ffmpeg.git
2 years agoUpdate for 3.3.2 n3.3.2
Michael Niedermayer [Tue, 6 Jun 2017 20:11:21 +0000 (22:11 +0200)]
Update for 3.3.2

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/mpeg4videodec: Fix runtime error: signed integer overflow: 53098 * 40448...
Michael Niedermayer [Tue, 6 Jun 2017 14:28:57 +0000 (16:28 +0200)]
avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: 53098 * 40448 cannot be represented in type 'int'

Fixes: 2106/clusterfuzz-testcase-minimized-6136503639998464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 18bca25adbae9d010d75f9fc197c0af656af758d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/pafvideo: Fix assertion failure
Michael Niedermayer [Tue, 6 Jun 2017 14:21:37 +0000 (16:21 +0200)]
avcodec/pafvideo: Fix assertion failure

Fixes: 2100/clusterfuzz-testcase-minimized-4522961547558912

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c4360559ee2a6c8c624f24fc7e2a1cf00972ba68)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/takdec: Fix multiple runtime error: signed integer overflow: 637072 * 4096...
Michael Niedermayer [Tue, 6 Jun 2017 14:01:16 +0000 (16:01 +0200)]
avcodec/takdec: Fix multiple runtime error: signed integer overflow: 637072 * 4096 cannot be represented in type 'int'

Fixes: 2079/clusterfuzz-testcase-minimized-5345861779324928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e4efd41b83e78c7f2ee3e74bee90226110743a8e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/mjpegdec: Check that reference frame matches the current frame
Michael Niedermayer [Mon, 5 Jun 2017 20:23:15 +0000 (22:23 +0200)]
avcodec/mjpegdec: Check that reference frame matches the current frame

Fixes: out of array read
Fixes: 2097/clusterfuzz-testcase-minimized-5036861833609216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4705edbbb96e193f51c72248f508ae5693702a48)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/tiff: Avoid loosing allocated geotag values
Michael Niedermayer [Mon, 5 Jun 2017 18:39:21 +0000 (20:39 +0200)]
avcodec/tiff: Avoid loosing allocated geotag values

Fixes memleak
Fixes: 2076/clusterfuzz-testcase-minimized-6542640243802112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d7cbeab4c1381f95ed0ebf85d7950bee96f66164)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/cavs: Fix runtime error: signed integer overflow: -12648062 * 256 cannot...
Michael Niedermayer [Mon, 5 Jun 2017 17:33:56 +0000 (19:33 +0200)]
avcodec/cavs: Fix runtime error: signed integer overflow: -12648062 * 256 cannot be represented in type 'int'

Fixes: 2067/clusterfuzz-testcase-minimized-5578430902960128

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1e6ee86d9254e8fd2158cc9a31d3be96b0809411)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavformat/hls: Check local file extensions
Michael Niedermayer [Sat, 3 Jun 2017 19:20:04 +0000 (21:20 +0200)]
avformat/hls: Check local file extensions

This reduces the attack surface of local file-system
information leaking.

It prevents the existing exploit leading to an information leak. As
well as similar hypothetical attacks.

Leaks of information from files and symlinks ending in common multimedia extensions
are still possible. But files with sensitive information like private keys and passwords
generally do not use common multimedia filename extensions.
It does not stop leaks via remote addresses in the LAN.

The existing exploit depends on a specific decoder as well.
It does appear though that the exploit should be possible with any decoder.
The problem is that as long as sensitive information gets into the decoder,
the output of the decoder becomes sensitive as well.
The only obvious solution is to prevent access to sensitive information. Or to
disable hls or possibly some of its feature. More complex solutions like
checking the path to limit access to only subdirectories of the hls path may
work as an alternative. But such solutions are fragile and tricky to implement
portably and would not stop every possible attack nor would they work with all
valid hls files.

Developers have expressed their dislike / objected to disabling hls by default as well
as disabling hls with local files. There also where objections against restricting
remote url file extensions. This here is a less robust but also lower
inconvenience solution.
It can be applied stand alone or together with other solutions.
limiting the check to local files was suggested by nevcairiel

This recommits the security fix without the author name joke which was
originally requested by Nicolas.

Found-by: Emil Lerner and Pavel Cheremushkin
Reported-by: Thierry Foucu <tfoucu@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 189ff4219644532bdfa7bab28dfedaee4d6d4021)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/qdrw: Fix null pointer dereference
Michael Niedermayer [Sun, 4 Jun 2017 19:37:47 +0000 (21:37 +0200)]
avcodec/qdrw: Fix null pointer dereference

The RGB555 PACKBITSRGN case tries to read a palette, if such
palette is actually stored then it accesses a null pointer.
All 16bit samples i could find use DIRECTBITSRGN.

Fixes: 2065/clusterfuzz-testcase-minimized-6298930457346048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 46b865ea9f86cbd12e1bf701913263c7932cccb0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavutil/softfloat: Fix sign error in and improve documentation of av_int2sf()
Michael Niedermayer [Sun, 4 Jun 2017 18:45:09 +0000 (20:45 +0200)]
avutil/softfloat: Fix sign error in and improve documentation of av_int2sf()

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6019d721d4c10bf73018d68511d9d0a914c0a389)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/hevc_ps: Fix runtime error: index 32 out of bounds for type 'uint8_t [32]'
Michael Niedermayer [Sun, 4 Jun 2017 15:06:27 +0000 (17:06 +0200)]
avcodec/hevc_ps: Fix runtime error: index 32 out of bounds for type 'uint8_t [32]'

