Commits · n4.3.8 · sixue.cheng / ffmpeg-7.1

05 Aug, 2024 4 commits

Changelog: update · 2ece1f83
Michael Niedermayer authored 10 months ago
```
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
```
2ece1f83

avcodec/parser: ensure input padding is zeroed · 64426fd6


Fixes use of uninitialized value, reported by MSAN.

Found by OSS-Fuzz.
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>

Fixes: 70852/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5179190066872320
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5dfc0cc8

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

64426fd6

avformat/img2dec: Clear padding data after EOF · d7256bf0

Michael Niedermayer authored 10 months ago

Fixes: use-of-uninitialized-value
Fixes: 70852/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5179190066872320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Reviewed-by: Kacper Michajlow <kasper93@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3978e818

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

d7256bf0

avformat/wavdec: Check if there are 16 bytes before testing them · d5a411f3

Michael Niedermayer authored 10 months ago

Fixes: use-of-uninitialized-value
Fixes: 70839/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5212907590189056

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 79a1cf30

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

d5a411f3

31 Jul, 2024 2 commits

avcodec/snow: Fix off by 1 error in run_buffer · 205732d4

Michael Niedermayer authored 10 months ago

Fixes: out of array access
Fixes: 70741/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5703668010647552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 06f5ed40

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

205732d4

avcodec/utils: apply the same alignment to YUV410 as we do to YUV420 for snow · 09f16093

Michael Niedermayer authored 1 year ago

The snow encoder uses block based motion estimation which can read out of array if
insufficient alignment is used

It may be better to only apply this for the encoder, as it would safe a few bytes of memory
for the decoder. Until then, this fixes the issue in a simple way.

Fixes: out of array access
Fixes: 68963/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-4979988435632128
Fixes: 68969/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-6239933667803136.fuzz
Fixed: 70497/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5751882631413760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 58fbeb59

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

09f16093

24 Jul, 2024 4 commits

update for 4.3.8 · a8975a3b
Michael Niedermayer authored 11 months ago
```
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
```
a8975a3b

avcodec/diracdsp: Remove unused variable · 57851936

Andreas Rheinhardt authored 4 years ago

Forgotten in ca3c6c98

.
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 310d4062

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

57851936

avcodec/vaapi_encode: Check hwctx · 0f75b041

Michael Niedermayer authored 11 months ago

Fixes: null pointer dereference
Fixes: 70376/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_VAAPI_fuzzer-4733551250046976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3cd077e2

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

0f75b041

avcodec/proresdec: Consider negative bits left · e346c742

Michael Niedermayer authored 11 months ago

Fixes: 70036/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PRORES_fuzzer-6298797647396864
Fixes: shift exponent 40 is too large for 32-bit type 'uint32_t' (aka 'unsigned int')

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 419eee63

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

e346c742

23 Jul, 2024 1 commit

avcodec/hevc/hevcdec: Do not allow slices to depend on failed slices · 999720f8

Michael Niedermayer authored 1 year ago

An alternative would be to leave the context unchanged on failure of hls_slice_header()

Fixes: out of array access
Fixes: NULL pointer dereference
Fixes: 69584/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5931086299856896
Fixes: 69724/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5104066422702080
Fixes: 70422/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5908731129298944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5d9544cf

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

999720f8

22 Jul, 2024 22 commits

avutil/slicethread: Check pthread_*_init() for failure · 23af4eac

Michael Niedermayer authored 11 months ago


Fixes: CID1604383 Unchecked return value
Fixes: CID1604439 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 23851c9e

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

23af4eac

avutil/frame: Check log2_crop_align · 17a8081d

Michael Niedermayer authored 11 months ago


Fixes: CID1604586 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 15540b3d

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

17a8081d

avutil/buffer: Check ff_mutex_init() for failure · fcef4eb0

Michael Niedermayer authored 11 months ago


Fixes: CID1604487 Unchecked return value
Fixes: CID1604494 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 82f5b20f

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

fcef4eb0

avformat/xmv: Check this_packet_size · 3cc8b4b4

Michael Niedermayer authored 11 months ago


Fixes: CID1604489 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 696685df

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

3cc8b4b4

avformat/ty: rec_size seems to only need 32bit · c31d0108

Michael Niedermayer authored 11 months ago


May help CID1604560 Overflowed integer argument

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit be309135

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

c31d0108

avformat/tty: Check avio_size() · 7c6f9c87

Michael Niedermayer authored 11 months ago


Fixes: CID1220824 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 41745e55

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

7c6f9c87

avformat/siff: Basic pkt_size check · 72bca563

Michael Niedermayer authored 11 months ago


Fixes: half of CID1258461 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 124a97dd

