dilim/FFmpeg
1
0 Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-11-09 14:58:04 +00:00
Code Issues Packages Projects Releases Wiki Activity
89,313 Commits 41 Branches 434 Tags
n3.4.13
Commit Graph
39994 Commits
Author SHA1 Message Date
Michael Niedermayer 7b4662fae5 avcodec/noise_bsf: Check for wrapped frames 
Wrapped frames contain pointers so they need specific code to
noise them, the generic code would lead to segfaults

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0889ebc577)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-07 01:35:38 +02:00
Michael Niedermayer 30cdacf8c2 avcodec/pngdec: Do not pass AVFrame into global header decode 
The global header should not contain a frame, and decoding it
would result in leaks

Fixes: memleak
Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-6603443149340672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d31d4f3228)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:24:48 +02:00
Michael Niedermayer 77d1ae5d94 avcodec/tak: Check remaining bits in ff_tak_decode_frame_header() 
Fixes: out of array access
Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-6682195323650048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 19b66b89da)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:24:43 +02:00
Michael Niedermayer 40f962e569 avcodec/utils: the IFF_ILBM implementation assumes that there are a multiple of 16 allocated 
Fixes: out of array access
Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5124452659888128
Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-6362836707442688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 34056a94ea)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:24:43 +02:00
Michael Niedermayer 0b003c0828 avcodec/vorbisdec: Check codebook float values to be finite 
Fixes: Timeout
Fixes: 55116/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VORBIS_fuzzer-4572159970508800

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cadd7e7a75)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:24 +02:00
Michael Niedermayer 99bab6e961 avcodec/g2meet: Replace fake allocation avoidance for framebuf 
framebuf is only allocated when the new width/height are larger than the old
but nothing sets the old so its always allocated.
Use av_fast_mallocz() instead.

Fixes: Timeout
Fixes: 55094/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5116909932904448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 38adbc6eeb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:24 +02:00
Michael Niedermayer dc530f258c avcodec/lcldec: More space for rgb24 
Fixes: Ticket 10239
Fixes: zlib_306_306_rgb24.av

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e2c3aa8e2b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:24 +02:00
Michael Niedermayer 09e16d736b avcodec/lcldec: Support 4:1:1 and 4:2:2 with odd width 
Fixes: Ticket10240
Fixes: zlib_306_306_yuv422.avi
Fixes: zlib_306_306_yuv411.avi

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0cf1ac905d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:23 +02:00
Michael Niedermayer 9989fd4516 libavcodec/lcldec: width and height should not be unsigned 
Computations like col < width - 3 will not work with unsigned width=1

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3eb4e28c26)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:23 +02:00
Michael Niedermayer e7ae341c2a avcodec/escape124: Check that blocks are allocated before use 
Fixes: NULL pointer dereference
Fixes: 57819/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-5077280228769792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5366ae12b9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:23 +02:00
Michael Niedermayer 8c8821b545 avcodec/huffyuvdec: Fix undefined behavior with shift 
Fixes: left shift of negative value -1
Fixes: 57554/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFVHUFF_fuzzer-4853603839115264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 27e7857bd1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:22 +02:00
Michael Niedermayer db29a66295 avcodec/j2kenc: fix 5/3 DWT identifer 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f6955b6df4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:22 +02:00
Michael Niedermayer e52276f77a avcodec/vp3: Check width to avoid assertion failure 
Fixes: Assertion failure on x86-32
       av_assert2(block_w * sizeof(pixel) <= FFABS(buf_linesize)); in ff_emulated_edge_mc()
Fixes: 39641/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-5925660741206016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dab1cd2dc0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:22 +02:00
Michael Niedermayer 192353f7c1 avcodec/g729postfilter: Limit shift in long term filter 
Fixes: shift exponent 34 is too large for 32-bit type 'int'
Fixes: 57389/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ACELP_KELVIN_fuzzer-6229522659016704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6d1d8609ac)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:21 +02:00
Michael Niedermayer 789e189779 avcodec/tests/snowenc: Fix 2nd test 
(cherry picked from commit 163013c724)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:21 +02:00
Michael Niedermayer 62a0bbfa54 avcodec/tests/snowenc: return a failure if DWT/IDWT mismatches 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 771c266c0b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:20 +02:00
Michael Niedermayer 872c74b3ba avcodec/snowenc: Fix visual weight calculation 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5b5fcadea0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:20 +02:00
Michael Niedermayer bf6bff0b75 avcodec/tests/snowenc: unbreak DWT tests 
the IDWT data type mismatched current code

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8b3351bbea)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:20 +02:00
Jiasheng Jiang 5cd450dd7a avcodec/vp3: Add missing check for av_malloc 
Since the av_malloc() may fail and return NULL pointer,
it is needed that the 's->edge_emu_buffer' should be checked
whether the new allocation is success.

