ffmpeg.git
14 months agoavcodec/dvdsub_parser: Init output buf/size
Michael Niedermayer [Fri, 13 Jul 2018 16:54:48 +0000 (18:54 +0200)]
avcodec/dvdsub_parser: Init output buf/size

No testcase

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9e6c8437761661441d836876934314cb2b8fafe7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/imgconvert: fix possible null pointer dereference
Simon Thelen [Tue, 3 Apr 2018 12:41:33 +0000 (14:41 +0200)]
avcodec/imgconvert: fix possible null pointer dereference

regression since 354b26a3945eadd4ed8fcd801dfefad2566241de

(cherry picked from commit 8c2c97403baf95d0facb53f03e468f023eb943e1)
(cherry picked from commit c1e172c2e14ef059dac632f7c67f081dfecd30dc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/dirac_dwt_template: Fix signedness regression in interleave()
Michael Niedermayer [Fri, 13 Jul 2018 16:33:08 +0000 (18:33 +0200)]
avcodec/dirac_dwt_template: Fix signedness regression in interleave()

Found-by: <jdarnley>
Tested-by: James Darnley <james.darnley@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 181435a4de6e38e0a15ddaf16de9a157ef41cb18)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/movenc: Write version 2 of audio atom if channels is not known
Michael Niedermayer [Sat, 7 Jul 2018 22:16:42 +0000 (00:16 +0200)]
avformat/movenc: Write version 2 of audio atom if channels is not known

The version 1 needs the channel count and would divide by 0
Fixes: division by 0
Fixes: fpe_movenc.c_1108_1.ogg
Fixes: fpe_movenc.c_1108_2.ogg
Fixes: fpe_movenc.c_1108_3.wav

Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fa19fbcf712a6a6cc5a5cfdc3254a97b9bce6582)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoswresample/arm: rename labels to fix xcode build error
Rahul Chaudhry [Fri, 27 Apr 2018 20:49:52 +0000 (13:49 -0700)]
swresample/arm: rename labels to fix xcode build error

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e84212b78e00df17799e01be1e153a073eb8f689)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/movenc: Check input sample count
Michael Niedermayer [Fri, 6 Jul 2018 20:23:25 +0000 (22:23 +0200)]
avformat/movenc: Check input sample count

Fixes: division by 0
Fixes: fpe_movenc.c_199_1.wav
Fixes: fpe_movenc.c_199_2.wav
Fixes: fpe_movenc.c_199_3.wav
Fixes: fpe_movenc.c_199_4.wav
Fixes: fpe_movenc.c_199_5.wav
Fixes: fpe_movenc.c_199_6.wav
Fixes: fpe_movenc.c_199_7.wav

Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3a2d21bc5f97aa0161db3ae731fc2732be6108b8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/mjpegdec: Check for odd progressive RGB
Michael Niedermayer [Fri, 6 Jul 2018 14:28:14 +0000 (16:28 +0200)]
avcodec/mjpegdec: Check for odd progressive RGB

Fixes: out of array access
Fixes: 9225/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-5684770334834688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ee1e3ca5eb1ec7d34e925d129c893e33847ee0b7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/movenc: Check that frame_types other than EAC3_FRAME_TYPE_INDEPENDENT have...
Michael Niedermayer [Wed, 27 Jun 2018 14:51:51 +0000 (16:51 +0200)]
avformat/movenc: Check that frame_types other than EAC3_FRAME_TYPE_INDEPENDENT have a supported substream id

Fixes: out of array access
Fixes: ffmpeg_bof_1.avi

Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ed22dc22216f74c75ee7901f82649e1ff725ba50)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/vp8_parser: Do not leave data/size uninitialized
Michael Niedermayer [Fri, 6 Jul 2018 10:01:46 +0000 (12:01 +0200)]
avcodec/vp8_parser: Do not leave data/size uninitialized

This is identical to what the VP9 parser does

Fixes: 9215/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVPX_VP8_fuzzer-5768227253649408
Fixes: out of memory access

This may also fix oss fuzz issue 9212

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 284dde24dab30225ed3e233b0e5908d67d7e13e7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/mms: Add missing chunksize check
Michael Niedermayer [Tue, 3 Jul 2018 18:33:04 +0000 (20:33 +0200)]
avformat/mms: Add missing chunksize check

Fixes: out of array read
Fixes: mms-crash-01b6c5d85f9d9f40f4e879896103e9f5b222816a

Found-by: Paul Ch <paulcher@icloud.com>
1st hunk by Paul Ch <paulcher@icloud.com>
Tested-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cced03dd667a5df6df8fd40d8de0bff477ee02e8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/pva: Check for EOF before retrying in read_part_of_packet()
Michael Niedermayer [Tue, 3 Jul 2018 20:14:42 +0000 (22:14 +0200)]
avformat/pva: Check for EOF before retrying in read_part_of_packet()

Fixes: Infinite loop
Fixes: pva-4b1835dbc2027bf3c567005dcc78e85199240d06

Found-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/rmdec: Do not pass mime type in rm_read_multi() to ff_rm_read_mdpr_codecdata()
Michael Niedermayer [Tue, 3 Jul 2018 19:37:46 +0000 (21:37 +0200)]
avformat/rmdec: Do not pass mime type in rm_read_multi() to ff_rm_read_mdpr_codecdata()

Fixes: use after free()
Fixes: rmdec-crash-ffe85b4cab1597d1cfea6955705e53f1f5c8a362

