[FFmpeg-cvslog] avcodec/mjpegenc: Fix segfault when freeing incomplete context

Andreas Rheinhardt git at videolan.org
Sat Apr 3 01:18:22 EEST 2021


ffmpeg | branch: release/4.4 | Andreas Rheinhardt <andreas.rheinhardt at outlook.com> | Tue Mar 30 23:20:49 2021 +0200| [5e2e8e1b9e2877062ae881ae68a69b4e12f6ed13] | committer: Andreas Rheinhardt

avcodec/mjpegenc: Fix segfault when freeing incomplete context

When allocating the MJpegContext fails (or if the dimensions run afoul
of the 65500x65500 limit), an attempt to free a subbuffer of said
context leads to a segfault in ff_mjpeg_encode_close().
Seems to be a regression since 467d9e27e0cb2bf74f41dc832f2f8d191ba58ec9.

Reviewed-by: Michael Niedermayer <michael at niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt at outlook.com>
(cherry picked from commit 84ac35ecb8a53bf313b468b5a9f1b0617f2a3de2)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5e2e8e1b9e2877062ae881ae68a69b4e12f6ed13
---

 libavcodec/mjpegenc.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/libavcodec/mjpegenc.c b/libavcodec/mjpegenc.c
index 22af094da7..4d7755cc88 100644
--- a/libavcodec/mjpegenc.c
+++ b/libavcodec/mjpegenc.c
@@ -312,8 +312,10 @@ av_cold int ff_mjpeg_encode_init(MpegEncContext *s)
 
 av_cold void ff_mjpeg_encode_close(MpegEncContext *s)
 {
-    av_freep(&s->mjpeg_ctx->huff_buffer);
-    av_freep(&s->mjpeg_ctx);
+    if (s->mjpeg_ctx) {
+        av_freep(&s->mjpeg_ctx->huff_buffer);
+        av_freep(&s->mjpeg_ctx);
+    }
 }
 
 /**



More information about the ffmpeg-cvslog mailing list