On 9/3/2021 3:39 PM, Michael Niedermayer wrote:
Fixes: Timeout (56sec -> 15sec)
Fixes:
37141/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-6192122867875840
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
---
libavcodec/mpegutils.c | 56 ++++++++++++++++++++++++------------------
1 file changed, 32 insertions(+), 24 deletions(-)
diff --git a/libavcodec/mpegutils.c b/libavcodec/mpegutils.c
index e5105ecc58..e91c554781 100644
--- a/libavcodec/mpegutils.c
+++ b/libavcodec/mpegutils.c
@@ -187,7 +187,6 @@ void ff_print_debug_info2(AVCodecContext *avctx, AVFrame
*pict, uint8_t *mbskip_
av_freep(&mvs);
}
-
Stray change.
/* TODO: export all the following to make them accessible for users (and
filters) */
if (avctx->hwaccel || !mbtype_table)
return;
@@ -195,71 +194,80 @@ void ff_print_debug_info2(AVCodecContext *avctx, AVFrame
*pict, uint8_t *mbskip_
if (avctx->debug & (FF_DEBUG_SKIP | FF_DEBUG_QP | FF_DEBUG_MB_TYPE)) {
int x,y;
+#define MB_STRING_SIZE 6
+ char *mbstring = av_malloc(MB_STRING_SIZE * mb_width + 1);
+ if (!mbstring)
+ return;
av_log(avctx, AV_LOG_DEBUG, "New frame, type: %c\n",
av_get_picture_type_char(pict->pict_type));
for (y = 0; y < mb_height; y++) {
+ char *mbs = mbstring;
for (x = 0; x < mb_width; x++) {
+ av_assert0(mbs - mbstring <= MB_STRING_SIZE * x);
if (avctx->debug & FF_DEBUG_SKIP) {
int count = mbskip_table ? mbskip_table[x + y *
mb_stride] : 0;
if (count > 9)
count = 9;
- av_log(avctx, AV_LOG_DEBUG, "%1d", count);
+ *mbs++ = '0' + count;
This is ugly and not very obvious at first glance. Can you use lavu's
bprint or something like that instead?
}
if (avctx->debug & FF_DEBUG_QP) {
- av_log(avctx, AV_LOG_DEBUG, "%2d",
- qscale_table[x + y * mb_stride]);
+ int q = qscale_table[x + y * mb_stride];
+ *mbs++ = '0' + q/10;
+ *mbs++ = '0' + q%10;
}
if (avctx->debug & FF_DEBUG_MB_TYPE) {
int mb_type = mbtype_table[x + y * mb_stride];
// Type & MV direction
if (IS_PCM(mb_type))
- av_log(avctx, AV_LOG_DEBUG, "P");
+ *mbs++ = 'P';
else if (IS_INTRA(mb_type) && IS_ACPRED(mb_type))
- av_log(avctx, AV_LOG_DEBUG, "A");
+ *mbs++ = 'A';
else if (IS_INTRA4x4(mb_type))
- av_log(avctx, AV_LOG_DEBUG, "i");
+ *mbs++ = 'i';
else if (IS_INTRA16x16(mb_type))
- av_log(avctx, AV_LOG_DEBUG, "I");
+ *mbs++ = 'I';
else if (IS_DIRECT(mb_type) && IS_SKIP(mb_type))
- av_log(avctx, AV_LOG_DEBUG, "d");
+ *mbs++ = 'd';
else if (IS_DIRECT(mb_type))
- av_log(avctx, AV_LOG_DEBUG, "D");
+ *mbs++ = 'D';
else if (IS_GMC(mb_type) && IS_SKIP(mb_type))
- av_log(avctx, AV_LOG_DEBUG, "g");
+ *mbs++ = 'g';
else if (IS_GMC(mb_type))
- av_log(avctx, AV_LOG_DEBUG, "G");
+ *mbs++ = 'G';
else if (IS_SKIP(mb_type))
- av_log(avctx, AV_LOG_DEBUG, "S");
+ *mbs++ = 'S';
else if (!USES_LIST(mb_type, 1))
- av_log(avctx, AV_LOG_DEBUG, ">");
+ *mbs++ = '>';
else if (!USES_LIST(mb_type, 0))
- av_log(avctx, AV_LOG_DEBUG, "<");
+ *mbs++ = '<';
else {
av_assert2(USES_LIST(mb_type, 0) &&
USES_LIST(mb_type, 1));
- av_log(avctx, AV_LOG_DEBUG, "X");
+ *mbs++ = 'X';
}
// segmentation
if (IS_8X8(mb_type))
- av_log(avctx, AV_LOG_DEBUG, "+");
+ *mbs++ = '+';
else if (IS_16X8(mb_type))
- av_log(avctx, AV_LOG_DEBUG, "-");
+ *mbs++ = '-';
else if (IS_8X16(mb_type))
- av_log(avctx, AV_LOG_DEBUG, "|");
+ *mbs++ = '|';
else if (IS_INTRA(mb_type) || IS_16X16(mb_type))
- av_log(avctx, AV_LOG_DEBUG, " ");
+ *mbs++ = ' ';
else
- av_log(avctx, AV_LOG_DEBUG, "?");
+ *mbs++ = '?';
if (IS_INTERLACED(mb_type))
- av_log(avctx, AV_LOG_DEBUG, "=");
+ *mbs++ = '=';
else
- av_log(avctx, AV_LOG_DEBUG, " ");
+ *mbs++ = ' ';
}
}
- av_log(avctx, AV_LOG_DEBUG, "\n");
+ *mbs++ = 0;
+ av_log(avctx, AV_LOG_DEBUG, "%s\n", mbstring);
}
+ av_freep(&mbstring);
}
}
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
