diff mbox series

[FFmpeg-devel,2/3] avcodec/mxpegdec: fix SOF counting

Message ID 20201203091139.14038-2-michael@niedermayer.cc
State Accepted
Commit 401495def62638a205569cac0f7861c7faba4d18
Headers show
Series [FFmpeg-devel,1/3] avformat/id3v2: Sanity check tlen before alloc and uncompress | expand

Checks

Context Check Description
andriy/x86_make success Make finished
andriy/x86_make_fate success Make fate finished
andriy/PPC64_make success Make finished
andriy/PPC64_make_fate success Make fate finished

Commit Message

Michael Niedermayer Dec. 3, 2020, 9:11 a.m. UTC 
Fixes: Timeout (>10sec -> 15ms)
Fixes: 27652/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-5125920868007936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/mxpegdec.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Michael Niedermayer Feb. 4, 2021, 4:27 p.m. UTC | #1 
On Thu, Dec 03, 2020 at 10:11:38AM +0100, Michael Niedermayer wrote:
> Fixes: Timeout (>10sec -> 15ms)
> Fixes: 27652/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MXPEG_fuzzer-5125920868007936
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/mxpegdec.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)

will apply the remainder of this patchset

[...]
diff mbox series

Patch

diff --git a/libavcodec/mxpegdec.c b/libavcodec/mxpegdec.c
index 55ec6e928e..f89226fefa 100644
--- a/libavcodec/mxpegdec.c
+++ b/libavcodec/mxpegdec.c
@@ -247,16 +247,17 @@  static int mxpeg_decode_frame(AVCodecContext *avctx,
                            "Multiple SOF in a frame\n");
                     return AVERROR_INVALIDDATA;
                 }
-                s->got_sof_data = 0;
                 ret = ff_mjpeg_decode_sof(jpg);
                 if (ret < 0) {
                     av_log(avctx, AV_LOG_ERROR,
                            "SOF data decode error\n");
+                    s->got_sof_data = 0;
                     return ret;
                 }
                 if (jpg->interlaced) {
                     av_log(avctx, AV_LOG_ERROR,
                            "Interlaced mode not supported in MxPEG\n");
+                    s->got_sof_data = 0;
                     return AVERROR(EINVAL);
                 }
                 s->got_sof_data ++;