RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-29 02:42:21 +00:00
Code Issues Projects Releases Wiki Activity

iavcodec/zmbv: Avoid reallocating cur/prev buffers if they are large enough

Browse Source 
Fixes: Timeout
Fixes: 9721/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ZMBV_fuzzer-5650321660444672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2018-08-27 00:49:00 +02:00
parent 42f053494c
commit a73579c12d
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libavcodec/zmbv.c
View File

@ -57,6 +57,7 @@ typedef struct ZmbvContext {
AVCodecContext *avctx;
int bpp;
int alloc_bpp;
unsigned int decomp_size;
uint8_t* decomp_buf;
uint8_t pal[768];
@ -494,12 +495,17 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac
return AVERROR_UNKNOWN;
}
c->cur = av_realloc_f(c->cur, avctx->width * avctx->height, (c->bpp / 8));
c->prev = av_realloc_f(c->prev, avctx->width * avctx->height, (c->bpp / 8));
if (c->alloc_bpp < c->bpp) {
c->cur = av_realloc_f(c->cur, avctx->width * avctx->height, (c->bpp / 8));
c->prev = av_realloc_f(c->prev, avctx->width * avctx->height, (c->bpp / 8));
c->alloc_bpp = c->bpp;
}
c->bx = (c->width + c->bw - 1) / c->bw;
c->by = (c->height+ c->bh - 1) / c->bh;
if (!c->cur || !c->prev)
if (!c->cur || !c->prev) {
c->alloc_bpp = 0;
return AVERROR(ENOMEM);
}
memset(c->cur, 0, avctx->width * avctx->height * (c->bpp / 8));
memset(c->prev, 0, avctx->width * avctx->height * (c->bpp / 8));
c->decode_intra= decode_intra;