aboutsummaryrefslogtreecommitdiffstats
path: root/libavformat
Commit message (Collapse)AuthorAgeFilesLines
* avformat/sccdec: Don't use uninitialized data, fix crash, simplify logicAndreas Rheinhardt2022-01-111-39/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Up until now, the scc demuxer not only read the line that it intends to process, but also the next line, in order to be able to calculate the duration of the current line. This approach leads to unnecessary complexity and also to bugs: For the last line, the timing of the next subtitle is not only logically indeterminate, but also uninitialized and the same applies to the duration of the last packet derived from it.* Worse yet, in case of e.g. an empty file, it is not only the duration that is uninitialized, but the whole timing as well as the line buffer itself.** The latter is used in av_strtok(), which could lead to crashes. Furthermore, the current code always outputs at least one packet, even for empty files. This commit fixes all of this: It stops using two lines at a time; instead only the current line is dealt with and in case there is a packet after that, the duration of the last packet is fixed up after having already parsed it; consequently the duration of the last packet is left in its default state (meaning "unknown/up until the next subtitle"). If no further line could be read, processing is stopped; in particular, no packet is output for an empty file. *: Due to stack reuse it seems to be zero quite often; for the same reason Valgrind does not report any errors for a normal input file. **: While ff_subtitles_read_line() claims to always zero-terminate the buffer like snprintf(), it doesn't do so if it didn't read anything. And even if it did, it would not necessarily help here: The current code jumps over 12 bytes that it deems to have read even when it hasn't. Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> (cherry picked from commit 60e12318bb9372b3053703f2a3b849270b9d2fe5)
* avformat/subtitles: Honour ff_subtitles_read_line() documentationAndreas Rheinhardt2022-01-111-0/+1
| | | | | | | | | | It claims to always zero-terminate its buffer like snprintf(), yet it does it not on EOF. Because of this the mcc demuxer used uninitialized values when reading an empty input file. Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> (cherry picked from commit 8766361fc16b6d25ee8be880bf55c9761490cb99)
* avformat/tee: Fix leak of FIFO-options dictionaryAndreas Rheinhardt2022-01-111-0/+2
| | | | | | | Happened for all slaves which didn't use the FIFO. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> (cherry picked from commit 3a27fcb168af07f168e58577f6b3696a8fe74803)
* avformat/tee: Fix leak of stringsAndreas Rheinhardt2022-01-111-0/+2
| | | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> (cherry picked from commit 4df34df642d252ec7849e07812548c417961f9ec)
* avformat/matroskadec: Don't unnecessarily reduce aspect ratioAndreas Rheinhardt2022-01-111-1/+1
| | | | | | | | Fixes ticket #9497. Reviewed-by: James Almer <jamrial@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> (cherry picked from commit 9139dc6140e8fb8d84760f3c567332b41858798d)
* avformat/aadec: Don't use the same loop counter in inner and outer loopAndreas Rheinhardt2022-01-111-2/+2
| | | | | | | | Due to this bush.aa (from the FATE suite) exported garbage metadata with key "_040930". Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> (cherry picked from commit 0a76f8217e0d80d336ad8d9c46523fd3d1262c8c)
* avformat/moflex: Don't use uninitialized timebase for data streamAndreas Rheinhardt2022-01-111-7/+6
| | | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> (cherry picked from commit 38e5ca9310b1a4dbb72fbe28769c9119bb880691)
* lavf/udp: do not return an uninitialized value from udp_open()Anton Khirnov2022-01-111-2/+6
| | | | | | | | (cherry picked from commit 3c2b67446875f925909fa33d8ee14264e11c293d) Signed-off-by: Anton Khirnov <anton@khirnov.net> Conflicts: libavformat/udp.c
* avformat/matroskadec: Reset state also on failure in matroska_reset_status()Michael Niedermayer2021-10-211-7/+12
| | | | | | | | | | | | | The calling code does not handle failures and will fail with assertion failures later. Seeking can always fail even when the position was previously read. Fixes: Assertion failure Fixes: 35253/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-4693059982983168 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit d115eec97929e23fd1b06df2d95f48cf5000eb87) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/wavdec: Check smv_block_sizeMichael Niedermayer2021-10-211-0/+2
| | | | | | | | | | Fixes: Timeout Fixes: 39554/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-4915221701984256 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 849138f476f4b08656681bfc3aec5beac47777fb) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/rmdec: Check for multiple audio_stream_infoMichael Niedermayer2021-10-211-0/+4
| | | | | | | | | | Fixes: memleak Fixes: 39166/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5153276690038784 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 8fe3566b8fdf4bcf5eed419c1aab6eb848287ff3) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* oavformat/avidec: Check offset in odmlMichael Niedermayer2021-10-211-1/+1
