Commit graph

38230 commits

Author SHA1 Message Date
Michael Niedermayer
6ea4287893 avcodec/dss_sp: Fix runtime error: signed integer overflow: 2147481189 + 4096 cannot be represented in type 'int'
Fixes: 1441/clusterfuzz-testcase-minimized-6223152357048320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-10 21:32:53 +02:00
James Almer
6655939f03 avcodec/hevc_sei: remove bugus debug message
Also Change the active_parameter_sets function name to one more in line
with the rest of the file.

Signed-off-by: James Almer <jamrial@gmail.com>
2017-05-10 14:59:03 -03:00
James Almer
f738140807 avcodec/hevc_sei: fix amount of bits skipped when reading picture timing SEI message
The code was skipping the entire reported SEI message size regardless of
the amount of bits read.
While in theory safe for NALU where the picture timing SEI message is alone
or at the end as we're using the checked bitstream reader, it isn't in any
other situation, where every SEI message in the NALU after the picture
timing one would potentially fail to parse.

Change the function name to one more in line with the rest of file, and
remove the bogus "Skipped SEI" debug message while at it.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
2017-05-10 14:56:17 -03:00
Michael Niedermayer
5871adc90f avcodec/cavs: Check updated MV
Fixes: runtime error: signed integer overflow: 251 + 2147483647 cannot be represented in type 'int'
Fixes: 1438/clusterfuzz-testcase-minimized-4917542646710272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-10 15:21:10 +02:00
Michael Niedermayer
3d8d372947 avcodec/y41pdec: Fix width in input buffer size check
Fixes: out of array read
Fixes: 1437/clusterfuzz-testcase-minimized-4569970002362368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-10 14:34:34 +02:00
Sumit Agarwal
01775730fd avcodec/nvenc: add weighted prediction support
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org>
2017-05-10 10:22:41 +02:00
Ben Chang
18a659d1b6 avcodec/nvenc: add fractional CQ support
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org>
2017-05-10 10:21:25 +02:00
Michael Niedermayer
ae6fd1790f avcodec/svq3: Fix multiple runtime error: signed integer overflow: -237341 * 24552 cannot be represented in type 'int'
Fixes: 1429/clusterfuzz-testcase-minimized-5959951610544128

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-10 01:27:15 +02:00
Michael Niedermayer
2bd8eb05d2 avcodec/texturedsp: Fix runtime error: left shift of 218 by 24 places cannot be represented in type 'int'
Fixes: 1428/clusterfuzz-testcase-minimized-5263281793007616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-10 01:19:03 +02:00
Michael Niedermayer
ed3c9b5b0d avcodec/lagarith: Check scale_factor
Fixes: 1425/clusterfuzz-testcase-minimized-6295712339853312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-10 01:10:55 +02:00
Michael Niedermayer
ddb2dd7edb avcodec/lagarith: Fix runtime error: left shift of negative value -1
Fixes: 1424/clusterfuzz-testcase-minimized-6088327159611392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-10 01:10:55 +02:00
Michael Niedermayer
c5d2fa2fdf avcodec/takdec: Fix multiple runtime error: left shift of negative value -1
Fixes: 1423/clusterfuzz-testcase-minimized-5063889899225088

