summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Changelog: updaten3.1.9Michael Niedermayer2017-06-221-0/+11
|
* avcodec/cfhd: Check bpc before setting bpc in contextMichael Niedermayer2017-06-221-2/+7
| | | | | | | | | | Fixes: runtime error: shift exponent 32 is too large for 32-bit type 'int' Fixes: 2306/clusterfuzz-testcase-minimized-5002997392211968 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 6f1d2355a7e4d681bea82b4cf4280272d9fe8af3) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/cfhd: Fix undefined shiftMichael Niedermayer2017-06-221-1/+1
| | | | | | | | | | Fixes: runtime error: left shift of negative value -1 Fixes: 2303/clusterfuzz-testcase-minimized-5529675273076736 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 5a950f4e32a9756391f81987246d96b6549dd447) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/hevc_filter: Fix invalid shiftMichael Niedermayer2017-06-221-1/+1
| | | | | | | | | | | Fixes: runtime error: left shift of negative value -1 Fixes: 2299/clusterfuzz-testcase-minimized-4843509351710720 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit d7b3d5c3f2e2ff1994762b5e09c05fbc33790b5b) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Fix overflow in virtual_ref computationMichael Niedermayer2017-06-221-8/+8
| | | | | | | | | | Fixes: runtime error: signed integer overflow: 262144 * -16120 cannot be represented in type 'int' Fixes: 2292/clusterfuzz-testcase-minimized-6156080415506432 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 5443c4bdf4828ac5b7b19cf54feb496c2da40079) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/lpc: signed integer overflow in compute_lpc_coefs() (aacdec_fixed)Michael Niedermayer2017-06-221-2/+5
| | | | | | | | | | Fixes: runtime error: signed integer overflow: -1575818955 + -915383657 cannot be represented in type 'int' Fixes: 2224/clusterfuzz-testcase-minimized-6208559949807616 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit e95fcfe8fb28fdfdaecec465c60aad79bc340a3d) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/wavpack: Fix undefined integer negationMichael Niedermayer2017-06-221-2/+2
| | | | | | | | | | Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself Fixes: 2291/clusterfuzz-testcase-minimized-5538453481586688 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 5f89747086af741ddc34e2378cde8519b8faee78) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/aacdec_fixed: Check s for being too smallMichael Niedermayer2017-06-221-2/+3
| | | | | | | | | | Fixes: runtime error: shift exponent -8 is negative Fixes: 2286/clusterfuzz-testcase-minimized-5711764169687040 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit cf7edbd6c5d48d7302877352f7b60092d5b65243) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/htmlsubtitles: Replace very slow redundant sscanf() calls by cleaner ↵Michael Niedermayer2017-06-221-5/+15
| | | | | | | | | | | | | and faster code This reduces the worst case from O(n²) to O(n) time Fixes Timeout Fixes: 2127/clusterfuzz-testcase-minimized-6595787859427328 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 4132218b87cd6fb13abd162e3037ef4563286baa) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/h264: Fix mix of lossless and lossy MBs decodingAnton Mitrofanov2017-06-202-16/+16
| | | | | | Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com> (cherry picked from commit cf231b68da1150c100114f2c5671b7ed740f917a) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/h264_mb: Fix 8x8dct in lossless for new versions of x264Anton Mitrofanov2017-06-201-1/+1
| | | | | | Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com> (cherry picked from commit 06dda70f1e7c69a3b1684af5e6930431c62c527a) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/h264_cabac: Fix CABAC+8x8dct in 4:4:4Anton Mitrofanov2017-06-201-14/+33
| | | | | | | | | Use the correct ctxIdxInc calculation for coded_block_flag. Keep old behavior for old versions of x264 for backward compatibility. Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com> (cherry picked from commit 840b41b2a643fc8f0617c0370125a19c02c6b586) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* Update for 3.1.9Michael Niedermayer2017-06-183-2/+105
| | | | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/takdec: Fixes: integer overflow in AV_SAMPLE_FMT_U8P outputMichael Niedermayer2017-06-181-1/+1
| | | | | | | | | | Fixes: runtime error: signed integer overflow: 2147483543 + 128 cannot be represented in type 'int' Fixes: 2234/clusterfuzz-testcase-minimized-6266896041115648 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 27c20068054d8c6786833234f7b6db19f1e98362) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/jpeg2000dsp: Reorder operations in ict_int() to avoid 2 integer ↵Michael Niedermayer2017-06-181-2/+2
