[FFmpeg-devel] [PATCH 2/4] avcodec/vc1dec: Use av_fast_realloc() for slices

[Michael Niedermayer]

Fixes: Timeout
Fixes: 57281/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1IMAGE_fuzzer-4594141064724480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavcodec/vc1dec.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c
index 5cb4c544c9a..18fb616fff5 100644
--- a/libavcodec/vc1dec.c
+++ b/libavcodec/vc1dec.c
@@ -836,6 +836,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame *pict,
         const uint8_t *rawbuf;
         int raw_size;
     } *slices = NULL, *tmp;
+    unsigned slices_allocated = 0;
 
     v->second_field = 0;
 
@@ -859,6 +860,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame *pict,
     //for advanced profile we may need to parse and unescape data
     if (avctx->codec_id == AV_CODEC_ID_VC1 || avctx->codec_id == AV_CODEC_ID_VC1IMAGE) {
         int buf_size2 = 0;
+        size_t next_allocated = 0;
         buf2 = av_mallocz(buf_size + AV_INPUT_BUFFER_PADDING_SIZE);
         if (!buf2)
             return AVERROR(ENOMEM);
@@ -882,7 +884,8 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame *pict,
                     int buf_size3;
                     if (avctx->hwaccel)
                         buf_start_second_field = start;
-                    tmp = av_realloc_array(slices, sizeof(*slices), n_slices+1);
+                    av_size_mult(sizeof(*slices), n_slices+1, &next_allocated);
+                    tmp = next_allocated ? av_fast_realloc(slices, &slices_allocated, next_allocated) : NULL;
                     if (!tmp) {
                         ret = AVERROR(ENOMEM);
                         goto err;
@@ -911,7 +914,8 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame *pict,
                     break;
                 case VC1_CODE_SLICE: {
                     int buf_size3;
-                    tmp = av_realloc_array(slices, sizeof(*slices), n_slices+1);
+                    av_size_mult(sizeof(*slices), n_slices+1, &next_allocated);
+                    tmp = next_allocated ? av_fast_realloc(slices, &slices_allocated, next_allocated) : NULL;
                     if (!tmp) {
                         ret = AVERROR(ENOMEM);
                         goto err;
@@ -946,7 +950,8 @@ static int vc1_decode_frame(AVCodecContext *avctx, AVFrame *pict,
             } else { // found field marker, unescape second field
                 if (avctx->hwaccel)
                     buf_start_second_field = divider;
-                tmp = av_realloc_array(slices, sizeof(*slices), n_slices+1);
+                av_size_mult(sizeof(*slices), n_slices+1, &next_allocated);
+                tmp = next_allocated ? av_fast_realloc(slices, &slices_allocated, next_allocated) : NULL;
                 if (!tmp) {
                     ret = AVERROR(ENOMEM);
                     goto err;
-- 
2.17.1