Fixes: 2010/clusterfuzz-testcase-minimized-6209288450080768

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 29808fff339da3e0f26131f7a6209b853947a54b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/dxv: Check remaining bytes in dxv_decompress_raw()
Michael Niedermayer [Sun, 4 Jun 2017 13:41:18 +0000 (15:41 +0200)]
avcodec/dxv: Check remaining bytes in dxv_decompress_raw()

Fixes: Timeout
Fixes: 2006/clusterfuzz-testcase-minimized-5766515037044736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eb5049227033d946add93c0714bb8a28d94166f1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/pafvideo: Check packet size and frame code before ff_reget_buffer()
Michael Niedermayer [Sun, 4 Jun 2017 11:38:02 +0000 (13:38 +0200)]
avcodec/pafvideo: Check packet size and frame code before ff_reget_buffer()

Fixes 1745/clusterfuzz-testcase-minimized-6160693365571584
Fixes: Timeout

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit faa5a2181df53b5226f998a20b735798addcd365)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/ac3dec_fixed: Fix runtime error: left shift of 419 by 23 places cannot be...
Michael Niedermayer [Sun, 4 Jun 2017 11:02:51 +0000 (13:02 +0200)]
avcodec/ac3dec_fixed: Fix runtime error: left shift of 419 by 23 places cannot be represented in type 'int'

Fixes: 1352/clusterfuzz-testcase-minimized-5757565017260032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 136ce8baa4fc16cf38690cb457f7356c00e00a28)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavformat/options: log filename on open
Michael Niedermayer [Fri, 2 Jun 2017 12:47:16 +0000 (14:47 +0200)]
avformat/options: log filename on open

The loglevel is choosen so that the main filename and any images of
multi image sequences are shown only at debug level to avoid
clutter.

This makes exploits in playlists more visible. As they would show
accesses to private/sensitive files

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 53e0d5d7247548743e13c59c35e59fc2161e9582)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/aacps: Fix runtime error: left shift of 1073741824 by 1 places cannot be...
Michael Niedermayer [Fri, 2 Jun 2017 20:31:02 +0000 (22:31 +0200)]
avcodec/aacps: Fix runtime error: left shift of 1073741824 by 1 places cannot be represented in type 'INTFLOAT' (aka 'int')

Fixes: 2005/clusterfuzz-testcase-minimized-5744226438479872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9faf098163b33e7b0f5baafa3371ef5401f4105d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/wavpack: Fix runtime error: shift exponent 32 is too large for 32-bit type...
Michael Niedermayer [Thu, 1 Jun 2017 16:48:37 +0000 (18:48 +0200)]
avcodec/wavpack: Fix runtime error: shift exponent 32 is too large for 32-bit type 'int'

Fixes: 1967/clusterfuzz-testcase-minimized-5757031199801344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8b3e580b7f436206e84dac89415e057fa9abdab8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/cfhd: Fix runtime error: signed integer overflow: 65280 * 65288 cannot be...
Michael Niedermayer [Thu, 1 Jun 2017 16:32:52 +0000 (18:32 +0200)]
avcodec/cfhd: Fix runtime error: signed integer overflow: 65280 * 65288 cannot be represented in type 'int'

Fixes: 1925/clusterfuzz-testcase-minimized-5564569688735744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cd6f319a7470394044627d1bd900e21b9aca5f4a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/wavpack: Fix runtime error: signed integer overflow: 2013265955 - -134217694...
Michael Niedermayer [Wed, 31 May 2017 20:53:02 +0000 (22:53 +0200)]
avcodec/wavpack: Fix runtime error: signed integer overflow: 2013265955 - -134217694 cannot be represented in type 'int'

Fixes: 1922/clusterfuzz-testcase-minimized-5561194112876544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a47273c803edfbc43793349b74429ae29b05c003)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/cinepak: Check input packet size before frame reallocation
Michael Niedermayer [Wed, 31 May 2017 20:18:23 +0000 (22:18 +0200)]
avcodec/cinepak: Check input packet size before frame reallocation

Reduces time spend decoding 1917/clusterfuzz-testcase-minimized-5023221273329664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e47057e932ff9a071d52fa1d5d4a956340eb2475)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/hevc_ps: Fix runtime error: signed integer overflow: 2147483628 + 256 cannot...
Michael Niedermayer [Wed, 31 May 2017 20:02:07 +0000 (22:02 +0200)]
avcodec/hevc_ps: Fix runtime error: signed integer overflow: 2147483628 + 256 cannot be represented in type 'int'

Fixes: 1909/clusterfuzz-testcase-minimized-6732072662073344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6726328f7940a76c43b4d97ac37ababf363d042f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/ra144: Fixes runtime error: signed integer overflow: 7160 * 327138 cannot...
Michael Niedermayer [Wed, 31 May 2017 13:52:56 +0000 (15:52 +0200)]
avcodec/ra144: Fixes runtime error: signed integer overflow: 7160 * 327138 cannot be represented in type 'int'

Fixes: 1908/clusterfuzz-testcase-minimized-5392712477966336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 08cb69e870c1b2fdc3574780a3662b92bfd6ef79)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/pnm: Use ff_set_dimensions()
Michael Niedermayer [Wed, 31 May 2017 11:39:45 +0000 (13:39 +0200)]
avcodec/pnm: Use ff_set_dimensions()

Fixes: OOM
Fixes: 1906/clusterfuzz-testcase-minimized-4599315114754048

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a1c0d1d906d27d3f9e1b058bb065f897f90c1c7c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/cavsdec: Fix runtime error: signed integer overflow: 59 + 2147483600 cannot...
Michael Niedermayer [Wed, 31 May 2017 11:21:58 +0000 (13:21 +0200)]
avcodec/cavsdec: Fix runtime error: signed integer overflow: 59 + 2147483600 cannot be represented in type 'int'

