Fixes: Timeout (17sec -> 20ms) Fixes: 14615/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MTS2_fuzzer-5093007763701760 Fixes: 14797/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MTS2_fuzzer-5651696119709696
Unified · Split
| @@ -552,6 +552,11 @@ static int mss4_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, · 551 unmodified lines | |||
| 552 | "Empty frame found but it is not a skip frame.\n"); | 552 | "Empty frame found but it is not a skip frame.\n"); |
| 553 | return AVERROR_INVALIDDATA; | 553 | return AVERROR_INVALIDDATA; |
| 554 | } | 554 | } |
| 555 | mb_width = FFALIGN(width, 16) >> 4; | ||
| 556 | mb_height = FFALIGN(height, 16) >> 4; | ||
| 557 | |||
| 558 | if (frame_type != SKIP_FRAME && 8*buf_size < 8*HEADER_SIZE + mb_width*mb_height) | ||
| 559 | return AVERROR_INVALIDDATA; | ||
| 555 | 560 | ||
| 556 | if ((ret = ff_reget_buffer(avctx, c->pic)) < 0) | 561 | if ((ret = ff_reget_buffer(avctx, c->pic)) < 0) |
| 557 | return ret; | 562 | return ret; |
| @@ -574,9 +579,6 @@ static int mss4_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, · 16 unmodified lines | |||
| 574 | 579 | ||
| 575 | if ((ret = init_get_bits8(&gb, buf + HEADER_SIZE, buf_size - HEADER_SIZE)) < 0) | 580 | if ((ret = init_get_bits8(&gb, buf + HEADER_SIZE, buf_size - HEADER_SIZE)) < 0) |
| 576 | return ret; | 581 | return ret; |
| 577 | |||
| 578 | mb_width = FFALIGN(width, 16) >> 4; | ||
| 579 | mb_height = FFALIGN(height, 16) >> 4; | ||
| 580 | dst[0] = c->pic->data[0]; | 582 | dst[0] = c->pic->data[0]; |
| 581 | dst[1] = c->pic->data[1]; | 583 | dst[1] = c->pic->data[1]; |
| 582 | dst[2] = c->pic->data[2]; | 584 | dst[2] = c->pic->data[2]; |