| | | | | | | | | | | | overflows Fixes: runtime error: signed integer overflow: 58065 * 51981 cannot be represented in type 'int' Fixes: 2271/clusterfuzz-testcase-minimized-5778297776504832 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit c746f92a8e03d5a062359fba836eba4b3530687e) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/hevcpred_template: Fix left shift of negative valueMichael Niedermayer2017-06-181-1/+1
| | | | | | | | | | Fixes: runtime error: left shift of negative value -1 Fixes: 2250/clusterfuzz-testcase-minimized-5693382112313344 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit c94326c1fc2fb5719c6f28fe1b95c0c74417998b) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/hevcdec: Fix signed integer overflow in decode_lt_rps()Michael Niedermayer2017-06-181-2/+6
| | | | | | | | | | Fixes: runtime error: signed integer overflow: 2147483647 + 6 cannot be represented in type 'int' Fixes: 2263/clusterfuzz-testcase-minimized-4800359627227136 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 1edbf5e20c75f06d6987bc823e63aa4e649ccddd) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/jpeg2000dec: Check nonzerobits more completelyMichael Niedermayer2017-06-181-2/+2
| | | | | | | | | | Fixes: runtime error: shift exponent 36 is too large for 32-bit type 'int' Fixes: 2239/clusterfuzz-testcase-minimized-5639766592716800 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit dfb61ea2630029b7aec7911aade769bf1a914eea) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/shorten: Sanity check maxnlpcMichael Niedermayer2017-06-181-0/+4
| | | | | | | | | | Fixes OOM Fixes: 2131/clusterfuzz-testcase-minimized-4718045157130240 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit e77ddd31a8e14bcf5eccd6008d866ae90b4b0d4c) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/truemotion2: Move skip computation after checksMichael Niedermayer2017-06-181-2/+2
| | | | | | | | | | Fixes: runtime error: signed integer overflow: 630067357 * 4 cannot be represented in type 'int' Fixes: 2233/clusterfuzz-testcase-minimized-5943031318446080 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 3c716682a8b69e6644a385a663aaf0e5dc808ae8) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/jpeg2000: Fixes integer overflow in ff_jpeg2000_ceildivpow2()Michael Niedermayer2017-06-181-1/+1
| | | | | | | | | | Fixes: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself Fixes: 2231/clusterfuzz-testcase-minimized-4565181982048256 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit e3fadc57c5c170f31455abacbcbd67115d7321d7) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/hevcdec: Check nb_spsMichael Niedermayer2017-06-181-0/+2
| | | | | | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit bc406744620710911de9157eafa3e61d0246566f) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/hevc_refs: Check nb_refs in add_candidate_ref()Michael Niedermayer2017-06-181-1/+1
| | | | | | | | | | Fixes: runtime error: index 16 out of bounds for type 'int [16]' Fixes: 2209/clusterfuzz-testcase-minimized-5012343912136704 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 1cb4ef526dd1e5f547d0354efb0831d07e967919) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Check sprite delta upshift against overflowing.Michael Niedermayer2017-06-181-8/+10
| | | | | | | | | | Fixes: runtime error: signed integer overflow: -268386304 * 16 cannot be represented in type 'int' Fixes: 2204/clusterfuzz-testcase-minimized-5616756909408256 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 12245ab1f677074b8ff83e87f76a41aba692ccd6) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Fix integer overflow in num_sprite_warping_points=2 caseMichael Niedermayer2017-06-181-20/+20
| | | | | | | | | | Fixes: runtime error: signed integer overflow: 131072 + 2147352576 cannot be represented in type 'int' Fixes: 2192/clusterfuzz-testcase-minimized-5370387988742144 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 0a87be404ab7e3f47e67e79160dcc9623e36835b) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/aacsbr_fixed: Check shift in sbr_hf_assemble()Michael Niedermayer2017-06-181-5/+13
| | | | | | | | | Fixes: runtime error: shift exponent -10 is negative Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit d1992448d37f7cfa2acda5cc729dc0ff1b019390) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/sbrdsp_fixed: Return an error from sbr_hf_apply_noise() if ↵Michael Niedermayer2017-06-181-3/+10
| | | | | | | | | | | operations are impossible Fixes: 1775/clusterfuzz-testcase-minimized-5330288148217856 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit d549f026d8b64b879c3ce3b8c7d153c82aa5eb52) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/jpeg2000dwt: Fix runtime error: left shift of negative value -123Michael Niedermayer2017-06-181-1/+1
