github-mirrors/FFmpeg
1
0
Fork 0
mirror of https://mirror.skon.top/https://github.com/FFmpeg/FFmpeg synced 2026-04-23 18:35:18 +08:00
Code Issues Packages Projects Releases Wiki Activity
101,934 Commits 39 Branches 417 Tags
620fa723b8f797aabae67419ddc49b3577a00a64
Commit Graph

44806 Commits

Author SHA1 Message Date
Michael Niedermayer
b3e21be8e1 avcodec/jpeg2000dec: Check that atom header is within bytsetream 
Fixes: Infinite loop
Fixes: 36666/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5912760671141888

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3c659f8618)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
7d58def70a avcodec/apedec: Fix 2 integer overflows in filter_3800() 
Fixes: signed integer overflow: 1683879955 - -466265224 cannot be represented in type 'int'
Fixes: 37419/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6074294407921664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 33feb527ff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
baefa5385e avcodec/xpmdec: Move allocations down after more error checks 
Fixes: Timeout
Fixes: 37035/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XPM_fuzzer-5142718576721920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e58692837c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
34aad02457 avcodec/argo: Move U, fix shift 
Fixes: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 37249/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ARGO_fuzzer-5754862984888320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 26659fe53e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
fa4ac6b43a avcodec/mjpegbdec: Skip SOS on AVDISCARD_ALL as does mjpeg 
Fixes: NULL pointer dereference
Fixes: 36342/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEGB_fuzzer-4579188072906752
Fixes: 36344/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEGB_fuzzer-5049579300061184
Fixes: 36345/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEGB_fuzzer-5301149845553152
Fixes: 36374/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEGB_fuzzer-6056312352931840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 104a8399ae)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
af8de920b7 avcodec/mjpegdec: Check for bits left in mjpeg_decode_scan_progressive_ac() 
Fixes: Timeout
Fixes: 36262/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-4969052454912000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 909faca929)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
671e182cc4 avcodec/webp: Check available space in loop in decode_entropy_coded_image() 
Fixes: Timeout
Fixes: 35401/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WEBP_fuzzer-5714401821851648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5e00eab611)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
fa6d6cc810 avcodec/h264dec: use picture parameters in ff_print_debug_info2() 
Fixes: out of array read
Fixes: 36341/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-6737583085322240

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 65892516d5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
82fe7775a8 avcodec/vc1dec: ff_print_debug_info() does not support WMV3 field_mode 
Fixes: out of array read
Fixes: 36331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-5140494328922112.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c59b5e3d1e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
4254dbe20f avcodec/frame_thread_encoder: Free AVCodecContext structure on error during init 
Fixes: MemLeak
Fixes: 8281
Fixes: PoC_option158.jpg
Fixes: CVE-2020-22037

Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7bba0dd638)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
f6f682f5aa avcodec/faxcompr: Check for end of input in cmode == 1 in decode_group3_2d_line() 
Fixes: Infinite loop
Fixes: 35591/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4503764022198272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f803635c4f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
674adf0a02 avcodec/vc1dec: Disable error concealment for *IMAGE 
The existing error concealment makes no sense for the image formats, they
use transformed source images which is different from keyframe + MC+difference
for which the error concealment is designed.
Of course feel free to re-enable this if you have a case where it works and
improves vissual results

Fixes: Timeout
Fixes: 36234/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-6300306743885824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 643b2d49bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
f25834ab07 avcodec/sbrdsp_fixed: Fix negation overflow in sbr_neg_odd_64_c() 
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 35593/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5182217725804544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8f2856a1da)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
725a0446b4 avcodec/argo: Check for even dimensions 
Fixes: reading over the end
Fixes: 36346/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ARGO_fuzzer-5366943107383296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c2f5e9ff3c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
fbf576417a avcodec/exr: Check ac_count 
Fixes: signed integer overflow: -9223372036854775808 * 2 cannot be represented in type 'long long'
Fixes: 36244/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6090656186499072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9bc32d7c4b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
3a67e33368 avcodec/aaccoder: Add minimal bias in search_for_ms() 
Fixes: floating point division by 0
Fixes: Ticket8218

