Commits · 74b74887390bd57163d8d7cc4738203bec2ea59a · Samuel Mira / ffmpeg

Oct 10, 2022

Update for 4.3.5 · 74b74887
Michael Niedermayer authored 2 years ago
```
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
```
n4.3.5

74b74887

avformat/vividas: Check packet size · 400d2d91

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 119760682 - -2084600173 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-6745781167587328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f44489c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

400d2d91

Sep 26, 2022

avcodec/dstdec: Check for overflow in build_filter() · bc246da3

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 1917019860 + 265558963 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-4833165046317056

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8008940d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

bc246da3

avformat/spdifdec: Use 64bit to compute bit rate · a411aba2

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 32 * 553590816 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-6564974517944320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4075f0ce)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

a411aba2

avformat/rpl: Use 64bit for duration computation · a9eaeba8

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 24709512 * 88 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6737973728641024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 529f64b2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

a9eaeba8

avformat/xwma: Use av_rescale() for duration computation · 48b2e91f

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 34242363648 * 538976288 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6577923913547776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2c789f75)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

48b2e91f

avformat/sdsdec: Use av_rescale() to avoid intermediate overflow in duration calculation · 765b73c9

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 72128794995445727 * 240 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_SDS_fuzzer-6628185583779840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aa8eb1be)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

765b73c9

avformat/sbgdec: Check ts_int in genrate_intervals · 964fb9f5

Michael Niedermayer authored 2 years ago

There is probably a better place to check for this, but better
here than nowhere

Fixes: signed integer overflow: -9223372036824775808 - 86400000000 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6601162580688896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5f529e91)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

964fb9f5

avformat/rmdec: check tag_size · f24aa3a5

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6598073725353984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2cb7ee8a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

f24aa3a5

avformat/nutdec: Check fields · d3c80525

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6566001610719232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2c146406)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

d3c80525

avformat/flvdec: Use 64bit for sum_flv_tag_size · fc0678a1

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 2138820085 + 16130322 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_LIVE_FLV_fuzzer-6704728165187584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7124f10c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

fc0678a1

avformat/jacosubdec: Fix overflow in get_shift() · 71e8a575

Michael Niedermayer authored 2 years ago

Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-6722544461283328
Fixes: signed integer overflow: 48214448 * 60 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b1a68127)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

71e8a575

avformat/dxa: avoid bpc overflows · 78ed2836

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 2147483647 + 32 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-6639823726706688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 93db0f07)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

78ed2836

avformat/cafdec: Check that nb_frasmes fits within 64bit · 650f0f97

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 1099511693312 * 538976288 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6565048815845376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d4bb4e37)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

650f0f97

avformat/asfdec_o: Limit packet offset · bf9ac33c

Michael Niedermayer authored 2 years ago

avoids overflows with it

Fixes: signed integer overflow: 9223372036846866010 + 4294967047 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6538296768987136
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-657169555665715

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 736e9e69)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

bf9ac33c

avformat/ape: Check frames size · 080c074c

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 9223372036854775806 + 3 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_APE_fuzzer-6389264140599296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d0349c99)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

080c074c

avformat/icodec: Check nb_pal · 2cdc8254

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 538976288 * 4 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-6690068904935424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit db73ae0d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

2cdc8254

avformat/aiffdec: Use 64bit for block_duration use · b591a55e

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 3 * -2147483648 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6668935979728896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9303ba27)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

b591a55e

avformat/aiffdec: Check block_duration · 68d39d6a

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 3 * -2147483648 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6668935979728896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1c2b6265)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

68d39d6a

avformat/mxfdec: only probe max run in · 7b7e6478

Michael Niedermayer authored 2 years ago


Suggested-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1182bbb2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

7b7e6478

avformat/mxfdec: Check run_in is within 65536 · 663fa835

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 9223372036854775807 - -2146905566 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6570996594769920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 77860978)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

663fa835

avcodec/mjpegdec: Check for unsupported bayer case · 37ac298e

Michael Niedermayer authored 2 years ago

Fixes: out of array access
Fixes: 51462/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-662559341582745

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dd81cc22)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

37ac298e

avcodec/apedec: Fix integer overflow in filter_3800() · 5aecf2c1

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: -2147448926 + -198321 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5739619273015296
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6744428485672960

