Commit 0c88a5d3 authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/wmv2dec: skip frames that have only skiped MBs

This requires us to pre-parse the skip data, as we want to
detect this before allocating all the arrays

Fixes: Timeout
Fixes: 9708/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV2_fuzzer-5729709861109760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 93a20366
...@@ -141,6 +141,21 @@ int ff_wmv2_decode_picture_header(MpegEncContext *s) ...@@ -141,6 +141,21 @@ int ff_wmv2_decode_picture_header(MpegEncContext *s)
if (s->qscale <= 0) if (s->qscale <= 0)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
if (s->pict_type != AV_PICTURE_TYPE_I && show_bits(&s->gb, 1)) {
GetBitContext gb = s->gb;
int skip_type = get_bits(&gb, 2);
int run = skip_type == SKIP_TYPE_COL ? s->mb_width : s->mb_height;
while (run > 0) {
int block = FFMIN(run, 25);
if (get_bits(&gb, block) + 1 != 1<<block)
break;
run -= block;
}
if (!run)
return FRAME_SKIPPED;
}
return 0; return 0;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment