1
0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-25 14:19:27 +03:00

33493 Commits

Author SHA1 Message Date
Michael Niedermayer
4c718691ea avcodec/cabac: Check initial cabac decoder state
Fixes integer overflows
Fixes: 1430e9c43fae47a24c179c7c54f94918/signal_sigsegv_421427_2340_591e9810c7b09efe501ad84638c9e9f8.264

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Found-by: xiedingbao (Ticket4727)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8000d484b8)

Conflicts:

	libavcodec/cabac.h
2015-11-27 14:07:03 +01:00
Michael Niedermayer
24c504bd0a avcodec/cabac_functions: Fix "left shift of negative value -31767"
Fixes: 1430e9c43fae47a24c179c7c54f94918/signal_sigsegv_421427_2340_591e9810c7b09efe501ad84638c9e9f8.264

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Found-by: xiedingbao (Ticket4727)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a1f6b05f52)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-27 14:03:01 +01:00
Michael Niedermayer
6b91701de3 avcodec/h264_slice: Limit max_contexts when slice_context_count is initialized
Fixes out of array access
Fixes: 1430e9c43fae47a24c179c7c54f94918/signal_sigsegv_421427_2049_f2192b6829ab6e0eefcb035329c03c60.264

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4ea4d2f438)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-26 16:06:39 +01:00
Michael Niedermayer
71a3113333 avcodec/pngdec: Replace assert by request for sample for unsupported TRNS cases
Fixes assertion failure
Fixes: 7f646252a30ee28b583aac1f82e7985e/signal_sigabrt_7ffff6ae7cc9_7353_62fc077bf2f454d39e188c69807193a6.png

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a62178be80)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-26 16:06:39 +01:00
Michael Niedermayer
2dc1f3a02b avcodec/jpeg2000dec: Fix potential integer overflow with tile dimensions
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 65d3359fb3)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-26 16:06:39 +01:00
Michael Niedermayer
9a9dda615b avcodec/jpeg2000: Use av_image_check_size() in ff_jpeg2000_init_component()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 016fd413f9)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-26 16:05:42 +01:00
Michael Niedermayer
b3bc05290a avcodec/wmaprodec: Check for overread in decode_packet()
Fixes assertion failure
Fixes: 0256e92df2df7e933b43a2c70e4c8040/signal_sigabrt_7ffff6ae7cc9_1358_999ac18684788221490757582ce9af84.wma

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7ad698e24e)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-26 16:05:42 +01:00
Michael Niedermayer
093e58228e avcodec/smacker: Check that the data size is a multiple of a sample vector
Fixes out of array access
Fixes: ce19e41f0ef1e52a23edc488faecdb58/asan_heap-oob_2504e97_4202_ffa0df1baed14022b9bfd4f8ac23d0cb.smk

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4a9af07a49)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-26 16:05:42 +01:00
Michael Niedermayer
948d93d3f4 avcodec/takdec: Skip last p2 sample (which is unused)
Fixes out of array read
Fixes: cb3f38b08b4541523974667c7d1eee9e/asan_heap-oob_2659e18_9838_021fd5cd635bf76cede6398cd9ecbcdd.tak

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 08b520636e)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-26 16:05:41 +01:00
Michael Niedermayer
824e72d9b7 avcodec/dxtory: Fix input size check in dxtory_decode_v1_410()
Fixes potential out of array read

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 76b6f4b7d9)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-26 16:05:41 +01:00
Michael Niedermayer
c7a970a3a0 avcodec/dxtory: Fix input size check in dxtory_decode_v1_420()
Fixes out of array read
Fixes: c50c4aa6cefda71b19a31ea12302980c/asan_heap-oob_12be5fd_7011_33ebd015a74976215934add72b9c8352.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9caa9414cc)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-26 16:05:41 +01:00
Michael Niedermayer
6af38b2718 avcodec/error_resilience: avoid accessing previous or next frames tables beyond height
The height of tables can be rounded up for MBAFF but this does not imply that is also true
for the previous frames

Fixes out of array reads
Fixes: c106b36fa36db8ff8f3ed0c82be7bea2/asan_heap-oob_32699f0_6321_467b9a1d7e03d7cfd310b7e65dc53bcc.mov

