Commits · 3371d0611fcd31e0bc72553d88774512a58bd2ef · Linshizhi / ffmpeg.wasm-core

08 Jun, 2020 8 commits

tools/target_dec_fuzzer: enable mjpeg for tiff or tdsc · 3371d061

Michael Niedermayer authored Feb 07, 2020

This is needed for fuzzing tiff/tdsc and should increase coverage
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

3371d061

avcodec/hcadec: Check or bound indexes · b7e5c8f6

Michael Niedermayer authored May 13, 2020

This causes indexes into scale_conversion_table to wrap around, alternatively they
could be clipped, the table be enlarged or we can error out. I have not found a document that specifies
what is the correct way to handle this

Fixes: out of array access
Fixes: 21727/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCA_fuzzer-5752477891952640.fuzz
Fixes: 22438/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HCA_fuzzer-5640717790871552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: Michael Niedermayer <michael@niedermayer.cc>

b7e5c8f6

avcodec/pnm: Check scale · 8e21379d

Michael Niedermayer authored Jun 06, 2020

Fixes: division by zero
Fixes: 22974/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PFM_fuzzer-6270027077779456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: Michael Niedermayer <michael@niedermayer.cc>

8e21379d

tools/target_dem_fuzzer: Implement AVSEEK_SIZE · 3e651eea
Michael Niedermayer authored Jun 07, 2020
```
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
```
3e651eea

avformat/4xm: Cleanup on GET_LIST_HEADER() failure · a5313ce6

Michael Niedermayer authored Jun 07, 2020

Fixes: memleak
Fixes: 23142/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5932860820422656

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

a5313ce6

hevc: move SliceHeader and LongTermRPS back to hevcdec.h · b7e18212

Anton Khirnov authored Jun 01, 2020

They are no longer necessary there and have nothing to do with parameter
sets, so do not belong in hevc_ps.h.

This effectively reverts 4aaace8b.

b7e18212

hevc_parser: drop the use of SliceHeader · fb30c910

Anton Khirnov authored May 27, 2020

It is only used to store a few local variables within one function,
which is better accomplished by just declaring them on stack explicitly.

fb30c910

hevc_refs: reduce code duplication in find_ref_idx() · 2a9bed8f
Anton Khirnov authored May 27, 2020

2a9bed8f

07 Jun, 2020 8 commits

avcodec/v4l2_m2m_enc: Avoid ;; · d29aaf12

Andreas Rheinhardt authored Jun 01, 2020

Inside a function, the second ; in a double ;; is a null statement, but
outside of functions a double ;; is simply invalid C that compilers
happen to accept. v4l2_m2m_enc.c contained several ;; as a result of
macro-expansion. So change the underlying macro so that it doesn't
happen any longer.

This fixes warnings when compiling with -pedantic: "ISO C does not allow
extra ‘;’ outside of a function".
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>

d29aaf12

avcodec/ac3dec_fixed: Remove some temporary variables from scale_coefs() · 27c42d33
Michael Niedermayer authored Feb 01, 2020
```
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
```
27c42d33

avcodec/lzf: Consider the needed size in reallocation · 292b9b93

Michael Niedermayer authored May 28, 2020

Fixes: NULL pointer dereference
Fixes: 22381/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer-5659879921680384.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: Michael Niedermayer <michael@niedermayer.cc>

292b9b93

avformat/mlvdec: fail reading a packet with 0 streams · 5bd5c310

Michael Niedermayer authored May 31, 2020

Fixes: NULL pointer dereference
Fixes: 22604/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5667739074297856.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: Michael Niedermayer <michael@niedermayer.cc>

5bd5c310

avformat/thp: Check compcount · 1ba84845

Michael Niedermayer authored May 31, 2020

Fixes: out of array access
Fixes: 22520/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5100297658826752

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: Michael Niedermayer <michael@niedermayer.cc>

1ba84845

avcodec/adpcm: XA: Check shift similar to filter · 6d96bae9

Michael Niedermayer authored May 31, 2020

Fixes: negative shift
Fixes: 22499/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_XA_fuzzer-5765452130418688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: Michael Niedermayer <michael@niedermayer.cc>

6d96bae9

avfilter/vf_vaguedenoiser: add new type of threshold · bd6336b9
Paul B Mahol authored Jun 07, 2020

bd6336b9
avfilter/vf_vaguedenoiser: remove excessive code from soft thresholding · 6c57b0d6
Paul B Mahol authored Jun 07, 2020

6c57b0d6

06 Jun, 2020 7 commits

libavcodec/jpeg2000_parser: Add jpeg2000 parser · d09c3567

Gautam Ramakrishnan authored Jun 06, 2020

I have attempted to write a JPEG2000 Parser. Have tested
by generating a file containing 14 frames, as mentioned
by Micheal. Have also tried testing with various packet
sizes by setting -frame_size option. Additionally,
fixed a few formatting issues as pointed out by Micheal.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

d09c3567

avformat/oggdec: Do not hardcode arbitrary and sometimes unavailable size · 8edfd059

Michael Niedermayer authored Jun 06, 2020

Fixes: regression since e983197c
Fixes: out of array read
Fixes: 22185/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5662069073641472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

8edfd059

avformat/oggdec: Initialize return value from ogg_read_page() and check it everywhere · 108ee4b4

Michael Niedermayer authored Jun 06, 2020

Fixes regression since 9ad47762
Fixes: out of array access
Fixes: 22172/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5658535590625280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

108ee4b4

avfilter/avf_showspectrum: properly handle EOF case · 7826fbfe
Paul B Mahol authored Jun 06, 2020

