diff mbox series

[FFmpeg-devel] avcodec/mjpegenc: Fix segfault when freeing incomplete context

Message ID HE1PR0301MB215457AFA61E93D497EBF22F8F7D9@HE1PR0301MB2154.eurprd03.prod.outlook.com
State Accepted
Commit 84ac35ecb8a53bf313b468b5a9f1b0617f2a3de2
Headers show
Series [FFmpeg-devel] avcodec/mjpegenc: Fix segfault when freeing incomplete context
Related show

Checks

Context Check Description
andriy/x86_make success Make finished
andriy/x86_make_fate success Make fate finished
andriy/PPC64_make success Make finished
andriy/PPC64_make_fate success Make fate finished

Commit Message

Andreas Rheinhardt March 30, 2021, 10:26 p.m. UTC
When allocating the MJpegContext fails (or if the dimensions run afoul
of the 65500x65500 limit), an attempt to free a subbuffer of said
context leads to a segfault in ff_mjpeg_encode_close().
Seems to be a regression since 467d9e27e0cb2bf74f41dc832f2f8d191ba58ec9.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
---
 libavcodec/mjpegenc.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

Comments

Michael Niedermayer March 31, 2021, 12:27 p.m. UTC | #1
On Wed, Mar 31, 2021 at 12:26:24AM +0200, Andreas Rheinhardt wrote:
> When allocating the MJpegContext fails (or if the dimensions run afoul
> of the 65500x65500 limit), an attempt to free a subbuffer of said
> context leads to a segfault in ff_mjpeg_encode_close().
> Seems to be a regression since 467d9e27e0cb2bf74f41dc832f2f8d191ba58ec9.
> 
> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
> ---
>  libavcodec/mjpegenc.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)

LGTM

thx

[...]
diff mbox series

Patch

diff --git a/libavcodec/mjpegenc.c b/libavcodec/mjpegenc.c
index df3aaaf26b..596b7544ca 100644
--- a/libavcodec/mjpegenc.c
+++ b/libavcodec/mjpegenc.c
@@ -312,8 +312,10 @@  av_cold int ff_mjpeg_encode_init(MpegEncContext *s)
 
 av_cold void ff_mjpeg_encode_close(MpegEncContext *s)
 {
-    av_freep(&s->mjpeg_ctx->huff_buffer);
-    av_freep(&s->mjpeg_ctx);
+    if (s->mjpeg_ctx) {
+        av_freep(&s->mjpeg_ctx->huff_buffer);
+        av_freep(&s->mjpeg_ctx);
+    }
 }
 
 /**