| | | | | | | | | | Fixes: signed integer overflow: 9223372036854775807 + 8 cannot be represented in type 'long' Fixes: 38787/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-4859845799444480 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 255a7b423ed5e07536bdc72e993056daa4efe009) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/mpegts: use actually read packet size in mpegts_resync special caseMichael Niedermayer2021-10-211-2/+2
| | | | | | | | | | | Fixes: infinite loop Fixes: 37986/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5292311517462528 - Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Marton Balint <cus@passwd.hu> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 83b2e4c8f15a00f037040131e26e20de83f0d842) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* Revert "avformat/hlsenc: compute video_keyframe_size after write keyframe"Steven Liu2021-10-071-6/+5
| | | | | | | | | | | | This reverts commit b5ca8f2c66954614d81579082025f580efc0cffc. This commit will make new problem about tickets: 9193,9205 It flush data into file with init file context together, and it can get keyframe size, maybe need more method to get keyframe size. Signed-off-by: Steven Liu <liuqi05@kuaishou.com> (cherry picked from commit 59032494e81a1a65c0b960aaae7ec4c2cc9db35a)
* avformat/mov: Fix last mfra checkMichael Niedermayer2021-10-051-2/+2
| | | | | | | | | | Fixes: signed integer overflow: 9223372036854775360 + 536870912 cannot be represented in type 'long' Fixes: 37940/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6095637855207424 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 451ceb5131fa67b0b380d4823981e421909c16db) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/mvdec: Do not set invalid sample rateMichael Niedermayer2021-10-051-2/+3
| | | | | | | | | | | Fixes: signed integer overflow: -682581959642593728 * 16 cannot be represented in type 'long' Fixes: 37883/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5311691517198336 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Peter Ross <pross@xvid.org> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 737e6bf2162b89d396f4d477bfe8c99f1dd885de) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/sbgdec: Check for t0 overflow in expand_tseq()Michael Niedermayer2021-10-051-0/+3
| | | | | | | | | | | Fixes: signed integer overflow: 4611686025627387904 + 4611686025627387904 cannot be represented in type 'long' Fixes: 35489/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-4862678601433088 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Nicolas George <george@nsup.org> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit f624c92d4c6fa73dfa95959d886090af6790bc36) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/rmdec: Use 64bit for intermediate for DEINT_ID_INT4Michael Niedermayer2021-10-051-2/+2
| | | | | | | | | | Fixes: runtime error: signed integer overflow: 65312 * 65535 cannot be represented in type 'int' Fixes: 32832/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-4817710040088576 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit e2c2872393f25253aa40861a9707934c4b83a3af) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/sbgdec: Check opt_duration and start for overflowMichael Niedermayer2021-10-051-0/+3
| | | | | | | | | | Fixes: signed integer overflow: 2788626175500000000 + 7118941284000000000 cannot be represented in type 'long' Fixes: 35215/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6123272247836672 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 2768928624793f66694f7f2b0824f052e69e3557) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/mov: Check for duplicate clliMichael Niedermayer2021-10-051-0/+5
| | | | | | | | | | Fixes: memleak Fixes: 35261/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4869656287510528 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 9a222f140e2674ac936b2f41c480487bc666dd95) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/utils: Ignore negative duration in codec_info_duration computationMichael Niedermayer2021-10-051-1/+1
| | | | | | | | | | Fixes: signed integer overflow: -5994697211974418462 + -3255307777713450286 cannot be represented in type 'long' Fixes: 35332/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-5868035117285376 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 4d81550df9580b454d2530bcb37de20b8354ad6e) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/jacosubdec: Check for min in t overflow in get_shift()Michael Niedermayer2021-10-051-0/+3
| | | | | | | | | | Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself Fixes: 34651/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-5157941012463616 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 989febfbd0c986e9e3e0f269a6b22778bf79147b) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/mxfdec: check channel number in mxf_get_d10_aes3_packet()Michael Niedermayer2021-10-051-0/+4
| | | | | | | | | | | Fixes: Out of array access Fixes: 37030/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5387719147651072 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 3dd5a8a13510d08a4e25e8f138d718672a0fed4a) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/mov: Check dts for overflow in mov_read_trun()Michael Niedermayer2021-09-081-0/+2
