avcodec/msvideo1: Check buffer size before re-getting the frame
authorMichael Niedermayer <michael@niedermayer.cc>
Thu, 4 May 2017 13:24:46 +0000 (15:24 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Thu, 4 May 2017 15:15:43 +0000 (17:15 +0200)
Fixes timeout
Fixes: 1306/clusterfuzz-testcase-minimized-6152296217968640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/msvideo1.c

index a49b9be..29700f5 100644 (file)
@@ -301,6 +301,12 @@ static int msvideo1_decode_frame(AVCodecContext *avctx,
     s->buf = buf;
     s->size = buf_size;
 
+    // Discard frame if its smaller than the minimum frame size
+    if (buf_size < (avctx->width/4) * (avctx->height/4) / 512) {
+        av_log(avctx, AV_LOG_ERROR, "Packet is too small\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     if ((ret = ff_reget_buffer(avctx, s->frame)) < 0)
         return ret;