| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
ff_read_packet had potential memleaks:
1. If av_packet_make_refcounted fails, it means that the packet is not
refcounted, but it could nevertheless carry side data and therefore
needs to be unreferenced.
2. If putting a packet on a packet list fails, it wasn't unreferenced.
Furthermore, read_frame_internal leaked a packet's (side) data if a
context update was required and failed.
Signed-off-by: Andreas Rheinhardt <[email protected]>
Signed-off-by: James Almer <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
| |
There is currently an ordinary check for this (which would lead to a
memleak), but given that no demuxer should ever return a packet with an
invalid stream_index it is more appropriate for this to be an assert.
FATE passes with this change.
Signed-off-by: Andreas Rheinhardt <[email protected]>
Signed-off-by: James Almer <[email protected]>
|
|
|
|
|
|
| |
Fix #5090
Fix the timestamp rescale issue, from sidx timebase to
stream's timebase.
|
|
|
|
|
|
| |
This reverts commit eb5d0f18ff609ba2280cea4e2c6286d216c8756b.
Together with 89f464e9, it breaks decoding of tiff files like fate-suite/exif/image_small.tiff
|
|
|
|
|
| |
Signed-off-by: Limin Wang <[email protected]>
Signed-off-by: James Almer <[email protected]>
|
| |
|
| |
|
| |
|
| |
|
|
|
|
| |
Fixes #8163, #8164, #8165.
|
|
|
|
| |
Fixes #8151
|
|
|
|
|
|
| |
This checks max_samples at the same level as max_pixels
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
| |
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
| |
Signed-off-by: Michael Niedermayer <[email protected]>
|
| |
|
| |
|
| |
|
|
|
|
| |
Fixes #8199.
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
| |
need to free the header in error path.
Reviewed-by: Michael Niedermayer <[email protected]>
Signed-off-by: Jun Zhao <[email protected]>
|
|
|
|
| |
Signed-off-by: Guo, Yejun <[email protected]>
|
|
|
|
| |
Signed-off-by: Guo, Yejun <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
4650975 -> 4493240 dezicycles
This optimizes lines 2 and later. Line 1 still uses av_memcpy_backptr()
This change originally fixed ossfuzz 10790 but this is now fixed by other
optimizations already
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
| |
Fixes: Infinite loop
Fixes: 16920/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5653421289373696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
initilaized
Fixes: Timeout (53sec -> 31sec)
Fixes: 16908/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5711207859748864
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
| |
Fixes: Timeout (191sec -> 53sec)
Fixes: 16908/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5711207859748864
Fixes: 10709/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5630617975259136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
| |
Fixes: signed integer overflow: 238 * 16843009 cannot be represented in type 'int'
Fixes: 16958/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMACKER_fuzzer-5193905355620352
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
| |
Fixes: left shift of negative value -256
Fixes: 16892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-4880802642395136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
| |
Fixes: signed integer overflow: -2147483648 * -1 cannot be represented in type 'int'
Fixes: 16786/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5632818851348480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
Several subtitle demuxers set negative durations
Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented in type 'long'
Fixes: 16925/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5766519790764032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
| |
Fixes: signed integer overflow: 9223371075321077760 * 2 cannot be represented in type 'long'
Fixes: 16447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5698937431785472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
| |
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
| |
Fixes: OOM
Fixes: 16726/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5719320750981120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
| |
Fixes: memleaks
Fixes: 16788/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5649873898045440
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
| |
Fixes: Timeout (73sec ->30ms)
Fixes: 16921/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5689384594046976
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
| |
Fixes: Timeout (35sec -> 6sec)
Fixes: 16901/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEGVIDEO_fuzzer-5729024726269952
Fixes: 16901/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEGVIDEO_fuzzer-5642388592132096
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
The decoder is slow
Fixes: Timeout (94sec -> 7sec)
Fixes: 16417/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MSS2_fuzzer-5711668050395136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
If adding an SEI message to an access unit fails, said SEI message was
not touched, so that the caller had to free any data associated with it
that might need to be freed. But given that ff_cbs_h264_add_sei_message
can simply call cbs_h264_free_sei_payload, one can easily free
the content of the SEI payload.
This fixes a memleak when inserting a user data unregistered string for
h264_metadata fails.
Signed-off-by: Andreas Rheinhardt <[email protected]>
|
|
|
|
|
|
|
|
| |
Fixes: signed integer overflow: 61 + 2147483647 cannot be represented in type 'int'
Fixes: 15311/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_fuzzer-5742552826773504
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
| |
This avoids some invalid shifts
Reviewed-by: Andreas Rheinhardt <[email protected]>
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
| |
Fixes: out of array access
Fixes: 17608/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_MTAF_fuzzer-5074936267276288
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <[email protected]>
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
| |
Signed-off-by: Timo Rothenpieler <[email protected]>
|
| |
|
|
|
|
|
| |
Signed-off-by: Limin Wang <[email protected]>
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
| |
Fixes CID 1453867, CID 1453866, CID 1453865.
Signed-off-by: Moritz Barsnick <[email protected]>
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
| |
Signed-off-by: Timo Rothenpieler <[email protected]>
|
|
|
|
|
|
|
| |
This can happen when av_bsf_free() is called on av_bsf_alloc() failure.
Reviewed-by: Paul B Mahol <[email protected]>
Signed-off-by: James Almer <[email protected]>
|
| |
|