aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2020-06-05avcodec/vaapi_h264: Add support for missing elements for Hantro supportvaapi/hantro-supportPaul Kocialkowski
Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
2020-06-05avcodec/h264: parse ref_pic_marking_size_in_bits and pic_order_cnt_bit_sizeBoris Brezillon
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2020-06-05avcodec/h264: parse idr_pic_idEzequiel Garcia
Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
2019-12-31Update for FFmpeg 4.2.2Michael Niedermayer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31cbs_mpeg2: Fix parsing the last unitAndreas Rheinhardt
There is one way to find out if avpriv_find_start_code has found a start code or not: One has to check whether the state variable contains a start code, i.e. whether the three most significant bytes are 0x00 00 01. Checking for whether the return value is the end of the designated buffer is not enough: If the last four bytes constitute a start code, the return value is also the end of the buffer. This happens with sequence_end_codes which have been ignored for exactly this reason, although e.g. all three files used for fate tests of cbs_mpeg2 contain sequence_end_codes. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit fd93d5efe64206d5f1bce8c702602353444c0c1a)
2019-12-31cbs_mpeg2: Rearrange start code searchAndreas Rheinhardt
1. Currently, cbs_mpeg2_split_fragment uses essentially three variables to hold the start code values found by avpriv_find_start_code. By rearranging the code, one of them can be omitted. 2. The return value of avpriv_find_start_code points to the byte after the byte containing the start code identifier (or to the byte after the last byte of the fragment's data if no start code was found), but cbs_mpeg2_split_fragment needs to work with the pointer to the byte containing the start code identifier; it already did this, but in a clumsy way. This has been changed. 3. Also use the correct type for the variable holding the CodedBitstreamUnitType. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 276b21a586900b4692efbb99e4789e05d927708e)
2019-12-31cbs_mpeg2: Decompose Sequence EndAndreas Rheinhardt
Sequence End units (or actually, sequence_end_codes) have up until now not been decomposed; in fact due to a bug in cbs_mpeg2_split_fragment they have mostly been treated as part of the preceding unit. So implement decomposing them as preparation for fixing said bug. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 0e66e1b61ea2fd8fd85ebe3b86ff48dad78233dd)
2019-12-31cbs_mpeg2: Fix parsing of picture and slice headersAndreas Rheinhardt
1. The extra information in slice headers was parsed incorrectly: In the first reading pass to derive the length of the extra information, one should look at bits n, n + 9, n + 18, ... and check whether they equal one (further extra information) or zero (end of extra information), but instead bits n, n + 8, n + 16, ... were inspected. The second pass of reading (where the length is already known and the bytes between the length-determining bits are copied into a buffer) did not record what was in bits n, n + 9, n + 18, ..., presuming they equal one. And during writing, the bytes in the buffer are interleaved with set bits and written. This means that if the detected length of the extra information was greater than the real length, the output was corrupted. Fortunately no sample is known that made use of this mechanism: The extra information in slices is still marked as reserved in the specifications. cbs_mpeg2 is now ready in case this changes. 2. Furthermore, the buffer is now padded and slightly different, but very similar code for reading resp. writing has been replaced by code used for both. This was made possible by a new macro, the equivalent to cbs_h2645's fixed(). 3. These changes also made it possible to remove the extra_bit_slice element from the MPEG2RawSliceHeader structure. Said element was always zero except when the detected length of the extra information was less than the real length. 4. The extra information in picture headers (which uses essentially the same syntax as the extra information in slice headers) has simply been forgotten. This meant that if this extra information was present, it was discarded during reading; and unfortunately writing created invalid bitstreams in this case (an extra_bit_picture - the last set bit of the whole unit - indicated that there would be a further byte of data, although the output didn't contain said data). This has been fixed; both types of extra information are now parsed via the same code and essentially passed through. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit d9182f04caa59c3ba2659981183238ada340f814)
2019-12-31cbs: Remove useless initializationsAndreas Rheinhardt
Up until now, a temporary variable was used and initialized every time a value was read in CBS; if reading turned out to be successfull, this value was overwritten (without having ever been looked at) with the value read if reading was successfull; on failure the variable wasn't touched either. Therefore these initializations can be and have been removed. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit b71a0367a6e763d631b8dcd608f98d42c05fa57c)
2019-12-31mpeg2_metadata, cbs_mpeg2: Fix handling of colour_descriptionAndreas Rheinhardt
