avcodec: Avoid splitting side data repeatedly

Fixes Timeout
Fixes: 508/clusterfuzz-testcase-6245747678773248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

1 files changed, 25 insertions, 0 deletions

diff --git a/libavcodec/avpacket.c b/libavcodec/avpacket.c
index 4bf830bb8a..369dd78208 100644
--- a/libavcodec/avpacket.c
+++ b/libavcodec/avpacket.c
@@ -462,7 +462,32 @@ int av_packet_split_side_data(AVPacket *pkt){
     }
     return 0;
 }
+#endif
+
+#if FF_API_MERGE_SD
+int ff_packet_split_and_drop_side_data(AVPacket *pkt){
+    if (!pkt->side_data_elems && pkt->size >12 && AV_RB64(pkt->data + pkt->size - 8) == FF_MERGE_MARKER){
+        int i;
+        unsigned int size;
+        uint8_t *p;
 
+        p = pkt->data + pkt->size - 8 - 5;
+        for (i=1; ; i++){
+            size = AV_RB32(p);
+            if (size>INT_MAX - 5 || p - pkt->data < size)
+                return 0;
+            if (p[4]&128)
+                break;
+            if (p - pkt->data < size + 5)
+                return 0;
+            p-= size+5;
+        }
+        pkt->size = p - pkt->data - size;
+        av_assert0(pkt->size >= 0);
+        return 1;
+    }
+    return 0;
+}
 #endif
 
 uint8_t *av_packet_pack_dictionary(AVDictionary *dict, int *size)