7826fbfe
avfilter/asrc_anoisesrc: switch to activate · 1c32d7df
Paul B Mahol authored Jun 06, 2020
```
Allows to set EOF timestamp.
```
1c32d7df
avcodec/libaomenc: remove the experimental flag when using libaom 2.0.0 or newer · 49d37b4b
James Almer authored May 27, 2020
```
Reviewed-by: James Zern <jzern@google.com>
Signed-off-by: James Almer <jamrial@gmail.com>
```
49d37b4b
avutil/dict: av_realloc -> av_realloc_array() · 4bc5eb27
Limin Wang authored May 25, 2020
```
Signed-off-by: Limin Wang <lance.lmwang@gmail.com>
```
4bc5eb27

05 Jun, 2020 11 commits

avcodec/huffyuvdec: Test vertical coordinate more often · a1223ddc

Michael Niedermayer authored Jun 05, 2020

Fixes: out of array access
Fixes: 22892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-5135996772679680.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

a1223ddc

avutil/mathematics: Fix overflow with NaN in av_add_stable() · d9aa1ef2
Dale Curtis authored May 14, 2020
```
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
```
d9aa1ef2

avformat: Fix overflow in compute_pkt_fields(). · 63ce7c71

Dale Curtis authored May 14, 2020

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

63ce7c71

avformat/rawdec: fix identifier names · 71a822fa

Michael Niedermayer authored Jun 03, 2020

Fixes: out of array access
Fixes: 22686/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5121369624018944

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

71a822fa

libavcodec/bmp_parser.c: fix a use_of_uninitialized_value in target_dec_fuzzer. · a1a85579

Thierry Foucu authored Jun 04, 2020

the target_dec_fuzzer is checking for the avpkt.data pointer but if the
bmp parser cannot combine the frame, the poutbuf is not set.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

a1a85579

libavcodec/mlp_parser.c: fix a use_of_uninitialized_value in target_dec_fuzzer. · 3dc24b33

Thierry Foucu authored Jun 04, 2020

the target_dec_fuzzer is checking for the avpkt.data pointer but if the
mlp parser cannot combine the frame, the poutbuf is not set.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

3dc24b33

libavcodec/png_parser.c: fix a use_of_uninitialized_value in target_dec_fuzzer. · d5422a14

Thierry Foucu authored Jun 04, 2020

the target_dec_fuzzer is checking for the avpkt.data pointer but if the
png parser cannot combine the frame, the poutbuf is not set.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

d5422a14

avcodec/hq_hqa: Check info size · cf28521f

Michael Niedermayer authored May 29, 2020

Fixes: assertion failure
Fixes: 21079/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-5737046523248640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: Michael Niedermayer <michael@niedermayer.cc>

cf28521f

avutil/buffer: separate public and internal flags inside AVBuffers · b6c8444e

James Almer authored Jun 01, 2020

It's better to not mix user provided flags and internal flags set by
AVBufferRef helper functions.
Signed-off-by: James Almer <jamrial@gmail.com>

b6c8444e

avutil/buffer: avutil/buffer: add a mention that some arguments from... · f2ad89be

James Almer authored Jun 01, 2020

avutil/buffer: avutil/buffer: add a mention that some arguments from av_buffer_pool_init2() may be NULL
Signed-off-by: James Almer <jamrial@gmail.com>

f2ad89be

avutil/buffer: use the default allocator if none is provided to av_buffer_pool_init2() · ec39c227
James Almer authored Jun 01, 2020
```
Signed-off-by: James Almer <jamrial@gmail.com>
```
ec39c227

04 Jun, 2020 6 commits

avcodec/mv30: Fix multiple integer overflows in idct_1d() · 7f817853

Michael Niedermayer authored May 23, 2020

Fixes: signed integer overflow: -4869937 * 473 cannot be represented in type 'int'
Fixes: 21934/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MV30_fuzzer-5667289925156864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: Michael Niedermayer <michael@niedermayer.cc>

7f817853

avcodec/mv30: Do not allow MVs outside the allocated image · e73a2516

Michael Niedermayer authored May 20, 2020

Fixes: out of array read
Fixes: 21804/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MV30_fuzzer-5673678898724864

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: Michael Niedermayer <michael@niedermayer.cc>

e73a2516

avcodec/wmalosslessdec: Fix integer overflow in mclms_predict() · c42ed066

Michael Niedermayer authored May 23, 2020

Fixes: signed integer overflow: 2147483636 + 2048 cannot be represented in type 'int'
Fixes: 22016/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5109395618004992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: Michael Niedermayer <michael@niedermayer.cc>

c42ed066

avcodec/vp9dsp_template: Fix integer overflow(s) in iadst16_1d() · 071e2937

Michael Niedermayer authored May 23, 2020

Fixes: signed integer overflow: 1080285923 - -1130879337 cannot be represented in type 'int'
Fixes: 22002/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-6260237310099456

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: Michael Niedermayer <michael@niedermayer.cc>

071e2937

avcodec/wavpack: Do not allow the sample format to change between channels · bafaf951

Michael Niedermayer authored Jun 03, 2020

Fixes: out of array access
Fixes: 22692/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVPACK_fuzzer-5678686190960640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReviewed-by: David Bryant <david@wavpack.com>
Tested-by: David Bryant <david@wavpack.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

bafaf951

avcodec/bitpacked: add missing comma to codec tags · e34686d7

Michael Niedermayer authored Jun 03, 2020

Fixes: array end overread
Fixes: 22395/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BITPACKED_fuzzer-5760940300828672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReviewed-by: James Darnley <james.darnley@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

e34686d7