Andreas Rheinhardt
29584733e6
libavcodec/libvpxenc: Don't free user-provided AVPacket
...
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit 26b4509690
2020-05-23 21:02:30 +02:00
Andreas Rheinhardt
526628058e
avcodec/libopusenc: Don't free user-provided AVPacket
...
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com >
(cherry picked from commit b803993b6d
2020-05-23 21:02:25 +02:00
James Almer
f8e254716b
avcodec/hevcdec: decode at most one slice reporting being the first in the picture
...
Fixes deadlocks when decoding packets containing more than one of the aforementioned
slices when using frame threads.
Tested-by: Derek Buitenhuis <derek.buitenhuis@gmail.com >
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 70c8c8a818
2019-03-20 22:09:31 -03:00
James Almer
a9c1ef2626
avcodec/bitstream_filters: check the input argument of av_bsf_get_by_name() for NULL
...
Fixes crashes like "ffmpeg -h bsf" caused by passing NULL to strcmp()
Signed-off-by: James Almer <jamrial@gmail.com >
(cherry picked from commit 3258cc6507
2018-07-28 22:46:33 -03:00
Rostislav Pehlivanov
7cce800930
vc2enc_dwt: pad the temporary buffer by the slice size
...
Since non-Haar wavelets need to look into pixels outside the frame, we
need to pad the buffer. The old factor of two seemed to be a workaround
that fact and only padded to the left and bottom. This correctly pads
by the slice size and as such reduces memory usage and potential
exploits.
Reported by Liu Bingchang.
Ideally, there should be no temporary buffer but the encoder is designed
to deinterleave the coefficients into the classical wavelet structure
with the lower frequency values in the top left corner.
Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com >
(cherry picked from commit 3228ac730c
2017-11-09 02:10:40 +00:00
Michael Niedermayer
27505de3b9
avcodec/takdec: Fix integer overflow in decode_lpc()
...
Fixes: runtime error: signed integer overflow: 16748560 + 2143729712 cannot be represented in type 'int'
Fixes: 3202/clusterfuzz-testcase-minimized-4988291642294272
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5d31f03a02michael@niedermayer.cc >
2017-09-25 11:10:29 +02:00
Michael Niedermayer
dc5240a4d7
avcodec/proresdec2: Check bits in DECODE_CODEWORD(), fixes invalid shift
...
Fixes: runtime error: shift exponent 42 is too large for 32-bit type 'unsigned int'
Fixes: 3410/clusterfuzz-testcase-minimized-5313377960198144
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4f5eaf0b59michael@niedermayer.cc >
2017-09-25 11:10:15 +02:00
Michael Niedermayer
c7ad616dda
avcodec/takdec: Fix integer overflows in decode_subframe()
...
Fixes: runtime error: signed integer overflow: -1562477869 + -691460395 cannot be represented in type 'int'
Fixes: 3196/clusterfuzz-testcase-minimized-4528307146063872
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 3dabb9c69dmichael@niedermayer.cc >
2017-09-25 11:09:06 +02:00
Michael Niedermayer
743354358b
avcodec/dirac_dwt: Fix integer overflow in COMPOSE_FIDELITYi*()
...
Fixes: runtime error: signed integer overflow: 161 * 13872281 cannot be represented in type 'int'
Fixes: 3295/clusterfuzz-testcase-minimized-4738998142500864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 67da2685e0michael@niedermayer.cc >
2017-09-24 02:43:53 +02:00
Michael Niedermayer
b9f0979e16
avcodec/ffv1dec: Fix integer overflow in read_quant_table()
...
Fixes: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 3361/clusterfuzz-testcase-minimized-5065842955911168
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d00fc952b6michael@niedermayer.cc >
2017-09-24 02:41:18 +02:00
Michael Niedermayer
bfb7744aaf
avcodec/svq3: Fix overflow in svq3_add_idct_c()
...
