 
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-28 19:36:57 +01:00
Michael Niedermayer 93bf8004d1 avformat/mxfdec: Do not clear arrays in mxf_read_index_entry_array() 
They are written too immediately, so it should not be needed.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-28 19:34:40 +01:00
Michael Niedermayer aea8d4061d avformat/swfdec: Allocate output buffer after reading input 
Fixes: Timeout (>10sec -> 0.26sec)
Fixes: 27419/clusterfuzz-testcase-minimized-ffmpeg_dem_SWF_fuzzer-5678307361947648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-24 15:25:00 +01:00
Michael Niedermayer 684aec6a68 avformat/cafdec: clip sample rate 
Fixes: 1.21126e+111 is outside the range of representable values of type 'int'
Fixes: 27398/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5412960339755008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-24 15:25:00 +01:00
Michael Niedermayer 0d4e8e4c97 tools/target_dec_fuzzer: Adjust maxpixels for G2M 
Fixes: Timeout (50sec -> 3sec)
Fixes: 27383/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5196953666977792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-24 15:25:00 +01:00
Michael Niedermayer 5cae71d2b7 avcodec/ffv1dec: Fix off by 1 error with quant tables 
Fixes: assertion failure
Fixes: 28447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-5369575948550144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-22 00:30:50 +01:00
Michael Niedermayer c0e660ba14 avformat/mpegts: simplify nb_packets code 
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-22 00:30:50 +01:00
Michael Niedermayer ef7b117b7b avformat/mpegts: Increase pcr_incr width to 64bit 
Fixes: division by zero
Fixes: 26459/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5666350112178176
Fixes: 28154/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5195728439476224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-22 00:30:50 +01:00
Michael Niedermayer 2749e20d04 avcodec/fastaudio: Fix invalid shift exponent 
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 25434/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FASTAUDIO_fuzzer-6252363168612352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-19 23:19:29 +01:00
Michael Niedermayer f58d0d5bec tools/target_dem_fuzzer: remove unused label 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-19 20:07:56 +01:00
Michael Niedermayer 8aadae670f avcodec/utils: Check bitrate for overflow in get_bit_rate() 
Fixes: signed integer overflow: 617890810133996544 * 16 cannot be represented in type 'long'
Fixes: 26565/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5092054700654592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-19 20:07:56 +01:00
Michael Niedermayer 0afbaabdca avformat/mov: Check if hoov is at the end 
Fixes: Timeout, probably infinite loop
Fixes: 26559/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5391165484171264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-19 20:07:56 +01:00
Michael Niedermayer ad20a4f92b avcodec/hevc_ps: Change scaling_list_dc_coef to 8 bit 
Suggested-by: James
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-19 20:07:56 +01:00
Michael Niedermayer f1700bd8bb avcodec/hevc_ps: check scaling_list_dc_coef 
Fixes: signed integer overflow: 2147483640 + 8 cannot be represented in type 'int'
Fixes: 28449/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5686013259284480