Fixes: 1903/clusterfuzz-testcase-minimized-5359318167715840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 58f8cd4ac576028ef492a005bd06b1f22c3a6879)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/nvenc: fix hw accelerated transcode with bframes
Ganapathy Kasi [Wed, 31 May 2017 02:03:14 +0000 (19:03 -0700)]
avcodec/nvenc: fix hw accelerated transcode with bframes

hw accelerated transcode (h264_cuvid -> h264_nvenc with -hwaccel cuvid) was
broken after the filtergraph initialization was changed to intialize decoder
first followed by encoder (commit af1761f7b5b1b72197dc40934953b775c2d951cc).
During initialzing encoder with bframes, local buffers are allocated
internally in encoder which fails since no cuda context is available. Now
pushing the correct cuda context before encoder initialization fixes the issue.
Also adding push/pop cuda ctx during create/destroy/map/unmap resources and
destroy encoder session.

Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org>
2 years agolibavformat/hls: Observe Set-Cookie headers
Micah Galizia [Wed, 31 May 2017 01:29:55 +0000 (21:29 -0400)]
libavformat/hls: Observe Set-Cookie headers

Signed-off-by: Micah Galizia <micahgalizia@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c4c73020f4bbf261f0b263be82de575c17fa5a60)
Signed-off-by: Micah Galizia <micahgalizia@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agolibavformat/http: Ignore expired cookies
Micah Galizia [Wed, 31 May 2017 01:29:54 +0000 (21:29 -0400)]
libavformat/http: Ignore expired cookies

Signed-off-by: Micah Galizia <micahgalizia@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 28b24670741e1de25bfc7b5ea7c1d6dbae1aef6f)
Signed-off-by: Micah Galizia <micahgalizia@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavformat/avidec: Limit formats in gab2 to srt and ass/ssa
Michael Niedermayer [Tue, 30 May 2017 19:29:20 +0000 (21:29 +0200)]
avformat/avidec: Limit formats in gab2 to srt and ass/ssa

This prevents part of one exploit leading to an information leak

Found-by: Emil Lerner and Pavel Cheremushkin
Reported-by: Thierry Foucu <tfoucu@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a5d849b149ca67ced2d271dc84db0bc95a548abb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/acelp_pitch_delay: Fix runtime error: value 4.83233e+39 is outside the range...
Michael Niedermayer [Tue, 30 May 2017 02:03:09 +0000 (04:03 +0200)]
avcodec/acelp_pitch_delay: Fix runtime error: value 4.83233e+39 is outside the range of representable values of type 'float'

Fixes: 1902/clusterfuzz-testcase-minimized-4762451407011840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 87bddba43b725d43767f2a387cdea0936ac1b549)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/wavpack: Check float_shift
Michael Niedermayer [Tue, 30 May 2017 01:13:21 +0000 (03:13 +0200)]
avcodec/wavpack: Check float_shift

Fixes: runtime error: shift exponent 40 is too large for 32-bit type 'unsigned int'
Fixes: 1898/clusterfuzz-testcase-minimized-5970744880136192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4020b009d1e88ff10abd25fb768165afa546851d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/wavpack: Fix runtime error: signed integer overflow: 24 * -2147483648 cannot...
Michael Niedermayer [Tue, 30 May 2017 01:09:11 +0000 (03:09 +0200)]
avcodec/wavpack: Fix runtime error: signed integer overflow: 24 * -2147483648 cannot be represented in type 'int'

Fixes: 1894/clusterfuzz-testcase-minimized-4716739789062144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d90c5bf10559554d6f9cd1dfb90767b991b76d5d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/ansi: Fix frame memleak
Michael Niedermayer [Mon, 29 May 2017 12:07:33 +0000 (14:07 +0200)]
avcodec/ansi: Fix frame memleak

Fixes: 1892/clusterfuzz-testcase-minimized-4519341733183488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e091b9b3c7859030f2896ca2ae96faa3afc694a1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/dds: Fix runtime error: left shift of 145 by 24 places cannot be represented...
Michael Niedermayer [Mon, 29 May 2017 11:51:08 +0000 (13:51 +0200)]
avcodec/dds: Fix runtime error: left shift of 145 by 24 places cannot be represented in type 'int'

Fixes: 1891/clusterfuzz-testcase-minimized-6274417925554176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c49fa2a51452eeba0cf2c14ce999ddeadf69aa4f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/jpeg2000dec: Use ff_set_dimensions()
Michael Niedermayer [Mon, 29 May 2017 11:45:29 +0000 (13:45 +0200)]
avcodec/jpeg2000dec: Use ff_set_dimensions()

Fixes: OOM
Fixes: 1890/clusterfuzz-testcase-minimized-6329019509243904

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f3da6fbff864e05e8871dd04222143abdee9e77b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/truemotion2: Fix passing null pointer to memset()
Michael Niedermayer [Sun, 28 May 2017 19:54:02 +0000 (21:54 +0200)]
avcodec/truemotion2: Fix passing null pointer to memset()

Fixes part of: 1888/clusterfuzz-testcase-minimized-5237704826552320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c901627918ff7480c1bb6f9cae507ee2c7c933d8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/truemotion2: Fix runtime error: left shift of 1 by 31 places cannot be repres...
Michael Niedermayer [Sun, 28 May 2017 19:54:02 +0000 (21:54 +0200)]
avcodec/truemotion2: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'

