git.videolan.org Git - ffmpeg.git/rss log

Les articles publiés sur le site

• avcodec/hevc/hevcdec : Check num_entry_point_offsets

  8 mai, par Michael Niedermayer

  avcodec/hevc/hevcdec: Check num_entry_point_offsets
  
  The code uses int, unsigned int and uint16_t to store num_entry_point_offsets
  This limits it to the smallest of the 3.
  Alternatively uint16_t can be changed and then a larger limit used.
  A Check will still be needed.
  
  Fixes: 391974932/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5966648879677440
  Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
  
  Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
  Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
  

  • [DH] libavcodec/hevc/hevcdec.c

• avcodec/hevc/ps : Fix dependant layer id check

  8 mai, par Michael Niedermayer

  avcodec/hevc/ps: Fix dependant layer id check
  
  Fixes: shift exponent 49 is too large for 32-bit type 'int'
  Fixes: 398060145/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5023082406543360
  
  Reviewed-by: James Almer <jamrial@gmail.com>
  Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
  Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
  

  • [DH] libavcodec/hevc/ps.c

• avcodec/rv60dec : inter also fails with qp >= 32

  8 mai, par Michael Niedermayer

  avcodec/rv60dec: inter also fails with qp >= 32
  
  Fixes: out of array read in decode_cu_16x16()
  Fixes: 398049430/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV60_fuzzer-5525836849807360
  
  Reviewed-by: Peter Ross <pross@xvid.org>
  Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
  Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
  

  • [DH] libavcodec/rv60dec.c

• avformat/iff : Check nb_channels == 0 in MHDR

  8 mai, par Michael Niedermayer

  avformat/iff: Check nb_channels == 0 in MHDR
  
  Fixes: division by 0
  Fixes: 395163171/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-542604339373670
  
  Reviewed-by: Peter Ross <pross@xvid.org>
  Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
  Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
  

  • [DH] libavformat/iff.c

• avcodec/speexdec : Pass and check remaining packets to decode functions

  8 mai, par Michael Niedermayer

  avcodec/speexdec: Pass and check remaining packets to decode functions
  
  Fixes: out of array access
  Fixes: 394638693/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SPEEX_fuzzer-4868142996455424
  
  Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
  Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
  

  • [DH] libavcodec/speexdec.c