virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-07-16 22:42:38 +02:00
Code Issues Releases Activity

avcodec/vp56: Require a correctly decoded frame before using vp56_conceal_mb()

Browse Source 
Fixes timeout with 700/clusterfuzz-testcase-5660909504561152
Fixes timeout with 702/clusterfuzz-testcase-4553541576294400

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2017-03-02 03:02:06 +01:00
parent 4507f29e4a
commit 2ce4f28431
2 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
libavcodec/vp56.c
View File

@ -617,8 +617,12 @@ int ff_vp56_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
} }
} }
s->discard_frame = 0;
avctx->execute2(avctx, ff_vp56_decode_mbs, 0, 0, (avctx->pix_fmt == AV_PIX_FMT_YUVA420P) + 1); avctx->execute2(avctx, ff_vp56_decode_mbs, 0, 0, (avctx->pix_fmt == AV_PIX_FMT_YUVA420P) + 1);
if (s->discard_frame)
return AVERROR_INVALIDDATA;
if ((res = av_frame_ref(data, p)) < 0) if ((res = av_frame_ref(data, p)) < 0)
return res; return res;
*got_frame = 1; *got_frame = 1;
@ -704,8 +708,13 @@ static int ff_vp56_decode_mbs(AVCodecContext *avctx, void *data,
for (mb_col=0; mb_col<s->mb_width; mb_col++) { for (mb_col=0; mb_col<s->mb_width; mb_col++) {
if (!damaged) { if (!damaged) {
int ret = vp56_decode_mb(s, mb_row, mb_col, is_alpha); int ret = vp56_decode_mb(s, mb_row, mb_col, is_alpha);
if (ret < 0) if (ret < 0) {
damaged = 1; damaged = 1;
if (!s->have_undamaged_frame) {
s->discard_frame = 1;
return AVERROR_INVALIDDATA;
}
}
} }
if (damaged) if (damaged)
vp56_conceal_mb(s, mb_row, mb_col, is_alpha); vp56_conceal_mb(s, mb_row, mb_col, is_alpha);
@ -722,6 +731,9 @@ static int ff_vp56_decode_mbs(AVCodecContext *avctx, void *data,
} }
} }
if (!damaged)
s->have_undamaged_frame = 1;
next: next:
if (p->key_frame || s->golden_frame) { if (p->key_frame || s->golden_frame) {
av_frame_unref(s->frames[VP56_FRAME_GOLDEN]); av_frame_unref(s->frames[VP56_FRAME_GOLDEN]);

3
libavcodec/vp56.h
View File

@ -203,6 +203,9 @@ struct vp56_context {
VLC runv_vlc[2]; VLC runv_vlc[2];
VLC ract_vlc[2][3][6]; VLC ract_vlc[2][3][6];
unsigned int nb_null[2][2]; /* number of consecutive NULL DC/AC */ unsigned int nb_null[2][2]; /* number of consecutive NULL DC/AC */
int have_undamaged_frame;
int discard_frame;
}; };