RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/clearvideo: Only output a frame if one is coded in the packet 

Fixes: Timeout (183 ms instead of about 20 sec)
Fixes: 3147/clusterfuzz-testcase-4870592182353920

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-09-10 01:32:52 +02:00
parent c225da68cf
commit f0efd795f4
1 changed files with 11 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
libavcodec/clearvideo.c
View File

@ -290,11 +290,6 @@ static int clv_decode_frame(AVCodecContext *avctx, void *data,
} }
frame_type = bytestream2_get_byte(&gb); frame_type = bytestream2_get_byte(&gb);
if ((ret = ff_reget_buffer(avctx, c->pic)) < 0)
return ret;
c->pic->key_frame = frame_type & 0x20 ? 1 : 0;
c->pic->pict_type = frame_type & 0x20 ? AV_PICTURE_TYPE_I : AV_PICTURE_TYPE_P;
if (frame_type & 0x2) { if (frame_type & 0x2) {
if (buf_size < c->mb_width * c->mb_height) { if (buf_size < c->mb_width * c->mb_height) {
@ -302,6 +297,12 @@ static int clv_decode_frame(AVCodecContext *avctx, void *data,
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
if ((ret = ff_reget_buffer(avctx, c->pic)) < 0)
return ret;
c->pic->key_frame = frame_type & 0x20 ? 1 : 0;
c->pic->pict_type = frame_type & 0x20 ? AV_PICTURE_TYPE_I : AV_PICTURE_TYPE_P;
bytestream2_get_be32(&gb); // frame size; bytestream2_get_be32(&gb); // frame size;
c->ac_quant = bytestream2_get_byte(&gb); c->ac_quant = bytestream2_get_byte(&gb);
c->luma_dc_quant = 32; c->luma_dc_quant = 32;
@ -323,14 +324,14 @@ static int clv_decode_frame(AVCodecContext *avctx, void *data,
mb_ret = ret; mb_ret = ret;
} }
} }
if ((ret = av_frame_ref(data, c->pic)) < 0)
return ret;
*got_frame = 1;
} else { } else {
} }
if ((ret = av_frame_ref(data, c->pic)) < 0)
return ret;
*got_frame = 1;
return mb_ret < 0 ? mb_ret : buf_size; return mb_ret < 0 ? mb_ret : buf_size;
} }