[FFmpeg-devel] [PATCH] avcodec/mpeg12dec: Limit maximum A53 CC size

[Michael Niedermayer]

This is more than 10 times the size of the largest i found. And also alot more
than our encoder could handle (our encoder is limited to max 31)
Without any limit megabyte+ sized blocks can be reallocated millions of times.
Sadly the SCTE-20 spec does not seem to contain any hard limit directly, so this limit here
is arbitrary

Fixes: Timeout (25sec -> 152ms)
Fixes: 25714/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG2VIDEO_fuzzer-5713633336885248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavcodec/mpeg12dec.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/libavcodec/mpeg12dec.c b/libavcodec/mpeg12dec.c
index ab470187a1..5884c6fd17 100644
--- a/libavcodec/mpeg12dec.c
+++ b/libavcodec/mpeg12dec.c
@@ -50,6 +50,8 @@
 #include "version.h"
 #include "xvmc_internal.h"
 
+#define A53_MAX_CC_COUNT 2000
+
 typedef struct Mpeg1Context {
     MpegEncContext mpeg_enc_ctx;
     int mpeg_enc_ctx_allocated; /* true if decoding context allocated */
@@ -2246,7 +2248,7 @@ static int mpeg_decode_a53_cc(AVCodecContext *avctx,
                                             * UINT64_C(3));
             int ret;
 
-            if (new_size > INT_MAX)
+            if (new_size > 3*A53_MAX_CC_COUNT)
                 return AVERROR(EINVAL);
 
             ret = av_buffer_realloc(&s1->a53_buf_ref, new_size);
@@ -2269,7 +2271,7 @@ static int mpeg_decode_a53_cc(AVCodecContext *avctx,
             int old_size = s1->a53_buf_ref ? s1->a53_buf_ref->size : 0;
             const uint64_t new_size = (old_size + cc_count
                                             * UINT64_C(3));
-            if (new_size > INT_MAX)
+            if (new_size > 3*A53_MAX_CC_COUNT)
                 return AVERROR(EINVAL);
 
             ret = av_buffer_realloc(&s1->a53_buf_ref, new_size);
@@ -2339,7 +2341,7 @@ static int mpeg_decode_a53_cc(AVCodecContext *avctx,
             int old_size = s1->a53_buf_ref ? s1->a53_buf_ref->size : 0;
             const uint64_t new_size = (old_size + cc_count
                                             * UINT64_C(6));
-            if (new_size > INT_MAX)
+            if (new_size > 3*A53_MAX_CC_COUNT)
                 return AVERROR(EINVAL);
 
             ret = av_buffer_realloc(&s1->a53_buf_ref, new_size);
-- 
2.17.1