Commits on Jan 24, 2019

  1. avfilter/af_silenceremove: fix possible crash if supplied duration is… 

    … negative

Signed-off-by: Paul B Mahol <onemda@gmail.com>

Fixes ticket #7697.
(cherry picked from commit 2d1594a)
    @richardpl @cehoyos
    richardpl authored and cehoyos committed Jan 24, 2019
    4321092

Commits on Mar 21, 2019

  1. avcodec/hevcdec: decode at most one slice reporting being the first i… 

    …n the picture

Fixes deadlocks when decoding packets containing more than one of the aforementioned
slices when using frame threads.

Tested-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 70c8c8a)
    @jamrial
    jamrial committed Mar 21, 2019
    a06cd02

Commits on Mar 24, 2019

  1. avutil/mem: Optimize fill32() by unrolling and using 64bit 

    Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 12b1338)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Mar 24, 2019
    8ea2558

  2. avcodec/fic: Check that there is input left in fic_decode_block() 

    Fixes: Timeout
Fixes: 12450/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FIC_fuzzer-5661984622641152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit db1c4ac)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Mar 24, 2019
    20337eb

  3. avformat/rtsp: Clear reply in every iteration in ff_rtsp_connect() 

    Fixes: Infinite loop

Found-by: Michael Hanselmann <public@hansmi.ch>
Reviewed-by: Michael Hanselmann <public@hansmi.ch>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0b50f27)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Mar 24, 2019
    e5ea21a

  4. avformat/rtsp: Check number of streams in sdp_parse_line() 

    Fixes: OOM

Found-by: Michael Hanselmann <public@hansmi.ch>
Reviewed-by: Michael Hanselmann <public@hansmi.ch>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 497c9b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Mar 24, 2019
    d116540

  5. avcodec/pgssubdec: Check for duplicate display segments 

    In such a duplication the previous gets overwritten and leaks

Fixes: memleak
Fixes: 12510/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGSSUB_fuzzer-5694439226343424

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e35c3d8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Mar 24, 2019
    98b5ec4

  6. avformat/mov.c: require tfhd to begin parsing trun 

    Detecting missing tfhd avoids re-using tfhd track info from the previous
moof. For files with multiple tracks, this may make a mess of the
avindex and fragindex, which can later trigger av_assert0 in
mov_read_trun().

Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3ea87e5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    @chcunningham
    chcunningham authored and Michael Niedermayer committed Mar 24, 2019
    90c1947

  7. avformat/mov: validate chunk_count vs stsc_data 

    Bad content may contain stsc boxes with a first_chunk index that
exceeds stco.entries (chunk_count). This ammends the existing check to
include cases where chunk_count == 0. It also patches up the case
when stsc refers to unknown chunks, but stts has no samples (so we
can simply ignore stsc).

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1c15449)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    @chcunningham
    chcunningham authored and Michael Niedermayer committed Mar 24, 2019
    750ec96

  8. avformat/matroskadec: Do not leak queued packets on sync errors 

    Fixes: memleak
Fixes: clusterfuzz-testcase-minimized-audio_decoder_fuzzer-5649187601121280

Reported-by: Chris Cunningham <chcunningham@google.com>
Tested-by: Chris Cunningham <chcunningham@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d1afa72)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Mar 24, 2019
    f84464c

  9. avformat/ftp: Fix Out-of-Bounds Access and Information Leak in ftp.c:393 

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a142ffd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    @leonwxqian
    leonwxqian authored and Michael Niedermayer committed Mar 24, 2019
    dacc00a

  10. avformat/http: Fix Out-of-Bounds access in process_line() 

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 85f91ed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    @leonwxqian
    leonwxqian authored and Michael Niedermayer committed Mar 24, 2019
    a0692be

  11. avformat/webmdashenc: Check id in adaption_sets 

    Fixes: out of array access

Found-by: Wenxiang Qian
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b687b54)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Mar 24, 2019
    0213519

  12. avcodec/h264_direct: Fix overflow in POC comparission 

    Fixes: runtime error: signed integer overflow: 2147421862 - -33624063 cannot be represented in type 'int'
Fixes: 12885/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5733516975800320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5ccf296)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Mar 24, 2019
    5773985

  13. avcodec/jvdec: Check available input space before decode8x8() 

    Fixes: Timeout (78 sec -> 15 millisec)
Fixes: 13147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JV_fuzzer-5727107827630080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6152368)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Mar 24, 2019
    fdf19ce

  14. avcodec/zmbv: obtain frame later 

    The frame is not needed that early so obtaining it later avoids
the costly operation in case other checks fail.