Fixes part of: 1888/clusterfuzz-testcase-minimized-5237704826552320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c9e884f3d98df85bf7f2cf30d71877b22929fdcb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/ra144: Fix runtime error: signed integer overflow: -2449 * 1398101 cannot...
Michael Niedermayer [Sun, 28 May 2017 19:44:32 +0000 (21:44 +0200)]
avcodec/ra144: Fix runtime error: signed integer overflow: -2449 * 1398101 cannot be represented in type 'int'

Fixes: 1885/clusterfuzz-testcase-minimized-5336328549957632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7c845450d2daa0d066045cf94ab51cb496f1b824)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/ra144: Fix runtime error: signed integer overflow: 11184810 * 404 cannot...
Michael Niedermayer [Sun, 28 May 2017 19:38:24 +0000 (21:38 +0200)]
avcodec/ra144: Fix runtime error: signed integer overflow: 11184810 * 404 cannot be represented in type 'int'

Fixes: 1884/clusterfuzz-testcase-minimized-4637425835966464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4c472c52525fcab4c80cdbc98b4625d318c84fcb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/aac_defines: Add missing () to AAC_HALF_SUM() macro
Michael Niedermayer [Sun, 28 May 2017 18:08:49 +0000 (20:08 +0200)]
avcodec/aac_defines: Add missing () to AAC_HALF_SUM() macro

Fixes: runtime error: shift exponent 1073741848 is too large for 32-bit type 'INTFLOAT' (aka 'int')
Fixes: 1880/clusterfuzz-testcase-minimized-4900645322620928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 872bac81590ccbec40ba7ad203421d9e38d1b253)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/webp: Fixes null pointer dereference
Michael Niedermayer [Wed, 10 May 2017 16:37:50 +0000 (18:37 +0200)]
avcodec/webp: Fixes null pointer dereference

Fixes: 1470/clusterfuzz-testcase-minimized-5404421666111488
Fixes: 1472/clusterfuzz-testcase-minimized-5677426430443520
Fixes: 1875/clusterfuzz-testcase-minimized-5536474562822144

Approved-by: BBB
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 67020711b7d45afa073ef671f755765035a64373)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/aacdec_fixed: Fix runtime error: left shift of 1 by 31 places cannot be repre...
Michael Niedermayer [Sun, 28 May 2017 16:09:47 +0000 (18:09 +0200)]
avcodec/aacdec_fixed: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'

Fixes: 1878/clusterfuzz-testcase-minimized-6441918630199296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6b9cb5d26a2d9905093621d12785bc5903dce66d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/ylc: Check count in build_vlc()
Michael Niedermayer [Sun, 28 May 2017 15:20:42 +0000 (17:20 +0200)]
avcodec/ylc: Check count in build_vlc()

Fixes: runtime error: signed integer overflow: 211633430 + 2147483647 cannot be represented in type 'int'
Fixes: 1874/clusterfuzz-testcase-minimized-5037763613163520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 67b30decf7793523f7fdaef6fdf7f1179ef42b18)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/snow: Fix runtime error: signed integer overflow: 1086573993 + 1086573994...
Michael Niedermayer [Sun, 28 May 2017 15:12:35 +0000 (17:12 +0200)]
avcodec/snow: Fix runtime error: signed integer overflow: 1086573993 + 1086573994 cannot be represented in type 'int'

Fixes: 1871/clusterfuzz-testcase-minimized-5719950331215872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b9c032ebc0ad17ac0ffefb915ff96baf9d79cab1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/jpeg2000: Fix runtime error: signed integer overflow: 4185 + 2147483394 canno...
Michael Niedermayer [Sun, 28 May 2017 12:00:30 +0000 (14:00 +0200)]
avcodec/jpeg2000: Fix runtime error: signed integer overflow: 4185 + 2147483394 cannot be represented in type 'int'

Fixes: 1870/clusterfuzz-testcase-minimized-4686788029317120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 781f88bb26534ececc76eaa972f02536ba2f0f55)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/jpeg2000dec: Check tile offsets more completely
Michael Niedermayer [Sun, 28 May 2017 11:52:13 +0000 (13:52 +0200)]
avcodec/jpeg2000dec: Check tile offsets more completely

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9c1812491f7be2730351969f4abd9b99d300d604)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/sheervideo: Check input buffer size before allocating and decoding
Michael Niedermayer [Sun, 28 May 2017 11:30:46 +0000 (13:30 +0200)]
avcodec/sheervideo: Check input buffer size before allocating and decoding

Fixes: Timeout
Fixes: 1858/clusterfuzz-testcase-minimized-6450473802399744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d8030c14bd7ac983b81ebe898631979f6b5aea09)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/aacdec_fixed: Fix multiple runtime error: shift exponent 127 is too large...
Michael Niedermayer [Sun, 28 May 2017 01:34:09 +0000 (03:34 +0200)]
avcodec/aacdec_fixed: Fix multiple runtime error: shift exponent 127 is too large for 32-bit type 'int'

Fixes: 1851/clusterfuzz-testcase-minimized-5692607495667712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6c3a63fc3d1be7ac947e38a165a299c9e5d37764)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/wnv1: More strict buffer size check
Michael Niedermayer [Sun, 28 May 2017 01:18:02 +0000 (03:18 +0200)]
avcodec/wnv1: More strict buffer size check

