diff mbox series

[FFmpeg-devel,24/40] avcodec/av1dec: Fix segfault upon allocation error

Message ID 20200914052747.124118-8-andreas.rheinhardt@gmail.com
State Superseded
Headers show
Series [FFmpeg-devel,01/16] avcodec/snowdec: Use ff_snow_common_init() directly
Related show

Checks

Context Check Description
andriy/default pending
andriy/make success Make finished
andriy/make_fate success Make fate finished

Commit Message

Andreas Rheinhardt Sept. 14, 2020, 5:27 a.m. UTC
The decoder's close function simply presumed that some AVFrames have
been successfully allocated although this can of course fail.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
---
Once could btw return immediately as soon as one encounters an AVFrame
that is NULL, because these frames are the first things to be allocated
in init (and in the same order as they are freed); yet I wanted to avoid
this additional dependency.

 libavcodec/av1dec.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Paul B Mahol Sept. 16, 2020, 9:18 a.m. UTC | #1
On Mon, Sep 14, 2020 at 07:27:31AM +0200, Andreas Rheinhardt wrote:
> The decoder's close function simply presumed that some AVFrames have
> been successfully allocated although this can of course fail.
> 
> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
> ---
> Once could btw return immediately as soon as one encounters an AVFrame
> that is NULL, because these frames are the first things to be allocated
> in init (and in the same order as they are freed); yet I wanted to avoid
> this additional dependency.
> 
>  libavcodec/av1dec.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 

probably ok
diff mbox series

Patch

diff --git a/libavcodec/av1dec.c b/libavcodec/av1dec.c
index bd8acdaafe..4b89bd83a0 100644
--- a/libavcodec/av1dec.c
+++ b/libavcodec/av1dec.c
@@ -388,11 +388,11 @@  static av_cold int av1_decode_free(AVCodecContext *avctx)
     AV1DecContext *s = avctx->priv_data;
 
     for (int i = 0; i < FF_ARRAY_ELEMS(s->ref); i++) {
-        if (s->ref[i].tf.f->buf[0])
+        if (s->ref[i].tf.f && s->ref[i].tf.f->buf[0])
             av1_frame_unref(avctx, &s->ref[i]);
         av_frame_free(&s->ref[i].tf.f);
     }
-    if (s->cur_frame.tf.f->buf[0])
+    if (s->cur_frame.tf.f && s->cur_frame.tf.f->buf[0])
         av1_frame_unref(avctx, &s->cur_frame);
     av_frame_free(&s->cur_frame.tf.f);