[FFmpeg-cvslog] avcodec/nvdec: Check av_buffer_ref()

[Andreas Rheinhardt]

ffmpeg | branch: master | Andreas Rheinhardt <andreas.rheinhardt at outlook.com> | Sat Aug  6 09:14:11 2022 +0200| [d3730acca3a749204f0c312f1be6f4e5f3296f22] | committer: Andreas Rheinhardt

avcodec/nvdec: Check av_buffer_ref()

It (unfortunately) involves an allocation and can therefore fail.

Reviewed-by: Timo Rothenpieler <timo at rothenpieler.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt at outlook.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d3730acca3a749204f0c312f1be6f4e5f3296f22
---

 libavcodec/nvdec.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/libavcodec/nvdec.c b/libavcodec/nvdec.c
index edff46d310..15665b83bb 100644
--- a/libavcodec/nvdec.c
+++ b/libavcodec/nvdec.c
@@ -532,8 +532,11 @@ static int nvdec_retrieve_data(void *logctx, AVFrame *frame)
     }
 
     unmap_data->idx = cf->idx;
-    unmap_data->idx_ref = av_buffer_ref(cf->idx_ref);
-    unmap_data->decoder_ref = av_buffer_ref(cf->decoder_ref);
+    if (!(unmap_data->idx_ref     = av_buffer_ref(cf->idx_ref)) ||
+        !(unmap_data->decoder_ref = av_buffer_ref(cf->decoder_ref))) {
+        ret = AVERROR(ENOMEM);
+        goto copy_fail;
+    }
 
     av_pix_fmt_get_chroma_sub_sample(hwctx->sw_format, &shift_h, &shift_v);
     for (i = 0; frame->linesize[i]; i++) {