ffmpeg.git
14 months agoUpdate for 4.0.2 n4.0.2
Michael Niedermayer [Wed, 18 Jul 2018 12:04:51 +0000 (14:04 +0200)]
Update for 4.0.2

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/dvdsub_parser: Allocate input padding
Michael Niedermayer [Fri, 13 Jul 2018 16:56:10 +0000 (18:56 +0200)]
avcodec/dvdsub_parser: Allocate input padding

Fixes: out of array read
Fixes: 9350/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVDSUB_fuzzer-5746777750765568

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cd86b5cfe278af79d6b147e122d9a72c270a9fde)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/dvdsub_parser: Init output buf/size
Michael Niedermayer [Fri, 13 Jul 2018 16:54:48 +0000 (18:54 +0200)]
avcodec/dvdsub_parser: Init output buf/size

No testcase

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9e6c8437761661441d836876934314cb2b8fafe7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/dirac_dwt_template: Fix signedness regression in interleave()
Michael Niedermayer [Fri, 13 Jul 2018 16:33:08 +0000 (18:33 +0200)]
avcodec/dirac_dwt_template: Fix signedness regression in interleave()

Found-by: <jdarnley>
Tested-by: James Darnley <james.darnley@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 181435a4de6e38e0a15ddaf16de9a157ef41cb18)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/mov: Simplify last element computation in mov_estimate_video_delay()
Michael Niedermayer [Wed, 11 Jul 2018 00:17:57 +0000 (02:17 +0200)]
avformat/mov: Simplify last element computation in mov_estimate_video_delay()

Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Reviewed-by: Sasi Inguva <isasi@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b0644f7f72a9ae64c7285d26ec720441c25d4cf5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/mov: Break out of inner loop early in mov_estimate_video_delay()
Michael Niedermayer [Wed, 11 Jul 2018 00:17:58 +0000 (02:17 +0200)]
avformat/mov: Break out of inner loop early in mov_estimate_video_delay()

0.266 <- 0.299 sec (this is time ffmpeg so containing alot other things)

Sample for benchmark was: ffmpeg -f rawvideo -pix_fmt yuv420p -s 32x32 -i /dev/zero -t 24:00:00.00 out.mp4

Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Reviewed-by: Sasi Inguva <isasi@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aba13dc13e5233545bdd06f514e0addbb0155c69)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/mov: Eliminate variable buf_size from mov_estimate_video_delay()
Michael Niedermayer [Wed, 11 Jul 2018 00:17:56 +0000 (02:17 +0200)]
avformat/mov: Eliminate variable buf_size from mov_estimate_video_delay()

Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Reviewed-by: Sasi Inguva <isasi@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3ce4034308a3726395a2c1b18a3dff3554e0b619)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/mov: remove modulo operations from mov_estimate_video_delay()
Michael Niedermayer [Wed, 11 Jul 2018 00:17:55 +0000 (02:17 +0200)]
avformat/mov: remove modulo operations from mov_estimate_video_delay()

0.324 <-0.491 sec

Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Reviewed-by: Sasi Inguva <isasi@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c995e01b1e01ac11cf2545b3ce86569a482ff434)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/movenc: Write version 2 of audio atom if channels is not known
Michael Niedermayer [Sat, 7 Jul 2018 22:16:42 +0000 (00:16 +0200)]
avformat/movenc: Write version 2 of audio atom if channels is not known

The version 1 needs the channel count and would divide by 0
Fixes: division by 0
Fixes: fpe_movenc.c_1108_1.ogg
Fixes: fpe_movenc.c_1108_2.ogg
Fixes: fpe_movenc.c_1108_3.wav

Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fa19fbcf712a6a6cc5a5cfdc3254a97b9bce6582)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoswresample/arm: rename labels to fix xcode build error
Rahul Chaudhry [Fri, 27 Apr 2018 20:49:52 +0000 (13:49 -0700)]
swresample/arm: rename labels to fix xcode build error

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e84212b78e00df17799e01be1e153a073eb8f689)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/movenc: Check input sample count
Michael Niedermayer [Fri, 6 Jul 2018 20:23:25 +0000 (22:23 +0200)]
avformat/movenc: Check input sample count

Fixes: division by 0
Fixes: fpe_movenc.c_199_1.wav
Fixes: fpe_movenc.c_199_2.wav
Fixes: fpe_movenc.c_199_3.wav
Fixes: fpe_movenc.c_199_4.wav
Fixes: fpe_movenc.c_199_5.wav
Fixes: fpe_movenc.c_199_6.wav
Fixes: fpe_movenc.c_199_7.wav

Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3a2d21bc5f97aa0161db3ae731fc2732be6108b8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/mjpegdec: Check for odd progressive RGB
Michael Niedermayer [Fri, 6 Jul 2018 14:28:14 +0000 (16:28 +0200)]
avcodec/mjpegdec: Check for odd progressive RGB

Fixes: out of array access
Fixes: 9225/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-5684770334834688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ee1e3ca5eb1ec7d34e925d129c893e33847ee0b7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/vp8_parser: Do not leave data/size uninitialized
Michael Niedermayer [Fri, 6 Jul 2018 10:01:46 +0000 (12:01 +0200)]
avcodec/vp8_parser: Do not leave data/size uninitialized

This is identical to what the VP9 parser does

Fixes: 9215/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVPX_VP8_fuzzer-5768227253649408
Fixes: out of memory access

This may also fix oss fuzz issue 9212

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 284dde24dab30225ed3e233b0e5908d67d7e13e7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/mms: Add missing chunksize check
Michael Niedermayer [Tue, 3 Jul 2018 18:33:04 +0000 (20:33 +0200)]
avformat/mms: Add missing chunksize check

