August 2019 - ffmpeg-cvslog - lists.ffmpeg.org

avcodec/truemotion2: Fix multiple integer overflows in tm2_null_res_block()
by Michael Niedermayer 31 Aug '19

31 Aug '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Thu Aug 15 23:22:50 2019 +0200| [cc78783ce5e8837d4f4ca43eedf2d299651e65ff] | committer: Michael Niedermayer avcodec/truemotion2: Fix multiple integer overflows in tm2_null_res_block() Fixes: signed integer overflow: 1795032576 + 598344192 cannot be represented in type 'int' Fixes: 16196/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5636723419119616 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cc78783ce5e8837d4… --- libavcodec/truemotion2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/truemotion2.c b/libavcodec/truemotion2.c index 5d6dfc24c3..27c876fd7d 100644 --- a/libavcodec/truemotion2.c +++ b/libavcodec/truemotion2.c @@ -619,7 +619,7 @@ static inline void tm2_null_res_block(TM2Context *ctx, AVFrame *pic, int bx, int ct = ctx->D[0] + ctx->D[1] + ctx->D[2] + ctx->D[3]; if (bx > 0) - left = last[-1] - ct; + left = last[-1] - (unsigned)ct; else left = 0; @@ -630,7 +630,7 @@ static inline void tm2_null_res_block(TM2Context *ctx, AVFrame *pic, int bx, int last[2] = right - (diff >> 2); last[3] = right; { - int tp = left; + unsigned tp = left; ctx->D[0] = (tp + (ct >> 2)) - left; left += ctx->D[0];

1 0

tools/target_dec_fuzzer: adjust pixel threshold for TRUEMOTION2, as it allows coding gigantic images on tiny input
by Michael Niedermayer 31 Aug '19

31 Aug '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Thu Aug 15 22:26:14 2019 +0200| [5a3dee65d4fade2172c1e83da9cea3e3ae665897] | committer: Michael Niedermayer tools/target_dec_fuzzer: adjust pixel threshold for TRUEMOTION2, as it allows coding gigantic images on tiny input Fixes: Timeout (137sec -> 6sec) Fixes: 16090/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEMOTION2_fuzzer-5674245178261504 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5a3dee65d4fade217… --- tools/target_dec_fuzzer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c index 901dbca385..3a19efd031 100644 --- a/tools/target_dec_fuzzer.c +++ b/tools/target_dec_fuzzer.c @@ -139,6 +139,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { case AV_CODEC_ID_HNM4_VIDEO:maxpixels /= 128; break; // Cliping in C, generally slow even with small input case AV_CODEC_ID_INDEO4: maxpixels /= 128; break; + case AV_CODEC_ID_TRUEMOTION2: maxpixels /= 1024; break; }

1 0

avcodec/vc1_block: Check the return code from vc1_decode_p_block()
by Michael Niedermayer 31 Aug '19

