[FFmpeg-cvslog] avcodec/interplayvideo: Check ff_get_buffer() for failure

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Fri Jun 30 03:31:54 2017 +0200| [60a45713e7bc94b079f8cd39cfaa300e9c381f62] | committer: Michael Niedermayer

avcodec/interplayvideo: Check ff_get_buffer() for failure

Fixes: runtime error: division by zero
Fixes: 2408/clusterfuzz-testcase-minimized-5432734438653952
Fixes: 2415/clusterfuzz-testcase-minimized-4672827619803136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=60a45713e7bc94b079f8cd39cfaa300e9c381f62
---

 libavcodec/interplayvideo.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/libavcodec/interplayvideo.c b/libavcodec/interplayvideo.c
index 56ce38b042..d6f484aa09 100644
--- a/libavcodec/interplayvideo.c
+++ b/libavcodec/interplayvideo.c
@@ -1155,6 +1155,7 @@ static void ipvideo_decode_format_11_opcodes(IpvideoContext *s, AVFrame *frame)
 static av_cold int ipvideo_decode_init(AVCodecContext *avctx)
 {
     IpvideoContext *s = avctx->priv_data;
+    int ret;
 
     s->avctx = avctx;
 
@@ -1169,11 +1170,8 @@ static av_cold int ipvideo_decode_init(AVCodecContext *avctx)
     s->prev_decode_frame = av_frame_alloc();
     if (!s->last_frame || !s->second_last_frame ||
         !s->cur_decode_frame || !s->prev_decode_frame) {
-        av_frame_free(&s->last_frame);
-        av_frame_free(&s->second_last_frame);
-        av_frame_free(&s->cur_decode_frame);
-        av_frame_free(&s->prev_decode_frame);
-        return AVERROR(ENOMEM);
+        ret = AVERROR(ENOMEM);
+        goto error;
     }
 
     s->cur_decode_frame->width   = avctx->width;
@@ -1183,10 +1181,21 @@ static av_cold int ipvideo_decode_init(AVCodecContext *avctx)
     s->cur_decode_frame->format  = avctx->pix_fmt;
     s->prev_decode_frame->format = avctx->pix_fmt;
 
-    ff_get_buffer(avctx, s->cur_decode_frame, 0);
-    ff_get_buffer(avctx, s->prev_decode_frame, 0);
+    ret = ff_get_buffer(avctx, s->cur_decode_frame, 0);
+    if (ret < 0)
+        goto error;
+
+    ret = ff_get_buffer(avctx, s->prev_decode_frame, 0);
+    if (ret < 0)
+        goto error;
 
     return 0;
+error:
+    av_frame_free(&s->last_frame);
+    av_frame_free(&s->second_last_frame);
+    av_frame_free(&s->cur_decode_frame);
+    av_frame_free(&s->prev_decode_frame);
+    return ret;
 }
 
 static int ipvideo_decode_frame(AVCodecContext *avctx,