[FFmpeg-cvslog] avcodec/h263dec: Avoid parsing extradata repeatedly

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Fri Nov 18 00:07:05 2022 +0100| [b32316923df0fb932d4e553705328755d3096165] | committer: Michael Niedermayer

avcodec/h263dec: Avoid parsing extradata repeatedly

Fixes: Timeout
Fixes: 52329/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4716563886637056

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b32316923df0fb932d4e553705328755d3096165
---

 libavcodec/h263dec.c   | 3 ++-
 libavcodec/mpegvideo.h | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/libavcodec/h263dec.c b/libavcodec/h263dec.c
index 71b846ba74..ac7a8521e5 100644
--- a/libavcodec/h263dec.c
+++ b/libavcodec/h263dec.c
@@ -492,11 +492,12 @@ retry:
     } else if (CONFIG_MSMPEG4DEC && s->msmpeg4_version) {
         ret = ff_msmpeg4_decode_picture_header(s);
     } else if (CONFIG_MPEG4_DECODER && avctx->codec_id == AV_CODEC_ID_MPEG4) {
-        if (s->avctx->extradata_size && s->picture_number == 0) {
+        if (s->avctx->extradata_size && !s->extradata_parsed) {
             GetBitContext gb;
 
             if (init_get_bits8(&gb, s->avctx->extradata, s->avctx->extradata_size) >= 0 )
                 ff_mpeg4_decode_picture_header(avctx->priv_data, &gb, 1, 0);
+            s->extradata_parsed = 1;
         }
         ret = ff_mpeg4_decode_picture_header(avctx->priv_data, &s->gb, 0, 0);
     } else if (CONFIG_H263I_DECODER && s->codec_id == AV_CODEC_ID_H263I) {
diff --git a/libavcodec/mpegvideo.h b/libavcodec/mpegvideo.h
index ccec0dd75f..6440b906b1 100644
--- a/libavcodec/mpegvideo.h
+++ b/libavcodec/mpegvideo.h
@@ -117,6 +117,7 @@ typedef struct MpegEncContext {
     int input_picture_number;  ///< used to set pic->display_picture_number, should not be used for/by anything else
     int coded_picture_number;  ///< used to set pic->coded_picture_number, should not be used for/by anything else
     int picture_number;       //FIXME remove, unclear definition
+    int extradata_parsed;
     int picture_in_gop_number; ///< 0-> first pic in gop, ...
     int mb_width, mb_height;   ///< number of MBs horizontally & vertically
     int mb_stride;             ///< mb_width+1 used for some arrays to allow simple addressing of left & top MBs without sig11