Michael Niedermayer
62dfe4f411
avformat/rmdec: check tag_size
...
Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6598073725353984
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2cb7ee8a36michael@niedermayer.cc >
2022-10-28 21:04:04 +02:00
Michael Niedermayer
7280495991
avformat/nutdec: Check fields
...
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6566001610719232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c146406eamichael@niedermayer.cc >
2022-10-28 21:04:04 +02:00
Michael Niedermayer
f534619700
avformat/cafdec: Check that nb_frasmes fits within 64bit
...
Fixes: signed integer overflow: 1099511693312 * 538976288 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6565048815845376
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d4bb4e3759michael@niedermayer.cc >
2022-10-28 21:04:04 +02:00
Michael Niedermayer
3503a45d98
avformat/asfdec_o: Limit packet offset
...
avoids overflows with it
Fixes: signed integer overflow: 9223372036846866010 + 4294967047 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6538296768987136
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-657169555665715
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 736e9e69d5michael@niedermayer.cc >
2022-10-28 21:04:04 +02:00
Michael Niedermayer
fe862271a4
avformat/ape: Check frames size
...
Fixes: signed integer overflow: 9223372036854775806 + 3 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_APE_fuzzer-6389264140599296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d0349c9929michael@niedermayer.cc >
2022-10-28 21:04:04 +02:00
Michael Niedermayer
1ccd4a9eac
avformat/icodec: Check nb_pal
...
Fixes: signed integer overflow: 538976288 * 4 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-6690068904935424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit db73ae0dc1michael@niedermayer.cc >
2022-10-28 21:04:04 +02:00
Michael Niedermayer
295c6a910d
avformat/aiffdec: Check block_duration
...
Fixes: signed integer overflow: 3 * -2147483648 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6668935979728896
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1c2b6265c8michael@niedermayer.cc >
2022-10-28 21:04:04 +02:00
Michael Niedermayer
5d4b0b77f6
libavformat/hls: Free keys
...
Fixes: memleak
Fixes: 50703/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-6399058578636800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Steven Liu <lingjiujianke@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d32a9f3137michael@niedermayer.cc >
2022-10-28 21:04:04 +02:00
Michael Niedermayer
998111d4c1
avformat/asfdec_o: limit recursion depth in asf_read_unknown()
...
The threshold of 5 is arbitrary, both smaller and larger should work fine
Fixes: Stack overflow
Fixes: 50603/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6049302564175872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f1a368169michael@niedermayer.cc >
2022-10-28 21:04:04 +02:00
Michael Niedermayer
a87ad0dba0
libavformat/iff: Check for overflow in body_end calculation
...
Fixes: signed integer overflow: -6322983228386819992 - 5557477266266529857 cannot be represented in type 'long'
Fixes: 50112/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6329186221948928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bcb4690304michael@niedermayer.cc >
2022-10-28 21:04:04 +02:00
Michael Niedermayer
e6f9ae27ca
avformat/flvdec: Check for EOF in index reading
...
Fixes: Timeout
Fixes: 47992/clusterfuzz-testcase-minimized-ffmpeg_dem_LIVE_FLV_fuzzer-6020443879899136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ceff5d7b74michael@niedermayer.cc >
2022-10-28 21:04:04 +02:00
Michael Niedermayer
4228a66bef
avformat/nutdec: Check get_packetheader() in mainheader
...
Fixes; Timeout
Fixes: 48794/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6524604713140224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5de084aa6michael@niedermayer.cc >
2022-10-28 21:04:04 +02:00
Michael Niedermayer
7593a9aa21
avformat/asfdec_f: Use 64bit for packet start time
...
Fixes: signed integer overflow: 2147483647 + 32 cannot be represented in type 'int'
Fixes: 49014/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-6314973315334144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8ed78486fcmichael@niedermayer.cc >
2022-10-28 21:04:04 +02:00
Michael Niedermayer
4536262900
avformat/rtsp: break on unknown protocols
...
