Commit Graph

41678 Commits

Author SHA1 Message Date
Michael Niedermayer cf3c245566 avcodec/libvorbisdec: Check extradata size
Fixes: out of array read
Fixes: 15261/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVORBIS_fuzzer-5764908467093504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-29 19:22:19 +02:00
Michael Niedermayer fb4a4557d1 avcodec/atrac9dec: Check q_unit_cnt in parse_band_ext()
Fixes: global-buffer-overflow
Fixes: 15247/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5671602181636096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-29 19:22:19 +02:00
Michael Niedermayer ac9af7e9a5 avcodec/atrac9dec: Check that the reused block has succeeded initilization
Fixes: global-buffer-overflow
Fixes: 15247/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5671602181636096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-29 19:22:19 +02:00
Paul B Mahol 2edb262759 avcodec/cfhd: add back alpha processing removed in 9cefb9e7ec
Fixes #7886.
2019-06-28 20:10:43 +02:00
Michael Niedermayer d33414d2ad avcodec/utils: Check bits_per_coded_sample
This avoids the need for each decoder separately having to handle this case

Fixes: shift exponent -100663046 is negative
Fixes: out of array access
Fixes: 15270/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5727829913763840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-26 21:41:53 +02:00
Michael Niedermayer 247a1de7f7 avcodec/videodsp_template: Fix overflow of addition
Fixes: addition of unsigned offset to 0x7f56fc26a9b6 overflowed to 0x7f56fc26a8be*
Fixes: clusterfuzz-testcase-minimized-mediasource_MP4_AVC1_pipeline_integration_fuzzer-4917949056679936

Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-26 21:40:19 +02:00
Michael Niedermayer f30be1ec98 avcodec/alsdec: Fix invalid shift in multiply()
Fixes: shift exponent -24 is negative
Fixes: 15292/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5768533318828032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-26 21:31:29 +02:00
Michael Niedermayer 55557c6124 avcodec/4xm: Fix vlc memleak
Fixes: memleak
Fixes: 15297/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5746203548975104

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-26 21:29:35 +02:00
Michael Niedermayer 2db7a3bc4a avcodec/ffwavesynth: Check ts_end - ts_start for overflow
Fixes: signed integer overflow: 2314885530818453536 - -8926099139098304480 cannot be represented in type 'long'
Fixes: 15259/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5764366093254656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-26 21:27:08 +02:00
Michael Niedermayer 507ca66ee4 avcodec/vc1dsp: Avoid undefined shifts in vc1_v_s_overlap_c / vc1_h_s_overlap_c
Fixes: left shift of negative value -13
Fixes: 15260/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-5702076048343040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-26 21:26:41 +02:00
Michael Niedermayer ebccd2f778 avcodec/tta: Fix undefined shift
Fixes: left shift of negative value -4483
Fixes: 15256/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5738691617619968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-26 21:26:04 +02:00
Michael Niedermayer 2921b45a38 avcodec/qdmc: Fix integer overflows in PRNG
Fixes: signed integer overflow: 214013 * 2531011 cannot be represented in type 'int'
Fixes: 15254/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDMC_fuzzer-5698137026461696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-26 21:25:56 +02:00
Michael Niedermayer d57f6606eb avcodec/rv10: Avoid calculating undefined value that is unused
Fixes: shift exponent 64 is too large for 32-bit type 'int'
Fixes: 15253/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV10_fuzzer-5671114300194816

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-26 21:25:50 +02:00
Michael Niedermayer bfb58bdd70 avcodec/bintext: Check font height
Fixes: division by zero
Fixes: 15257/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINTEXT_fuzzer-5757352881422336

