avcodec/mpeg12dec: Limit maximum A53 CC size

This is more than 10 times the size of the largest i found. And also alot more
than our encoder could handle (our encoder is limited to max 31)
Without any limit megabyte+ sized blocks can be reallocated millions of times.
Sadly the SCTE-20 spec does not seem to contain any hard limit directly, so this limit here
is arbitrary

Fixes: Timeout (25sec -> 152ms)
Fixes: 25714/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG2VIDEO_fuzzer-5713633336885248
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavcodec/mpeg12dec.c b/libavcodec/mpeg12dec.c
index 3be90d7f25152ba77a68ade845a5755026b12119..6d0e9fc7ed7880ffac694c668884a3cefb99a9bc 100644 (file)
--- a/libavcodec/mpeg12dec.c
+++ b/libavcodec/mpeg12dec.c
@@ -50,6 +50,8 @@
 #include "version.h"
 #include "xvmc_internal.h"
 
+#define A53_MAX_CC_COUNT 2000
+
 typedef struct Mpeg1Context {
     MpegEncContext mpeg_enc_ctx;
     int mpeg_enc_ctx_allocated; /* true if decoding context allocated */
@@ -2240,7 +2242,7 @@ static int mpeg_decode_a53_cc(AVCodecContext *avctx,
                                             * UINT64_C(3));
             int ret;
 
-            if (new_size > INT_MAX)
+            if (new_size > 3*A53_MAX_CC_COUNT)
                 return AVERROR(EINVAL);
 
             ret = av_buffer_realloc(&s1->a53_buf_ref, new_size);
@@ -2263,7 +2265,7 @@ static int mpeg_decode_a53_cc(AVCodecContext *avctx,
             int old_size = s1->a53_buf_ref ? s1->a53_buf_ref->size : 0;
             const uint64_t new_size = (old_size + cc_count
                                             * UINT64_C(3));
-            if (new_size > INT_MAX)
+            if (new_size > 3*A53_MAX_CC_COUNT)
                 return AVERROR(EINVAL);
 
             ret = av_buffer_realloc(&s1->a53_buf_ref, new_size);
@@ -2333,7 +2335,7 @@ static int mpeg_decode_a53_cc(AVCodecContext *avctx,
             int old_size = s1->a53_buf_ref ? s1->a53_buf_ref->size : 0;
             const uint64_t new_size = (old_size + cc_count
                                             * UINT64_C(6));
-            if (new_size > INT_MAX)
+            if (new_size > 3*A53_MAX_CC_COUNT)
                 return AVERROR(EINVAL);
 
             ret = av_buffer_realloc(&s1->a53_buf_ref, new_size);