If a sequence display extension is read with colour_description equal to zero, but a user wants to add one or more of the colour_description elements, then the colour_description elements the user did not explicitly request to be set are set to zero and not to the value equal to unknown/unspecified (namely 2). A value of zero is not only inappropriate, but explicitly forbidden. This is fixed by inferring the right default values during the reading process if the elements are absent; moreover, changing any of the colour_description elements to zero is now no longer possible. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit c2a91645c5b5cd6ed32089ec79cbb667326a8d8a)
2019-12-31lavc/cbs_h2645_syntax_template: Fix memleakAndriy Gelman
payload_count is used to track the number of SEI payloads. It is also used to free the SEIs in cbs_h264_free_sei()/cbs_h265_free_sei(). Currently, payload_count is set after for loop is completed. Hence if there is an error and the function exits, the payload remains zero causing a memleak. This commit keeps track of payload_count inside the for loop to fix the issue. Note that that the contents of current are initialized with av_mallocz() so there is no need to zero initialize payload_count. Found-by: libFuzzer Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com> (cherry picked from commit c07a77247363eb666a49536af505e7317225ee81)
2019-12-31avcodec/cbs: Fix potential overflowAndreas Rheinhardt
The number of bits in a PutBitContext must fit into an int, yet nothing guaranteed the size argument cbs_write_unit_data() uses in init_put_bits() to be in the range 0..INT_MAX / 8. This has been changed. Furthermore, the check 8 * data_size > data_bit_start that there is data beyond the initial padding when writing mpeg2 or H.264/5 slices could also overflow, so divide it by 8 to get an equivalent check without this problem. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit cda3e8ca04c0e343f5b60fda8fb467936e176f33)
2019-12-31avcodec/cbs: Factor out common code for writing unitsAndreas Rheinhardt
All cbs-functions to write units share a common pattern: 1. They check whether they have a write buffer (that is used to store the unit's data until the needed size becomes known after writing the unit when a dedicated buffer will be allocated). 2. They use this buffer for a PutBitContext. 3. The (codec-specific) writing takes place through the PutBitContext. 4. The return value is checked. AVERROR(ENOSPC) here always indicates that the buffer was too small and leads to a reallocation of said buffer. 5. The final buffer will be allocated and the data copied. This commit factors this common code out in a single function in cbs.c. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 7c92eaace2b338e0b3acc18e1543b365610578fd)
2019-12-31avcodec/ffwavesynth: Fix undefined overflow in wavesynth_synth_sample()Michael Niedermayer
Fixes: signed integer overflow: 2147464192 + 21176 cannot be represented in type 'int' Fixes: 19042/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5719828090585088 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit fa47f6412dbf93b4865adf8c66618906a3274330) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/cook: Use 3 stage VLC decoding for channel_couplingMichael Niedermayer
Fixes: shift exponent -1 is negative Fixes: out of array read Fixes: 19028/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5759766471376896 Fixes: 19037/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5734106625474560 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 89fd76db71d9d4f87c51fee2a2edf99662444df7) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/wmalosslessdec: Fixes undefined overflow in dequantization in ↵Michael Niedermayer
decode_subframe() Fixes: signed integer overflow: 47875596 * 45 cannot be represented in type 'int' Fixes: 19082/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5687766512041984 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 53efab44a9d0971c6c12d9b3d1af855ca863c847) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/sonic: Check e in get_symbol()Michael Niedermayer
Fixes: signed integer overflow: 1721520852 + 1721520852 cannot be represented in type 'int' Fixes: 18346/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5709623893426176 Fixes: 18753/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5663299131932672 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit aea67556116330d3151e4cd3ef1e266b5d90f388) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/twinvqdec: Correct overflow in block align checkMichael Niedermayer
Fixes: signed integer overflow: 538976288 * 8 cannot be represented in type 'int' Fixes: 19126/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TWINVQ_fuzzer-5687464110325760 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 4dc93ae3d725e892927f04002021337c2f90252a) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/vc1dec: Fix "return -1" casesMichael Niedermayer
Reviewed-by: "mypopy@gmail.com" <mypopy@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 26f040bcb4a1db78d1311af2e69de6984ecb43e5) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/vc1dec: Free sprite_output_frame on errorMichael Niedermayer
Fixes: memleaks Fixes: 19471/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5688035714269184 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 3ee9240be3e4044ae9e60a9a3a68820bf8075299) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/atrac9dec: Clamp band_ext_data to max that can be read if skipped.Michael Niedermayer
Fixes: out of array read Fixes: 19327/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5679823087468544 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Lynne <dev@lynne.ee> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 18ff210efb8d158f3e8c79508d99a52eaebf9d48) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/agm: Include block size in the MV check for flags == 3Michael Niedermayer