Reviewed-by: James Almer <jamrial@gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-19 20:07:56 +01:00
Michael Niedermayer ef59a40c2a avformat/url: Change () position in ff_make_absolute_url() 
No testcase
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-16 22:45:28 +01:00
Michael Niedermayer 001bc594d8 avformat/iff: Check data_size 
Fixes: infinite loop
Fixes: 27834/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5694930919620608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-12 00:13:58 +01:00
Michael Niedermayer 7b88dd8f0c avformat/matroskadec: Sanity check codec_id/track type 
Fixes: memleak
Fixes: 27766/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-5198300814508032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-09 21:41:15 +01:00
Michael Niedermayer 0677bdb1f5 avformat/rpl: Check the number of streams 
Fixes: out of memory access
Fixes: 27787/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-4743666463408128.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-09 21:41:15 +01:00
Michael Niedermayer b1bced5433 avformat/vividas: Check sample_rate 
Fixes: Assertion c > 0 failed at libavutil/mathematics.c
Fixes: 27001/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5726041328582656
Fixes: 27453/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5716060384526336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-09 21:41:15 +01:00
Michael Niedermayer b29d351f97 avformat/vividas: Make len signed 
Fixes: out of array access
Fixes: 27424/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5682070692823040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-09 21:41:15 +01:00
Michael Niedermayer 51dfd6f1bd avcodec/h264idct_template: Fix integer overflow in ff_h264_chroma422_dc_dequant_idct() 
Fixes: signed integer overflow: -2105540608 - 2105540608 cannot be represented in type 'int'
Fixes: 26870/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5656647567147008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-06 21:00:03 +01:00
Michael Niedermayer 65b8974d54 avformat/dsfdec: Check block_align more completely 
Fixes: infinite loop
Fixes: 26865/clusterfuzz-testcase-minimized-ffmpeg_dem_DSF_fuzzer-5649473830912000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-06 21:00:03 +01:00
Michael Niedermayer 76b6c46a81 avformat/av1dec: check size before addition in probing 
Fixes: signed integer overflow: 175 + 2147483571 cannot be represented in type 'int'
Fixes: 26833/clusterfuzz-testcase-minimized-ffmpeg_dem_IMAGE2_fuzzer-5969501214212096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-06 21:00:03 +01:00
Michael Niedermayer 47c146a56b avformat/realtextdec: read_ts() in 64bits 
Fixes: signed integer overflow: 46671062 * 100 cannot be represented in type 'int'
Fixes: 26826/clusterfuzz-testcase-minimized-ffmpeg_dem_REALTEXT_fuzzer-5644062910316544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-06 21:00:03 +01:00
Michael Niedermayer fef17e8928 avcodec/cdgraphics: Check frame before clearing 
Fixes: null pointer dereference
Fixes: 27730/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CDGRAPHICS_fuzzer-6212402236096512

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-05 00:08:33 +01:00
Michael Niedermayer 4f66dd13d0 avformat/mpc8: Check remaining space in mpc8_parse_seektable() 
Fixes: Fixes infinite loop
Fixes: 26704/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6327056939614208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-05 00:08:33 +01:00
Michael Niedermayer 72ca9f38e4 avformat/wavdec: Check for EOF in cues reading 
Fixes: Timeout (>20sec -> 1ms)
Fixes: 26793/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-5674966852567040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-05 00:08:33 +01:00
Michael Niedermayer a834af133b avformat/vqf: Check len for COMM chunks 
Fixes: Infinite loop
Fixes: 26696/clusterfuzz-testcase-minimized-ffmpeg_dem_VQF_fuzzer-5648269168082944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-05 00:08:33 +01:00
Michael Niedermayer c34004d82f avformat/mov: Use av_sat_add64() in mov_read_sidx() 
This avoids a potential integer overflow, no testcase is known

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-05 00:08:33 +01:00
Michael Niedermayer 7d75ecf8d2 avformat/mov: Avoid overflow in end computation in mov_read_custom() 
Fixes: signed integer overflow: 18 + 9223372036854775799 cannot be represented in type 'long'
Fixes: 26731/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5696846019952640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-05 00:08:33 +01:00
Michael Niedermayer d7f87a4b9e avformat/id3v2: Sanity check tlen before alloc and uncompress 
Fixes: Timeout (>20sec -> 65ms)
Fixes: 26896/clusterfuzz-testcase-minimized-ffmpeg_dem_DAUD_fuzzer-5691024049176576
Fixes: 27627/clusterfuzz-testcase-minimized-ffmpeg_dem_AEA_fuzzer-4907019324358656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-12-05 00:08:33 +01:00
Michael Niedermayer 7cf852b03c avcodec/hevc_cabac: Limit value in coeff_abs_level_remaining_decode() tighter 
The max depth is 16bps, the max allowed coefficient depth is depth+6
Fixes: signed integer overflow: 1074266112 + 1073725439 cannot be represented in type 'int'
Fixes: 26493/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5657763331702784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-29 16:10:56 +01:00
Michael Niedermayer 9dc3301745 avformat/cafdec: Check the return code from av_add_index_entry() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-29 16:10:56 +01:00
Michael Niedermayer eb46939e3a avformat/cafdec: Check for EOF in index read loop 
Fixes: OOM
Fixes: 27398/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-541296033975500

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-29 16:10:55 +01:00
Michael Niedermayer 5eed718087 avformat/cafdec: Check that bytes_per_packet and frames_per_packet are non negative 
These fields are not signed in the spec (1.0) so they cannot be negative
Changing bytes_per_packet to unsigned would not solve this as it is exported
as block_align which is signed

Fixes: Infinite loop
Fixes: 26492/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5632087614554112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-29 16:10:55 +01:00
Michael Niedermayer 4bdb7966fa avformat/mpegts: Limit iterations of get_packet_size() 
This is a pathological case where the fuzzer provides only 2 bytes per iteration.

