[FFmpeg-cvslog] avcodec/binkaudio: Clear state on EAGAIN

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Sat Apr  2 22:39:08 2022 +0200| [b97e58da449f78c347a88fbd09dd79a3c75e042a] | committer: Michael Niedermayer

avcodec/binkaudio: Clear state on EAGAIN

Its not supported to maintain a frame as receive_frame() argument
over multiple calls
Fixes: store to null pointer of type 'FFTSample' (aka 'float')
Fixes: 46231/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINKAUDIO_DCT_fuzzer-6276566037954560
Fixes: ACDC.smo

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b97e58da449f78c347a88fbd09dd79a3c75e042a
---

 libavcodec/binkaudio.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libavcodec/binkaudio.c b/libavcodec/binkaudio.c
index 16067662d6..8bac8e03f3 100644
--- a/libavcodec/binkaudio.c
+++ b/libavcodec/binkaudio.c
@@ -301,8 +301,10 @@ static int binkaudio_receive_frame(AVCodecContext *avctx, AVFrame *frame)
 again:
     if (!s->pkt->data) {
         ret = ff_decode_get_packet(avctx, s->pkt);
-        if (ret < 0)
+        if (ret < 0) {
+            s->ch_offset = 0;
             return ret;
+        }
 
         if (s->pkt->size < 4) {
             av_log(avctx, AV_LOG_ERROR, "Packet is too small\n");