Fixes: runtime error: signed integer overflow: 2147392585 + 524288 cannot be represented in type 'int'
Fixes: 3348/clusterfuzz-testcase-minimized-4809500517203968
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c933c5168michael@niedermayer.cc >
2017-09-24 02:41:00 +02:00
Michael Niedermayer
7333799de5
avcodec/pngdec: Clean up on av_frame_ref() failure
...
Fixes: memleak
Fixes: 3203/clusterfuzz-testcase-minimized-4514553595428864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 5480e82d77michael@niedermayer.cc >
2017-09-20 03:09:14 +02:00
Michael Niedermayer
61c5c89d04
avcodec/hevc_ps: Fix c?_qp_offset_list size
...
Fixes: runtime error: index 5 out of bounds for type 'int8_t const[5]'
Fixes:3175/clusterfuzz-testcase-minimized-4736774054084608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit abf3f9fa23michael@niedermayer.cc >
2017-09-17 15:57:27 +02:00
Michael Niedermayer
19045efd05
avcodec/shorten: Move buffer allocation and offset init to end of read_header()
...
They are time consuming operations, performing them after the other checks
improves the speed with damaged input dramatically.
Fixes: Timeout
Fixes: 2928/clusterfuzz-testcase-4992812120539136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 380659604fmichael@niedermayer.cc >
2017-09-17 15:57:27 +02:00
Michael Niedermayer
33e67eb80c
avcodec/jpeg2000dsp: Fix multiple integer overflows in ict_int()
...
Fixes: runtime error: signed integer overflow: 22553 * -188962 cannot be represented in type 'int'
Fixes: 3042/clusterfuzz-testcase-minimized-5174210131394560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2d025e7428michael@niedermayer.cc >
2017-09-17 15:57:27 +02:00
Michael Niedermayer
4b43dd03ed
avcodec/hevcdsp_template: Fix undefined shift in put_hevc_pel_bi_w_pixels
...
Fixes: runtime error: left shift of negative value -95
Fixes: 3077/clusterfuzz-testcase-minimized-4684917524922368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c225da68cfmichael@niedermayer.cc >
2017-09-17 15:57:27 +02:00
Michael Niedermayer
10ae5fb269
avcodec/diracdec: Fix overflow in DC computation
...
Fixes: runtime error: signed integer overflow: 11896 + 2147483646 cannot be represented in type 'int'
Fixes: 3053/clusterfuzz-testcase-minimized-6355082062856192
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b5995856a4michael@niedermayer.cc >
2017-09-17 15:57:27 +02:00
Michael Niedermayer
5cc3add036
avcodec/dirac_dwt: Fix multiple overflows in 9/7 lifting
...
Fixes: runtime error: signed integer overflow: 1073901567 + 1073901567 cannot be represented in type 'int'
Fixes: 3124/clusterfuzz-testcase-minimized-454643435752652
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit f71cd44147michael@niedermayer.cc >
2017-09-17 15:57:27 +02:00
Michael Niedermayer
93a32c15a8
avcodec/diracdec: Fix integer overflow in INTRA_DC_PRED()
...
Fixes: runtime error: signed integer overflow: 1168175789 + 1168178473 cannot be represented in type 'int'
Fixes: 3081/clusterfuzz-testcase-minimized-4807564879462400
Fixes: 2844/clusterfuzz-testcase-minimized-5561715838156800
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2a0823ae96michael@niedermayer.cc >
2017-09-17 15:57:27 +02:00
Michael Niedermayer
0e4612ea68
avcodec/snowdec: Fix integer overflow in decode_subband_slice_buffered()
...
Fixes: runtime error: signed integer overflow: 267 * 8388608 cannot be represented in type 'int'
Fixes: 2743/clusterfuzz-testcase-minimized-5820652076400640
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 732f976456michael@niedermayer.cc >
2017-09-17 15:57:27 +02:00
Michael Niedermayer
f69905e230
avcodec/hevc_ps: Fix undefined shift in pcm code
...
