ffmpeg.git
5 months agoavcodec/x86/pngdsp: add missing emms at the end of add_png_paeth_prediction release/4.2
James Almer [Tue, 16 Sep 2025 01:18:52 +0000 (22:18 -0300)]
avcodec/x86/pngdsp: add missing emms at the end of add_png_paeth_prediction

Fixes unpredictable behavior with floats.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 57a29f2e7dd2374a1df27316c6cf7c0225e86758)

9 months agoUpdate for 4.2.11 n4.2.11
Michael Niedermayer [Fri, 16 May 2025 01:08:43 +0000 (03:08 +0200)]
Update for 4.2.11

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/takdec: Check remaining space for first predictors
Michael Niedermayer [Sun, 11 May 2025 21:09:07 +0000 (23:09 +0200)]
avcodec/takdec: Check remaining space for first predictors

Fixes: Timeout
Fixes: 403673829/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-5498240154009600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8e6db875afcd147d48718130fde4a05c3ac406db)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/sonic: Check num_taps
Michael Niedermayer [Sat, 10 May 2025 23:08:06 +0000 (01:08 +0200)]
avcodec/sonic: Check num_taps

The encoder uses max 128 taps, which is quiet a lot already
If work is done to improve sonic, it will be more radical than changing the taps

Fixes: Timeout
Fixes: 402539974/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-6122944271286272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fd0a792766c8ae513dd849fc47fa9e899cc5664b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/mov: reject negative ELST durations
Michael Niedermayer [Sat, 10 May 2025 21:39:53 +0000 (23:39 +0200)]
avformat/mov: reject negative ELST durations

Fixes: multiple integer overflows
Fixes: 401016767/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6242067591790592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9fc2702f6f502064d0d2d75c97ece33f4b56eb84)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/h264_mb: Fix tmp_cr for arm
Michael Niedermayer [Wed, 16 Apr 2025 00:25:00 +0000 (02:25 +0200)]
avcodec/h264_mb: Fix tmp_cr for arm

When decoding a bitstream with weighted-bipred enabled,
the results on ARM and x86 platforms may differ.

The reason for the inconsistency is that the value of
STRIDE_ALIGN differs between platforms. And STRIDE_ALIGN
is set to the buffer stride of temporary buffers for U
and V components in mc_part_weighted.

If the buffer stride is 32 or 64 (as on x86 platforms),
the U and V pixels can be interleaved row by row without
overlapping, resulting in correct output.
However, on ARM platforms where the stride is 16,
the V component did overwrite part of the U component's pixels,
leading to incorrect predicted pixels.

The bug can be reproduced by the following bitstream.

https://trac.ffmpeg.org/attachment/ticket/11357/inter_weighted_bipred2.264

Fixes: ticket 11357
Commit-msg-mostly-by: Bin Peng <pengbin@visionular.com>
Reviewed-by: Bin Peng <pengbin@visionular.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 74fd2c3ddbaf1fef5c4777784aa72b5747ad389c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/vorbisdec: Dont treat overread as error
Michael Niedermayer [Sun, 6 Apr 2025 14:49:31 +0000 (16:49 +0200)]
avcodec/vorbisdec: Dont treat overread as error

This differs from libvorbis by
stddev:    2.44 PSNR: 88.58 MAXDIFF:   41 bytes:   834304/   834304
for the file from the ticket

Fixes: Ticket11427

Regression since: dc89cf804a811c0d25f4649a99f7fab4b5b416fa

This is a similar solution to what james proposed earlier in
[FFmpeg-devel] [PATCH] avcodec/vorbisdec: don't abort on EOD when decoding residuals

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fd5a3c5fed2c190446b2beb9bc532887db360cf7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agolibpostproc: check minimum size
Michael Niedermayer [Thu, 1 May 2025 19:20:31 +0000 (21:20 +0200)]
libpostproc: check minimum size

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 917c15435ae2e11a90de5d1a1153405bd3686fbe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/hls: add fmp4 to allowed_extensions
Michael Niedermayer [Sun, 6 Apr 2025 10:47:34 +0000 (12:47 +0200)]
avformat/hls: add fmp4 to allowed_extensions

Fixes: yt-dlp/issues/12700

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d82016c7302e0ede8626fc3d92f1418c567fbab4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/hls: Add ec3 to allowed_extensions
Michael Niedermayer [Sun, 6 Apr 2025 10:43:12 +0000 (12:43 +0200)]
avformat/hls: Add ec3 to allowed_extensions

Fixes part of Ticket11435
Fixes: Elisa Viihde (Finnish online recording service)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 68644994fd7cf55613e8b17bcc95b29226285ec5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/hls: Add cmfv and cmfa to allowed_extensions
Michael Niedermayer [Sun, 6 Apr 2025 10:30:04 +0000 (12:30 +0200)]
avformat/hls: Add cmfv and cmfa to allowed_extensions

Fixes: www.nicovideo.jp
Fixes: Ticket11526
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2352145e416c7cbdcf9679ea690c9c1dee4a7936)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoconfigure: Clearer documentation for "disable-safe-bitstream-reader"
Michael Niedermayer [Mon, 24 Mar 2025 01:57:46 +0000 (02:57 +0100)]
configure: Clearer documentation for "disable-safe-bitstream-reader"

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 979608dde7a833b7af50a9f6bad81fc483c1ff04)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoswscale/output: Fix integer overflow in yuv2gbrp_full_X_c()
Michael Niedermayer [Tue, 4 Feb 2025 02:58:44 +0000 (03:58 +0100)]
swscale/output: Fix integer overflow in yuv2gbrp_full_X_c()

Fixes: signed integer overflow: 1966895953 + 210305024 cannot be represented in type 'int'
Fixes: 391921975/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5916798905548800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce538ef97a7b1fdab6f2a3c8afc538c1cc3760d9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/libtheora: fix setting keyframe_mask
James Almer [Fri, 7 Feb 2025 03:04:25 +0000 (00:04 -0300)]
avcodec/libtheora: fix setting keyframe_mask

t_info.keyframe_granule_shift is set to the library default of 6, which is ok
for gop sizes up to 63. Since there's apparently no way to query the updated
value after having forced a gop value with TH_ENCCTL_SET_KEYFRAME_FREQUENCY_FORCE,
calculate it manually instead.

