Commit Graph

18 Commits

Author SHA1 Message Date
Michael Niedermayer a98eeb0c1e avcodec/agm: YUV420 without DCT needs even dimensions
Fixes: out of array access
Fixes: 19892/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5707525924323328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-02-09 23:33:18 +01:00
Michael Niedermayer 5c151e1491 avcodec/agm: Test remaining data in decode_raw_intra_rgb()
Fixes: Timeout (270sec -> 25ms)
Fixes: 20485/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5636954207289344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-02-09 23:33:18 +01:00
Michael Niedermayer 1f20969457 avcodec/agm: Include block size in the MV check for flags == 3
Fixes: out of array read
Fixes: 19331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5644115983466496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-28 11:20:48 +01:00
Michael Niedermayer 7a1b30c871 avcodec/agm: Do not allow MVs out of the picture area as no edge is allocated
Fixes: out of array access
Fixes: 18499/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5749038406434816

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-12-10 16:09:14 +01:00
Michael Niedermayer bfa8272f40 vcodec/agm: Alloc based on coded dimensions
Fixes: out of array read
Fixes: 18715/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5659333417500672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-11-15 21:31:43 +01:00
Michael Niedermayer 315a445933 avcodec/agm: Check for reference frame earlier
Fixes: Timeout (14sec -  120ms)
Fixes: 17824/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5639825457152000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-10-20 19:57:51 +02:00
Michael Niedermayer 6ebbfb377f avcodec/agm: Fix overflow of signed shift
Fixes: left shift of 1 by 31 places cannot be represented in type 'int'
Fixes: 15328/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5637545171353600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-07-19 21:42:38 +02:00
Michael Niedermayer 19af948e53 avcodec/agm: Check output size before allocation
Fixes: OOM
Fixes: 14198/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5723579234123776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-04-30 21:25:01 +02:00
Michael Niedermayer caa9b4ff89 avcodec/agm: Check that there is available input in read_code()
Fixes: Timeout (46sec -> 7ms)
Fixes: 14030/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5721258760601600

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-04-24 17:05:02 +02:00
Michael Niedermayer df9ef925f9 avcodec/agm: remove ;;
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-04-21 23:29:04 +02:00
Michael Niedermayer 7ee7bb92e6 avcodec/agm: Check for too many too short codes in make_new_tree()
Fixes: SEGV on unknown address
Fixes: 14198/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5723579234123776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-04-21 23:29:04 +02:00
Michael Niedermayer 158efc045c avcodec/agm: Do not crash on invalid codes
I do not know if such vlc trees are allowed in agm, I have no specification
So i do not know if these should be treated as error, or not.
But the code does contain a check for idx < 0 already ...

Fixes: Stack-buffer-overflow in get_tree_codes
Fixes: 14189/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5745747003179008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-04-21 23:29:04 +02:00
Michael Niedermayer 3308e3da04 avcodec/agm: Check frame dimensions
Fixes: out of array access
Fixes: 14110/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5649184864075776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-04-11 19:25:42 +02:00
Paul B Mahol 7be8f7ac81 avcodec/agm: add support for non-dct coding 2019-04-11 11:49:43 +02:00
Paul B Mahol 0f28355974 avcodec/agm: add support for higher compression 2019-04-11 11:49:43 +02:00
Michael Niedermayer 2169a3f262 avcodec/agm: Fix integer overflow with w/h
Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 13999/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5644405991538688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-04-05 12:05:47 +02:00
Michael Niedermayer 8e3b01e20e avcodec/agm: More completely check size before using it
Fixes: out of array access
Fixes: 13997/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AGM_fuzzer-5701427252428800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2019-04-04 11:31:17 +02:00
Paul B Mahol 4e8cbbf70e avcodec: add Amuse Graphics decoder
This work is sponsored by VideoLAN.
2019-03-31 10:48:43 +02:00