diff mbox

[FFmpeg-devel,4/5] avcodec/parser: Optimize ff_combine_frame() with massivly negative next

Message ID 20190801214443.7695-4-michael@niedermayer.cc
State Accepted
Commit 8a24d2cc304c7f0807bc472dfc39d247040d71c2
Headers show

Commit Message

Michael Niedermayer Aug. 1, 2019, 9:44 p.m. UTC 
Fixes: Timeout
Fixes: 15558/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PPM_fuzzer-5705273643106304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/parser.c | 4 ++++
 1 file changed, 4 insertions(+)

Comments

Michael Niedermayer Aug. 23, 2019, 1:43 p.m. UTC | #1 
On Thu, Aug 01, 2019 at 11:44:42PM +0200, Michael Niedermayer wrote:
> Fixes: Timeout
> Fixes: 15558/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PPM_fuzzer-5705273643106304
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/parser.c | 4 ++++
>  1 file changed, 4 insertions(+)

will apply

[...]
diff mbox

Patch

diff --git a/libavcodec/parser.c b/libavcodec/parser.c
index 3e19810a94..a63f532c48 100644
--- a/libavcodec/parser.c
+++ b/libavcodec/parser.c
@@ -295,6 +295,10 @@  int ff_combine_frame(ParseContext *pc, int next,
         *buf      = pc->buffer;
     }
 
+    if (next < -8) {
+        pc->overread += -8 - next;
+        next = -8;
+    }
     /* store overread bytes */
     for (; next < 0; next++) {
         pc->state   = pc->state   << 8 | pc->buffer[pc->last_index + next];