Found-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a7e032a277452366771951e29fd0bf2bd5c029f0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/indeo4: Check for end of bitstream in decode_mb_info()
Michael Niedermayer [Sun, 1 Jul 2018 23:26:44 +0000 (01:26 +0200)]
avcodec/indeo4: Check for end of bitstream in decode_mb_info()

Fixes: Timeout
Fixes: 8776/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-5361788798369792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 267ba2aa96354c5b6a1ea89b2943fbd7a4893862)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/shorten: Fix undefined addition in shorten_decode_frame()
Michael Niedermayer [Mon, 2 Jul 2018 17:11:46 +0000 (19:11 +0200)]
avcodec/shorten: Fix undefined addition in shorten_decode_frame()

Fixes: signed integer overflow: 1139785606 + 1454196085 cannot be represented in type 'int'
Fixes: 8937/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-6202943597445120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3b10bb8772c76177cc47b8d15a6970f19dd11039)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/shorten: Fix undefined integer overflow
Michael Niedermayer [Mon, 2 Jul 2018 17:08:54 +0000 (19:08 +0200)]
avcodec/shorten: Fix undefined integer overflow

Fixes: signed integer overflow: 8454144 * 256 cannot be represented in type 'int'
Fixes: 8788/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5728205041303552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 70832333bba3b915040f415548518e136b44280e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/jpeg2000dec: Fixes invalid shifts in jpeg2000_decode_packets_po_iteration()
Michael Niedermayer [Mon, 2 Jul 2018 16:57:05 +0000 (18:57 +0200)]
avcodec/jpeg2000dec: Fixes invalid shifts in jpeg2000_decode_packets_po_iteration()

Fixes: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 9163/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5661750182543360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 652d7c6348f96181fa69f8e2afb7b27a14c0a88a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/jpeg2000dec: Check that there are enough bytes for all tiles
Michael Niedermayer [Mon, 2 Jul 2018 16:40:08 +0000 (18:40 +0200)]
avcodec/jpeg2000dec: Check that there are enough bytes for all tiles

Fixes: OOM
Fixes: 8781/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5810709081358336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0898a3d9909960324e27d3a7a4f48c4effbb654a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/movenc: Do not pass AVCodecParameters in avpriv_request_sample
Michael Niedermayer [Wed, 27 Jun 2018 15:27:50 +0000 (17:27 +0200)]
avformat/movenc: Do not pass AVCodecParameters in avpriv_request_sample

Fixes: out of array read
Fixes: ffmpeg_crash_8.avi

Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 95556e27e2c1d56d9e18f5db34d6f756f3011148)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/escape124: Fix spelling errors in comment
Michael Niedermayer [Wed, 27 Jun 2018 11:00:28 +0000 (13:00 +0200)]
avcodec/escape124: Fix spelling errors in comment

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f59c4e43915ed0528e2789f27ddb1635b59779df)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/ra144: Fix integer overflow in ff_eval_refl()
Michael Niedermayer [Thu, 21 Jun 2018 21:08:32 +0000 (23:08 +0200)]
avcodec/ra144: Fix integer overflow in ff_eval_refl()

Fixes: signed integer overflow: -4096 * -524288 cannot be represented in type 'int'
Fixes: 8650/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-5734816036159488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b31189881a4cf54b0057ecf3eab917ad56eecfea)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/cscd: Check output buffer size for lzo.
Michael Niedermayer [Thu, 21 Jun 2018 23:18:20 +0000 (01:18 +0200)]
avcodec/cscd: Check output buffer size for lzo.

Fixes: Timeout
Fixes: 8665/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CSCD_fuzzer-5768442610188288

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit 78167b498f53c36c31105a2bf11e90b03637598f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/escape124: Check buf_size against num_superblocks
Michael Niedermayer [Sun, 24 Jun 2018 17:23:02 +0000 (19:23 +0200)]
avcodec/escape124: Check buf_size against num_superblocks

Fixes: Timeout
Fixes: 8722/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-4843268402577408

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6677c98626489edfdb4b49b4f66ca91867768a9f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/h264_parser: Reduce needed history for parsing mb index
Michael Niedermayer [Fri, 22 Jun 2018 19:45:59 +0000 (21:45 +0200)]
avcodec/h264_parser: Reduce needed history for parsing mb index

This fixes a bug/regression with very small packets
Fixes: output_file

Regression since: 0782fb6bcb32fe3ab956a99af4cc472ff81da0c2

Reported-by: Thierry Foucu <tfoucu@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d25c945247979a88fac6bb3b7a26370262b96ef1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/mjpegdec: Check for end of bitstream in ljpeg_decode_rgb_scan()
Michael Niedermayer [Thu, 21 Jun 2018 20:48:54 +0000 (22:48 +0200)]
avcodec/mjpegdec: Check for end of bitstream in ljpeg_decode_rgb_scan()

Fixes: Timeout
Fixes: 8648/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5108395525799936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 540e8c2d641bf90fc28e47e170f8c0b1962197e9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/aacdec_fixed: Fix undefined integer overflow in apply_independent_coupling_fi...
Michael Niedermayer [Thu, 14 Jun 2018 14:41:49 +0000 (16:41 +0200)]
avcodec/aacdec_fixed: Fix undefined integer overflow in apply_independent_coupling_fixed()