| | | | | | | | | | Fixes: signed integer overflow: 9223372034248226491 + 3275247799 cannot be represented in type 'long' Fixes: clusterfuzz-testcase-minimized-audio_decoder_fuzzer-4538729166077952 Reported-by: Matt Wolenetz <wolenetz@google.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 4de4bc06fdfd0383f3d9012c6557a38408a09d28) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/avidec: Use 64bit for frame number in odml index parsingMichael Niedermayer2021-09-081-2/+2
| | | | | | | | | | Fixes: signed integer overflow: 1179337772 + 1392508928 cannot be represented in type 'int' Fixes: 34088/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5846945303232512 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit a4c98c507ed3c729fc92d641b974385f8aa37b33) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/adtsenc: return value check for init_get_bits in adts_decode_extradatamaryam ebrahimzadeh2021-09-081-2/+4
| | | | | | | | | | As the second argument for init_get_bits (buf) can be crafted, a return value check for this function call is necessary. 'buf' is part of 'AVPacket pkt'. replace init_get_bits with init_get_bits8. Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 9ffa49496d1aae4cbbb387aac28a9e061a6ab0a6) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/wtvdec: Check for EOF before seeking back in parse_media_type()Michael Niedermayer2021-09-081-0/+2
| | | | | | | | | | | Fixes: Infinite loop Fixes: 36311/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-4889181296918528 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Peter Ross <pross@xvid.org> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 89505d38de989bddd579ce3b841f1c011f1d7bf2) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/mpc8: Check first keyframe position for overflowMichael Niedermayer2021-09-081-1/+7
| | | | | | | | | | Fixes: signed integer overflow: 9223372036854775791 + 18 cannot be represented in type 'long' Fixes: 36307/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-4917863877050368 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 2bbef69b0ba938cce4f9d61bed46d3f3058e56c2) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/wavdec: Use 64bit in new_pos computationMichael Niedermayer2021-09-081-1/+1
| | | | | | | | | | Fixes: signed integer overflow: 129 * 16711680 cannot be represented in type 'int' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-6742285317439488 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 9b57d2f0a967195dc1c72fda8f3a983a0132a243) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/sbgdec: Check for overflow in timestamp preparationMichael Niedermayer2021-09-081-0/+4
| | | | | | | | | | Fixes: signed integer overflow: 9223372036854775807 + 86400000000 cannot be represented in type 'long' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6731040263634944 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 9dbed908403b0d97ae70881fab68020f148b6b11) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/dsicin: Check packet size for overflowMichael Niedermayer2021-09-081-2/+5
| | | | | | | | | | Fixes: signed integer overflow: 24672 + 2147483424 cannot be represented in type 'int' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_DSICIN_fuzzer-6731325979623424 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 9d1c47ec033d038e04578eaf0767c8983250d03d) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/dsfdec: Change order of operations in bitrate computationMichael Niedermayer2021-09-081-1/+1
| | | | | | | | | | Fixes: signed integer overflow: 538976288 * 67372036 cannot be represented in type 'int' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_DSF_fuzzer-6751696819716096 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 5e38eff284637e9f7c3c25d020df549ca6667e40) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/bfi: check nframesMichael Niedermayer2021-09-081-0/+2
| | | | | | | | | | Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_BFI_fuzzer-6737028768202752 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit b4e77dfca1c2970446f79277034d8e60c3fe3f4e) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/avidec: fix position overflow in avi_load_index()Michael Niedermayer2021-09-081-1/+4
| | | | | | | | | | Fixes: signed integer overflow: 9223372033098784808 + 4294967072 cannot be represented in type 'long' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6732488912273408 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 527821a2dd6f19d9a4d2abe05833346ae86c66c6) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/asfdec_f: Check sizeX against paddingMichael Niedermayer2021-09-081-1/+1
| | | | | | | | | | Fixes: signed integer overflow: 2147483607 + 64 cannot be represented in type 'int' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-6753897878257664 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit f034c2e36acb7d0c11dc1849ddf8a67bde44eff4) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/aiffdec: Check for size overflow in header parsingMichael Niedermayer2021-09-081-0/+3
| | | | | | | | | | Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-6723467048255488 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit bae2e1977744f42d56b85193d4910811de829714) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/mov: Fix incorrect overflow detection in mov_read_sidx()Michael Niedermayer2021-09-081-1/+1
