Welcome to mirror list, hosted at ThFree Co, Russian Federation.

github.com/FFmpeg/FFmpeg.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
path: root/libavcodec
AgeCommit message (Collapse)Author
2020-07-03avcodec/dstdec: Replace AC overread check by sample rate checkMichael Niedermayer
Real files do skip coding 0 bits at the end, thus this kind of check does not work reliable. Fixes: Ticket 8770 Fixes: dst-256fs44-6ch-refdstencoder.dff The samplerate is specified in ISO/IEC 14496-3:2005(E) as one of 3 fixed values, this also can be used to limit the duration and avoid the timeout This reverts commit f6df99dba1ae64b05d08fba8160d13eb9795042f. (cherry picked from commit 1679f23beb3cfc3639352b3cbe7c08c00189c6b0) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-02avcodec/hevc_mp4toannexb_bsf: Check NAL size against available inputAndreas Rheinhardt
The hevc_mp4toannexb bsf does not explicitly check whether a NAL unit is so big that it extends beyond the end of the input packet; it does so only implicitly by using the checked version of the bytestream2 API. But this has downsides compared to real checks: It can lead to huge allocations (up to 2GiB) even when the input packet is just a few bytes. And furthermore it leads to uninitialized data being output. So add a check to error out early if it happens. Also check directly whether there is enough data for the length field. Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit ea1b71e82f5a1752d59d3bfb9704092a79eba6b5) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-02avcodec/ttaenc: Fix undefined shiftAndreas Rheinhardt
ttaenc contained (1 << unary) - 1 as an argument for a function expecting an unsigned int. unary can be as big as 31 in this case. The type of the shift and the whole expression is int, because 1 fits into an integer, so that the behaviour is undefined if unary == 31 as the result of the shift can't be represented in an int §. Subtraction by 1 (which makes the result of the whole expression representable in an int) doesn't change that this is undefined (it usually leads to signed integer overflow which is undefined, too). The solution is simple: Make 1 unsigned to change the type of the whole expression to unsigned int (as the function expects anyway). Fixes ticket #8153. §: This of course presupposes the common int range of -2^31..2^31-1 Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 3ab488a5407f833ecc66e8fa4c537dc4852db720) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-02avcodec/jpeg2000dwt: Fix undefined shifts of negative numbersAndreas Rheinhardt
Affected the vsynth*-jpeg2000 and the vsynth*-jpeg2000-97 FATE tests (where * ranges over { 1, 2, 3, _lena }) as well as ticket #7983. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 5cf593adcd79a7c9502dc2725e1f0681ada36aef) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-02avcodec/ituh263dec: Fix undefined left shift of negative numberAndreas Rheinhardt
Fixes ticket #8160. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 324487b596fbcda0a5753c7bb7b2e96e9d512479) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-02avcodec/dnxhdenc: Fix undefined left shifts of negative numbersAndreas Rheinhardt
Affected 61 FATE-tests: 60 vsynth tests and lavf-mxf_opatom. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit b7f156e8cbdf3256c7860c62ebb7a6c3002cbb03) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-02avcodec/exr: Fix undefined left shifts of negative numbersAndreas Rheinhardt
Affected the FATE-tests exr-rgb-scanline-pxr24-half-uint32-13x9 and exr-rgb-scanline-pxr24-uint32. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 8b0f949906116c40b6f1e55a1bce4447ada3219c) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-02avcodec/pcm: Fix undefined shiftsAndreas Rheinhardt
Fixes the acodec-pcm-u16[lb]e FATE-tests. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 69473bec6f38fefc9a433d95f8e00de101299592) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-02avcodec/wavpackenc: Fix undefined shiftsAndreas Rheinhardt
Fixes ticket #8161 and the acodec-wavpack FATE-test. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 84974c6fb542cf019904016c2165d9a62db9f312) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-02avcodec/ac3enc: Fix invalid shiftAndreas Rheinhardt
Fixes the FATE-tests unknown_layout-ac3, ac3-fixed-encode, ac3-encode and eac3-encode. It furthermore fixes the ac3-encoder bugs mentioned in tickets #7994, #8144 and #8159. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 2f289ec914cc7e8133858d4f9e8d91dab685ae44) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-02avcodec/tdsc: Fix undefined shiftsAndreas Rheinhardt
Fixes the tdsc FATE-test. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 86bef10e7aee338a4df60c57904c16e33509e76e) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-02avcodec/cinepakenc: Fix invalid shiftsAndreas Rheinhardt
