diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-09-03 00:02:53 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-09-28 18:25:20 +0200 |
| commit | cf41da2ad2ec89a1e1c1ef3ca4f6a5b416f4104e (patch) | |
| tree | c13f10c65ae4e8e2fd801dab8f902c9a0594a9d3 /libavcodec/apedec.c | |
| parent | 1e95a3e8a7250060befd9a5fba69151bb2a6690c (diff) | |
avcodec/apedec: Allocate decoded_buffer after successful ff_get_buffer()
We need to reset samples in this case to avoid being stuck with incorrect
samples value.
Fixes: OOM
Fixes: Timeout
Fixes: 16627/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5638059583864832
Fixes: 17089/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5672188463546368
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/apedec.c')
| -rw-r--r-- | libavcodec/apedec.c | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c index e218f7c043..3e2fffb850 100644 --- a/libavcodec/apedec.c +++ b/libavcodec/apedec.c @@ -1497,6 +1497,14 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data, /* reallocate decoded sample buffer if needed */ decoded_buffer_size = 2LL * FFALIGN(blockstodecode, 8) * sizeof(*s->decoded_buffer); av_assert0(decoded_buffer_size <= INT_MAX); + + /* get output buffer */ + frame->nb_samples = blockstodecode; + if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) { + s->samples=0; + return ret; + } + av_fast_malloc(&s->decoded_buffer, &s->decoded_size, decoded_buffer_size); if (!s->decoded_buffer) return AVERROR(ENOMEM); @@ -1504,11 +1512,6 @@ static int ape_decode_frame(AVCodecContext *avctx, void *data, s->decoded[0] = s->decoded_buffer; s->decoded[1] = s->decoded_buffer + FFALIGN(blockstodecode, 8); - /* get output buffer */ - frame->nb_samples = blockstodecode; - if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) - return ret; - s->error=0; if ((s->channels == 1) || (s->frameflags & APE_FRAMECODE_PSEUDO_STEREO)) |