Fixes: signed integer overflow: 1195517 * 2048 cannot be represented in type 'int'
Fixes: 8636/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-4695836326887424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8bd514d9343746566b123275f8b6d0e9c11ec2b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/dirac_dwt_template: Fix undefined behavior in interleave()
Michael Niedermayer [Thu, 14 Jun 2018 14:37:32 +0000 (16:37 +0200)]
avcodec/dirac_dwt_template: Fix undefined behavior in interleave()

Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 8697/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5197148130902016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 575d8ca0260fabac29e5b3541154633569ce2b5d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavutil/common: Fix undefined behavior in av_clip_uintp2_c()
Michael Niedermayer [Thu, 14 Jun 2018 13:41:33 +0000 (15:41 +0200)]
avutil/common: Fix undefined behavior in av_clip_uintp2_c()

Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 8521/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5639024952737792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aa41d322be71106ce147445f2b42bb763f1eff86)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agofftools/ffmpeg: Fallback to duration if sample rate is unavailable
Michael Niedermayer [Tue, 1 May 2018 20:44:07 +0000 (22:44 +0200)]
fftools/ffmpeg: Fallback to duration if sample rate is unavailable

Regression since: af1761f7
Fixes: Division by 0
Fixes: ffmpeg_crash_1

Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 16d8b13b3b26c19d7f8856e039fe6662d96b4ff3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/mov: Only set pkt->duration to non negative values
Michael Niedermayer [Wed, 16 May 2018 21:35:58 +0000 (23:35 +0200)]
avformat/mov: Only set pkt->duration to non negative values

Reviewed-by: Sasi Inguva <isasi@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8176799f31b23849382623f0f9001acc5edf7c76)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/h264_ps: Move MAX_LOG2_MAX_FRAME_NUM to header so it can be used in h264_sei
Michael Niedermayer [Sun, 10 Jun 2018 15:02:47 +0000 (17:02 +0200)]
avcodec/h264_ps: Move MAX_LOG2_MAX_FRAME_NUM to header so it can be used in h264_sei

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b796c5ae9299c795cba0d16ce1d8eef05488953b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/h264_mc_template: Only prefetch motion if the list is used.
Michael Niedermayer [Fri, 8 Jun 2018 16:25:14 +0000 (18:25 +0200)]
avcodec/h264_mc_template: Only prefetch motion if the list is used.

Fixes: index 59 out of bounds for type 'H264Ref [48]'
Fixes: 8232/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5703295145345024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8b55591757244d8244a2be369c2b54c9ae79b02a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/xwddec: Use ff_set_dimensions()
Michael Niedermayer [Thu, 7 Jun 2018 22:42:31 +0000 (00:42 +0200)]
avcodec/xwddec: Use ff_set_dimensions()

Fixes: OOM
Fixes: 8178/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XWD_fuzzer-4844793342459904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c2852e4e00de4073ff7de82d41cb3368702686e8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/wavpack: Fix overflow in adding tail
Michael Niedermayer [Thu, 7 Jun 2018 22:07:04 +0000 (00:07 +0200)]
avcodec/wavpack: Fix overflow in adding tail

Fixes: signed integer overflow: 2146907204 + 26846088 cannot be represented in type 'int'
Fixes: 8105/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-6233036682166272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d13379fb79708f550460dd6d698023bf26f968d5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/shorten: Fix multiple integer overflows
Michael Niedermayer [Tue, 5 Jun 2018 11:19:35 +0000 (13:19 +0200)]
avcodec/shorten: Fix multiple integer overflows

Fixes: signed integer overflow: 3 * 1006632960 cannot be represented in type 'int'
Fixes: 8278/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5692857166856192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f2abd36b3863188894fd21964c662b6c17268bfb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/shorten: Fix undefined shift in fix_bitshift()
Michael Niedermayer [Tue, 5 Jun 2018 11:15:34 +0000 (13:15 +0200)]
avcodec/shorten: Fix undefined shift in fix_bitshift()

Fixes: left shift of negative value -9
Fixes: 8571/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5715966875926528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 606c7148231404544005c0827b83c165dd6b39a8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/shorten: Fix a negative left shift in shorten_decode_frame()
Michael Niedermayer [Tue, 5 Jun 2018 11:12:54 +0000 (13:12 +0200)]
avcodec/shorten: Fix a negative left shift in shorten_decode_frame()

Fixes: left shift of negative value -9057
Fixes: 8527/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5666853924896768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a711efe922b2bf1d363bdf7f8357656c3e35021e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/shorten: Sanity check nmeans
Michael Niedermayer [Tue, 5 Jun 2018 11:03:48 +0000 (13:03 +0200)]
avcodec/shorten: Sanity check nmeans

Fixes: OOM
Fixes: 8195/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5179785826271232

The reference software appears to use longs for 32bits and it uses int for nmeans
hinting that the intended maximum size was not 32bit.