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'. Affected the FATE-tests vsynth1-cinepak, vsynth2-cinepak and vsynth_lena-cinepak. Also fixes ticket #8220. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit e3650dcfc9cde6ceccf7bbc225962da196e2a386) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-02avcodec/cbs_h2645: Fix potential out-of-bounds array accessAndreas Rheinhardt
The maximum allowed index for an array access is FF_ARRAY_ELEMS - 1; yet the current code allowed FF_ARRAY_ELEMS. This wasn't dangerous in practice, as parameter sets with invalid ids were already filtered out during reading. Found via PVS-Studio (see ticket #8156). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit f3333c3c67e8825a4468120bb8aa0943c72c03f3) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-02h264_redundant_pps: Fix memleak in case of errorsAndreas Rheinhardt
Now the fragment is uninitialized and the input packet freed in case of errors. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@googlemail.com> Signed-off-by: Mark Thompson <sw@jkqxz.net> (cherry picked from commit 40b74abfca39bf514333c3ebb6d6e946975057c3) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-02avcodec/cavsdsp: Fix undefined left shifts of negative numbersAndreas Rheinhardt
Affected the ffmpeg-filter_colorkey FATE-test (but only if the C version of idct8_add is used and not e.g. the x86 SSE2 version). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Fixes: left shift of negative value -107 Fixes: 20398/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5725389278412800 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 0f0f2ab0c3b3d04e904db97b07ae829c72c91778) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-02avcodec/ra144enc: Fix invalid left shift of negative numberAndreas Rheinhardt
by replacing it with a multiplication. Said multiplication can't overflow an int32_t because lpc_coefs is limited to 16 bit precision. Fixes the FACE-test acodec-ra144 as well as part of #8217. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit e3fb9af6f1353f30855eaa1cbd5befaf06e303b8) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-02avcodec/adxenc: Avoid undefined left shift of negative numbersAndreas Rheinhardt
Replace "((a << shift) + b) >> shift" by "a + (b >> shift)". This avoids a left shift which also happens to trigger undefined behaviour in case "a" is negative. This affected the FATE-tests acodec-adpcm-adx and acodec-adpcm-adx-trellis; it also fixes ticket #8008. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 59a9d65e0d790821f88527a82569f56eb2f8a9be) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-02avcodec/adpcm: Fix undefined left shifts of negative numbersAndreas Rheinhardt
Affected the adpcm-afc, adpcm-ea-1, adpcm-ea-2, adpcm-ea-maxis-xa, adpcm-thp and ea-cdata FATE-tests. Also fixes ticket #8487. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 3ad8af51b7c0a968ac3fd62964780d4ff9136c5a) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-02avcodec/proresenc_anatoliy: Fix invalid left shift of negative numberAndreas Rheinhardt
This fixes ticket #7997 as well as the vsynth*-prores_# FATE-tests (where * ranges over { 1, 2, 3, _lena } and # over { , _int, _444, _444_int }). (Given that prev_dc is in the range -0xC000..0x3FFF, no overflow can happen upon multiplication with 2.) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 198081efb7c7343349f0a7acc836f001c511e990) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-01avcodec/bitstream: Don't check for undefined behaviour after it happenedAndreas Rheinhardt
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 5e196dac22cc510db104922f99626a03b453ef4a) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-07-01avcodec/pngdec: Check for fctl after idatMichael Niedermayer
Fixes: out of array access Fixes: 23554/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-4796622520451072.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 65b1ba680fb67902a9c876a49d0146eaae5a1c3d) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/wmalosslessdec: fix overflow with pred in revert_cdlmsMichael Niedermayer
Fixes: signed integer overflow: 2048 + 2147483646 cannot be represented in type 'int' Fixes: 23538/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5227567073460224 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 21598d711d894081d0566282473044ba4f378f33) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/ffwavesynth: Avoid undefined operation on ts overflowMichael Niedermayer
Alternatively these conditions could be treated as errors Fixes: 23147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5639254549200896 Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'int64_t' (aka 'long') Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 584d334afd59714ed04637a9227a4f1368c26166) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/mpeg4videodec: Fix 2 integer overflows in get_amv()Michael Niedermayer