31 Aug '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Thu Aug 15 20:15:20 2019 +0200| [fe536b6d9984d40f800a24a84032b99ebc9f680e] | committer: Michael Niedermayer avcodec/vc1_block: Check the return code from vc1_decode_p_block() Fixes: left shift of negative value -1 Fixes: 16424/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-5656579055026176 Fixes: 16358/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-5714436358144000 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=fe536b6d9984d40f8… --- libavcodec/vc1_block.c | 37 +++++++++++++++++++++++++++---------- 1 file changed, 27 insertions(+), 10 deletions(-) diff --git a/libavcodec/vc1_block.c b/libavcodec/vc1_block.c index 775e3c516b..514206f6d2 100644 --- a/libavcodec/vc1_block.c +++ b/libavcodec/vc1_block.c @@ -1385,6 +1385,8 @@ static int vc1_decode_p_mb(VC1Context *v) pat = vc1_decode_p_block(v, v->block[v->cur_blk_idx][block_map[i]], i, mquant, ttmb, first_block, s->dest[dst_idx] + off, (i & 4) ? s->uvlinesize : s->linesize, CONFIG_GRAY && (i & 4) && (s->avctx->flags & AV_CODEC_FLAG_GRAY), &block_tt); + if (pat < 0) + return pat; block_cbp |= pat << (i << 2); if (!v->ttmbf && ttmb < 8) ttmb = -1; @@ -1488,6 +1490,8 @@ static int vc1_decode_p_mb(VC1Context *v) (i & 4) ? s->uvlinesize : s->linesize, CONFIG_GRAY && (i & 4) && (s->avctx->flags & AV_CODEC_FLAG_GRAY), &block_tt); + if (pat < 0) + return pat; block_cbp |= pat << (i << 2); if (!v->ttmbf && ttmb < 8) ttmb = -1; @@ -1698,6 +1702,8 @@ static int vc1_decode_p_mb_intfr(VC1Context *v) first_block, s->dest[dst_idx] + off, (i & 4) ? s->uvlinesize : (s->linesize << fieldtx), CONFIG_GRAY && (i & 4) && (s->avctx->flags & AV_CODEC_FLAG_GRAY), &block_tt); + if (pat < 0) + return pat; block_cbp |= pat << (i << 2); if (!v->ttmbf && ttmb < 8) ttmb = -1; @@ -1834,6 +1840,8 @@ static int vc1_decode_p_mb_intfi(VC1Context *v) (i & 4) ? s->uvlinesize : s->linesize, CONFIG_GRAY && (i & 4) && (s->avctx->flags & AV_CODEC_FLAG_GRAY), &block_tt); + if (pat < 0) + return pat; block_cbp |= pat << (i << 2); if (!v->ttmbf && ttmb < 8) ttmb = -1; @@ -1853,7 +1861,7 @@ static int vc1_decode_p_mb_intfi(VC1Context *v) /** Decode one B-frame MB (in Main profile) */ -static void vc1_decode_b_mb(VC1Context *v) +static int vc1_decode_b_mb(VC1Context *v) { MpegEncContext *s = &v->s; GetBitContext *gb = &s->gb; @@ -1919,7 +1927,7 @@ static void vc1_decode_b_mb(VC1Context *v) bmvtype = BMV_TYPE_INTERPOLATED; ff_vc1_pred_b_mv(v, dmv_x, dmv_y, direct, bmvtype); vc1_b_mc(v, dmv_x, dmv_y, direct, bmvtype); - return; + return 0; } if (direct) { cbp = get_vlc2(&v->s.gb, v->cbpcy_vlc->table, VC1_CBPCY_P_VLC_BITS, 2); @@ -1936,7 +1944,7 @@ static void vc1_decode_b_mb(VC1Context *v) /* no coded blocks - effectively skipped */ ff_vc1_pred_b_mv(v, dmv_x, dmv_y, direct, bmvtype); vc1_b_mc(v, dmv_x, dmv_y, direct, bmvtype); - return; + return 0; } if (s->mb_intra && !mb_has_coeffs) { GET_MQUANT(); @@ -1951,7 +1959,7 @@ static void vc1_decode_b_mb(VC1Context *v) /* interpolated skipped block */ ff_vc1_pred_b_mv(v, dmv_x, dmv_y, direct, bmvtype); vc1_b_mc(v, dmv_x, dmv_y, direct, bmvtype); - return; + return 0; } } ff_vc1_pred_b_mv(v, dmv_x, dmv_y, direct, bmvtype); @@ -1995,20 +2003,23 @@ static void vc1_decode_b_mb(VC1Context *v) i & 4 ? s->uvlinesize : s->linesize); } else if (val) { - vc1_decode_p_block(v, s->block[i], i, mquant, ttmb, - first_block, s->dest[dst_idx] + off, - (i & 4) ? s->uvlinesize : s->linesize, - CONFIG_GRAY && (i & 4) && (s->avctx->flags & AV_CODEC_FLAG_GRAY), NULL); + int pat = vc1_decode_p_block(v, s->block[i], i, mquant, ttmb, + first_block, s->dest[dst_idx] + off, + (i & 4) ? s->uvlinesize : s->linesize, + CONFIG_GRAY && (i & 4) && (s->avctx->flags & AV_CODEC_FLAG_GRAY), NULL); + if (pat < 0) + return pat; if (!v->ttmbf && ttmb < 8) ttmb = -1; first_block = 0; } } + return 0; } /** Decode one B-frame MB (in interlaced field B picture) */ -static void vc1_decode_b_mb_intfi(VC1Context *v) +static int vc1_decode_b_mb_intfi(VC1Context *v) { MpegEncContext *s = &v->s; GetBitContext *gb = &s->gb; @@ -2113,7 +2124,7 @@ static void vc1_decode_b_mb_intfi(VC1Context *v) dmv_x[1] = dmv_y[1] = pred_flag[0] = 0; if (!s->next_picture_ptr->field_picture) { av_log(s->avctx, AV_LOG_ERROR, "Mixed field/frame direct mode not supported\n"); - return; + return AVERROR_INVALIDDATA; } } ff_vc1_pred_b_mv_intfi(v, 0, dmv_x, dmv_y, 1, pred_flag); @@ -2158,6 +2169,8 @@ static void vc1_decode_b_mb_intfi(VC1Context *v) first_block, s->dest[dst_idx] + off, (i & 4) ? s->uvlinesize : s->linesize, CONFIG_GRAY && (i & 4) && (s->avctx->flags & AV_CODEC_FLAG_GRAY), &block_tt); + if (pat < 0) + return pat; block_cbp |= pat << (i << 2); if (!v->ttmbf && ttmb < 8) ttmb = -1; @@ -2167,6 +2180,8 @@ static void vc1_decode_b_mb_intfi(VC1Context *v) } v->cbp[s->mb_x] = block_cbp; v->ttblk[s->mb_x] = block_tt; + + return 0; } /** Decode one B-frame MB (in interlaced frame B picture) @@ -2453,6 +2468,8 @@ static int vc1_decode_b_mb_intfr(VC1Context *v) first_block, s->dest[dst_idx] + off, (i & 4) ? s->uvlinesize : (s->linesize << fieldtx), CONFIG_GRAY && (i & 4) && (s->avctx->flags & AV_CODEC_FLAG_GRAY), &block_tt); + if (pat < 0) + return pat; block_cbp |= pat << (i << 2); if (!v->ttmbf && ttmb < 8) ttmb = -1;

