avcodec/ac3dec: Use frame_size if superframe_size is 0
authorMichael Niedermayer <michael@niedermayer.cc>
Thu, 17 May 2018 23:48:38 +0000 (01:48 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Fri, 25 May 2018 22:54:55 +0000 (00:54 +0200)
Fixes: Infinite loop
Fixes: 7669/clusterfuzz-testcase-ffmpeg_AV_CODEC_ID_AC3_FIXED_fuzzer-4689042185650176
Fixes: 7670/clusterfuzz-testcase-ffmpeg_AV_CODEC_ID_AC3_fuzzer-4706306762997760
Fixes: 7672/clusterfuzz-testcase-ffmpeg_AV_CODEC_ID_EAC3_fuzzer-4702108499574784

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/ac3dec.c

index b14d2e7..1d3180b 100644 (file)
@@ -1800,6 +1800,9 @@ dependent_frame:
 
     *got_frame_ptr = 1;
 
+    if (!s->superframe_size)
+        return FFMIN(full_buf_size, s->frame_size);
+
     return FFMIN(full_buf_size, s->superframe_size);
 }