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-10 01:10:55 +02:00
Michael Niedermayer
f1a4dd5e48 avcodec/scpr: Fix multiple runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 1422/clusterfuzz-testcase-minimized-5030993939398656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-09 19:46:17 +02:00
Michael Niedermayer
62c5949bec avcodec/cllc: Check prefix
Fixes: runtime error: left shift of 1610706944 by 1 places cannot be represented in type 'int'
Fixes: 1421/clusterfuzz-testcase-minimized-6239947507892224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-09 19:39:43 +02:00
Michael Niedermayer
72810d20b7 avcodec/webp: Update canvas size in vp8_lossy_decode_frame() as in vp8_lossless_decode_frame()
Fixes: 1407/clusterfuzz-testcase-minimized-6044604124102656
Fixes: 1420/clusterfuzz-testcase-minimized-6059927359455232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-09 19:11:58 +02:00
Michael Niedermayer
c4f63b78b7 avcodec/webp: Factor update_canvas_size() out
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-09 19:11:58 +02:00
Michael Niedermayer
2f2bc2e246 avcodec/webp: Check for VP8X after other VP8 chunks
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-09 19:11:58 +02:00
Timo Rothenpieler
cfbebe9dda avcodec/nvenc: deprecated old rc modes, add new ones 2017-05-09 18:38:30 +02:00
Timo Rothenpieler
fea4713472 avcodec/cuvid: use capability check instead of dummy decoder 2017-05-09 18:38:30 +02:00
Timo Rothenpieler
23538ad2eb avcodec/nvenc: remove usage of deprecated fields 2017-05-09 18:38:30 +02:00
Michael Niedermayer
78aa93807b avcodec/snowdec: Check width
Fixes: out of array read
Fixes: 1419/clusterfuzz-testcase-minimized-6108700873850880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-09 16:50:18 +02:00
Michael Niedermayer
ea627dc094 avcodec/snowdec: Remove unneeded {}
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-09 16:50:18 +02:00
Michael Niedermayer
3f5a68533d avcodec/flacdec: Return error code instead of 0 for failures
Fixes: infinite loop
Fixes: 1418/clusterfuzz-testcase-minimized-5934472438480896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-09 16:50:18 +02:00
Aaron Levinson
ae5b67ee64 qsvenc: Make sure the interlaced encoding works
Purpose: qsvenc: make sure that interlaced encoding works.  Also,
reduce the vertical alignment constraint when possible to reduce
memory usage.

Note: Most of this code used to be present in ffmpeg and was
eliminated in revision 1f26a23 on Oct. 31, 2016 (qsv: Merge libav
implementation, at
1f26a231bb
edfa#diff-7d84a34d58597bb7aa4b8239dca1f9f8).  Already applied to
libav.

Reviewed-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 8fd8f91e47)
Signed-off-by: Mark Thompson <sw@jkqxz.net>
Signed-off-by: Aaron Levinson <alevinsn@aracnet.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-09 03:22:14 +02:00
Aaron Levinson
dd8319767e qsvenc: Use MFXVideoENCODE_Query() to update the parameters
Purpose: Fill out the default/unset parameters with ones actually in use.

Note: Matches the current MediaSDK example code.  This code used to be
present in ffmpeg and was eliminated in revision 1f26a23 on Oct. 31,
2016 (qsv: Merge libav implementation, at
1f26a231bb (diff-7d84a34d58597bb7aa4b8239dca1f9f8)).
Already applied to libav.

Reviewed-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit b22094d749)
Signed-off-by: Mark Thompson <sw@jkqxz.net>
Signed-off-by: Aaron Levinson <alevinsn@aracnet.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-09 03:22:14 +02:00
Michael Niedermayer
28230a690e avcodec/clearvideo: Fix runtime error: signed integer overflow: 181 * 18050756 cannot be represented in type 'int'
Fixes: 1417/clusterfuzz-testcase-minimized-6606778030620672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-09 00:42:20 +02:00
Michael Niedermayer
159fb8ff7e avcodec/indeo2: Check for invalid VLCs
Fixes: timeout
Fixes: 1416/clusterfuzz-testcase-minimized-5536862435278848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-09 00:42:20 +02:00
Michael Niedermayer
548459080b avcodec/fic: Check coefficients
Fixes: signed integer overflow: 1258291200 * 2 cannot be represented in type 'int'
Fixes: 1413/clusterfuzz-testcase-minimized-5923451770503168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-09 00:42:20 +02:00
Michael Niedermayer
d3088e0fd8 avcodec/g723_1dec: Fix several integer related cases of undefined behaviour
Fixes: 1412/clusterfuzz-testcase-minimized-6561308772139008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-09 00:42:20 +02:00
James Almer
f089e02fa2 Merge commit '019ab88a95'
* commit '019ab88a95':
  lavc: add an option for exporting cropping information to the caller

Merged-by: James Almer <jamrial@gmail.com>
2017-05-08 14:22:43 -03:00
Michael Niedermayer
7b94df232a avcodec/srtdec: Check ff_htmlmarkup_to_ass() return code
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-08 17:02:02 +02:00
Michael Niedermayer
983e3fbcc5 avcodec/samidec: Check ff_htmlmarkup_to_ass() return code
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-08 17:02:02 +02:00
Michael Niedermayer
f4ae3cce64 avcodec/htmlsubtitles: Check for string truncation and return error
Fixes out of array access
Fixes: 1354/clusterfuzz-testcase-minimized-5520132195483648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-08 17:02:02 +02:00
Michael Niedermayer
aaeec1c654 avcodec/wavpack: Fix signed integer overflow: 1285114081 * 2 cannot be represented in type 'int'
Fixes: 945/clusterfuzz-testcase-6037937588273152
Fixes: integer overflow

