virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-13 21:28:01 +02:00
Code Issues Releases Activity

avcodec/ffv1: Fix segfaults on allocation error

Browse Source 
When allocating FFV1 slice contexts fails, ff_ffv1_init_slice_contexts()
frees everything that it has allocated, yet it does not reset the
counter for the number of allocated slice contexts. This inconsistent
state leads to segfaults lateron in ff_ffv1_close(), because said
function presumes that the slice contexts have been allocated.
Fix this by making sure that the number of slice contexts on error is
consistent (namely zero).

(This issue only affected the FFV1 decoder, because the encoder does not
clean up after itself on init failure.)

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit a0750f412a)
This commit is contained in:
Andreas Rheinhardt 2020-09-14 04:58:34 +02:00
parent e7780f1615
commit 5e95dc426e
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/ffv1.c
View File

@ -115,12 +115,11 @@ av_cold int ff_ffv1_init_slices_state(FFV1Context *f)
av_cold int ff_ffv1_init_slice_contexts(FFV1Context *f) av_cold int ff_ffv1_init_slice_contexts(FFV1Context *f)
{ {
int i; int i, max_slice_count = f->num_h_slices * f->num_v_slices;
f->max_slice_count = f->num_h_slices * f->num_v_slices; av_assert0(max_slice_count > 0);
av_assert0(f->max_slice_count > 0);
for (i = 0; i < f->max_slice_count; i++) { for (i = 0; i < max_slice_count; i++) {
int sx = i % f->num_h_slices; int sx = i % f->num_h_slices;
int sy = i / f->num_h_slices; int sy = i / f->num_h_slices;
int sxs = f->avctx->width * sx / f->num_h_slices; int sxs = f->avctx->width * sx / f->num_h_slices;
@ -152,6 +151,7 @@ av_cold int ff_ffv1_init_slice_contexts(FFV1Context *f)
goto memfail; goto memfail;
} }
} }
f->max_slice_count = max_slice_count;
return 0; return 0;
memfail: memfail: