chacha/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
94,669 Commits 36 Branches 386 Tags
f21ef41c1437edeb8d249aa5ec00253467eba159
Commit Graph

42032 Commits

Author SHA1 Message Date
Michael Niedermayer
31240bb703 avcodec/ffwavesynth: Fix integer overflow with pink_ts_cur/next 
Fixes: signed integer overflow: 6175076100092079360 - -5034989061050195840 cannot be represented in type 'long'
Fixes: 18614/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5704508847423488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d82ab96e76)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
8c1c43c6c1 avcodec/ralf: Fix integer overflows with the filter coefficient in decode_channel() 
Fixes: signed integer overflow: 1145975808 - -1146173210 cannot be represented in type 'int'
Fixes: 18616/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5121296757424128

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 721624c2f6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
10fb811c0d avcodec/g729dec: Use 64bit and clip in scalar product 
The G729 reference decoder clips after each individual operation and keeps track if overflow
occurred (in the fixed point implementation), this here is
simpler and faster but not 1:1 the same what the reference does.

Non fuzzed samples which trigger any such overflow are welcome, so
the need and impact of different clipping solutions can be evaluated.

Fixes: signed integer overflow: 1271483721 + 1073676289 cannot be represented in type 'int'
Fixes: 18617/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-5137705679978496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bf9c4a1275)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
1aeef9979d avcodec/mxpegdec: Check for multiple SOF 
Fixes: Timeout (14sec -> 9ms)
Fixes: 18598/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-5726095261564928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 75b64e5aa3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
4cd8ae5b9c avcodec/nuv: Move comptype check up 
Fixes: Timeout (23sec -> 5ms)
Fixes: 18517/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NUV_fuzzer-5753135536013312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1138cdecbe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
0ae9a8cdbb avcodec/wmavoice: Fix integer overflow in synth_frame() 
Fixes: left shift of negative value -3
Fixes: 18518/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-6560514359951360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cf323f4d38)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
b56388541b avcodec/rawdec: Check bits_per_coded_sample more pedantically for 16bit cases 
Fixes: shift exponent -14 is negative
Fixes: 18335/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RAWVIDEO_fuzzer-5723267192586240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5634e20525)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
3a6ef19263 avcodec/cngdec: Remove AV_CODEC_CAP_DELAY 
As is the decoder will never stop, it will cause an infinite loop. The RFC seems only
to speak of non empty packets so endlessly generating noise from the last empty flush
packets seems wrong.

Fixes: infinite loop
Fixes: 18333/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COMFORTNOISE_fuzzer-5668481831272448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 327a968817)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
afd3574959 avcodec/iff: Move index use after check in decodeplane8() 
Fixes: index 9 out of bounds for type 'const uint64_t [8][256]'
Fixes: 18409/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5767030560522240
Fixes: 18720/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5651995784642560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a1f8b36cc4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
f75b377857 avcodec/atrac3: Check for huge block aligns 
The largest documented frame size = block align is 1024 bytes
(https://wiki.multimedia.cx/index.php/ATRAC3)

Without a limit this can allocate arbitrary memory and trigger OOM
Fixes: OOM
Fixes: 18337/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3_fuzzer-5763861478637568
Fixes: 18556/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3AL_fuzzer-5646183334936576

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f09151fff9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
96ccd5665c avcodec/ralf: use multiply instead of shift to avoid undefined behavior in decode_block() 
Fixes: left shift of negative value -249
Fixes: 18566/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5649394561187840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b7d02642b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
9eecca08e7 avcodec/wmadec: Require previous exponents for reuse 
Fixes: division by zero
Fixes: 18474/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5764986962182144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c54b9fc42f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
074d7c2f8d avcodec/vc1_block: Fix undefined behavior in ac prediction rescaling 
The intermediates are required to fit in 12bit (8.1.3.9 Coefficient Scaling)
See SMPTE 421M-2006 and Amendment 1-2007

