| Message ID | HE1PR0301MB215457AFA61E93D497EBF22F8F7D9@HE1PR0301MB2154.eurprd03.prod.outlook.com |
|---|---|
| State | Accepted |
| Commit | 84ac35ecb8a53bf313b468b5a9f1b0617f2a3de2 |
| Headers | show |
| Series | [FFmpeg-devel] avcodec/mjpegenc: Fix segfault when freeing incomplete context | expand |
| Context | Check | Description |
|---|---|---|
| andriy/x86_make | success | Make finished |
| andriy/x86_make_fate | success | Make fate finished |
| andriy/PPC64_make | success | Make finished |
| andriy/PPC64_make_fate | success | Make fate finished |
On Wed, Mar 31, 2021 at 12:26:24AM +0200, Andreas Rheinhardt wrote: > When allocating the MJpegContext fails (or if the dimensions run afoul > of the 65500x65500 limit), an attempt to free a subbuffer of said > context leads to a segfault in ff_mjpeg_encode_close(). > Seems to be a regression since 467d9e27e0cb2bf74f41dc832f2f8d191ba58ec9. > > Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> > --- > libavcodec/mjpegenc.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) LGTM thx [...]
diff --git a/libavcodec/mjpegenc.c b/libavcodec/mjpegenc.c index df3aaaf26b..596b7544ca 100644 --- a/libavcodec/mjpegenc.c +++ b/libavcodec/mjpegenc.c @@ -312,8 +312,10 @@ av_cold int ff_mjpeg_encode_init(MpegEncContext *s) av_cold void ff_mjpeg_encode_close(MpegEncContext *s) { - av_freep(&s->mjpeg_ctx->huff_buffer); - av_freep(&s->mjpeg_ctx); + if (s->mjpeg_ctx) { + av_freep(&s->mjpeg_ctx->huff_buffer); + av_freep(&s->mjpeg_ctx); + } } /**
When allocating the MJpegContext fails (or if the dimensions run afoul of the 65500x65500 limit), an attempt to free a subbuffer of said context leads to a segfault in ff_mjpeg_encode_close(). Seems to be a regression since 467d9e27e0cb2bf74f41dc832f2f8d191ba58ec9. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> --- libavcodec/mjpegenc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)