Fixes ticket #11454.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 22aa71d4da37a4ad2b0d28deeace64b57aa2ef50)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavfilter/buffersrc: check for valid sample rate
James Almer [Mon, 30 Dec 2024 03:25:41 +0000 (00:25 -0300)]
avfilter/buffersrc: check for valid sample rate

A sample rate <= 0 is invalid.

Fixes an assert in ffmpeg_enc.c that assumed a valid sample rate would be set.
Fixes ticket #11385.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 1446e37d3d032e1452844778b3e6ba2c20f0c322)

9 months agodoc: replace http/git by https urls
Michael Niedermayer [Tue, 1 Apr 2025 00:00:41 +0000 (02:00 +0200)]
doc: replace http/git by https urls

These are more secure

Reviewed-by: Gyan Doshi <ffmpeg@gyani.pro>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b4d165c68fe74f4b9c7fa4cbc2e1467a0bafea37)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoconfigure: update copyright year
Lynne [Wed, 1 Jan 2025 09:03:33 +0000 (18:03 +0900)]
configure: update copyright year

On 01/01/2025 19:05, Peter Ross wrote:
> FFmpeg turns 25 this year.

(cherry picked from commit d3aa99a4f436e89773246339d9d363587a1d21df)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavfilter/bwdif: account for chroma sub-sampling in min size calculation
Cosmin Stejerean [Wed, 6 Dec 2023 10:39:32 +0000 (18:39 +0800)]
avfilter/bwdif: account for chroma sub-sampling in min size calculation

The current logic for detecting frames that are too small for the
algorithm does not account for chroma sub-sampling, and so a sample
where the luma plane is large enough, but the chroma planes are not
will not be rejected. In that event, a heap overflow will occur.

This change adjusts the logic to consider the chroma planes and makes
the change to all three bwdif implementations.

Fixes #10688

Signed-off-by: Cosmin Stejerean <cosmin@cosmin.at>
Reviewed-by: Thomas Mundt <tmundt75@gmail.com>
Signed-off-by: Philip Langdale <philipl@overt.org>
(cherry picked from commit 737ede405b11a37fdd61d19cf25df296a0cb0b75)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/iff: Check that we have a stream in read_dst_frame()
Michael Niedermayer [Sun, 9 Feb 2025 00:28:17 +0000 (01:28 +0100)]
avformat/iff: Check that we have a stream in read_dst_frame()

Fixes: null pointer dereference
Fixes: 385644864/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4551049565765632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8668957ef604bd2b99175310638bc5031ae0d991)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/mlvdec: fix size checks
Michael Niedermayer [Fri, 7 Feb 2025 01:33:21 +0000 (02:33 +0100)]
avformat/mlvdec: fix size checks

Fixes: heap-buffer-overflow
Fixes: 391962476/clusterfuzz-testcase-minimized-ffmpeg_dem_MLV_fuzzer-5746746587676672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 251d43aef0df9262f2688c1c848af993bbb67d08)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/mxfdec: Check edit unit for overflow in mxf_set_current_edit_unit()
Michael Niedermayer [Wed, 5 Feb 2025 02:47:52 +0000 (03:47 +0100)]
avformat/mxfdec: Check edit unit for overflow in mxf_set_current_edit_unit()

Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'long'
Fixes: 392672068/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6232335892152320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8a6ad9eab2f1c37a18c2f30e6660260edd7c0c16)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/h263dec: Check against previous dimensions instead of coded
Michael Niedermayer [Thu, 30 Jan 2025 01:28:32 +0000 (02:28 +0100)]
avcodec/h263dec: Check against previous dimensions instead of coded

Fixes: out of array access
Fixes: crash-a41ef3db699013f669b076f02f36942925f5a98c

Found-by: Kacper Michajlow <kasper93@gmail.com>
Reviewed-by: Kacper Michajlow <kasper93@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0fe33c99a26a06a6875c4abfb96362a65145264b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/mxfdec: Check avio_read() success in mxf_decrypt_triplet()
Michael Niedermayer [Mon, 23 Sep 2024 18:05:37 +0000 (20:05 +0200)]
avformat/mxfdec: Check avio_read() success in mxf_decrypt_triplet()

Fixes: Use of uninitialized memory
Fixes: 71444/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5448597561212928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6ecc96f4d08d74b0590ab03f39f93f386910c4c0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/huffyuvdec: Initialize whole output for decode_gray_bitstream()
Michael Niedermayer [Sat, 30 Nov 2024 00:48:22 +0000 (01:48 +0100)]
avcodec/huffyuvdec: Initialize whole output for decode_gray_bitstream()

Fixes: use of uninitialized memory
Fixes: 375286238/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-6352546854141952

