projects / ffmpeg.git / commitdiff
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: af681f6)
avformat/mpegts: use av_fast_realloc() for prg
authorMichael Niedermayer <michael@niedermayer.cc>
Thu, 4 Jun 2026 19:19:18 +0000 (21:19 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Mon, 15 Jun 2026 21:57:24 +0000 (23:57 +0200)
Fixes: Timeout
Fixes: 514855073/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTS_fuzzer-5074757044469760
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f7e6a8ade5b695d52e8161df8687e806c2e4d924)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavformat/mpegts.c patch | blob | history

diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c
index 337fdd155f5dc6cddcc9cd6073adaa2ff22117a4..427bb88a3e05e72b9cb3000408af60225eca1f99 100644 (file)
--- a/libavformat/mpegts.c
+++ b/libavformat/mpegts.c
@@ -173,6 +173,7 @@ struct MpegTSContext {
     /* scan context */
     /** structure to keep track of Program->pids mapping */
     unsigned int nb_prg;
+    unsigned int prg_size; ///< allocated size of prg in bytes
     struct Program *prg;
 
     int8_t crc_validity[NB_PID_MAX];
@@ -318,17 +319,26 @@ static void clear_programs(MpegTSContext *ts)
 {
     av_freep(&ts->prg);
     ts->nb_prg = 0;
+    ts->prg_size = 0;
 }
 
 static struct Program * add_program(MpegTSContext *ts, unsigned int programid)
 {
     struct Program *p = get_program(ts, programid);
+    struct Program *tmp = NULL;
+    size_t new_prg_size;
     if (p)
         return p;
-    if (av_reallocp_array(&ts->prg, ts->nb_prg + 1, sizeof(*ts->prg)) < 0) {
-        ts->nb_prg = 0;
+
+    if (!av_size_mult(ts->nb_prg + 1,  sizeof(*ts->prg), &new_prg_size))
+        tmp = av_fast_realloc(ts->prg, &ts->prg_size,new_prg_size);
+    if (!tmp) {
+        av_freep(&ts->prg);
+        ts->nb_prg   = 0;
+        ts->prg_size = 0;
         return NULL;
     }
+    ts->prg = tmp;
     p = &ts->prg[ts->nb_prg];
     p->id = programid;
     clear_program(p);
FFmpeg git repo