Fixes: Timeout (14sec -> 4sec)
Fixes: 13140/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZMBV_fuzzer-5738330308739072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 177b408)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Mar 24, 2019
    715b526

  15. avcodec/mlpdec: Insuffient typo 

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fc32e08)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Mar 24, 2019
    e9dbc7b

  16. avcodec/error_resilience: Use a symmetric check for skipping MV estim… 

    …ation

This speeds up the testcase by a factor of 4

Fixes: Timeout
Fixes: 13100/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV2_fuzzer-5767533905313792

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e4289cb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Mar 24, 2019
    8a59803

  17. avcodec/jpeg2000dwt: Fix integer overflow in dwt_decode97_int() 

    Fixes: runtime error: signed integer overflow: 2147483598 + 128 cannot be represented in type 'int'
Fixes: 12926/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5705100733972480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4801eea)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Mar 24, 2019
    6299f85

  18. avcodec/bethsoftvideo: Check block_type 

    Fixes: Timeout (17 seconds -> 1 second)
Fixes: 13184/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BETHSOFTVID_fuzzer-5711446296494080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b8ecade)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Mar 24, 2019
    4e5a17e

  19. avcodec/aic: Check remaining bits in aic_decode_coeffs() 

    Fixes: Timeout (78 seconds -> 2 seconds)
Fixes: 13186/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AIC_fuzzer-5639516533030912

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 951bb76)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Mar 24, 2019
    8c69d65

  20. avcodec/qpeg: Limit copy in qpeg_decode_intra() to the available bytes 

    Fixes: Timeout (27 sec -> 39 milli sec)
Fixes: 13151/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QPEG_fuzzer-5717536023248896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b819472)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Mar 24, 2019
    5ff9505

  21. avcodec/cdgraphics: Use ff_set_dimensions() 

    Fixes: Timeout (17 sec -> 65 milli sec)
Fixes: 13264/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CDGRAPHICS_fuzzer-5711167941509120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9a9f0e2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Mar 24, 2019
    bed614b

  22. avcodec/dvbsubdec: Check object position 

    Reference: ETSI EN 300 743 V1.2.1  7.2.2 Region composition segment

Fixes: Timeout
Fixes: 13325/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DVBSUB_fuzzer-5143979392237568

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a8c5ae4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Mar 24, 2019
    5d28b2d

  23. avcodec/dfa: Check the chunk header is not truncated 

    Fixes: Timeout (11sec -> 3sec)
Fixes: 13218/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DFA_fuzzer-5661074316066816

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f20760f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Mar 24, 2019
    9e96567

Commits on Mar 25, 2019

  1. avcodec/truemotion2: Fix integer overflow in tm2_null_res_block() 

    Fixes: signed integer overflow: 1111638592 - -2122219136 cannot be represented in type 'int'
Fixes: 13441/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5732769815068672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1223696)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Mar 25, 2019
    e20e5b3

Commits on Mar 27, 2019

  1. lavc/bmp: Avoid a heap buffer overwrite for 1bpp input. 

    Found by Mingi Cho, Seoyoung Kim, and Taekyoung Kwon
of the Information Security Lab, Yonsei University.

(cherry picked from commit 1e34014)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    @cehoyos
    cehoyos authored and Michael Niedermayer committed Mar 27, 2019
    0eeea04

  2. avcodec/hevcdec: Avoid only partly skiping duplicate first slices 

    Fixes: NULL pointer dereference and out of array access
Fixes: 13871/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5746167087890432
Fixes: 13845/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5650370728034304

This also fixes the return code for explode mode

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5465562)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Mar 27, 2019
    cbfd062

Commits on Apr 1, 2019

  1. avcodec/rscc: Check that the to be uncompressed input is large enough 

    Fixes: Out of array access
Fixes: 13984/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RSCC_fuzzer-5734128093233152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3a0ec15)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Apr 1, 2019
    544f5fc

Commits on Apr 21, 2019

  1. avcodec/truemotion2: Fix integer overflow in tm2_decode_blocks() 

    Fixes: signed integer overflow: 255 + 2147483634 cannot be represented in type 'int'
Fixes: 13472/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5712444142387200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ad0533)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Apr 21, 2019
    5f7ab54

  2. avcodec/diracdec: Use 64bit in intermediate of global motion vector f… 

    …ield generation

It seems the specification does not limit the value to 32bit

Fixes: signed integer overflow: -109611143 * 24 cannot be represented in type 'int'
Fixes: 13477/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5648337460527104

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 837820f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Apr 21, 2019
    49881ea

  3. avcodec/ivi: Move buffer/block end check to caller of ivi_dc_transform() 

    Fixes: assertion failure
Fixes: 14078/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO5_fuzzer-5760571284127744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 110dce9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Apr 21, 2019
    3b29945

