virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-10 06:10:52 +02:00
Code Issues Releases Activity

avcodec/interplayvideo: Check ff_get_buffer() for failure

Browse Source 
Fixes: runtime error: division by zero
Fixes: 2408/clusterfuzz-testcase-minimized-5432734438653952
Fixes: 2415/clusterfuzz-testcase-minimized-4672827619803136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2017-06-30 03:31:54 +02:00
parent 0b180d2066
commit 60a45713e7
1 changed files with 16 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
libavcodec/interplayvideo.c
View File

@@ -1155,6 +1155,7 @@ static void ipvideo_decode_format_11_opcodes(IpvideoContext *s, AVFrame *frame)
static av_cold int ipvideo_decode_init(AVCodecContext *avctx) static av_cold int ipvideo_decode_init(AVCodecContext *avctx)
{ {
IpvideoContext *s = avctx->priv_data; IpvideoContext *s = avctx->priv_data;
int ret;
s->avctx = avctx; s->avctx = avctx;
@@ -1169,11 +1170,8 @@ static av_cold int ipvideo_decode_init(AVCodecContext *avctx)
s->prev_decode_frame = av_frame_alloc(); s->prev_decode_frame = av_frame_alloc();
if (!s->last_frame || !s->second_last_frame || if (!s->last_frame || !s->second_last_frame ||
!s->cur_decode_frame || !s->prev_decode_frame) { !s->cur_decode_frame || !s->prev_decode_frame) {
av_frame_free(&s->last_frame); ret = AVERROR(ENOMEM);
av_frame_free(&s->second_last_frame); goto error;
av_frame_free(&s->cur_decode_frame);
av_frame_free(&s->prev_decode_frame);
return AVERROR(ENOMEM);
} }
s->cur_decode_frame->width = avctx->width; s->cur_decode_frame->width = avctx->width;
@@ -1183,10 +1181,21 @@ static av_cold int ipvideo_decode_init(AVCodecContext *avctx)
s->cur_decode_frame->format = avctx->pix_fmt; s->cur_decode_frame->format = avctx->pix_fmt;
s->prev_decode_frame->format = avctx->pix_fmt; s->prev_decode_frame->format = avctx->pix_fmt;
ff_get_buffer(avctx, s->cur_decode_frame, 0); ret = ff_get_buffer(avctx, s->cur_decode_frame, 0);
ff_get_buffer(avctx, s->prev_decode_frame, 0); if (ret < 0)
goto error;
ret = ff_get_buffer(avctx, s->prev_decode_frame, 0);
if (ret < 0)
goto error;
return 0; return 0;
error:
av_frame_free(&s->last_frame);
av_frame_free(&s->second_last_frame);
av_frame_free(&s->cur_decode_frame);
av_frame_free(&s->prev_decode_frame);
return ret;
} }
static int ipvideo_decode_frame(AVCodecContext *avctx, static int ipvideo_decode_frame(AVCodecContext *avctx,