[FFmpeg-cvslog] avcodec/mpeg12dec: Limit maximum A53 CC size

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Mon Sep 21 22:40:48 2020 +0200| [ee33fecb62c6dabcfdb9199d7a5b8575b758f1d9] | committer: Michael Niedermayer

avcodec/mpeg12dec: Limit maximum A53 CC size

This is more than 10 times the size of the largest i found. And also alot more
than our encoder could handle (our encoder is limited to max 31)
Without any limit megabyte+ sized blocks can be reallocated millions of times.
Sadly the SCTE-20 spec does not seem to contain any hard limit directly, so this limit here
is arbitrary

Fixes: Timeout (25sec -> 152ms)
Fixes: 25714/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG2VIDEO_fuzzer-5713633336885248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ee33fecb62c6dabcfdb9199d7a5b8575b758f1d9
---

 libavcodec/mpeg12dec.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/libavcodec/mpeg12dec.c b/libavcodec/mpeg12dec.c
index 3be90d7f25..6d0e9fc7ed 100644
--- a/libavcodec/mpeg12dec.c
+++ b/libavcodec/mpeg12dec.c
@@ -50,6 +50,8 @@
 #include "version.h"
 #include "xvmc_internal.h"
 
+#define A53_MAX_CC_COUNT 2000
+
 typedef struct Mpeg1Context {
     MpegEncContext mpeg_enc_ctx;
     int mpeg_enc_ctx_allocated; /* true if decoding context allocated */
@@ -2240,7 +2242,7 @@ static int mpeg_decode_a53_cc(AVCodecContext *avctx,
                                             * UINT64_C(3));
             int ret;
 
-            if (new_size > INT_MAX)
+            if (new_size > 3*A53_MAX_CC_COUNT)
                 return AVERROR(EINVAL);
 
             ret = av_buffer_realloc(&s1->a53_buf_ref, new_size);
@@ -2263,7 +2265,7 @@ static int mpeg_decode_a53_cc(AVCodecContext *avctx,
             int old_size = s1->a53_buf_ref ? s1->a53_buf_ref->size : 0;
             const uint64_t new_size = (old_size + cc_count
                                             * UINT64_C(3));
-            if (new_size > INT_MAX)
+            if (new_size > 3*A53_MAX_CC_COUNT)
                 return AVERROR(EINVAL);
 
             ret = av_buffer_realloc(&s1->a53_buf_ref, new_size);
@@ -2333,7 +2335,7 @@ static int mpeg_decode_a53_cc(AVCodecContext *avctx,
             int old_size = s1->a53_buf_ref ? s1->a53_buf_ref->size : 0;
             const uint64_t new_size = (old_size + cc_count
                                             * UINT64_C(6));
-            if (new_size > INT_MAX)
+            if (new_size > 3*A53_MAX_CC_COUNT)
                 return AVERROR(EINVAL);
 
             ret = av_buffer_realloc(&s1->a53_buf_ref, new_size);