Commit Graph

115105 Commits

Author SHA1 Message Date
Michael Niedermayer f2bc7ba82f
avcodec/svq3: Check there are bits left before decompression
Fixes: out of array read
Fixes: 402587670/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-6343867775647744

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c06f5b3ab9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:31 +02:00
Michael Niedermayer 2eb4b18916
avcodec/sonic: Check num_taps
The encoder uses max 128 taps, which is quiet a lot already
If work is done to improve sonic, it will be more radical than changing the taps

Fixes: Timeout
Fixes: 402539974/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-6122944271286272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fd0a792766)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:31 +02:00
Michael Niedermayer 26d4501cb9
avformat/imf_cpl: fix indention after previous commit
(cherry picked from commit d28bec8c4d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:30 +02:00
Michael Niedermayer 63efe4bd80
avformat/imf_cpl: do not continue looping forever
Fixes: infinite loop
Fixes: 401658595/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5756875014733824
Regression since: 61fa1e14e4

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 39800d78b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:30 +02:00
Michael Niedermayer 6df4b662cb
avformat/mov: reject negative ELST durations
Fixes: multiple integer overflows
Fixes: 401016767/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6242067591790592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9fc2702f6f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:30 +02:00
Michael Niedermayer e53e2e26c8
avformat/avidec: Ignore duplicate GAB2
Fixes: memleak
Fixes: 398401912/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-4669849976766464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6a47046981)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:29 +02:00
Michael Niedermayer 19bcd62b46
avcodec/h264_mb: Fix tmp_cr for arm
When decoding a bitstream with weighted-bipred enabled,
the results on ARM and x86 platforms may differ.

The reason for the inconsistency is that the value of
STRIDE_ALIGN differs between platforms. And STRIDE_ALIGN
is set to the buffer stride of temporary buffers for U
and V components in mc_part_weighted.

If the buffer stride is 32 or 64 (as on x86 platforms),
the U and V pixels can be interleaved row by row without
overlapping, resulting in correct output.
However, on ARM platforms where the stride is 16,
the V component did overwrite part of the U component's pixels,
leading to incorrect predicted pixels.

The bug can be reproduced by the following bitstream.

https://trac.ffmpeg.org/attachment/ticket/11357/inter_weighted_bipred2.264

Fixes: ticket 11357
Commit-msg-mostly-by: Bin Peng <pengbin@visionular.com>
Reviewed-by: Bin Peng <pengbin@visionular.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 74fd2c3ddb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:29 +02:00
Michael Niedermayer d52856f507
avcodec/vorbisdec: Dont treat overread as error
This differs from libvorbis by
stddev:    2.44 PSNR: 88.58 MAXDIFF:   41 bytes:   834304/   834304
for the file from the ticket

Fixes: Ticket11427

Regression since: dc89cf804a

This is a similar solution to what james proposed earlier in
[FFmpeg-devel] [PATCH] avcodec/vorbisdec: don't abort on EOD when decoding residuals

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fd5a3c5fed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:29 +02:00
Michael Niedermayer f9b617c15a
avformat/iff: Check nb_channels == 0 in MHDR
Fixes: division by 0
Fixes: 395163171/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-542604339373670

Reviewed-by: Peter Ross <pross@xvid.org>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce1fd73d63)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:28 +02:00
Michael Niedermayer 0c19b39dca
tests/fate/filter-video: Fix dependancy for codecview
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b643e3f65)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:28 +02:00
Michael Niedermayer f7a26950cc
libpostproc: check minimum size
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 917c15435a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:28 +02:00
Michael Niedermayer d0f89c457d
avformat/hls: Fix flash1.bogulus.cfd support
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 75be669ca1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:27 +02:00
Michael Niedermayer a7adf9cf18
avformat/hls: Split allowed_segment_extensions off allowed_extensions
This allows the user to set only the one that is needed to ALL or a
specific "wrong" extension like html

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f99f223eb1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:27 +02:00
Michael Niedermayer 8d1812ad8c
avformat/hls: Fix Youtube AAC
Fixes: Ticket11435
Fixes: yt-dlp -f 234+270 https://www.youtube.com/live/l8PMl7tUDIE

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 48c0dba23b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:27 +02:00
Michael Niedermayer 62c1f5615d
avformat/hls: add fmp4 to allowed_extensions
Fixes: yt-dlp/issues/12700