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a105f52855)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-26 16:05:41 +01:00
Michael Niedermayer
0ce7baa245 avcodec/dpx: Move need_align to act per line
Fixes out of array read
Fixes: 61cf123c081ee2bb774d307c75bdb99e/asan_heap-oob_1224f76_5546_bee833ffae73f752b489b9eeaac52db7.dpx

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c8aaae8e0f)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-26 16:05:41 +01:00
Michael Niedermayer
7f0b58947d avcodec/flashsv: Check size before updating it
Fixes out of array read
Fixes: 3c857d4d90365731524716e6d051e43a/signal_sigsegv_7f4f59bcc29e_1386_20abd2c8e655cb9c75b24368e65fe3b1.flv

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 17705f5d4f)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-26 16:05:41 +01:00
Michael Niedermayer
f64ffbbdc0 avcodec/ivi: Check image dimensions
Fixes integer overflow
Fixes: 1e32c6c591d940337c20b197ec1c4d3d/asan_heap-oob_4a52e5_8946_0bb0d9e863def56005e49f1d89bdc94d.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit df91aa034b)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-26 16:05:41 +01:00
Michael Niedermayer
c0748b9954 avcodec/utils: Better check for channels in av_get_audio_frame_duration()
Fixes integer overflow
Fixes: 0c2625f236ced104d402b4a03c0d65c7/asan_generic_274e1ce_5990_9314e7a67c26aecf011b178ade9f217c.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4e16ad2868)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-26 16:05:41 +01:00
Michael Niedermayer
dbfec68d32 avcodec/jpeg2000dec: Check for duplicate SIZ marker
Fixes: 0231a17345734228011c6f35a64e4594/asan_heap-oob_1d92a72_3218_1213809a9e3affec77e4c191fdfdc0a9.mov

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 44a7f17d0b)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-26 16:05:41 +01:00
Andreas Cadhalpun
34f2d74555 aacsbr: don't call sbr_dequant twice without intermediate read_sbr_data
Doing that doesn't make sense, because the only purpose of sbr_dequant
is to process the data from read_sbr_data.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 1c3e43a627)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-11-26 01:35:46 +01:00
Andreas Cadhalpun
22017f7745 hqx: correct type and size check of info_offset
It is used as size argument of ff_canopus_parse_info_tag, which uses it
as size argument to bytestream2_init, which only supports sizes up to
INT_MAX.
Changing it's type to unsigned simplifies the check.

Reviewed-by: Vittorio Giovara <vittorio.giovara@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 1ed7fcd42a)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-11-26 01:35:46 +01:00
Michael Niedermayer
bdbfc12e7f avcodec/jpeg2000: Change coord to 32bit to support larger than 32k width or height
Fixes: 03e0abe721b1174856d41a1eb5d6a896/signal_sigabrt_7ffff6ae7cc9_3813_e71bf3541abed3ccba031cd5ba0269a4.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0eb7de1973)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-11-26 01:35:46 +01:00
Michael Niedermayer
c3a44a2a55 avcodec/jpeg2000dec: Check SIZ dimensions to be within the supported range
Fixes potential integer overflows
Fixes: 03e0abe721b1174856d41a1eb5d6a896/signal_sigabrt_7ffff6ae7cc9_3813_e71bf3541abed3ccba031cd5ba0269a4.avi

This fix is choosen to be simple to backport, better solution
for master is planed

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6ef819c40b)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-11-26 01:35:46 +01:00
Michael Niedermayer
d1d48d4319 avcodec/jpeg2000: Check comp coords to be within the supported size
Fixes assertion failure
Fixes: 03e0abe721b1174856d41a1eb5d6a896/signal_sigabrt_7ffff6ae7cc9_3813_e71bf3541abed3ccba031cd5ba0269a4.avi

This fix is choosen to be simple to backport, better solution
for master is planed