1 0

avcodec/vc1dec: Require res_sprite for wmv3images
by Michael Niedermayer 31 Aug '19

31 Aug '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Thu Aug 15 20:04:35 2019 +0200| [9c6b4004928ef41563b0e913666f8da27fdb2399] | committer: Michael Niedermayer avcodec/vc1dec: Require res_sprite for wmv3images non res_sprite leads to decoder delay which leads to assertion failure Fixes: Assertion failure Fixes: 16402/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5704510034411520 Fixes: left shift of 1073741824 by 1 places cannot be represented in type 'int' Fixes: 16425/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5692858838810624 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9c6b4004928ef4156… --- libavcodec/vc1dec.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c index 9519864c55..ac3198e4fd 100644 --- a/libavcodec/vc1dec.c +++ b/libavcodec/vc1dec.c @@ -450,6 +450,11 @@ static av_cold int vc1_decode_init(AVCodecContext *avctx) if ((ret = ff_vc1_decode_sequence_header(avctx, v, &gb)) < 0) return ret; + if (avctx->codec_id == AV_CODEC_ID_WMV3IMAGE && !v->res_sprite) { + avpriv_request_sample(avctx, "Non sprite WMV3IMAGE"); + return AVERROR_PATCHWELCOME; + } + count = avctx->extradata_size*8 - get_bits_count(&gb); if (count > 0) { av_log(avctx, AV_LOG_INFO, "Extra data: %i bits left, value: %X\n",

1 0

avcodec/vc1_block: Check for double escapes
by Michael Niedermayer 31 Aug '19

31 Aug '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Thu Aug 15 18:47:54 2019 +0200| [6962fd586e1a9a98828866dcfb4114af30c8c756] | committer: Michael Niedermayer avcodec/vc1_block: Check for double escapes Fixes: out of array read Fixes: 16331/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5672735195267072 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6962fd586e1a9a988… --- libavcodec/vc1_block.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/vc1_block.c b/libavcodec/vc1_block.c index 94184b0873..775e3c516b 100644 --- a/libavcodec/vc1_block.c +++ b/libavcodec/vc1_block.c @@ -526,7 +526,7 @@ static int vc1_decode_ac_coeff(VC1Context *v, int *last, int *skip, int escape = decode210(gb); if (escape != 2) { index = get_vlc2(gb, ff_vc1_ac_coeff_table[codingset].table, AC_VLC_BITS, 3); - if (index < 0) + if (index >= ff_vc1_ac_sizes[codingset] - 1U) return AVERROR_INVALIDDATA; run = vc1_index_decode_table[codingset][index][0]; level = vc1_index_decode_table[codingset][index][1];

1 0

avutil/mathematics: Fix 2 overflows in av_add_stable()
by Michael Niedermayer 31 Aug '19