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f05247f6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

5aecf2c1

avcodec/tta: Check 24bit scaling for overflow · 3cf9bfa0

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: -8427924 * 256 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5409428670644224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3993345f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

3cf9bfa0

avcodec/tiff: Fix loop detection · 900c4ffc

Michael Niedermayer authored 2 years ago


Fixes regression with tickets/4364/L1004220.DNG

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 43a48545)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

900c4ffc

libavformat/hls: Free keys · 25d79ebb

Michael Niedermayer authored 2 years ago

Fixes: memleak
Fixes: 50703/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-6399058578636800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d32a9f31)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

25d79ebb

avcodec/fmvc: Move frame allocation to a later stage · 787e3af5

Michael Niedermayer authored 2 years ago


This way more things are checked before allocation

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9783749c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

787e3af5

avfilter/vf_showinfo: remove backspaces · 9f1c9e48

Michael Niedermayer authored 2 years ago


They mess with storing editing and comparing the results

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 31581ae7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

9f1c9e48

avcodec/speedhq: Check width · 51d8a691

Michael Niedermayer authored 2 years ago

Fixes: out of array access
Fixes: 50014/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEDHQ_fuzzer-4748914632294400

Alternatively the buffer size can be increased

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f0395f9e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

51d8a691

avcodec/bink: disallow odd positioned scaled blocks · 6106a5c9

Michael Niedermayer authored 2 years ago

Fixes: out of array access
Fixes: 47911/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6194020855971840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b14104a6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

6106a5c9

avformat/asfdec_o: limit recursion depth in asf_read_unknown() · f550cdb7

Michael Niedermayer authored 2 years ago

The threshold of 5 is arbitrary, both smaller and larger should work fine

Fixes: Stack overflow
Fixes: 50603/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6049302564175872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1f1a3681)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

f550cdb7

doc/git-howto.texi: Document commit signing · 4f552c19

Michael Niedermayer authored 2 years ago


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ced0dc80)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

4f552c19

libavcodec/8bps: Check that line lengths fit within the buffer · 4d1fd5c4

Michael Niedermayer authored 2 years ago

Fixes: Timeout
Fixes: undefined pointer arithmetic
Fixes: 50330/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EIGHTBPS_fuzzer-5436287485607936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2316d5ec)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

4d1fd5c4

avcodec/midivid: Perform lzss_uncompress() before ff_reget_buffer() · 16d6003b

Michael Niedermayer authored 2 years ago


This would avoid regeting the frame on lzss errors

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 628fb97e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

16d6003b

libavformat/iff: Check for overflow in body_end calculation · d9c15655

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: -6322983228386819992 - 5557477266266529857 cannot be represented in type 'long'
Fixes: 50112/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6329186221948928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bcb46903)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

d9c15655

avformat/avidec: Prevent entity expansion attacks · 47e4bab5

Michael Niedermayer authored 2 years ago


Fixes: Timeout
Fixes no testcase, this is the same idea as similar attacks against XML parsers

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f3e823c2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

47e4bab5

avcodec/h263dec: Sanity check against minimal I/P frame size · 33a6f36c

Michael Niedermayer authored 2 years ago

Fixes: Timeout
Fixes: 49718/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4874987894341632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ca4ff9c2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

33a6f36c

avcodec/hevcdec: Check s->ref in the md5 path similar to hwaccel · fd786688

Michael Niedermayer authored 2 years ago

This is somewhat redundant with the is_decoded check. Maybe
there is a nicer solution

Fixes: Null pointer dereference
Fixes: 49584/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5297367351427072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3b51e199)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

fd786688

avformat/subviewerdec: Make read_ts() more flexible · ace963dd

Michael Niedermayer authored 4 years ago

Fixes: signed integer overflow: -1948269928 * 10 cannot be represented in type 'int'
Fixes: 49451/clusterfuzz-testcase-minimized-ffmpeg_dem_SUBVIEWER_fuzzer-6344614822412288

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


(cherry picked from commit 58a8e739)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

ace963dd

avcodec/mjpegdec: bayer and rct are incompatible · 8cafce03

Michael Niedermayer authored 2 years ago

Fixes: out of array read
Fixes: 49434/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5208501080686592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a44f5a52)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

8cafce03