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d91a0b503d7a886587281bc1ee42476aa5e89f85)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/shorten: Check non COMM chunk len before skip in decode_aiff_header()
Michael Niedermayer [Tue, 5 Jun 2018 00:33:43 +0000 (02:33 +0200)]
avcodec/shorten: Check non COMM chunk len before skip in decode_aiff_header()

Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 8024/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5109204648984576

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 424a81df107b63a166894a4aee3d27702ae3f459)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/mjpegdec: Fix integer overflow in ljpeg_decode_rgb_scan()
Michael Niedermayer [Tue, 5 Jun 2018 00:17:24 +0000 (02:17 +0200)]
avcodec/mjpegdec: Fix integer overflow in ljpeg_decode_rgb_scan()

Fixes: signed integer overflow: 32768 + 2147450880 cannot be represented in type 'int'
Fixes: 7885/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-5298834394578944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 936f4a2c2e14ec753e8835f2e820b4cd9aec9a56)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/truemotion2: Fix overflow in tm2_apply_deltas()
Michael Niedermayer [Tue, 5 Jun 2018 00:09:59 +0000 (02:09 +0200)]
avcodec/truemotion2: Fix overflow in tm2_apply_deltas()

Fixes: signed integer overflow: 1077952576 + 1077952576 cannot be represented in type 'int'
Fixes: 7712/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5056281753681920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 79c6047c3668c639f717b3a7001a34dddba0ede2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/opus_silk: Change silk_lsf2lpc() slightly toward silk/NLSF2A.c
Michael Niedermayer [Sat, 2 Jun 2018 23:33:54 +0000 (01:33 +0200)]
avcodec/opus_silk: Change silk_lsf2lpc() slightly toward silk/NLSF2A.c

Fixes: runtime error: signed integer overflow: -1440457022 - 785819492 cannot be represented in type 'int'
Fixes: 7700/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OPUS_fuzzer-6595838684954624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e7dda51150b73e5fbdccf4c2d3a72e356980fba3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/amrwbdec: Fix division by 0 in find_hb_gain()
Michael Niedermayer [Sat, 2 Jun 2018 22:48:06 +0000 (00:48 +0200)]
avcodec/amrwbdec: Fix division by 0 in find_hb_gain()

This restructures the code slightly toward D_UTIL_dec_synthesis()

Fixes: 7420/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMRWB_fuzzer-6577305112543232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dce80a4b47efaba97707bda781a9ee57f5a26974)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/mov: replace a value error by clipping into valid range in mov_read_stsc()
Michael Niedermayer [Mon, 21 May 2018 01:16:58 +0000 (03:16 +0200)]
avformat/mov: replace a value error by clipping into valid range in mov_read_stsc()

Fixes: #7165

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fe84f70819d6f5aab3c4823290e0d32b99d6de78)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/mov: Break out early if chunk_count is 0 in mov_build_index()
Michael Niedermayer [Tue, 15 May 2018 15:06:59 +0000 (17:06 +0200)]
avformat/mov: Break out early if chunk_count is 0 in mov_build_index()

Without this some operations might overflow (undefined behavior)
even though the index adding loop would never execute

No testcase known

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 56e76bd0579cc7f7b28860885d9e569a39daf41b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/fic: Avoid some magic numbers related to cursors
Michael Niedermayer [Sat, 5 May 2018 21:42:36 +0000 (23:42 +0200)]
avcodec/fic: Avoid some magic numbers related to cursors

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c6a11714c4b1227be62cbc36651ccfc415e8e623)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/g2meet: ask for sample with overflowing RGB
Michael Niedermayer [Wed, 16 May 2018 20:50:19 +0000 (22:50 +0200)]
avcodec/g2meet: ask for sample with overflowing RGB

Suggested-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ab834b8f36c8157b7015e849405cbf6ae21e672f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/aacdec_fixed: use 64bit to avoid overflow in rounding in apply_dependent_coup...
Michael Niedermayer [Fri, 25 May 2018 20:06:48 +0000 (22:06 +0200)]
avcodec/aacdec_fixed: use 64bit to avoid overflow in rounding in apply_dependent_coupling_fixed()

Fixes: signed integer overflow: -2141499320 + -14469590 cannot be represented in type 'int'
Fixes: 7351/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-6351214791884800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 90475db97e2e5931d295df6ab86519fa2e14d259)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agooavcodec/aacpsdsp_template: Use unsigned for hs0X to prevent undefined behavior
Michael Niedermayer [Fri, 25 May 2018 20:02:20 +0000 (22:02 +0200)]
oavcodec/aacpsdsp_template: Use unsigned for hs0X to prevent undefined behavior

Fixes: signed integer overflow: 1073741842 + 1784008138 cannot be represented in type 'int'
Fixes: 6792/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5677589835284480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 62cb6fadf33de6db386deac92853d4b95c930015)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/g723_1dec: Clip bits2 in both directions
Michael Niedermayer [Fri, 25 May 2018 19:56:04 +0000 (21:56 +0200)]
avcodec/g723_1dec: Clip bits2 in both directions

Fixes: shift exponent 33 is too large for 32-bit type 'int'
Fixes: 6743/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G723_1_fuzzer-5823772687859712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 53f241218d9eac368e2e1c58bcca9bbdf10fd0e1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/mpeg4videoenc: Use 64 bit for times in mpeg4_encode_gop_header()
Michael Niedermayer [Mon, 21 May 2018 21:08:05 +0000 (23:08 +0200)]
avcodec/mpeg4videoenc: Use 64 bit for times in mpeg4_encode_gop_header()

Fixes truncation
Fixes Assertion n <= 31 && value < (1U << n) failed at libavcodec/put_bits.h:169
Fixes: ffmpeg_crash_2.avi

Found-by: Thuan Pham <thuanpv@comp.nus.edu.sg>, Marcel Böhme, Andrew Santosa and Alexandru RazvanCaciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e1182fac1afba92a4975917823a5f644bee7e6e8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/mlpdec: Only change noise_type if the related fields are valid
Michael Niedermayer [Thu, 17 May 2018 11:58:46 +0000 (13:58 +0200)]
avcodec/mlpdec: Only change noise_type if the related fields are valid

Fixes: inconsistency
Fixes:runtime error: index 8 out of bounds for type 'int32_t [8]'
Fixes: 6686/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-5191383498358784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 63c4a4b0d692bc86142790276358ba35129f2290)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoindeo4: Decode all or nothing of a band header.
Michael Niedermayer [Thu, 17 May 2018 11:40:38 +0000 (13:40 +0200)]
indeo4: Decode all or nothing of a band header.

