RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-01-14 19:31:24 +00:00
Code Issues Projects Releases Wiki Activity

avcodec/vc1dec: Use av_fast_realloc() for slices

Browse Source 
Fixes: Timeout
Fixes: 57281/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-4594141064724480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2023-03-26 20:31:05 +02:00
parent 1942dbb8ca
commit c2ed905b68
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libavcodec/vc1dec.c
View File

@ -836,6 +836,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame *pict,
const uint8_t *rawbuf; const uint8_t *rawbuf;
int raw_size; int raw_size;
} *slices = NULL, *tmp; } *slices = NULL, *tmp;
unsigned slices_allocated = 0;
v->second_field = 0; v->second_field = 0;
@ -859,6 +860,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame *pict,
//for advanced profile we may need to parse and unescape data //for advanced profile we may need to parse and unescape data
if (avctx->codec_id == AV_CODEC_ID_VC1 || avctx->codec_id == AV_CODEC_ID_VC1IMAGE) { if (avctx->codec_id == AV_CODEC_ID_VC1 || avctx->codec_id == AV_CODEC_ID_VC1IMAGE) {
int buf_size2 = 0; int buf_size2 = 0;
size_t next_allocated = 0;
buf2 = av_mallocz(buf_size + AV_INPUT_BUFFER_PADDING_SIZE); buf2 = av_mallocz(buf_size + AV_INPUT_BUFFER_PADDING_SIZE);
if (!buf2) if (!buf2)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
@ -882,7 +884,8 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame *pict,
int buf_size3; int buf_size3;
if (avctx->hwaccel) if (avctx->hwaccel)
buf_start_second_field = start; buf_start_second_field = start;
tmp = av_realloc_array(slices, sizeof(*slices), n_slices+1); av_size_mult(sizeof(*slices), n_slices+1, &next_allocated);
tmp = next_allocated ? av_fast_realloc(slices, &slices_allocated, next_allocated) : NULL;
if (!tmp) { if (!tmp) {
ret = AVERROR(ENOMEM); ret = AVERROR(ENOMEM);
goto err; goto err;
@ -911,7 +914,8 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame *pict,
break; break;
case VC1_CODE_SLICE: { case VC1_CODE_SLICE: {
int buf_size3; int buf_size3;
tmp = av_realloc_array(slices, sizeof(*slices), n_slices+1); av_size_mult(sizeof(*slices), n_slices+1, &next_allocated);
tmp = next_allocated ? av_fast_realloc(slices, &slices_allocated, next_allocated) : NULL;
if (!tmp) { if (!tmp) {
ret = AVERROR(ENOMEM); ret = AVERROR(ENOMEM);
goto err; goto err;
@ -946,7 +950,8 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame *pict,
} else { // found field marker, unescape second field } else { // found field marker, unescape second field
if (avctx->hwaccel) if (avctx->hwaccel)
buf_start_second_field = divider; buf_start_second_field = divider;
tmp = av_realloc_array(slices, sizeof(*slices), n_slices+1); av_size_mult(sizeof(*slices), n_slices+1, &next_allocated);
tmp = next_allocated ? av_fast_realloc(slices, &slices_allocated, next_allocated) : NULL;
if (!tmp) { if (!tmp) {
ret = AVERROR(ENOMEM); ret = AVERROR(ENOMEM);
goto err; goto err;