| | | | | | | | | Fixes: 2208/clusterfuzz-testcase-minimized-5976593765761024 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit d24043e1a2f93f206a2ad59054f24f45ff023e5c) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/wavpack: Fix runtime error: signed integer overflow: 1886191616 + ↵Michael Niedermayer2017-06-181-1/+1
| | | | | | | | | | | 277872640 cannot be represented in type 'int' Fixes: 2181/clusterfuzz-testcase-minimized-6314784322486272 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit c996374d4d86e0efbef71812448b4c65656bc667) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/snowdec: Fix runtime error: left shift of negative value -1Michael Niedermayer2017-06-181-1/+1
| | | | | | | | | Fixes: 2197/clusterfuzz-testcase-minimized-6010716676947968 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 2e44126363bc9e23093ceced5d7bde1ee4bbb338) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/aacdec_fixed: Fix runtime error: left shift of negative value -1297616Michael Niedermayer2017-06-181-1/+1
| | | | | | | | | Fixes: 2195/clusterfuzz-testcase-minimized-4736721533009920 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 6d499ecef9c2467772b6066176ffda0b7ab27cc2) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/tiff: Fix leak of geotags[].valMichael Niedermayer2017-06-181-0/+2
| | | | | | | | | Fixes: 2176/clusterfuzz-testcase-minimized-5908197216878592 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 22a25ab3896cbb8dceebdba4d439e8b2b398ff0e) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/ra144: Fix runtime error: signed integer overflow: -2200 * 1033073 ↵Michael Niedermayer2017-06-181-1/+1
| | | | | | | | | | | cannot be represented in type 'int' Fixes: 2175/clusterfuzz-testcase-minimized-5809657849315328 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 71da0a5c9750e9fd0c9609470f610d32952923eb) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/flicvideo: Fix runtime error: signed integer overflow: 4864 * 459296 ↵Michael Niedermayer2017-06-181-0/+10
| | | | | | | | | | | cannot be represented in type 'int' Fixes: 2174/clusterfuzz-testcase-minimized-5739234533048320 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 90e8317b3b33dcb54ae01e419d85cbbfbd874963) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/cfhd: Check band parameters before storing themMichael Niedermayer2017-06-181-9/+9
| | | | | | | | | | Fixes out of array read Fixes: 2169/clusterfuzz-testcase-minimized-5688641642823680 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 54aaadf648073149f1ac34f56cbde4e6c5aa22ef) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/indeo4: Check remaining data in Pic hdr extension parsing codeMichael Niedermayer2017-06-181-0/+2
| | | | | | | | | | Fixes: Timeout Fixes: 2115/clusterfuzz-testcase-minimized-6594111748440064 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit a3b5b60bdf451faefeeec07c4e684a251968bf2d) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/ac3dec_fixed: Fix multiple runtime error: signed integer overflow: ↵Michael Niedermayer2017-06-181-1/+1
| | | | | | | | | | | -39271008 * 59 cannot be represented in type 'int' Fixes: 2113/clusterfuzz-testcase-minimized-6510704959946752 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 4e3ab1a5c12fe3a88f44b734d3f2e25f4769ec47) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mpeg4videodec: Fix runtime error: signed integer overflow: 53098 * ↵Michael Niedermayer2017-06-181-2/+2
| | | | | | | | | | | 40448 cannot be represented in type 'int' Fixes: 2106/clusterfuzz-testcase-minimized-6136503639998464 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 18bca25adbae9d010d75f9fc197c0af656af758d) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/pafvideo: Fix assertion failureMichael Niedermayer2017-06-181-1/+1
| | | | | | | | | Fixes: 2100/clusterfuzz-testcase-minimized-4522961547558912 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit c4360559ee2a6c8c624f24fc7e2a1cf00972ba68) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/takdec: Fix multiple runtime error: signed integer overflow: 637072 ↵Michael Niedermayer2017-06-181-2/+2
| | | | | | | | | | | * 4096 cannot be represented in type 'int' Fixes: 2079/clusterfuzz-testcase-minimized-5345861779324928 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit e4efd41b83e78c7f2ee3e74bee90226110743a8e) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/mjpegdec: Check that reference frame matches the current frameMichael Niedermayer2017-06-181-0/+9
| | | | | | | | | | Fixes: out of array read Fixes: 2097/clusterfuzz-testcase-minimized-5036861833609216 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 4705edbbb96e193f51c72248f508ae5693702a48) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/tiff: Avoid loosing allocated geotag valuesMichael Niedermayer2017-06-181-0/+2
