avcodec/cavsdec: Limit the number of access units per packet to 2
authorMichael Niedermayer <michael@niedermayer.cc>
Sat, 10 Aug 2019 15:34:37 +0000 (17:34 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Thu, 29 Aug 2019 13:16:18 +0000 (15:16 +0200)
Fixes: Timeout (122sec -> 13ms)
Fixes: 15978/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5148925004087296

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/cavsdec.c

index 5f3b354518e64db9cd310cc7d1fb17df978aa55b..1c4f71824a1b9e8598219ab65a2734b4f7e3d61b 100644 (file)
@@ -1215,6 +1215,7 @@ static int cavs_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
     int input_size, ret;
     const uint8_t *buf_end;
     const uint8_t *buf_ptr;
+    int frame_start = 0;
 
     if (buf_size == 0) {
         if (!h->low_delay && h->DPB[0].f->data[0]) {
@@ -1248,6 +1249,9 @@ static int cavs_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
                 h->got_keyframe = 1;
             }
         case PIC_PB_START_CODE:
+            if (frame_start > 1)
+                return AVERROR_INVALIDDATA;
+            frame_start ++;
             if (*got_frame)
                 av_frame_unref(data);
             *got_frame = 0;