mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2026-08-09 09:32:43 +00:00
dd941af8ac
Each pending packet consumes up to poc_diff tree nodes when it is output, so the packets in the FIFO can consume at most nb_pending nodes in total. Frames whose tree lookup misses on output leave their nodes behind, and damaged or crafted streams can make that happen indefinitely, growing the tree without limit. Track the node count and insertion order, keep the leftovers of up to MAX_DAMAGED_FRAMES frames and beyond that evict the nodes unconsumed the longest. Timestamps of valid frames are unaffected unless more frames than that are damaged. No eviction is done at EOF, where nodes are deliberately kept to regenerate timestamps from. Of all h264/hevc conformance samples only MR3_TANDBERG_B.264 triggers evictions, and no sample changes output. Fixes: unbounded memory growth with damaged streams Co-Authored-By: Fable-5