wrapper/FFmpeg
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
88938 commits 40 branches 405 tags 230 MiB
Commit graph

20575 commits

Author SHA1 Message Date
Michael Niedermayer
abb8a37bf8 avformat/flvdec: Check for nesting depth in amf_skip_tag() 
Fixes: out of array access
Fixes: 29440/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5985279812960256.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2ef522c918)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
d99234eec2 avformat/flvdec: Check for nesting depth in amf_parse_object() 
Fixes: out of array access
Fixes: 29202/clusterfuzz-testcase-minimized-ffmpeg_dem_KUX_fuzzer-5112845840809984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 074e204b42)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
f465193646 avformat/asfdec_o: Check for EOF in asf_read_marker() 
Fixes: Timeout
Fixes: 26460/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-5710884393189376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9e3d09f435)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
2d104fd260 avformat/utils: Check dts - (1<<pts_wrap_bits) overflow 
Fixes: signed integer overflow: -9223372036842389247 - 2147483648 cannot be represented in type 'long long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_FLV_fuzzer-4845007531671552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d82ee907d6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
74b28ca1ab avformat/bfi: Check chunk_header 
Fixes: signed integer overflow: -2147483648 - 3 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_BFI_fuzzer-6665764123836416

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 638a151a87)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
ec0eb88a39 avformat/ads: Check size 
Fixes: signed integer overflow: -2147483616 - 64 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_ADS_fuzzer-6617769344892928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c78b2b138c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
fd7d3d6043 avformat/iff: Check block align also for ID_MAUD 
Fixes: Timeout & OOM
Fixes: 28701/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5185094964871168
Fixes: 29116/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4874284795297792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b17ffe8f8f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
f897515f5f avformat/fitsdec: Better size checks 
Fixes: out of array access
Fixes: 26819/clusterfuzz-testcase-minimized-ffmpeg_dem_FITS_fuzzer-5634559355650048
Fixes: 26820/clusterfuzz-testcase-minimized-ffmpeg_dem_FITS_fuzzer-5760774955597824
Fixes: 27379/clusterfuzz-testcase-minimized-ffmpeg_dem_FITS_fuzzer-5129775942991872.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 14bbb6bb30)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
5a2d068627 avformat/mxfdec: Fix integer overflow in next position in mxf_read_local_tags() 
Fixes: signed integer overflow: 9223372036854775723 + 8192 cannot be represented in type 'long'
Fixes: 29072/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4812604904177664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d3d9b1fc8e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
d287614620 avformat/avidec: dv does not support palettes 
Fixes: memleak
Fixes: 26937/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5763003338981376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b373b41d9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
41d3d169b4 libavformat/utils: consider avio_size() failure in ffio_limit() 
Fixes: Timeout (>20sec -> 3ms)
Fixes: 26918/clusterfuzz-testcase-minimized-ffmpeg_dem_THP_fuzzer-5750425191710720

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b1dac2716)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
1f29e97714 avformat/nistspheredec: Check bits_per_coded_sample and channels 
Fixes: signed integer overflow: 80 * 92233009 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_NISTSPHERE_fuzzer-6669100654919680

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 60770a50fb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
21b22a76d6 avformat/asfdec_o: Check size vs. offset in detect_unknown_subobject() 
Fixes: signed integer overflow: 2314885530818453566 + 7503032301549264928 cannot be represented in type 'long'
Fixes: 26639/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6024222100684800

Alternatively this could be ignored but then the end condition of the loop
would be hard to reach as avio_tell() is int64_t

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0bee216ad4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
13c058d51c avformat/utils: check for integer overflow in av_get_frame_filename2() 
Fixes: signed integer overflow: 317316873 * 10 cannot be represented in type 'int'
Fixes: 24708/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5731180885049344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 03c479ce23)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
2e239cbcb8 avformat/sbgdec: Reduce the amount of floating point in str_to_time() 
Fixes: 1e+75 is outside the range of representable values of type 'long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6626834808700928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ac6c8993f7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
4f4d738dea avformat/mxfdec: Free all types for both Descriptors 
Fixes: memleak
Fixes: 26352/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5201158714687488

