February 2022 - ffmpeg-cvslog

avcodec/libdav1d: free the Dav1dData packet on dav1d_send_data() failure
by James Almer 01 Feb '22

01 Feb '22

ffmpeg | branch: master | James Almer <jamrial(a)gmail.com> | Tue Feb 1 12:06:14 2022 -0300| [61b104caaace2dd182b0cb3a51265342b323eb2c] | committer: James Almer avcodec/libdav1d: free the Dav1dData packet on dav1d_send_data() failure We still own it on failure, and there's no point trying to feed it again. This should address the issue reported in dav1d #383 and part of VLC #26259. Signed-off-by: James Almer <jamrial(a)gmail.com> Reviewed-by: Ronald S. Bultje <rsbultje(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=61b104caaace2dd18… --- libavcodec/libdav1d.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavcodec/libdav1d.c b/libavcodec/libdav1d.c index 29fa4f9c3d..872e60e000 100644 --- a/libavcodec/libdav1d.c +++ b/libavcodec/libdav1d.c @@ -347,8 +347,10 @@ static int libdav1d_receive_frame(AVCodecContext *c, AVFrame *frame) if (res < 0) { if (res == AVERROR(EINVAL)) res = AVERROR_INVALIDDATA; - if (res != AVERROR(EAGAIN)) + if (res != AVERROR(EAGAIN)) { + dav1d_data_unref(data); return res; + } } res = dav1d_get_picture(dav1d->c, p);

1 0

avformat/mov: Check size before subtraction
by Michael Niedermayer 01 Feb '22

01 Feb '22

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Mon Jan 17 14:26:05 2022 +0100| [d8d9d506a3de976b647bcbb8f76c7b8d30eff576] | committer: Michael Niedermayer avformat/mov: Check size before subtraction Fixes: signed integer overflow: -9223372036854775808 - 8 cannot be represented in type 'long' Fixes: 43542/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5237670148702208 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d8d9d506a3de976b6… --- libavformat/mov.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index 1437d160f8..a80fcc1606 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -7329,6 +7329,8 @@ static int mov_read_default(MOVContext *c, AVIOContext *pb, MOVAtom atom) if (a.size == 0) { a.size = atom.size - total_size + 8; } + if (a.size < 0) + break; a.size -= 8; if (a.size < 0) break;

1 0

avcodec/cfhd: Avoid signed integer overflow in coeff
by Michael Niedermayer 01 Feb '22

01 Feb '22

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Mon Jan 17 14:16:39 2022 +0100| [cd6ac013a00373126bf3d313743d39b5edd5428a] | committer: Michael Niedermayer avcodec/cfhd: Avoid signed integer overflow in coeff Fixes: signed integer overflow: 15244032 * 256 cannot be represented in type 'int' Fixes: 43504/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-4865014842916864 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cd6ac013a00373126… --- libavcodec/cfhd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/cfhd.c b/libavcodec/cfhd.c index 008a6360b6..ac7826250f 100644 --- a/libavcodec/cfhd.c +++ b/libavcodec/cfhd.c @@ -838,7 +838,7 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame, const uint16_t q = s->quantisation; for (i = 0; i < run; i++) { - *coeff_data |= coeff * 256; + *coeff_data |= coeff * 256U; *coeff_data++ *= q; } } else { @@ -869,7 +869,7 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame, const uint16_t q = s->quantisation; for (i = 0; i < run; i++) { - *coeff_data |= coeff * 256; + *coeff_data |= coeff * 256U; *coeff_data++ *= q; } } else {

1 0

avformat/http: Fix double-free on error
by Andreas Rheinhardt 01 Feb '22

01 Feb '22

ffmpeg | branch: master | Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> | Thu Jan 20 20:18:11 2022 +0100| [61cbfdc0a29e88483a6fa9645f64fec71983689a] | committer: Andreas Rheinhardt avformat/http: Fix double-free on error av_dict_set() with AV_DICT_DONT_STRDUP_VAL takes ownership of the string it is passed to as val; this includes freeing it on error. Fixes Coverity issue #1497468. Reviewed-by: Eran Kornblau <eran.kornblau(a)kaltura.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt(a)outlook.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=61cbfdc0a29e88483… --- libavformat/http.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/libavformat/http.c b/libavformat/http.c index e8096e3134..8f39d11a88 100644 --- a/libavformat/http.c +++ b/libavformat/http.c @@ -333,10 +333,8 @@ static int redirect_cache_set(HTTPContext *s, const char *source, const char *de } ret = av_dict_set(&s->redirect_cache, source, value, AV_DICT_MATCH_CASE | AV_DICT_DONT_STRDUP_VAL); - if (ret < 0) { - av_free(value); + if (ret < 0) return ret; - } return 0; }

1 0