This function needs more cleanup and it lacks error handling
Fixes: use of uninitialized memory
Fixes: CID700776
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 73c0fd27c5michael@niedermayer.cc >
2022-10-28 21:04:04 +02:00
Michael Niedermayer
07350dede5
avformat/sctp: close socket on errors
...
This is untested as i have no testcase
Fixes: CID1302709
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c9a2996544michael@niedermayer.cc >
2022-10-28 21:04:04 +02:00
Michael Niedermayer
a3059140bd
avformat/aiffdec: cleanup size handling for extreem cases
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c6f1e48b86michael@niedermayer.cc >
2022-10-28 21:04:04 +02:00
Michael Niedermayer
b61ed4614e
avformat/aiffdec: avoid integer overflow in get_meta()
...
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 45891/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6159183893889024
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6a02de2127michael@niedermayer.cc >
2022-10-28 21:04:04 +02:00
Michael Niedermayer
c82d1ac95a
avformat/ape: more bits in size for less overflows
...
Fixes: signed integer overflow: 2147483647 + 3 cannot be represented in type 'int'
Fixes: 46184/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-4678059519770624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e5f6707a7bmichael@niedermayer.cc >
2022-10-28 21:04:04 +02:00
Michael Niedermayer
6c214b8e1a
avformat/bfi: Check offsets better
...
Fixes: signed integer overflow: -2145378272 - 538976288 cannot be represented in type 'int'
Fixes: 45690/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5015496544616448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 35dc93ab44michael@niedermayer.cc >
2022-10-28 21:04:04 +02:00
Michael Niedermayer
cc277f46ae
avformat/asfdec_f: Check packet_frag_timestamp
...
Fixes: signed integer overflow: -9223372036854775808 - 4607 cannot be represented in type 'long'
Fixes: 45685/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5280102802391040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ffc8772150michael@niedermayer.cc >
2022-10-28 21:04:04 +02:00
James Almer
40dfd62363
avformat/nutenc: don't allocate a dynamic AVIOContext if no index is going to be written
...
Fixes ticket #8295
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 1d479300cbmichael@niedermayer.cc >
2022-05-04 19:38:52 +02:00
James Almer
02161c6ed1
aformat/movenc: add missing padding to output track extradata
...
Fixes ticket #8183 .
Tested-by: Thierry Foucu <tfoucu@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 58aa0ed8f1michael@niedermayer.cc >
2022-05-04 18:31:05 +02:00
Michael Niedermayer
21caec9402
avformat/aqtitledec: Skip unrepresentable durations
...
Fixes: signed integer overflow: -5 - 9223372036854775807 cannot be represented in type 'long'
Fixes: 45665/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-475618463934054
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c2d1597a8amichael@niedermayer.cc >
2022-03-28 23:17:57 +02:00
Michael Niedermayer
2e31d39b31
avformat/cafdec: Do not store empty keys in read_info_chunk()
...
Fixes: Timeout
Fixes: 45543/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5684953164152832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7ec28e1d4cmichael@niedermayer.cc >
2022-03-28 23:16:47 +02:00
Michael Niedermayer
bcc5755ae3
avformat/matroskadec: Check pre_ns
...
Fixes: division by 0
Fixes: 44615/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6681108677263360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 710e51677amichael@niedermayer.cc >
2022-03-28 23:13:19 +02:00
Michael Niedermayer
478796dcf2
avformat/matroskadec: Use rounded down duration in get_cue_desc() check
...
Floating point is evil, it would be better if duration was not a double
Fixes: Infinite loop
Fixes: 45123/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6725052291219456
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bd3a03db9amichael@niedermayer.cc >
2022-03-28 23:07:18 +02:00
Michael Niedermayer
81e99640d5
avformat/mov: Disallow empty sidx
...
It appears this is not allowed "Each Segment Index box documents how a (sub)segment is divided into one or more subsegments
(which may themselves be further subdivided using Segment Index boxes)."