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ef71552cf970876085d99834abdb8e429aea9730)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/ipmovie: Check signature_buffer read
Michael Niedermayer [Thu, 26 Dec 2024 02:07:51 +0000 (03:07 +0100)]
avformat/ipmovie: Check signature_buffer read

Fixes: use of uninitilaized data
Fixes: 385167047/clusterfuzz-testcase-minimized-ffmpeg_dem_IPMOVIE_fuzzer-5941477505564672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 788abe0d253b2034af15876d7889265d4746df2b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/wtvdec: Initialize buf
Michael Niedermayer [Thu, 26 Dec 2024 01:53:45 +0000 (02:53 +0100)]
avformat/wtvdec: Initialize buf

ff_parse_mpeg2_descriptor() reads over what is initialized
Fixes: use of uninitialized memory
Fixes: 383825645/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-5144130618982400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 17b019c517af26c6d2f0c6266938c60d36db1fa3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/cbs_vp9: Initialize VP9RawSuperframeIndex
Michael Niedermayer [Wed, 1 Jan 2025 04:03:08 +0000 (05:03 +0100)]
avcodec/cbs_vp9: Initialize VP9RawSuperframeIndex

Fixes: use-of-uninitialized-value
Fixes: 70907/clusterfuzz-testcase-minimized-ffmpeg_BSF_VP9_METADATA_fuzzer-6339363208757248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e81d410242ea604c4f667da4a415836c1575d72f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/vqf: Check avio_read() in add_metadata()
Michael Niedermayer [Thu, 26 Dec 2024 00:46:49 +0000 (01:46 +0100)]
avformat/vqf: Check avio_read() in add_metadata()

Fixes: use of uninitialized data
Fixes: 383825642/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5380168801124352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c43dbecbdad152a91eadc7538b545852eee562ae)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/dashdec: Check whitelist
Michael Niedermayer [Wed, 15 Jan 2025 23:22:05 +0000 (00:22 +0100)]
avformat/dashdec: Check whitelist

Fixes: CVE-2023-6602, V. DASH Playlist SSRF

Found-by: Harvey Phillips of Amazon Element55 (element55)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4c96d6bf75357ab13808efc9f08c1b41b1bf5bdf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavutil/avstring: dont mess with NULL pointers in av_match_list()
Michael Niedermayer [Wed, 15 Jan 2025 02:30:21 +0000 (03:30 +0100)]
avutil/avstring: dont mess with NULL pointers in av_match_list()

Fixes: applying zero offset to null pointer

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c6c54943d161812b3c4034116cb14f3f5c05dc43)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/mpegvideo_enc: Check FLV1 resolution limits
Michael Niedermayer [Wed, 8 Jan 2025 01:59:28 +0000 (02:59 +0100)]
avcodec/mpegvideo_enc: Check FLV1 resolution limits

Found-by: Elias Myllymäki <elias.myllymaki04p@gmail.com>
Reviewed-by: Alexander Strasser <eclipse7@gmx.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 827c073154f4cc17d1bd3777dff3b58370210bcb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/ffv1enc: Fix handling of 32bit unsigned symbols
Michael Niedermayer [Thu, 9 Jan 2025 20:35:06 +0000 (21:35 +0100)]
avcodec/ffv1enc: Fix handling of 32bit unsigned symbols

This may be needed for floats

Sponsored-by: Sovereign Tech Fund
Reviewed-by: Alexander Strasser <eclipse7@gmx.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 402824e9e99461f1c9e74a6730ced40894669560)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/vc1dec: Clear block_index in vc1_decode_reset()
Michael Niedermayer [Sun, 1 Dec 2024 22:30:55 +0000 (23:30 +0100)]
avcodec/vc1dec: Clear block_index in vc1_decode_reset()

Fixes: 377965565/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-4504434689769472
Fixes: out of array access

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 251de1791e645f16e80b09d82999d4a5e24b1ad1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/aacsbr_template: Clear n_q on error
Michael Niedermayer [Sun, 1 Dec 2024 21:27:18 +0000 (22:27 +0100)]
avcodec/aacsbr_template: Clear n_q on error

Fixes: index 5 out of bounds for type 'uint8_t [5]'
Fixes: 377748135/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5167109774049280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3f029bfb7f9ca1c73fecb8d0eacf3c4e0550f771)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoswscale/output: Fix undefined overflow in yuv2rgba64_full_X_c_template()
Michael Niedermayer [Sun, 1 Dec 2024 02:25:09 +0000 (03:25 +0100)]
swscale/output: Fix undefined overflow in yuv2rgba64_full_X_c_template()

Fixes: signed integer overflow: -1082982400 + -1195645138 cannot be represented in type 'int'
Fixes: 376136843/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-4791844321427456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 56faee21c136942c491f30a2e82cfbbfce180beb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavfilter/af_pan: Fix sscanf() use
Michael Niedermayer [Mon, 6 Jan 2025 21:01:39 +0000 (22:01 +0100)]
avfilter/af_pan: Fix sscanf() use

Fixes: Memory Data Leak

Found-by: Simcha Kosman <simcha.kosman@cyberark.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b5b6391d64807578ab872dc58fb8aa621dcfc38a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/rmdec: check that buf if completely filled
Michael Niedermayer [Fri, 16 Aug 2024 12:47:42 +0000 (14:47 +0200)]
avformat/rmdec: check that buf if completely filled

Fixes: use of uninitialized value
Fixes: 70988/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5298245077630976

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9578c135d00dd9cc01491b8559d7fad5a387e90d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/hapdec: Clear tex buffer
Michael Niedermayer [Sun, 11 Aug 2024 21:15:32 +0000 (23:15 +0200)]
avcodec/hapdec: Clear tex buffer

