diff mbox series

[FFmpeg-devel,21/23] avcodec/dnxhdenc: Fix segfault when using too many slice threads

Message ID VI1PR0301MB2159CB7153633C9074203C308F589@VI1PR0301MB2159.eurprd03.prod.outlook.com
State Accepted
Commit eb583b3cb98797e8e815b7432f90cae8e8d52794
Headers show
Series [FFmpeg-devel,01/23] avcodec/ljpegenc: Mark encoder as init-threadsafe | expand

Checks

Context Check Description
andriy/x86_make success Make finished
andriy/x86_make_fate success Make fate finished
andriy/PPC64_make success Make finished
andriy/PPC64_make_fate success Make fate finished

Commit Message

Andreas Rheinhardt May 6, 2021, 5:11 a.m. UTC 
The DNXHD encoder's context contains an array of 32 pointers to
DNXHDEncContexts used in case of slice threading; when trying
to use more than 32 threads with slice threading, the encoder's init
function errors out, but the close function takes avctx->thread_count
at face value and tries to free inexistent elements of the array,
leading to potential crashes.

Fix this by modifying the check used to decide whether the slice
contexts should be freed.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
---
 libavcodec/dnxhdenc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/libavcodec/dnxhdenc.c b/libavcodec/dnxhdenc.c
index 7f18aff66e..1df5346e62 100644
--- a/libavcodec/dnxhdenc.c
+++ b/libavcodec/dnxhdenc.c
@@ -1337,7 +1337,7 @@  static av_cold int dnxhd_encode_end(AVCodecContext *avctx)
     av_freep(&ctx->qmatrix_c16);
     av_freep(&ctx->qmatrix_l16);
 
-    if (avctx->active_thread_type == FF_THREAD_SLICE) {
+    if (ctx->thread[1]) {
         for (i = 1; i < avctx->thread_count; i++)
             av_freep(&ctx->thread[i]);
     }