This requires at least 25% of a picture to allocate and decode it

Fixes: Timeout
Fixes: 1845/clusterfuzz-testcase-minimized-5075974343360512

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7f50c25124a015a539823077bb302ff0c7ce8963)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/libfdk-aacdec: Correct buffer_size parameter
Michael Niedermayer [Thu, 25 May 2017 01:21:50 +0000 (03:21 +0200)]
avcodec/libfdk-aacdec: Correct buffer_size parameter

the timeDataSize argument to aacDecoder_DecodeFrame() seems undocumented and until
2016 04 (203e3f28fbebec7011342017fafc2a0bda0ce530) unused.
after that commit libfdk-aacdec interprets it as size in sample units and memsets that on error.
FFmpeg as well as others (like GStreamer) did interpret it as size in bytes

Fixes: 1442/clusterfuzz-testcase-minimized-4540199973421056 (This requires recent libfdk to reproduce)

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ca6776a993903dbcfef5ae8a18556c40ecf83e1c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/sbrdsp_template: Fix: runtime error: signed integer overflow: 849815297 ...
Michael Niedermayer [Tue, 23 May 2017 19:08:48 +0000 (21:08 +0200)]
avcodec/sbrdsp_template: Fix: runtime error: signed integer overflow: 849815297 + 1315389781 cannot be represented in type 'int'

Fixes: 1770/clusterfuzz-testcase-minimized-5285511235108864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7c36ee216f1e668e2c2af1573bd9dbbb2a501f48)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/ivi_dsp: Fix runtime error: left shift of negative value -2
Michael Niedermayer [Sun, 28 May 2017 01:03:46 +0000 (03:03 +0200)]
avcodec/ivi_dsp: Fix runtime error: left shift of negative value -2

Fixes: 1839/clusterfuzz-testcase-minimized-6238490993885184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 357f2316a08478a4442e8051978c7b161e10281c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agodoc/filters: Clarify scale2ref example
Kevin Mark [Sat, 27 May 2017 14:10:46 +0000 (10:10 -0400)]
doc/filters: Clarify scale2ref example

Signed-off-by: Kevin Mark <kmark937@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 114e8716214d414d7965029ae5fe74668ed69e4a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/mlpdec: Do not leave invalid values in matrix_out_ch[] on error
Michael Niedermayer [Sat, 27 May 2017 11:17:34 +0000 (13:17 +0200)]
avcodec/mlpdec: Do not leave invalid values in matrix_out_ch[] on error

Fixes: runtime error: index 12 out of bounds for type 'uint8_t [8]'
Fixes: 1832/clusterfuzz-testcase-minimized-6574546079449088

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ac8dfcbd89a818b786d05ebc1af70f7bf6aeb86e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/ra144dec: Fix runtime error: left shift of negative value -17
Michael Niedermayer [Sat, 27 May 2017 11:07:00 +0000 (13:07 +0200)]
avcodec/ra144dec: Fix runtime error: left shift of negative value -17

Fixes: 1830/clusterfuzz-testcase-minimized-5828293733384192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 53c0c637d36c1de9ea461a8d863e8703da090894)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/pixlet: Fix runtime error: signed integer overflow: 2147483647 + 32 cannot...
Michael Niedermayer [Sat, 27 May 2017 11:03:36 +0000 (13:03 +0200)]
avcodec/pixlet: Fix runtime error: signed integer overflow: 2147483647 + 32 cannot be represented in type 'int'

Fixes: 1829/clusterfuzz-testcase-minimized-5527165321871360

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 77d98898211eeb0241e8411428b0b364a6231744)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavformat/mux: Fix copy an paste typo
Michael Niedermayer [Fri, 26 May 2017 16:01:31 +0000 (18:01 +0200)]
avformat/mux: Fix copy an paste typo

Found-by: Roger Scott <rscott@grammatech.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1a36354698fc0453ba4d337786d2cb4d3e374cfb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavutil/internal: Do not enable CHECKED with DEBUG
Michael Niedermayer [Fri, 7 Apr 2017 11:49:09 +0000 (13:49 +0200)]
avutil/internal: Do not enable CHECKED with DEBUG

This avoids potential undefined behavior in debug mode while still allowing
developers which want to check for potential additional overflows to do so
by manually enabling this.

Reviewed-by: wm4
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a44b3abb4cf922e379fbac55452d0482a8223597)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/clearvideo: Check buf_size before decoding frame
Michael Niedermayer [Thu, 25 May 2017 23:37:14 +0000 (01:37 +0200)]
avcodec/clearvideo: Check buf_size before decoding frame

Fixes; Timeout
Fixes: 1826/clusterfuzz-testcase-minimized-5728569256837120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 43c394dcaebe9eec5802b420f273385473380909)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/aacdec_fixed: Fix runtime error: signed integer overflow: -2147483648 * ...
Michael Niedermayer [Thu, 25 May 2017 21:01:27 +0000 (23:01 +0200)]
avcodec/aacdec_fixed: Fix runtime error: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'

Fixes: 1825/clusterfuzz-testcase-minimized-6002833050566656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8e87d146d798ca25d8f3a4520a6deb7946b39d73)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/smc: Check remaining input
Michael Niedermayer [Thu, 25 May 2017 18:07:49 +0000 (20:07 +0200)]
avcodec/smc: Check remaining input

Fixes: Timeout
Fixes: 1818/clusterfuzz-testcase-minimized-5039166473633792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 356194fcb17375de2472f4cbff6ede48d6a374b2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/diracdec: Fix off by 1 error in quant check
Michael Niedermayer [Thu, 25 May 2017 14:35:40 +0000 (16:35 +0200)]
avcodec/diracdec: Fix off by 1 error in quant check

