diff mbox

[FFmpeg-devel,5/5] avcodec/pnm_parser: Use memmove() to handle "overread"

Message ID 20190801214443.7695-5-michael@niedermayer.cc
State Accepted
Commit 34f6d1a7d7859310914d7f34e8cc3b68d6254003
Headers show

Commit Message

Michael Niedermayer Aug. 1, 2019, 9:44 p.m. UTC
This is significantly faster

Fixes: Timeout (1sec after this and the previous commit)
Fixes: 15558/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PPM_fuzzer-5705273643106304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/pnm_parser.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
diff mbox

Patch

diff --git a/libavcodec/pnm_parser.c b/libavcodec/pnm_parser.c
index 5339bebde9..94777d2cca 100644
--- a/libavcodec/pnm_parser.c
+++ b/libavcodec/pnm_parser.c
@@ -41,8 +41,11 @@  static int pnm_parse(AVCodecParserContext *s, AVCodecContext *avctx,
     int next = END_NOT_FOUND;
     int skip = 0;
 
-    for (; pc->overread > 0; pc->overread--) {
-        pc->buffer[pc->index++]= pc->buffer[pc->overread_index++];
+    if (pc->overread > 0) {
+        memmove(pc->buffer + pc->index, pc->buffer + pc->overread_index, pc->overread);
+        pc->index          += pc->overread;
+        pc->overread_index += pc->overread;
+        pc->overread = 0;
     }
 
     if (pnmpc->remaining_bytes) {