April 2019 - ffmpeg-cvslog - lists.ffmpeg.org

Changelog: update
by Michael Niedermayer 01 Apr '19

01 Apr '19

ffmpeg | branch: release/4.1 | Michael Niedermayer <michael(a)niedermayer.cc> | Mon Apr 1 10:33:02 2019 +0200| [4154f8967820ca734a77ce91bb590cd77649dee8] | committer: Michael Niedermayer Changelog: update Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4154f8967820ca734… --- Changelog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Changelog b/Changelog index 6f4a623552..5b76927071 100644 --- a/Changelog +++ b/Changelog @@ -2,6 +2,8 @@ Entries are sorted chronologically from oldest to youngest within each release, releases are sorted from youngest to oldest. version 4.1.3: +- avcodec/rscc: Check that the to be uncompressed input is large enough +- avformat/movenc: free eac3 private data only when closing the stream - avcodec/hevcdec: Avoid only partly skiping duplicate first slices - lavc/bmp: Avoid a heap buffer overwrite for 1bpp input. - avcodec/mpegpicture: Check size of edge_emu_buffer

1 0

avcodec/rscc: Check that the to be uncompressed input is large enough
by Michael Niedermayer 01 Apr '19

01 Apr '19

ffmpeg | branch: release/4.1 | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Mar 31 17:31:17 2019 +0200| [6c75df556f8ce97398789f363f5b323ae3abc920] | committer: Michael Niedermayer avcodec/rscc: Check that the to be uncompressed input is large enough Fixes: Out of array access Fixes: 13984/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RSCC_fuzzer-5734128093233152 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> (cherry picked from commit 3a0ec1511e7040845a0d1ce99fe2f30a0972b6d2) Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6c75df556f8ce9739… --- libavcodec/rscc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/rscc.c b/libavcodec/rscc.c index 7921f149ed..69cb702777 100644 --- a/libavcodec/rscc.c +++ b/libavcodec/rscc.c @@ -198,6 +198,12 @@ static int rscc_decode_frame(AVCodecContext *avctx, void *data, /* If necessary, uncompress tiles, and hijack the bytestream reader */ if (packed_tiles_size != tiles_nb * TILE_SIZE) { uLongf length = tiles_nb * TILE_SIZE; + + if (bytestream2_get_bytes_left(gbc) < packed_tiles_size) { + ret = AVERROR_INVALIDDATA; + goto end; + } + inflated_tiles = av_malloc(length); if (!inflated_tiles) { ret = AVERROR(ENOMEM);

1 0

doc/general: make column key note more verbose
by Gyan Doshi 01 Apr '19

01 Apr '19

ffmpeg | branch: master | Gyan Doshi <ffmpeg(a)gyani.pro> | Mon Apr 1 14:25:28 2019 +0530| [7f9a81b1105618fc064fdfdb8c97570c032a0bf0] | committer: Gyan Doshi doc/general: make column key note more verbose Addresses #7795 > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7f9a81b1105618fc0… --- doc/general.texi | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/doc/general.texi b/doc/general.texi index fe94c40386..109c8c58cc 100644 --- a/doc/general.texi +++ b/doc/general.texi @@ -677,7 +677,7 @@ library: @item Psygnosis YOP @tab @tab X @end multitable -@code{X} means that encoding (resp. decoding) is supported. +@code{X} means that the feature in that column (encoding / decoding) is supported. @section Image Formats @@ -747,7 +747,7 @@ following image formats are supported: @tab X Window Dump image format @end multitable -@code{X} means that encoding (resp. decoding) is supported. +@code{X} means that the feature in that column (encoding / decoding) is supported. @code{E} means that support is provided through an external library. @@ -1029,7 +1029,7 @@ following image formats are supported: @tab Encoder works only in PAL8. @end multitable -@code{X} means that encoding (resp. decoding) is supported. +@code{X} means that the feature in that column (encoding / decoding) is supported. @code{E} means that support is provided through an external library. @@ -1248,7 +1248,7 @@ following image formats are supported: @item Xbox Media Audio 2 @tab @tab X @end multitable -@code{X} means that encoding (resp. decoding) is supported. +@code{X} means that the feature in that column (encoding / decoding) is supported. @code{E} means that support is provided through an external library.

1 0

avcodec/rscc: Check that the to be uncompressed input is large enough
by Michael Niedermayer 01 Apr '19

01 Apr '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Mar 31 17:31:17 2019 +0200| [3a0ec1511e7040845a0d1ce99fe2f30a0972b6d2] | committer: Michael Niedermayer avcodec/rscc: Check that the to be uncompressed input is large enough Fixes: Out of array access Fixes: 13984/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RSCC_fuzzer-5734128093233152 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3a0ec1511e7040845… --- libavcodec/rscc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/rscc.c b/libavcodec/rscc.c index 7d4e842cd3..f494c30ed8 100644 --- a/libavcodec/rscc.c +++ b/libavcodec/rscc.c @@ -199,6 +199,12 @@ static int rscc_decode_frame(AVCodecContext *avctx, void *data, /* If necessary, uncompress tiles, and hijack the bytestream reader */ if (packed_tiles_size != tiles_nb * TILE_SIZE) { uLongf length = tiles_nb * TILE_SIZE; + + if (bytestream2_get_bytes_left(gbc) < packed_tiles_size) { + ret = AVERROR_INVALIDDATA; + goto end; + } + inflated_tiles = av_malloc(length); if (!inflated_tiles) { ret = AVERROR(ENOMEM);

1 0