github-mirrors/FFmpeg
1
0
Fork 0
mirror of https://mirror.skon.top/https://github.com/FFmpeg/FFmpeg synced 2026-04-25 19:33:46 +08:00
Code Issues Packages Projects Releases Wiki Activity
102,226 Commits 39 Branches 417 Tags
3392936e8294de1fc312c19a285702db33360be9
Commit Graph

44946 Commits

Author SHA1 Message Date
Michael Niedermayer
3392936e82 avcodec/escape124: fix signdness of end of input check 
Fixes: Timeout
Fixes: 56561/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ESCAPE124_fuzzer-5560363635834880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 87ad0a5dd7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:46 +02:00
Paul B Mahol
ad28b01a14 avcodec/rpzaenc: stop accessing out of bounds frame 
(cherry picked from commit 92f9b28ed8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:46 +02:00
Michael Niedermayer
fa20129765 avcodec/motionpixels: Mask pixels to valid values 
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOTIONPIXELS_fuzzer-6724203352555520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ac6eec1fc2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:45 +02:00
Michael Niedermayer
0f6580b169 avcodec/xpmdec: Check size before allocation to avoid truncation 
Fixes:OOM
Fixes:out of array access (no testcase)
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XPM_fuzzer-6573323838685184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 95f0f84dae)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:45 +02:00
Michael Niedermayer
4c34976fea avcodec/bink: Avoid undefined out of array end pointers in binkb_decode_plane() 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ea9deafd3b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:45 +02:00
Michael Niedermayer
8b84cffb30 avcodec/bink: Fix off by 1 error in ref end 
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6657932926517248

Alterantivly to this it is possibly to allocate a bigger array

Note: oss-fuzz assigned this issue to a unrelated theora bug so the bug number matches that

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 49487045dd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:44 +02:00
Michael Niedermayer
bc9e149c2a avcodec/utils: Ensure linesize for SVQ3 
Fixes: Assertion block_w * sizeof(uint8_t) <= ((buf_linesize) >= 0 ? (buf_linesize) : (-(buf_linesize))
Fixes: 54861/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-5352418248622080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4eef658ca5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:44 +02:00
Michael Niedermayer
0c5f3c230a avcodec/utils: allocate a line more for VC1 and WMV3 
Fixes: out of array read on 32bit
Fixes: 54857/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5840588224462848

The chroma MC code reads over the currently allocated frame.
Alternative fixes would be allocating a few bytes more at the end instead of a whole
line extra or to adjust the threshold where the edge emu code is activated

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 01636a63d4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:44 +02:00
Michael Niedermayer
545cfeeebd avcodec/videodsp_template: Adjust pointers to avoid undefined pointer things 
Fixes: subtraction of unsigned offset from 0xf6602770 overflowed to 0xf6638c80
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THEORA_fuzzer-495074400600064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f0150cd41c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:43 +02:00
Michael Niedermayer
3eaf65305e avcodec/pngdec: Check deloco index more exactly 
Fixes: out of array access:
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PNG_fuzzer-6716193709096960

Alternatively it should be possible to limit this to 3 plane RGB 8 /16bit to ensure the size is what it should be

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d5bae70406)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:43 +02:00
Michael Niedermayer
73eb9578c1 avcodec/ffv1dec: Check that num h/v slices is supported 
Fixes: out of array access
Fixes: 55597/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-4898293416329216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8ead0ae68e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:43 +02:00
Michael Niedermayer
773d1b857b avcodec/pictordec: Remove mid exit branch 
This causes the RLE decoder to exit before applying the last RLE run
All images i tested with are unchanged, this makes the special case
for handling the last run unused for non truncated images.

Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 88f0e05c72)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:42 +02:00
Michael Niedermayer
261ff2e208 avcodec/eac3dec: avoid float noise in fixed mode addition to overflow 
Fixes: 2.28595e+09 is outside the range of representable values of type 'int'
Fixes: 54644/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AC3_FIXED_fuzzer-4816961584627712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2f48d227c1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:42 +02:00
Michael Niedermayer
8478879af6 avcodec/utils: use 32pixel alignment for bink 
bink supports 16x16 blocks in chroma planes thus we need to allocate enough.
Fixes: out of array access
Fixes: 55026/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6013915371012096
Reviewed-by: Peter Ross <pross@xvid.org>

