[FFmpeg-devel] [PATCH] avcodec/cbs: Allocate more CodedBitstreamUnit at once in cbs_insert_unit()

[James Almer]

On 4/10/2020 5:44 PM, James Almer wrote:
> On 4/10/2020 5:23 PM, Michael Niedermayer wrote:
>> Fixes: Timeout (85sec -> 0.5sec)
>> Fixes: 20791/clusterfuzz-testcase-minimized-ffmpeg_BSF_AV1_FRAME_SPLIT_fuzzer-5659537719951360
>> Fixes: 21214/clusterfuzz-testcase-minimized-ffmpeg_BSF_MPEG2_METADATA_fuzzer-5165560875974656
>> Fixes: 21247/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_METADATA_fuzzer-5715175257931776
>>
>> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
>> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
>> ---
>>  libavcodec/cbs.c | 4 ++--
>>  1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/libavcodec/cbs.c b/libavcodec/cbs.c
>> index 0bd5e1ac5d..42cb9711fa 100644
>> --- a/libavcodec/cbs.c
>> +++ b/libavcodec/cbs.c
>> @@ -693,11 +693,11 @@ static int cbs_insert_unit(CodedBitstreamContext *ctx,
>>              memmove(units + position + 1, units + position,
>>                      (frag->nb_units - position) * sizeof(*units));
>>      } else {
>> -        units = av_malloc_array(frag->nb_units + 1, sizeof(*units));
>> +        units = av_malloc_array(frag->nb_units*2 + 1, sizeof(*units));
>>          if (!units)
>>              return AVERROR(ENOMEM);
>>  
>> -        ++frag->nb_units_allocated;
>> +        frag->nb_units_allocated = 2*frag->nb_units_allocated + 1;
> 
> Use ff_fast_malloc(), please. This is quite ugly and the *2 undocumented
> and not obvious.

Actually no, ff_fast_malloc or av_fast_malloc can't be used for this. It
would need to be av_fast_realloc(), and the memcpy calls below changed
to memmove(), i think.

An alternative could be to maybe port this code to use AVTreeNodes. But
i still think that duplicating the amount of allocated units each time
sounds like it could go out of control fast.

> 
>>  
>>          if (position > 0)
>>              memcpy(units, frag->units, position * sizeof(*units));
>>
>