The code following makes no attempt to initialize all of the buffer

Fixes: use of uninitialized value
Fixes: 70980/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HAP_fuzzer-5329909059223552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7eeeda703b599847aa89c7c08bb433d0b3da9590)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/mxfdec: Check that key was read sucessfull
Michael Niedermayer [Sun, 11 Aug 2024 20:53:47 +0000 (22:53 +0200)]
avformat/mxfdec: Check that key was read sucessfull

Fixes: use of uninitialized value
Fixes: 70932/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4870202133643264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4c62cbcae2612acbc7ab5e8a7e7815674a6e8df4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/rpl: Fix check for negative values
Michael Niedermayer [Mon, 18 Nov 2024 03:09:11 +0000 (04:09 +0100)]
avformat/rpl: Fix check for negative values

Fixes: signed integer overflow: 10 * -1923267925333400000 cannot be represented in type 'int64_t' (aka 'long')
Fixes: 378891963/clusterfuzz-testcase-minimized-fuzzer_loadfile_direct-5714338935013376
Found-by: ossfuzz
Reported-by: Kacper Michajlow <kasper93@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eab65379bf89c55d8ec4bc6f00e04f15b37d3d85)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/mlvdec: Check avio_read()
Michael Niedermayer [Wed, 25 Dec 2024 04:13:02 +0000 (05:13 +0100)]
avformat/mlvdec: Check avio_read()

Fixes: use-of-uninitialized-value
Fixes: 383170476/clusterfuzz-testcase-minimized-ffmpeg_dem_MLV_fuzzer-4696002884337664

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bb85423142103d694d97bad1967bd3dc55440e71)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/utils: Fix block align overflow for ADPCM_IMA_WAV
Michael Niedermayer [Wed, 11 Dec 2024 21:37:07 +0000 (22:37 +0100)]
avcodec/utils: Fix block align overflow for ADPCM_IMA_WAV

Fixes: signed integer overflow: 529008646 * 8 cannot be represented in type 'int'
Fixes: 383379145/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-6674045107503104

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 93270930798da368d5b1954a73ef7ff9dfa48f73)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/matroskadec: Check pre_ns for overflow
Michael Niedermayer [Wed, 11 Dec 2024 20:36:11 +0000 (21:36 +0100)]
avformat/matroskadec: Check pre_ns for overflow

Fixes: signed integer overflow: -3483479120376300096 - 7442323944145700864 cannot be represented in type 'long'
Fixes: 383187489/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4561470580391936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 361d24e6d920e4f7e4e5fa1fd6fbb6922bff35f2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/webp: Check ref_x/y
Michael Niedermayer [Fri, 16 Aug 2024 14:00:01 +0000 (16:00 +0200)]
avcodec/webp: Check ref_x/y

Fixes: 70991/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WEBP_fuzzer-5544067620995072
Fixes: use of uninintailized value

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7c1e732ad2e240af5afe9ffea443c91bb233aa65)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/ilbcdec: Initialize tempbuff2
Michael Niedermayer [Mon, 23 Sep 2024 17:57:28 +0000 (19:57 +0200)]
avcodec/ilbcdec: Initialize tempbuff2

Fixes: Use of uninitialized value
Fixes: 71350/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ILBC_fuzzer-6322020827070464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4482218440534804d067de00ee1a4bc493c8b41d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/dxa: check bpc
Michael Niedermayer [Fri, 18 Oct 2024 23:15:53 +0000 (01:15 +0200)]
avformat/dxa: check bpc

Fixes: integer overflow: -2147483648 - 1 cannot be represented in type 'int'
Fixes: 373971762/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-4880491112103936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7e020f21413269418180eea7933a94ecb6bf2ef8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoswscale/slice: clear allocated memory in alloc_lines()
Michael Niedermayer [Fri, 18 Oct 2024 22:08:03 +0000 (00:08 +0200)]
swscale/slice: clear allocated memory in alloc_lines()

Fixes: use of uninitialized memory in hScale16To15_c()
Fixes: 373924007/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5841199968092160

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aeec39f3c1be82863efe64ce95242de58e075e8f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/icodec: fix integer overflow with nb_pal
Michael Niedermayer [Sun, 3 Nov 2024 10:07:27 +0000 (11:07 +0100)]
avformat/icodec: fix integer overflow with nb_pal

Fixes: runtime error: signed integer overflow
Fixes: 42536949/clusterfuzz-testcase-minimized-fuzzer_loadfile-6199846684393472
Found-by: ossfuzz
Reported-by: Kacper Michajlow
Tested-by: Kacper Michajlow
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 84569b6c22cb4eda9c682aabeb5f658112126780)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agodoc/developer: Document relationship between git accounts and MAINTAINERS
Michael Niedermayer [Sat, 16 Nov 2024 20:32:53 +0000 (21:32 +0100)]
doc/developer: Document relationship between git accounts and MAINTAINERS

This should have been documented long ago and i thought it was

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7051825b0171bd5d566c5a5cc78852c5f3aa3072)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/vividas: Check avio_read() for failure
Michael Niedermayer [Sun, 3 Nov 2024 19:54:29 +0000 (20:54 +0100)]
avformat/vividas: Check avio_read() for failure

Fixes: use of uninitialized value (untested)
Fixes: 42537627/clusterfuzz-testcase-minimized-fuzzer_loadfile_direct-5505802505355264