Fixes: out of array read
Fixes: mms-crash-01b6c5d85f9d9f40f4e879896103e9f5b222816a

Found-by: Paul Ch <paulcher@icloud.com>
1st hunk by Paul Ch <paulcher@icloud.com>
Tested-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cced03dd667a5df6df8fd40d8de0bff477ee02e8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/pva: Check for EOF before retrying in read_part_of_packet()
Michael Niedermayer [Tue, 3 Jul 2018 20:14:42 +0000 (22:14 +0200)]
avformat/pva: Check for EOF before retrying in read_part_of_packet()

Fixes: Infinite loop
Fixes: pva-4b1835dbc2027bf3c567005dcc78e85199240d06

Found-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/rmdec: Do not pass mime type in rm_read_multi() to ff_rm_read_mdpr_codecdata()
Michael Niedermayer [Tue, 3 Jul 2018 19:37:46 +0000 (21:37 +0200)]
avformat/rmdec: Do not pass mime type in rm_read_multi() to ff_rm_read_mdpr_codecdata()

Fixes: use after free()
Fixes: rmdec-crash-ffe85b4cab1597d1cfea6955705e53f1f5c8a362

Found-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a7e032a277452366771951e29fd0bf2bd5c029f0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/asfdec_o: Check size_bmp more fully
Michael Niedermayer [Tue, 3 Jul 2018 19:01:23 +0000 (21:01 +0200)]
avformat/asfdec_o: Check size_bmp more fully

Fixes: integer overflow and out of array access
Fixes: asfo-crash-46080c4341572a7137a162331af77f6ded45cbd7

Found-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/mxfdec: Fix av_log context
Michael Niedermayer [Tue, 3 Jul 2018 18:38:06 +0000 (20:38 +0200)]
avformat/mxfdec: Fix av_log context

Fixes: out of array access
Fixes: mxf-crash-1c2e59bf07a34675bfb3ada5e1ec22fa9f38f923

Found-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/mpeg4videodec: Check for bitstream end in read_quant_matrix_ext()
Michael Niedermayer [Tue, 3 Jul 2018 20:48:32 +0000 (22:48 +0200)]
avcodec/mpeg4videodec: Check for bitstream end in read_quant_matrix_ext()

Fixes: out of array read
Fixes: asff-crash-0e53d0dc491dfdd507530b66562812fbd4c36678

Found-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5aba5b89d0b1d73164d3b81764828bb8b20ff32a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/indeo4: Check for end of bitstream in decode_mb_info()
Michael Niedermayer [Sun, 1 Jul 2018 23:26:44 +0000 (01:26 +0200)]
avcodec/indeo4: Check for end of bitstream in decode_mb_info()

Fixes: Timeout
Fixes: 8776/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-5361788798369792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 267ba2aa96354c5b6a1ea89b2943fbd7a4893862)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/ac3dec: Check channel_map index
Michael Niedermayer [Wed, 27 Jun 2018 13:56:18 +0000 (15:56 +0200)]
avcodec/ac3dec: Check channel_map index

Fixes: out of array read
Fixes: 8924/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EAC3_fuzzer-5851861780267008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 00f98d23b1462afb97116b947334db3754516207)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/mpeg4videodec: Remove use of FF_PROFILE_MPEG4_SIMPLE_STUDIO as indicator...
Michael Niedermayer [Mon, 2 Jul 2018 22:27:04 +0000 (00:27 +0200)]
avcodec/mpeg4videodec: Remove use of FF_PROFILE_MPEG4_SIMPLE_STUDIO as indicator of studio profile

The profile field is changed by code inside and outside the decoder,
its not a reliable indicator of the internal codec state.
Maintaining it consistency with studio_profile is messy.
Its easier to just avoid it and use only studio_profile

Fixes: assertion failure
Fixes: ffmpeg_crash_9.avi

Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bd27a9364ca274ca97f1df6d984e88a0700fb235)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/shorten: Fix undefined addition in shorten_decode_frame()
Michael Niedermayer [Mon, 2 Jul 2018 17:11:46 +0000 (19:11 +0200)]
avcodec/shorten: Fix undefined addition in shorten_decode_frame()

Fixes: signed integer overflow: 1139785606 + 1454196085 cannot be represented in type 'int'
Fixes: 8937/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-6202943597445120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3b10bb8772c76177cc47b8d15a6970f19dd11039)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/shorten: Fix undefined integer overflow
Michael Niedermayer [Mon, 2 Jul 2018 17:08:54 +0000 (19:08 +0200)]
avcodec/shorten: Fix undefined integer overflow

Fixes: signed integer overflow: 8454144 * 256 cannot be represented in type 'int'
Fixes: 8788/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5728205041303552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 70832333bba3b915040f415548518e136b44280e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/jpeg2000dec: Fixes invalid shifts in jpeg2000_decode_packets_po_iteration()
Michael Niedermayer [Mon, 2 Jul 2018 16:57:05 +0000 (18:57 +0200)]
avcodec/jpeg2000dec: Fixes invalid shifts in jpeg2000_decode_packets_po_iteration()

Fixes: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 9163/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5661750182543360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 652d7c6348f96181fa69f8e2afb7b27a14c0a88a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/jpeg2000dec: Check that there are enough bytes for all tiles
Michael Niedermayer [Mon, 2 Jul 2018 16:40:08 +0000 (18:40 +0200)]
avcodec/jpeg2000dec: Check that there are enough bytes for all tiles

Fixes: OOM
Fixes: 8781/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5810709081358336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0898a3d9909960324e27d3a7a4f48c4effbb654a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/movenc: Use mov->fc consistently for av_log()
Michael Niedermayer [Wed, 27 Jun 2018 21:41:52 +0000 (23:41 +0200)]
avformat/movenc: Use mov->fc consistently for av_log()

