@@ -159,6 +159,7 @@ static int intlist_read(BonkContext *s, int *buf, int entries, int base_2_part)
int n_zeros = 0, step = 256, dominant = 0;
int pos = 0, level = 0;
BitCount *bits = s->bits;
+ int passes = 1;
memset(buf, 0, entries * sizeof(*buf));
if (base_2_part) {
@@ -222,21 +223,25 @@ static int intlist_read(BonkContext *s, int *buf, int entries, int base_2_part)
x = 0;
n_zeros = 0;
for (i = 0; n_zeros < entries; i++) {
+ if (x >= max_x)
+ return AVERROR_INVALIDDATA;
+
if (pos >= entries) {
pos = 0;
- level += 1 << low_bits;
+ level += passes << low_bits;
+ passes = 1;
+ if (bits[x].bit && bits[x].count > entries - n_zeros)
+ passes = bits[x].count / (entries - n_zeros);
}
- if (x >= max_x)
- return AVERROR_INVALIDDATA;
-
if (buf[pos] >= level) {
if (bits[x].bit)
- buf[pos] += 1 << low_bits;
+ buf[pos] += passes << low_bits;
else
n_zeros++;
- bits[x].count--;
+ av_assert1(bits[x].count >= passes);
+ bits[x].count -= passes;
x += bits[x].count == 0;
}
This makes the worst case much faster Fixes: Timeout Fixes: 51363/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BONK_fuzzer-5660734784143360 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/bonk.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)