Found-by: ossfuzz
Reported-by: Kacper Michajlow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 96d45c3b212689f82bff2530c3637405df9e9369)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/ilbc: Check avio_read() for failure
Michael Niedermayer [Sun, 3 Nov 2024 19:47:07 +0000 (20:47 +0100)]
avformat/ilbc: Check avio_read() for failure

Fixes: use of uninitialized value
Fixes: 42537627/clusterfuzz-testcase-minimized-fuzzer_protocol_memory-6656646223298560-cut

Found-by: ossfuzz
Reported-by: Kacper Michajlow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e30d957a9bacf7f7307c640aa0bd1e70cb3bbe7e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/nistspheredec: Clear buffer
Michael Niedermayer [Sun, 3 Nov 2024 19:43:21 +0000 (20:43 +0100)]
avformat/nistspheredec: Clear buffer

Fixes: use-of-uninitialized-value
Fixes: 42537627/clusterfuzz-testcase-minimized-fuzzer_protocol_memory-6515855798632448-cut

Found-by: ossfuzz
Reported-by: Kacper Michajlow
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 898f6582eb51bf77b1f88e8f55eab67ee6ee13b8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoINSTALL: explain the circular dependency issue and solution
Michael Niedermayer [Sat, 2 Nov 2024 17:23:50 +0000 (18:23 +0100)]
INSTALL: explain the circular dependency issue and solution

Sponsored-by: Sovereign Tech Fund
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit df00705e0010cc2c53d17d51944f847c2c852189)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/mpegts: Initialize predefined_SLConfigDescriptor_seen
Michael Niedermayer [Wed, 9 Oct 2024 21:44:00 +0000 (23:44 +0200)]
avformat/mpegts: Initialize predefined_SLConfigDescriptor_seen

Fixes: use of uninitialized variable
Fixes: 368729566/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTS_fuzzer-6044501804646400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit db7b4fc89fb18d5ff0a1426bd433c234555a3fff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/mxfdec: Fix overflow in midpoint computation
Michael Niedermayer [Wed, 9 Oct 2024 18:47:34 +0000 (20:47 +0200)]
avformat/mxfdec: Fix overflow in midpoint computation

Fixes: signed integer overflow: 4611686016549392399 + 9223372033098784800 cannot be represented in type 'long long'
Fixes: 368503277/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5928227458056192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 23088a5ff2b549fa4fc037bb9ed833fffbc89ca0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/rangecoder: only perform renorm check/loop for callers that need it
Michael Niedermayer [Wed, 16 Oct 2024 12:39:20 +0000 (14:39 +0200)]
avcodec/rangecoder: only perform renorm check/loop for callers that need it

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d147b3d7ecba2bd40cb45284f920238da97a95ee)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/ffv1dec: Fix end computation with ec=2
Michael Niedermayer [Thu, 10 Oct 2024 18:39:23 +0000 (20:39 +0200)]
avcodec/ffv1dec: Fix end computation with ec=2

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 10e5af15bf220d9da128ca12d2d474ff6ab0076e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/ffv1enc: Prevent generation of files with broken slices
Michael Niedermayer [Tue, 1 Oct 2024 20:06:40 +0000 (22:06 +0200)]
avcodec/ffv1enc: Prevent generation of files with broken slices

Fixes: Ticket5548

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b7ff66a35804275b25c1176cad560540785e8750)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/matroskadec: Check desc_bytes so bits fit in 64bit
Michael Niedermayer [Sun, 28 Jul 2024 20:08:23 +0000 (22:08 +0200)]
avformat/matroskadec: Check desc_bytes so bits fit in 64bit

Likely a tighter check can be done

Fixes: signed integer overflow: 3305606804154370442 * 8 cannot be represented in type 'long'
Fixes: 70449/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4771166007918592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c4122406f6d2726aea833480a2a8e345833dd881)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/ffv1enc: Correct error message about unsupported version
Michael Niedermayer [Tue, 1 Oct 2024 20:04:58 +0000 (22:04 +0200)]
avcodec/ffv1enc: Correct error message about unsupported version

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 556c767786e9e3c072f7666d60a68a31a3400438)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/ffv1enc: Slice combination is unsupported
Michael Niedermayer [Fri, 6 Oct 2023 20:23:33 +0000 (22:23 +0200)]
avcodec/ffv1enc: Slice combination is unsupported

We always write minimal slices, the size calculation is wrong in some
corner cases but as its always 1x1 (minus1) we can for now just hard-code it

This helps with ticket 5548

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7d514655bfa47c6e5cc1b81fbba8e750e368036e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/ffv1enc: 2Pass mode is not possible with golomb coding
Michael Niedermayer [Mon, 30 Sep 2024 21:42:50 +0000 (23:42 +0200)]
avcodec/ffv1enc: 2Pass mode is not possible with golomb coding

"Fixes" Ticket7063

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 417b163c00555ccda201a963e797bfa663a26ff5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/ffv1enc: Fix >8bit context size
Michael Niedermayer [Tue, 24 Sep 2024 21:43:09 +0000 (23:43 +0200)]
avcodec/ffv1enc: Fix >8bit context size

Fixes: Ticket5405

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a9c83e43f2fc9128e20851291b0270add1a6b95f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/xan: Add basic input size check
Michael Niedermayer [Sun, 22 Sep 2024 21:15:35 +0000 (23:15 +0200)]
avcodec/xan: Add basic input size check

Fixes: Timeout
Fixes: 71739/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_XAN_WC3_fuzzer-6170301405134848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpe
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 56bef2fd58d0ed30dbe940083c30ada2b0404491)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/svq3: Check for minimum size input
Michael Niedermayer [Sun, 22 Sep 2024 18:31:58 +0000 (20:31 +0200)]
avcodec/svq3: Check for minimum size input