Fixes: out of array read
Fixes: 1781/clusterfuzz-testcase-minimized-4617176877105152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b946bd8ef2c7aeee09469a4901182a44f9b67189)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/jpeg2000dec: Fix copy and paste error
Michael Niedermayer [Thu, 25 May 2017 09:11:33 +0000 (11:11 +0200)]
avcodec/jpeg2000dec: Fix copy and paste error

Found-by: jamrial
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5782e0ba8cc30bb08a806cdeda1adfb89a0556b4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/jpeg2000dec: Check tile offsets
Michael Niedermayer [Wed, 24 May 2017 17:40:42 +0000 (19:40 +0200)]
avcodec/jpeg2000dec: Check tile offsets

Fixes: runtime error: signed integer overflow: 4096 - -2147483648 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 89325417e7b33f4b08171d9d609c48662d96b2d3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/sanm: Fix uninitialized reference frames
Max Justicz [Wed, 24 May 2017 13:25:50 +0000 (15:25 +0200)]
avcodec/sanm: Fix uninitialized reference frames

Fixes: poc.snm

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ca616b0f72c65b0ef5f9e1e6125698b15f50a26e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/jpeglsdec: Check get_bits_left() before decoding a picture
Michael Niedermayer [Tue, 23 May 2017 20:18:52 +0000 (22:18 +0200)]
avcodec/jpeglsdec: Check get_bits_left() before decoding a picture

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4bc3008d04451cd31818e21703ed7ed96b6ff074)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/fmvc: Fix use of uninitialized memory when the first frame is not a keyframe
Max Justicz [Tue, 23 May 2017 09:22:35 +0000 (11:22 +0200)]
avcodec/fmvc: Fix use of uninitialized memory when the first frame is not a keyframe

Fixes: fmvc-poc.avi

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3766aa7343c43521c8ad67aaec26e3c91f6d91c7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/ivi_dsp: Fix multiple runtime error: left shift of negative value -71
Michael Niedermayer [Sun, 21 May 2017 23:19:50 +0000 (01:19 +0200)]
avcodec/ivi_dsp: Fix multiple runtime error: left shift of negative value -71

Fixes: 1734/clusterfuzz-testcase-minimized-5385630815092736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8fb00b3e858b7a5aeccfe6bdfc10290c2121c3ec)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/mjpegdec: Fix runtime error: signed integer overflow: -32767 * 130560 cannot...
Michael Niedermayer [Sun, 21 May 2017 19:49:54 +0000 (21:49 +0200)]
avcodec/mjpegdec: Fix runtime error: signed integer overflow: -32767 * 130560 cannot be represented in type 'int'

Fixes: 1724/clusterfuzz-testcase-minimized-4842395432648704

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 40fa6a2fa2c255293a780a194eecae5df52644a1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/aacdec_fixed: Fix runtime error: shift exponent 34 is too large for 32-bit...
Michael Niedermayer [Sun, 21 May 2017 14:53:55 +0000 (16:53 +0200)]
avcodec/aacdec_fixed: Fix runtime error: shift exponent 34 is too large for 32-bit type 'int'

Fixes: 1721/clusterfuzz-testcase-minimized-4719352135811072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b5228e44c7f3a5eba537c8a39a45cfbf2961a28d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/mpeg4videodec: Check for multiple VOL headers
Michael Niedermayer [Sun, 21 May 2017 14:01:27 +0000 (16:01 +0200)]
avcodec/mpeg4videodec: Check for multiple VOL headers

Fixes multiple: runtime error: signed integer overflow: 2147115008 + 413696 cannot be represented in type 'int'
Fixes: 1723/clusterfuzz-testcase-minimized-5309409372667904
Fixes: 1727/clusterfuzz-testcase-minimized-5900685306494976
Fixes: 1737/clusterfuzz-testcase-minimized-5922321338466304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit efeb47fd5d5cbf980e52a6d5e741c3c74b94b5e2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/vp9block: fix runtime error: signed integer overflow: 196675 * 20670 cannot...
Michael Niedermayer [Sun, 21 May 2017 00:12:21 +0000 (02:12 +0200)]
avcodec/vp9block: fix runtime error: signed integer overflow: 196675 * 20670 cannot be represented in type 'int'

Fixes: 1710/clusterfuzz-testcase-minimized-4837032931098624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d4ee76780869c659a5d3b0815c56024ab260a81d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/vmnc: Check location before use
Michael Niedermayer [Sun, 21 May 2017 11:22:16 +0000 (13:22 +0200)]
avcodec/vmnc: Check location before use

Fixes: runtime error: signed integer overflow: 65535 * 64256 cannot be represented in type 'int'
Fixes: 1717/clusterfuzz-testcase-minimized-5491696676634624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ec2b76aab44f55be22eb12d86eb0dfd2eff68581)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/takdec: Fix runtime error: signed integer overflow: 8192 * 524308 cannot...
Michael Niedermayer [Tue, 16 May 2017 22:07:02 +0000 (00:07 +0200)]
avcodec/takdec: Fix runtime error: signed integer overflow: 8192 * 524308 cannot be represented in type 'int'

Fixes: 1630/clusterfuzz-testcase-minimized-6326111917047808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 955db411929a9876d3cd016fbbb9c49b6362feba)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/aac_defines: Fix: runtime error: left shift of negative value -2
Michael Niedermayer [Sun, 21 May 2017 00:51:04 +0000 (02:51 +0200)]
avcodec/aac_defines: Fix: runtime error: left shift of negative value -2