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 872ea3dfe565098570ad213a6f1eb00a805aec5d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/mpeg4videodec: Check read profile before setting it
Michael Niedermayer [Wed, 27 Jun 2018 17:37:09 +0000 (19:37 +0200)]
avcodec/mpeg4videodec: Check read profile before setting it

Fixes: null pointer dereference
Fixes: ffmpeg_crash_7.avi

Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2aa9047486dbff12d9e040f917e5f799ed2fd78b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/movenc: Do not pass AVCodecParameters in avpriv_request_sample
Michael Niedermayer [Wed, 27 Jun 2018 15:27:50 +0000 (17:27 +0200)]
avformat/movenc: Do not pass AVCodecParameters in avpriv_request_sample

Fixes: out of array read
Fixes: ffmpeg_crash_8.avi

Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 95556e27e2c1d56d9e18f5db34d6f756f3011148)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/ac3_parser: Check init_get_bits8() for failure
Michael Niedermayer [Wed, 27 Jun 2018 14:59:13 +0000 (16:59 +0200)]
avcodec/ac3_parser: Check init_get_bits8() for failure

Fixes: null pointer dereference
Fixes: ffmpeg_crash_6.avi

Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 00e8181bd97c834fe60751b0c511d4bb97875f78)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavformat/movenc: Check that frame_types other than EAC3_FRAME_TYPE_INDEPENDENT have...
Michael Niedermayer [Wed, 27 Jun 2018 14:51:51 +0000 (16:51 +0200)]
avformat/movenc: Check that frame_types other than EAC3_FRAME_TYPE_INDEPENDENT have a supported substream id

Fixes: out of array access
Fixes: ffmpeg_bof_1.avi

Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ed22dc22216f74c75ee7901f82649e1ff725ba50)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/dpx: Check elements in 12bps planar path
Michael Niedermayer [Wed, 27 Jun 2018 14:12:39 +0000 (16:12 +0200)]
avcodec/dpx: Check elements in 12bps planar path

Fixes: null pointer dereference
Fixes: 8946/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DPX_fuzzer-5078915222601728

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Carl Eugen Hoyos <ceffmpeg@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 75a2db552423295b509546f3b0f8b2b46d3424b1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/escape124: Fix spelling errors in comment
Michael Niedermayer [Wed, 27 Jun 2018 11:00:28 +0000 (13:00 +0200)]
avcodec/escape124: Fix spelling errors in comment

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f59c4e43915ed0528e2789f27ddb1635b59779df)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/ra144: Fix integer overflow in ff_eval_refl()
Michael Niedermayer [Thu, 21 Jun 2018 21:08:32 +0000 (23:08 +0200)]
avcodec/ra144: Fix integer overflow in ff_eval_refl()

Fixes: signed integer overflow: -4096 * -524288 cannot be represented in type 'int'
Fixes: 8650/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RA_144_fuzzer-5734816036159488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b31189881a4cf54b0057ecf3eab917ad56eecfea)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/cscd: Check output buffer size for lzo.
Michael Niedermayer [Thu, 21 Jun 2018 23:18:20 +0000 (01:18 +0200)]
avcodec/cscd: Check output buffer size for lzo.

Fixes: Timeout
Fixes: 8665/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CSCD_fuzzer-5768442610188288

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit 78167b498f53c36c31105a2bf11e90b03637598f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/escape124: Check buf_size against num_superblocks
Michael Niedermayer [Sun, 24 Jun 2018 17:23:02 +0000 (19:23 +0200)]
avcodec/escape124: Check buf_size against num_superblocks

Fixes: Timeout
Fixes: 8722/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-4843268402577408

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6677c98626489edfdb4b49b4f66ca91867768a9f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/h264_parser: Reduce needed history for parsing mb index
Michael Niedermayer [Fri, 22 Jun 2018 19:45:59 +0000 (21:45 +0200)]
avcodec/h264_parser: Reduce needed history for parsing mb index

This fixes a bug/regression with very small packets
Fixes: output_file

Regression since: 0782fb6bcb32fe3ab956a99af4cc472ff81da0c2

Reported-by: Thierry Foucu <tfoucu@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d25c945247979a88fac6bb3b7a26370262b96ef1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/magicyuv: Check bits left in flags&1 branch
Michael Niedermayer [Sat, 23 Jun 2018 21:37:10 +0000 (23:37 +0200)]
avcodec/magicyuv: Check bits left in flags&1 branch

Fixes: Timeout
Fixes: 8690/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_fuzzer-6542020913922048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7719b8ccc790b6e1325af0afe2b65e2334a7173c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoavcodec/mjpegdec: Check for end of bitstream in ljpeg_decode_rgb_scan()
Michael Niedermayer [Thu, 21 Jun 2018 20:48:54 +0000 (22:48 +0200)]
avcodec/mjpegdec: Check for end of bitstream in ljpeg_decode_rgb_scan()

Fixes: Timeout
Fixes: 8648/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5108395525799936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 540e8c2d641bf90fc28e47e170f8c0b1962197e9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14 months agoffmpeg: fix -stream_loop with multiple inputs
Marton Balint [Wed, 27 Jun 2018 20:27:01 +0000 (22:27 +0200)]
ffmpeg: fix -stream_loop with multiple inputs

The input thread needs to be properly cleaned up and re-initalized before we
can start reading again in threaded mode. (Threaded input reading is used when
there is mode than one input file).

Fixes ticket #6121 and #7043.