Fixes: signed integer overflow: -144876608 * 16 cannot be represented in type 'int' Fixes: 22782/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-6039584977977344 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit e361785ee05cc75d3caacf2f254160b0336f5358) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/lossless_audiodsp: Fix undefined overflows in ↵Michael Niedermayer
scalarproduct_and_madd_int16_c() Fixes: signed integer overflow: 2142077091 + 6881070 cannot be represented in type 'int' Fixes: 22737/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5958388889681920 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit c0dfe134beefde4070d43910518b1f4a58f01794) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/sonic: Fix several integer overflowsMichael Niedermayer
Fixes: signed integer overflow: 2129689466 + 2129689466 cannot be represented in type 'int' Fixes: 20715/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5155263109922816 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 75d520e33704447f1b29ac47fd9e40994a6bc659) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/mpeg4videodec: avoid invalid values and reinitialize in format ↵Michael Niedermayer
changes for studio profile Fixes: out of array access Fixes: 23327/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5134822992510976 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit e53235f06c229a23d3241b47e32647019161fb7c) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/pixlet: Fix log(0) checkMichael Niedermayer
Fixes: passing zero to clz(), which is not a valid argument Fixes: 23337/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PIXLET_fuzzer-5179131989065728 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit bd0f81526d3f4c23ecd0a399829103be2445c011) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/iff: Fix off by x errorMichael Niedermayer
Fixes: out of array access Fixes: 23245/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5723121327013888.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 51225dee0a6266780d26d43bd6802bbcf736327e) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/wmalosslessdec: Check block_align maximumMichael Niedermayer
Fixes: Assertion failure Fixes: 22737/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5958388889681920 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 314d10f7a60f1786c85da30a569be61e2b906fef) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/loco: Fix signed integer overflow in loco_get_rice()Michael Niedermayer
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int' Fixes: 22975/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5658160970072064 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit aa88cdfd90f5da0683cd6556c75a5ba5740a1c27) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/mpeg12dec: remove outdated commentsMichael Niedermayer
Found-by: Kieran Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 48de8f5816aa54dc584aeb2dbbf63a0e880279e2) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/snowdec: Avoid integer overflow with huge qlogMichael Niedermayer
Fixes: integer overflow Fixes: 22285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5682428762128384 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 38fbf33c7255b503453052c32ab5ae4fb151b29e) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/mpeg12dec: Fix got_outputMichael Niedermayer
This makes got_output consistent with the code in slice_end() which sets the output in slice_end() if (s->pict_type == AV_PICTURE_TYPE_B || s->low_delay) { int ret = av_frame_ref(pict, s->current_picture_ptr->f); ... } else { Fixes: assertion failure Fixes: 22178/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5664234440753152 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 4f33a9803a3068ce2d52289fc1db60375dc8b7a5) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/lzf: Consider the needed size in reallocationMichael Niedermayer
Fixes: NULL pointer dereference Fixes: 22381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-5659879921680384.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 292b9b93a50aa0622e33013de9f2ddc130bef671) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/adpcm: XA: Check shift similar to filterMichael Niedermayer
Fixes: negative shift Fixes: 22499/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_XA_fuzzer-5765452130418688 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 6d96bae9c480e020e9f51fabd5642d7ae6020943) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/huffyuvdec: Test vertical coordinate more oftenMichael Niedermayer
Fixes: out of array access Fixes: 22892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-5135996772679680.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit a1223ddc5692772198a02600ecff2545f32b37be) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/hq_hqa: Check info sizeMichael Niedermayer