  4. avcodec/ccaption_dec: Add a blank like at the end to avoid rollup rea… 

    …ding from outside

Fixes: index 20 out of bounds for type 'const char *[4][128]'
Fixes: 14367/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CCAPTION_fuzzer-5718819672162304

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f17e8e9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed Apr 21, 2019
    0dd99b0

Commits on May 9, 2019

  1. avformat/aadec: Check for scanf() failure 

    Fixes: use of uninitialized variables
Fixes: blank.aa

Found-by: Chamal De Silva <chamal.desilva@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ed188f6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed May 9, 2019
    b5b12e2

  2. avformat/mov: Skip stsd adjustment without chunks 

    Fixes: Assertion failure
Fixes: clusterfuzz-testcase-minimized-media_pipeline_integration_fuzzer-5683096400822272

Found-by: Clusterfuzz
Reported-by: Dan Sanders <sandersd@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 18a567c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed May 9, 2019
    d203563

  3. avutil/avstring: Fix bug and undefined behavior in av_strncasecmp() 

    The function in case of n=0 would read more bytes than 0.
The end pointer could be beyond the allocated space, which
is undefined.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6f0e9a8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed May 9, 2019
    3905ace

  4. avcodec/aacdec_fixed: Fix undefined shift in noise_scale() 

    Fixes: 13655/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_FIXED_fuzzer-5120559430500352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8ea211a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed May 9, 2019
    3adb156

  5. avcodec/jpeg2000: Check stepsize before using it 

    Fixes: value 1.87633e+10 is outside the range of representable values of type 'int'
Fixes: Undefined behavior
Fixes: 14246/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5758393601490944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 06ef186)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed May 9, 2019
    485546e

  6. avcodec/truemotion2: Fix 2 integer overflows in tm2_update_block() 

    Fixes: signed integer overflow: -2147483648 + -1 cannot be represented in type 'int'
Fixes: 14107/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5694078680825856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f4a1b8d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed May 9, 2019
    430850d

  7. avcodec/jvdec: Use ff_get_buffer() when the content is not reused 

    Fixes: Timeout (11sec -> 5sec)
Fixes: 14473/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JV_fuzzer-5761630857592832

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 09edcd3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed May 9, 2019
    2d64c35

Commits on May 10, 2019

  1. Update for 3.2.14 

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed May 10, 2019
    e38fc0a

Commits on May 11, 2019

  1. lavf/webm_chunk: Respect buffer size 

    The last argument of av_strlcpy is supposed to contain the size of the
destination buffer, but it was filled with the size of the source
string, effectively negating its very purpose.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 73ef1f4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    @mkver
    mkver authored and Michael Niedermayer committed May 11, 2019
    9fad760

Commits on May 12, 2019

  1. avcodec/hq_hqa: Check available space before reading slice offsets 

    Fixes: Timeout (43sec -> 18sec)
Fixes: 14556/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-5673543024508928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 407e7c3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed May 12, 2019
    a649b62

Commits on May 13, 2019

  1. libswcale: Fix possible string overflow in test. 

    In libswcale/tests/swcale.c, the function fileTest() calls sscanf in
an argument of "%12s" on character srcStr[] and dstStr[], which are
only 12 bytes.  So, if the input string is 12 characters, a
terminating null byte can be written past the end of these arrays.

This bug was found by cppcheck.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b8ed493)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    @adamjrichter
    adamjrichter authored and Michael Niedermayer committed May 13, 2019
    280f5c4

  2. Changelog: update 

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed May 13, 2019
    3a6bcc0

  3. avcodec/htmlsubtitles: Be a bit more picky on syntax 

    This reduces the number of strstr() calls per byte
This diasalows empty tags like '< >' as well as '<' in tags like '<ab<cd<<ef>'

Fixes timeout
Fixes: 1817/clusterfuzz-testcase-minimized-5104230530547712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c61715e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed May 13, 2019
    abdbbe8

  4. avcodec/htmlsubtitles: Fixes denial of service due to use of sscanf i… 

    …n inner loop for tag scaning

Fixes: [Semmle Security Reports #19438]
Fixes: dos_sscanf1.mkv

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1f00c97)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Kevin Backhouse via RT authored and Michael Niedermayer committed May 13, 2019
    23ccf3c

  5. avcodec/htmlsubtitles: Fixes denial of service due to use of sscanf i… 

    …n inner loop for handling braces

Fixes: [Semmle Security Reports #19439]
Fixes: dos_sscanf2.mkv

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 894995c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Kevin Backhouse via RT authored and Michael Niedermayer committed May 13, 2019
    273f275

  6. Changelog: Update 

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
    Michael Niedermayer committed May 13, 2019
    ba11e40