Welcome to mirror list, hosted at ThFree Co, Russian Federation.

github.com/FFmpeg/FFmpeg.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
path: root/libavcodec
AgeCommit message (Collapse)Author
2021-02-02avcodec/exr: Check line size for overflowMichael Niedermayer
Fixes: signed integer overflow: 570425356 * 6 cannot be represented in type 'int Fixes: 25929/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5099197739827200 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 9b72cea4463dd2fabcd9ba1454a0855e521d0148) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/exr: Check xdelta, ydeltaMichael Niedermayer
Fixes: assertion failure Fixes: 25617/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5648746061496320 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 6949df35d0c69ae91bb0f49069e0703deb9bd676) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/celp_filters: Avoid invalid negation in ff_celp_lp_synthesis_filter()Michael Niedermayer
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself Fixes: 25675/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G729_fuzzer-4786580731199488 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 11a6347f9e544a1b9fba059ae02c30c0e512c195) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/takdsp: Fix negative shift in decorrelate_sf()Michael Niedermayer
Fixes: left shift of negative value -4 Fixes: 25723/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-6250580752990208 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 4f54f530039db149808478796e8389c14eb73095) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/dxtory: Fix negative stride shift in dx2_decode_slice_420()Michael Niedermayer
Fixes: left shift of negative value -640 Fixes: 26044/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXTORY_fuzzer-5631057602543616 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 3291d994b76db4b6e67c8467367ce68f79785e60) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/vc1_block: Fix integer overflow in ac valueMichael Niedermayer
Fixes: signed integer overflow: 25488 * 87381 cannot be represented in type 'int' Fixes: 24765/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5108259565076480 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 3056e19e68122b9464b24870488f8faca4e78ea8) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/mv30: Fix several integer overflows in idct_1d()Michael Niedermayer
Fixes: signed integer overflow: -1846510390 + -361755993 cannot be represented in type 'int' Fixes: 23941/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MV30_fuzzer-5654696631730176 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit ddf2ba54979387740b0b2fb319bb5a2c9f78debe) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/dxtory: Fix negative shift in dx2_decode_slice_410()Michael Niedermayer
Fixes: left shift of negative value -768 Fixes: 25574/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXTORY_fuzzer-6012596027916288 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit abebd87764992dc22c82802bdc75d40aac14ab86) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/sonic: Check channels before deallocatingMichael Niedermayer
Fixes: heap-buffer-overflow Fixes: 25744/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5172961169113088 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit f249981976b18438cfb646183d4c21fb051e1ad4) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/ansi: Check nb_args for overflowMichael Niedermayer
Fixes: Integer overflow (no testcase) Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit bc0e776c9aaf06f437bf21e05a713fd54dc85400) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/tiff: Fix default white levelMichael Niedermayer
According to the spec bits per sample should be used Fix invalid shift with bpp=32 Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int' Fixes: 23507/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4815432665268224 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit d54c24acde88a214489d5ef410982eedac7ffc29) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/diracdsp: Fix integer anomaly in dequant_subband_*Michael Niedermayer
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself Fixes: 23760/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-604209011412172 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit ca3c6c981aa5b0af8a5576020b79fdd3cdf9ae9e) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/mv30: Check remaining mask in decode_inter()Michael Niedermayer
Fixes: timeout (too long -> 4sec) Fixes: 25129/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MV30_fuzzer-5642089713631232 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 142ae27b1d4d23b72396950ebaaeaca10ba600d9) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/wmalosslessdec: Check remaining space before padding and channel residueMichael Niedermayer
Fixes: Timeout (1101sec -> 0.4sec) Fixes: 24491/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5725337036783616 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit c467adf3bf9bb4b7fd28956ec698d884e63f145d) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/mpc: Fix multiple numerical overflows in ff_mpc_dequantize_and_synth()Michael Niedermayer
Fixes: -2.4187e+09 is outside the range of representable values of type 'int' Fixes: signed integer overflow: -14512205 + -2147483648 cannot be represented in type 'int' Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC7_fuzzer-5747263166480384 Fixes: 23528/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC7_fuzzer-5747263166480384 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 2b9f39689ab19c68ff37b5a4ac71e8fb7f58c487) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/agm: Fix off by 1 error in decode_inter_plane()Michael Niedermayer
