[FFmpeg-devel] [PATCH 7/7] avcodec/cri: check for available input in unpack_10bit()

[Michael Niedermayer]

On Thu, Jan 21, 2021 at 11:26:57PM +0100, Paul B Mahol wrote:
> On Tue, Nov 10, 2020 at 12:15 AM Michael Niedermayer <michael at niedermayer.cc>
> wrote:
> 
> > Fixes: Timeout (>20sec -> 56ms)
> > Fixes:
> > 26995/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CRI_fuzzer-5107217080254464
> >
> > Found-by: continuous fuzzing process
> > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by
> > <https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by>:
> > Michael Niedermayer <michael at niedermayer.cc>
> > ---
> >  libavcodec/cri.c | 11 +++++++----
> >  1 file changed, 7 insertions(+), 4 deletions(-)
> >
> > diff --git a/libavcodec/cri.c b/libavcodec/cri.c
> > index dafbc1f1be..9bcd2ebfc6 100644
> > --- a/libavcodec/cri.c
> > +++ b/libavcodec/cri.c
> > @@ -80,10 +80,13 @@ static void unpack_10bit(GetByteContext *gb, uint16_t
> > *dst, int shift,
> >      int pos = 0;
> >
> >      while (count > 0) {
> > -        uint32_t a0 = bytestream2_get_le32(gb);
> > -        uint32_t a1 = bytestream2_get_le32(gb);
> > -        uint32_t a2 = bytestream2_get_le32(gb);
> > -        uint32_t a3 = bytestream2_get_le32(gb);
> > +        uint32_t a0, a1,a2,a3;
> >
> 
> Why style issue is very bad here?
> 
> 
> > +        if (bytestream2_get_bytes_left(gb) < 4)
> >
> 
> This should be 16, not 4.

only a0 is unconditionally used. a1 only if count is bigger than 2
a2 only if count is bigger than 4 and so forth

so breaking out only if used input is unavailable was done in the patch.
I can change it to 16 but that may break some files as it fails on
the input lacking unused data

Thanks

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Democracy is the form of government in which you can choose your dictator
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20210122/a45fe62e/attachment.sig>