summaryrefslogtreecommitdiff
path: root/libavcodec/shorten.c
Commit message (Collapse)AuthorAge
* avcodec/shorten: Fix integer overflow with offsetMichael Niedermayer2018-11-13
| | | | | | | | Fixes: signed integer overflow: -1625810908 - 582229060 cannot be represented in type 'int' Fixes: 10977/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5732602018267136 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/shorten: Fix bitstream end check in read_header()Michael Niedermayer2018-09-15
| | | | | | | | | Fixes: Timeout Fixes: 9961/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5687856176562176 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/shorten: Fix signed 32bit overflow in shift in shorten_decode_frame()Michael Niedermayer2018-08-16
| | | | | | | | Fixes: runtime error: left shift of 1 by 31 places cannot be represented in type 'int' Fixes: 9480/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-6647324284551168 -rss_limit_mb=2000 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/shorten: Fix integer overflow in residual/LPC combinationMichael Niedermayer2018-08-16
| | | | | | | | Fixes: signed integer overflow: -540538872 + -2012739576 cannot be represented in type 'int' Fixes: 9255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5758630052757504 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/shorten: Check verbatim lengthMichael Niedermayer2018-08-16
| | | | | | | | Fixes: Timeout Fixes: 9252/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5780720709533696 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/shorten: Fix undefined addition in shorten_decode_frame()Michael Niedermayer2018-07-04
| | | | | | | | Fixes: signed integer overflow: 1139785606 + 1454196085 cannot be represented in type 'int' Fixes: 8937/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-6202943597445120 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/shorten: Fix undefined integer overflowMichael Niedermayer2018-07-04
| | | | | | | | Fixes: signed integer overflow: 8454144 * 256 cannot be represented in type 'int' Fixes: 8788/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5728205041303552 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/shorten: Fix multiple integer overflowsMichael Niedermayer2018-06-07
| | | | | | | | Fixes: signed integer overflow: 3 * 1006632960 cannot be represented in type 'int' Fixes: 8278/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5692857166856192 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/shorten: Fix undefined shift in fix_bitshift()Michael Niedermayer2018-06-07
| | | | | | | | Fixes: left shift of negative value -9 Fixes: 8571/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5715966875926528 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/shorten: Fix a negative left shift in shorten_decode_frame()Michael Niedermayer2018-06-07
| | | | | | | | Fixes: left shift of negative value -9057 Fixes: 8527/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5666853924896768 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/shorten: Sanity check nmeansMichael Niedermayer2018-06-07
| | | | | | | | | | | Fixes: OOM Fixes: 8195/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5179785826271232 The reference software appears to use longs for 32bits and it uses int for nmeans hinting that the intended maximum size was not 32bit. Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/shorten: Check non COMM chunk len before skip in decode_aiff_header()Michael Niedermayer2018-06-06
| | | | | | | | Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int' Fixes: 8024/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SHORTEN_fuzzer-5109204648984576 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/shorten: Move buffer allocation and offset init to end of read_header()Michael Niedermayer2017-09-12
| | | | | | | | | | | | They are time consuming operations, performing them after the other checks improves the speed with damaged input dramatically. Fixes: Timeout Fixes: 2928/clusterfuzz-testcase-4992812120539136 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/shorten: Sanity check maxnlpcMichael Niedermayer2017-06-16
| | | | | | | | Fixes OOM Fixes: 2131/clusterfuzz-testcase-minimized-4718045157130240 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/shorten: Check residual sizeMichael Niedermayer2017-05-06
| | | | | | Fixes assertion failure Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/shorten: Check k in get_uint()Michael Niedermayer2017-05-06
| | | | | | | | Fixes: undefined shift Fixes: 1371/clusterfuzz-testcase-minimized-5770822591447040 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* Merge commit '67deba8a416d818f3d95aef0aa916589090396e2'Clément Bœsch2017-03-31