This avoids inconsistent value combinations.
Alternatively it would be possible to add more checks and careful use of
temporary variables, but my try of this quickly seemed to become
a rather large change.
The disadvantage of this, is that the struct is copied back and forth.

Fixes: index 6 out of bounds for type 'const uint16_t [5][16]'
Fixes: 6557/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-4787296550256640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 10c8521265da86118597336c5589e26de377a374)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/mov: Only fail for STCO/STSC contradictions if both exist
Michael Niedermayer [Tue, 15 May 2018 15:07:00 +0000 (17:07 +0200)]
avformat/mov: Only fail for STCO/STSC contradictions if both exist

Fixes regression with playback of GF9720Repeal20the20Eighth20with20Helen20Linehan.m4a
See: crbug 822666

Found-by: "Mattias Wadman <mattias.wadman@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2c2d689c56646cce64d02a3b75f61c12c5589260)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD97iH0 / COMPOSE_DD137iL0
Michael Niedermayer [Sun, 13 May 2018 22:10:33 +0000 (00:10 +0200)]
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD97iH0 / COMPOSE_DD137iL0

Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int');
Fixes: 6500/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-4523620274536448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cb944fc7f1327443a0cf449afbce5a3e8712f90f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/fic: Check available input space for cursor
Michael Niedermayer [Sat, 5 May 2018 20:00:01 +0000 (22:00 +0200)]
avcodec/fic: Check available input space for cursor

Fixes: out of array read
Fixes: 6546/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FIC_fuzzer-6317064647081984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cb2f7ea96b4f6e03ebf0c0563677745fc65f148e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/g2meet: Check RGB upper limit
Michael Niedermayer [Fri, 27 Apr 2018 18:16:13 +0000 (20:16 +0200)]
avcodec/g2meet: Check RGB upper limit

Fixes: runtime error: left shift of 1876744317 by 16 places cannot be represented in type 'int'
Fixes: 6799/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5115274731716608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4dd2c8b9ea46b4e008a8bfc2077834428cd5a17c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/jpeg2000dec: Fix undefined shift in the jpeg2000_decode_packets_po_iteration...
Michael Niedermayer [Fri, 4 May 2018 17:18:25 +0000 (19:18 +0200)]
avcodec/jpeg2000dec: Fix undefined shift in the jpeg2000_decode_packets_po_iteration() CPRL case

Fixes: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 7955/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-6016721977606144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 652ba72ed3124f201f98eea9bafb2232b535f549)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/jpeg2000dec: Skip init for component in CPRL if nothing is to be done
Michael Niedermayer [Fri, 4 May 2018 17:11:36 +0000 (19:11 +0200)]
avcodec/jpeg2000dec: Skip init for component in CPRL if nothing is to be done

Fixes: assertion failure
Fixes: 7949/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-4819602782552064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a96c131eb53b00de154f4773d96a3b323ea3daed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/g2meet: Change order of operations to avoid undefined behavior
Michael Niedermayer [Fri, 4 May 2018 16:16:08 +0000 (18:16 +0200)]
avcodec/g2meet: Change order of operations to avoid undefined behavior

Fixes: signed integer overflow: 65280 * 196032 cannot be represented in type 'int'
Fixes: 7279/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5977332473921536

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0a4745145840d97619c424961c1b5c625dbf516c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/flac_parser: Fix infinite loop
Michael Niedermayer [Mon, 30 Apr 2018 20:20:28 +0000 (22:20 +0200)]
avcodec/flac_parser: Fix infinite loop

Fixes: crbug/827204

Reported-by: Frank Liberato <liberato@google.com>
Reviewed-by: Frank Liberato <liberato@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 15a2e35e9e74bba5a27e39c26da5be2361f27945)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/wavpack: Fix integer overflow in DEC_MED() / INC_MED()
Michael Niedermayer [Fri, 27 Apr 2018 19:44:07 +0000 (21:44 +0200)]
avcodec/wavpack: Fix integer overflow in DEC_MED() / INC_MED()

Fixes: runtime error: signed integer overflow: 2147483637 + 128 cannot be represented in type 'int'
Fixes: 6701/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5358324934508544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6e95d80e6fae978f8a44afc24b0c5097a062719f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/error_resilience: Fix integer overflow in filter181()
Michael Niedermayer [Sun, 22 Apr 2018 19:46:05 +0000 (21:46 +0200)]
avcodec/error_resilience: Fix integer overflow in filter181()

Fixes: runtime error: signed integer overflow: 197710 * 10923 cannot be represented in type 'int'
Fixes: 7010/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5667127596941312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1c97035e3b1677d6f0c5b6161ebfeffcf7bb638d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/h263dec: Check slice_ret in mspeg4 slice loop
Michael Niedermayer [Sun, 22 Apr 2018 19:07:45 +0000 (21:07 +0200)]
avcodec/h263dec: Check slice_ret in mspeg4 slice loop

