From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 3270249812 for ; Thu, 21 Mar 2024 01:15:29 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 5661F68D4CA; Thu, 21 Mar 2024 03:15:26 +0200 (EET) Received: from relay2-d.mail.gandi.net (relay2-d.mail.gandi.net [217.70.183.194]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 4C71468D305 for ; Thu, 21 Mar 2024 03:15:19 +0200 (EET) Received: by mail.gandi.net (Postfix) with ESMTPSA id A1D1440002 for ; Thu, 21 Mar 2024 01:15:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1710983718; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=tqL5R+xrkRpv8ogJpyN5rZuLdIKXBdvhH7QTGC+6Ins=; b=fqLtnlRobwCXgh+OP5GCtc08DzgAumjJZhEWh0mL3os8VhmuJgDgzkfVNwPvyXKoz4lPCm zwYD758r+y8+Na7OfOuzxy2/XYoYPmsjFHaPBjrYEbnt9IQF53Q5JUiRiD5XnvVYqRH4uX KH8q4WnFeyNaQOTiUQcuIPahLk0nkYv4bz7nD5axsCznoG7qxq3SQGDq/iwKH61hIb9XhG DZ+tcAcbcfTiOIjGvlRi5WhPtr0ZsbnJkBOaXYsMVKjtwr/mJhpgoRa4owJ5EUJbWfuSmO hSvlNiP8mP8qlDDCTvWNb/M7944nmwQzPgx4uouLi8lXdlcsuKRRaGtmegC3RQ== From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Thu, 21 Mar 2024 02:15:14 +0100 Message-Id: <20240321011517.10363-1-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 X-GND-Sasl: michael@niedermayer.cc Subject: [FFmpeg-devel] [PATCH 1/4] avcodec/mscc: move frame allocates to later X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: Fixes: Timeout Fixes: 66964/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SRGC_fuzzer-5413170363564032 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/mscc.c | 43 +++++++++++++++++++++---------------------- 1 file changed, 21 insertions(+), 22 deletions(-) diff --git a/libavcodec/mscc.c b/libavcodec/mscc.c index d1d23e6751..1e9fd35f03 100644 --- a/libavcodec/mscc.c +++ b/libavcodec/mscc.c @@ -142,28 +142,6 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame, if (avpkt->size < 3) return buf_size; - if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) - return ret; - - if (avctx->pix_fmt == AV_PIX_FMT_PAL8) { - size_t size; - const uint8_t *pal = av_packet_get_side_data(avpkt, AV_PKT_DATA_PALETTE, &size); - - if (pal && size == AVPALETTE_SIZE) { -#if FF_API_PALETTE_HAS_CHANGED -FF_DISABLE_DEPRECATION_WARNINGS - frame->palette_has_changed = 1; -FF_ENABLE_DEPRECATION_WARNINGS -#endif - for (j = 0; j < 256; j++) - s->pal[j] = 0xFF000000 | AV_RL32(pal + j * 4); - } else if (pal) { - av_log(avctx, AV_LOG_ERROR, - "Palette size %"SIZE_SPECIFIER" is wrong\n", size); - } - memcpy(frame->data[1], s->pal, AVPALETTE_SIZE); - } - ret = inflateReset(zstream); if (ret != Z_OK) { av_log(avctx, AV_LOG_ERROR, "Inflate reset error: %d\n", ret); @@ -191,6 +169,27 @@ inflate_error: av_log(avctx, AV_LOG_ERROR, "Inflate error: %d\n", ret); return AVERROR_UNKNOWN; } + if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) + return ret; + + if (avctx->pix_fmt == AV_PIX_FMT_PAL8) { + size_t size; + const uint8_t *pal = av_packet_get_side_data(avpkt, AV_PKT_DATA_PALETTE, &size); + + if (pal && size == AVPALETTE_SIZE) { +#if FF_API_PALETTE_HAS_CHANGED +FF_DISABLE_DEPRECATION_WARNINGS + frame->palette_has_changed = 1; +FF_ENABLE_DEPRECATION_WARNINGS +#endif + for (j = 0; j < 256; j++) + s->pal[j] = 0xFF000000 | AV_RL32(pal + j * 4); + } else if (pal) { + av_log(avctx, AV_LOG_ERROR, + "Palette size %"SIZE_SPECIFIER" is wrong\n", size); + } + memcpy(frame->data[1], s->pal, AVPALETTE_SIZE); + } bytestream2_init(&gb, s->decomp_buf, zstream->total_out); bytestream2_init_writer(&pb, s->uncomp_buf, s->uncomp_size); -- 2.17.1 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".