avcodec/vp56: Consider the alpha start as end of the prior header
authorMichael Niedermayer <michael@niedermayer.cc>
Tue, 6 Aug 2019 21:30:02 +0000 (23:30 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Tue, 13 Aug 2019 14:48:38 +0000 (16:48 +0200)
Fixes: Timeout (23sec -> 71ms)
Fixes: 15661/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP6A_fuzzer-6257865947348992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/vp56.c

index 72fea3780e79c37c4ae6ec851af10f0b7a0831a3..695f37e9724ae95dcc9c7bfc115609bc301e5866 100644 (file)
@@ -572,7 +572,7 @@ int ff_vp56_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
     VP56Context *s = avctx->priv_data;
     AVFrame *const p = s->frames[VP56_FRAME_CURRENT];
     int remaining_buf_size = avpkt->size;
-    int av_uninit(alpha_offset);
+    int alpha_offset = remaining_buf_size;
     int i, res;
     int ret;
 
@@ -585,7 +585,7 @@ int ff_vp56_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
             return AVERROR_INVALIDDATA;
     }
 
-    res = s->parse_header(s, buf, remaining_buf_size);
+    res = s->parse_header(s, buf, alpha_offset);
     if (res < 0)
         return res;