Fixes: Null pointer dereference
Fixes: Ticket9517
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4419433d77michael@niedermayer.cc >
2022-03-28 22:40:45 +02:00
Michael Niedermayer
97a21e9373
avformat/matroskadec: Check duration
...
Fixes: -nan is outside the range of representable values of type 'long'
Fixes: 44614/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6216204841254912
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 36680078camichael@niedermayer.cc >
2022-03-28 22:18:12 +02:00
Michael Niedermayer
2437e69aec
avformat/matroskadec: Check desc_bytes
...
Fixes: Division by 0
Fixes: 44035/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4826721386364928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5038933977michael@niedermayer.cc >
2022-02-16 20:10:30 +01:00
Michael Niedermayer
de04027679
avformat/utils: Fix invalid NULL pointer operation in ff_parse_key_value()
...
Fixes: pointer index expression with base 0x000000000000 overflowed to 0xffffffffffffffff
Fixes: 44012/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-5670607746891776
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 59328aabd2michael@niedermayer.cc >
2022-02-16 20:09:36 +01:00
Michael Niedermayer
437cd15ae3
avformat/matroskadec: Fix infinite loop with bz decompression
...
The same check is added to zlib too, it seems not needed there though
Fixes: Infinite loop
Fixes: 43932/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-6175167573786624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9c3d2cbb51michael@niedermayer.cc >
2022-02-16 18:57:03 +01:00
Michael Niedermayer
ea9125a43f
avformat/mov: Check size before subtraction
...
Fixes: signed integer overflow: -9223372036854775808 - 8 cannot be represented in type 'long'
Fixes: 43542/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5237670148702208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d8d9d506a3michael@niedermayer.cc >
2022-02-16 18:55:58 +01:00
Michael Niedermayer
d3abd961ee
avformat/flvdec: timestamps cannot use the full int64 range
...
We do not support this as we multiply by 1000
Fixes: signed integer overflow: -45318575073853696 * 1000 cannot be represented in type 'long'
Fixes: 42804/clusterfuzz-testcase-minimized-ffmpeg_dem_LIVE_FLV_fuzzer-4630325425209344
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c217ca7718michael@niedermayer.cc >
2022-01-13 23:10:59 +01:00
Michael Niedermayer
9b5d10d744
avformat/4xm: Check for duplicate track ids
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dd94912479michael@niedermayer.cc >
2022-01-13 22:50:52 +01:00
Michael Niedermayer
e10f67a6e6
avformat/4xm: Consider max_streams on reallocating tracks array
...
Fixes: OOM
Fixes: 41595/clusterfuzz-testcase-minimized-ffmpeg_dem_FOURXM_fuzzer-6355979363549184
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0dcd95ef8amichael@niedermayer.cc >
2022-01-13 22:50:19 +01:00
Michael Niedermayer
18c74f2e72
avformat/mov: Check next offset in mov_read_dref()
...
Fixes: signed integer overflow: 9223372036200463215 + 1109914409 cannot be represented in type 'long'
Fixes: 41480/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6553086177443840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 562021e2fdmichael@niedermayer.cc >
2022-01-13 22:46:54 +01:00
Michael Niedermayer
1c2f1591eb
avformat/mxfdec: Check for duplicate mxf_read_index_entry_array()
...
Fixes: memleak
Fixes: 41596/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6439060204290048
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f44a218e5michael@niedermayer.cc >
2022-01-13 22:44:14 +01:00
Michael Niedermayer
d403446d87
avformat/mov: Check for EOF in mov_read_glbl()
...
Fixes: Infinite loop
Fixes: 41351/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5433895854669824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 59b4e7cbd8michael@niedermayer.cc >
2021-12-06 22:06:48 +01:00
Andreas Rheinhardt
a728f4af24
avformat/movenc: Fix segfault when remuxing rtp hint stream
...
