[FFmpeg-devel,1/2] avcodec/pnm: Optimize reading loop in pnm_get()

Submitted by Michael Niedermayer on March 10, 2019, 11:42 p.m.

Details

Message ID 20190310234209.9975-1-michael@niedermayer.cc
State Accepted
Commit 14eea7c47a9275dbef0168ee5e13424d1fd58357
Headers show

Commit Message

Michael Niedermayer March 10, 2019, 11:42 p.m.
Fixes: Timeout 13149 (5sec -> 3sec), 13166 (11sec -> 7sec), 13430 (5sec -> 3sec)
Fixes: 13149/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGM_fuzzer-5760833622114304
Fixes: 13166/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-5763216322330624
Fixes: 13430/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PPM_fuzzer-5758658334425088

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/pnm.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

Comments

Michael Niedermayer March 17, 2019, 10:41 a.m.
On Mon, Mar 11, 2019 at 12:42:08AM +0100, Michael Niedermayer wrote:
> Fixes: Timeout 13149 (5sec -> 3sec), 13166 (11sec -> 7sec), 13430 (5sec -> 3sec)
> Fixes: 13149/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGM_fuzzer-5760833622114304
> Fixes: 13166/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-5763216322330624
> Fixes: 13430/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PPM_fuzzer-5758658334425088
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/pnm.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)

will apply patchset

[...]

Patch hide | download patch | download mbox

diff --git a/libavcodec/pnm.c b/libavcodec/pnm.c
index 17926f256f..a9771710c2 100644
--- a/libavcodec/pnm.c
+++ b/libavcodec/pnm.c
@@ -52,12 +52,13 @@  static void pnm_get(PNMContext *sc, char *str, int buf_size)
     }
 
     s = str;
-    while (bs < end && !pnm_space(c)) {
-        if ((s - str)  < buf_size - 1)
-            *s++ = c;
+    while (bs < end && !pnm_space(c) && (s - str) < buf_size - 1) {
+        *s++ = c;
         c = *bs++;
     }
     *s = '\0';
+    while (bs < end && !pnm_space(c))
+        c = *bs++;
     sc->bytestream = bs;
 }