aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2023-01-24 22:48:46 +0100
committerMichael Niedermayer <michael@niedermayer.cc>2023-06-04 20:18:24 +0200
commit99bab6e96168e205ffa990369684fee41e367934 (patch)
treee01af641222e34c414521734ff50650d97f27609
parentdc530f258cf7ac11e777879aa453e131293583e5 (diff)
downloadffmpeg-99bab6e96168e205ffa990369684fee41e367934.tar.gz
avcodec/g2meet: Replace fake allocation avoidance for framebuf
framebuf is only allocated when the new width/height are larger than the old but nothing sets the old so its always allocated. Use av_fast_mallocz() instead. Fixes: Timeout Fixes: 55094/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G2M_fuzzer-5116909932904448 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 38adbc6eebd7f2f34ecf1b0b18019e88bad9d9f4) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-rw-r--r--libavcodec/g2meet.c19
1 files changed, 10 insertions, 9 deletions
diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c
index 7ef275c9fe..5856d51783 100644
--- a/libavcodec/g2meet.c
+++ b/libavcodec/g2meet.c
@@ -143,7 +143,8 @@ typedef struct G2MContext {
int got_header;
uint8_t *framebuf;
- int framebuf_stride, old_width, old_height;
+ int framebuf_stride;
+ unsigned int framebuf_allocated;
uint8_t *synth_tile, *jpeg_tile, *epic_buf, *epic_buf_base;
int tile_stride, epic_buf_stride, old_tile_w, old_tile_h;
@@ -1179,14 +1180,13 @@ static int g2m_init_buffers(G2MContext *c)
{
int aligned_height;
- if (!c->framebuf || c->old_width < c->width || c->old_height < c->height) {
- c->framebuf_stride = FFALIGN(c->width + 15, 16) * 3;
- aligned_height = c->height + 15;
- av_free(c->framebuf);
- c->framebuf = av_mallocz_array(c->framebuf_stride, aligned_height);
- if (!c->framebuf)
- return AVERROR(ENOMEM);
- }
+ c->framebuf_stride = FFALIGN(c->width + 15, 16) * 3;
+ aligned_height = c->height + 15;
+
+ av_fast_mallocz(&c->framebuf, &c->framebuf_allocated, c->framebuf_stride * aligned_height);
+ if (!c->framebuf)
+ return AVERROR(ENOMEM);
+
if (!c->synth_tile || !c->jpeg_tile ||
(c->compression == 2 && !c->epic_buf_base) ||
c->old_tile_w < c->tile_width ||
@@ -1638,6 +1638,7 @@ static av_cold int g2m_decode_end(AVCodecContext *avctx)
av_freep(&c->jpeg_tile);
av_freep(&c->cursor);
av_freep(&c->framebuf);
+ c->framebuf_allocated = 0;
return 0;
}