Fixes: Timeout (>30 -> 0.9sec)
Fixes: 26488/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTS_fuzzer-5911031077142528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-29 16:10:55 +01:00
Michael Niedermayer 3f6653efdb avcodec/notchlc: Check available space for luma block code and alpha code 
Fixes: Timeout (too long -> 2sec)
Fixes: 25439/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-5688211127664640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-29 16:10:55 +01:00
Michael Niedermayer 81503ac58a avcodec/utils: Require a non zero channels unless AV_CODEC_CAP_CHANNEL_CONF is set 
This avoids per codec checks for channels not being 0

Fixes: division by 0
Fixes: 25419/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FASTAUDIO_fuzzer-5632544761184256
Fixes: 25433/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FASTAUDIO_fuzzer-6215671900536832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Paul B Mahol <onemda@gmail.com>
See: [FFmpeg-devel] [PATCH 1/3] avcodec/fastaudio: Check channel
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-28 00:41:51 +01:00
Michael Niedermayer 34f5a59ad5 avcodec: Set AV_CODEC_CAP_CHANNEL_CONF in more decoders 
Suggested-by: Paul B Mahol <onemda@gmail.com>
See: [FFmpeg-devel] [PATCH 1/3] avcodec/fastaudio: Check channels
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-28 00:41:51 +01:00
Michael Niedermayer 0897402ac8 avformat/mpc8: correct integer overflow in mpc8_parse_seektable() 
Fixes: signed integer overflow: -4683718486770919638 * 2 cannot be represented in type 'long'
Fixes: 26704/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6327056939614208
Fixes: 27550/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6259212652642304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-27 00:25:42 +01:00
Michael Niedermayer ad3e495657 avformat/mpc8: correct 32bit timestamp truncation 
Fixes: left shift of 65536 by 15 places cannot be represented in type 'int'
Fixes: 26801/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-5164313092030464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-27 00:25:42 +01:00
Michael Niedermayer 3b8a263c4f avformat/mov: Fix memleak in dref reading 
Fixes: leak in mov_read_dref()
Fixes: 26698/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5638785444085760
Fixes: 27554/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6256643054239744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-27 00:25:42 +01:00
Michael Niedermayer b0a8b40294 avcodec/exr: skip bottom clearing loop when its outside the image 
Fixes: signed integer overflow: 1633771809 * 32960 cannot be represented in type 'int'
Fixes: 26532/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5613925708857344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-22 17:45:17 +01:00
Michael Niedermayer 3e5959b345 avcodec/exr: Check ymin vs. h 
Fixes: out of array access
Fixes: 26532/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5613925708857344
Fixes: 27443/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5631239813595136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-22 17:45:17 +01:00
Michael Niedermayer 1278f117d7 avformat/avs: Use 64bit for the avio_tell() output 
Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented in type 'long'
Fixes: 26549/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS_fuzzer-4844306424397824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-22 17:45:17 +01:00
Michael Niedermayer 40348637be avformat/moflex: Check pkt_size 
Fixes: Timeout (>20sec -> 1ms)
Fixes: 26527/clusterfuzz-testcase-minimized-ffmpeg_dem_MOFLEX_fuzzer-6308307310215168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-22 17:45:17 +01:00
Michael Niedermayer a108a4d809 avcodec/mobiclip: Check mv against INT_MAX 
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 27369/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-5083469356728320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-21 22:09:51 +01:00
Michael Niedermayer a207df2acb avformat/wavdec: More complete size check in find_guid() 
Fixes: signed integer overflow: 9223372036854775807 + 8 cannot be represented in type 'long'
Fixes: 27341/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5442833206738944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-21 22:09:51 +01:00
Michael Niedermayer 2eb6417417 avcodec/mv30: Use unsigned in idct_1d() 
Fixes: signed integer overflow: 2110302399 + 39074947 cannot be represented in type 'int'
Fixes: 27330/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MV30_fuzzer-5664923153334272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-21 22:09:51 +01:00
Michael Niedermayer 8b50e8bc29 avformat/iff: Check size before skip 
Fixes: Infinite loop
Fixes: 27292/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5731168991051776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-21 22:09:51 +01:00
Michael Niedermayer ebf4bc629e avformat/rmdec: Check for EOF in index packet reading 
Fixes: Timeout(>10sec -> 1ms)
Fixes: 27284/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6304211110985728

