[FFmpeg-devel] [PATCH 1/2] avcodec/vp9: prevent null pointer use on init_frames() failure

[James Almer]

On 4/5/2020 3:31 AM, Peter Ross wrote:
> ---
>  libavcodec/vp9.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/libavcodec/vp9.c b/libavcodec/vp9.c
> index 7ee375d4d0..c125e22975 100644
> --- a/libavcodec/vp9.c
> +++ b/libavcodec/vp9.c
> @@ -1216,18 +1216,24 @@ static av_cold int vp9_decode_free(AVCodecContext *avctx)
>      int i;
>  
>      for (i = 0; i < 3; i++) {
> +        if (s->s.frames[i].tf.f) {
>          if (s->s.frames[i].tf.f->buf[0])
>              vp9_frame_unref(avctx, &s->s.frames[i]);
>          av_frame_free(&s->s.frames[i].tf.f);
> +        }
>      }
>      av_buffer_pool_uninit(&s->frame_extradata_pool);
>      for (i = 0; i < 8; i++) {
> +        if (s->s.refs[i].f) {
>          if (s->s.refs[i].f->buf[0])
>              ff_thread_release_buffer(avctx, &s->s.refs[i]);
>          av_frame_free(&s->s.refs[i].f);
> +        }
> +        if (s->next_refs[i].f) {
>          if (s->next_refs[i].f->buf[0])
>              ff_thread_release_buffer(avctx, &s->next_refs[i]);
>          av_frame_free(&s->next_refs[i].f);
> +        }
>      }

ff_thread_release_buffer() (and by extension vp9_frame_unref()) already
does a check for ThreadFrame->f then ThreadFrame->f->buf[0], so this can
be simplified into simply removing the existing checks here and call
ff_thread_release_buffer/vp9_frame_unref unconditionally.

See vp9_decode_flush().

>  
>      free_buffers(s);
> 
> 
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".
>