Commits · c655749d1d007a8fcda4d85032733e0547d24c0d · Samuel Mira / ffmpeg

Oct 21, 2022

Update for 3.2.19 · c655749d
Michael Niedermayer authored 2 years ago
```
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
```
n3.2.19

c655749d

avcodec/dstdec: Check for overflow in build_filter() · efee81be

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 1917019860 + 265558963 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DST_fuzzer-4833165046317056

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8008940d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

efee81be

avformat/spdifdec: Use 64bit to compute bit rate · 2b9ab807

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 32 * 553590816 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-6564974517944320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4075f0ce)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

2b9ab807

avformat/xwma: Use av_rescale() for duration computation · a9fcab5c

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 34242363648 * 538976288 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6577923913547776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2c789f75)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

a9fcab5c

avformat/rmdec: check tag_size · fa4fdc7f

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6598073725353984

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2cb7ee8a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

fa4fdc7f

avformat/nutdec: Check fields · f8074b79

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6566001610719232

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2c146406)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

f8074b79

avformat/dxa: avoid bpc overflows · c91ed5ee

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 2147483647 + 32 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-6639823726706688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 93db0f07)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

c91ed5ee

avformat/cafdec: Check that nb_frasmes fits within 64bit · 2dacd939

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 1099511693312 * 538976288 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6565048815845376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d4bb4e37)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

2dacd939

avformat/asfdec_o: Limit packet offset · 7e635723

Michael Niedermayer authored 2 years ago

avoids overflows with it

Fixes: signed integer overflow: 9223372036846866010 + 4294967047 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6538296768987136
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-657169555665715

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 736e9e69)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

7e635723

avformat/ape: Check frames size · 89914fa8

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 9223372036854775806 + 3 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_APE_fuzzer-6389264140599296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d0349c99)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

89914fa8

avformat/icodec: Check nb_pal · 3c33d80c

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 538976288 * 4 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ICO_fuzzer-6690068904935424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit db73ae0d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

3c33d80c

avformat/aiffdec: Use 64bit for block_duration use · 13cbb136

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 3 * -2147483648 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6668935979728896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9303ba27)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

13cbb136

avformat/aiffdec: Check block_duration · 596684dd

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 3 * -2147483648 cannot be represented in type 'int'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6668935979728896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1c2b6265)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

596684dd

avcodec/apedec: Fix integer overflow in filter_3800() · 75353c4b

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: -2147448926 + -198321 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5739619273015296
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6744428485672960

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f05247f6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

75353c4b

avcodec/tta: Check 24bit scaling for overflow · bce93faf

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: -8427924 * 256 cannot be represented in type 'int'
Fixes: 48798/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5409428670644224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3993345f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

bce93faf

libavformat/hls: Free keys · 45d4d7e3

Michael Niedermayer authored 2 years ago

Fixes: memleak
Fixes: 50703/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-6399058578636800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Reviewed-by: Steven Liu <lingjiujianke@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d32a9f31)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

45d4d7e3

avcodec/bink: disallow odd positioned scaled blocks · 46408a2d

Michael Niedermayer authored 2 years ago

Fixes: out of array access
Fixes: 47911/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINK_fuzzer-6194020855971840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b14104a6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

46408a2d

avformat/asfdec_o: limit recursion depth in asf_read_unknown() · 9bf2cb6d

Michael Niedermayer authored 2 years ago

The threshold of 5 is arbitrary, both smaller and larger should work fine

Fixes: Stack overflow
Fixes: 50603/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6049302564175872

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1f1a3681)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

9bf2cb6d

doc/git-howto.texi: Document commit signing · f94628a3

Michael Niedermayer authored 2 years ago


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ced0dc80)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

f94628a3

libavcodec/8bps: Check that line lengths fit within the buffer · f9aa66bc

Michael Niedermayer authored 2 years ago

Fixes: Timeout
Fixes: undefined pointer arithmetic
Fixes: 50330/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EIGHTBPS_fuzzer-5436287485607936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2316d5ec)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

f9aa66bc

libavformat/iff: Check for overflow in body_end calculation · 65831041

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: -6322983228386819992 - 5557477266266529857 cannot be represented in type 'long'
Fixes: 50112/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6329186221948928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bcb46903)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

