Fixes timeout with 847/clusterfuzz-testcase-5291877358108672 Fixes timeout with 850/clusterfuzz-testcase-5721296509861888
This likely will need to be tweaked Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> --- libavcodec/vp56.c | 10 +++++++--- libavcodec/vp56.h | 1 + 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/libavcodec/vp56.c b/libavcodec/vp56.c index 9d4162bb96..b4ee760080 100644 --- a/libavcodec/vp56.c +++ b/libavcodec/vp56.c @@ -508,6 +508,7 @@ static int vp56_size_changed(VP56Context *s) s->plane_height[1] = s->plane_height[2] = avctx->coded_height/2; s->have_undamaged_frame = 0; + s->damaged_frame_count = 0; for (i=0; i<4; i++) s->stride[i] = s->flip * s->frames[VP56_FRAME_CURRENT]->linesize[i]; @@ -712,8 +713,9 @@ static int ff_vp56_decode_mbs(AVCodecContext *avctx, void *data, int ret = vp56_decode_mb(s, mb_row, mb_col, is_alpha); if (ret < 0) { damaged = 1; - if (!s->have_undamaged_frame) { + if (5*s->have_undamaged_frame <= s->damaged_frame_count) { s->discard_frame = 1; + s->damaged_frame_count ++; return AVERROR_INVALIDDATA; } } @@ -733,8 +735,10 @@ static int ff_vp56_decode_mbs(AVCodecContext *avctx, void *data, } } - if (!damaged) - s->have_undamaged_frame = 1; + if (!damaged) { + s->have_undamaged_frame ++; + } else + s->damaged_frame_count ++; next: if (p->key_frame || s->golden_frame) { diff --git a/libavcodec/vp56.h b/libavcodec/vp56.h index c049399df8..37837d0c7b 100644 --- a/libavcodec/vp56.h +++ b/libavcodec/vp56.h @@ -206,6 +206,7 @@ struct vp56_context { int have_undamaged_frame; int discard_frame; + int damaged_frame_count; }; -- 2.11.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
