[FFmpeg-devel] [PATCH 2/4] avcodec/bonk: decode multiple passes in intlist_read() at once
Michael Niedermayer
michael at niedermayer.cc
Sat Nov 5 22:16:27 EET 2022
This makes the worst case much faster
Fixes: Timeout
Fixes: 51363/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BONK_fuzzer-5660734784143360
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
libavcodec/bonk.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
diff --git a/libavcodec/bonk.c b/libavcodec/bonk.c
index 409694f710..471e09fe14 100644
--- a/libavcodec/bonk.c
+++ b/libavcodec/bonk.c
@@ -159,6 +159,7 @@ static int intlist_read(BonkContext *s, int *buf, int entries, int base_2_part)
int n_zeros = 0, step = 256, dominant = 0;
int pos = 0, level = 0;
BitCount *bits = s->bits;
+ int passes = 1;
memset(buf, 0, entries * sizeof(*buf));
if (base_2_part) {
@@ -222,21 +223,25 @@ static int intlist_read(BonkContext *s, int *buf, int entries, int base_2_part)
x = 0;
n_zeros = 0;
for (i = 0; n_zeros < entries; i++) {
+ if (x >= max_x)
+ return AVERROR_INVALIDDATA;
+
if (pos >= entries) {
pos = 0;
- level += 1 << low_bits;
+ level += passes << low_bits;
+ passes = 1;
+ if (bits[x].bit && bits[x].count > entries - n_zeros)
+ passes = bits[x].count / (entries - n_zeros);
}
- if (x >= max_x)
- return AVERROR_INVALIDDATA;
-
if (buf[pos] >= level) {
if (bits[x].bit)
- buf[pos] += 1 << low_bits;
+ buf[pos] += passes << low_bits;
else
n_zeros++;
- bits[x].count--;
+ av_assert1(bits[x].count >= passes);
+ bits[x].count -= passes;
x += bits[x].count == 0;
}
--
2.17.1
More information about the ffmpeg-devel
mailing list