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

72bca563

avformat/sauce: Check avio_size() for failure · e3f7976c

Michael Niedermayer authored 11 months ago


Fixes: CID1604592 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 759aae59

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

e3f7976c

avformat/sapdec: Check ffurl_get_file_handle() for error · aa3cdc08

Michael Niedermayer authored 11 months ago


Fixes: CID1604506 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3e305a0e

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

aa3cdc08

avformat/nsvdec: Check asize for PCM · a1524dbc

Michael Niedermayer authored 11 months ago


Fixes: CID1604527 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e83e2465

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

a1524dbc

avformat/mp3dec: Check header_filesize · 1c1f537e

Michael Niedermayer authored 11 months ago


Fixes: CID1608714 Division or modulo by float zero

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cea4dbc9

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

1c1f537e

avformat/mp3dec; Check for avio_size() failure · f21ba27c

Michael Niedermayer authored 11 months ago


Fixes: CID1608710 Improper use of negative value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bb936a1a

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

f21ba27c

avformat/mov: Use 64bit for str_size · 02e6d29c

Michael Niedermayer authored 11 months ago


We assign a 64bit variable to it before checking

Fixes: CID1604544 Overflowed integer argument

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 046d0695

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

02e6d29c

avformat/mm: Check length · 000b9de9

Michael Niedermayer authored 11 months ago


Fixes: CID1220824 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 139bf412

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

000b9de9

avformat/hnm: Check *chunk_size · adabe1aa

Michael Niedermayer authored 11 months ago


Fixes: CID1604419 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 291356f5

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

adabe1aa

avformat/hlsenc: Check ret · a7c43833

Michael Niedermayer authored 11 months ago


Fixes: CID1609624 Unused value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7e577165

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

a7c43833

avformat/bintext: Check avio_size() return · f96036e4

Michael Niedermayer authored 11 months ago


Fixes: CID1604503 Overflowed constant
Fixes: CID1604566 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bf61f811

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

f96036e4

avformat/asfdec_o: Check size of index object · 5364d0de

Michael Niedermayer authored 11 months ago


We subtract 24 so it must be at least 24

Fixes: CID1604482 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 891bc070

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

5364d0de

avfilter/scale_eval: Use 64bit, check values in ff_scale_adjust_dimensions() · 8860326a

Michael Niedermayer authored 11 months ago


Found by reviewing CID1513722 Operands don't affect result

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ad9df8bc

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

8860326a

avfilter/vf_lut3d: Check av_scanf() · 0ca34161

Michael Niedermayer authored 11 months ago


Fixes: CID1604398 Unchecked return value
Fixes: CID1604542 Unchecked return value

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ace2e257

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

0ca34161

avfilter/vf_deshake_opencl: Ensure that the first iteration initializes the best variables · 75de958c

Michael Niedermayer authored 1 year ago


Fixes: CID1452759 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9385847a

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

75de958c

swscale/output: Fix integer overflows in yuv2rgba64_X_c_template · 3cfd197b

Michael Niedermayer authored 11 months ago

Fixes: signed integer overflow: -1082982400 + -1068681048 cannot be represented in type 'int'
Fixes: 69995/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-6285740271534080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bcab9789

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

3cfd197b

21 Jul, 2024 7 commits

avformat/mxfdec: Reorder elements of expression in bisect loop · 4a04c96f

Michael Niedermayer authored 11 months ago

Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented in type 'long'
Fixes: 68578/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6032171648221184

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d8d28847

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

4a04c96f

avcodec/pnmdec: Use 64bit for input size check · da2240cc

Michael Niedermayer authored 11 months ago


Fixes: out of array read
Fixes: poc3

Reported-by: VulDB CNA Team
Found-by: CookedMelon
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3faadbe2

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

da2240cc

avcodec/utvideoenc: Use unsigned shift to build flags · 4430a979

Michael Niedermayer authored 1 year ago

Fixes: left shift of 255 by 24 places cannot be represented in type 'int'
Fixes: 69083/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_UTVIDEO_fuzzer-5608202363273216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 69e90491

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

4430a979

avcodec/vc2enc: Fix overflows with storing large values · 2c7d8469

Michael Niedermayer authored 1 year ago

Fixes: left shift of 1431634944 by 2 places cannot be represented in type 'int'
Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int'
Fixes: 69061/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC2_fuzzer-6325700826038272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit af993583

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

2c7d8469

avcodec/mpegvideo_enc: Do not duplicate pictures on shifting · 0e2bff1a

Michael Niedermayer authored 1 year ago

Fixes: out of array access
Fixes: 69098/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG2VIDEO_fuzzer-6107989688778752
Fixes: 69599/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4848626296225792.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9c8881cb

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

0e2bff1a

avcodec/tiff: Check value on positive signed targets · 35be459c

Michael Niedermayer authored 11 months ago


Fixes: CID1604593 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 66d6b803

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

35be459c

avfilter/vf_bm3d: Dont round MSE2SSE to an integer · 8e35cb8c

Michael Niedermayer authored 1 year ago


Fixes: CID1439581 Result is not floating-point

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ec18ec9f

)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

8e35cb8c

GitLab

Menu