Fixes: Timeout (17sec -> 20ms) Fixes: 14615/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MTS2_fuzzer-5093007763701760 Fixes: 14797/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MTS2_fuzzer-5651696119709696
Unified · Split
| @@ -552,6 +552,11 @@ static int mss4_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, · 551 unmodified lines | ||
| 552 | 552 | "Empty frame found but it is not a skip frame.\n"); |
| 553 | 553 | return AVERROR_INVALIDDATA; |
| 554 | 554 | } |
| 555 | + mb_width = FFALIGN(width, 16) >> 4; | |
| 556 | + mb_height = FFALIGN(height, 16) >> 4; | |
| 557 | + | |
| 558 | + if (frame_type != SKIP_FRAME && 8*buf_size < 8*HEADER_SIZE + mb_width*mb_height) | |
| 559 | + return AVERROR_INVALIDDATA; | |
| 555 | 560 | |
| 556 | 561 | if ((ret = ff_reget_buffer(avctx, c->pic)) < 0) |
| 557 | 562 | return ret; |
| @@ -574,9 +579,6 @@ static int mss4_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, · 16 unmodified lines | ||
| 574 | 579 | |
| 575 | 580 | if ((ret = init_get_bits8(&gb, buf + HEADER_SIZE, buf_size - HEADER_SIZE)) < 0) |
| 576 | 581 | return ret; |
| 577 | − | |
| 578 | − mb_width = FFALIGN(width, 16) >> 4; | |
| 579 | − mb_height = FFALIGN(height, 16) >> 4; | |
| 580 | 582 | dst[0] = c->pic->data[0]; |
| 581 | 583 | dst[1] = c->pic->data[1]; |
| 582 | 584 | dst[2] = c->pic->data[2]; |