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit da36bcbeb78c78e493d18d3cd3ac92ea401e7031)

14 months agoffmpeg: factorize input thread creation and destruction
Marton Balint [Wed, 27 Jun 2018 19:55:38 +0000 (21:55 +0200)]
ffmpeg: factorize input thread creation and destruction

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit b181cd359b872283d5fcaf7c553bbad88517c78b)

15 months agoavformat/mpegts: parse large PMTs with multiple tables
Aman Gupta [Mon, 11 Jun 2018 07:43:31 +0000 (00:43 -0700)]
avformat/mpegts: parse large PMTs with multiple tables

In 9152c1e4955, the mpegts parser was taught how to parse
PMT sections which contained multiple tables. That commit
fixed parsing of PMT packets from some cable providers,
which included a special SCTE table (0xc0) before the
standard program map table (0x2).

Sometimes, however, the combined 0xc0 and 0x2 tables are
larger than a single TS packet (188 bytes). The mpegts parser
already attempts to parse sections which span multiple packets,
but still assumed that the split section only contained one
table.

This patch fixes parsing of such a sample[1].

Before:

    Input #0, mpegts, from 'combined-pmt-tids-split.ts':
      Duration: 00:00:01.26, start: 39188.931756, bitrate: 597 kb/s
      Program 1
      No Program
        Stream #0:0[0xeff]: Audio: ac3, 48000 Hz, mono, fltp, 64 kb/s
        Stream #0:1[0xefd]: Audio: mp3, 0 channels, fltp
        Stream #0:2[0xefe]: Unknown: none

After:

    Input #0, mpegts, from 'combined-pmt-tids-split.ts':
      Duration: 00:00:01.27, start: 39188.931756, bitrate: 589 kb/s
      Program 1
        Stream #0:0[0xefd]: Video: h264 ([27][0][0][0] / 0x001B), none, 59.94 fps, 59.94 tbr, 90k tbn, 180k tbc
        Stream #0:1[0xefe](eng): Audio: ac3 ([129][0][0][0] / 0x0081), 48000 Hz, stereo, fltp, 384 kb/s
        Stream #0:2[0xeff](spa): Audio: ac3 ([129][0][0][0] / 0x0081), 48000 Hz, mono, fltp, 64 kb/s
        Stream #0:3[0xf00]: Data: scte_35
        Stream #0:4[0xf01]: Unknown: none (ETV1 / 0x31565445)
        Stream #0:5[0xf02]: Unknown: none (ETV1 / 0x31565445)
        Stream #0:6[0xf03]: Unknown: none ([192][0][0][0] / 0x00C0)

With the patch, the PMT is parsed correctly so the streams are
created in the correct order, are associated with "Program 1",
and their codecs are set correctly.

[1] https://s3.amazonaws.com/tmm1/combined-pmt-tids-split.ts

Signed-off-by: Aman Gupta <aman@tmm1.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cd86c5dbcca5e79c979a6a04da25155ccf17f843)

15 months agoRevert "avcodec/mediacodecdec: wait on first frame after input buffers are full"
Aman Gupta [Mon, 18 Jun 2018 18:53:27 +0000 (11:53 -0700)]
Revert "avcodec/mediacodecdec: wait on first frame after input buffers are full"

@xyz reported a regression on his Sony Xperia Z3 Tablet Compact where
playback would intermittently fail to start, essentially deadlocking in
the decoder. Bisecting narrowed down the issue to this commit, which was
meant as an optimization but is not necessary.

This reverts commit a75bb5496ac6e7e194f1c6fd3b87f02a52e74adb.

Signed-off-by: Aman Gupta <aman@tmm1.net>
(cherry picked from commit 37c2cb6a68a4cbd746b0a56e38f28f7ee84e925f)

15 months agoavcodec/videotoolboxenc: fix invalid session on iOS
Thomas Guillem [Thu, 14 Jun 2018 15:48:07 +0000 (17:48 +0200)]
avcodec/videotoolboxenc: fix invalid session on iOS

Cf. comment. Restart the VT session when the APP goes from foreground to
background and vice versa.

Signed-off-by: Aman Gupta <aman@tmm1.net>
(cherry picked from commit 513e6a30fb013ca34812ccaaf3d090680ac868c5)

15 months agoavcodec/videotoolboxenc: split initialization
Thomas Guillem [Mon, 11 Jun 2018 14:21:18 +0000 (16:21 +0200)]
avcodec/videotoolboxenc: split initialization

Split vtenc_init() into vtenc_init() (VTEncContext initialization) and
vtenc_configure_encoder() (creates the vt session).

This commit will allow to restart the vt session while encoding.

Signed-off-by: Aman Gupta <aman@tmm1.net>
(cherry picked from commit 9e11d27c25bf9bbd53fa23e892946752096f378b)

15 months agoavcodec/videotoolboxenc: fix mutex/cond leak in error path
Thomas Guillem [Mon, 11 Jun 2018 14:21:17 +0000 (16:21 +0200)]
avcodec/videotoolboxenc: fix mutex/cond leak in error path

The leak could happen when the vtenc_create_encoder() function failed.

Signed-off-by: Aman Gupta <aman@tmm1.net>
(cherry picked from commit ce2330bdf896458131fcd00f9284c31617adcf01)

15 months agoUpdate for 4.0.1 n4.0.1
Michael Niedermayer [Fri, 15 Jun 2018 22:18:40 +0000 (00:18 +0200)]
Update for 4.0.1

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/aacdec_fixed: Fix undefined integer overflow in apply_independent_coupling_fi...
Michael Niedermayer [Thu, 14 Jun 2018 14:41:49 +0000 (16:41 +0200)]
avcodec/aacdec_fixed: Fix undefined integer overflow in apply_independent_coupling_fixed()

Fixes: signed integer overflow: 1195517 * 2048 cannot be represented in type 'int'
Fixes: 8636/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-4695836326887424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8bd514d9343746566b123275f8b6d0e9c11ec2b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/dirac_dwt_template: Fix undefined behavior in interleave()
Michael Niedermayer [Thu, 14 Jun 2018 14:37:32 +0000 (16:37 +0200)]
avcodec/dirac_dwt_template: Fix undefined behavior in interleave()

Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 8697/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5197148130902016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 575d8ca0260fabac29e5b3541154633569ce2b5d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavutil/common: Fix undefined behavior in av_clip_uintp2_c()
Michael Niedermayer [Thu, 14 Jun 2018 13:41:33 +0000 (15:41 +0200)]
avutil/common: Fix undefined behavior in av_clip_uintp2_c()

Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 8521/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5639024952737792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aa41d322be71106ce147445f2b42bb763f1eff86)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agofftools/ffmpeg: Fallback to duration if sample rate is unavailable
Michael Niedermayer [Tue, 1 May 2018 20:44:07 +0000 (22:44 +0200)]
fftools/ffmpeg: Fallback to duration if sample rate is unavailable

Regression since: af1761f7
Fixes: Division by 0
Fixes: ffmpeg_crash_1

Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 16d8b13b3b26c19d7f8856e039fe6662d96b4ff3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavformat/mov: Only set pkt->duration to non negative values
Michael Niedermayer [Wed, 16 May 2018 21:35:58 +0000 (23:35 +0200)]
avformat/mov: Only set pkt->duration to non negative values

Reviewed-by: Sasi Inguva <isasi@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8176799f31b23849382623f0f9001acc5edf7c76)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/mpeg4videodec: Clear bits_per_raw_sample if it has originated from a previous...
Michael Niedermayer [Sat, 9 Jun 2018 20:25:38 +0000 (22:25 +0200)]
avcodec/mpeg4videodec: Clear bits_per_raw_sample if it has originated from a previous instance

Fixes: assertion failure
Fixes: ffmpeg_crash_5.avi

Found-by: Thuan Pham <thuanpv@comp.nus.edu.sg>, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2fc108f60f98cd00813418a8754a46476b404a3c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavformat/movenc: fix recognization of cover image streams
Timo Teräs [Mon, 4 Jun 2018 14:36:19 +0000 (17:36 +0300)]
avformat/movenc: fix recognization of cover image streams

For chapter images, the mov demux produces streams with disposition set
to attached_pic+timed_thumbnails. This patch fixes to properly recognize
streams that should be encoded as cover image (ones with only and only
attached_pic disposition set).

Signed-off-by: Timo Teräs <timo.teras@iki.fi>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2223811b015926fec68473a08016d40cea0989b2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavformat/movenc: properly handle cover image codecs
Timo Teräs [Thu, 31 May 2018 23:24:39 +0000 (02:24 +0300)]
avformat/movenc: properly handle cover image codecs

Find codec tag for attached images using appropriate list of
supported image formats.

This fixes writing the cover image to m4v/m4a and other container
formats that do not allow these codecs as a track.

Signed-off-by: Timo Teräs <timo.teras@iki.fi>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 12205d2c896b7edbc929d4886e7bfda4b53538e5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/h264_slice: Fix overflow in recovery_frame computation
Michael Niedermayer [Fri, 8 Jun 2018 17:07:22 +0000 (19:07 +0200)]
avcodec/h264_slice: Fix overflow in recovery_frame computation

Fixes: signed integer overflow: 15 + 2147483646 cannot be represented in type 'int'
Fixes: 8381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-6225533137321984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8c20ea8ee0f3f0b27aca0204c6dfaa4ac137e34e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/h264_ps: Move MAX_LOG2_MAX_FRAME_NUM to header so it can be used in h264_sei
Michael Niedermayer [Sun, 10 Jun 2018 15:02:47 +0000 (17:02 +0200)]
avcodec/h264_ps: Move MAX_LOG2_MAX_FRAME_NUM to header so it can be used in h264_sei

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b796c5ae9299c795cba0d16ce1d8eef05488953b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/h264_mc_template: Only prefetch motion if the list is used.
Michael Niedermayer [Fri, 8 Jun 2018 16:25:14 +0000 (18:25 +0200)]
avcodec/h264_mc_template: Only prefetch motion if the list is used.

Fixes: index 59 out of bounds for type 'H264Ref [48]'
Fixes: 8232/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5703295145345024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8b55591757244d8244a2be369c2b54c9ae79b02a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/xwddec: Use ff_set_dimensions()
Michael Niedermayer [Thu, 7 Jun 2018 22:42:31 +0000 (00:42 +0200)]
avcodec/xwddec: Use ff_set_dimensions()

Fixes: OOM
Fixes: 8178/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XWD_fuzzer-4844793342459904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c2852e4e00de4073ff7de82d41cb3368702686e8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/wavpack: Fix overflow in adding tail
Michael Niedermayer [Thu, 7 Jun 2018 22:07:04 +0000 (00:07 +0200)]
avcodec/wavpack: Fix overflow in adding tail

Fixes: signed integer overflow: 2146907204 + 26846088 cannot be represented in type 'int'
Fixes: 8105/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-6233036682166272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d13379fb79708f550460dd6d698023bf26f968d5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/shorten: Fix multiple integer overflows
Michael Niedermayer [Tue, 5 Jun 2018 11:19:35 +0000 (13:19 +0200)]
avcodec/shorten: Fix multiple integer overflows

Fixes: signed integer overflow: 3 * 1006632960 cannot be represented in type 'int'
Fixes: 8278/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5692857166856192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f2abd36b3863188894fd21964c662b6c17268bfb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/shorten: Fix undefined shift in fix_bitshift()
Michael Niedermayer [Tue, 5 Jun 2018 11:15:34 +0000 (13:15 +0200)]
avcodec/shorten: Fix undefined shift in fix_bitshift()

Fixes: left shift of negative value -9
Fixes: 8571/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5715966875926528