Suggested-by: Tomas Härdin <tjoppen@acc.umu.se>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 88519be8db)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
26c82e3038 uavformat/rsd: check for EOF in extradata 
Fixes: OOM
Fixes: 26503/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-6530816735444992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7186ec88b9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
c9b74bbec2 avformat/mpegts: Fix argument type for av_log 
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 654b21ef17)
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
607098b74a avformat/cafdec: clip sample rate 
Fixes: 1.21126e+111 is outside the range of representable values of type 'int'
Fixes: 27398/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5412960339755008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 684aec6a68)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
3049331a49 avformat/mpegts: Increase pcr_incr width to 64bit 
Fixes: division by zero
Fixes: 26459/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5666350112178176
Fixes: 28154/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5195728439476224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ef7b117b7b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
8a3b513aa7 avformat/mov: Check if hoov is at the end 
Fixes: Timeout, probably infinite loop
Fixes: 26559/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5391165484171264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0afbaabdca)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
eeb387c9a5 avformat/iff: Check data_size 
Fixes: infinite loop
Fixes: 27834/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5694930919620608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 001bc594d8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
38e6692a31 avformat/matroskadec: Sanity check codec_id/track type 
Fixes: memleak
Fixes: 27766/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-5198300814508032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7b88dd8f0c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
f817e1396e avformat/rpl: Check the number of streams 
Fixes: out of memory access
Fixes: 27787/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-4743666463408128.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0677bdb1f5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
6996bf684e avformat/dsfdec: Check block_align more completely 
Fixes: infinite loop
Fixes: 26865/clusterfuzz-testcase-minimized-ffmpeg_dem_DSF_fuzzer-5649473830912000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 65b8974d54)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
a8584c6cbf avformat/mpc8: Check remaining space in mpc8_parse_seektable() 
Fixes: Fixes infinite loop
Fixes: 26704/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6327056939614208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4f66dd13d0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
7dcf0f1ebb avformat/id3v2: Sanity check tlen before alloc and uncompress 
Fixes: Timeout (>20sec -> 65ms)
Fixes: 26896/clusterfuzz-testcase-minimized-ffmpeg_dem_DAUD_fuzzer-5691024049176576
Fixes: 27627/clusterfuzz-testcase-minimized-ffmpeg_dem_AEA_fuzzer-4907019324358656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d7f87a4b9e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
8d4d02c13a avformat/vqf: Check len for COMM chunks 
Fixes: Infinite loop
Fixes: 26696/clusterfuzz-testcase-minimized-ffmpeg_dem_VQF_fuzzer-5648269168082944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a834af133b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
9b82853d3c avformat/cafdec: Check the return code from av_add_index_entry() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9dc3301745)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
a0f3a049e6 avformat/cafdec: Check for EOF in index read loop 
Fixes: OOM
Fixes: 27398/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-541296033975500

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eb46939e3a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
f7fe3969ef avformat/cafdec: Check that bytes_per_packet and frames_per_packet are non negative 
These fields are not signed in the spec (1.0) so they cannot be negative
Changing bytes_per_packet to unsigned would not solve this as it is exported
as block_align which is signed

