@@ -850,6 +850,7 @@ static int decode(AVCodecContext *avctx, void *data, int *got_sub, AVPacket *avp
int len = avpkt->size;
int ret = 0;
int i;
+ size_t nb_rect_allocated = 0;
for (i = 0; i < len; i += 3) {
uint8_t hi, cc_type = bptr[i] & 1;
@@ -886,7 +887,7 @@ static int decode(AVCodecContext *avctx, void *data, int *got_sub, AVPacket *avp
AV_TIME_BASE_Q, ms_tb);
else
sub->end_display_time = -1;
- ret = ff_ass_add_rect(sub, ctx->buffer[bidx].str, ctx->readorder++, 0, NULL, NULL);
+ ret = ff_ass_add_rect2(sub, ctx->buffer[bidx].str, ctx->readorder++, 0, NULL, NULL, &nb_rect_allocated);
if (ret < 0)
return ret;
ctx->last_real_time = sub->pts;
Fixes: Timeout Fixes: 42258/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CCAPTION_fuzzer-5540144118104064 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/ccaption_dec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)