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 606c7148231404544005c0827b83c165dd6b39a8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/shorten: Fix a negative left shift in shorten_decode_frame()
Michael Niedermayer [Tue, 5 Jun 2018 11:12:54 +0000 (13:12 +0200)]
avcodec/shorten: Fix a negative left shift in shorten_decode_frame()

Fixes: left shift of negative value -9057
Fixes: 8527/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5666853924896768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a711efe922b2bf1d363bdf7f8357656c3e35021e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/shorten: Sanity check nmeans
Michael Niedermayer [Tue, 5 Jun 2018 11:03:48 +0000 (13:03 +0200)]
avcodec/shorten: Sanity check nmeans

Fixes: OOM
Fixes: 8195/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5179785826271232

The reference software appears to use longs for 32bits and it uses int for nmeans
hinting that the intended maximum size was not 32bit.

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d91a0b503d7a886587281bc1ee42476aa5e89f85)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/shorten: Check non COMM chunk len before skip in decode_aiff_header()
Michael Niedermayer [Tue, 5 Jun 2018 00:33:43 +0000 (02:33 +0200)]
avcodec/shorten: Check non COMM chunk len before skip in decode_aiff_header()

Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 8024/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5109204648984576

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 424a81df107b63a166894a4aee3d27702ae3f459)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/mjpegdec: Fix integer overflow in ljpeg_decode_rgb_scan()
Michael Niedermayer [Tue, 5 Jun 2018 00:17:24 +0000 (02:17 +0200)]
avcodec/mjpegdec: Fix integer overflow in ljpeg_decode_rgb_scan()

Fixes: signed integer overflow: 32768 + 2147450880 cannot be represented in type 'int'
Fixes: 7885/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-5298834394578944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 936f4a2c2e14ec753e8835f2e820b4cd9aec9a56)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/truemotion2: Fix overflow in tm2_apply_deltas()
Michael Niedermayer [Tue, 5 Jun 2018 00:09:59 +0000 (02:09 +0200)]
avcodec/truemotion2: Fix overflow in tm2_apply_deltas()

Fixes: signed integer overflow: 1077952576 + 1077952576 cannot be represented in type 'int'
Fixes: 7712/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5056281753681920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 79c6047c3668c639f717b3a7001a34dddba0ede2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/opus_silk: Change silk_lsf2lpc() slightly toward silk/NLSF2A.c
Michael Niedermayer [Sat, 2 Jun 2018 23:33:54 +0000 (01:33 +0200)]
avcodec/opus_silk: Change silk_lsf2lpc() slightly toward silk/NLSF2A.c

Fixes: runtime error: signed integer overflow: -1440457022 - 785819492 cannot be represented in type 'int'
Fixes: 7700/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OPUS_fuzzer-6595838684954624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e7dda51150b73e5fbdccf4c2d3a72e356980fba3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/amrwbdec: Fix division by 0 in find_hb_gain()
Michael Niedermayer [Sat, 2 Jun 2018 22:48:06 +0000 (00:48 +0200)]
avcodec/amrwbdec: Fix division by 0 in find_hb_gain()

This restructures the code slightly toward D_UTIL_dec_synthesis()

Fixes: 7420/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMRWB_fuzzer-6577305112543232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dce80a4b47efaba97707bda781a9ee57f5a26974)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/h263dec: Reinitialize idct context if it has not been setup for the active...
Michael Niedermayer [Mon, 28 May 2018 20:29:58 +0000 (22:29 +0200)]
avcodec/h263dec: Reinitialize idct context if it has not been setup for the active profile

The profile after reading headers can be different from when the context was initialized

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 44a2415a6d94f841f2026bb70b8b3c19ba68aa72)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/idctdsp: Clear idct/idct_add for studio profile
Michael Niedermayer [Mon, 28 May 2018 20:29:57 +0000 (22:29 +0200)]
avcodec/idctdsp: Clear idct/idct_add for studio profile

This does not leave them "as before" which may be a value from a previous profile

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8c50d0cccfe4c9f25a8494f76da55dcdc2275058)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavformat/mov: replace a value error by clipping into valid range in mov_read_stsc()
Michael Niedermayer [Mon, 21 May 2018 01:16:58 +0000 (03:16 +0200)]
avformat/mov: replace a value error by clipping into valid range in mov_read_stsc()

Fixes: #7165

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fe84f70819d6f5aab3c4823290e0d32b99d6de78)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavformat/bintext: Reduce detection for random .bin files as it more likely is not...
Michael Niedermayer [Sat, 12 May 2018 16:33:26 +0000 (18:33 +0200)]
avformat/bintext: Reduce detection for random .bin files as it more likely is not a multimedia related file

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 919e37377a76f63d030d680fcb9506a3f8cc2d62)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavformat/mov: Break out early if chunk_count is 0 in mov_build_index()
Michael Niedermayer [Tue, 15 May 2018 15:06:59 +0000 (17:06 +0200)]
avformat/mov: Break out early if chunk_count is 0 in mov_build_index()

Without this some operations might overflow (undefined behavior)
even though the index adding loop would never execute

No testcase known

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 56e76bd0579cc7f7b28860885d9e569a39daf41b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/fic: Avoid some magic numbers related to cursors
Michael Niedermayer [Sat, 5 May 2018 21:42:36 +0000 (23:42 +0200)]
avcodec/fic: Avoid some magic numbers related to cursors

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c6a11714c4b1227be62cbc36651ccfc415e8e623)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/mpeg4video: Detect reference studio streams as studio streams
Michael Niedermayer [Sun, 29 Apr 2018 21:39:41 +0000 (23:39 +0200)]
avcodec/mpeg4video: Detect reference studio streams as studio streams