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b95b2c8492)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:41 +02:00
Michael Niedermayer
e243076b32 avcodec/scpr3: Check bx 
Fixes: Out of array access
Fixes: 55102/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-4877396618903552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cc7e984a05)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:41 +02:00
Michael Niedermayer
e5a88d62b6 avcodec/012v: Order operations for odd size handling 
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZERO12V_fuzzer-6714182078955520.fuzz
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZERO12V_fuzzer-6698145212137472.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4d42d82563)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:41 +02:00
Michael Niedermayer
2ae1a70cd5 avcodec/eatgq: : Check index increments in tgq_decode_block() 
Fixes: out of array access
Fixes: 48567/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EATGQ_fuzzer-6743211456724992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e7755b433e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:40 +02:00
Michael Niedermayer
68da8e9703 avcodec/scpr: Test bx before use 
Fixes: out of array access on 32bit
Fixes: 54850/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-5302669294305280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b59de3770)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:40 +02:00
Michael Niedermayer
9f828f147b avcodec/sunrast: Fix maplength check 
Fixes: out of bounds read

Found-by: Ibrahim Mohamed <ielsayed@meta.com>
Reviewed-by; Ibrahim Mohamed <ielsayed@meta.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f8a2a65078)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:39 +02:00
Michael Niedermayer
fdff97fe47 avcodec/wavpack: Avoid undefined shift in get_tail() 
Fixes: left shift of 1208485947 by 1 places cannot be represented in type 'int'
Fixes: 54058/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5827521084260352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8374a747af)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:39 +02:00
Michael Niedermayer
79afac279b avcodec/wavpack: Check for end of input in wv_unpack_dsd_high() 
Fixes: Timeout
Fixes: 50793/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-4980185027444736

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6ad7403bce)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:39 +02:00
Michael Niedermayer
7436138621 avcodec/tiff: Ignore tile_count 
Fixes: out of array access
Fixes: 52427/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4849108968144896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 65ce417828)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:38 +02:00
Michael Niedermayer
b314170e2b avcodec/ffv1dec: restructure slice coordinate reading a bit 
Fixes: signed integer overflow: -1094995528 * 8224 cannot be represented in type 'int'
Fixes: 53508/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-474551033462784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 74b6ac7ebb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:38 +02:00
Michael Niedermayer
3f4ec2d6af avcodec/mlpdec: Check max matrix instead of max channel in noise check 
This is a regression since: adaa06581c
Before this, max_channel and  max_matrix_channel where compared for equality

Fixes: out of array access
Fixes: 53340/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-514959011885875

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aa79560de5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:37 +02:00
Michael Niedermayer
383a51855a avcodec/alsdec: The minimal block is at least 7 bits 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5280947fb6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:37 +02:00
Michael Niedermayer
2177cc8eb8 avcodec/speedhq: Check buf_size to be big enough for DC 
Fixes: Timeout
Fixes: 51919/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-6023716480090112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9184d3d7b6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:36 +02:00
Michael Niedermayer
a16aaae628 avcodec/ffv1dec: Fail earlier if prior context is corrupted 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4df91e2215)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2023-04-07 23:40:35 +02:00
Kyle Manning
3f28c576e0 avcodec/nvenc: fix b-frame DTS behavior with fractional framerates 
When using fractional framerates (or any fraction with a numerator != 1),
DTS values for packets would be calculated incorrectly.

Signed-off-by: Kyle Manning <tt2468@irltoolkit.com>
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org>
 2023-04-03 12:11:04 +02:00
Timo Rothenpieler
b48951bd29 avcodec/nvenc: fix vbv buffer size in cq mode 
The CQ calculation gets thrown off and behaves very nonsensical
if it isn't set to 0.
 2022-12-08 12:39:46 +01:00
James Almer
a54187b7d9 avcodec/mjpegenc: take into account component count when writing the SOF header size 
Fixes ticket #10069

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 1009396953)
 2022-11-28 08:45:40 -03:00
Michael Niedermayer
ec47a3b95f avcodec/dstdec: Check for overflow in build_filter() 
Fixes: signed integer overflow: 1917019860 + 265558963 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-4833165046317056

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8008940da5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-25 13:52:03 +02:00
Michael Niedermayer
c2c9dac463 avcodec/mjpegdec: Check for unsupported bayer case 
Fixes: out of array access
Fixes: 51462/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-662559341582745

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dd81cc22b3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-25 13:51:57 +02:00
Michael Niedermayer
5f0afb748e avcodec/apedec: Fix integer overflow in filter_3800() 
Fixes: signed integer overflow: -2147448926 + -198321 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5739619273015296
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6744428485672960

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f05247f6a4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-25 13:51:57 +02:00
Michael Niedermayer
ed496ac4f5 avcodec/tta: Check 24bit scaling for overflow 
Fixes: signed integer overflow: -8427924 * 256 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5409428670644224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3993345f91)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-25 13:51:56 +02:00
Michael Niedermayer
bd7c92f484 avcodec/mobiclip: Check quantizer for overflow 
Fixes: signed integer overflow: 127 + 2147483536 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-6014034970804224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 677e27a9af)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-25 13:51:56 +02:00
Michael Niedermayer
446de009f9 avcodec/exr: Check preview psize 
Fixes: signed integer overflow: 17121181824 * 538976288 cannot be represented in type 'long long'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5915330316206080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ac26712e35)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-25 13:51:56 +02:00
Michael Niedermayer
9a814adf89 avcodec/tiff: Fix loop detection 
Fixes regression with tickets/4364/L1004220.DNG

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 43a4854510)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-25 13:51:55 +02:00
Michael Niedermayer
12043b8a6b avcodec/fmvc: Move frame allocation to a later stage 
This way more things are checked before allocation

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9783749c66)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-25 13:51:55 +02:00
Michael Niedermayer
c7f723ddb6 avcodec/speedhq: Check width 
Fixes: out of array access
Fixes: 50014/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-4748914632294400

Alternatively the buffer size can be increased

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f0395f9ef6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-25 13:51:54 +02:00
Michael Niedermayer
85f5aaa15f avcodec/bink: disallow odd positioned scaled blocks 
Fixes: out of array access
Fixes: 47911/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6194020855971840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b14104a637)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-25 13:51:54 +02:00
Michael Niedermayer
399670d668 libavcodec/8bps: Check that line lengths fit within the buffer 
Fixes: Timeout
Fixes: undefined pointer arithmetic
Fixes: 50330/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EIGHTBPS_fuzzer-5436287485607936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2316d5ec1a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-25 13:51:53 +02:00
Michael Niedermayer
7e2559982f avcodec/midivid: Perform lzss_uncompress() before ff_reget_buffer() 
This would avoid regeting the frame on lzss errors

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 628fb97efb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-25 13:51:52 +02:00
Michael Niedermayer
eb252776d8 avcodec/h263dec: Sanity check against minimal I/P frame size 
Fixes: Timeout
Fixes: 49718/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4874987894341632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ca4ff9c21c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-25 13:51:51 +02:00
Michael Niedermayer
5b9b498e1b avcodec/hevcdec: Check s->ref in the md5 path similar to hwaccel 
This is somewhat redundant with the is_decoded check. Maybe
there is a nicer solution

Fixes: Null pointer dereference
Fixes: 49584/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5297367351427072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3b51e19922)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-25 13:51:51 +02:00
Michael Niedermayer
8b644b85f4 avcodec/mpegaudiodec_template: use unsigned shift in handle_crc() 
Fixes: left shift of 192 by 24 places cannot be represented in type 'int'
Fixes: 49577/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MP1FLOAT_fuzzer-5205996678545408

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7086491fa0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-25 13:51:51 +02:00
Michael Niedermayer
0035e034c0 avcodec/mjpegdec: bayer and rct are incompatible 
Fixes: out of array read
Fixes: 49434/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5208501080686592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a44f5a5212)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-25 13:51:50 +02:00
Michael Niedermayer
1882734fe1 avcodec/hevc_filter: copy_CTB() only within width&height 
Fixes: out of array access
Fixes: 49271/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5424984922652672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 009ef35d38)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-25 13:51:49 +02:00
Michael Niedermayer
cd76f3ed59 avcodec/tiff: Check tile_length and tile_width 
Fixes: Division by 0
Fixes: 49235/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5495613847896064

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 76112c2b41)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-25 13:51:49 +02:00
Michael Niedermayer
ff6d408ac0 avcodec/mss4: Check image size with av_image_check_size2() 
Fixes: Timeout
Fixes: 48418/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MTS2_fuzzer-4834851466903552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4e145f1dcd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-25 13:51:49 +02:00
Michael Niedermayer
f18d625883 avcodec/exr: Check x/ysize 
Fixes: OOM
Fixes: 48911/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6352002510094336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 614a4d1476)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2022-09-25 13:51:47 +02:00