avformat/aviobuf: Delay buffer downsizing until asserts are met

Fixes: Assertion failure
Fixes: 15151/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5757079496687616
Fixes: 15205/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5767573242642432
May fix: Ticket7094

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
index 5a33f82950c32b2a1dee172ce4c61ed97469c51e..6a5cd97b0aa81ffef3830f08bc67d2efd5b1a47c 100644 (file)
--- a/libavformat/aviobuf.c
+++ b/libavformat/aviobuf.c
@@ -570,7 +570,7 @@ static void fill_buffer(AVIOContext *s)
     }
 
     /* make buffer smaller in case it ended up large after probing */
-    if (s->read_packet && s->orig_buffer_size && s->buffer_size > s->orig_buffer_size) {
+    if (s->read_packet && s->orig_buffer_size && s->buffer_size > s->orig_buffer_size && len >= s->orig_buffer_size) {
         if (dst == s->buffer && s->buf_ptr != dst) {
             int ret = ffio_set_buf_size(s, s->orig_buffer_size);
             if (ret < 0)
@@ -578,7 +578,6 @@ static void fill_buffer(AVIOContext *s)
 
             s->checksum_ptr = dst = s->buffer;
         }
-        av_assert0(len >= s->orig_buffer_size);
         len = s->orig_buffer_size;
     }