From 1244b257ee7ec7d56f021a5c2e39e2c04881a148 Mon Sep 17 00:00:00 2001 From: Martin Storsjo Date: Tue, 15 Aug 2017 16:36:05 +0300 Subject: Always feed more input data when possible for ADTS This fixes cases where an ADTS header could set numberOfRawDataBlocks to a number larger than 1, which would lead to transportDec_FillData not feeding any more data, even though the input buffer was depleted. Fixes: 3014/clusterfuzz-testcase-5425740193464320 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg --- libMpegTPDec/src/tpdec_lib.cpp | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'libMpegTPDec') diff --git a/libMpegTPDec/src/tpdec_lib.cpp b/libMpegTPDec/src/tpdec_lib.cpp index 24f755b..09f0703 100644 --- a/libMpegTPDec/src/tpdec_lib.cpp +++ b/libMpegTPDec/src/tpdec_lib.cpp @@ -342,9 +342,7 @@ TRANSPORTDEC_ERROR transportDec_FillData( } } else { /* ... else feed bitbuffer with new stream data (append). */ - if (hTp->numberOfRawDataBlocks <= 0) { - FDKfeedBuffer (hBs, pBuffer, bufferSize, pBytesValid) ; - } + FDKfeedBuffer (hBs, pBuffer, bufferSize, pBytesValid); } return TRANSPORTDEC_OK; -- cgit v1.2.3