aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/snowdec.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2021-08-14 16:45:02 +0200
committerMichael Niedermayer <michael@niedermayer.cc>2021-09-19 22:36:23 +0200
commit0faf04e807fc09bb3d72a034c284fe44b54fa76b (patch)
treecc40e310d623b3640a63177b97c582e2962e0eb3 /libavcodec/snowdec.c
parentdb18f29b33a060b3ce0fc7ac7d215aeb3506c0ae (diff)
downloadffmpeg-0faf04e807fc09bb3d72a034c284fe44b54fa76b.tar.gz
avcodec/snowdec: Maintain avmv buffer
This avoids reallocating per frame Fixes: Assertion failure Fixes: 36359/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-6733238591684608 Fixes: 38623/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-6098656512573440 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/snowdec.c')
-rw-r--r--libavcodec/snowdec.c17
1 files changed, 13 insertions, 4 deletions
diff --git a/libavcodec/snowdec.c b/libavcodec/snowdec.c
index 1355ae6ed1..cd2265aba1 100644
--- a/libavcodec/snowdec.c
+++ b/libavcodec/snowdec.c
@@ -492,9 +492,17 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
s->spatial_decomposition_count
);
- av_assert0(!s->avmv);
if (s->avctx->export_side_data & AV_CODEC_EXPORT_DATA_MVS) {
- s->avmv = av_malloc_array(s->b_width * s->b_height, sizeof(AVMotionVector) << (s->block_max_depth*2));
+ size_t size;
+ res = av_size_mult(s->b_width * s->b_height, sizeof(AVMotionVector) << (s->block_max_depth*2), &size);
+ if (res)
+ return res;
+ av_fast_malloc(&s->avmv, &s->avmv_size, size);
+ if (!s->avmv)
+ return AVERROR(ENOMEM);
+ } else {
+ s->avmv_size = 0;
+ av_freep(&s->avmv);
}
s->avmv_index = 0;
@@ -623,8 +631,6 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
memcpy(sd->data, s->avmv, s->avmv_index * sizeof(AVMotionVector));
}
- av_freep(&s->avmv);
-
if (res < 0)
return res;
@@ -644,6 +650,9 @@ static av_cold int decode_end(AVCodecContext *avctx)
ff_snow_common_end(s);
+ s->avmv_size = 0;
+ av_freep(&s->avmv);
+
return 0;
}