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d82016c730)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:26 +02:00
Michael Niedermayer c418fc8bb4
avformat/hls: Add ec3 to allowed_extensions
Fixes part of Ticket11435
Fixes: Elisa Viihde (Finnish online recording service)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 68644994fd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:26 +02:00
Michael Niedermayer d22a7dbfc6
avformat/hls: Add cmfv and cmfa to allowed_extensions
Fixes: www.nicovideo.jp
Fixes: Ticket11526
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2352145e41)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:26 +02:00
Michael Niedermayer 05440074bf
postproc/postprocess_template: Fix reading uninitialized pixels in dering_C()
This issue was found through the new blocktest

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0118f392be)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:25 +02:00
Michael Niedermayer 6ee5107296
configure: Clearer documentation for "disable-safe-bitstream-reader"
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 979608dde7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:25 +02:00
Michael Niedermayer 5e835cb7be
avcodec/osq: avoid undefined negation
Fixes: negation of -2147483648 cannot be represented in type 'int32_t' (aka 'int'); cast to an unsigned type to negate this value to itself
Fixes: 390646659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-5040277374435328

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c6a889f3e0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:24 +02:00
Michael Niedermayer 4cd539c093
swscale/output: Fix integer overflow in yuv2gbrp_full_X_c()
Fixes: signed integer overflow: 1966895953 + 210305024 cannot be represented in type 'int'
Fixes: 391921975/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5916798905548800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce538ef97a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:24 +02:00
James Almer 6eaf9a7fff
avcodec/libtheora: fix setting keyframe_mask
t_info.keyframe_granule_shift is set to the library default of 6, which is ok
for gop sizes up to 63. Since there's apparently no way to query the updated
value after having forced a gop value with TH_ENCCTL_SET_KEYFRAME_FREQUENCY_FORCE,
calculate it manually instead.

Fixes ticket #11454.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 22aa71d4da)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:24 +02:00
James Almer ab650a5284
avfilter/buffersrc: check for valid sample rate
A sample rate <= 0 is invalid.

Fixes an assert in ffmpeg_enc.c that assumed a valid sample rate would be set.
Fixes ticket #11385.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 1446e37d3d)
2025-08-04 18:51:23 +02:00
Michael Niedermayer 1ccb8c1e6d
doc: replace http/git by https urls
These are more secure

Reviewed-by: Gyan Doshi <ffmpeg@gyani.pro>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b4d165c68f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:23 +02:00
Lynne d639a90f54
configure: update copyright year
On 01/01/2025 19:05, Peter Ross wrote:
> FFmpeg turns 25 this year.

(cherry picked from commit d3aa99a4f4)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:23 +02:00
softworkz a82046f21f
avformat/hls: Partially revert "reduce default max reload to 3"
(setting to 100 as a reasonable compromise)

The change has caused regressions for many users and consumers.
Playlist reloads only happen when a playlist doesn't indicate that it
has ended (via #EXT-X-ENDLIST), which means that the addition of future
segments is still expected.
It is well possible that an HLS server is temporarily unable to serve
further segments but resumes after some time, either indicating a
discontinuity or even by fully catching up.
With a segment length of 3s, a max_reload value of 1000 corresponds to
a duration of 50 minutes which appears to be a reasonable default.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ace9f03a6c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-08-04 18:51:22 +02:00
Lynne f98f142da5 aacenc_tns: clamp filter direction energy measurement
The issue is that:

float en[2];
...
tns->n_filt[w] = is8 ? 1 : order != TNS_MAX_ORDER ? 2 : 3;
for (g = 0; g < tns->n_filt[w]; g++) {
    tns->direction[w][g] = slant != 2 ? slant : en[g] < en[!g];

When using the AAC Main profile, n_filt = 3, and slant is by
default 2 (normal long frames), g can go above 1.

en is the evolution of energy in the frequency domain for every
band at the given window. E.g. whether the energy is concentrated
at the top of each band, or the bottom.

For 2-pole filters, its straightforward.
For 3-pole filters, we need more than 2 measurements.

This commit properly implements support for 3-pole filters, by measuring
the band energy across three areas.

Do note that even xHE-AAC caps n_filt to 2, and only AAC Main allows
n_filt == 3.