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ba97d75ac6254db90c64d3c7aacdd0548dca7b24)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/mpeg4videodec: Do not corrupt bits_per_raw_sample
Michael Niedermayer [Sun, 29 Apr 2018 18:49:21 +0000 (20:49 +0200)]
avcodec/mpeg4videodec: Do not corrupt bits_per_raw_sample

Reviewed-by: Kieran Kunhya <kierank@obe.tv>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9e5d0860c043ba5d1e48c0f8c42b0fe3b6cbeba4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/mpeg4videode: Eliminate out of loop VOP startcode reading for studio profile
Michael Niedermayer [Sun, 29 Apr 2018 17:09:05 +0000 (19:09 +0200)]
avcodec/mpeg4videode: Eliminate out of loop VOP startcode reading for studio profile

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9f73ae31e075104c7613d481a09a8b102e6449e9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/g2meet: ask for sample with overflowing RGB
Michael Niedermayer [Wed, 16 May 2018 20:50:19 +0000 (22:50 +0200)]
avcodec/g2meet: ask for sample with overflowing RGB

Suggested-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ab834b8f36c8157b7015e849405cbf6ae21e672f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/idctdsp: Transmit studio_profile to init instead of using AVCodecContext...
Michael Niedermayer [Mon, 28 May 2018 19:19:08 +0000 (21:19 +0200)]
avcodec/idctdsp: Transmit studio_profile to init instead of using AVCodecContext profile

These 2 fields are not always the same, it is simpler to always use the same field
for detecting studio profile

Fixes: null pointer dereference
Fixes: ffmpeg_crash_3.avi

Found-by: Thuan Pham <thuanpv@comp.nus.edu.sg>, Marcel Böhme, Andrew Santosa and Alexandru RazvanCaciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b3332a182f8ba33a34542e4a0370f38b914ccf7d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/ac3dec: Check that the number of channels with dependant streams is valid
Michael Niedermayer [Fri, 25 May 2018 20:55:19 +0000 (22:55 +0200)]
avcodec/ac3dec: Check that the number of channels with dependant streams is valid

Fixes: left shift of 1 by 63 places cannot be represented in type 'long long'
Fixes: out of array access
Fixes: 7284/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AC3_fuzzer-5767914968842240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e3275f937dc38e740c74539f2f6aad5bfdba2bf1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/ac3dec: Fix null pointer dereference in ac3_decode_frame()
Michael Niedermayer [Fri, 25 May 2018 20:22:27 +0000 (22:22 +0200)]
avcodec/ac3dec: Fix null pointer dereference in ac3_decode_frame()

Fixes: index 8 out of bounds for type 'uint8_t *[8]'
Fixes: 7273/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EAC3_fuzzer-6296497667702784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e3f656f2dea6ef6e2a14e72931f3d6f205f732c8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/aacdec_fixed: use 64bit to avoid overflow in rounding in apply_dependent_coup...
Michael Niedermayer [Fri, 25 May 2018 20:06:48 +0000 (22:06 +0200)]
avcodec/aacdec_fixed: use 64bit to avoid overflow in rounding in apply_dependent_coupling_fixed()

Fixes: signed integer overflow: -2141499320 + -14469590 cannot be represented in type 'int'
Fixes: 7351/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-6351214791884800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 90475db97e2e5931d295df6ab86519fa2e14d259)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agooavcodec/aacpsdsp_template: Use unsigned for hs0X to prevent undefined behavior
Michael Niedermayer [Fri, 25 May 2018 20:02:20 +0000 (22:02 +0200)]
oavcodec/aacpsdsp_template: Use unsigned for hs0X to prevent undefined behavior

Fixes: signed integer overflow: 1073741842 + 1784008138 cannot be represented in type 'int'
Fixes: 6792/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5677589835284480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 62cb6fadf33de6db386deac92853d4b95c930015)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/g723_1dec: Clip bits2 in both directions
Michael Niedermayer [Fri, 25 May 2018 19:56:04 +0000 (21:56 +0200)]
avcodec/g723_1dec: Clip bits2 in both directions

Fixes: shift exponent 33 is too large for 32-bit type 'int'
Fixes: 6743/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G723_1_fuzzer-5823772687859712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 53f241218d9eac368e2e1c58bcca9bbdf10fd0e1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/mpeg4videoenc: Use 64 bit for times in mpeg4_encode_gop_header()
Michael Niedermayer [Mon, 21 May 2018 21:08:05 +0000 (23:08 +0200)]
avcodec/mpeg4videoenc: Use 64 bit for times in mpeg4_encode_gop_header()

Fixes truncation
Fixes Assertion n <= 31 && value < (1U << n) failed at libavcodec/put_bits.h:169
Fixes: ffmpeg_crash_2.avi

Found-by: Thuan Pham <thuanpv@comp.nus.edu.sg>, Marcel Böhme, Andrew Santosa and Alexandru RazvanCaciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e1182fac1afba92a4975917823a5f644bee7e6e8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/mlpdec: Only change noise_type if the related fields are valid
Michael Niedermayer [Thu, 17 May 2018 11:58:46 +0000 (13:58 +0200)]
avcodec/mlpdec: Only change noise_type if the related fields are valid

Fixes: inconsistency
Fixes:runtime error: index 8 out of bounds for type 'int32_t [8]'
Fixes: 6686/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-5191383498358784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 63c4a4b0d692bc86142790276358ba35129f2290)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoindeo4: Decode all or nothing of a band header.
Michael Niedermayer [Thu, 17 May 2018 11:40:38 +0000 (13:40 +0200)]
indeo4: Decode all or nothing of a band header.

This avoids inconsistent value combinations.
Alternatively it would be possible to add more checks and careful use of
temporary variables, but my try of this quickly seemed to become
a rather large change.
The disadvantage of this, is that the struct is copied back and forth.