Fixes infinite loop
Fixes: 6858/clusterfuzz-testcase-ffmpeg_AV_CODEC_ID_MSMPEG4V3_fuzzer-4681563766784000
Fixes: 6890/clusterfuzz-testcase-ffmpeg_AV_CODEC_ID_WMV1_fuzzer-4756103142309888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit de841fbea7655b74a9663001e01008a86c88779a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/elsdec: Fix memleaks
Michael Niedermayer [Tue, 24 Apr 2018 23:54:17 +0000 (01:54 +0200)]
avcodec/elsdec: Fix memleaks

Fixes: 6798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5135899701542912

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0bd0401336df4e4ca7f3da6a7e226904fd7d5add)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/vc1_block: simplify ac_val computation
Michael Niedermayer [Mon, 23 Apr 2018 00:08:10 +0000 (02:08 +0200)]
avcodec/vc1_block: simplify ac_val computation

also fixes: runtime error: index 1456 out of bounds for type 'int16_t [16]'

Found-by: durandal_1707
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d06b01fc2d4f5e031d45f9460d1eea610d23d6c5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/ffv1enc: Check that the crc + version combination is supported
Michael Niedermayer [Sat, 21 Apr 2018 20:19:31 +0000 (22:19 +0200)]
avcodec/ffv1enc: Check that the crc + version combination is supported

The crc flag is only stored since version 3 thus before this crcs do not
work. We increase the version as needed same as we do with pix_fmts

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d9706f79c17a33bf97e51a7d6ab211ce83a463ee)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agolavf/http.c: Free allocated client URLContext in case of error.
Stephan Holljes [Fri, 12 Jan 2018 18:16:29 +0000 (19:16 +0100)]
lavf/http.c: Free allocated client URLContext in case of error.

Signed-off-by: Stephan Holljes <klaxa1337@googlemail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7b6b8c92652d6683d97515352e4a9a4147b7da7c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/dsicinvideo: Fail if there is only a small fraction of the data available...
Michael Niedermayer [Mon, 16 Apr 2018 20:29:09 +0000 (22:29 +0200)]
avcodec/dsicinvideo: Fail if there is only a small fraction of the data available that comprises a full frame

Fixes: Timeout
Fixes: 6306/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DSICINVIDEO_fuzzer-5079253549842432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5549488bbf3a23c0fb9833cefc6354f97055dd96)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/dsicinvideo: Propagate errors from cin_decode_rle()
Michael Niedermayer [Mon, 16 Apr 2018 20:28:23 +0000 (22:28 +0200)]
avcodec/dsicinvideo: Propagate errors from cin_decode_rle()

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 942217b153a9bff2d17463957abd772fcd72b400)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/dfa: Check dimension against maximum
Michael Niedermayer [Mon, 16 Apr 2018 20:04:53 +0000 (22:04 +0200)]
avcodec/dfa: Check dimension against maximum

The headers from where the dimensions are read in actual files
are limited to 16bit per component.

Fixes: Timeout
Fixes: 6305/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DFA_fuzzer-4824270749302784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9d5a4fcfbb51edc871bdb1c67a88223cbfb1c0e4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/cinepak: Skip empty frames
Michael Niedermayer [Tue, 17 Apr 2018 00:13:43 +0000 (02:13 +0200)]
avcodec/cinepak: Skip empty frames

Speeds up decoding from 3 to 0.1 seconds for 6302/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CINEPAK_fuzzer-5626371985375232
Fixes: Timeout

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9033920bec9ccf17de205fc17c2b330906b200f5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/cinepak: move some checks prior to frame allocation
Michael Niedermayer [Tue, 17 Apr 2018 00:13:42 +0000 (02:13 +0200)]
avcodec/cinepak: move some checks prior to frame allocation

Speeds up decoding from 8 to 3 seconds for 6302/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CINEPAK_fuzzer-5626371985375232
Fixes: Timeout

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2324ef1ff32e5effd6f295bca80580ae4816be0b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoswresample/arm: remove unintentional relocation.
Rahul Chaudhry [Wed, 18 Apr 2018 23:29:39 +0000 (16:29 -0700)]
swresample/arm: remove unintentional relocation.

Branch to global symbol results in reference to PLT, and when compiling
for THUMB-2 - in a R_ARM_THM_JUMP19 relocation. Some linkers don't
support this relocation (ld.gold), while others can end up truncating
the relocation to fit (ld.bfd).

Convert this branch through PLT into a direct branch that the assembler
can resolve locally.

See https://github.com/android-ndk/ndk/issues/337 for background.