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-21 22:09:51 +01:00
Michael Niedermayer cb59cd3466 tools/target_dec_fuzzer: Call avcodec_flush_buffers() in a fuzzer choosen pattern 
This should increase coverage

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
 2020-11-20 12:43:51 -03:00
Michael Niedermayer c7e775f712 avcodec/vp3dsp: Use unsigned constant to avoid undefined integer overflow in ff_vp3dsp_set_bounding_values() 
Fixes: signed integer overflow: 64 * 33686018 cannot be represented in type 'int'
Fixes: 26911/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-4904975073017856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-13 18:01:54 +01:00
Michael Niedermayer b33233bd53 avformat/icodec: Check for zero streams and stream creation failure 
Fixes: NULL pointer dereference
Fixes: 26814/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-5758487797432320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-13 17:46:47 +01:00
Michael Niedermayer 27ee67c00f avformat/icodec: Factor failure code out in read_header() 
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-13 17:46:47 +01:00
Michael Niedermayer f6dc285fb5 avformat/bintext: Check width 
Fixes: division by 0
Fixes: 26780/clusterfuzz-testcase-minimized-ffmpeg_dem_ADF_fuzzer-5117945027756032
Fixes: 26998/clusterfuzz-testcase-minimized-ffmpeg_dem_ADF_fuzzer-5119352359354368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-11 17:05:24 +01:00
Michael Niedermayer 9ef60a66f1 avformat/sbgdec: Check that end is not before start 
Fixes: signed integer overflow: -9223372036854775808 + -5279949906739200 cannot be represented in type 'long'
Fixes: 26908/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6329610851319808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-11 17:05:24 +01:00
Michael Niedermayer b1d99ab14f avformat/lvfdec: Check stream_index before use 
Fixes: assertion failure
Fixes: 26905/clusterfuzz-testcase-minimized-ffmpeg_dem_LVF_fuzzer-5724267599364096.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-10 16:37:37 +01:00
Michael Niedermayer d16974c3dd avformat/au: cleanup on EOF return in au_read_annotation() 
Fixes: memleak
Fixes: 26841/clusterfuzz-testcase-minimized-ffmpeg_dem_AU_fuzzer-5174166309044224
Regression since: e680d50eb4
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-10 16:37:37 +01:00
Michael Niedermayer 8fbcc546b8 tools/target_dem_fuzzer: Consider it an EIO when reading position wraps around 64bit 
Fixes: signed integer overflow: 9223372036854775807 + 564 cannot be represented in type 'long'
Fixes: 26494/clusterfuzz-testcase-minimized-ffmpeg_dem_VOC_fuzzer-576754158849228
Fixes: 26549/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS_fuzzer-4844306424397824
FIxes: 26875/clusterfuzz-testcase-minimized-ffmpeg_dem_C93_fuzzer-5996226782429184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-07 20:50:33 +01:00
Michael Niedermayer 79cf7c7191 avformat/mpegts: Limit copied data to space 
Fixes: out of array access
Fixes: 26816/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-6282861159907328.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-07 20:10:51 +01:00
Michael Niedermayer 442d53f409 avformat/bintext: Check width in idf_read_header() 
Fixes: division by 0
Fixes: 26802/clusterfuzz-testcase-minimized-ffmpeg_dem_IDF_fuzzer-5180591554953216.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-04 23:38:36 +01:00
Michael Niedermayer f291cd681b avformat/iff: check size against INT64_MAX 
Bigger sizes are misinterpreted as negative numbers by the API
Fixes: infinite loop
Fixes: 26611/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4890614975692800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-04 23:38:36 +01:00
Michael Niedermayer 27a99e2c7d avformat/vividas: improve extradata packing checks in track_header() 
Fixes: out of array accesses
Fixes: 26622/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-6581200338288640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-04 23:30:53 +01:00
Michael Niedermayer 437b7302b0 avformat/paf: Check for EOF in read_table() 
Fixes: OOM
Fixes: 26528/clusterfuzz-testcase-minimized-ffmpeg_dem_PAF_fuzzer-5081929248145408
Fixes: 26584/clusterfuzz-testcase-minimized-ffmpeg_dem_PAF_fuzzer-5172661183053824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-04 23:30:53 +01:00
Michael Niedermayer dad9a86ca7 avformat/gxf: Check pkt_len 
Fixes: Infinite loop
Fixes: 26576/clusterfuzz-testcase-minimized-ffmpeg_dem_GXF_fuzzer-4823080360476672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-04 23:30:53 +01:00
Michael Niedermayer 0ba71a72d3 avformat/aiffdec: Check packet size 
Fixes: Fixes infinite loop
Fixes: 26575/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-5727522236661760