Fixes: Regression since 1f2096945709a32315da740691b5716da55893c3 Found-by: Paul B Mahol <onemda@gmail.com> Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 6d71a25cc460960c49997d52c1d1f1c39ccc38b4) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/ffwavesynth: Fix integer overflow in wavesynth_synth_sample / WS_SINEMichael Niedermayer
Fixes: signed integer overflow: -1429092 * -32596 cannot be represented in type 'int' Fixes: 24419/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5157849974702080 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Nicolas George <george@nsup.org> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit a0da95df77a528251a326fc8b7e2ff48c60e41d0) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/vp9dsp_template: Fix integer overflow in iadst8_1d()Michael Niedermayer
Fixes: signed integer overflow: 998938090 + 1169275991 cannot be represented in type 'int' Fixes: 23411/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-4644692330545152 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit d182d8f10cf69c59ef9c21df4b06e5478df063ef) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/cfhd: Check transform typeMichael Niedermayer
Fixes: out of array access Fixes: 24823/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-4855119863349248 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 659658d08bb2e7219001795c78efd24f381446e2) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/tiff: Check jpeg context against jpeg frame parametersMichael Niedermayer
Fixes: out of array access Fixes: 24825/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-6326925027704832 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit b9ea493afe8576efe3de60f8c6723f9f155de0d8) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/tiff: Restrict tag order based on specificationMichael Niedermayer
"The entries in an IFD must be sorted in ascending order by Tag. Note that this is not the order in which the fields are described in this document." This way various dimensions, sample and bit sizes cannot be changed at arbitrary times which reduces the potential for bugs. The tag reading code also on various places assumes that numerically previous tags have already been parsed, so this needs to be enforced one way or another. If this commit causes problems with real world files which are not easy to fix then some other form of checks are needed to ensure the various dependencies in the tag reading are not violated. Fixes: out of array access Fixes: 24825/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-6326925027704832 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit ad29f9e47cb848e11ee1d358d2bae15cd35ef04b) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/tiff: Avoid abort with DNG RAW TIFF with YA8Michael Niedermayer
Fixes: Assertion failure Fixes: 24707/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5179910197608448 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit ca47402a06922f5280b4526007e32bf7847c7430) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/tiff: Check the linearization table sizeMichael Niedermayer
Fixes: out of array access Fixes: 24604/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4843529818603520 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 7577f8332a6bb2f227b876c83ec6fa45cc9670f9) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/tiff: Check bpp/bppcount for 0Michael Niedermayer
Fixes: division by zero Fixes: 24253/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-6250318007107584 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit be090da25f734460f3105075456877b8a66185c1) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/snowdec: Sanity check hcoeffMichael Niedermayer
Fixes: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int' Fixes: 24011/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5486376610168832 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit d51d569cf68f78aaea8464a156c847a0e294726a) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/alac: Check decorr_shift to avoid invalid shiftMichael Niedermayer
Later the decorrelate_stereo call is guarded by channels == 2 and non-zero decorr_left_weight. Make sure decorr_shift is in the expected shift range for that case. Fixes: shift exponent 128 is too large for 32-bit type 'int' Fixes: 23860/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5751138914402304 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Alexander Strasser <eclipse7@gmx.net> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 4333718b357a9ad195031e5d0ea080d37677b795) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-02-02avcodec/tdsc: Fix tile checksMichael Niedermayer
Fixes: out of array access Fixes: crash.asf Found-by: anton listov <greyfarn7@yandex.ru> Reviewed-by: anton listov <greyfarn7@yandex.ru> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 081e3001edb67dcd55fe0f68505df1fce667476d) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-01-26opusdec: do not fail when LBRR frames are presentAnton Khirnov
Decode and discard them. Fixes ticket 4641. (cherry picked from commit 33b4b788aac91dfd522415baaedcbda160482816) Signed-off-by: Anton Khirnov <anton@khirnov.net>
2020-10-01avcodec/cuviddec: backport extradata fixesTimo Rothenpieler
2020-09-30avcodec/cuviddec: handle arbitrarily sized extradataTimo Rothenpieler
2020-09-06avcodec/cbs_av1: fix setting FrameWidth in frame_size_with_refs()James Almer
Section 5.9.7 of the spec states UpscaledWidth = RefUpscaledWidth[ ref_frame_idx[ i ] ] FrameWidth = UpscaledWidth FrameHeight = RefFrameHeight[ ref_frame_idx[ i ] ] RenderWidth = RefRenderWidth[ ref_frame_idx[ i ] ] RenderHeight = RefRenderHeight[ ref_frame_idx[ i ] ] Meaning FrameWidth must not be set to RefFrameWidth[ ref_frame_idx[ i ] ] like we're currently doing. Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com> Signed-off-by: James Almer <jamrial@gmail.com>
2020-09-06avcodec/cbs_av1: use a more appropiate AV1ReferenceFrameState pointer ↵James Almer
