[FFmpeg-devel] [PATCH 2/2] avcodec/binkaudio: Clear state on EAGAIN

[Michael Niedermayer]

Its not supported to maintain a frame as receive_frame() argument
over multiple calls
Fixes: store to null pointer of type 'FFTSample' (aka 'float')
Fixes: 46231/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_BINKAUDIO_DCT_fuzzer-6276566037954560

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavcodec/binkaudio.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libavcodec/binkaudio.c b/libavcodec/binkaudio.c
index c4f3e743e2..f8cdc9f0cf 100644
--- a/libavcodec/binkaudio.c
+++ b/libavcodec/binkaudio.c
@@ -301,8 +301,10 @@ static int binkaudio_receive_frame(AVCodecContext *avctx, AVFrame *frame)
 again:
     if (!s->pkt->data) {
         ret = ff_decode_get_packet(avctx, s->pkt);
-        if (ret < 0)
+        if (ret < 0) {
+            s->ch_offset = 0;
             return ret;
+        }
 
         if (s->pkt->size < 4) {
             av_log(avctx, AV_LOG_ERROR, "Packet is too small\n");
-- 
2.17.1