chacha/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
83,465 Commits 36 Branches 386 Tags
d88e50ed615b5edcfa49cd6e83bcdfd0757fce29
Commit Graph

37466 Commits

Author SHA1 Message Date
Michael Niedermayer
d88e50ed61 avcodec/iff: Test video_size being non zero 
Fixes: Out of array access
Fixes: 20659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5658548592967680
Fixes: 20659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5723561177382912

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a035fd88ae)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
44710253f4 avcodec/utvideodec: Fix integer overflow in decode_plane() 
Fixes: signed integer overflow: 2147483594 + 142 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_fuzzer-5658568101724160

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 876cfa67f3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
b1046b3b14 avcodec/ttadsp: Fix several integer overflows in tta_filter_process_c() 
Fixes: signed integer overflow: 1931744255 + 252497024 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5763348114440192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8627885172)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
b87281969a avcodec/ralf: Fix integer overflow in decode_block() 
Fixes: signed integer overflow: 289082077 - -2003141111 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5196077752123392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0c4330847c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
3cf22dc460 avcodec/nuv: widen buf_size type 
Fixes: signed integer overflow: 65312 * 65312 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-5740176118906880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1ac106bf56)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
4a41de80ed avcodec/iff: Fix several integer overflows 
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int32_t' (aka 'int')
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5764066459254784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7a92147f87)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
6ce730d39e avcodec/g729postfilter: Clip gain before scaling with AGC_FAC1 
The fixed point integer reference specifies the multiplication used
to have 16bit input and clips so we need to clip the input
The floating point implementation does not seem to do that.

Fixes: signed integer overflow: 6317568 * 410 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G729_fuzzer-5700189272932352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 82d4c7b95e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
4cbda397c3 avcodec/alac: Fix integer overflow with 24/20bps samples 
Fixes: signed integer overflow: 1020048 * 4096 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5753877751660544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 22e51e95ac)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
efe50a9ce1 avcodec/dstdec: Check sample rate 
Fixes: out of array access
Fixes: 20659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5735812071424000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5727b1f13f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
d48569cb5b avcodec/pngdec: Check length in fdAT 
Fixes: 21089/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-5135981419429888
Fixes: out of array read

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 79e5c2ee2b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
74f7e11a98 avcodec/g2meet: Check tile_width in epic_jb_decode_tile() 
Fixes: out of array access
Fixes: 21469/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5199357982015488