Fixes: out of array read Fixes: 19331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5644115983466496 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 1f2096945709a32315da740691b5716da55893c3) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/wmadec: Keep track of exponent initialization per channelMichael Niedermayer
Fixes: division by 0 Fixes: 19123/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAV2_fuzzer-5655493121146880 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit bf5c850b795126d4f60dd9498c06f0492f5726a7) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/iff: Check that video_size is large enough for the read parametersMichael Niedermayer
video is allocated before parameters like bpp are read. Fixes: out of array access Fixes: 19084/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5718556033679360 Fixes: 19465/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5759908398235648 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit f1b97f62f86d5dca35d01d7a5ebbc5dca2a88ae6) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/cbs_vp9: Check data_sizeMichael Niedermayer
Fixes: out of array access Fixes: 19542/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5659498341728256 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: James Almer <jamrial@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 4fa2d5a692f40c398a299acf2c6a20f5b98a3708) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/cbs_vp9: Check index_sizeMichael Niedermayer
Fixes: out of array read Fixes: 19300/clusterfuzz-testcase-minimized-ffmpeg_BSF_VP9_METADATA_fuzzer-5653911730126848 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: James Almer <jamrial@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit d6553e2e60a389296dd2f83a96f944ccfa5877a0) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/adpcm: Clip predictor for APCMichael Niedermayer
Fixes: signed integer overflow: -2147483648 - 13 cannot be represented in type 'int' Fixes: 18893/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_IMA_APC_fuzzer-5630760442920960 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 9fe07908c3f67d59cf4db5668d61b34506189590) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/targa: Check colors vs. available spaceMichael Niedermayer
Fixes: Timeout (37sec -> 52ms) Fixes: 18892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TARGA_fuzzer-5739537854889984 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 01593278cef06dbb4491d50d03b72198d2848adf) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/dstdec: Use get_ur_golomb_jpegls()Michael Niedermayer
Fixes: shift exponent -4 is negative Fixes: 17793/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5766088435957760 Fixes: 18989/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-5175008116867072 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit a76690c02b4fd12d7fac6f753af8bad72c82d55c) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/wmavoice: Check remaining input in parse_packet_header()Michael Niedermayer
Fixes: Infinite loop Fixes: 18914/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-5731902946541568 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 19c41969b26d07519fff8182a0d3266cdb712078) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/wmalosslessdec: Fix 2 overflows in mclmsMichael Niedermayer
Fixes: signed integer overflow: 2038337026 + 109343477 cannot be represented in type 'int' Fixes: 18886/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5673660505653248 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 92455c8c65c403ea696cb8c63d474d386d631bbd) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/wmaprodec: Fixes integer overflow with 32bit samplesMichael Niedermayer
Fixes: left shift of 1 by 31 places cannot be represented in type 'int' Fixes: 18860/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAPRO_fuzzer-5755223125786624 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit a9cc69c0d59057ea172a107e0308fdf5fd8fc04e) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/adpcm: Fix invalid shift in xa_decode()Michael Niedermayer
Fixes: left shift of negative value -1 Fixes: 18859/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_XA_fuzzer-5748474213040128 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 50db30b47d016fc4e7b47067545b15d22d4faddf) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/wmalosslessdec: Fix several integer issuesMichael Niedermayer
Fixes: shift exponent -1 is negative (and others) Fixes: 18852/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5660855295541248 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit ec3fe67074ad0a6a3a817f6f42175ea63a98092b) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/wmalosslessdec: Check that padding bits is not more than sample bitsMichael Niedermayer
Fixes: left shift of 1 by 31 places cannot be represented in type 'int' Fixes: 18817/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5713317180211200 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 9d428265808255ad2fc60355fe641aaa4fd3dae4) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/iff: Skip overflowing runs in decode_delta_d()Michael Niedermayer
Fixes: Timeout (107sec - 75ms> Fixes: 18812/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-6295585225441280 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 185f441ba26a2112725db1e8f218e54ac8068bbb) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/pnm: Check that the header is not truncatedMichael Niedermayer