Fixes https://trac.ffmpeg.org/ticket/11418

(cherry picked from commit ed09aa28ae3b4509f00a24a9ebdeb084ee00736a)
2025-07-15 16:35:05 +09:00
James Almer 2e503a9b94 fftools/ffmpeg_demux: don't flag timestamps as unreliable if they are generated
Regardless of the source being an AVFMT_NOTIMESTAMPS format, if the timestamps
are generated like when using the use_wallclock_as_timestamps demuxer option,
then they are reliable.

Fixes ticket #11268

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 1787fade20)
2025-07-10 11:17:54 -03:00
Coia Prant 67ce9aeb5c configure: Use MSYSTEM_CARCH for default arch on msys2
On msys2, `uname -m` returns the architecture of the base msys2
layer. On Windows on arm64, the base msys2 layer itself is still
x86_64 only, even if running with e.g. the clangarm64 where the
windows native applications are built as aarch64.

If MSYSTEM_CARCH is set, use this instead of `uname -m` for
the default architecture. This gives the correct behaviour
for the clangarm64 environments. It also gives the correct
default for the 32 bit x86 environments such as `mingw32`.

(On `mingw32`, the fact that `uname -m` returned `x86_64`
hasn't been an issue, as both that and `i686` gets normalized
into `x86` internally in ffmpeg's configure.)

Signed-off-by: Coia Prant <coiaprant@gmail.com>
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit df967d095a)
2025-05-28 10:56:05 +03:00
Paul B Mahol 01e42959a5 avfilter/avfiltergraph: fix regression in picking channel layout
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 1b3f4842c1)
2025-05-22 19:41:16 -03:00
Martin Storsjö 20d711e4df configure: Enable -fno-common for Darwin targets, avoid linker warnings
Since GCC 10 and llvm.org Clang 11, -fno-common is the default.
However Apple's Xcode Clang hasn't followed suit yet, and still
defaults to -fcommon.

Compiling with -fcommon causes uninitialized global variables to
be treated as "common" (which allows multiple object files to have
similar definitions).

Common variables seem to have the issue that their intended alignment
isn't signaled, so the linker assumes that they may need alignment
according to their full size.

With large global tables, this can lead to linker warnings like
this, with Xcode 16.3:

    ld: warning: reducing alignment of section __DATA,__common from 0x8000 to 0x4000 because it exceeds segment maximum alignment

This can be reproduced with a small snippet like this:

    char table[16385];
    int main(int argc, char* argv[]) { return 0; }

Compiling with -fno-common avoids this issue and warning, and
matches the default behaviour of other compilers. (Compiling with
-fno-common also avoids the risk of accidentally accepting
duplicate definitions of global variables, as long as they are
uninitialized.)

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit f4e72eb5a3)
2025-05-06 10:57:27 +03:00
Martin Storsjö eaa3fb32d9 configure: Only try to use the -no_warn_duplicate_libraries flag on Darwin
While we only add the flag if the linker seems to support it,
it turns out that ld.bfd had a bug where the flag is accidentally
accepted, and the flag produces an output file named
"_warn_duplicate_libraries".

The ld.bfd bug was fixed in binutils 2.36, in
https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=3991c7acb29aa8d7d52150695eb3efa03a08dd50.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 38d08f5c45)
2025-05-06 10:57:19 +03:00
Martin Storsjö 5c61d2bddd configure: Silence Xcode warnings about duplicate libraries
Since Xcode 15, macOS developer tools use a new linker. The new
linker by default warns for duplicate -l options. As this is a
known and expected thing, not to be considered an issue, ask for
the warning to be silenced.

This silences linker warnings like this:

    ld: warning: ignoring duplicate libraries: '-lc++', '-lcrypto', '-lm', '-logg', '-lpthread', '-lssl', '-lvorbis', '-lvpx', '-lz'

The linker can also warn about duplicate -rpath options, and there's
currently no option to silence those warnings.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit bd22d7e601)
2025-05-06 10:56:41 +03:00
Brad Smith 94e94becb1 lsws/ppc/yuv2rgb_altivec: Fix build in non-VSX environments with Clang v2
v2: test for function if AltiVec is enabled instead of with AltiVec and without VSX

(cherry picked from commit 49c8f33262)
Signed-off-by: Brad Smith <brad@comstyle.com>
2025-03-16 00:10:37 -04:00
Brad Smith 70fe76385d lsws/ppc/yuv2rgb_altivec: Fix build in non-VSX environments with Clang
Add a check for the existence of the vec_xl() function. Clang provides
the function even with VSX not enabled.