Fixes: signed integer overflow: -20691 * 262144 cannot be represented in type 'int'
Fixes: 18479/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5128912371187712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7fc1baf0ca)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
3c53cdb1ad avcodec/qdm2: The smallest header seems to have 2 bytes so treat 1 as invalid 
Fixes: Timeout (217sec -> 2ms)
Fixes: 18488/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5708293662310400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e36ccb5048)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
1c531e7d76 avcodec/apedec: Fixes integer overflow of res+*data in do_apply_filter() 
Fixes: signed integer overflow: 7400 + 2147482786 cannot be represented in type 'int'
Fixes: 18405/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5708834760294400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dc3f327e74)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
d79972badd avcodec/sonic: Fix integer overflow in predictor_calc_error() 
Fixes: signed integer overflow: 5 * -1094995529 cannot be represented in type 'int'
Fixes: 18346/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5709623893426176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c8c17b8cef)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
e57cb9429a avcodec/atrac9dec: Check precision_fine/coarse 
Clipping is done as it was preferred in review
See: [FFmpeg-devel] [PATCH 1/5] avcodec/atrac9dec: Check precision_fine/coarse

Fixes: out of array access
Fixes: 18330/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5641113058148352

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 19b8db2908)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
1c24ab39b6 vcodec/agm: Alloc based on coded dimensions 
Fixes: out of array read
Fixes: 18715/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5659333417500672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bfa8272f40)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
922837561b avcodec/wmaprodec: get frame during frame decode 
Fixes: memleak
Fixes: 17615/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA2_fuzzer-5681306024804352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0f89a2293e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
f3c4718f1b avcodec/interplayacm: Fix overflow of last unused value 
Fixes: signed integer overflow: -2147450880 - 65535 cannot be represented in type 'int'
Fixes: 18393/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5667520110919680

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 10eabb8e40)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
88d97044cb avcodec/adpcm: Fix undefined behavior with negative predictions in IMA OKI 
Fixes: left shift of negative value -30
Fixes: 18392/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_OKI_fuzzer-5631771831435264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7786f6c30e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
9cf2764389 avcodec/cook: Move up and extend block_align check 
Fixes: signed integer overflow: 2046820356 * 8 cannot be represented in type 'int'
Fixes: 18391/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5631674666188800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1c63edcdd2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
62dae886b6 avcodec/sbcdec: Fix integer overflows in sbc_synthesize_four() 
Fixes: signed integer overflow: 1494495519 + 1494495519 cannot be represented in type 'int'
Fixes: 18347/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SBC_fuzzer-5711714661695488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 00e469fb61)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
651e9773ed avcodec/twinvq: Check block_align 
Fixes: signed integer overflow: 538976288 * 8 cannot be represented in type 'int'
Fixes: 18348/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_METASOUND_fuzzer-6681325716635648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 97f778e9c5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
61fd1484c4 avcodec/cook: Enlarge gain table 
Fixes: index 25 out of bounds for type 'float [23]'
Fixes: 18355/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5641398941908992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 50001cd440)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
0c6d17ae87 avcodec/cook: Check samples_per_channel earlier 
Fixes: division by zero
Fixes: 18362/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5653727679086592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 57750bb629)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
c599f7ed76 avcodec/atrac3plus: Check split point in fill mode 3 
Fixes: index 32 out of bounds for type 'int [32]'
Fixes: 18350/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC3P_fuzzer-5643794862571520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit de5102fd92)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
556bb822a0 avcodec/wmavoice: Check sample_rate 
Fixes: left shift of 538976288 by 8 places cannot be represented in type 'int'
Fixes: 18376/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5741645391200256

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 55c97a7637)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
d32058276c avcodec/xsubdec: fix overflow in alpha handling 
Fixes: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 18368/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XSUB_fuzzer-5702665442426880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9ea9973959)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
571c66659d avcodec/iff: Check available space before entering loop in decode_long_vertical_delta2() / decode_long_vertical_delta() 
Fixes: Timeout (31sec -> 41ms)
Fixes: 18380/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5645210121404416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 32b3c8ce7d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
3613a0df40 avcodec/apedec: Fix integer overflow in filter_3800() 
Fixes: signed integer overflow: 2117181180 + 60483298 cannot be represented in type 'int'
Fixes: 18344/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5685327791915008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1c038c5c63)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
b8425d0e26 avcodec/ffv1dec: Use a different error message for the slice level CRC 
This way they can be told apart easily

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit df498cf544)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
72c9dab15d avcodec/apedec: Fix undefined integer overflow in long_filter_ehigh_3830() 
Fixes: signed integer overflow: -1094995529 * 2 cannot be represented in type 'int'
Fixes: 18281/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5692589180715008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1d1719a44d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
f9738b2af3 avcodec/dstdec: Check that AC probabilities are within range 
ISO/IEC 14496-3:2005(E): "Each entry of P_one[ ][ ] is in the range of 1 to
128, corresponding to a probability of 1/256 to 128/256 of the next error bit (bit E, See Figure 10.5)..."

