[FFmpeg-cvslog] avcodec/msvideo1: Check buffer size before re-getting the frame

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Thu May  4 15:24:46 2017 +0200| [cabfed6895fcc679cd6a6244a12d800e0f3f2d20] | committer: Michael Niedermayer

avcodec/msvideo1: Check buffer size before re-getting the frame

Fixes timeout
Fixes: 1306/clusterfuzz-testcase-minimized-6152296217968640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cabfed6895fcc679cd6a6244a12d800e0f3f2d20
---

 libavcodec/msvideo1.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/libavcodec/msvideo1.c b/libavcodec/msvideo1.c
index a49b9be364..29700f54b6 100644
--- a/libavcodec/msvideo1.c
+++ b/libavcodec/msvideo1.c
@@ -301,6 +301,12 @@ static int msvideo1_decode_frame(AVCodecContext *avctx,
     s->buf = buf;
     s->size = buf_size;
 
+    // Discard frame if its smaller than the minimum frame size
+    if (buf_size < (avctx->width/4) * (avctx->height/4) / 512) {
+        av_log(avctx, AV_LOG_ERROR, "Packet is too small\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     if ((ret = ff_reget_buffer(avctx, s->frame)) < 0)
         return ret;