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 75a099fc73)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
maryam ebr
46bbf194c4 avcodec/dnxhddec: check and propagate function return value 
Similar to CVE-2013-0868, here return value check for 'init_vlc' is needed.
crafted DNxHD data can cause unspecified impact.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 7150f95756)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
6a5d7fd8ad avcodec/aacdec_template: Avoid some invalid values to be set by decode_audio_specific_config_gb() 
Fixes: NULL pointer dereference
Fixes: decode_spectrum_and_dequant.mp4

Found-by: Rafael Dutra <rafael.dutra@cispa.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eaec4df63f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
1196932f1c avcodec/lpc: check for zero err in normalization in compute_lpc_coefs() 
Fixes: floating point division by 0
Fixes: Ticket8213

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 70874e024a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
09f47af747 avcodec/j2kenc: Check for av_strtok() failure 
Fixes: CID1466601 Dereference null return value

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6a6a765fa4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
8f0d442434 avcodec/cpia: Fix missing src_size update 
Fixes: out of array read
Fixes: 35210/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CPIA_fuzzer-5669199688105984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cea05864e6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
7b5308045e avcodec/exr: Better size checks 
Fixes: signed integer overflow: 3530839700044513368 + 8386093932303352321 cannot be represented in type 'long long'
Fixes: 35182/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5398383270428672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 18b0dd0738)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
bb1d2cf898 avcodec/clearvideo: Check tile_size to be not too large 
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 35023/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CLEARVIDEO_fuzzer-6740166587842560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 11fac9613e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
417bc2a5b0 avcodec/utils: Use 64bit for intermediate in AV_CODEC_ID_ADPCM_THP* duration calculation 
Fixes: signed integer overflow: 486539264 * 14 cannot be represented in type 'int'
Fixes: 35281/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-6068262742917120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 00ae9b77ef)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
b49039b23e avcodec/hevc_sei: Use get_bits_long() for time_offset_value 
Fixes: assertion failure
Fixes: crash_1

Found-by: Thuan Pham <tpham.unimelb@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d866787dac)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
Michael Niedermayer
b01534293e avcodec/iff: Only write palette to plane 1 if its PAL8 
Fixes: null pointer passed as argument 1, which is declared to never be null
Fixes: 33791/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5107575256383488.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 216eb60b85)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-09-08 21:31:50 +02:00
James Almer
bf87bdd3f6 avcodec/h264_slice: clear old slice POC values on parsing failure 
If a slice header fails to parse, and the next one uses different Sequence and
Picture parameter sets, certain values may not be read if they are not coded,
resulting in the previous slice values being used.

Signed-off-by: James Almer <jamrial@gmail.com>
 2021-08-10 15:22:12 -03:00
James Almer
3f06be77ac avcodec/crystalhd: signal that the decoder sets all output frame properties 
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit ec8e95296e)
 2021-06-23 11:24:56 -03:00
James Almer
6136f1398a avcodec/cuviddec: signal that the decoder sets all output frame properties 
Fixes memleaks described in ticket #9082.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 6b4805686c)
 2021-06-23 11:24:53 -03:00
James Almer
4a953e5c81 avcodec/decode: reindent after the previous commit 
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit b4c2ff3e41)
 2021-06-23 11:21:09 -03:00
James Almer
28e803d637 avcodec/decode: add an internal codec flag to signal a decoder sets all output frame properties 
Decoders like cuviddec ignore and overwrite all the properties set by the generic
code as derived from AVCodecInternal.last_pkt_props. This flag ensures libavcodec
will not store and potentially queue input packets that ultimately will not be used.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 7b9610ebd8)
 2021-06-23 11:17:06 -03:00
James Almer
7015704640 avcodec/decode: fetch packets from the pkt_props FIFO on every frame returned 
Fixes memleaks on decoders that don't call ff_decode_frame_props(), like
libdav1d.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit a4fb03563a)
 2021-06-21 16:31:26 -03:00
Michael Niedermayer
29d3e924a6 avcodec/faxcompr: Check available bits in decode_uncompressed() 
Fixes: Timeout
Fixes: 34950/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5686764151898112
Fixes: 34966/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4587409334468608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ff56c139e0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-06-18 20:53:56 +02:00
Michael Niedermayer
d91f3644ce avcodec/faxcompr: Check if bits are available before reading in cmode == 9 || cmode == 10 
Fixes: Timeout
Fixes: 34950/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5686764151898112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7d8421e3d5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-06-18 20:53:56 +02:00
Michael Niedermayer
a21c64199c avcodec/utils: do "calc from frame_bytes, channels, and block_align" in 64bit 
Fixes: signed integer overflow: 104962766 * 32 cannot be represented in type 'int'
Fixes: 33614/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-6252129036664832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3447979d08)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-06-18 20:53:56 +02:00
Michael Niedermayer
93ef174211 avcodec/ttadata: Add sentinel at the end of ff_tta_shift_1 
Fixes: out of array access
Fixes: 34933/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5629322560929792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dbbcfbcc4e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-06-18 20:53:56 +02:00
Michael Niedermayer
f91056a25a avcodec/dpx: fix off by 1 in bits_per_color check 
Fixes: CID1476303 Bad bit shift operation
Fixes: 34871/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DPX_fuzzer-6331163028357120