Alternatively the arrays can be made bigger or the index can be clipped.
In case a real file with such huge tiles exist we ask the user to upload it.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5501bb28dd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
60d36825bc avcodec/vp9dsp_template: Fix integer overflows in idct32_1d() 
Fixes: signed integer overflow: -193177 * 11585 cannot be represented in type 'int'
Fixes: 20557/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5704852816789504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e16e3e63f0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
e2a3317510 avcodec/alacdsp: Fix invalid shift in append_extra_bits() 
Fixes: left shift of negative value -1
Fixes: 21390/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-6242539519868928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 49ae034b42)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
a4e9221bde libavcodec/wmalosslessdec: prevent sum of positive numbers from becoming negative 
Fixes: left shift of negative value -8321365
Fixes: 20506/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-4798062906310656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 62e4003780)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
3ea3a94a1e avcodec/dstdec: Fix integer overflow in read_table() 
Fixes: signed integer overflow: -16 * 134217879 cannot be represented in type 'int'
Fixes: 20492/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5639509530378240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2d465a401d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
76ad5d0351 avcodec/txd: Check for input size against the header size. 
Fixes: Timeout (21sec -> 80ms)
Fixes: 20673/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TXD_fuzzer-5177453863763968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aeb4e43584)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
ae8e215c41 avcodec/svq1dec: Check that there is data left after the header 
Fixes: Timeout (21sec -> 255ms)
Fixes: 20709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ1_fuzzer-5085075089915904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 55e344ee5a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
01436cc976 avcodec/intrax8: Check for end of bitstream in ff_intrax8_decode_picture() 
Fixes: Timeout (105sec -> 1sec)
Fixes: 20479/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5769846937878528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0a9ccc2514)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
3402904943 avcodec/hevc_mp4toannexb_bsf: Check nalu_size 
Fixes: Timeout (29sec -> 5ms)
Fixes: 20237/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_MP4TOANNEXB_fuzzer-5165615044362240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ae2537f53e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
c2fd7070d4 avcodec/iff: Check length before memcpy() in decode_deep_rle32() 
Fixes: out of array read
Fixes: 20796/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5111364702175232.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b4a33387cb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
bedf686d5b avcodec/iff: Fix invalid pointer intermediates in decode_deep_rle32() 
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bc41a29a5a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
5e9fa514a4 avcodec/rv40dsp: Fix integer overflows in rv40_weight_func_*() 
Fixes: signed integer overflow: 40550400 * 128 cannot be represented in type 'int'
Fixes: 20331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV40_fuzzer-5676685725007872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 13171ad2e3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
ff3ea90d6b avcodec/ac3dec_fixed: Fix several invalid left shifts in scale_coefs() 
Fixes: left shift of negative value -14336
Fixes: 20298/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AC3_FIXED_fuzzer-5675484201615360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8e30502abe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
541298cef7 avcodec/flac_parser: Do not lose header count in find_headers_search() 
Fixes: Timeout
Fixes: out of array access
Fixes: 20274/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5649631988154368
Fixes: 19275/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5757535722405888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 55f9683cf6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
2d3dd65a4b avcodec/audiodsp: Fix integer overflow in scalarproduct_int16_c() 
Fixes: signed integer overflow: 2145417478 + 76702564 cannot be represented in type 'int'
Fixes: 20313/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-5734487724130304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit abb5762e98)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
7164a168fb avcodec/dpcm: clip exponent into supported range in XAN DPCM 
Fixes: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 21200/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XAN_DPCM_fuzzer-5754704894361600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 20ade59d96)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
51e0e2deaf avcodec/flacdsp_template: Fix invalid shifts in decorrelate 
Fixes: left shift of negative value -2
Fixes: 20303/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLAC_fuzzer-5096829297623040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3935c891e9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
dad6714ce6 avcodec/xvididct: Fix integer overflow in MULT() 
Fixes: signed integer overflow: 23170 * 95058 cannot be represented in type 'int'
Fixes: 20295/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5800212870463488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7ccb576191)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
9727acaad5 avcodec/ffwavesynth: Correct undefined overflow of PINK_UNIT 
Fixes: signed integer overflow: 9223372036854775775 + 128 cannot be represented in type 'long'
Fixes: 20054/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5686385113825280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 187161d62f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
ce53f179ac avcodec/ffwavesynth: Fix integer overflow in computation of ddphi 
Fixes: signed integer overflow: 1302123111085380114 - -8319005078741256972 cannot be represented in type 'long'
Fixes: 20991/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5148554161291264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c85bf16318)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
80cf78e4d6 avcodec/adpcm: Fix invalid shift in AV_CODEC_ID_ADPCM_PSX 
Fixes: left shift of negative value -1
Fixes: 20859/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_PSX_fuzzer-5720391507247104

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0a11ef68f0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
c8c2855510 avcodec/mpeg12dec: Fix invalid shift in mpeg2_fast_decode_block_intra() 
Fixes: left shift of negative value -695
Fixes: 19232/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5702856963522560
Fixes: 19555/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer-5741218147598336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c40df2166c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
28163cb7ad avcodec/mpegaudioenc_template: fix invalid shift of sample 
Fixes: Ticket8010

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a2c97a8342)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
a70f312df1 avcodec/motion_est_template: Fix invalid shifts in no_sub_motion_search() 
Fixes: Ticket8167

