diff options
| author | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2021-03-30 23:20:49 +0200 |
|---|---|---|
| committer | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2021-04-02 21:39:04 +0200 |
| commit | 5e2e8e1b9e2877062ae881ae68a69b4e12f6ed13 (patch) | |
| tree | 8edb89b51de7f8565cfe4b17cb84fa76a3619fff | |
| parent | 28dd12c9b7518adc2bda4ca980603504b32298cf (diff) | |
| download | ffmpeg-5e2e8e1b9e2877062ae881ae68a69b4e12f6ed13.tar.gz | |
avcodec/mjpegenc: Fix segfault when freeing incomplete context
When allocating the MJpegContext fails (or if the dimensions run afoul
of the 65500x65500 limit), an attempt to free a subbuffer of said
context leads to a segfault in ff_mjpeg_encode_close().
Seems to be a regression since 467d9e27e0cb2bf74f41dc832f2f8d191ba58ec9.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 84ac35ecb8a53bf313b468b5a9f1b0617f2a3de2)
| -rw-r--r-- | libavcodec/mjpegenc.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavcodec/mjpegenc.c b/libavcodec/mjpegenc.c index 22af094da7..4d7755cc88 100644 --- a/libavcodec/mjpegenc.c +++ b/libavcodec/mjpegenc.c @@ -312,8 +312,10 @@ av_cold int ff_mjpeg_encode_init(MpegEncContext *s) av_cold void ff_mjpeg_encode_close(MpegEncContext *s) { - av_freep(&s->mjpeg_ctx->huff_buffer); - av_freep(&s->mjpeg_ctx); + if (s->mjpeg_ctx) { + av_freep(&s->mjpeg_ctx->huff_buffer); + av_freep(&s->mjpeg_ctx); + } } /** |