[FFmpeg-devel] [PATCH 1/3] avcodec/osq: Implement flush()

[Andreas Rheinhardt]

Michael Niedermayer:
> Fixes: out of array access
> Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6227491892887552
> Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6268561729126400
> Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6414805046788096
> Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6538151088488448
> Fixes: 62164/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_OSQ_fuzzer-6608131540779008
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/osq.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
> 
> diff --git a/libavcodec/osq.c b/libavcodec/osq.c
> index 435f3ea7f69..abe15c97f18 100644
> --- a/libavcodec/osq.c
> +++ b/libavcodec/osq.c
> @@ -61,6 +61,15 @@ typedef struct OSQContext {
>      int pkt_offset;
>  } OSQContext;
>  
> +static void osq_flush(AVCodecContext *avctx)
> +{
> +    OSQContext *s = avctx->priv_data;
> +
> +    s->bitstream_size = 0;
> +    s->pkt_offset = 0;
> +    av_packet_unref(s->pkt);

s->pkt is the same as avctx->internal->in_pkt which is unreferenced
generically upon flush. So this is unnecessary.

> +}
> +
>  static av_cold int osq_close(AVCodecContext *avctx)
>  {
>      OSQContext *s = avctx->priv_data;
> @@ -478,4 +487,5 @@ const FFCodec ff_osq_decoder = {
>                                                          AV_SAMPLE_FMT_S16P,
>                                                          AV_SAMPLE_FMT_S32P,
>                                                          AV_SAMPLE_FMT_NONE },
> +    .flush            = osq_flush,
>  };