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-26 21:25:10 +02:00
Michael Niedermayer 7a072fbcc4 avcodec/binkdsp: Fix integer overflows in idct
Fixes: signed integer overflow: 3784 * 682038 cannot be represented in type 'int'
Fixes: 15265/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5088311799971840
Fixes: 15268/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5666502344179712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-26 19:05:29 +02:00
Michael Niedermayer 62ad08cef9 avcodec/bink: Fix integer overflow in unquantize_dct_coeffs()
Fixes: signed integer overflow: -3447 * 2883584 cannot be represented in type 'int'
Fixes: 15265/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5088311799971840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-26 19:05:29 +02:00
Michael Niedermayer 930cdef80a avcodec/motionpixels: Check for vlc error in mp_get_vlc()
Fixes: 15246/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOTIONPIXELS_fuzzer-5168534407086080
Fixes: runtime error: index -1 out of bounds for type 'HuffCode [16]'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-25 13:30:09 +02:00
Michael Niedermayer ce3b0b9066 avcodec/loco: Limit lossy parameter so it is sane and does not overflow
Fixes: 15248/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LOCO_fuzzer-5087440458481664
Fixes: signed integer overflow: 3 + 2147483647 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-25 13:30:09 +02:00
Michael Niedermayer 5ea7f20500 avcodec/xpmdec: Do not use context dimensions as temporary variables
Fixes: Integer overflow
Fixes: 15134/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XPM_fuzzer-5722635939348480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-25 13:30:09 +02:00
Michael Niedermayer 07ffe94c17 avcodec/fitsdec: Fix division by 0 in size check
Fixes: division by zero
Fixes: 15210/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5746033243455488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-25 13:30:09 +02:00
Michael Niedermayer f8f5668df5 avcodec/aacpsdsp_template: Fix integer overflow in ps_hybrid_analysis_c()
Fixes: signed integer overflow: -1539565182 + -798086761 cannot be represented in type 'int'
Fixes: 14807/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-564925382682214

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-25 13:30:09 +02:00
Michael Niedermayer 3aecd01704 avcodec/truemotion2: Fix integer overflow in last loop in tm2_update_block()
Fixes: signed integer overflow: -1727985666 - 538976288 cannot be represented in type 'int'
Fixes: 15031/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5100228035739648

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-25 13:30:09 +02:00
Michael Niedermayer c830752142 avcodec/pngdec: Check input space
Fixes: Timeout (33sec -> 78ms)
Fixes: 14668/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LSCR_fuzzer-5767073352908800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-25 13:30:09 +02:00
Andreas Rheinhardt 800f618a34 movsub_bsf: Fix mov2textsub regression
The mov flavour of timed text uses the first two bytes of the packet as
a length field. And up until 11bef2fe said length field has been read
correctly in the mov2textsub bsf. But since then the next two bytes are
read as if they were the length field. This is fixed in this commit.

Reviewed-by: Philip Langdale <philipl@overt.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
2019-06-24 23:49:19 -03:00
Carl Eugen Hoyos c8232e5007 lavc/tableprint_vlc: Remove avpriv_request_sample() from included files.
Fixes compilation with --enable-hardcoded-tables.
Fixes ticket #7962.
2019-06-24 00:19:03 +02:00
Michael Niedermayer 0f9789c8e3 avcodec/iff: finetune the palette size check in the mask case
Fixes: out of array access
Fixes: 15381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5668057826983936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-23 10:51:16 +02:00
Michael Niedermayer 92e8db532c avcodec/iff: Fix mask_buf / mask_palbuf leak
Fixes: 15372/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5708881759567872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-23 10:46:49 +02:00
Michael Niedermayer 561cc161ca avcodec/fmvc: Check if header fields are available before allocating the image
Fixes: Timeout (15sec -> 0.5sec)
Fixes: 14846/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FMVC_fuzzer-5068322120400896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-21 18:28:00 +02:00
Michael Niedermayer dd8720045c avcodec/wcmv: check remaining space vs. blocks
Fixes: Timeout (18sec  -> 7sec)
Fixes: 14835/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WCMV_fuzzer-5646714897170432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-21 18:28:00 +02:00
Andreas Rheinhardt a1a8815220 libavcodec: Reduce the size of some arrays
This commit uses smaller types for some static const arrays to reduce
their size in case the entries can be represented in the smaller type.
The biggest savings came from inv_map_table in vp9.c.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
2019-06-20 14:47:46 -03:00
Limin Wang 268ab17c51 libavcodec/videotoolboxenc: Fix compilation broken on macOS 10.12
Signed-off-by: Limin Wang <lance.lmwang@gmail.com>
Signed-off-by: Rick Kern <kernrj@gmail.com>
2019-06-17 22:54:04 -04:00
Michael Niedermayer 2603f25d32 avcodec/bink: Reorder operations in init to avoid memleak on error
Fixes: Direct leak of 536 byte(s) in 1 object(s)
Fixes: 15266/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-5629530426834944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-16 09:56:43 +02:00
Michael Niedermayer a7e3b271fc avcodec/bitstream: Check for more conflicting codes in build_table()
Fixes: out of array read
Fixes: 14563/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5646451545210880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-14 21:36:39 +02:00
Michael Niedermayer e78b0f8374 avcodec/bitstream: Check for integer code truncation in build_table()
Fixes: out of array read
Fixes: 14563/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5646451545210880

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-14 21:36:39 +02:00
Matthieu Bouron 7c2c5c4940 avcodec/mediacodecdec: re-indent after previous commit 2019-06-13 11:41:18 +02:00
Matthieu Bouron fef5ba4023 avcodec/mediacodecdec: remove unneeded else block in ff_mediacodec_dec_send() 2019-06-13 11:41:18 +02:00
Matthieu Bouron d83985ce11 avcodec/mediacodecdec: try to receive a frame after signaling EOF to the codec
Avoids returning EAGAIN after signaling EOF to the codec in
ff_mediacodec_dec_send() so we can try to receive a frame before
returning in mediacodec_receive_frame().