Fixes: Timeout
Fixes: 71295/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-4999941125111808

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 050b5e85cbe61414ba9b78f76a04b2488e816f42)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/eacmv: Check input size for intra frames
Michael Niedermayer [Thu, 19 Sep 2024 21:57:31 +0000 (23:57 +0200)]
avcodec/eacmv: Check input size for intra frames

Fixes: Timeout
Fixes: 71135/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EACMV_fuzzer-6251879028293632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c3a1cbbf5d99337b5e99260eb95c84e65c7587f6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/jfdctint_template: use unsigned z* in row_fdct()
Michael Niedermayer [Thu, 19 Sep 2024 19:57:09 +0000 (21:57 +0200)]
avcodec/jfdctint_template: use unsigned z* in row_fdct()

Fixes: signed integer overflow: 856827136 + 2123580416 cannot be represented in type 'int'
Fixes: 70772/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PRORES_KS_fuzzer-5180569961431040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f27c8b04d3059fa538db8f2db6503cbb586eb3ad)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/mxfdec: More offset_temp checks
Michael Niedermayer [Thu, 12 Sep 2024 20:29:04 +0000 (22:29 +0200)]
avformat/mxfdec: More offset_temp checks

Fixes: signed integer overflow: 9223372036854775807 - -1927491430256034080 cannot be represented in type 'long'
Fixes: 70607/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5282235077951488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5a96aa435af0d66bdec52ee115cf4dd971855fcd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoswscale/output: Fix undefined integer overflow in yuv2rgba64_2_c_template()
Michael Niedermayer [Thu, 12 Sep 2024 20:51:53 +0000 (22:51 +0200)]
swscale/output: Fix undefined integer overflow in yuv2rgba64_2_c_template()

Fixes: signed integer overflow: -1082982400 + -1083218484 cannot be represented in type 'int'
Fixes: 70657/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-6707819712675840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bd80c97391969f9dbb312d6c498211ad85bb67cb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoswscale/swscale: Use unsigned operation to avoid undefined behavior
Michael Niedermayer [Thu, 12 Sep 2024 18:08:42 +0000 (20:08 +0200)]
swscale/swscale: Use unsigned operation to avoid undefined behavior

I have not checked that the constant is correct, this just fixes the undefined behavior

Fixes: signed integer overflow: -646656 * 3517 cannot be represented in type 'int
Fixes: 70559/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5209368631508992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 44c5641ae82387fcfce94820f5b53ce8e9dcd27f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/vc2enc: basic sanity check on slice_max_bytes
Michael Niedermayer [Thu, 12 Sep 2024 18:03:55 +0000 (20:03 +0200)]
avcodec/vc2enc: basic sanity check on slice_max_bytes

Fixes: left shift of 896021632 by 3 places cannot be represented in type 'int'
Fixes: 70544/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC2_fuzzer-6685593652756480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6df9a0292ca6c29ef3b220fbf9b257924cabf035)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/mvdec: Check if name was fully read
Michael Niedermayer [Wed, 14 Aug 2024 22:37:05 +0000 (00:37 +0200)]
avformat/mvdec: Check if name was fully read

Fixes: use of uninitialized value
Fixes: 70901/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-6341913949569024

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4e39795c75e664ef06f17473adec8c75fcf9de6f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/wmavoice: Do not use uninitialized pitch[0]
Michael Niedermayer [Wed, 14 Aug 2024 22:37:04 +0000 (00:37 +0200)]
avcodec/wmavoice: Do not use uninitialized pitch[0]

Fixes: use of uninitialized value
Fixes: 70850/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMAVOICE_fuzzer-4806127362048000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 53387079301690f1bd38b97fdf31d63194201d17)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/apetag: Check APETAGEX
Michael Niedermayer [Mon, 19 Aug 2024 15:02:12 +0000 (17:02 +0200)]
avformat/apetag: Check APETAGEX

Fixes: Use of uninitialized value
Fixes: 71074/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5697034877730816

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 796ff2d599449ed798b69ab798ebcbcc0a5853f5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/avcodec: Warn about data returned from get_buffer*()
Michael Niedermayer [Fri, 16 Aug 2024 23:11:50 +0000 (01:11 +0200)]
avcodec/avcodec: Warn about data returned from get_buffer*()

Text based on suggestion by: epirat07@gmail.com
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 93444c46fce195e378c4ebb1a20ea662e7f0123b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/aic: Clear slice_data
Michael Niedermayer [Sun, 4 Aug 2024 20:30:03 +0000 (22:30 +0200)]
avcodec/aic: Clear slice_data

Fixes: use-of-uninitialized-value
Fixes: 70865/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AIC_fuzzer-4874102695854080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit de3f6c8888bcf3df4ca6cb265a83507b95c884cd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/vc1dec: Clear mb_type_base and ttblk_base
Michael Niedermayer [Sun, 4 Aug 2024 20:15:08 +0000 (22:15 +0200)]
avcodec/vc1dec: Clear mb_type_base and ttblk_base

Fixes: two use-of-uninitialized-value
Fixes: 70856/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5539349918187520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 50471f96c4a68874575ab21f799c5999ed920838)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/shorten: clear padding
Michael Niedermayer [Sun, 4 Aug 2024 20:10:48 +0000 (22:10 +0200)]
avcodec/shorten: clear padding