Fixes: runtime error: shift exponent -1 is negative
Fixes: 3091/clusterfuzz-testcase-minimized-6229767969832960
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2a83866c9fmichael@niedermayer.cc >
2017-09-17 15:57:27 +02:00
Michael Niedermayer
fcc2119eac
avcodec/sbrdsp_fixed: Fix undefined overflows in autocorrelate()
...
Fixes: runtime error: signed integer overflow: 8903997421129740175 + 354481484684609529 cannot be represented in type 'long'
Fixes: 2045/clusterfuzz-testcase-minimized-6751255865065472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit eefb68c9c3michael@niedermayer.cc >
2017-09-17 15:57:27 +02:00
Michael Niedermayer
0575adfd4a
avcodec/hevc_ps: Check delta_pocs in ff_hevc_decode_short_term_rps()
...
Fixes: integer overflow
Fixes: 2893/clusterfuzz-testcase-minimized-5809330567774208
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2b44dcbc44michael@niedermayer.cc >
2017-09-17 15:57:27 +02:00
Vitaly Buka and Michael Niedermayer
edac232860
avcodec/utils: Fix signed integer overflow in rc_initial_buffer_occupancy initialization
...
Signed integer overflow is undefined behavior.
Detected with clang and -fsanitize=signed-integer-overflow
Signed-off-by: Vitaly Buka <vitalybuka@google.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8c2bb10ddfmichael@niedermayer.cc >
2017-09-17 15:57:27 +02:00
Michael Niedermayer
1fa31e28fd
avcodec/aacdec_template: Fix running cleanup in decode_ics_info()
...
Fixes: out of array read
Fixes: 2873/clusterfuzz-testcase-minimized-5924145713905664
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Previous version reviewed-by: Alex Converse <alex.converse@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6f03ffb47dmichael@niedermayer.cc >
2017-09-17 15:57:27 +02:00
Michael Niedermayer
3ee6a9cfb4
avcodec/me_cmp: Fix crashes on ARM due to misalignment
...
Adds a diff_pixels_unaligned()
Fixes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872503
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bc488ec28amichael@niedermayer.cc >
2017-09-17 15:57:27 +02:00
Michael Niedermayer
b2f99c424f
avcodec/dirac_dwt_template: Fix integer overflow in vertical_compose53iL0()
...
Fixes: runtime error: signed integer overflow: 2147483646 + 2 cannot be represented in type 'int'
Fixes: 3013/clusterfuzz-testcase-minimized-4644084197097472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a165b53daamichael@niedermayer.cc >
2017-09-17 15:57:27 +02:00
Michael Niedermayer
96d5786027
avcodec/fic: Fixes signed integer overflow
...
Fixes: runtime error: signed integer overflow: 1037142357 + 1227025305 cannot be represented in type 'int'
Fixes: 3024/clusterfuzz-testcase-minimized-5885660323905536
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0c9d5b015cmichael@niedermayer.cc >
2017-09-17 15:57:27 +02:00
Michael Niedermayer
1b5548cc09
avcodec/snowdec: Fix off by 1 error
...
Fixes: runtime error: index 4 out of bounds for type 'int8_t [4]'
Fixes: 3023/clusterfuzz-testcase-minimized-6421736130084864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d132683dddmichael@niedermayer.cc >
2017-09-17 15:57:27 +02:00
Michael Niedermayer
df2efc212d
avcodec/diracdec: Check perspective_exp and zrs_exp.
...
Fixes: undefined shift
Fixes: runtime error: shift exponent 264 is too large for 32-bit type 'int'
Fixes: 2860/clusterfuzz-testcase-minimized-4672811689836544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e6cab8745michael@niedermayer.cc >
2017-09-17 15:57:27 +02:00
Michael Niedermayer
a5c83b586b
avcodec/mpeg4videodec: Clear mcsel before decoding an image
...