31 Aug '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sat Aug 10 21:09:03 2019 +0200| [679f3408906081036afacbc94f325793f303c039] | committer: Michael Niedermayer avutil/mathematics: Fix 2 overflows in av_add_stable() Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'long' Fixes: 16022/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5759796759756800 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=679f3408906081036… --- libavutil/mathematics.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavutil/mathematics.c b/libavutil/mathematics.c index 1bf044cdf1..0485db7222 100644 --- a/libavutil/mathematics.c +++ b/libavutil/mathematics.c @@ -198,7 +198,7 @@ int64_t av_add_stable(AVRational ts_tb, int64_t ts, AVRational inc_tb, int64_t i m = inc_tb.num * (int64_t)ts_tb.den; d = inc_tb.den * (int64_t)ts_tb.num; - if (m % d == 0) + if (m % d == 0 && ts <= INT64_MAX - m / d) return ts + m / d; if (m < d) return ts; @@ -206,6 +206,10 @@ int64_t av_add_stable(AVRational ts_tb, int64_t ts, AVRational inc_tb, int64_t i { int64_t old = av_rescale_q(ts, ts_tb, inc_tb); int64_t old_ts = av_rescale_q(old, inc_tb, ts_tb); + + if (old == INT64_MAX) + return ts; + return av_rescale_q(old + 1, inc_tb, ts_tb) + (ts - old_ts); } }

1 0

avformat/utils: return pending IO error on EOF in av_read_frame()
by Marton Balint 31 Aug '19

31 Aug '19

ffmpeg | branch: master | Marton Balint <cus(a)passwd.hu> | Sat Aug 24 22:00:12 2019 +0200| [ce1fcc8cede2971f6e36119e9dd41fb41b36c63a] | committer: Marton Balint avformat/utils: return pending IO error on EOF in av_read_frame() avio_feof() returns true both in case of actual EOF and in case of IO errors. Some demuxers (matroska) have special handling to be able to return the proper error for this exact reason, e.g.: if (avio_feof(pb)) { if (pb->error) { return pb->error; } else { return AVERROR_EOF; } } However, most of the demuxers do not, and they simply return AVERROR_EOF if avio_feof() is true, so there is a real chance that IO errors are mistaken for EOF. We might just say that the API user should always check the IO context error attribute on EOF to make sure no IO errors happened, but not even ffmpeg.c does this. It should be more intuitive to the API user if we simply return the IO error as the return value of av_read_frame() instead of AVERROR_EOF. Signed-off-by: Marton Balint <cus(a)passwd.hu> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ce1fcc8cede2971f6… --- libavformat/utils.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavformat/utils.c b/libavformat/utils.c index b57e680089..b83a740500 100644 --- a/libavformat/utils.c +++ b/libavformat/utils.c @@ -1762,6 +1762,11 @@ FF_ENABLE_DEPRECATION_WARNINGS av_ts2str(pkt->dts), pkt->size, pkt->duration, pkt->flags); + /* A demuxer might have returned EOF because of an IO error, let's + * propagate this back to the user. */ + if (ret == AVERROR_EOF && s->pb && s->pb->error < 0 && s->pb->error != AVERROR(EAGAIN)) + ret = s->pb->error; + return ret; }

1 0

avformat/avidec: add support for recognizing HEVC fourcc when demuxing
by Marton Balint 31 Aug '19

31 Aug '19

ffmpeg | branch: master | Marton Balint <cus(a)passwd.hu> | Sat Aug 24 01:39:33 2019 +0200| [2e31774b409d77f046f166fb3ff630a9ef91def7] | committer: Marton Balint avformat/avidec: add support for recognizing HEVC fourcc when demuxing Some security cams generate this, as well as some versions of VirtualDub and VLC so support for _reading_ such files is justified. Fixes ticket #7110. See also this discussion: https://patchwork.ffmpeg.org/patch/8744/ Signed-off-by: Marton Balint <cus(a)passwd.hu> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2e31774b409d77f04… --- libavformat/avidec.c | 3 +++ libavformat/riff.c | 5 +++++ libavformat/riff.h | 2 ++ 3 files changed, 10 insertions(+) diff --git a/libavformat/avidec.c b/libavformat/avidec.c index 1d887b1cc9..df78925d55 100644 --- a/libavformat/avidec.c +++ b/libavformat/avidec.c @@ -815,6 +815,9 @@ FF_ENABLE_DEPRECATION_WARNINGS "mov tag found in avi (fourcc %s)\n", av_fourcc2str(tag1)); } + if (!st->codecpar->codec_id) + st->codecpar->codec_id = ff_codec_get_id(ff_codec_bmp_tags_unofficial, tag1); + /* This is needed to get the pict type which is necessary * for generating correct pts. */ st->need_parsing = AVSTREAM_PARSE_HEADERS; diff --git a/libavformat/riff.c b/libavformat/riff.c index 610974ebf0..f2c04f8d95 100644 --- a/libavformat/riff.c +++ b/libavformat/riff.c @@ -492,6 +492,11 @@ const AVCodecTag ff_codec_bmp_tags[] = { { AV_CODEC_ID_NONE, 0 } }; +const AVCodecTag ff_codec_bmp_tags_unofficial[] = { + { AV_CODEC_ID_HEVC, MKTAG('H', 'E', 'V', 'C') }, + { AV_CODEC_ID_NONE, 0 } +}; + const AVCodecTag ff_codec_wav_tags[] = { { AV_CODEC_ID_PCM_S16LE, 0x0001 }, /* must come after s16le in this list */ diff --git a/libavformat/riff.h b/libavformat/riff.h index 323aa38b4d..21078b77c8 100644 --- a/libavformat/riff.h +++ b/libavformat/riff.h @@ -73,6 +73,8 @@ int ff_get_wav_header(AVFormatContext *s, AVIOContext *pb, AVCodecParameters *pa extern const AVCodecTag ff_codec_bmp_tags[]; // exposed through avformat_get_riff_video_tags() extern const AVCodecTag ff_codec_wav_tags[]; +extern const AVCodecTag ff_codec_bmp_tags_unofficial[]; + void ff_parse_specific_params(AVStream *st, int *au_rate, int *au_ssize, int *au_scale); int ff_read_riff_info(AVFormatContext *s, int64_t size);