|\ | | | | | | | | | | | | * commit '67deba8a416d818f3d95aef0aa916589090396e2': Use avpriv_report_missing_feature() where appropriate Merged-by: Clément Bœsch <cboesch@gopro.com>
| * Use avpriv_report_missing_feature() where appropriateDiego Biurrun2016-11-08
| |
* | Fix all -Wformat warnings raised by DJGPPClément Bœsch2017-03-29
| |
* | avcodec/shorten: support decoding AIFF-C variantPaul B Mahol2017-02-23
| | | | | | | | Signed-off-by: Paul B Mahol <onemda@gmail.com>
* | avcodec/shorten: make max frame size bigger if custom block size was usedPaul B Mahol2016-04-27
| | | | | | | | Signed-off-by: Paul B Mahol <onemda@gmail.com>
* | avcodec/shorten: properly handle bitshift > 31Paul B Mahol2016-04-11
| | | | | | | | Signed-off-by: Paul B Mahol <onemda@gmail.com>
* | avcodec/shorten: mark as AV_CODEC_CAP_SUBFRAMESPaul B Mahol2016-04-10
| | | | | | | | Signed-off-by: Paul B Mahol <onemda@gmail.com>
* | avcodec/shorten: add support for AIFF packing, not bitexactPaul B Mahol2016-04-09
| | | | | | | | | | | | Also report unsupported packing. Signed-off-by: Paul B Mahol <onemda@gmail.com>
* | avcodec/shorten: fix decoding of very large (>2048) block sizesPaul B Mahol2016-04-09
| | | | | | | | Signed-off-by: Paul B Mahol <onemda@gmail.com>
* | avcodec/shorten: fix decoding of files with number of samples lower than ↵Paul B Mahol2016-04-08
| | | | | | | | | | | | | | | | | | max_frame_size Note that support of very big block sizes is not currently supported at all due too flawed logic in decoder. Signed-off-by: Paul B Mahol <onemda@gmail.com>
* | avcodec/shorten: remove useless if condition and comment, reindentPaul B Mahol2016-04-08
| | | | | | | | Signed-off-by: Paul B Mahol <onemda@gmail.com>
* | avcodec/shorten: fix decoding of last framePaul B Mahol2016-04-08
| | | | | | | | | | | | Previously it would be always discarded. Signed-off-by: Paul B Mahol <onemda@gmail.com>
* | avcodec/shorten: if allocation fails reset max_frame_sizePaul B Mahol2016-04-08
| | | | | | | | | | | | Otherwise crash happens. Signed-off-by: Paul B Mahol <onemda@gmail.com>
* | avformat: support shorten in nistshpere demuxerPaul B Mahol2016-04-07
| | | | | | | | Signed-off-by: Paul B Mahol <onemda@gmail.com>
* | Merge commit '29c2d06d67724e994980045afa055c6c34611b30'Derek Buitenhuis2016-02-24
|\| | | | | | | | | | | | | * commit '29c2d06d67724e994980045afa055c6c34611b30': cosmetics: Drop empty comment lines Merged-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
| * cosmetics: Drop empty comment linesDiego Biurrun2016-02-18
| |
* | Merge commit '059a934806d61f7af9ab3fd9f74994b838ea5eba'Michael Niedermayer2015-07-27
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * commit '059a934806d61f7af9ab3fd9f74994b838ea5eba': lavc: Consistently prefix input buffer defines Conflicts: doc/examples/decoding_encoding.c libavcodec/4xm.c libavcodec/aac_adtstoasc_bsf.c libavcodec/aacdec.c libavcodec/aacenc.c libavcodec/ac3dec.h libavcodec/asvenc.c libavcodec/avcodec.h libavcodec/avpacket.c libavcodec/dvdec.c libavcodec/ffv1enc.c libavcodec/g2meet.c libavcodec/gif.c libavcodec/h264.c libavcodec/h264_mp4toannexb_bsf.c libavcodec/huffyuvdec.c libavcodec/huffyuvenc.c libavcodec/jpeglsenc.c libavcodec/libxvid.c libavcodec/mdec.c libavcodec/motionpixels.c libavcodec/mpeg4videodec.c libavcodec/mpegvideo.c libavcodec/noise_bsf.c libavcodec/nuv.c libavcodec/nvenc.c libavcodec/options.c libavcodec/parser.c libavcodec/pngenc.c libavcodec/proresenc_kostya.c libavcodec/qsvdec.c libavcodec/svq1enc.c libavcodec/tiffenc.c libavcodec/truemotion2.c libavcodec/utils.c libavcodec/utvideoenc.c libavcodec/vc1dec.c libavcodec/wmalosslessdec.c libavformat/adxdec.c libavformat/aiffdec.c libavformat/apc.c libavformat/apetag.c libavformat/avidec.c libavformat/bink.c libavformat/cafdec.c libavformat/flvdec.c libavformat/id3v2.c libavformat/isom.c libavformat/matroskadec.c libavformat/mov.c libavformat/mpc.c libavformat/mpc8.c libavformat/mpegts.c libavformat/mvi.c libavformat/mxfdec.c libavformat/mxg.c libavformat/nutdec.c libavformat/oggdec.c libavformat/oggparsecelt.c libavformat/oggparseflac.c libavformat/oggparseopus.c libavformat/oggparsespeex.c libavformat/omadec.c libavformat/rawdec.c libavformat/riffdec.c libavformat/rl2.c libavformat/rmdec.c libavformat/rtpdec_latm.c libavformat/rtpdec_mpeg4.c libavformat/rtpdec_qdm2.c libavformat/rtpdec_svq3.c libavformat/sierravmd.c libavformat/smacker.c libavformat/smush.c libavformat/spdifenc.c libavformat/takdec.c libavformat/tta.c libavformat/utils.c libavformat/vqf.c libavformat/westwood_vqa.c libavformat/xmv.c libavformat/xwma.c libavformat/yop.c Merged-by: Michael Niedermayer <michael@niedermayer.cc>
