[FFmpeg-devel] [PATCH 1/7] avformat/vivo: Do not use the general expression evaluator for parsing a floating point value

[Anton Khirnov]

Quoting Michael Niedermayer (2021-12-05 22:19:01)
> Fixes: Timeout
> Fixes: 41564/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVO_fuzzer-6309014024093696
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavformat/vivo.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/libavformat/vivo.c b/libavformat/vivo.c
> index b2904cd25a7..8e819d910b7 100644
> --- a/libavformat/vivo.c
> +++ b/libavformat/vivo.c
> @@ -206,11 +206,12 @@ static int vivo_read_header(AVFormatContext *s)
>                      return AVERROR_INVALIDDATA;
>                  value_used = 1;
>              } else if (!strcmp(key, "FPS")) {
> -                AVRational tmp;
> +                double d;
> +                if (sscanf(value, "%f", &d) != 1)
> +                    return AVERROR_INVALIDDATA;
>  
>                  value_used = 1;
> -                if (!av_parse_ratio(&tmp, value, 10000, AV_LOG_WARNING, s))
> -                    fps = av_inv_q(tmp);
> +                fps = av_d2q(1/d, 10000);
>              }
>  
>              if (!value_used)
> -- 
> 2.17.1

Won't this be inexact? You might also skip parsing the field if the
relevant key has already been seen.

-- 
Anton Khirnov