diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-08-13 18:42:45 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-08-15 01:27:36 +0200 |
| commit | 426a322aa2bfd8ec28e467743c79dad81c63c108 (patch) | |
| tree | d30bd7f67c50f6f6a000396f4b051e7ca8688c00 | |
| parent | 62b75537db15816fde8b8a33976ffc4a8277f1fc (diff) | |
| download | ffmpeg-426a322aa2bfd8ec28e467743c79dad81c63c108.tar.gz | |
avcodec/cavsdec: Check I frame mb decode for errors
Fixes: timeout
Fixes: 2943/clusterfuzz-testcase-5430257156882432
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/cavsdec.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c index 7a5f795dab..02b3d213a9 100644 --- a/libavcodec/cavsdec.c +++ b/libavcodec/cavsdec.c @@ -1070,10 +1070,14 @@ static int decode_pic(AVSContext *h) } else { h->alpha_offset = h->beta_offset = 0; } + + ret = 0; if (h->cur.f->pict_type == AV_PICTURE_TYPE_I) { do { check_for_slice(h); - decode_mb_i(h, 0); + ret = decode_mb_i(h, 0); + if (ret < 0) + break; } while (ff_cavs_next_mb(h)); } else if (h->cur.f->pict_type == AV_PICTURE_TYPE_P) { do { @@ -1109,12 +1113,12 @@ static int decode_pic(AVSContext *h) } while (ff_cavs_next_mb(h)); } emms_c(); - if (h->cur.f->pict_type != AV_PICTURE_TYPE_B) { + if (ret >= 0 && h->cur.f->pict_type != AV_PICTURE_TYPE_B) { av_frame_unref(h->DPB[1].f); FFSWAP(AVSFrame, h->cur, h->DPB[1]); FFSWAP(AVSFrame, h->DPB[0], h->DPB[1]); } - return 0; + return ret; } /***************************************************************************** |