65831041

avcodec/h263dec: Sanity check against minimal I/P frame size · c08f64df

Michael Niedermayer authored 2 years ago

Fixes: Timeout
Fixes: 49718/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4874987894341632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ca4ff9c2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

c08f64df

MAINTAINERS: Add ED25519 key for signing my commits in the future · dc6f7e6b

Michael Niedermayer authored 2 years ago


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 05225180)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

dc6f7e6b

avcodec/hevc_filter: copy_CTB() only within width&height · 05e0eb05

Michael Niedermayer authored 2 years ago

Fixes: out of array access
Fixes: 49271/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5424984922652672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 009ef35d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

05e0eb05

avformat/flvdec: Check for EOF in index reading · 2278ce50

Michael Niedermayer authored 2 years ago

Fixes: Timeout
Fixes: 47992/clusterfuzz-testcase-minimized-ffmpeg_dem_LIVE_FLV_fuzzer-6020443879899136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ceff5d7b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

2278ce50

avformat/nutdec: Check get_packetheader() in mainheader · b0700a13

Michael Niedermayer authored 2 years ago

Fixes; Timeout
Fixes: 48794/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6524604713140224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b5de084a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

b0700a13

avformat/asfdec_f: Use 64bit for packet start time · 01705cc0

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 2147483647 + 32 cannot be represented in type 'int'
Fixes: 49014/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-6314973315334144

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8ed78486)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

01705cc0

avcodec/lagarith: Check dst/src in zero run code · 6ca1a2ac

Michael Niedermayer authored 2 years ago

Fixes: out of array access
Fixes: 48799/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LAGARITH_fuzzer-4764457825337344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9450f759)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

6ca1a2ac

avcodec/h264dec: Skip late SEI · 7e4e122c

Michael Niedermayer authored 2 years ago


Fixes: Race condition
Fixes: clusterfuzz-testcase-minimized-mediasource_MP2T_AVC_pipeline_integration_fuzzer-6282675434094592

Found-by: google ClusterFuzz
Tested-by: Dan Sanders <sandersd@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f7dd408d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

7e4e122c

avcodec/sbrdsp_fixed: Fix integer overflows in sbr_qmf_deint_neg_c() · cc770893

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 2147483645 + 16 cannot be represented in type 'int'
Fixes: 46993/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-4759025234870272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1537f405)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

cc770893

avformat/rtsp: break on unknown protocols · eedbc82e

Michael Niedermayer authored 2 years ago


This function needs more cleanup and it lacks error handling

Fixes: use of uninitialized memory
Fixes: CID700776

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 73c0fd27)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

eedbc82e

avcodec/hevcdsp_template: stay within tables in sao_band_filter() · 2e8529d2

Michael Niedermayer authored 2 years ago

Fixes: out of array read
Fixes: 47875/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5719393113341952

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9c5250a5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

2e8529d2

avcodec/qpeldsp: copy less for the mc0x cases · d81081d2

Michael Niedermayer authored 2 years ago

Fixes: out of array access
Fixes: 47936/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-5745039940124672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e690d4ed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

d81081d2

avcodec/ffv1dec: Limit golomb rice coded slices to width 8M · 0f49789f

Michael Niedermayer authored 2 years ago


This limit is possibly not reachable due to other restrictions on buffers but
the decoder run table is too small beyond this, so explicitly check for it.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b4431399)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

0f49789f

avformat/iff: simplify duration calculation · 3df3d2cf

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: 315680096256 * 134215943 cannot be represented in type 'long long'
Fixes: 48713/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5886272312311808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0740641e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

3df3d2cf

avcodec/wnv1: Check for width =1 · f3ac9f6f

Michael Niedermayer authored 2 years ago

The decoder only outputs pixels for width >1 images, fail early

Fixes: Timeout
Fixes: 48298/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WNV1_fuzzer-6198626319204352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d98d5a43)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

f3ac9f6f

avformat/sctp: close socket on errors · 4b3ff3ce

Michael Niedermayer authored 2 years ago


This is untested as i have no testcase

Fixes: CID1302709

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c9a29965)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

4b3ff3ce

avcodec/aasc: Fix indention · bd7fd6a6

Michael Niedermayer authored 2 years ago


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit af2ed092)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

bd7fd6a6

avcodec/qdrw: adjust max colors to array size · 5c3262e8

Michael Niedermayer authored 2 years ago

Fixes: out of array access
Fixes: 48429/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDRAW_fuzzer-4608329791438848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cd847f86)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

5c3262e8

avcodec/alacdsp: Make intermediates unsigned · 8618061a

Michael Niedermayer authored 2 years ago

Fixes: signed integer overflow: -14914387 + -2147418648 cannot be represented in type 'int'
Fixes: 46464/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-474307197311385

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg


Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8709f4c1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

8618061a