| | | | | | | | | | Fixes: signed integer overflow: 9223372036854775807 + 1442840321 cannot be represented in type 'long' Fixes: 33670/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6644379491106816 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 200406d930eff3202f3230f188f85f4ab9cf4525) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/mov: Avoid undefined overflow in time_offset calculationMichael Niedermayer2021-09-081-1/+5
| | | | | | | | | | Fixes: signed integer overflow: 8511838621821575200 - -3954125146725285889 cannot be represented in type 'long' Fixes: 33414/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6610119325515776 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 7666d588ba1af26ce479e7fb92f7dc5b3a2ca48e) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/mov: do not ignore errors in mov_metadata_hmmt()Michael Niedermayer2021-09-081-0/+2
| | | | | | | | | | Fixes: Timeout Fixes: 35637/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6311060272447488 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit c52c99a18f6e40973e52d99d4bb29e34a66c695a) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/mxfdec: Check size for shrinkingMichael Niedermayer2021-09-081-1/+1
| | | | | | | | | | | av_shrink_packet() takes int size, so size must fit in int Fixes: out of array access Fixes: 35607/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4875541323841536 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 65b862ab59c4bfaae98be596b84a072f52444398) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/matroskadec: Fix handling of huge default durationsMichael Niedermayer2021-09-081-1/+2
| | | | | | | | | | Fixes: negation of -9223372036854775808 cannot be represented in type 'int64_t' (aka 'long'); cast to an unsigned type to negate this value to itself Fixes: 33997/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6752039691485184 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 343d950a4a8a8c32f5f7d9d4ac1fbe317cb9cc80) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/ftp: Check for av_strtok() failureMichael Niedermayer2021-09-081-0/+2
| | | | | | | | Fixes: CID1396258 Dereference null return value Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 9d40782088cf969fbadc881e4a97ec22b8ae0177) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/aaxdec: Check avio_seek() in header readingMichael Niedermayer2021-09-081-4/+11
| | | | | | | | | | Fixes: Timeout Fixes: 32450/clusterfuzz-testcase-minimized-ffmpeg_dem_AAX_fuzzer-4875522262827008 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 602bbf71f683dc564822c39070c42246d2c2b5e2) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/rmdec: Check old_format len for overflowMichael Niedermayer2021-09-081-3/+5
| | | | | | | | | | | | | Maybe such large values could be disallowed earlier and closer to where they are set. Fixes: signed integer overflow: 538976288 * 8224 cannot be represented in type 'int' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6704350354341888 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 06d174e289eb185f03a34a738965f0042f39c038) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/realtextdec: Check the pts difference before using it for the ↵Michael Niedermayer2021-09-081-1/+2
| | | | | | | | | | | | duration computation Fixes: signed integer overflow: 5404200000 - -9223372031709351616 cannot be represented in type 'long' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_REALTEXT_fuzzer-6737340551790592 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit fe12aa689003db9b07a6e1b837031dcc57a71435) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/qcp: Avoid negative nb_ratesMichael Niedermayer2021-09-081-1/+2
| | | | | | | | | | Fixes: signed integer overflow: 2 * -1725947872 cannot be represented in type 'int' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_QCP_fuzzer-6726807632084992 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 1b865cc703d29cb307e1fa628aa02940d54eb42a) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/pp_bnk: Use 64bit in bitrate computationMichael Niedermayer2021-09-081-1/+1
| | | | | | | | | | Fixes: signed integer overflow: 1207959552 * 4 cannot be represented in type 'int' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_PP_BNK_fuzzer-6747301169201152 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 88fc295838b3cf16b43c0bbea5766fe92b18dd17) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/nutdec: Check tmp_sizeMichael Niedermayer2021-09-081-0/+5
| | | | | | | | | | Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6739990530883584 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 1ca00b5e44f21840b608e238fa135a1aab6e576b) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/msf: Check that channels doesnt overflow during extradata constructionMichael Niedermayer2021-09-081-0/+2
| | | | | | | | | | Fixes: signed integer overflow: 2048 * 1122336 cannot be represented in type 'int' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_MSF_fuzzer-6726959600107520 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit a1a277926b49dad60d9e78c6c7a8c6b5d0d6d7c9) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/subtitles: Check pts difference before useMichael Niedermayer2021-09-081-1/+1
| | | | | | | | | | Fixes: signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'long' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_MPL2_fuzzer-6747053545881600 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit e7a990164f67108e99ec5adb8b2d636cd4147715) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-17 00:33:18 +0000