The current workaround is to disable neon during gstreamer build,
which is not optimal and can be reverted after this patch:
https://github.com/freedesktop/gstreamer-cerbero/commit/41556c415739fbc3a72c7eaee7e70a565b719b2f

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b22db4f465c9adb2cf1489e04f7b65ef6bb55b8b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agodoc/APIchanges: Fix typos in hashes
Michael Niedermayer [Mon, 16 Apr 2018 16:23:12 +0000 (18:23 +0200)]
doc/APIchanges: Fix typos in hashes

Thanks-to: Moritz Barsnick <barsnick@gmx.net> for finding the correct ones

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ec8a5262b03f85158d722dbc8b8f30cb6bd67e0f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavdevice/iec61883: free the private context at the end
James Almer [Wed, 18 Apr 2018 18:32:10 +0000 (15:32 -0300)]
avdevice/iec61883: free the private context at the end

Fixes part of ticket #7146.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 5079e96bcc7aaa9cae82a58397ce986e124028e4)

17 months agoavdevice/iec61883: return reference counted packets
James Almer [Wed, 18 Apr 2018 18:19:40 +0000 (15:19 -0300)]
avdevice/iec61883: return reference counted packets

Fixes part of ticket #7146, dealing with leaks of packet data since
commit 87c88122703f2befcf96383d05bdf14373c22df9.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit b8629654c6460a28c507f816a977914e3a6f2520)

17 months agoChangelog: update n3.3.7
Michael Niedermayer [Fri, 13 Apr 2018 21:11:26 +0000 (23:11 +0200)]
Changelog: update

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavformat/utils: Check cur_dts in update_initial_timestamps() more
Michael Niedermayer [Fri, 13 Apr 2018 09:38:48 +0000 (11:38 +0200)]
avformat/utils: Check cur_dts in update_initial_timestamps() more

Fixes: runtime error: signed integer overflow: 18133149658382192 - -9223090561878065151 cannot be represented in type 'long long'
Fixes: crbug 831552

Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 37d46dc21d708192b12aa13617ebe6a117b07363)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavcodec/utils: Enforce minimum width also for VP5/6
Michael Niedermayer [Wed, 11 Apr 2018 17:50:52 +0000 (19:50 +0200)]
avcodec/utils: Enforce minimum width also for VP5/6

Fixes: out of array access
Fixes: poc_0411

Found-by: GwanYeong Kim <gy741.kim@gmail.com>
Tested-by: GwanYeong Kim <gy741.kim@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 544324827e0131e43af1a54fb790a48a25fd7ba4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavcodec/truemotion2: Propagate out of bounds error from GET_TOK()
Michael Niedermayer [Tue, 10 Apr 2018 20:24:03 +0000 (22:24 +0200)]
avcodec/truemotion2: Propagate out of bounds error from GET_TOK()

Fixes: Timeout
Fixes: 6389/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5695918121680896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f6304af2341d0cee51c2116766622e3ac567b7a0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavformat/utils: Fix integer overflow in end time calculation in update_stream_timings()
Michael Niedermayer [Wed, 11 Apr 2018 16:55:57 +0000 (18:55 +0200)]
avformat/utils: Fix integer overflow in end time calculation in update_stream_timings()

Fixes: crbug 829153

Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c48ceff786bdc96fdc64417118c457d03bd19871)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoUpdate for 3.3.7
Michael Niedermayer [Thu, 12 Apr 2018 23:22:06 +0000 (01:22 +0200)]
Update for 3.3.7

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavformat/utils: fix mixed declarations and code
James Almer [Fri, 24 Nov 2017 20:46:16 +0000 (17:46 -0300)]
avformat/utils: fix mixed declarations and code

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 31de45d20b1ff90d4baf7c5a65e88f582efdb2a6)

17 months agoavcodec/mjpegdec: Check input buffer size.
Michael Niedermayer [Tue, 10 Apr 2018 14:12:15 +0000 (16:12 +0200)]
avcodec/mjpegdec: Check input buffer size.

Fixes: Timeout
Fixes: 6381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-5665032743419904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8d381b57fd9d17fb5c3a851ca46c738b3afc33a2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavcodec/h264_slice: Fix integer overflow with last_poc
Michael Niedermayer [Fri, 6 Apr 2018 22:34:25 +0000 (00:34 +0200)]
avcodec/h264_slice: Fix integer overflow with last_poc

Fixes: signed integer overflow: 2147483646 - -2816 cannot be represented in type 'int'
Fixes: crbug 823145

Reported-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8c02cd8ca097871dcd00cf8e08ce51660873f405)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavformat/mov: Fix extradata memleak
Michael Niedermayer [Fri, 6 Apr 2018 21:56:57 +0000 (23:56 +0200)]
avformat/mov: Fix extradata memleak

Fixes: crbug 822705

Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0a8133119ca5d087c7c7140d100406ff84c477ee)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agolavc/libopusdec: Allow avcodec_open2 to call .close
Matt Wolenetz [Tue, 10 Apr 2018 20:59:25 +0000 (13:59 -0700)]
lavc/libopusdec: Allow avcodec_open2 to call .close

If there is a decoder initialization failure detected in avcodec_open2
after .init is called, allow graceful decoder .close to prevent leaking
libopus decoder allocations.

BUG=828526

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e43e97f0e0f0596b56ceb2f887fe7414f202f081)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavcodec/movtextdec: Check style_start/end
Michael Niedermayer [Sun, 8 Apr 2018 01:29:44 +0000 (03:29 +0200)]
avcodec/movtextdec: Check style_start/end

Limits based on 3GPP TS 26.245 V14.0.0
Fixes: Timeout
Fixes: 6377/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOVTEXT_fuzzer-5175929115508736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Philip Langdale <philipl@overt.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 249aca8f98ff7fb09c12ea68e23c862c62203b95)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavcodec/aacsbr_fixed: Fix integer overflow in sbr_hf_assemble()
Michael Niedermayer [Sat, 7 Apr 2018 19:55:06 +0000 (21:55 +0200)]
avcodec/aacsbr_fixed: Fix integer overflow in sbr_hf_assemble()