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ca9025f374)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-06-18 20:53:56 +02:00
Michael Niedermayer
350bedf7e2 avcodec/vc2enc: Check for non negative slice bounds 
Fixes: invalid shifts
Fixes: Ticket 8221

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f7862e8268)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-06-18 20:53:56 +02:00
Michael Niedermayer
78b71acab7 avcodec/mpegvideo_enc: Reset stuffing bits if they are not supported 
Fixes: Assertion failure
Fixes: Ticket8202

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 996797f8ed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-06-18 20:53:56 +02:00
Michael Niedermayer
478c5d838b avcodec/svq1enc: Do not print debug RD value before it has been computed 
Avoids floating point division by 0

Fixes: Ticket8191

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c297f7e57a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-06-18 20:53:56 +02:00
Michael Niedermayer
159403fc9f avcodec/aacpsy: Check bandwidth 
Fixes: Ticket8011

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 36dead4bc2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-06-18 20:53:56 +02:00
Michael Niedermayer
27727d56bf avcodec/aacenc: Do not divide by lambda_count if it is 0 
Avoids Floating point division by 0

Fixes: Ticket8011

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c520b98691)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-06-18 20:53:56 +02:00
Michael Niedermayer
2b70d3941f avcodec/aacenc: Use FLT_EPSILON for lambda minimum 
(cherry picked from commit 4b89cf7aa4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-06-18 20:53:56 +02:00
Michael Niedermayer
7fbea837fd avcodec/lpc: Avoid floating point division by 0 
Fixes: Ticket7996
Fixes: CVE-2020-20445

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 38d18fb578)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-06-18 20:53:56 +02:00
Michael Niedermayer
5828700d5c avcodec/aacpsy: Avoid floating point division by 0 of norm_fac 
Fixes: Ticket7995
Fixes: CVE-2020-20446

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 223b5e8ac9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-06-18 20:53:56 +02:00
Michael Niedermayer
05cca35df9 avcodec/aacenc: Avoid 0 lambda 
Fixes: Ticket8003
Fixes: CVE-2020-20453

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a7a7f32c8a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-06-18 20:53:56 +02:00
Michael Niedermayer
43bdf562c3 avcodec/exr: More strictly check dc_count 
Fixes: out of array access
Fixes: exr/deneme

Found-by: Burak Çarıkçı <burakcarikci@crypttech.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 26d3c81bc5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-06-18 20:53:56 +02:00
Michael Niedermayer
fa38dfc0ef avcodec/exr: x/ymax cannot be INT_MAX 
The code uses x/ymax + 1 so the maximum is INT_MAX-1

Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 33158/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5545462457303040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 48342aa075)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-06-18 20:53:56 +02:00
Michael Niedermayer
a6bd1bdd12 avcodec/clearvideo: Check for 0 tile_shift 
Fixes: shift exponent -1 is negative
Fixes: 33401/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CLEARVIDEO_fuzzer-5908683596890112

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 63e75e09ae)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-06-18 20:53:56 +02:00
Michael Niedermayer
3f81371bd4 avcodec/vc1: Check remaining bits in ff_vc1_parse_frame_header() 
Fixes: Timeout
Fixes: 33156/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-6259655027326976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 38c4761588)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
 2021-06-18 20:53:56 +02:00