Fixes: d14723861b ("VP3: fix decoding of videos with stride > 2048")
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
(cherry picked from commit 656cb0450a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:19 +02:00
Michael Niedermayer f8ef4290e3 avcodec/escape124: Fix some return codes 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 98df605f7a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:19 +02:00
Michael Niedermayer 800ba7107e avcodec/escape124: fix signdness of end of input check 
Fixes: Timeout
Fixes: 56561/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-5560363635834880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 87ad0a5dd7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:19 +02:00
Michael Niedermayer d85f407e0d avcodec/motionpixels: Mask pixels to valid values 
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOTIONPIXELS_fuzzer-6724203352555520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ac6eec1fc2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:18 +02:00
Michael Niedermayer 2ca69aa42d avcodec/xpmdec: Check size before allocation to avoid truncation 
Fixes:OOM
Fixes:out of array access (no testcase)
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XPM_fuzzer-6573323838685184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 95f0f84dae)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:18 +02:00
Michael Niedermayer a2da41e03a avcodec/bink: Avoid undefined out of array end pointers in binkb_decode_plane() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ea9deafd3b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:17 +02:00
Michael Niedermayer e152447bb5 avcodec/bink: Fix off by 1 error in ref end 
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6657932926517248

Alterantivly to this it is possibly to allocate a bigger array

Note: oss-fuzz assigned this issue to a unrelated theora bug so the bug number matches that

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 49487045dd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:17 +02:00
Michael Niedermayer 06fe955608 avcodec/utils: Ensure linesize for SVQ3 
Fixes: Assertion block_w * sizeof(uint8_t) <= ((buf_linesize) >= 0 ? (buf_linesize) : (-(buf_linesize))
Fixes: 54861/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-5352418248622080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4eef658ca5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:17 +02:00
Michael Niedermayer 331d1d5677 avcodec/utils: allocate a line more for VC1 and WMV3 
Fixes: out of array read on 32bit
Fixes: 54857/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5840588224462848

The chroma MC code reads over the currently allocated frame.
Alternative fixes would be allocating a few bytes more at the end instead of a whole
line extra or to adjust the threshold where the edge emu code is activated

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 01636a63d4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:16 +02:00
Michael Niedermayer 6047f056af avcodec/videodsp_template: Adjust pointers to avoid undefined pointer things 
Fixes: subtraction of unsigned offset from 0xf6602770 overflowed to 0xf6638c80
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-495074400600064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f0150cd41c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:16 +02:00
Michael Niedermayer 3b39e8a3b8 avcodec/pngdec: Check deloco index more exactly 
Fixes: out of array access:
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PNG_fuzzer-6716193709096960

Alternatively it should be possible to limit this to 3 plane RGB 8 /16bit to ensure the size is what it should be

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d5bae70406)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:16 +02:00
Michael Niedermayer a928367cba avcodec/ffv1dec: Check that num h/v slices is supported 
Fixes: out of array access
Fixes: 55597/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-4898293416329216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8ead0ae68e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:15 +02:00
Michael Niedermayer 07dd5b4d69 avcodec/pictordec: Remove mid exit branch 
This causes the RLE decoder to exit before applying the last RLE run
All images i tested with are unchanged, this makes the special case
for handling the last run unused for non truncated images.

Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 88f0e05c72)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:15 +02:00
Michael Niedermayer 1552773f07 avcodec/eac3dec: avoid float noise in fixed mode addition to overflow 
Fixes: 2.28595e+09 is outside the range of representable values of type 'int'
Fixes: 54644/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AC3_FIXED_fuzzer-4816961584627712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2f48d227c1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:14 +02:00
Michael Niedermayer d361cdee61 avcodec/utils: use 32pixel alignment for bink 
bink supports 16x16 blocks in chroma planes thus we need to allocate enough.
Fixes: out of array access
Fixes: 55026/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6013915371012096
Reviewed-by: Peter Ross <pross@xvid.org>

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b95b2c8492)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:14 +02:00
Michael Niedermayer 05fd95fe85 avcodec/012v: Order operations for odd size handling 
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZERO12V_fuzzer-6714182078955520.fuzz
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZERO12V_fuzzer-6698145212137472.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4d42d82563)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:14 +02:00
Michael Niedermayer 0791340377 avcodec/eatgq: : Check index increments in tgq_decode_block() 
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATGQ_fuzzer-6743211456724992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e7755b433e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:13 +02:00
Michael Niedermayer 879521ecdc avcodec/scpr: Test bx before use 
Fixes: out of array access on 32bit
Fixes: 54850/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-5302669294305280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b59de3770)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:13 +02:00
Michael Niedermayer 4f9152af77 avcodec/sunrast: Fix maplength check 
Fixes: out of bounds read

Found-by: Ibrahim Mohamed <ielsayed@meta.com>
Reviewed-by; Ibrahim Mohamed <ielsayed@meta.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f8a2a65078)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:13 +02:00
Michael Niedermayer 25b434d931 avcodec/wavpack: Avoid undefined shift in get_tail() 
Fixes: left shift of 1208485947 by 1 places cannot be represented in type 'int'
Fixes: 54058/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5827521084260352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8374a747af)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:12 +02:00
Michael Niedermayer e4b0610c6a avcodec/ffv1dec: restructure slice coordinate reading a bit 
Fixes: signed integer overflow: -1094995528 * 8224 cannot be represented in type 'int'
Fixes: 53508/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-474551033462784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 74b6ac7ebb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:12 +02:00
Michael Niedermayer 0f09239167 avcodec/mlpdec: Check max matrix instead of max channel in noise check 
This is a regression since: adaa06581c
Before this, max_channel and  max_matrix_channel where compared for equality

Fixes: out of array access
Fixes: 53340/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-514959011885875

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aa79560de5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:11 +02:00
Michael Niedermayer 42e5ab500a avcodec/alsdec: The minimal block is at least 7 bits 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5280947fb6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:11 +02:00
Michael Niedermayer 80201f0dc1 avcodec/speedhq: Check buf_size to be big enough for DC 
Fixes: Timeout
Fixes: 51919/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-6023716480090112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9184d3d7b6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:10 +02:00
Michael Niedermayer f6780b83f7 avcodec/ffv1dec: Fail earlier if prior context is corrupted 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4df91e2215)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-06-04 20:18:09 +02:00
Michael Niedermayer cdeb121c6a avcodec/dstdec: Check for overflow in build_filter() 
Fixes: signed integer overflow: 1917019860 + 265558963 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-4833165046317056

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8008940da5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 22:57:49 +02:00
Michael Niedermayer b231f3be56 avcodec/apedec: Fix integer overflow in filter_3800() 
Fixes: signed integer overflow: -2147448926 + -198321 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5739619273015296
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6744428485672960

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f05247f6a4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 22:44:30 +02:00
Michael Niedermayer 78da181eee avcodec/tta: Check 24bit scaling for overflow 
Fixes: signed integer overflow: -8427924 * 256 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5409428670644224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3993345f91)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 22:43:37 +02:00
Michael Niedermayer d10b5d96dd avcodec/fmvc: Move frame allocation to a later stage 
This way more things are checked before allocation

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9783749c66)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 22:38:37 +02:00
Michael Niedermayer ad107f99b6 avcodec/speedhq: Check width 
Fixes: out of array access
Fixes: 50014/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-4748914632294400

Alternatively the buffer size can be increased

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f0395f9ef6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-24 22:31:00 +02:00
Michael Niedermayer 3128853ad4 avcodec/bink: disallow odd positioned scaled blocks 
Fixes: out of array access
Fixes: 47911/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6194020855971840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b14104a637)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-02 10:45:58 +02:00
Michael Niedermayer 2d83c7492d libavcodec/8bps: Check that line lengths fit within the buffer 
Fixes: Timeout
Fixes: undefined pointer arithmetic
Fixes: 50330/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EIGHTBPS_fuzzer-5436287485607936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2316d5ec1a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-08-28 22:52:03 +02:00