variable name frame is more commonly used for AV1RawFrameHeader and AV1RawFrame. Signed-off-by: James Almer <jamrial@gmail.com> (cherry picked from commit 97819f15a8b776e3450cc10217f646da40013bf1)
2020-09-06avcodec/cbs_av1: fix handling reference frames on show_existing_frame framesJames Almer
Implement Section 7.21 "Reference frame loading process" and Section 7.20 "Reference frame update process" for show_existing_frame frames, as required by the definition in Section 7.4 "Decode frame wrapup process". Signed-off-by: James Almer <jamrial@gmail.com> (cherry picked from commit e76b4b2a6b488ecc3f55cb48dea971c17588d075)
2020-09-06avcodec/cbs_av1: infer frame_type in show_existing_frame frames earlierJames Almer
This follows the spec and will come in handy in the next commit. Signed-off-by: James Almer <jamrial@gmail.com> (cherry picked from commit afbe9ebac7b47fec84703459bfe64fc90c2ad937)
2020-09-06avcodec/cbs_av1: add OrderHint to CodedBitstreamAV1ContextJames Almer
This follows the spec and will come in handy in a following commit. Signed-off-by: James Almer <jamrial@gmail.com> (cherry picked from commit e3ed0ce32aaee0487533b10c18f81ab05fd31fa8)
2020-09-06avcodec/cbs_av1: infer frame_type when parsing a show_existing_frame frameJames Almer
Reviewed-by: Mark Thompson <sw@jkqxz.net> Signed-off-by: James Almer <jamrial@gmail.com> (cherry picked from commit 6c20207dceefa0452c65c719f0326cbc0177e827)
2020-09-06cbs_av1: Fix test for presence of buffer_removal_time elementMark Thompson
The frame must be in both the spatial and temporal layers for the operating point, not just one of them. (cherry picked from commit b567cb8d0b664775201d843ab985f49fefeb25d5)
2020-09-06avcodec/cbs_av1: fix storage size for render_{width,height}_minus_1James Almer
Signed-off-by: James Almer <jamrial@gmail.com> (cherry picked from commit 751f2a27f7d2efe5091ef54d73e5428160a85578)
2020-08-25lavc: Lower MediaFoundation audio encoder priority.Carl Eugen Hoyos
The actual encoders may not be available. Fixes ticket #8699. (cherry picked from commit 13db5061ff3c0ff0ad29294e276f7829d3456f5b)
2020-07-12x86/h264_deblock: fix warning about trailing empty parameterJames Almer
Fixes part of ticket #8771 Signed-off-by: James Almer <jamrial@gmail.com> (cherry picked from commit 2c844c98285ca03d9cc44db920da645cf0376c40)
2020-07-11avcodec/tiff: Check input space in dng_decode_jpeg()Michael Niedermayer
Fixes: out of array read Fixes: 24034/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5111884337119232 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 79e8d17024e6c6328a40fcee191ffd70798a9c6e) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-11avcodec/mjpeg_parser: Adjust size rejection thresholdMichael Niedermayer
Fixes: 86987846-429c8d80-c197-11ea-916b-bb4738e09687.jpg Fixes: Regression since ec3d8a0e6945fe015d16cd98a1e7dbb4be815c15 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit dde60772970ed663b85d475e741013a0222decda) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-11avcodec/cbs_jpeg: Fix uninitialized end index in cbs_jpeg_split_fragment()Michael Niedermayer
Fixes: Out of array read Fixes: 24043/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5084566275751936.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 4a10bc8f6f5d600c44ecb9b43cd9abf13bf3bfae) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-09avcodec/apedec: Fix undefined integer overflow with 24bitMichael Niedermayer
Fixes: signed integer overflow: 8683744 * 256 cannot be represented in type 'int' Fixes: 23527/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5679885932822528 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 9f7b252cdf2d0e0f79d16dc7cd575d1884239863) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-09avcodec/loco: Fix integer overflow with large values from loco_get_rice()Michael Niedermayer
Fixes: signed integer overflow: 155 + 2147483647 cannot be represented in type 'int' Fixes: 23421/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5652849097965568 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 3ddc5e1f3cebca25ade54ee68159d305f210bf5f) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-09avcodec/tiff: Check frame parameters before blit for DNGMichael Niedermayer
Fixes: out of array access Fixes: 23888/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-6021365974171648.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 4091f4f78012d1a7eb1e04b69cf65d5ef3afee3a) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-09avcodec/mjpegdec: Limit bayer to single plane outputting formatMichael Niedermayer
This reduces the number of paths reachable with DNG and should improve security Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 865a34970e73b9c23e33fd6dc6ba046d4e821519) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-09avcodec/pnmdec: Fix misaligned readsMichael Niedermayer
Found-by: "Steinar H. Gunderson" <steinar+ffmpeg@gunderson.no> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit ea28ce9bc13803ccef97850388ddc9a73998a23e) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-09avcodec/mv30: Fix integer overflows in idct2_1d()Michael Niedermayer
Fixes: signed integer overflow: 6500736 * 473 cannot be represented in type 'int' Fixes: 23259/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MV30_fuzzer-5179394271477760 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 3b8d5bcc3189c6c46279889f1176c0caba4466e4) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-07-09avcodec/hcadec: Check total_band_count against imdct_in sizeMichael Niedermayer
Fixes: index 128 out of bounds for type 'float [128]' Fixes: 23465/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCA_fuzzer-5089866596745216 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 2d96c945312d3f62e3f872bfb51a593afb40e09a) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-21 11:40:12 +0300