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-04 23:30:53 +01:00
Michael Niedermayer 66ca6d0fe8 libavformat/aviobuf: Forward error from avio_read in ffio_read_size() 
Suggested-by: Andreas Rheinhardt
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-04 23:30:53 +01:00
Michael Niedermayer 441fd1bd7d avformat/rmdec: remove unneeded memset() on packet allocation 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-04 23:30:53 +01:00
Michael Niedermayer bbba41704b avcodec/magicyuv: Free previous VLC table 
Fixes: memleak
Fixes: 26788/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_fuzzer-5184116808744960

Regression since: 1bf30a1beb

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-03 00:46:59 +01:00
Michael Niedermayer 2610acb49a avformat/concatdec: use av_strstart() 
Fixes: out array read
Fixes: 26610/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-5631838049271808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-11-03 00:46:59 +01:00
Michael Niedermayer 7b2244565a avformat/wavdec: Refuse to read chunks bigger than the filesize in w64_read_header() 
Fixes: OOM
Fixes: 26414/clusterfuzz-testcase-minimized-ffmpeg_dem_FWSE_fuzzer-5070632544632832
Fixes: 26475/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5770207722995712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-10-30 17:49:51 +01:00
Michael Niedermayer c79d8a6851 avformat/rsd: Check size and start before computing duration 
Fixes: signed integer overflow: 100794754 * 28 cannot be represented in type 'int'
Fixes: 26474/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-5181797606096896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-10-30 17:49:51 +01:00
Michael Niedermayer b848baef0d avformat/vividas: better check of current_sb_entry 
This is the simplest fix for the problem, it is possible to instead check
this when the variables are set and propagate errors and then fail earlier

Fixes: out of array access
Fixes: 26490/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5723367078100992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-10-30 17:49:51 +01:00
Michael Niedermayer 3588e2e6b0 avformat/iff: More completely check body_size 
Fixes: infinite loop
Fixes: 26485/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5126561373880320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-10-30 17:49:51 +01:00
Michael Niedermayer d5c42b8c08 avformat/vividas use avpriv_set_pts_info() 
Fixes: assertion failure
Fixes: 26482/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-4905102324006912
Fixes: 26491/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-6002953141616640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-10-30 17:46:34 +01:00
Michael Niedermayer 44b18a76b8 avformat/xwma: Check for EOF in dpds_table read code 
Fixes: Timeout (>30 -> 140ms)
Fixes: 26478/clusterfuzz-testcase-minimized-ffmpeg_dem_XWMA_fuzzer-5918147066200064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-10-30 17:46:34 +01:00
Michael Niedermayer ec7e0d4288 avcodec/utils: Check sample rate before use for AV_CODEC_ID_BINKAUDIO_DCT in get_audio_frame_duration() 
Fixes: shift exponent 95 is too large for 32-bit type 'int'
Fixes: 26590/clusterfuzz-testcase-minimized-ffmpeg_dem_SMACKER_fuzzer-5120609937522688

Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-10-29 20:42:48 +01:00