diff mbox series

[FFmpeg-devel,5/6] avcodec/vp3: Simplify shuffling frames, fix crash on alloc error

Message ID AS8P250MB07447C11719A0963DD9523E18FF6A@AS8P250MB0744.EURP250.PROD.OUTLOOK.COM
State Accepted
Commit 0e6fdebd0d5dafa07b4963f6b8ea7690ca124887
Headers show
Series [FFmpeg-devel,1/3] avcodec/vp3: Move work after ff_thread_finish_setup | expand

Checks

Context Check Description
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Andreas Rheinhardt Sept. 15, 2023, 2:47 p.m. UTC 
When decoding non-keyframes, the decoding process expects
there to be two reference frames, the last one and the golden
one. The existence of the golden one is checked and in case
it is there, it is presumed that the last one exists as well.

This assumption is wrong in case of memory allocation failure,
namely in case the call to ff_thread_ref_frame() that sets
the last frame fails.

Fix this by actually performing a shuffle without creating
new references. This can't fail and has the advantage of
fewer implicit allocations.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
---
 libavcodec/vp3.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)
diff mbox series

Patch

diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
index 5ce1ecfce7..f12bd497b9 100644
--- a/libavcodec/vp3.c
+++ b/libavcodec/vp3.c
@@ -2498,19 +2498,14 @@  static int update_frames(AVCodecContext *avctx)
     Vp3DecodeContext *s = avctx->priv_data;
     int ret = 0;
 
-    /* shuffle frames (last = current) */
-    ff_thread_release_ext_buffer(avctx, &s->last_frame);
-    ret = ff_thread_ref_frame(&s->last_frame, &s->current_frame);
-    if (ret < 0)
-        goto fail;
-
     if (s->keyframe) {
         ff_thread_release_ext_buffer(avctx, &s->golden_frame);
         ret = ff_thread_ref_frame(&s->golden_frame, &s->current_frame);
     }
+    /* shuffle frames */
+    ff_thread_release_ext_buffer(avctx, &s->last_frame);
+    FFSWAP(ThreadFrame, s->last_frame, s->current_frame);
 
-fail:
-    ff_thread_release_ext_buffer(avctx, &s->current_frame);
     return ret;
 }