| | | | | | | | | | Fixes memleak Fixes: 2076/clusterfuzz-testcase-minimized-6542640243802112 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit d7cbeab4c1381f95ed0ebf85d7950bee96f66164) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/cavs: Fix runtime error: signed integer overflow: -12648062 * 256 ↵Michael Niedermayer2017-06-181-2/+1
| | | | | | | | | | | cannot be represented in type 'int' Fixes: 2067/clusterfuzz-testcase-minimized-5578430902960128 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 1e6ee86d9254e8fd2158cc9a31d3be96b0809411) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/hls: Check local file extensionsMichael Niedermayer2017-06-181-1/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reduces the attack surface of local file-system information leaking. It prevents the existing exploit leading to an information leak. As well as similar hypothetical attacks. Leaks of information from files and symlinks ending in common multimedia extensions are still possible. But files with sensitive information like private keys and passwords generally do not use common multimedia filename extensions. It does not stop leaks via remote addresses in the LAN. The existing exploit depends on a specific decoder as well. It does appear though that the exploit should be possible with any decoder. The problem is that as long as sensitive information gets into the decoder, the output of the decoder becomes sensitive as well. The only obvious solution is to prevent access to sensitive information. Or to disable hls or possibly some of its feature. More complex solutions like checking the path to limit access to only subdirectories of the hls path may work as an alternative. But such solutions are fragile and tricky to implement portably and would not stop every possible attack nor would they work with all valid hls files. Developers have expressed their dislike / objected to disabling hls by default as well as disabling hls with local files. There also where objections against restricting remote url file extensions. This here is a less robust but also lower inconvenience solution. It can be applied stand alone or together with other solutions. limiting the check to local files was suggested by nevcairiel This recommits the security fix without the author name joke which was originally requested by Nicolas. Found-by: Emil Lerner and Pavel Cheremushkin Reported-by: Thierry Foucu <tfoucu@google.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 189ff4219644532bdfa7bab28dfedaee4d6d4021) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/qdrw: Fix null pointer dereferenceMichael Niedermayer2017-06-181-1/+5
| | | | | | | | | | | | | The RGB555 PACKBITSRGN case tries to read a palette, if such palette is actually stored then it accesses a null pointer. All 16bit samples i could find use DIRECTBITSRGN. Fixes: 2065/clusterfuzz-testcase-minimized-6298930457346048 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 46b865ea9f86cbd12e1bf701913263c7932cccb0) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avutil/softfloat: Fix sign error in and improve documentation of av_int2sf()Michael Niedermayer2017-06-181-2/+4
| | | | | | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 6019d721d4c10bf73018d68511d9d0a914c0a389) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/hevc_ps: Fix runtime error: index 32 out of bounds for type 'uint8_t ↵Michael Niedermayer2017-06-181-0/+6
| | | | | | | | | | | [32]' Fixes: 2010/clusterfuzz-testcase-minimized-6209288450080768 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 29808fff339da3e0f26131f7a6209b853947a54b) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/dxv: Check remaining bytes in dxv_decompress_raw()Michael Niedermayer2017-06-181-0/+3
| | | | | | | | | | Fixes: Timeout Fixes: 2006/clusterfuzz-testcase-minimized-5766515037044736 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit eb5049227033d946add93c0714bb8a28d94166f1) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/pafvideo: Check packet size and frame code before ff_reget_buffer()Michael Niedermayer2017-06-181-4/+11
| | | | | | | | | | Fixes 1745/clusterfuzz-testcase-minimized-6160693365571584 Fixes: Timeout Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit faa5a2181df53b5226f998a20b735798addcd365) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/ac3dec_fixed: Fix runtime error: left shift of 419 by 23 places ↵Michael Niedermayer2017-06-181-1/+1
| | | | | | | | | | | cannot be represented in type 'int' Fixes: 1352/clusterfuzz-testcase-minimized-5757565017260032 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 136ce8baa4fc16cf38690cb457f7356c00e00a28) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
View Lorry Controller Status