diff mbox

[FFmpeg-devel,2/2] avcodec/pnm: Avoid structure pointer dereferences in inner loop in pnm_get()

Message ID 20190221193429.19600-2-michael@niedermayer.cc
State Accepted
Commit 3f68948cb3036e239baa17d88b2f2ef1ecbb8f0c
Headers show

Commit Message

Michael Niedermayer Feb. 21, 2019, 7:34 p.m. UTC
Improves speed from 5.4 to 4.2 seconds
Fixes: 13149/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGM_fuzzer-5760833622114304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/pnm.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

Comments

Lauri Kasanen Feb. 22, 2019, 7:10 a.m. UTC | #1
On Thu, 21 Feb 2019 20:34:29 +0100
Michael Niedermayer <michael@niedermayer.cc> wrote:

> Improves speed from 5.4 to 4.2 seconds
> Fixes: 13149/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGM_fuzzer-5760833622114304

LGTM

Though, I really would expect the compiler to detect and optimize that.
I wonder if "PNMContext * const sc" would help it any.

- Lauri
Michael Niedermayer Feb. 22, 2019, 9:48 p.m. UTC | #2
On Fri, Feb 22, 2019 at 09:10:55AM +0200, Lauri Kasanen wrote:
> On Thu, 21 Feb 2019 20:34:29 +0100
> Michael Niedermayer <michael@niedermayer.cc> wrote:
> 
> > Improves speed from 5.4 to 4.2 seconds
> > Fixes: 13149/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGM_fuzzer-5760833622114304
> 
> LGTM

will apply


> 
> Though, I really would expect the compiler to detect and optimize that.
> I wonder if "PNMContext * const sc" would help it any.

i doubt that would help.
the char * pointer both the one we are reding from and the one we
write to could in principle alias anything else 
(this is allowed in C)

So the compiler would have to proof every time it writes to str/s that this
cannot alias anything in the structure. And every time it writes to the 
structure that it cannot alias the bytestream its reading from.
Otherwise it cannot optimize the operations out

thanks

[...]
diff mbox

Patch

diff --git a/libavcodec/pnm.c b/libavcodec/pnm.c
index b06a6e81b5..17926f256f 100644
--- a/libavcodec/pnm.c
+++ b/libavcodec/pnm.c
@@ -36,13 +36,15 @@  static void pnm_get(PNMContext *sc, char *str, int buf_size)
 {
     char *s;
     int c;
+    uint8_t *bs  = sc->bytestream;
+    const uint8_t *end = sc->bytestream_end;
 
     /* skip spaces and comments */
-    while (sc->bytestream < sc->bytestream_end) {
-        c = *sc->bytestream++;
+    while (bs < end) {
+        c = *bs++;
         if (c == '#')  {
-            while (c != '\n' && sc->bytestream < sc->bytestream_end) {
-                c = *sc->bytestream++;
+            while (c != '\n' && bs < end) {
+                c = *bs++;
             }
         } else if (!pnm_space(c)) {
             break;
@@ -50,12 +52,13 @@  static void pnm_get(PNMContext *sc, char *str, int buf_size)
     }
 
     s = str;
-    while (sc->bytestream < sc->bytestream_end && !pnm_space(c)) {
+    while (bs < end && !pnm_space(c)) {
         if ((s - str)  < buf_size - 1)
             *s++ = c;
-        c = *sc->bytestream++;
+        c = *bs++;
     }
     *s = '\0';
+    sc->bytestream = bs;
 }
 
 int ff_pnm_decode_header(AVCodecContext *avctx, PNMContext * const s)