Fixes: runtime error: signed integer overflow: 2146467840 + 1032192 cannot be represented in type 'int'
Fixes: 2826/clusterfuzz-testcase-minimized-5901511613743104
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7735ed2974michael@niedermayer.cc >
2017-09-17 15:57:27 +02:00
Michael Niedermayer
55fe7a738f
avcodec/dirac_dwt: Fixes integer overflows in COMPOSE_DAUB97*
...
Fix multiple: runtime error: signed integer overflow: 6497 * 3409630 cannot be represented in type 'int'
Fixes: 2819/clusterfuzz-testcase-minimized-4743700301217792
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a5380f9c1cmichael@niedermayer.cc >
2017-09-17 15:57:27 +02:00
Michael Niedermayer
46023f3258
avcodec/aacdec_fixed: fix invalid shift in predict()
...
Fixes: runtime error: shift exponent -2 is negative
Fixes: 2818/clusterfuzz-testcase-minimized-5062943676825600
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1e443051b2michael@niedermayer.cc >
2017-09-17 15:57:27 +02:00
Michael Niedermayer
74e9dbf0df
avcodec/h264_slice: Fix overflow in slice offset
...
Fixes: runtime error: signed integer overflow: 1610612736 * 2 cannot be represented in type 'int'
Fixes: 2817/clusterfuzz-testcase-minimized-5289691240726528
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 1f53bde6d8michael@niedermayer.cc >
2017-09-17 15:57:27 +02:00
Michael Niedermayer
6d849e2706
avcodec/diracdec: Check weight_log2denom
...
Fixes: runtime error: shift exponent -1 is negative
Fixes: 2742/clusterfuzz-testcase-minimized-5724322402402304
Fixes: 2744/clusterfuzz-testcase-minimized-4672435653705728
Fixes: 2749/clusterfuzz-testcase-minimized-5298741273690112
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 880f5c5913michael@niedermayer.cc >
2017-08-01 14:13:31 +02:00
Michael Niedermayer
acedc53186
avcodec/dirac_dwt: Fix multiple integer overflows in COMPOSE_DD97iH0()
...
Fixes: runtime error: signed integer overflow: 9 * 335544320 cannot be represented in type 'int'
Fixes: 2739/clusterfuzz-testcase-minimized-6737297955356672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit bf8ab72ae9michael@niedermayer.cc >
2017-07-29 19:13:20 +02:00
Michael Niedermayer
6b1c71040d
avcodec/diracdec: Fix integer overflow in divide3()
...
Fixes: runtime error: signed integer overflow: -1073746548 * 21845 cannot be represented in type 'int'
Fixes: 2729/clusterfuzz-testcase-minimized-5902915464069120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c0220c768cmichael@niedermayer.cc >
2017-07-29 14:23:25 +02:00
Michael Niedermayer
6274709c1c
avcodec/takdec: Fix integer overflow in decode_subframe()
...
Fixes: runtime error: signed integer overflow: -536870912 - 1972191120 cannot be represented in type 'int'
Fixes: 2711/clusterfuzz-testcase-minimized-4975142398590976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2c630d159fmichael@niedermayer.cc >
2017-07-29 14:18:35 +02:00
Michael Niedermayer
f4c8449238
avcodec/diracdec: Fix integer overflow in signed multiplication in UNPACK_ARITH()
...
Fixes: runtime error: signed integer overflow: 1073741823 * 4 cannot be represented in type 'int'
Fixes: 2729/clusterfuzz-testcase-minimized-5902915464069120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8e275a74b0michael@niedermayer.cc >
2017-07-28 03:41:08 +02:00
Michael Niedermayer
956f2db21f
avcodec/dnxhddec: Move mb height check out of non hr branch
...
Fixes: out of array access
Fixes: poc.dnxhd
Found-by: Bingchang, Liu@VARAS of IIE
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 296debd213michael@niedermayer.cc >
2017-07-27 03:11:20 +02:00
Michael Niedermayer
7f3124e08c
avcodec/hevc_ps: fix integer overflow in log2_parallel_merge_level_minus2
...
