diff options
| author | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2023-09-24 13:15:48 +0200 |
|---|---|---|
| committer | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2024-04-19 13:18:04 +0200 |
| commit | 4513300989502090c4fd6560544dce399a8cd53c (patch) | |
| tree | a1b9155bac0a73be79e4d9f658f73265015c00c0 | |
| parent | d692c429380ff254ea449ef62b07fb0542109200 (diff) | |
| download | ffmpeg-4513300989502090c4fd6560544dce399a8cd53c.tar.gz | |
avcodec/rkmppdec: Fix double-free on error
After having created the AVBuffer that is put into frame->buf[0],
ownership of several objects (namely an AVDRMFrameDescriptor,
an MppFrame and some AVBufferRefs framecontextref and decoder_ref)
has passed to the AVBuffer and therefore to the frame.
Yet it has nevertheless been freed manually on error
afterwards, which would lead to a double-free as soon
as the AVFrame is unreferenced.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
| -rw-r--r-- | libavcodec/rkmppdec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/rkmppdec.c b/libavcodec/rkmppdec.c index 7665098c6a..6889545b20 100644 --- a/libavcodec/rkmppdec.c +++ b/libavcodec/rkmppdec.c @@ -463,8 +463,8 @@ static int rkmpp_retrieve_frame(AVCodecContext *avctx, AVFrame *frame) frame->hw_frames_ctx = av_buffer_ref(decoder->frames_ref); if (!frame->hw_frames_ctx) { - ret = AVERROR(ENOMEM); - goto fail; + av_frame_unref(frame); + return AVERROR(ENOMEM); } return 0; |