diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-08-21 16:33:03 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-06-10 02:13:12 +0200 |
| commit | 03c80a740043bd8cf35dc18db84ed1ffd4c08ddc (patch) | |
| tree | 410ff2c4f73ff2994f29e851385e94cbbe6d136a | |
| parent | b6ae28c2e9cb1b667a4fd51feb9ad63987c0c9c2 (diff) | |
| download | ffmpeg-03c80a740043bd8cf35dc18db84ed1ffd4c08ddc.tar.gz | |
avcodec/h264_slice: More complete cleanup in h264_slice_header_init()
Fixes null pointer dereference
Fixes Ticket3873
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1fa35e4352cc39894987e14de464e3d72b55739f)
Conflicts:
libavcodec/h264_slice.c
| -rw-r--r-- | libavcodec/h264.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/libavcodec/h264.c b/libavcodec/h264.c index 4d1269a5dd..c41cc36c34 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -3128,6 +3128,7 @@ static int h264_slice_header_init(H264Context *h, int reinit) h->avctx->active_thread_type & FF_THREAD_SLICE) ? h->avctx->thread_count : 1; int i; + int ret = AVERROR_INVALIDDATA; h->avctx->sample_aspect_ratio = h->sps.sar; av_assert0(h->avctx->sample_aspect_ratio.den); @@ -3153,7 +3154,7 @@ static int h264_slice_header_init(H264Context *h, int reinit) if (ff_h264_alloc_tables(h) < 0) { av_log(h->avctx, AV_LOG_ERROR, "Could not allocate memory for h264\n"); - return AVERROR(ENOMEM); + goto fail; } if (nb_slices > MAX_THREADS || (nb_slices > h->mb_height && h->mb_height)) { @@ -3171,12 +3172,16 @@ static int h264_slice_header_init(H264Context *h, int reinit) if (!HAVE_THREADS || !(h->avctx->active_thread_type & FF_THREAD_SLICE)) { if (context_init(h) < 0) { av_log(h->avctx, AV_LOG_ERROR, "context_init() failed.\n"); - return -1; + goto fail; } } else { for (i = 1; i < h->slice_context_count; i++) { H264Context *c; c = h->thread_context[i] = av_mallocz(sizeof(H264Context)); + if (!c) { + ret = AVERROR(ENOMEM); + goto fail; + } c->avctx = h->avctx; if (CONFIG_ERROR_RESILIENCE) { c->dsp = h->dsp; @@ -3215,13 +3220,17 @@ static int h264_slice_header_init(H264Context *h, int reinit) for (i = 0; i < h->slice_context_count; i++) if (context_init(h->thread_context[i]) < 0) { av_log(h->avctx, AV_LOG_ERROR, "context_init() failed.\n"); - return -1; + goto fail; } } h->context_initialized = 1; return 0; +fail: + free_tables(h, 0); + h->context_initialized = 0; + return ret; } /** |