From 8c6b931f4ca08abdaff4896cb2707c38d8483d80 Mon Sep 17 00:00:00 2001 From: James Almer Date: Fri, 2 Jun 2023 13:59:35 -0300 Subject: [PATCH] avcodec/av1dec: reset the fragment on reading failure Fixes: NULL pointer dereference Fixes: 59359/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-6726080594313216 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: James Almer --- libavcodec/av1dec.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/av1dec.c b/libavcodec/av1dec.c index 5cc5d87c64..d63e792113 100644 --- a/libavcodec/av1dec.c +++ b/libavcodec/av1dec.c @@ -1460,6 +1460,7 @@ static int av1_receive_frame(AVCodecContext *avctx, AVFrame *frame) ret = ff_cbs_read_packet(s->cbc, &s->current_obu, s->pkt); if (ret < 0) { + ff_cbs_fragment_reset(&s->current_obu); av_packet_unref(s->pkt); av_log(avctx, AV_LOG_ERROR, "Failed to read packet.\n"); return ret;