@@ -612,8 +612,12 @@ int ff_vp56_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
}
}
+ s->discard_frame = 0;
avctx->execute2(avctx, ff_vp56_decode_mbs, 0, 0, (avctx->pix_fmt == AV_PIX_FMT_YUVA420P) + 1);
+ if (s->discard_frame)
+ return AVERROR_INVALIDDATA;
+
if ((res = av_frame_ref(data, p)) < 0)
return res;
*got_frame = 1;
@@ -699,8 +703,13 @@ static int ff_vp56_decode_mbs(AVCodecContext *avctx, void *data,
for (mb_col=0; mb_col<s->mb_width; mb_col++) {
if (!damaged) {
int ret = vp56_decode_mb(s, mb_row, mb_col, is_alpha);
- if (ret < 0)
+ if (ret < 0) {
damaged = 1;
+ if (!s->have_undamaged_frame) {
+ s->discard_frame = 1;
+ return AVERROR_INVALIDDATA;
+ }
+ }
}
if (damaged)
vp56_conceal_mb(s, mb_row, mb_col, is_alpha);
@@ -717,6 +726,9 @@ static int ff_vp56_decode_mbs(AVCodecContext *avctx, void *data,
}
}
+ if (!damaged)
+ s->have_undamaged_frame = 1;
+
next:
if (p->key_frame || s->golden_frame) {
av_frame_unref(s->frames[VP56_FRAME_GOLDEN]);
@@ -203,6 +203,9 @@ struct vp56_context {
VLC runv_vlc[2];
VLC ract_vlc[2][3][6];
unsigned int nb_null[2][2]; /* number of consecutive NULL DC/AC */
+
+ int have_undamaged_frame;
+ int discard_frame;
};
Fixes timeout with 700/clusterfuzz-testcase-5660909504561152 Fixes timeout with 702/clusterfuzz-testcase-4553541576294400 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/vp56.c | 14 +++++++++++++- libavcodec/vp56.h | 3 +++ 2 files changed, 16 insertions(+), 1 deletion(-)