30M cycles -> 5M cycles
Testcase: fate-rgbapng-4816
Testcase:
16097/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-5664690889293824
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
---
libavcodec/pngdec.c | 38 +-
1 file changed, 29 insertions(+), 9 deletions(-)
diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c
index cad5796545..4ca4f7bdc1 100644
--- a/libavcodec/pngdec.c
+++ b/libavcodec/pngdec.c
@@ -24,6 +24,7 @@
#include "libavutil/avassert.h"
#include "libavutil/bprint.h"
#include "libavutil/imgutils.h"
+#include "libavutil/intreadwrite.h"
#include "libavutil/stereo3d.h"
#include "libavutil/mastering_display_metadata.h"
@@ -1363,19 +1364,38 @@ exit_loop:
unsigned x, y;
av_assert0(s->bit_depth > 1);
-
for (y = 0; y < s->height; ++y) {
uint8_t *row = >image_buf[s->image_linesize * y];
-/* since we're updating in-place, we have to go from right to left
*/
-for (x = s->width; x > 0; --x) {
-uint8_t *pixel = [s->bpp * (x - 1)];
-memmove(pixel, [raw_bpp * (x - 1)], raw_bpp);
+if (s->bpp == 2 && byte_depth == 1) {
+uint8_t *pixel = [2 * s->width - 1];
+uint8_t *rowp = [1 * s->width - 1];
+int tcolor = s->transparent_color_be[0];
+for (x = s->width; x > 0; --x) {
+*pixel-- = *rowp == tcolor ? 0 : 0xff;
+*pixel-- = *rowp--;
+}
+} else if (s->bpp == 4 && byte_depth == 1) {
+uint8_t *pixel = [4 * s->width - 1];
+uint8_t *rowp = [3 * s->width - 1];
+int tcolor = AV_RL24(s->transparent_color_be);
+for (x = s->width; x > 0; --x) {
+*pixel-- = AV_RL24(rowp-2) == tcolor ? 0 : 0xff;
+*pixel-- = *rowp--;
+*pixel-- = *rowp--;
+*pixel-- = *rowp--;
+}
+} else {
+/* since we're updating in-place, we have to go from right to
left */
+for (x = s->width; x > 0; --x) {
+uint8_t *pixel = [s->bpp * (x - 1)];
+memmove(pixel, [raw_bpp * (x - 1)], raw_bpp);
-if (!memcmp(pixel, s->transparent_color_be, raw_bpp)) {
-memset([raw_bpp], 0, byte_depth);
-} else {
-memset([raw_bpp], 0xff, byte_depth);
+if (!memcmp(pixel, s->transparent_color_be, raw_bpp)) {
+memset([raw_bpp], 0, byte_depth);
+} else {
+memset([raw_bpp], 0xff, byte_depth);
+}
}
}
}
--
2.22.1
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".