Fixes: 1716/clusterfuzz-testcase-minimized-4691012196761600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c3547dcbc326474745f02a618e01848a293f3f92)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/takdec: Fix runtime error: left shift of negative value -63
Michael Niedermayer [Sun, 21 May 2017 00:46:55 +0000 (02:46 +0200)]
avcodec/takdec: Fix runtime error: left shift of negative value -63

Fixes: 1713/clusterfuzz-testcase-minimized-5791887476654080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d66193252b4067144f11211f8f3e1d5a50146235)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/mlpdsp: Fix runtime error: signed integer overflow: -24419392 * 128 cannot...
Michael Niedermayer [Sun, 21 May 2017 00:42:12 +0000 (02:42 +0200)]
avcodec/mlpdsp: Fix runtime error: signed integer overflow: -24419392 * 128 cannot be represented in type 'int'

Fixes: 1711/clusterfuzz-testcase-minimized-5248503515185152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1d04fc94e1021b70e542dc01a48b8398c6fc6325)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/sbrdsp_fixed: fix runtime error: left shift of 1 by 31 places cannot be repre...
Michael Niedermayer [Sat, 20 May 2017 23:43:04 +0000 (01:43 +0200)]
avcodec/sbrdsp_fixed: fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int'

Fixes: part of 1709/clusterfuzz-testcase-minimized-4513580554649600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 384508b2ff69bc3fad1e1c2e7de0dcd0913c6208)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/aacsbr_fixed: Fix multiple runtime error: shift exponent 170 is too large...
Michael Niedermayer [Sat, 20 May 2017 22:06:10 +0000 (00:06 +0200)]
avcodec/aacsbr_fixed: Fix multiple runtime error: shift exponent 170 is too large for 32-bit type 'int'

Fixes part of 1709/clusterfuzz-testcase-minimized-4513580554649600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6310fc714de3cd73848416ead73228fcef8b6dc0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/mlpdec: Do not leave a invalid num_primitive_matrices in the context
Michael Niedermayer [Fri, 19 May 2017 23:23:01 +0000 (01:23 +0200)]
avcodec/mlpdec: Do not leave a invalid num_primitive_matrices in the context

Fixes: runtime error: index 8 out of bounds for type 'uint8_t [8]'
Fixes: 1699/clusterfuzz-testcase-minimized-6327177438035968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 64ea4d102a070b95832ae4a751688f87da7760a2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/aacsbr_fixed: Fix multiple runtime error: shift exponent 150 is too large...
Michael Niedermayer [Fri, 19 May 2017 10:25:52 +0000 (12:25 +0200)]
avcodec/aacsbr_fixed: Fix multiple runtime error: shift exponent 150 is too large for 32-bit type 'int'

Fixes: 1681/clusterfuzz-testcase-minimized-5970545365483520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3fb104f4476ad238e2ca768e9b80dc314e6e856d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/mimic: Use ff_set_dimensions() to set the dimensions
Michael Niedermayer [Thu, 18 May 2017 15:46:56 +0000 (17:46 +0200)]
avcodec/mimic: Use ff_set_dimensions() to set the dimensions

Fixes: OOM
Fixes: 1671/clusterfuzz-testcase-minimized-4759078033162240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e434840fd4b3c854beec845f950b80bc1bf93b60)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/fic: Fix multiple runtime error: signed integer overflow: 5793 * 419752 canno...
Michael Niedermayer [Thu, 18 May 2017 15:13:18 +0000 (17:13 +0200)]
avcodec/fic: Fix multiple runtime error: signed integer overflow: 5793 * 419752 cannot be represented in type 'int'

Fixes: 1669/clusterfuzz-testcase-minimized-5287529198649344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a173f484b52ed63292439de5347e49bd78cad0ed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/pixlet: Fix reading invalid numbers of bits
Michael Niedermayer [Thu, 18 May 2017 14:51:08 +0000 (16:51 +0200)]
avcodec/pixlet: Fix reading invalid numbers of bits

Fixes: asertion failure
Fixes: 1664/clusterfuzz-testcase-minimized-6587801187385344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d32ebce8fd79bb859ba4a04c92470a052f2aafa6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/mlpdec: Fix: runtime error: left shift of negative value -8
Michael Niedermayer [Thu, 18 May 2017 00:07:17 +0000 (02:07 +0200)]
avcodec/mlpdec: Fix: runtime error: left shift of negative value -8

Fixes: 1658/clusterfuzz-testcase-minimized-4889937130291200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 25c81e4b737bcc737b13c9a752cb301a28cb3906)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/dfa: Fix: runtime error: signed integer overflow: -14202 * 196877 cannot...
Michael Niedermayer [Wed, 17 May 2017 23:54:43 +0000 (01:54 +0200)]
avcodec/dfa: Fix: runtime error: signed integer overflow: -14202 * 196877 cannot be represented in type 'int'

Fixes: 1657/clusterfuzz-testcase-minimized-4710000079405056

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 58ac7fb9c395ab91cb321fa4c8c9e127ce8147c3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/aacdec: Fix runtime error: signed integer overflow: 2147483520 + 255 cannot...
Michael Niedermayer [Wed, 17 May 2017 14:45:46 +0000 (16:45 +0200)]
avcodec/aacdec: Fix runtime error: signed integer overflow: 2147483520 + 255 cannot be represented in type 'int'

Fixes: 1656/clusterfuzz-testcase-minimized-5900404925661184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 94d05ff15985d17aba070eaec82acd21c0da3d86)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/aacdec_template: Fix fixed point scale in decode_cce()
Michael Niedermayer [Wed, 17 May 2017 13:51:46 +0000 (15:51 +0200)]
avcodec/aacdec_template: Fix fixed point scale in decode_cce()

