avcodec/cavs: Check for av_malloc* failure in ff_cavs_init_top_lines()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

3 files changed, 20 insertions, 3 deletions

diff --git a/libavcodec/cavs.c b/libavcodec/cavs.c
index c0880e005f..83073901bc 100644
--- a/libavcodec/cavs.c
+++ b/libavcodec/cavs.c
@@ -751,7 +751,7 @@ int ff_cavs_init_pic(AVSContext *h)
  * this data has to be stored for one complete row of macroblocks
  * and this storage space is allocated here
  */
-void ff_cavs_init_top_lines(AVSContext *h)
+int ff_cavs_init_top_lines(AVSContext *h)
 {
     /* alloc top line of predictors */
     h->top_qp       = av_mallocz(h->mb_width);
@@ -767,6 +767,23 @@ void ff_cavs_init_top_lines(AVSContext *h)
                                         4 * sizeof(cavs_vector));
     h->col_type_base = av_mallocz(h->mb_width * h->mb_height);
     h->block         = av_mallocz(64 * sizeof(int16_t));
+
+    if (!h->top_qp || !h->top_mv[0] || !h->top_mv[1] || !h->top_pred_Y ||
+        !h->top_border_y || !h->top_border_u || !h->top_border_v ||
+        !h->col_mv || !h->col_type_base || !h->block) {
+        av_freep(&h->top_qp);
+        av_freep(&h->top_mv[0]);
+        av_freep(&h->top_mv[1]);
+        av_freep(&h->top_pred_Y);
+        av_freep(&h->top_border_y);
+        av_freep(&h->top_border_u);
+        av_freep(&h->top_border_v);
+        av_freep(&h->col_mv);
+        av_freep(&h->col_type_base);
+        av_freep(&h->block);
+        return AVERROR(ENOMEM);
+    }
+    return 0;
 }
 
 av_cold int ff_cavs_init(AVCodecContext *avctx)
diff --git a/libavcodec/cavs.h b/libavcodec/cavs.h
index 12f396228e..fb9df15194 100644
--- a/libavcodec/cavs.h
+++ b/libavcodec/cavs.h
@@ -272,7 +272,7 @@ void ff_cavs_mv(AVSContext *h, enum cavs_mv_loc nP, enum cavs_mv_loc nC,
 void ff_cavs_init_mb(AVSContext *h);
 int  ff_cavs_next_mb(AVSContext *h);
 int ff_cavs_init_pic(AVSContext *h);
-void ff_cavs_init_top_lines(AVSContext *h);
+int ff_cavs_init_top_lines(AVSContext *h);
 int ff_cavs_init(AVCodecContext *avctx);
 int ff_cavs_end (AVCodecContext *avctx);
 
diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c
index b5304eab9e..cffb19c959 100644
--- a/libavcodec/cavsdec.c
+++ b/libavcodec/cavsdec.c
@@ -1151,7 +1151,7 @@ static int decode_seq_header(AVSContext *h)
     h->avctx->width  = h->width;
     h->avctx->height = h->height;
     if (!h->top_qp)
-        ff_cavs_init_top_lines(h);
+        return ff_cavs_init_top_lines(h);
     return 0;
 }