Traneptora/FFmpeg
1
Fork 0
forked from FFmpeg/FFmpeg
Code Pull requests Activity

avcodec/cavsdec: Check I frame mb decode for errors

Browse source 
Fixes: timeout
Fixes: 2943/clusterfuzz-testcase-5430257156882432

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-08-13 18:42:45 +02:00
parent 62b75537db
commit 426a322aa2
1 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
libavcodec/cavsdec.c
View file

@ -1070,10 +1070,14 @@ static int decode_pic(AVSContext *h)
} else {
h->alpha_offset = h->beta_offset = 0;
}
ret = 0;
if (h->cur.f->pict_type == AV_PICTURE_TYPE_I) {
do {
check_for_slice(h);
decode_mb_i(h, 0);
ret = decode_mb_i(h, 0);
if (ret < 0)
break;
} while (ff_cavs_next_mb(h));
} else if (h->cur.f->pict_type == AV_PICTURE_TYPE_P) {
do {
@ -1109,12 +1113,12 @@ static int decode_pic(AVSContext *h)
} while (ff_cavs_next_mb(h));
}
emms_c();
if (h->cur.f->pict_type != AV_PICTURE_TYPE_B) {
if (ret >= 0 && h->cur.f->pict_type != AV_PICTURE_TYPE_B) {
av_frame_unref(h->DPB[1].f);
FFSWAP(AVSFrame, h->cur, h->DPB[1]);
FFSWAP(AVSFrame, h->DPB[0], h->DPB[1]);
}
return 0;
return ret;
}
/*****************************************************************************