From 3f68948cb3036e239baa17d88b2f2ef1ecbb8f0c Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 21 Feb 2019 18:38:40 +0100 Subject: [PATCH] avcodec/pnm: Avoid structure pointer dereferences in inner loop in pnm_get() Improves speed from 5.4 to 4.2 seconds Fixes: 13149/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGM_fuzzer-5760833622114304 Fixes: 13166/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PGMYUV_fuzzer-5763216322330624 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Lauri Kasanen Signed-off-by: Michael Niedermayer --- libavcodec/pnm.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/libavcodec/pnm.c b/libavcodec/pnm.c index b06a6e81b5..17926f256f 100644 --- a/libavcodec/pnm.c +++ b/libavcodec/pnm.c @@ -36,13 +36,15 @@ static void pnm_get(PNMContext *sc, char *str, int buf_size) { char *s; int c; + uint8_t *bs = sc->bytestream; + const uint8_t *end = sc->bytestream_end; /* skip spaces and comments */ - while (sc->bytestream < sc->bytestream_end) { - c = *sc->bytestream++; + while (bs < end) { + c = *bs++; if (c == '#') { - while (c != '\n' && sc->bytestream < sc->bytestream_end) { - c = *sc->bytestream++; + while (c != '\n' && bs < end) { + c = *bs++; } } else if (!pnm_space(c)) { break; @@ -50,12 +52,13 @@ static void pnm_get(PNMContext *sc, char *str, int buf_size) } s = str; - while (sc->bytestream < sc->bytestream_end && !pnm_space(c)) { + while (bs < end && !pnm_space(c)) { if ((s - str) < buf_size - 1) *s++ = c; - c = *sc->bytestream++; + c = *bs++; } *s = '\0'; + sc->bytestream = bs; } int ff_pnm_decode_header(AVCodecContext *avctx, PNMContext * const s)