Fixes: use-of-uninitialized-value
Fixes: 70854/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5533480570650624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e44349ee88418ac16051bbc9231c1bfdc25d3504)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/mpeg: Check an avio_read() for failure
Michael Niedermayer [Sun, 4 Aug 2024 19:27:44 +0000 (21:27 +0200)]
avformat/mpeg: Check an avio_read() for failure

Fixes: use-of-uninitialized-value
Fixes: 70849/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGPS_fuzzer-4684401009557504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 66ee75d76ce56a3553a99d67e74b8a9970c18f5b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/segafilm: Set keyframe
Michael Niedermayer [Tue, 6 Aug 2024 16:02:58 +0000 (18:02 +0200)]
avformat/segafilm: Set keyframe

Fixes: use of uninitialized value
Fixes: 70871/clusterfuzz-testcase-minimized-ffmpeg_dem_SEGAFILM_fuzzer-5883617752973312

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4dc7dfe65aaa21801a907c66592b92b05da921dc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/dxva2: initialize hr in ff_dxva2_common_end_frame()
Michael Niedermayer [Sun, 26 May 2024 20:33:11 +0000 (22:33 +0200)]
avcodec/dxva2: initialize hr in ff_dxva2_common_end_frame()

Related: CID1591924 Uninitialized scalar variable
Related: CID1591938 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1d6a2aebae202652feb5964a2d62bdba4e5cc6e4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/dxva2: initialize validate
Michael Niedermayer [Sun, 26 May 2024 20:28:04 +0000 (22:28 +0200)]
avcodec/dxva2: initialize validate

Related: CID1591915 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2232c4cc8c3d64dec4e4399b58e057f5dbb9ff98)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/dxva2: Initialize ConfigBitstreamRaw
Michael Niedermayer [Sun, 26 May 2024 20:23:16 +0000 (22:23 +0200)]
avcodec/dxva2: Initialize ConfigBitstreamRaw

Related: CID1591894 Uninitialized scalar variable
Related: CID1591906 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 489c05b9c3ea7d856b7a81abce247721b3b3d6e8)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/dxva2: Initialize dxva_size and check it
Michael Niedermayer [Sun, 26 May 2024 20:13:28 +0000 (22:13 +0200)]
avcodec/dxva2: Initialize dxva_size and check it

Related: CID1591878 Uninitialized scalar variable
Related: CID1591928 Uninitialized pointer read

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c8c59e99295f9ef572b5d6f0fd9075bb2b79acbd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavfilter/vf_tonemap_opencl: Dereference after NULL check
Michael Niedermayer [Wed, 10 Jul 2024 21:47:46 +0000 (23:47 +0200)]
avfilter/vf_tonemap_opencl: Dereference after NULL check

Fixes: CID1437472 Dereference before null check

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e5c0f56ca09b4cb4ea87a61547218f9c818b52d7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/lmlm4: Eliminate some AVERROR(EIO)
Michael Niedermayer [Sat, 13 Jul 2024 07:16:48 +0000 (09:16 +0200)]
avformat/lmlm4: Eliminate some AVERROR(EIO)

Found by code review related to CID732224 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 191a685010319cb0d248771574c7c61d76e4eb95)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/wtvdec: Check length of read mpeg2_descriptor
Michael Niedermayer [Tue, 6 Aug 2024 22:18:53 +0000 (00:18 +0200)]
avformat/wtvdec: Check length of read mpeg2_descriptor

Fixes: Use of uninitialized value
Fixes: 70900/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-6286909377150976

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c390234da2e3c7a8884f5592f0b9b4928c482b3e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/wtvdec: clear sectors
Michael Niedermayer [Tue, 6 Aug 2024 22:18:51 +0000 (00:18 +0200)]
avformat/wtvdec: clear sectors

The code can leave uninitialized holes in the array.
Fixes: use of uninitialized values
Fixes: 70883/clusterfuzz-testcase-minimized-ffmpeg_dem_WTV_fuzzer-6698694567591936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c95ea0310468e0a0906fa7d590ff7406c39d6991)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavcodec/parser: ensure input padding is zeroed
Kacper Michajłow [Thu, 27 Jun 2024 00:40:35 +0000 (02:40 +0200)]
avcodec/parser: ensure input padding is zeroed

Fixes use of uninitialized value, reported by MSAN.

Found by OSS-Fuzz.

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
Fixes: 70852/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5179190066872320
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5dfc0cc84129758b4eab2acdc3e186c3116deacd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/img2dec: Clear padding data after EOF
Michael Niedermayer [Sun, 4 Aug 2024 20:00:35 +0000 (22:00 +0200)]
avformat/img2dec: Clear padding data after EOF

Fixes: use-of-uninitialized-value
Fixes: 70852/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5179190066872320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Kacper Michajlow <kasper93@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3978e81809a3daf278199849f7bbeacbffb9fa09)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 months agoavformat/wavdec: Check if there are 16 bytes before testing them
Michael Niedermayer [Sat, 3 Aug 2024 17:45:15 +0000 (19:45 +0200)]
avformat/wavdec: Check if there are 16 bytes before testing them

Fixes: use-of-uninitialized-value
Fixes: 70839/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5212907590189056

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 79a1cf30d1289f90da682263ba160f6e4a5a7bf1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
13 months agovp9: recon: Use emulated edge to prevent buffer overflows
Janne Grunau [Fri, 3 Jan 2025 00:54:40 +0000 (01:54 +0100)]
vp9: recon: Use emulated edge to prevent buffer overflows

The arm/aarch64 horizontal filter reads one additional pixel beyond what
the filter uses. This can become an issue if the application does not
allocate larger buffers than what's required for the pixel data. If the
motion vector points to the bottom right edge of the picture this
becomes a read buffer overflow. This triggers segfaults in Firefox for
video resolutions which result in a page aligned picture size like
1280x640.
Prevent this by using emulated edge in this case.