Fixes: runtime error: shift exponent 1073741824 is too large for 32-bit type 'int'
Fixes: 1654/clusterfuzz-testcase-minimized-5151903795118080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 53a502206a9ea698926694d7252526fe00d1ea44)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/fmvc: Fix off by 1 error
Michael Niedermayer [Wed, 17 May 2017 00:17:13 +0000 (02:17 +0200)]
avcodec/fmvc: Fix off by 1 error

Fixes: out of array access
Fixes: 1643/clusterfuzz-testcase-minimized-6117573403869184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e11dcc35bb4dbacd87378465b4cafa6a604e8b87)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/flicvideo: Check frame_size before decrementing
Michael Niedermayer [Tue, 16 May 2017 23:12:55 +0000 (01:12 +0200)]
avcodec/flicvideo: Check frame_size before decrementing

Fixes: runtime error: signed integer overflow: -2147483627 - 22 cannot be represented in type 'int'
Fixes: 1637/clusterfuzz-testcase-minimized-5376582493405184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 355e27e24dc88d6ba8f27501a34925d9d937a399)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/mlpdec: Fix runtime error: left shift of negative value -1
Michael Niedermayer [Tue, 16 May 2017 22:53:32 +0000 (00:53 +0200)]
avcodec/mlpdec: Fix runtime error: left shift of negative value -1

Fixes: 1636/clusterfuzz-testcase-minimized-5310494757879808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 552adf1dd3a38fb7a1a6109dd2b517d63290f20e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/takdec: Fix runtime error: left shift of negative value -42
Michael Niedermayer [Tue, 16 May 2017 22:44:36 +0000 (00:44 +0200)]
avcodec/takdec: Fix  runtime error: left shift of negative value -42

Fixes: 1635/clusterfuzz-testcase-minimized-4992749856096256

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 99c4c76cfbc4ae56dc8c37f5fab02f88f6b2cb48)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/hq_hqa: Fix: runtime error: signed integer overflow: -255 * 10180917 cannot...
Michael Niedermayer [Tue, 16 May 2017 21:44:24 +0000 (23:44 +0200)]
avcodec/hq_hqa: Fix: runtime error: signed integer overflow: -255 * 10180917 cannot be represented in type 'int'

Fixes: 1626/clusterfuzz-testcase-minimized-6416580571299840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3d9cb583c8f005a260d255853ef5f1c21e8599a0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/scpr: mask bits to prevent out of array read
Michael Niedermayer [Tue, 16 May 2017 00:22:37 +0000 (02:22 +0200)]
avcodec/scpr: mask bits to prevent out of array read

Fixes: 1615/clusterfuzz-testcase-minimized-6625214647500800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5666b95c9f27efa6f9b1e1bb6c592b9a8d78bca5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/truemotion1: Fix multiple runtime error: signed integer overflow: 1246906962...
Michael Niedermayer [Tue, 16 May 2017 01:04:26 +0000 (03:04 +0200)]
avcodec/truemotion1: Fix multiple runtime error: signed integer overflow: 1246906962 * 2 cannot be represented in type 'int'

Fixes: 1616/clusterfuzz-testcase-minimized-5119196578971648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5ea6bc2a166edac37042f2bbc28eb603a0fbeccb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/svq3: Fix runtime error: left shift of negative value -6
Michael Niedermayer [Mon, 15 May 2017 19:21:20 +0000 (21:21 +0200)]
avcodec/svq3: Fix runtime error: left shift of negative value -6

Fixes: 1604/clusterfuzz-testcase-minimized-5312060206350336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a6eb006ad47beb6d5e5cc2c99f8185965209ec6b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoavcodec/tiff: reset sampling[] if its invalid
Michael Niedermayer [Mon, 15 May 2017 19:19:06 +0000 (21:19 +0200)]
avcodec/tiff: reset sampling[] if its invalid

Fixes divission by 0
Fixes: clusterfuzz-testcase-minimized-5592896440893440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f08122fbe039a56ab3c24f74636b4b0efea97d85)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoconfigure: Fix the msvcrt version check for mingw32
Martin Storsjö [Wed, 31 May 2017 09:53:32 +0000 (12:53 +0300)]
configure: Fix the msvcrt version check for mingw32

This was actually broken when committed in 46e3936fb04; the
test never succeeded, and thus, _aligned_malloc wasn't actually
used on legacy mingw.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 427f7a1f9ec1977bcb57cb4d6e6f7228dc1e858b)

2 years agolavf/mov: make invalid m{d,v}hd time_scale default to 1 instead of erroring out
Matthieu Bouron [Thu, 11 May 2017 13:16:22 +0000 (15:16 +0200)]
lavf/mov: make invalid m{d,v}hd time_scale default to 1 instead of erroring out

Some samples have their metadata track time_scale incorrectly set to 0
and the check introduced by a398f054fdb9b0f0b5a91c231fba6ce014143f71
prevents playback of those samples. Setting the time_scale to 1 fixes
playback.

2 years agolavc/ffjni: add missing '\n'
Matthieu Bouron [Sun, 21 May 2017 15:44:12 +0000 (17:44 +0200)]
lavc/ffjni: add missing '\n'

2 years agolavc/mediacodec_wrapper: do not declare JNIAMedia{Codec,CodecList,Format}Fields on...
Matthieu Bouron [Sun, 21 May 2017 15:48:05 +0000 (17:48 +0200)]
lavc/mediacodec_wrapper: do not declare JNIAMedia{Codec,CodecList,Format}Fields on the stack