wrapper/FFmpeg
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
88297 commits 40 branches 405 tags 230 MiB
Commit graph

88297 commits

This branch
This branch
All branches
Author SHA1 Message Date
Michael Niedermayer
3bdd16fd68 avcodec/hevc_ps: Fix integer overflow with num_tile_rows and num_tile_columns 
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 14880/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5130977304641536

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c692051252)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
9a7d3304ff avcodec/apedec: Add k < 24 check to the only k++ case which lacks such a check 
Fixes: 15255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5718831688843264
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3d4f4f4a15)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
241f59eb8b avformat/aviobuf: Delay buffer downsizing until asserts are met 
Fixes: Assertion failure
Fixes: 15151/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5757079496687616
Fixes: 15205/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5767573242642432
May fix: Ticket7094

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0334632d5c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
6aaca5234d avcodec/fitsdec: Check data_min/max 
Fixes: division by 0
Fixes: 15206/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5657260212092928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eb82d19f03)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
80bbb8b851 avcodec/m101: Fix off be 2 error 
Fixes: out of array read
Fixes: 15263/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_M101_fuzzer-5728999453491200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 89b96900fa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
d84f4c0c25 avcodec/qdm2: Move fft_order check up 
This avoids undefined computations with unchecked values

Fixes: shift exponent -21 is negative
Fixes: 15262/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5651261753393152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8d8b8c4ac6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
9856f1f615 avcodec/libvorbisdec: Check extradata size 
Fixes: out of array read
Fixes: 15261/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVORBIS_fuzzer-5764908467093504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cf3c245566)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
93baaaaa8c avformat/vqf: Check header_size 
Fixes: 15271/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5735262606327808
Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7c30ff3888)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
ec2b12fa05 avcodec/utils: Check bits_per_coded_sample 
This avoids the need for each decoder separately having to handle this case

Fixes: shift exponent -100663046 is negative
Fixes: out of array access
Fixes: 15270/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5727829913763840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d33414d2ad)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
f1400191c6 avcodec/videodsp_template: Fix overflow of addition 
Fixes: addition of unsigned offset to 0x7f56fc26a9b6 overflowed to 0x7f56fc26a8be*
Fixes: clusterfuzz-testcase-minimized-mediasource_MP4_AVC1_pipeline_integration_fuzzer-4917949056679936

Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 247a1de7f7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
55fca6e6e5 avcodec/alsdec: Fix invalid shift in multiply() 
Fixes: shift exponent -24 is negative
Fixes: 15292/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5768533318828032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f30be1ec98)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
fb81fd52d3 avcodec/ffwavesynth: Check ts_end - ts_start for overflow 
Fixes: signed integer overflow: 2314885530818453536 - -8926099139098304480 cannot be represented in type 'long'
Fixes: 15259/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5764366093254656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2db7a3bc4a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
0409e5fe36 avcodec/vc1dsp: Avoid undefined shifts in vc1_v_s_overlap_c / vc1_h_s_overlap_c 
Fixes: left shift of negative value -13
Fixes: 15260/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5702076048343040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 507ca66ee4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
5a49cad78a avcodec/tta: Fix undefined shift 
Fixes: left shift of negative value -4483
Fixes: 15256/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5738691617619968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ebccd2f778)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
7887aa79de avcodec/qdmc: Fix integer overflows in PRNG 
Fixes: signed integer overflow: 214013 * 2531011 cannot be represented in type 'int'
Fixes: 15254/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDMC_fuzzer-5698137026461696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2921b45a38)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
6aa01c0625 avcodec/bintext: Check font height 
Fixes: division by zero
Fixes: 15257/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINTEXT_fuzzer-5757352881422336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bfb58bdd70)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
00d5a47039 avcodec/binkdsp: Fix integer overflows in idct 
Fixes: signed integer overflow: 3784 * 682038 cannot be represented in type 'int'
Fixes: 15265/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5088311799971840
Fixes: 15268/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5666502344179712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7a072fbcc4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
ed92170916 avcodec/motionpixels: Check for vlc error in mp_get_vlc() 
Fixes: 15246/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOTIONPIXELS_fuzzer-5168534407086080
Fixes: runtime error: index -1 out of bounds for type 'HuffCode [16]'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 930cdef80a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
65326b27b6 avcodec/loco: Limit lossy parameter so it is sane and does not overflow 
Fixes: 15248/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5087440458481664
Fixes: signed integer overflow: 3 + 2147483647 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce3b0b9066)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
a77473d040 avformat/mov: Set fragment.found_tfhd only after TFHD has been parsed 
Fixes: Assertion failure
Fixes: crbug971646.mp4

Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 696312c487)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
eca9b4022b avcodec/xpmdec: Do not use context dimensions as temporary variables 
Fixes: Integer overflow
Fixes: 15134/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XPM_fuzzer-5722635939348480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5ea7f20500)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
91348aa5ba avcodec/fitsdec: Fix division by 0 in size check 
Fixes: division by zero
Fixes: 15210/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5746033243455488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 07ffe94c17)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
36f8bb1261 avcodec/aacpsdsp_template: Fix integer overflow in ps_hybrid_analysis_c() 
Fixes: signed integer overflow: -1539565182 + -798086761 cannot be represented in type 'int'
Fixes: 14807/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-564925382682214