Fixes: Infinite loop
Fixes: 26492/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5632087614554112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5eed718087)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
3293cf065e avformat/mpc8: correct integer overflow in mpc8_parse_seektable() 
Fixes: signed integer overflow: -4683718486770919638 * 2 cannot be represented in type 'long'
Fixes: 26704/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6327056939614208
Fixes: 27550/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6259212652642304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0897402ac8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
9162b1a60d avformat/mpc8: correct 32bit timestamp truncation 
Fixes: left shift of 65536 by 15 places cannot be represented in type 'int'
Fixes: 26801/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-5164313092030464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ad3e495657)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
caefd7a3ba avformat/avs: Use 64bit for the avio_tell() output 
Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented in type 'long'
Fixes: 26549/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS_fuzzer-4844306424397824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1278f117d7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
9ca75063ea avformat/wavdec: More complete size check in find_guid() 
Fixes: signed integer overflow: 9223372036854775807 + 8 cannot be represented in type 'long'
Fixes: 27341/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5442833206738944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a207df2acb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
b9df29a393 avformat/iff: Check size before skip 
Fixes: Infinite loop
Fixes: 27292/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5731168991051776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8b50e8bc29)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
5515c34baf avformat/rmdec: Check for EOF in index packet reading 
Fixes: Timeout(>10sec -> 1ms)
Fixes: 27284/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6304211110985728

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ebf4bc629e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
ea83351a49 avformat/icodec: Check for zero streams and stream creation failure 
Fixes: NULL pointer dereference
Fixes: 26814/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-5758487797432320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b33233bd53)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
ee7cdaaa3f avformat/icodec: Factor failure code out in read_header() 
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 27ee67c00f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
1703863faa avformat/bintext: Check width 
Fixes: division by 0
Fixes: 26780/clusterfuzz-testcase-minimized-ffmpeg_dem_ADF_fuzzer-5117945027756032
Fixes: 26998/clusterfuzz-testcase-minimized-ffmpeg_dem_ADF_fuzzer-5119352359354368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f6dc285fb5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
3dc3b95910 avformat/sbgdec: Check that end is not before start 
Fixes: signed integer overflow: -9223372036854775808 + -5279949906739200 cannot be represented in type 'long'
Fixes: 26908/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6329610851319808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9ef60a66f1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
3454254eb4 avformat/lvfdec: Check stream_index before use 
Fixes: assertion failure
Fixes: 26905/clusterfuzz-testcase-minimized-ffmpeg_dem_LVF_fuzzer-5724267599364096.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b1d99ab14f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
78f990e9bd avformat/au: cleanup on EOF return in au_read_annotation() 
Fixes: memleak
Fixes: 26841/clusterfuzz-testcase-minimized-ffmpeg_dem_AU_fuzzer-5174166309044224
Regression since: e680d50eb4
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d16974c3dd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
bec8415990 avformat/mpegts: Limit copied data to space 
Fixes: out of array access
Fixes: 26816/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-6282861159907328.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 79cf7c7191)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
e51ff9d5fd avformat/bintext: Check width in idf_read_header() 
Fixes: division by 0
Fixes: 26802/clusterfuzz-testcase-minimized-ffmpeg_dem_IDF_fuzzer-5180591554953216.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 442d53f409)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
992fd3262d avformat/iff: check size against INT64_MAX 
Bigger sizes are misinterpreted as negative numbers by the API
Fixes: infinite loop
Fixes: 26611/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4890614975692800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f291cd681b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
774b06e252 avformat/paf: Check for EOF in read_table() 
Fixes: OOM
Fixes: 26528/clusterfuzz-testcase-minimized-ffmpeg_dem_PAF_fuzzer-5081929248145408
Fixes: 26584/clusterfuzz-testcase-minimized-ffmpeg_dem_PAF_fuzzer-5172661183053824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 437b7302b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
570884a6c4 avformat/gxf: Check pkt_len 
Fixes: Infinite loop
Fixes: 26576/clusterfuzz-testcase-minimized-ffmpeg_dem_GXF_fuzzer-4823080360476672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dad9a86ca7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
025be7dfca avformat/aiffdec: Check packet size 
Fixes: Fixes infinite loop
Fixes: 26575/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-5727522236661760

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ba71a72d3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00
Michael Niedermayer
7186ab2b7d avformat/concatdec: use av_strstart() 
Fixes: out array read
Fixes: 26610/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-5631838049271808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2610acb49a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-11 21:23:48 +02:00