(cherry picked from commit 30a8641465)
Signed-off-by: Brad Smith <brad@comstyle.com>
2025-03-16 00:10:28 -04:00
James Almer cacdb41ef2 Changelog: update
Signed-off-by: James Almer <jamrial@gmail.com>
2025-02-28 16:27:20 -03:00
Patrice Dumas f1e8e74477 doc/t2h: Support texinfo 7.1 and 7.2 pretest
Here is a proposed patch for portability of doc/t2h.pm for GNU Texinfo
7.1 and 7.1.90 (7.2 pretest).  I tested against 7.1 and 7.1.90 (7.2
pretest).  There is a difference in the headings compared to the website
version, maybe related to FA_ICONS not being set the same, but the
result seems correct.

I also renamed $element to $output_unit in ffmpeg_heading_command as in
new equivalent makeinfo/texi2any code the $element variable is the
$command variable in ffmpeg_heading_command, which is very confusing.  I
left as is the $command variable to have a patch easier to read, but it
could make sense to rename $command as $element later on.

The patch could also have effects with Texinfo 7.0, since some of the
changes are for that version, but that probably never show up because it
is for situations that may not exist in ffmpeg manuals (for example
@node without sectioning command), or because the code is robust to some
missing information (case of $heading_level in ffmpeg_heading_command
that was not set, as far as I can tell).

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 4d9cdf82ee)
2025-02-28 16:24:33 -03:00
James Almer e0e7c95a06 avformat/iamf_parse: ensure there's at most one of each parameter types in audio elements
Should prevent potential memory leaks on invalid files.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 5470d024e1)
2025-02-28 16:24:33 -03:00
James Almer 695dcf29c2 avformat/iamf_parse: add missing constrains for num_parameters in audio_element_oub()
Fixes ticket #11475.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 0526535cd5)
2025-02-28 16:24:33 -03:00
James Almer d6270e6b5c avformat/iamf_parse: add missing av_free() call on failure path
Fixes ticket #11416

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit d5873be583)
2025-02-28 16:24:33 -03:00
James Almer c10f15c0e8 avformat/iamf_writer: ensure the stream groups are not empty
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit cedd9151f8)
2025-02-28 16:24:33 -03:00
James Almer d88741836e avformat/iamf_writer: fix setting num_samples_per_frame for OPUS
As per section 3.11.1 of the IAMF spec, the sample rate used in Codec Config
for Opus shall be 48kHz, regardless of the original sample rate used during
encoding.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 76049d1c45)
2025-02-28 16:24:33 -03:00
James Almer 70ae846c71 avformat/iamf_parse: fix setting duration for the last subblock in a parameter definition
When subblock durations are constant, the last block may be smaller and the
value needs to be calculated.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit fb5e8ea971)
2025-02-28 16:24:33 -03:00
James Almer 5a8055a58a avformat/iamf_parse: add checks to parameter definition durations
Section 3.6.1 of the IAMF spec states "When constant_subblock_duration is equal to 0, the summation of all
subblock_duration in this parameter block SHALL be equal to duration.".

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit d38fc25519)
2025-02-28 16:24:33 -03:00
James Almer 3c3d252449 avformat/iamfdec: don't set individual streams as dependent
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 2d33f66f9a)
2025-02-28 16:24:33 -03:00
Michael Niedermayer 9aab014878
update for 7.0.3
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 01:45:06 +01:00
Michael Niedermayer 33435e078f
avformat/iff: Check that we have a stream in read_dst_frame()
Fixes: null pointer dereference
Fixes: 385644864/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4551049565765632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8668957ef6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 01:42:20 +01:00
Michael Niedermayer f43dfb5e82
avformat/mlvdec: fix size checks
Fixes: heap-buffer-overflow
Fixes: 391962476/clusterfuzz-testcase-minimized-ffmpeg_dem_MLV_fuzzer-5746746587676672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 251d43aef0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 01:42:20 +01:00
Michael Niedermayer 89a792fd3b
avformat/wavdec: Fix overflow of intermediate in block_align check
Fixes: signed integer overflow: -251517880 * 32 cannot be represented in type 'int'
Fixes: 385224934/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-4909298151915520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1afbc40875)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 01:42:20 +01:00
Michael Niedermayer af1eb801da
avformat/mxfdec: Check edit unit for overflow in mxf_set_current_edit_unit()
Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'long'
Fixes: 392672068/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6232335892152320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin <git@haerdin.se>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8a6ad9eab2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-27 01:42:19 +01:00