Message ID | D4YALSG1G3VH.3ABJR031BO4DH@gmail.com |
---|---|
State | New |
Headers | show |
Series | [FFmpeg-devel] avcodec/hw_base_encode: fix use after free on close | expand |
diff --git a/libavcodec/hw_base_encode.c b/libavcodec/hw_base_encode.c index 912c707a68f..4d8bf4fe71d 100644 --- a/libavcodec/hw_base_encode.c +++ b/libavcodec/hw_base_encode.c @@ -802,14 +802,14 @@ int ff_hw_base_encode_init(AVCodecContext *avctx, FFHWBaseEncodeContext *ctx) return 0; } int ff_hw_base_encode_close(FFHWBaseEncodeContext *ctx) { - FFHWBaseEncodePicture *pic; - - for (pic = ctx->pic_start; pic; pic = pic->next) + for (FFHWBaseEncodePicture *pic = ctx->pic_start, *next_pic = pic; pic; pic = next_pic) { + next_pic = pic->next; base_encode_pic_free(pic); + } av_fifo_freep2(&ctx->encode_fifo); av_frame_free(&ctx->frame); av_packet_free(&ctx->tail_pkt);