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a1a8cbcb35)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-11-26 01:35:46 +01:00
Andreas Cadhalpun
6b0bc64f54 mpegvideo: clear overread in clear_context
Otherwise the h263p decoder can try to copy overread bytes, even though
buffer is NULL.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 6a69a175e7)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-11-26 01:35:46 +01:00
Michael Niedermayer
983e63b490 avcodec/avrndec: Use the AVFrame format instead of the context
Fixes out of array read
Fixes: 20dd01398dee0f6d83d7e5410a2ae8eb/signal_sigsegv_39eeb1f_4001_62efbdf1c60748dabf1ec310b59525fd.mov

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ccba8aaff2)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-11-26 01:35:46 +01:00
Andreas Cadhalpun
bf2f7115d9 dds: disable palette flag for compressed images
Having both is not valid and can cause a NULL pointer dereference of
frame->data[1] later.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
(cherry picked from commit 0a8bff788b)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-11-26 01:35:46 +01:00
Andreas Cadhalpun
ef699b4135 dds: validate compressed source buffer size
A too small buffer will cause segfaults somewhere below
decompress_texture_thread.

Reviewed-by: Vittorio Giovara <vittorio.giovara@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 9a37d47644)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-11-26 01:35:46 +01:00
Andreas Cadhalpun
a8513826dd dds: validate source buffer size before copying
If it is too small av_image_copy_plane segfaults.

Reviewed-by: Vittorio Giovara <vittorio.giovara@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 1675809d2d)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-11-26 01:35:46 +01:00
Andreas Cadhalpun
df31acda64 dvdsubdec: validate offset2 similar to offset1
If it is negative, it causes segmentation faults in decode_rle.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit f621749d11)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-11-26 01:35:45 +01:00
Andreas Cadhalpun
c3f276b608 aacps: avoid division by zero in stereo_processing
This fixes a SIGFPE crash in the aac_fixed decoder.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com>
(cherry picked from commit ef7fe9851e)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-11-26 01:35:45 +01:00
Michael Niedermayer
c4133b25f8 avcodec/takdec: Use memove, avoid undefined memcpy() use
Fixes: e214333cbd94c91228e624ff39329ce6/asan_generic_4a5159_6412_96cda2530e80607210ab41ccae3d456d.tak

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7cea3430a5)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-11-26 01:35:41 +01:00
Andreas Cadhalpun
46f83b059b aacsbr_fixed: check for envelope scalefactors overflowing
This prevents various values from getting an insanely huge exponent.
If someone knows a cleaner solution, thats welcome!

This is similar to commit 8978c74 for aacsbr.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 0e36a14a42)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-12 00:43:01 +01:00
Andreas Cadhalpun
ce2664f5f7 aacdec: don't return frames without data from aac_decode_er_frame
This is similar to commit ec38a1b for aac_decode_frame_int.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d7f29bfa69)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-12 00:42:50 +01:00
Michael Niedermayer
8364d607ac avcodec/aacsbr_fixed: Try to initialize sum[0..1] differently to fix build with VS2012
Found-by: Hendrik Leppkes <h.leppkes@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8a024f6a43)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-12 00:42:43 +01:00
Michael Niedermayer
21e42d9b0d avcodec/aacsbr: Use FLOAT_0
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dcf1cf5d24)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-12 00:42:35 +01:00
Andreas Cadhalpun
c0cd8747ef apng: use correct size for output buffer
The buffer needs s->bpp bytes, at maximum currently 10.
Assert that s->bpp is not larger.

This fixes a stack buffer overflow.

Reviewed-by: wm4 <nfxjfg@googlemail.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 3e8e1a660e)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-07 14:11:12 +01:00
Michael Niedermayer
56419053bc avcodec/jpeg2000dec: Clip all tile coordinates
Fixes out of array access
Fixes: b877a6b788a25c70e8b1d014f8628549/asan_heap-oob_1da2c3f_2324_5a1b329b0b3c4bb6b1d775660ac56717.r3d

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 43492ff3ab)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-07 03:02:04 +01:00
Michael Niedermayer
11b4822ddb avcodec/microdvddec: Check for string end in 'P' case
Fixes out of array read
Fixes: a9502b60f4cecc19475382aee255f73c/asan_heap-oob_1e87fba_2548_a8ad47f6dde36644fe9cdc444d4632d0.sub

