On Tue, 8 Feb 2022, Michael Niedermayer wrote:

Fixes: Timeout
Fixes: 
43717/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5206008287330304

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
---
libavformat/demux.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libavformat/demux.c b/libavformat/demux.c
index dd42d32710..1acba0c608 100644
--- a/libavformat/demux.c
+++ b/libavformat/demux.c
@@ -2590,8 +2590,10 @@ int avformat_find_stream_info(AVFormatContext *ic, 
AVDictionary **options)
        /* NOTE: A new stream can be added there if no header in file
         * (AVFMTCTX_NOHEADER). */
        ret = read_frame_internal(ic, pkt1);
-        if (ret == AVERROR(EAGAIN))
+        if (ret == AVERROR(EAGAIN)) {
+            read_size += 100;

Sorry, same here, very hackish. I especially dislike that you use read_size for a limit because that intereferes with probesize and silently ignores the problem.

Can't we fix the underlying issue? If not, then counting the number of EAGAINs and returning a hard failure if that becomes more than e.g. 10000 would be a lot more acceptable to me. E.g.

if (nb_egains > 10000) {
   av_log(NULL, AV_LOG_ERROR, "read_frame stuck in an EAGAIN loop, this should 
not happen\n);
   return AVERROR_BUG;
}

Regards,
Marton
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".

Reply via email to