[FFmpeg-cvslog] avcodec/hevc: clear HEVClc when its deallocated in hevc_decode_free()

[Michael Niedermayer]

ffmpeg | branch: release/2.1 | Michael Niedermayer <michaelni at gmx.at> | Tue Dec 31 15:18:47 2013 +0100| [69aa3d5b88ecb1e57d1d1f508f1f141514bc7526] | committer: Michael Niedermayer

avcodec/hevc: clear HEVClc when its deallocated in hevc_decode_free()

Fixes reading freed memory
Fixes: asan_heap-uaf_1abf8ef_3987_NUT_A_ericsson_4.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 21a2fb7e0579703fdea96f659498ef8b1f243289)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=69aa3d5b88ecb1e57d1d1f508f1f141514bc7526
---

 libavcodec/hevc.c |    2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/hevc.c b/libavcodec/hevc.c
index 2f7c5b6..a16b045 100644
--- a/libavcodec/hevc.c
+++ b/libavcodec/hevc.c
@@ -2624,6 +2624,8 @@ static av_cold int hevc_decode_free(AVCodecContext *avctx)
             av_freep(&s->sList[i]);
         }
     }
+    if (s->HEVClc == s->HEVClcList[0])
+        s->HEVClc = NULL;
     av_freep(&s->HEVClcList[0]);
 
     for (i = 0; i < s->nals_allocated; i++)