diff options
| author | Derek Buitenhuis <derek.buitenhuis@gmail.com> | 2014-12-15 17:59:08 -0500 |
|---|---|---|
| committer | Derek Buitenhuis <derek.buitenhuis@gmail.com> | 2014-12-15 21:52:19 -0500 |
| commit | 402a61c9197b6d1199e3f12c41a99924b5811cfe (patch) | |
| tree | d315c4b5c008175280cf66d975c121326eaffc43 | |
| parent | 0a7964dca5e52536c05a72987c3d7dbb12add942 (diff) | |
| download | ffmpeg-402a61c9197b6d1199e3f12c41a99924b5811cfe.tar.gz | |
snow_dwt: Don't try and free members of non-existent arrays
If allocation fails earlier on, and the next frame is processed,
the slice buffer could be left in a state where line and data_stack
have already been freed, or are otherwise null pointers.
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
| -rw-r--r-- | libavcodec/snow_dwt.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/libavcodec/snow_dwt.c b/libavcodec/snow_dwt.c index 5b890e01b5..986a6b904c 100644 --- a/libavcodec/snow_dwt.c +++ b/libavcodec/snow_dwt.c @@ -91,6 +91,10 @@ void ff_slice_buffer_release(slice_buffer *buf, int line) void ff_slice_buffer_flush(slice_buffer *buf) { int i; + + if (!buf->line) + return; + for (i = 0; i < buf->line_count; i++) if (buf->line[i]) ff_slice_buffer_release(buf, i); @@ -101,8 +105,9 @@ void ff_slice_buffer_destroy(slice_buffer *buf) int i; ff_slice_buffer_flush(buf); - for (i = buf->data_count - 1; i >= 0; i--) - av_freep(&buf->data_stack[i]); + if (buf->data_stack) + for (i = buf->data_count - 1; i >= 0; i--) + av_freep(&buf->data_stack[i]); av_freep(&buf->data_stack); av_freep(&buf->line); } |