| * lavc: Consistently prefix input buffer definesVittorio Giovara2015-07-27
| | | | | | | | Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
* | Merge commit 'def97856de6021965db86c25a732d78689bd6bb0'Michael Niedermayer2015-07-27
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * commit 'def97856de6021965db86c25a732d78689bd6bb0': lavc: AV-prefix all codec capabilities Conflicts: cmdutils.c ffmpeg.c ffplay.c libavcodec/8svx.c libavcodec/aacenc.c libavcodec/ac3dec.c libavcodec/adpcm.c libavcodec/alac.c libavcodec/atrac3plusdec.c libavcodec/bink.c libavcodec/dnxhddec.c libavcodec/dvdec.c libavcodec/dvenc.c libavcodec/ffv1dec.c libavcodec/ffv1enc.c libavcodec/fic.c libavcodec/flacdec.c libavcodec/flacenc.c libavcodec/flvdec.c libavcodec/fraps.c libavcodec/frwu.c libavcodec/gifdec.c libavcodec/h261dec.c libavcodec/hevc.c libavcodec/iff.c libavcodec/imc.c libavcodec/libopenjpegdec.c libavcodec/libvo-aacenc.c libavcodec/libvorbisenc.c libavcodec/libvpxdec.c libavcodec/libvpxenc.c libavcodec/libx264.c libavcodec/mjpegbdec.c libavcodec/mjpegdec.c libavcodec/mpegaudiodec_float.c libavcodec/msmpeg4dec.c libavcodec/mxpegdec.c libavcodec/nvenc_h264.c libavcodec/nvenc_hevc.c libavcodec/pngdec.c libavcodec/qpeg.c libavcodec/ra288.c libavcodec/rv10.c libavcodec/s302m.c libavcodec/sp5xdec.c libavcodec/takdec.c libavcodec/tiff.c libavcodec/tta.c libavcodec/utils.c libavcodec/v210dec.c libavcodec/vp6.c libavcodec/vp9.c libavcodec/wavpack.c libavcodec/yop.c Merged-by: Michael Niedermayer <michael@niedermayer.cc>
| * lavc: AV-prefix all codec capabilitiesVittorio Giovara2015-07-27
| | | | | | | | | | | | Express bitfields more simply. Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
* | avcodec/shorten: use init_get_bits8()Paul B Mahol2015-07-03
| | | | | | | | Signed-off-by: Paul B Mahol <onemda@gmail.com>
* | avcodec/shorten: More complete pred_order checkMichael Niedermayer2015-05-15
| | | | | | | | | | | | Fixes CID1239055 Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* | avcodec/shorten: Fix code depending on signed overflow behaviorMichael Niedermayer2015-05-15
| | | | | | | | Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* | avcodec/shorten: Check skip_bytes()Michael Niedermayer2015-05-15
| | | | | | | | | | | | Fixes CID1210526 Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* | avcodec/shorten: use av_reallocp_array()Michael Niedermayer2015-01-12
| | | | | | | | Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* | Merge commit '8e104619a627fcf5f4c2bd3c09d0c2d323aae745'Michael Niedermayer2014-11-13
|\| | | | | | | | | | | | | | | | | | | | | * commit '8e104619a627fcf5f4c2bd3c09d0c2d323aae745': shorten: check for return value Conflicts: libavcodec/shorten.c See: e20ebe491c17388a312e04ff060c217ecfafc914 Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * shorten: check for return valueVittorio Giovara2014-11-13
| | | | | | | | | | | | | | Avoid a possible negative bitshift. CC: libav-stable@libav.org Bug-Id: CID 1194400
| * shorten: pad the internal bitstream bufferAnton Khirnov2014-02-04
| | | | | | | | | | | | | | Fixes invalid reads. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC:libav-stable@libav.org
* | avcodec/shorten: check bitshiftMichael Niedermayer2014-04-27
| | | | | | | | | | | | | | Fixes invalid shift Fixes CID1194400 Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* | avcodec/shorten: clear bitstream bufferMichael Niedermayer2013-12-26
| | | | | | | | | | | | | | Fixes use of uninitialized memory Fixes: msan_uninit-mem_7f3ca95606fb_6393_luckynight-partial.shn Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* | Merge commit '9b8d11a76ae7bca8bbb58abb822138f8b42c776c'Michael Niedermayer2013-12-09
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | * commit '9b8d11a76ae7bca8bbb58abb822138f8b42c776c': avcodec: Use av_reallocp where suitable Conflicts: libavcodec/bitstream.c libavcodec/eatgv.c libavcodec/flashsv.c libavcodec/libtheoraenc.c libavcodec/libvpxenc.c Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * avcodec: Use av_reallocp where suitableAlexandra Khirnova2013-12-09
| | | | | | | | Signed-off-by: Martin Storsjö <martin@martin.st>
* | Merge commit '5f5ada3dbf97e306a74250ba8dcf8619ad59b020'Michael Niedermayer2013-10-11
|\| | | | | | | | | | | | | * commit '5f5ada3dbf97e306a74250ba8dcf8619ad59b020': shorten: Fix out-of-array read Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * shorten: Fix out-of-array readTim Walker2013-10-10
| | | | | | | | | | | | pred_order == FF_ARRAY_ELEMS(fixed_coeffs) is invalid too. Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-14 01:42:29 +0000