[FFmpeg-devel] [PATCH 2/2] avformat/demux: Count EAGAIN as 100 bytes in relation to read limit in avformat_find_stream_info()

[Marton Balint]

On Tue, 8 Feb 2022, Michael Niedermayer wrote:

> Fixes: Timeout
> Fixes: 43717/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5206008287330304
>
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
> libavformat/demux.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/libavformat/demux.c b/libavformat/demux.c
> index dd42d32710..1acba0c608 100644
> --- a/libavformat/demux.c
> +++ b/libavformat/demux.c
> @@ -2590,8 +2590,10 @@ int avformat_find_stream_info(AVFormatContext *ic, AVDictionary **options)
>         /* NOTE: A new stream can be added there if no header in file
>          * (AVFMTCTX_NOHEADER). */
>         ret = read_frame_internal(ic, pkt1);
> -        if (ret == AVERROR(EAGAIN))
> +        if (ret == AVERROR(EAGAIN)) {
> +            read_size += 100;

Sorry, same here, very hackish. I especially dislike that you use 
read_size for a limit because that intereferes with probesize and silently 
ignores the problem.

Can't we fix the underlying issue? If not, then counting the number of 
EAGAINs and returning a hard failure if that becomes more than e.g. 10000 
would be a lot more acceptable to me. E.g.

if (nb_egains > 10000) {
    av_log(NULL, AV_LOG_ERROR, "read_frame stuck in an EAGAIN loop, this should not happen\n);
    return AVERROR_BUG;
}

Regards,
Marton