Fixes: runtime error: signed integer overflow: 2052929346 + 204817098 cannot be represented in type 'int'

This was missed in b1bef755f617af9685b592d866b3eb7f3c4b02b1
Fixes: 5275/clusterfuzz-testcase-minimized-5367635958038528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c837918f50a7bbd6150afd340857ea43fe4717c7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agolibavcodec/rv34: error out earlier on missing references
Michael Niedermayer [Mon, 2 Apr 2018 18:01:07 +0000 (20:01 +0200)]
libavcodec/rv34: error out earlier on missing references

Fixes visual corruption on seeking

Fixes: downloadTest_clip_24M.rmvb

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6cd81d68c5e4b0ff00288970c4151ff4031c0ea9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoswresample/swresample: Fix for seg fault in swr_convert_internal() -> sum2_float...
Hendrik Schreiber [Thu, 5 Apr 2018 11:58:37 +0000 (13:58 +0200)]
swresample/swresample: Fix for seg fault in swr_convert_internal() -> sum2_float during dithering.

Removed +len1 in call to s->mix_2_1_f() as I found no logical explanation for it. After removal, problem was gone.

Signed-off-by: Hendrik Schreiber <hs@tagtraum.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 647fd4b8292e3bfae30b1086aa842a5ee47ee868)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavcodec/aacdec_fixed: Fix integer overflow in apply_independent_coupling_fixed()
Michael Niedermayer [Sat, 31 Mar 2018 19:19:19 +0000 (21:19 +0200)]
avcodec/aacdec_fixed: Fix integer overflow in apply_independent_coupling_fixed()

I was not able to reproduce this, this fix is based on just the fuzzer log.
Fixes: 4959/clusterfuzz-testcase-minimized-6035350934781952

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 197a4e8feed45b2e5868760240e83636818f32a9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavcodec/cscd: Error out when LZ* decompression fails
Michael Niedermayer [Sun, 11 Mar 2018 23:05:04 +0000 (00:05 +0100)]
avcodec/cscd: Error out when LZ* decompression fails

Fixes: Timeout
Fixes: 6304/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CSCD_fuzzer-5754772461191168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d52be5d4e91871a22dac70af3e0ab429e95a2d10)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavcodec/imgconvert: Fix loss mask bug in avcodec_find_best_pix_fmt_of_list()
heimdallr [Sat, 31 Mar 2018 12:37:23 +0000 (19:37 +0700)]
avcodec/imgconvert: Fix loss mask bug in avcodec_find_best_pix_fmt_of_list()

example:

AVPixelFormat pixFmts[] = { AV_PIX_FMT_RGB24, AV_PIX_FMT_RGBA };
int loss = 0;
AVPixelFormat best = avcodec_find_best_pix_fmt_of_list(pixFmts, AV_PIX_FMT_BGRA, 1, &loss);

best is AV_PIX_FMT_RGB24. But AV_PIX_FMT_RGBA is better.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 354b26a3945eadd4ed8fcd801dfefad2566241de)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavfilter/vf_signature: use av_strlcpy()
Michael Niedermayer [Fri, 30 Mar 2018 00:16:31 +0000 (02:16 +0200)]
avfilter/vf_signature: use av_strlcpy()

Fixes: out of array access

Found-by: Kira <kira_cxy@foxmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 35eeff30caf34df835206f1c12bcf4b7c2bd6758)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavcodec/utvideodec: Set pro flag based on fourcc
Michael Niedermayer [Sat, 31 Mar 2018 01:10:43 +0000 (03:10 +0200)]
avcodec/utvideodec: Set pro flag based on fourcc

This avoids mixing 8bit variants with pro and 10bit with non pro mode.
Fixes: out of array read
Fixes: poc_03_30.avi

Found-by: GwanYeong Kim <gy741.kim@gmail.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 47b7c68ae54560e2308bdb6be4fb076c73b93081)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavcodec/wmalosslessdec: Fix null pointer dereference in decode_frame()
Michael Niedermayer [Sun, 25 Mar 2018 00:51:28 +0000 (01:51 +0100)]
avcodec/wmalosslessdec: Fix null pointer dereference in decode_frame()

Fixes: 2018_03_23_poc.wav
Found-by: GwanYeong Kim <gy741.kim@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ea15915b2dc5aaa80c91879fbd183475a7e66e54)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavcodec/tableprint_vlc: Fix build failure with --enable-hardcoded-tables
Michael Niedermayer [Wed, 28 Mar 2018 23:07:24 +0000 (01:07 +0200)]
avcodec/tableprint_vlc: Fix build failure with --enable-hardcoded-tables

Found-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5c75438b893539dd17998c489fb4c540fc5a6e48)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavformat/mov: Move +1 in check to avoid hypothetical overflow in add_ctts_entry()
Michael Niedermayer [Sat, 3 Feb 2018 20:36:22 +0000 (21:36 +0100)]
avformat/mov: Move +1 in check to avoid hypothetical overflow in add_ctts_entry()

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eb60b9d3aaaa42265fb1960be6fff6383cfdbf37)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
17 months agoavcodec/get_bits: Make sure the input bitstream with padding can be addressed
Michael Niedermayer [Sat, 24 Mar 2018 00:38:53 +0000 (01:38 +0100)]
avcodec/get_bits: Make sure the input bitstream with padding can be addressed

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e529fe7633762cb26a665fb6dee3be29b15285cc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>