1 0

avformat/mpegts: fix teletext PTS when selecting teletext streams only
by Marton Balint 31 Aug '19

31 Aug '19

ffmpeg | branch: master | Marton Balint <cus(a)passwd.hu> | Sat Aug 24 00:27:41 2019 +0200| [765c56bfa9037060e36250090880b2961c88f27d] | committer: Marton Balint avformat/mpegts: fix teletext PTS when selecting teletext streams only After a1b4f120c031e6697bac9fd8c725d9c37ee36d13 the teletext PTS values were set to AV_NOPTS_VALUE if the stream of the PCR pid was discarded. What actually matters is that if we parse the PCR of the PCR PID or not, so let's use the cached discard value of the actual PCR PID instead of the stream discard value, which may be different. Also fixes ticket #7567, which was caused by the fact that teletext PTS values were not touched if the PCR pid was discarded even before a1b4f120c031e6697bac9fd8c725d9c37ee36d13. Signed-off-by: Marton Balint <cus(a)passwd.hu> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=765c56bfa9037060e… --- libavformat/mpegts.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index 47d8d5f877..58902527c5 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -1303,15 +1303,17 @@ skip: st = pst; } } - if (f->last_pcr != -1 && st && st->discard != AVDISCARD_ALL) { + if (f->last_pcr != -1 && !f->discard) { // teletext packets do not always have correct timestamps, // the standard says they should be handled after 40.6 ms at most, // and the pcr error to this packet should be no more than 100 ms. // TODO: we should interpolate the PCR, not just use the last one int64_t pcr = f->last_pcr / 300; pcr_found = 1; - pes->st->pts_wrap_reference = st->pts_wrap_reference; - pes->st->pts_wrap_behavior = st->pts_wrap_behavior; + if (st) { + pes->st->pts_wrap_reference = st->pts_wrap_reference; + pes->st->pts_wrap_behavior = st->pts_wrap_behavior; + } if (pes->dts == AV_NOPTS_VALUE || pes->dts < pcr) { pes->pts = pes->dts = pcr; } else if (pes->st->codecpar->codec_id == AV_CODEC_ID_DVB_TELETEXT &&

1 0

tools/target_dec_fuzzer: Init parsepkt
by Michael Niedermayer 31 Aug '19

31 Aug '19

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sat Aug 31 00:03:57 2019 +0200| [a370582ba9c4e0db4e8518d4df199003d36bea16] | committer: Michael Niedermayer tools/target_dec_fuzzer: Init parsepkt Fixes: memory corruption Fixes: 16702/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PNG_fuzzer-5768418552184832 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: James Almer <jamrial(a)gmail.com> Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a370582ba9c4e0db4… --- tools/target_dec_fuzzer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c index e22a0c5c34..901dbca385 100644 --- a/tools/target_dec_fuzzer.c +++ b/tools/target_dec_fuzzer.c @@ -194,6 +194,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { // Read very simple container AVPacket avpkt, parsepkt; av_init_packet(&avpkt); + av_init_packet(&parsepkt); while (data < end && it < maxiteration) { // Search for the TAG while (data + sizeof(fuzz_tag) < end) {

1 0