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c719cd6cf7)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-07 01:10:58 +01:00
Michael Niedermayer
2de2959305 avcodec/dirac_parser: Fix undefined memcpy() use
Fixes: 9d375e415486edd1a0c826f2307d89a4/asan_generic_4a5159_1577_faa333e83dacdd9e4dd322380aeed537.iss

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit daefd8ab2f)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-07 01:10:16 +01:00
Michael Niedermayer
6e085f9a32 avcodec/mpeg12dec: Do not call show_bits() with invalid bits
Fixes assertion failure
Fixes: 63e50545709a6440d3d59f6426d58db9/signal_sigabrt_7ffff6ae7cc9_8189_3272a3010fd98ddf947c662bbde1ac13.ts

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 973c3dba27)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-06 01:17:00 +01:00
Michael Niedermayer
a7bbb7fb88 avcodec/faxcompr: Add missing runs check in decode_uncompressed()
Fixes out of array access
Fixes: 54e488b9da4abbceaf405d6492515697/asan_heap-oob_32769b0_160_a8755eb08ee8f9579348501945a33955.TIF

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d4a731b84a)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-05 21:50:14 +01:00
Michael Niedermayer
ff30907205 avcodec/hevc_ps: Check chroma_format_idc
Fixes out of array access
Fixes: 24d05e8b84676799c735c9e27d97895e/asan_heap-oob_1b70f6a_2955_7c3652a7f370f9f3ef40642bc2c99bb2.bit

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 93f30f825c)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-05 15:17:56 +01:00
Michael Niedermayer
a6ae88bb25 avcodec/ffv1dec: Check for 0 quant tables
Fixes assertion failure
Fixes: 07ec1fc3c1cbf2d3edcd7d9b52ca156c/asan_heap-oob_13624c5_491_ecd4720a03e697ba750b235690656c8f.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5745cf799a)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-05 01:49:09 +01:00
Michael Niedermayer
4567cba0b8 avcodec/mjpegdec: Reinitialize IDCT on BPP changes
Fixes misaligned access
Fixes: dc9262a469f6f315f74c087a7b3a7f35/signal_sigsegv_2e95bcd_9_9c0f9f4a9ba82aa9b3ab2b91ce4d5277.jpg

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cc35f6f476)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-04 22:16:38 +01:00
Michael Niedermayer
fdb8842639 avcodec/mjpegdec: Check index in ljpeg_decode_yuv_scan() before using it
Fixes: 04715144ba237443010554be0d05343f/asan_heap-oob_1eafc76_1737_c685b48041a563461839e4e7ab97abb8.jpg
Fixes out of array access

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d24888ef19)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-04 19:42:29 +01:00
Michael Niedermayer
aa34146e41 avcodec/h264_slice: Disable slice threads if there are multiple access units in a packet
Fixes null pointer dereference
Fixes part of Ticket4977

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9368d2da3d33cac845f2fdf663df500b53625c5e)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-10-31 22:57:52 +01:00
Kieran Kunhya
2f5f940bef opusdec: Don't run vector_fmul_scalar on zero length arrays
Fixes crashes on fuzzed files
Fixes Ticket4969 part2

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b3e5f15b95)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-10-30 17:55:31 +01:00
Michael Niedermayer
6ac9d6303f avcodec/opusdec: Fix extra samples read index
Fixes crash
Fixes Ticket4969 part 1

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 07225fa74f)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-10-30 17:55:31 +01:00
Michael Niedermayer
81a2ad762b avcodec/ffv1: Initialize vlc_state on allocation
This ensures that they are always set to valid values
Fixes Ticket4939

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a878dfa4f5)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-10-30 17:55:31 +01:00
Michael Niedermayer
c8a1324d1e avcodec/ffv1dec: update progress in case of broken pointer chains
Fixes deadlock
Fixes Ticket4932

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5063a18f56)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-10-30 17:55:31 +01:00
Michael Niedermayer
6a0e10ae0d avcodec/ffv1dec: Clear slice coordinates if they are invalid or slice header decoding fails for other reasons
Fixes Ticket4931

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4c2d4e8700)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-10-30 17:55:31 +01:00