virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

avcodec/cavsdec: Propagate error codes inside decode_mb_i()

Browse Source 
Fixes: Timeout
Fixes: 10702/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5669940938407936

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c1cee05656)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2018-11-04 20:00:16 +01:00
parent ecbf42e13a
commit 14c8795361
1 changed files with 21 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
libavcodec/cavsdec.c
View File

@ -591,14 +591,21 @@ static int decode_residual_block(AVSContext *h, GetBitContext *gb,
}
static inline void decode_residual_chroma(AVSContext *h)
static inline int decode_residual_chroma(AVSContext *h)
{
if (h->cbp & (1 << 4))
decode_residual_block(h, &h->gb, chroma_dec, 0,
if (h->cbp & (1 << 4)) {
int ret = decode_residual_block(h, &h->gb, chroma_dec, 0,
ff_cavs_chroma_qp[h->qp], h->cu, h->c_stride);
if (h->cbp & (1 << 5))
decode_residual_block(h, &h->gb, chroma_dec, 0,
if (ret < 0)
return ret;
}
if (h->cbp & (1 << 5)) {
int ret = decode_residual_block(h, &h->gb, chroma_dec, 0,
ff_cavs_chroma_qp[h->qp], h->cv, h->c_stride);
if (ret < 0)
return ret;
}
return 0;
}
static inline int decode_residual_inter(AVSContext *h)
@ -649,6 +656,7 @@ static int decode_mb_i(AVSContext *h, int cbp_code)
uint8_t top[18];
uint8_t *left = NULL;
uint8_t *d;
int ret;
ff_cavs_init_mb(h);
@ -692,8 +700,11 @@ static int decode_mb_i(AVSContext *h, int cbp_code)
ff_cavs_load_intra_pred_luma(h, top, &left, block);
h->intra_pred_l[h->pred_mode_Y[scan3x3[block]]]
(d, top, left, h->l_stride);
if (h->cbp & (1<<block))
decode_residual_block(h, gb, intra_dec, 1, h->qp, d, h->l_stride);
if (h->cbp & (1<<block)) {
ret = decode_residual_block(h, gb, intra_dec, 1, h->qp, d, h->l_stride);
if (ret < 0)
return ret;
}
}
/* chroma intra prediction */
@ -703,7 +714,9 @@ static int decode_mb_i(AVSContext *h, int cbp_code)
h->intra_pred_c[pred_mode_uv](h->cv, &h->top_border_v[h->mbx * 10],
h->left_border_v, h->c_stride);
decode_residual_chroma(h);
ret = decode_residual_chroma(h);
if (ret < 0)
return ret;
ff_cavs_filter(h, I_8X8);
set_mv_intra(h);
return 0;