From cabfed6895fcc679cd6a6244a12d800e0f3f2d20 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 4 May 2017 15:24:46 +0200
Subject: [PATCH] avcodec/msvideo1: Check buffer size before re-getting the
 frame

Fixes timeout
Fixes: 1306/clusterfuzz-testcase-minimized-6152296217968640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/msvideo1.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/libavcodec/msvideo1.c b/libavcodec/msvideo1.c
index a49b9be364..29700f54b6 100644
--- a/libavcodec/msvideo1.c
+++ b/libavcodec/msvideo1.c
@@ -301,6 +301,12 @@ static int msvideo1_decode_frame(AVCodecContext *avctx,
     s->buf = buf;
     s->size = buf_size;
 
+    // Discard frame if its smaller than the minimum frame size
+    if (buf_size < (avctx->width/4) * (avctx->height/4) / 512) {
+        av_log(avctx, AV_LOG_ERROR, "Packet is too small\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     if ((ret = ff_reget_buffer(avctx, s->frame)) < 0)
         return ret;