ffmpeg | branch: master | Michael Niedermayer <mich...@niedermayer.cc> | Thu Aug 17 23:40:45 2017 +0200| [e7b9d136a1ba2d048b1a17df5778e426b825676d] | committer: Michael Niedermayer
avcodec/cngdec: Check skip_samples Without this its possible to make the new decode API decode billions of samples out of a empty input and never return to the caller before all samples have been created and discarded. Fixes: Timeout Fixes: 2992/clusterfuzz-testcase-6649611793989632 Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e7b9d136a1ba2d048b1a17df5778e426b825676d --- libavcodec/cngdec.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/cngdec.c b/libavcodec/cngdec.c index 34f881448d..1e884f3c33 100644 --- a/libavcodec/cngdec.c +++ b/libavcodec/cngdec.c @@ -23,6 +23,7 @@ #include "libavutil/common.h" #include "libavutil/ffmath.h" +#include "libavutil/intreadwrite.h" #include "avcodec.h" #include "celp_filters.h" #include "internal.h" @@ -120,6 +121,11 @@ static int cng_decode_frame(AVCodecContext *avctx, void *data, } } + if (avctx->internal->skip_samples > 10 * avctx->frame_size) { + avctx->internal->skip_samples = 0; + return AVERROR_INVALIDDATA; + } + if (p->inited) { p->energy = p->energy / 2 + p->target_energy / 2; for (i = 0; i < p->order; i++) _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