Fixes: runtime error: signed integer overflow: -2147483647 - 2 cannot be represented in type 'int'
Fixes: 2702/clusterfuzz-testcase-minimized-4511932591636480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 74c1c22d7fmichael@niedermayer.cc >
2017-07-26 17:24:59 +02:00
Michael Niedermayer
a0edd7f583
avcodec/ylc: Fix shift overflow
...
Fixes: runtime error: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 2698/clusterfuzz-testcase-minimized-4713541443518464
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 03a9e6ff30michael@niedermayer.cc >
2017-07-26 00:14:22 +02:00
Michael Niedermayer
2755c73d55
avcodec/aacps: Fix multiple integer overflow in map_val_34_to_20()
...
Fixes: avcodec/aacps.c:511:40: runtime error: signed integer overflow: 1509077651 + 758068176 cannot be represented in type 'int'
Fixes: 2678/clusterfuzz-testcase-minimized-4702787684270080
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0764fe1d09michael@niedermayer.cc >
2017-07-26 00:14:02 +02:00
Michael Niedermayer
918d45ec82
avcodec/aacdec_fixed: fix: left shift of negative value -1
...
Fixes: 2699/clusterfuzz-testcase-minimized-5631303862976512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2dfb8c4178michael@niedermayer.cc >
2017-07-26 00:11:55 +02:00
Vodyannikov Aleksandr and Michael Niedermayer
c6d9d00220
avcodec/cfhd: Fix decoding regression due to height check
...
Fixes: Ticket6546
Regression since: 54aaadf648mfcc64@gmail.com >
Reviewed-by: Kieran Kunhya <kierank@obe.tv >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 47c9365724michael@niedermayer.cc >
2017-07-23 15:00:52 +02:00
Michael Niedermayer
02bec657f3
avcodec/aacdec_template (fixed point): Check gain in decode_cce() to avoid undefined shifts later
...
Fixes: runtime error: shift exponent 47 is too large for 32-bit type 'int'
Fixes: 2581/clusterfuzz-testcase-minimized-4681474395602944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 2886142e0cmichael@niedermayer.cc >
2017-07-19 04:03:10 +02:00
Michael Niedermayer
a2c3c9bc60
avcodec/aacdec_template: Fix undefined integer overflow in apply_tns()
...
Fixes: runtime error: signed integer overflow: -2147483648 - 1202286525 cannot be represented in type 'int'
Fixes: 2071/clusterfuzz-testcase-minimized-6036414271586304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0ef8f03133michael@niedermayer.cc >
2017-07-19 03:54:39 +02:00
Michael Niedermayer
94077cf673
avcodec/magicyuv: Check that vlc len is not too large
...
Fixes: runtime error: shift exponent -95 is negative
Fixes: 2568/clusterfuzz-testcase-minimized-4926115716005888
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 341f01290cmichael@niedermayer.cc >
2017-07-19 03:53:54 +02:00
Michael Niedermayer
506bbbc099
avcodec/mjpegdec: Clip DC also on the negative side.
...
Fixes: runtime error: signed integer overflow: -16711425 + -2130772346 cannot be represented in type 'int'
Fixes: 2533/clusterfuzz-testcase-minimized-5372857678823424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c28f648b19michael@niedermayer.cc >
2017-07-19 03:48:00 +02:00
Michael Niedermayer
910878e4d9
avcodec/aacps (fixed point): Fix multiple signed integer overflows
...
Fixes: runtime error: signed integer overflow: 1421978265 - -1810326882 cannot be represented in type 'int'
Fixes: 2527/clusterfuzz-testcase-minimized-5260915396050944
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 80b9e40b6fmichael@niedermayer.cc >
2017-07-19 03:47:45 +02:00
Andreas Rheinhardt