This helps avoiding an extra round-trip between avcodec_send_frame() and
avcodec_receive_frame() while draining the remaining frames.
2019-06-13 11:41:18 +02:00
Alejandro Solozabal caabe1b495 avcodec/omx: Correct av_log() log message
Print the right library name, which is trying to open, on the log message.

Signed-off-by: Alejandro Solozabal <a.solozabal@hotmail.com>
2019-06-12 22:29:11 +01:00
U. Artie Eoff f70c397456 vaapi_encode_mjpeg: fix bad component id bug
The compound literals assigned to "components"
only exist within the scope of the if/else
block (thanks Mark Thompson for the better
explanation).

Thus, after this if/else block, "components"
ends up pointing to an arbitrary/undefined
array.  With some compilers and depending on
optimization settings, these arbitrary values
may end up being the same value (i.e. 0 with
GNU GCC 9.x).  Unfortunately, the GNU GCC
compiler, at least, never prints any warnings
about this.

This patch fixes this issue by assigning the
constant arrays to local variables at function
scope and then pointing "components" to those
as necessary.

Fixes #7915

Signed-off-by: U. Artie Eoff <ullysses.a.eoff@intel.com>
2019-06-12 22:27:13 +01:00
Peter Ross 43dbdee264 VP4 video decoder 2019-06-12 20:06:20 +10:00
Peter Ross a212c8da48 avcodec/vp3: spin off get_eob_run and get_coeff coeff functions
these reoutines are shared by vp3 and vp4.
2019-06-12 20:06:20 +10:00
Michael Niedermayer 442375fee7 avcodec/mjpegdec: Check for non ls PAL8
Fixes: Null-dereference READ in av_malloc
Fixes: 15002/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-5643474625363968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-12 12:01:32 +02:00
Michael Niedermayer e5f92f3fba avcodec/v4l2_m2m_dec: Fix memleak on ff_v4l2_m2m_codec_init() failure
Fixes: 13579/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG1_V4L2M2M_fuzzer-5753560726241280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-12 12:01:32 +02:00
Michael Niedermayer 914d6a7c1a avcodec/interplayvideo: check decoding_map_size with video_data_size
Fixes: Timeout (90543 ms -> 59 ms)
Fixes: 14721/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_VIDEO_fuzzer-5697492148027392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-12 12:01:32 +02:00
Michael Niedermayer 4896fa18ad avcodec/h264_parse: Use 64bit for expectedpoc and expected_delta_per_poc_cycle
Fixes: signed integer overflow: -2142516591 + -267814575 cannot be represented in type 'int'
Fixes: 14450/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5716105319940096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-12 12:01:26 +02:00
Peter Ross b6ca032ade avcodec/vp3data: combine eob_run_base and eob_run_get_bits tables 2019-06-08 09:37:26 +10:00
Andreas Rheinhardt ad2745e867 cbs_av1, cbs_jpeg, cbs_mpeg2, cbs_vp9: Fix undef
READ has already been undefined at this point; it is obviously intended
to undef WRITE.
Furthermore, leb128 (in cbs_av1) was undefined too often and
inconsistently.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2019-06-07 21:24:07 +01:00
Michael Niedermayer 0fef412dff avcodec/mss4: Check input size against skip bits
Fixes: Timeout (17sec -> 20ms)
Fixes: 14615/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MTS2_fuzzer-5093007763701760
Fixes: 14797/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MTS2_fuzzer-5651696119709696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-05 13:19:59 +02:00
Michael Niedermayer 8e520843dd avcodec/dxv: Check op_offset in dxv_decompress_cocg()
Fixes: signed integer overflow: -2147483648 - 12 cannot be represented in type 'int'
Fixes: 14732/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_fuzzer-5735273129836544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-05 13:19:59 +02:00
Michael Niedermayer a99ffb5bb4 avcodec/diracdec: Fix integer overflow in global_mv()
Fixes: signed integer overflow: 16384 * 196607 cannot be represented in type 'int'
Fixes: 14810/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5091232683917312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-06-05 13:19:59 +02:00