Fixes: assertion failure Fixes: 21079/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-5737046523248640 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit cf28521fee22dbe2f7eeb8ab0306c0fd0802c48a) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/wmalosslessdec: Fix integer overflow in mclms_predict()Michael Niedermayer
Fixes: signed integer overflow: 2147483636 + 2048 cannot be represented in type 'int' Fixes: 22016/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5109395618004992 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit c42ed06695848617350a94543823e850f190b3ab) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/vp9dsp_template: Fix integer overflow(s) in iadst16_1d()Michael Niedermayer
Fixes: signed integer overflow: 1080285923 - -1130879337 cannot be represented in type 'int' Fixes: 22002/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-6260237310099456 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 071e2937236945c168ab99d3e3b01539194466dd) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/h264dec: Disable forced small_padding on flag2 fastMichael Niedermayer
Fixes: 20978/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5746381832847360 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/pnmdec: Use unsigned for maxval rescalingMichael Niedermayer
Fixes: signed integer overflow: 65535 * 55335 cannot be represented in type 'int' Fixes: 21955/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-5669206981083136 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 49459aca47d4803b2188fbf12b758bd2b01e91d7) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/ivi: Clear got_p_frame before decoding a new frame using itMichael Niedermayer
Fixes: assertion failure Fixes: 21666/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-5706468994318336 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 1d633e6a0a61118c9b2d1785d96bdebaa8c38592) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/dsddec: Check channelsMichael Niedermayer
Fixes: division by zero Fixes: 21677/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DSD_MSBF_fuzzer-5712547983654912 Fixes: 21751/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DSD_LSBF_fuzzer-5197097180856320 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 2570a8777e7095358b10f679d35641e114a2ab33) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/xvididct: Fix integer overflow in idct_row()Michael Niedermayer
Fixes: signed integer overflow: -1238335488 + -1003634688 cannot be represented in type 'int' Fixes: 21649/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5112005765890048 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 620236e4d2ac46821911b99fa4551868675d4ed9) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/wmalosslessdec: Fix integer overflows in revert_inter_ch_decorr()Michael Niedermayer
Fixes: signed integer overflow: -717241856 + -1434459904 cannot be represented in type 'int' Fixes: 21405/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5677143666458624 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit e9a4c4fe9918220be492a4a9d74c2293fd706be3) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/cbs_h265_syntax_template: Limit num_long_term_pics more strictlyMichael Niedermayer
The limit is based on hevcdec.c Fixes: 20854/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-5160442882424832 Fixes: out of array access Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 435fa373d1f5045b17de74934e44863e2fb3071f) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01mpeg4videoenc: Don't crash with -fsanitize=boundsVitaly Buka
Also the patch makes this code consistent with mpeg4videodec.c Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit f163d30de2090a7275f1fb8ad69258576f12c1a2) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/binkaudio: Fix 2Ghz sample_rateMichael Niedermayer
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int' Fixes: 19950/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINKAUDIO_DCT_fuzzer-5765514337189888 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Suggested-by: Paul Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit f603d10b1e6bb2fbf4dcccc43d3ea2fb911b36ba) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-01avcodec/adpcm: Fix integer overflow in ADPCM THPMichael Niedermayer
The reference (thp.txt) uses floats so wrap around would seem incorrect. Fixes: signed integer overflow: 1073741824 + 1073741824 cannot be represented in type 'int' Fixes: 20658/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_THP_fuzzer-5646302555930624 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit b12b05374f7025167e2c43449ceb8ba3f0a6083f) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-09 11:48:23 +0300