Fixes: Ticket8430 Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit c94cb8d9b21baeeecef962c72965dbedc4e0b0e1) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/mp3_header_decompress_bsf: Check sample_rate_indexMichael Niedermayer
Fixes: out of array read Fixes: 19309/clusterfuzz-testcase-minimized-ffmpeg_BSF_MP3_HEADER_DECOMPRESS_fuzzer-5651002950942720 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit f064c7c449f162a9011ad890f26ceeca26934d22) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/cbs_av1_syntax_template: Check num_y_pointsMichael Niedermayer
"It is a requirement of bitstream conformance that num_y_points is less than or equal to 14." Fixes: index 24 out of bounds for type 'uint8_t [24]' Fixes: 19282/clusterfuzz-testcase-minimized-ffmpeg_BSF_AV1_FRAME_MERGE_fuzzer-5747424845103104 Note, also needs a23dd33606d5 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: jamrial Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit bbe27890ff7e31e74d024a17123cb073720f2486) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avformat/rmdec: Initialize and sanity check offset in ivr_read_header()Michael Niedermayer
Fixes: signed integer overflow: -9223372036854775808 - 17 cannot be represented in type 'long' Fixes: 18768/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5674385247830016 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 7e665e4a81e2e96eb45138a1dfa38617de2631a4) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/agm: Do not allow MVs out of the picture area as no edge is allocatedMichael Niedermayer
Fixes: out of array access Fixes: 18499/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5749038406434816 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 7a1b30c871c873e97c93af75f925c854de7b75f2) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/apedec: Fix 2 integer overflowsMichael Niedermayer
Fixes: signed integer overflow: 2119056926 - -134217728 cannot be represented in type 'int' Fixes: 18728/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5747539563511808 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 6e15ba2d1f688c61759001839811b11903de9ce0) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avformat/id3v2: Fix double-free on errorAndreas Rheinhardt
ff_id3v2_parse_priv_dict() uses av_dict_set() with the flags AV_DICT_DONT_STRDUP_KEY and AV_DICT_DONT_STRDUP_VAL. In this case both key and value are freed on error (and owned by the destination dictionary on success), so that freeing them again on error is a double-free and therefore forbidden. But it nevertheless happened. Fixes CID 1452489 and 1452421. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 67d4940a7795aa3afc8d1e624de33b030e0be51e) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/wmaprodec: Set packet_loss when we error out on a sanity checkMichael Niedermayer
Fixes: left shift of negative value -34 Fixes: 18719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAPRO_fuzzer-5642658173419520 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit a9cbd25d89dbdf72f7b616fdf672d7da36143cfe) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/wmaprodec: Check offsetMichael Niedermayer
Fixes: index 33280 out of bounds for type 'float [32768]' Fixes: 18718/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA2_fuzzer-5635373899710464 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 5473c7825ea627a115155313a56a907d67a0d0c1) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/truemotion2: Fix 2 integer overflows in tm2_low_res_block()Michael Niedermayer
Fixes: signed integer overflow: 1778647621 + 574372924 cannot be represented in type 'int' Fixes: 18692/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-6248679635943424 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 93d52a181ec050d3a4fb68f526604d39cd006be5) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/wmaprodec: Check if the channel sum of all internal contexts match ↵Michael Niedermayer
the external Fixes: NULL pointer dereference Fixes: 18689/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XMA1_fuzzer-5715114640015360 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 090ac5799751c6f52358da4e5201a3845760db93) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/atrac9dec: Check q_unit_cnt more completely before using it to ↵Michael Niedermayer
access at9_tab_band_ext_group Fixes: index 8 out of bounds for type 'const uint8_t [8][3]' Fixes: 19127/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5709394985091072 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Lynne <dev@lynne.ee> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit e1d836d2375c93cbc44a2b0d34e404682c1e8436) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/fitsdec: Use lrint()Michael Niedermayer
Fixes: fate-fitsdec-bitpix-64 Possibly Fixes: -nan is outside the range of representable values of type 'unsigned short' Possibly Fixes: 17769/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5678314672357376 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 37f31f4e509fe4ccc56a64edaa6fa3d95ee20466) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-31avcodec/g729dec: Avoid using buf_sizeMichael Niedermayer
buf_size is not updated as buf is advanced so it is wrong after the first iteration Fixes: Timeout (160sec -> 27sec) Fixes: 18658/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G729_fuzzer-5729784269373440 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 336f9461df7d2005db9d1af4f5f81fd033025ce2) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-19 16:29:51 +0000