[FFmpeg-devel] [PATCH 1/3] avcodec/vp56: Require 1 undamaged frame for 5 damaged frames for concealment to be used

[Michael Niedermayer]

Fixes timeout with 847/clusterfuzz-testcase-5291877358108672
Fixes timeout with 850/clusterfuzz-testcase-5721296509861888

This likely will need to be tweaked

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavcodec/vp56.c | 10 +++++++---
 libavcodec/vp56.h |  1 +
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/libavcodec/vp56.c b/libavcodec/vp56.c
index 9d4162bb96..b4ee760080 100644
--- a/libavcodec/vp56.c
+++ b/libavcodec/vp56.c
@@ -508,6 +508,7 @@ static int vp56_size_changed(VP56Context *s)
     s->plane_height[1] = s->plane_height[2] = avctx->coded_height/2;
 
     s->have_undamaged_frame = 0;
+    s->damaged_frame_count = 0;
 
     for (i=0; i<4; i++)
         s->stride[i] = s->flip * s->frames[VP56_FRAME_CURRENT]->linesize[i];
@@ -712,8 +713,9 @@ static int ff_vp56_decode_mbs(AVCodecContext *avctx, void *data,
                 int ret = vp56_decode_mb(s, mb_row, mb_col, is_alpha);
                 if (ret < 0) {
                     damaged = 1;
-                    if (!s->have_undamaged_frame) {
+                    if (5*s->have_undamaged_frame <= s->damaged_frame_count) {
                         s->discard_frame = 1;
+                        s->damaged_frame_count ++;
                         return AVERROR_INVALIDDATA;
                     }
                 }
@@ -733,8 +735,10 @@ static int ff_vp56_decode_mbs(AVCodecContext *avctx, void *data,
         }
     }
 
-    if (!damaged)
-        s->have_undamaged_frame = 1;
+    if (!damaged) {
+        s->have_undamaged_frame ++;
+    } else
+        s->damaged_frame_count ++;
 
 next:
     if (p->key_frame || s->golden_frame) {
diff --git a/libavcodec/vp56.h b/libavcodec/vp56.h
index c049399df8..37837d0c7b 100644
--- a/libavcodec/vp56.h
+++ b/libavcodec/vp56.h
@@ -206,6 +206,7 @@ struct vp56_context {
 
     int have_undamaged_frame;
     int discard_frame;
+    int damaged_frame_count;
 };
 
 
-- 
2.11.0