When remuxing an rtp hint stream (or any stream with the tag "rtp "),
the mov muxer treats this as one of the rtp hint tracks it creates
internally when ordered to do so; yet this track lacks the
AVFormatContext for the hinting rtp muxer, leading to segfaults in
mov_write_udta_sdp() if a "trak" atom is written for this stream; if not,
the stream's codecpar is freed by mov_free() as if the mov muxer owned
it (it does for the internally created "rtp " tracks), but without
resetting st->codecpar, leading to double-frees lateron. This commit
therefore ignores said tag which makes rtp hint streams unremuxable.
This fixes tickets #8181 and #8186 .
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 22c3cd1760michael@niedermayer.cc >
2021-10-31 18:56:48 +01:00
Paul B Mahol
e5d1808aa5
avformat/tty: add probe function
...
(cherry picked from commit 3bce9e9b3e
2021-10-31 18:45:40 +01:00
Carl Eugen Hoyos
ede7d9c4fa
lavf/rawenc: Only accept the appropriate stream type for raw muxers.
...
This does not affect the rawvideo muxer.
Fixes ticket #7979 .
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2021-10-17 21:35:41 +02:00
Michael Niedermayer
452faa80b4
avformat/icodec: Check for zero streams and stream creation failure
...
Fixes: NULL pointer dereference
Fixes: 26814/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-5758487797432320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b33233bd53michael@niedermayer.cc >
2021-10-17 21:34:53 +02:00
Michael Niedermayer
d5c4d05482
avformat/bintext: Check width in idf_read_header()
...
Fixes: division by 0
Fixes: 26802/clusterfuzz-testcase-minimized-ffmpeg_dem_IDF_fuzzer-5180591554953216.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 442d53f409michael@niedermayer.cc >
2021-10-17 21:34:53 +02:00
Michael Niedermayer
57d6ff94f0
avformat/bintext: Check width
...
Fixes: division by 0
Fixes: 26780/clusterfuzz-testcase-minimized-ffmpeg_dem_ADF_fuzzer-5117945027756032
Fixes: 26998/clusterfuzz-testcase-minimized-ffmpeg_dem_ADF_fuzzer-5119352359354368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f6dc285fb5michael@niedermayer.cc >
2021-10-17 21:34:53 +02:00
Michael Niedermayer
3b3d9a5e0a
avformat/wavdec: Check smv_block_size
...
Fixes: Timeout
Fixes: 39554/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-4915221701984256
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 849138f476michael@niedermayer.cc >
2021-10-17 21:34:53 +02:00
Michael Niedermayer
c641782f7a
oavformat/avidec: Check offset in odml
...
Fixes: signed integer overflow: 9223372036854775807 + 8 cannot be represented in type 'long'
Fixes: 38787/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-4859845799444480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 255a7b423emichael@niedermayer.cc >
2021-10-17 21:34:53 +02:00
Michael Niedermayer
100e380292
avformat/rmdec: Use 64bit for intermediate for DEINT_ID_INT4
...
Fixes: runtime error: signed integer overflow: 65312 * 65535 cannot be represented in type 'int'
Fixes: 32832/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-4817710040088576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit e2c2872393michael@niedermayer.cc >
2021-10-17 21:34:53 +02:00
Michael Niedermayer
9f352dc52d
avformat/jacosubdec: Check for min in t overflow in get_shift()
...
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 34651/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-5157941012463616
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 989febfbd0michael@niedermayer.cc >
2021-10-17 21:34:53 +02:00
Michael Niedermayer
c8174013f2
avformat/mxfdec: check channel number in mxf_get_d10_aes3_packet()
...
Fixes: Out of array access
Fixes: 37030/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5387719147651072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3dd5a8a135michael@niedermayer.cc >
2021-10-17 21:34:53 +02:00
maryam ebrahimzadeh
a5f40432b4
avformat/adtsenc: return value check for init_get_bits in adts_decode_extradata
...
As the second argument for init_get_bits (buf) can be crafted, a return value check for this function call is necessary.
'buf' is part of 'AVPacket pkt'.
replace init_get_bits with init_get_bits8.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 9ffa49496dmichael@niedermayer.cc >
2021-10-17 21:34:53 +02:00
Michael Niedermayer