diff mbox

[FFmpeg-devel,2/8] avcodec/cavsdec: Limit the number of access units per packet to 2

Message ID 20190810210949.1743-2-michael@niedermayer.cc
State Accepted
Commit 37bc8e3249c88b733bcc0d8c74cdf668292e4d63
Headers show

Commit Message

Michael Niedermayer Aug. 10, 2019, 9:09 p.m. UTC 
Fixes: Timeout (122sec -> 13ms)
Fixes: 15978/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5148925004087296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/cavsdec.c | 4 ++++
 1 file changed, 4 insertions(+)

Comments

Michael Niedermayer Aug. 29, 2019, 1:18 p.m. UTC | #1 
On Sat, Aug 10, 2019 at 11:09:43PM +0200, Michael Niedermayer wrote:
> Fixes: Timeout (122sec -> 13ms)
> Fixes: 15978/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5148925004087296
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/cavsdec.c | 4 ++++
>  1 file changed, 4 insertions(+)

will apply

[...]
diff mbox

Patch

diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c
index 5f3b354518..1c4f71824a 100644
--- a/libavcodec/cavsdec.c
+++ b/libavcodec/cavsdec.c
@@ -1215,6 +1215,7 @@  static int cavs_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
     int input_size, ret;
     const uint8_t *buf_end;
     const uint8_t *buf_ptr;
+    int frame_start = 0;
 
     if (buf_size == 0) {
         if (!h->low_delay && h->DPB[0].f->data[0]) {
@@ -1248,6 +1249,9 @@  static int cavs_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
                 h->got_keyframe = 1;
             }
         case PIC_PB_START_CODE:
+            if (frame_start > 1)
+                return AVERROR_INVALIDDATA;
+            frame_start ++;
             if (*got_frame)
                 av_frame_unref(data);
             *got_frame = 0;