avcodec/parser: Optimize ff_combine_frame() with massivly negative next
authorMichael Niedermayer <michael@niedermayer.cc>
Thu, 1 Aug 2019 20:18:43 +0000 (22:18 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Fri, 23 Aug 2019 20:26:50 +0000 (22:26 +0200)
Fixes: Timeout
Fixes: 15558/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PPM_fuzzer-5705273643106304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/parser.c

index 3e19810a94994dc0f42dc32a9333f6d927b5b002..a63f532c48427f3510c5ea2cc7c563c6e5b99259 100644 (file)
@@ -295,6 +295,10 @@ int ff_combine_frame(ParseContext *pc, int next,
         *buf      = pc->buffer;
     }
 
+    if (next < -8) {
+        pc->overread += -8 - next;
+        next = -8;
+    }
     /* store overread bytes */
     for (; next < 0; next++) {
         pc->state   = pc->state   << 8 | pc->buffer[pc->last_index + next];