diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-08-18 00:40:45 +0300 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-08-20 03:59:57 +0300 |
| commit | e7b9d136a1ba2d048b1a17df5778e426b825676d (patch) | |
| tree | 4a3ee8e2460e1979cd43df4ddfe14d1171878d99 /libavcodec/cngdec.c | |
| parent | 0c9d5b015c2022e8deebb93367f8ee8a8eb779e8 (diff) | |
avcodec/cngdec: Check skip_samples
Without this its possible to make the new decode API decode billions of samples
out of a empty input and never return to the caller before all samples have been
created and discarded.
Fixes: Timeout
Fixes: 2992/clusterfuzz-testcase-6649611793989632
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/cngdec.c')
| -rw-r--r-- | libavcodec/cngdec.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavcodec/cngdec.c b/libavcodec/cngdec.c index 34f881448d..1e884f3c33 100644 --- a/libavcodec/cngdec.c +++ b/libavcodec/cngdec.c @@ -23,6 +23,7 @@ #include "libavutil/common.h" #include "libavutil/ffmath.h" +#include "libavutil/intreadwrite.h" #include "avcodec.h" #include "celp_filters.h" #include "internal.h" @@ -120,6 +121,11 @@ static int cng_decode_frame(AVCodecContext *avctx, void *data, } } + if (avctx->internal->skip_samples > 10 * avctx->frame_size) { + avctx->internal->skip_samples = 0; + return AVERROR_INVALIDDATA; + } + if (p->inited) { p->energy = p->energy / 2 + p->target_energy / 2; for (i = 0; i < p->order; i++) |