Fixes: Timeout (42sec ->1sec)
Fixes: 18181/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5736646250594304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0c3e1b395b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
a06c0fadc8 avcodec/dstdec: Check read_table() for failure 
Fixes: Timeout (too long -> 42sec)
Fixes: 18181/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5736646250594304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 03ea8d8cd4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
1c1b94aaae avcodec/snowenc: Set mb_num to avoid ratecontrol floating point divisions by 0.0 
Fixes: Ticket7990

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 55279d699f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
f348a0bc3c avcodec/snowenc: Fix 2 undefined shifts 
Fixes: Ticket7990

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8802e329c8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
59a2b67c79 avcodec/aptx: Check the number of channels 
Fixes: store to null pointer of type 'uint32_t' (aka 'unsigned int')
Fixes: 18021/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APTX_HD_fuzzer-5761738313564160

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 98a257c323)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
5cf9d6c586 avcodec/aacdec_template: Check samplerate 
Fixes: signed integer overflow: 2 * 1881153568 cannot be represented in type 'int'
Fixes: 17996/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5687126468853760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7730bacb41)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
63162b9f97 avcodec/truemotion2: Fix several integer overflows in tm2_low_res_block() 
Fixes: signed integer overflow: 1077952576 + 1355863565 cannot be represented in type 'int'
Fixes: 16196/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5679842317565952

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2b655f55ea)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
267ee47529 avcodec/utils: Check block_align 
Fixes: out of array access
Fixes: 18432/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5675574936207360
Fixes: 18326/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5071752362721280
Fixes: 18384/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV1_fuzzer-5769439500304384

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f011572e66)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
f3a90da0b5 avcodec/wmalosslessdec: Fix some integer anomalies 
Fixes: left shift of negative value -341180
Fixes: 18401/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5686380134400000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d3dee676b8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
b55ec3f327 avcodec/adpcm: Fix invalid shifts in ADPCM DTK 
Fixes: left shift of negative value -1
Fixes: 18397/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_DTK_fuzzer-5675653487132672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 34e701ff93)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
6be30c4f8e avcodec/apedec: Only clear the needed buffer space, instead of all 
Fixes: Timeout (15sec -> 0.4sec)
Fixes: 18396/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5730080487112704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f17ea02001)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
8f71cd980c avcodec/libvorbisdec: Fix insufficient input checks leading to out of array reads 
Fixes: 16144/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVORBIS_fuzzer-5638618940440576
Fixes: out of array read

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 069be4aa5d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
99243eea7b avcodec/g723_1dec: fix invalid shift with negative sid_gain 
Fixes: left shift of negative value -1
Fixes: 18395/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G723_1_fuzzer-5710313034350592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1850c3feaa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
87e8bfeb90 avcodec/vp5: Check render_x/y 
Fixes: Timeout (15sec -> 91ms)
Fixes: 18353/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP5_fuzzer-5704150326706176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 698e042c77)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
28ddc0b9b8 avcodec/hcom: Check the root entry and the right entries 
Fixes: Segfault
Fixes: 17991/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCOM_fuzzer-5647235349479424

Also fixes related memleak

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4834ec926a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
f66e52fd96 avcodec/qdrw: Check input for header/skiped space before get_buffer() 
Fixes: Timeout (21sec -> 0.8sec)
Fixes: 17990/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDRAW_fuzzer-5200374436200448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b63fbc19c0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00
Michael Niedermayer
3a9432ec64 avcodec/ralf: Skip initializing unused filter variables 
Fixes: left shift of negative value -1
Fixes: 17890/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RALF_fuzzer-5643307467669504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f4ecf6c39d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-12-31 19:51:56 +01:00