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f8f5668df5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
7ca17d973b avcodec/truemotion2: Fix integer overflow in last loop in tm2_update_block() 
Fixes: signed integer overflow: -1727985666 - 538976288 cannot be represented in type 'int'
Fixes: 15031/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5100228035739648

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3aecd01704)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
d88be9bc67 avcodec/iff: finetune the palette size check in the mask case 
Fixes: out of array access
Fixes: 15381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5668057826983936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0f9789c8e3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
67ad2f201c avcodec/iff: Fix mask_buf / mask_palbuf leak 
Fixes: 15372/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5708881759567872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 92e8db532c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
1246e38511 avformat/icodec: Free ico->images on error paths 
Fixes: 15116/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5715173567889408
Fixes: memleak

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 54918b5116)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
25d3ae9697 avformat/wsddec: Fix undefined shift 
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 15123/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5738039235575808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 112eb17a2b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
30047c052d avcodec/fmvc: Check if header fields are available before allocating the image 
Fixes: Timeout (15sec -> 0.5sec)
Fixes: 14846/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FMVC_fuzzer-5068322120400896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 561cc161ca)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
039c7d21f6 avcodec/bink: Reorder operations in init to avoid memleak on error 
Fixes: Direct leak of 536 byte(s) in 1 object(s)
Fixes: 15266/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5629530426834944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2603f25d32)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
a8ff09d7b7 avformat/wtvdec: Avoid (32bit signed) sectors 
Fixes: left shift of negative value -14614752
Fixes: 15174/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5670543606415360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dd357d76e5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
c8f7f583c0 avcodec/bitstream: Check for more conflicting codes in build_table() 
Fixes: out of array read
Fixes: 14563/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5646451545210880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a7e3b271fc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
8d2d04569a avcodec/bitstream: Check for integer code truncation in build_table() 
Fixes: out of array read
Fixes: 14563/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5646451545210880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e78b0f8374)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
5b4ceb45e3 avformat/sbgdec: Fixes integer overflow in str_to_time() with hours 
Fixes: signed integer overflow: 904444 * 3600 cannot be represented in type 'int'
Fixes: 15113/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5764083346833408

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2a0f23b9d6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
62c408412f avformat/vpk: Check offset for validity 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aa003019ab)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
d14dd61a3d avformat/vpk: Fix integer overflow in samples_per_block computation 
Fixes: signed integer overflow: 84026453 * 28 cannot be represented in type 'int'
Fixes: 15111/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5675630072430592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8c6c4129b4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
b8bb86efe7 avcodec/mjpegdec: Check for non ls PAL8 
Fixes: Null-dereference READ in av_malloc
Fixes: 15002/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-5643474625363968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 442375fee7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
84b444aa78 avcodec/interplayvideo: check decoding_map_size with video_data_size 
Fixes: Timeout (90543 ms -> 59 ms)
Fixes: 14721/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_VIDEO_fuzzer-5697492148027392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 914d6a7c1a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
a2927d38cb avcodec/h264_parse: Use 64bit for expectedpoc and expected_delta_per_poc_cycle 
Fixes: signed integer overflow: -2142516591 + -267814575 cannot be represented in type 'int'
Fixes: 14450/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5716105319940096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4896fa18ad)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
ac7d876723 avcodec/mss4: Check input size against skip bits 
Fixes: Timeout (17sec -> 20ms)
Fixes: 14615/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MTS2_fuzzer-5093007763701760
Fixes: 14797/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MTS2_fuzzer-5651696119709696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0fef412dff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
ddf153b139 avcodec/diracdec: Fix integer overflow in global_mv() 
Fixes: signed integer overflow: 16384 * 196607 cannot be represented in type 'int'
Fixes: 14810/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5091232683917312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a99ffb5bb4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
14a62019bb avcodec/vmnc: Check available space against chunks before reget_buffer() 
Fixes: Timeout (16sec -> 60ms)
Fixes: 14673/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VMNC_fuzzer-5640217517621248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 279d9a84af)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
5866e20b01 avcodec/aacdec_template: skip apply_tns() if max_sfb is 0 (from previous header decode failure) 
Fixes: NULL pointer dereference
Fixes: 14723/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5654612436058112
Fixes: 14724/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5712607111020544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cf3156e762)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
1dc80a7d4e avcodec/aacdec_fixed: Handle more extreem cases in noise_scale() 
Its unclear if these cases have any relevance in real files

Fixes: shift exponent -2 is negative
Fixes: 14489/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5681941631729664

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3d14663f83)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
1b2691fe1a avcodec/aacdec_template: Merge 3 #ifs related to noise handling 
Fewer #if and fewer lines

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bc33c99d56)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
e575ac8d84 avcodec/aacdec_fixed: ssign seems always -1 in noise_scale(), simplify 
(cherry picked from commit 3d5863d739)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
20ecac12c9 avformat/mp3enc: Avoid SEEK_END as it is unsupported 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bf3ee6a130)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
eec89990b5 avcodec/truemotion2: Fix several integer overflows in tm2_update_block() 
Fixes: signed integer overflow: -1877966852 + -469491713 cannot be represented in type 'int'
Fixes: 14561/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5167608359288832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8eecf761a6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
e1ceb17ee3 avformat/webm_chunk: Specify expected argument length of get_chunk_filename() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1a74b04737)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00
Michael Niedermayer
abb7d3f1d0 avformat/webm_chunk: Check header filename length 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3b5b977c9f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2019-11-14 23:30:37 +01:00