Fixes: index 6 out of bounds for type 'const uint16_t [5][16]'
Fixes: 6557/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-4787296550256640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 10c8521265da86118597336c5589e26de377a374)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/ac3dec: Use frame_size if superframe_size is 0
Michael Niedermayer [Thu, 17 May 2018 23:48:38 +0000 (01:48 +0200)]
avcodec/ac3dec: Use frame_size if superframe_size is 0

Fixes: Infinite loop
Fixes: 7669/clusterfuzz-testcase-ffmpeg_AV_CODEC_ID_AC3_FIXED_fuzzer-4689042185650176
Fixes: 7670/clusterfuzz-testcase-ffmpeg_AV_CODEC_ID_AC3_fuzzer-4706306762997760
Fixes: 7672/clusterfuzz-testcase-ffmpeg_AV_CODEC_ID_EAC3_fuzzer-4702108499574784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f77eee67e25b13e32e899efb6fdf01719914353e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavformat/mov: Only fail for STCO/STSC contradictions if both exist
Michael Niedermayer [Tue, 15 May 2018 15:07:00 +0000 (17:07 +0200)]
avformat/mov: Only fail for STCO/STSC contradictions if both exist

Fixes regression with playback of GF9720Repeal20the20Eighth20with20Helen20Linehan.m4a
See: crbug 822666

Found-by: "Mattias Wadman <mattias.wadman@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2c2d689c56646cce64d02a3b75f61c12c5589260)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD97iH0 / COMPOSE_DD137iL0
Michael Niedermayer [Sun, 13 May 2018 22:10:33 +0000 (00:10 +0200)]
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD97iH0 / COMPOSE_DD137iL0

Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int');
Fixes: 6500/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-4523620274536448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cb944fc7f1327443a0cf449afbce5a3e8712f90f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/fic: Check available input space for cursor
Michael Niedermayer [Sat, 5 May 2018 20:00:01 +0000 (22:00 +0200)]
avcodec/fic: Check available input space for cursor

Fixes: out of array read
Fixes: 6546/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FIC_fuzzer-6317064647081984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cb2f7ea96b4f6e03ebf0c0563677745fc65f148e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/mpeg4videodec: Check bps (VOL header) before VOP for studio profile
Michael Niedermayer [Sun, 29 Apr 2018 18:28:46 +0000 (20:28 +0200)]
avcodec/mpeg4videodec: Check bps (VOL header) before VOP for studio profile

Fixes: runtime error: shift exponent -1 is negative
Fixes: 7486/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4977380939530240

Fixes: runtime error: index 36 out of bounds for type 'const uint8_t [32]'
Fixes: 7566/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-6536620682510336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b3a18511cc93082ebecce0861bc15d7f548492e0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/g2meet: Check RGB upper limit
Michael Niedermayer [Fri, 27 Apr 2018 18:16:13 +0000 (20:16 +0200)]
avcodec/g2meet: Check RGB upper limit

Fixes: runtime error: left shift of 1876744317 by 16 places cannot be represented in type 'int'
Fixes: 6799/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5115274731716608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4dd2c8b9ea46b4e008a8bfc2077834428cd5a17c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/jpeg2000dec: Fix undefined shift in the jpeg2000_decode_packets_po_iteration...
Michael Niedermayer [Fri, 4 May 2018 17:18:25 +0000 (19:18 +0200)]
avcodec/jpeg2000dec: Fix undefined shift in the jpeg2000_decode_packets_po_iteration() CPRL case

Fixes: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 7955/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-6016721977606144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 652ba72ed3124f201f98eea9bafb2232b535f549)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/jpeg2000dec: Skip init for component in CPRL if nothing is to be done
Michael Niedermayer [Fri, 4 May 2018 17:11:36 +0000 (19:11 +0200)]
avcodec/jpeg2000dec: Skip init for component in CPRL if nothing is to be done

Fixes: assertion failure
Fixes: 7949/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-4819602782552064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a96c131eb53b00de154f4773d96a3b323ea3daed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/g2meet: Change order of operations to avoid undefined behavior
Michael Niedermayer [Fri, 4 May 2018 16:16:08 +0000 (18:16 +0200)]
avcodec/g2meet: Change order of operations to avoid undefined behavior

Fixes: signed integer overflow: 65280 * 196032 cannot be represented in type 'int'
Fixes: 7279/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5977332473921536

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0a4745145840d97619c424961c1b5c625dbf516c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/flac_parser: Fix infinite loop
Michael Niedermayer [Mon, 30 Apr 2018 20:20:28 +0000 (22:20 +0200)]
avcodec/flac_parser: Fix infinite loop

Fixes: crbug/827204

Reported-by: Frank Liberato <liberato@google.com>
Reviewed-by: Frank Liberato <liberato@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 15a2e35e9e74bba5a27e39c26da5be2361f27945)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/mpeg4videodec: Split decode_studio_vol_header() out of decode_studiovisualobj...
Michael Niedermayer [Sun, 29 Apr 2018 19:19:15 +0000 (21:19 +0200)]
avcodec/mpeg4videodec: Split decode_studio_vol_header() out of decode_studiovisualobject()

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 177133a0f4b41b3c98b9cbc7f8f45755412c537b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/mpeg4videodec: Move decode_studiovisualobject() parsing in the branch for...
Michael Niedermayer [Sun, 29 Apr 2018 19:19:14 +0000 (21:19 +0200)]
avcodec/mpeg4videodec: Move decode_studiovisualobject() parsing in the branch for visual object parsing

Fixes: runtime error: shift exponent -1 is negative
Fixes: 7510/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5024523356209152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e03bf251d8784f4d1df2c22381c902087e151e31)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>