virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

avcodec/pafvideo: Only clear frame when it was written to

Browse Source 
This avoids unneeded operations and makes the code faster.

Fixes: Timeout
Fixes: 15724/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PAF_VIDEO_fuzzer-5750842205929472 (12sec -> 9sec)
Fixes: 17625/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PAF_VIDEO_fuzzer-5640515311108096 (16sec -> 4sec)

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-08-06 23:07:01 +02:00
parent 114ddf6430
commit 859362a6f0
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/pafvideo.c
View File

@ -55,6 +55,7 @@ typedef struct PAFVideoDecContext {
int current_frame; int current_frame;
uint8_t *frame[4]; uint8_t *frame[4];
int dirty[4];
int frame_size; int frame_size;
int video_size; int video_size;
@ -187,6 +188,7 @@ static int decode_0(PAFVideoDecContext *c, uint8_t *pkt, uint8_t code)
j = bytestream2_get_le16(&c->gb) + offset; j = bytestream2_get_le16(&c->gb) + offset;
if (bytestream2_get_bytes_left(&c->gb) < (j - offset) * 16) if (bytestream2_get_bytes_left(&c->gb) < (j - offset) * 16)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
c->dirty[page] = 1;
do { do {
offset++; offset++;
if (dst + 3 * c->width + 4 > dend) if (dst + 3 * c->width + 4 > dend)
@ -329,9 +331,13 @@ static int paf_video_decode(AVCodecContext *avctx, void *data,
c->pic->palette_has_changed = 1; c->pic->palette_has_changed = 1;
} }
c->dirty[c->current_frame] = 1;
if (code & 0x20) if (code & 0x20)
for (i = 0; i < 4; i++) for (i = 0; i < 4; i++) {
memset(c->frame[i], 0, c->frame_size); if (c->dirty[i])
memset(c->frame[i], 0, c->frame_size);
c->dirty[i] = 0;
}
switch (code & 0x0F) { switch (code & 0x0F) {
case 0: case 0: