diff mbox series

[FFmpeg-devel,1/2] avcodec/g2meet: Replace fake allocation avoidance for framebuf

Message ID 20230124234254.30008-1-michael@niedermayer.cc
State Accepted
Commit 38adbc6eebd7f2f34ecf1b0b18019e88bad9d9f4
Headers show
Series [FFmpeg-devel,1/2] avcodec/g2meet: Replace fake allocation avoidance for framebuf | expand

Checks

Context Check Description
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Michael Niedermayer Jan. 24, 2023, 11:42 p.m. UTC 
framebuf is only allocated when the new width/height are larger than the old
but nothing sets the old so its always allocated.
Use av_fast_mallocz() instead.

Fixes: Timeout
Fixes: 55094/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5116909932904448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/g2meet.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

Comments

Michael Niedermayer April 22, 2023, 9:18 p.m. UTC | #1 
On Wed, Jan 25, 2023 at 12:42:53AM +0100, Michael Niedermayer wrote:
> framebuf is only allocated when the new width/height are larger than the old
> but nothing sets the old so its always allocated.
> Use av_fast_mallocz() instead.
> 
> Fixes: Timeout
> Fixes: 55094/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5116909932904448
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/g2meet.c | 19 ++++++++++---------
>  1 file changed, 10 insertions(+), 9 deletions(-)

will apply patchset

[...]
diff mbox series

Patch

diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c
index 761fd22fc3..7363c2212d 100644
--- a/libavcodec/g2meet.c
+++ b/libavcodec/g2meet.c
@@ -145,7 +145,8 @@  typedef struct G2MContext {
     int        got_header;
 
     uint8_t    *framebuf;
-    int        framebuf_stride, old_width, old_height;
+    int        framebuf_stride;
+    unsigned int framebuf_allocated;
 
     uint8_t    *synth_tile, *jpeg_tile, *epic_buf, *epic_buf_base;
     int        tile_stride, epic_buf_stride, old_tile_w, old_tile_h;
@@ -1160,14 +1161,13 @@  static int g2m_init_buffers(G2MContext *c)
 {
     int aligned_height;
 
-    if (!c->framebuf || c->old_width < c->width || c->old_height < c->height) {
-        c->framebuf_stride = FFALIGN(c->width + 15, 16) * 3;
-        aligned_height     = c->height + 15;
-        av_free(c->framebuf);
-        c->framebuf = av_calloc(c->framebuf_stride, aligned_height);
-        if (!c->framebuf)
-            return AVERROR(ENOMEM);
-    }
+    c->framebuf_stride = FFALIGN(c->width + 15, 16) * 3;
+    aligned_height = c->height + 15;
+
+    av_fast_mallocz(&c->framebuf, &c->framebuf_allocated, c->framebuf_stride * aligned_height);
+    if (!c->framebuf)
+        return AVERROR(ENOMEM);
+
     if (!c->synth_tile || !c->jpeg_tile ||
         (c->compression == 2 && !c->epic_buf_base) ||
         c->old_tile_w < c->tile_width ||
@@ -1617,6 +1617,7 @@  static av_cold int g2m_decode_end(AVCodecContext *avctx)
     av_freep(&c->jpeg_tile);
     av_freep(&c->cursor);
     av_freep(&c->framebuf);
+    c->framebuf_allocated = 0;
 
     return 0;
 }