virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-10 06:10:52 +02:00
Code Issues Releases Activity

avcodec/cavsdec: Check I frame mb decode for errors

Browse Source 
Fixes: timeout
Fixes: 2943/clusterfuzz-testcase-5430257156882432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2017-08-13 18:42:45 +02:00
parent 62b75537db
commit 426a322aa2
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/cavsdec.c
View File

@@ -1070,10 +1070,14 @@ static int decode_pic(AVSContext *h)
} else { } else {
h->alpha_offset = h->beta_offset = 0; h->alpha_offset = h->beta_offset = 0;
} }
ret = 0;
if (h->cur.f->pict_type == AV_PICTURE_TYPE_I) { if (h->cur.f->pict_type == AV_PICTURE_TYPE_I) {
do { do {
check_for_slice(h); check_for_slice(h);
decode_mb_i(h, 0); ret = decode_mb_i(h, 0);
if (ret < 0)
break;
} while (ff_cavs_next_mb(h)); } while (ff_cavs_next_mb(h));
} else if (h->cur.f->pict_type == AV_PICTURE_TYPE_P) { } else if (h->cur.f->pict_type == AV_PICTURE_TYPE_P) {
do { do {
@@ -1109,12 +1113,12 @@ static int decode_pic(AVSContext *h)
} while (ff_cavs_next_mb(h)); } while (ff_cavs_next_mb(h));
} }
emms_c(); emms_c();
if (h->cur.f->pict_type != AV_PICTURE_TYPE_B) { if (ret >= 0 && h->cur.f->pict_type != AV_PICTURE_TYPE_B) {
av_frame_unref(h->DPB[1].f); av_frame_unref(h->DPB[1].f);
FFSWAP(AVSFrame, h->cur, h->DPB[1]); FFSWAP(AVSFrame, h->cur, h->DPB[1]);
FFSWAP(AVSFrame, h->DPB[0], h->DPB[1]); FFSWAP(AVSFrame, h->DPB[0], h->DPB[1]);
} }
return 0; return ret;
} }
/***************************************************************************** /*****************************************************************************