On 4/10/2020 5:44 PM, James Almer wrote: > On 4/10/2020 5:23 PM, Michael Niedermayer wrote: >> Fixes: Timeout (85sec -> 0.5sec) >> Fixes: >> 20791/clusterfuzz-testcase-minimized-ffmpeg_BSF_AV1_FRAME_SPLIT_fuzzer-5659537719951360 >> Fixes: >> 21214/clusterfuzz-testcase-minimized-ffmpeg_BSF_MPEG2_METADATA_fuzzer-5165560875974656 >> Fixes: >> 21247/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_METADATA_fuzzer-5715175257931776 >> >> Found-by: continuous fuzzing process >> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg >> Signed-off-by: Michael Niedermayer <[email protected]> >> --- >> libavcodec/cbs.c | 4 ++-- >> 1 file changed, 2 insertions(+), 2 deletions(-) >> >> diff --git a/libavcodec/cbs.c b/libavcodec/cbs.c >> index 0bd5e1ac5d..42cb9711fa 100644 >> --- a/libavcodec/cbs.c >> +++ b/libavcodec/cbs.c >> @@ -693,11 +693,11 @@ static int cbs_insert_unit(CodedBitstreamContext *ctx, >> memmove(units + position + 1, units + position, >> (frag->nb_units - position) * sizeof(*units)); >> } else { >> - units = av_malloc_array(frag->nb_units + 1, sizeof(*units)); >> + units = av_malloc_array(frag->nb_units*2 + 1, sizeof(*units)); >> if (!units) >> return AVERROR(ENOMEM); >> >> - ++frag->nb_units_allocated; >> + frag->nb_units_allocated = 2*frag->nb_units_allocated + 1; > > Use ff_fast_malloc(), please. This is quite ugly and the *2 undocumented > and not obvious.
Actually no, ff_fast_malloc or av_fast_malloc can't be used for this. It would need to be av_fast_realloc(), and the memcpy calls below changed to memmove(), i think. An alternative could be to maybe port this code to use AVTreeNodes. But i still think that duplicating the amount of allocated units each time sounds like it could go out of control fast. > >> >> if (position > 0) >> memcpy(units, frag->units, position * sizeof(*units)); >> > _______________________________________________ ffmpeg-devel mailing list [email protected] https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email [email protected] with subject "unsubscribe".