Fixes: https://bugzilla.mozilla.org/show_bug.cgi?id=1881185
Signed-off-by: Janne Grunau <janne-ffmpeg@jannau.net>
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 060464105bdca82b8cfb91c7a6fb56df4c7cd9d0)

13 months agoarm: vp9mc: Load only 12 pixels in the 4 pixel wide horizontal filter
Janne Grunau [Fri, 3 Jan 2025 00:54:39 +0000 (01:54 +0100)]
arm: vp9mc: Load only 12 pixels in the 4 pixel wide horizontal filter

This reduces the amount the horizontal filters read beyond the filter
width to a consistent 1 pixel. The data is not used so this is usually
not noticeable. It becomes a problem when the application allocates
frame buffers only for the aligned picture size and the end of it is at
a page boundary. This happens for picture sizes which are a multiple of
the page size like 1280x640. The frame buffer allocation is based on
its most likely done via mmap + MAP_ANONYMOUS so start and end of the
buffer are page aligned and the previous and next page are not
necessarily mapped.
This mirrors the aarch64 change.

Signed-off-by: Janne Grunau <janne-ffmpeg@jannau.net>
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit f3662562156c9b908588b1e58e4203fd09217cb6)

13 months agoaarch64: vp9mc: Load only 12 pixels in the 4 pixel wide horizontal filter
Janne Grunau [Fri, 3 Jan 2025 00:54:38 +0000 (01:54 +0100)]
aarch64: vp9mc: Load only 12 pixels in the 4 pixel wide horizontal filter

This reduces the amount the horizontal filters read beyond the filter
width to a consistent 1 pixel. The data is not used so this is usually
not noticeable. It becomes a problem when the application allocates
frame buffers only for the aligned picture size and the end of it is at
a page boundary. This happens for picture sizes which are a multiple of
the page size like 1280x640. The frame buffer allocation is based on
its most likely done via mmap + MAP_ANONYMOUS so start and end of the
buffer are page aligned and the previous and next page are not
necessarily mapped.
Under these conditions like seen by Firefox a read beyond the end of the
buffer results in a segfault.
After the over-read is reduced to a single pixel it's reasonable to use
VP9's emulated edge motion compensation for this.

Fixes: https://bugzilla.mozilla.org/show_bug.cgi?id=1881185
Signed-off-by: Janne Grunau <janne-ffmpeg@jannau.net>
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 430c38f698a65d597e863330810b05e083682be6)

17 months agoconfigure: improve check for POSIX ioctl
Ramiro Polla [Thu, 29 Aug 2024 13:40:00 +0000 (15:40 +0200)]
configure: improve check for POSIX ioctl

Instead of relying on system #ifdefs which may or may not be correct,
detect the POSIX ioctl signature at configure time.

(cherry picked from commit 00b64fca55a3a009c9d0e391c85f4fd3291e5d12)
Signed-off-by: Brad Smith <brad@comstyle.com>
17 months agoconfigure: restore autodetection of v4l2 and fbdev
Ramiro Polla [Tue, 2 Jul 2024 22:30:08 +0000 (00:30 +0200)]
configure: restore autodetection of v4l2 and fbdev

The detection logic for v4l2 and fbdev was accidentally modified to
depend on v4l2-m2m in 43b3412.

(cherry picked from commit 7405f1ad5351cc24b91a0227aeeaf24ff9d12278)
Signed-off-by: Brad Smith <brad@comstyle.com>
17 months agoconfigure: fix --disable-v4l2-m2m can't work
Jun Zhao [Wed, 4 Sep 2019 09:39:59 +0000 (17:39 +0800)]
configure: fix --disable-v4l2-m2m can't work

Use the command ./configure with/without --disable-v4l2-m2m test.

Reviewed-by: Aman Gupta <aman@tmm1.net>
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
(cherry picked from commit 43b3412631893ca432857304e91d85b953bd5feb)
Signed-off-by: Brad Smith <brad@comstyle.com>
17 months agoconfigure: use just the pkg-config for sndio
Brad Smith [Sat, 17 Jun 2023 22:48:38 +0000 (18:48 -0400)]
configure: use just the pkg-config for sndio

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f6d846459043786eb859ff1c95af30e6fbc2d0e4)
Signed-off-by: Brad Smith <brad@comstyle.com>
17 months agoconfigure: enable ffnvcodec, nvenc, nvdec for FreeBSD
Brad Smith [Sat, 18 May 2024 23:55:30 +0000 (19:55 -0400)]
configure: enable ffnvcodec, nvenc, nvdec for FreeBSD

Signed-off-by: Brad Smith <brad@comstyle.com>
(cherry picked from commit 43b1a956789bf0d5796769427d40c78e460c247f)
Signed-off-by: Brad Smith <brad@comstyle.com>
17 months agoavutil/ppc/cpu: Also use the machdep.altivec sysctl on NetBSD
Brad Smith [Sat, 18 May 2024 11:38:40 +0000 (07:38 -0400)]
avutil/ppc/cpu: Also use the machdep.altivec sysctl on NetBSD

Use the machdep.altivec sysctl on NetBSD for AltiVec detection
as is done with OpenBSD.

(cherry picked from commit 115c96b9bd53e775f425f23d5b73fa0a9dedbd08)
Signed-off-by: Brad Smith <brad@comstyle.com>