[FFmpeg-devel] [PATCH 2/2] avcodec/rscc: Avoid returning frames that have nearly no undamaged pixels in them

[Michael Niedermayer]

On Fri, Jan 18, 2019 at 11:41:35PM +0000, Matthew Fearnley wrote:
> 
> > On 18 Jan 2019, at 23:00, Michael Niedermayer <michael at niedermayer.cc> wrote:
> > 
> > Fixes: Timeout
> > Fixes: 12192/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RSCC_fuzzer-6279038004363264
> > 
> > Before: clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RSCC_fuzzer-6279038004363264 in 15423 ms
> > After:  clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RSCC_fuzzer-6279038004363264 in 190 ms
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> > libavcodec/rscc.c | 7 ++++++-
> > 1 file changed, 6 insertions(+), 1 deletion(-)
> > 
> > diff --git a/libavcodec/rscc.c b/libavcodec/rscc.c
> > index 7921f149ed..3868c1cb1b 100644
> > --- a/libavcodec/rscc.c
> > +++ b/libavcodec/rscc.c
> > @@ -64,6 +64,7 @@ typedef struct RsccContext {
> >     /* zlib interaction */
> >     uint8_t *inflated_buf;
> >     uLongf inflated_size;
> > +    int valid_pixels
> > } RsccContext;
> > 
> > static av_cold int rscc_init(AVCodecContext *avctx)
> > @@ -348,7 +349,11 @@ static int rscc_decode_frame(AVCodecContext *avctx, void *data,
> >         memcpy (frame->data[1], ctx->palette, AVPALETTE_SIZE);
> >     }
> > 
> > -    *got_frame = 1;
> > +    // We only return a picture when too little is undameged, this avoids copying nearly broken frames around
> Hi,
> FWIW, I think “too little is undameged” should say: “enough of it is undamaged”
> (i.e. invert the logic, fix the typo).

will apply with the better wording

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

In a rich man's house there is no place to spit but his face.
-- Diogenes of Sinope
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: not available
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20190127/61a04637/attachment.sig>