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-08 17:02:02 +02:00
James Almer
2cb656ad11 avcodec/mjpegenc: move ff_mjpeg_encode_picture_frame to mjpegenc_common
Fixes compilation of ljpeg encoder if mjpeg and amv encoders are disabled
2017-05-08 11:33:57 -03:00
Michael Niedermayer
29692023b2 avcodec/bmvvideo: Fix runtime error: left shift of 137 by 24 places cannot be represented in type 'int'
Fixes: 1411/clusterfuzz-testcase-minimized-5776085184675840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-08 15:47:29 +02:00
Michael Niedermayer
ea59ef0c03 avcodec/dss_sp: Fix multiple runtime error: signed integer overflow: -15699 * -164039 cannot be represented in type 'int'
Fixed: 1409/clusterfuzz-testcase-minimized-5237365020819456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-08 15:41:15 +02:00
Michael Niedermayer
0075d9eced avcodec/dvbsubdec: check region dimensions
Fixes: 1408/clusterfuzz-testcase-minimized-6529985844084736
Fixes: integer overflow

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-08 15:28:26 +02:00
Michael Niedermayer
8824b7370a avcodec/vp8dsp: Fixes: runtime error: signed integer overflow: 1330143360 - -1023040530 cannot be represented in type 'int'
Fixes: 1406/clusterfuzz-testcase-minimized-5064865125236736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-08 12:30:09 +02:00
Michael Niedermayer
5d5118f81b avcodec/hqxdsp: Fix multiple runtime error: signed integer overflow: 248220 * 21407 cannot be represented in type 'int' in idct_col()
Fixes: 1405/clusterfuzz-testcase-minimized-5011491835084800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-08 12:30:09 +02:00
Michael Niedermayer
279420b5a6 avcodec/cavsdec: Check sym_factor
Fixes: runtime error: signed integer overflow: 25984 * 130560 cannot be represented in type 'int'

Fixes: 1404/clusterfuzz-testcase-minimized-5000441286885376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-08 12:30:09 +02:00
Michael Niedermayer
1e42736b95 avcodec/cdxl: Check format for BGR24
Fixes: out of array access
Fixes: 1427/clusterfuzz-testcase-minimized-5020737339392000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-08 12:30:09 +02:00
Daniil Cherednik
b8c2b9c392 avcodec/dcaenc: Initial implementation of ADPCM encoding for DCA encoder 2017-05-08 05:56:14 +01:00
Michael Niedermayer
5f928c5201 avcodec/rangecoder: Test for invalid corner case
Fixes runtime error: left shift of 1912602815 by 8 places cannot be represented in type 'int'
Fixes: 1403/clusterfuzz-testcase-minimized-4724820484816896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-08 03:25:17 +02:00
Michael Niedermayer
3a4d387195 avcodec/ffv1dec: Fix copying planes of paletted formats
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-08 03:25:17 +02:00
Michael Niedermayer
8b1f66cf5c avcodec/wmv2dsp: Fix runtime error: signed integer overflow: 181 * -12156865 cannot be represented in type 'int'
Fixes: 1401/clusterfuzz-testcase-minimized-6526248148795392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-08 03:25:17 +02:00
Michael Niedermayer
441026fcb1 avcodec/xwddec: Check bpp more completely
Fixes out of array access
Fixes: 1399/clusterfuzz-testcase-minimized-4866094172995584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-07 19:32:33 +02:00
Michael Niedermayer
a5e0dbf530 avcodec/aacdec_template: Do not decode 2nd PCE if it will lead to failure
Fixes: out of array read
Fixes: 1072/clusterfuzz-testcase-6456688074817536
Fixes: 1398/clusterfuzz-testcase-minimized-4576913622302720

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-07 19:32:33 +02:00
Michael Niedermayer
a38e9797cb avcodec/s302m: Fix left shift of 8 by 28 places cannot be represented in type 'int'
Fixes: 1395/clusterfuzz-testcase-minimized-5330939741732864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-07 19:32:33 +02:00
Michael Niedermayer
0ac1c87194 avcodec/eamad: Fix runtime error: signed integer overflow: 49674 * 49858 cannot be represented in type 'int'
Fixes: 1394/clusterfuzz-testcase-minimized-6493376885030912

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-05-07 19:32:33 +02:00