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e13eee37ee)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
1bed5bf9e2 avcodec/magicyuv: Check that there are enough lines for interlacing to be possible 
Fixes: out of array access
Fixes: 20763/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_fuzzer-5759562508664832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f8a0e9f9f7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
7588b99a3b avcodec/pcm: Fix invalid shift in AV_CODEC_ID_PCM_LXF 
Fixes: left shift of 233 by 24 places cannot be represented in type 'int'
Fixes: 20736/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PCM_LXF_fuzzer-4829212685107200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 051d11f659)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
5654c46336 avcodec/qdm2: Check fft_coefs_index 
Fixes: out of array access
Fixes: 20660/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5658290216501248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9fc73bf022)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
b503ec1ae1 avcodec/apedec: Fix invalid shift with 24 bps 
Fixes: left shift of negative value -463
Fixes: 20542/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5688714435231744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8e27867229)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
1a54ee4a51 avcodec/wmalosslessdec: Fix integer overflow with sliding in padding bits 
Fixes: signed integer overflow: -53716100 * 256 cannot be represented in type 'int'
Fixes: 20143/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5716604000403456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b8a0be9352)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
44da920eb7 avcodec/wmalosslessdec: Fix loop in revert_acfilter() 
Fixes: out of array read
Fixes: 20059/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5691776237305856

No testcase except the fuzzed one.

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5584c0bb94)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
e1aa37ce1a avcodec/lagarith: Sanity check scale 
A value of 24 and above can collaps the range to 0 which would not work.

Fixes: Timeout (75sec -> 21sec)
Fixes: 18707/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LAGARITH_fuzzer-5708950892969984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fb3855342b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
ba17b9961a avcodec/apedec: Fix integer overflows in predictor_decode_mono_3950() 
Fixes: signed integer overflow: -2147407150 + -1871606 cannot be represented in type 'int'
Fixes: 18702/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5679095417667584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eb64a5c6f9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
f46cd02b63 avcodec/ralf: Fix integer overflow in apply_lpc() 
Fixes: signed integer overflow: 2147482897 + 2048 cannot be represented in type 'int'
Fixes: 19240/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5743240326414336
Fixes: 19869/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5150136636538880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fd313d8cf8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
4b0a1becaa avcodec/dca_lbr: Fix some error codes and error passing 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bfea054a75)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
b68e717a2e avcodec/wmavoice: Fix rounding and integer anomalies in calc_input_response() 
Fixes: out of array access
Fixes: inf is outside the range of representable values of type 'int'
Fixes: signed integer overflow: -9223372036854775808 - 1 cannot be represented in type 'long'
Fixes: 19316/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5677369365102592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 38d3758444)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
833cb46dfa avcodec/pcm: Fix invalid shift in pcm_decode_frame for LXF 
Fixes: left shift of 32 by 28 places cannot be represented in type 'int'
Fixes: 19472/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PCM_LXF_fuzzer-5704364320096256

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 985d3666f6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
5e483df01f avcodec/snappy: Sanity check bytestream2_get_levarint() 
Fixes: left shift of 79 by 28 places cannot be represented in type 'int'
Fixes: 20202/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5719004081815552
Fixes: 20219/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5641738677125120
Fixes: 20389/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5680721517871104

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit be54da2117)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
876997d462 avcodec/mlpdsp: Fix a invalid shift in ff_mlp_rematrix_channel() 
Fixes: left shift of negative value -2
Fixes: 20305/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-5677196618498048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Jai Luthra <me@jailuthra.in>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fcc9f13717)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
cb3495c0cb avcodec/avdct: Clear IDCTDSPContext context 
Fixes use of uninitialized variable and segfault

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b82825eba8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00
Michael Niedermayer
10e807c860 avcodec/x86/diracdsp: Fix high bits on Windows x86_64 
Found-by: james
(cherry picked from commit 24af459d1e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2020-07-01 12:49:26 +02:00