diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2015-11-28 00:23:54 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2015-11-28 00:25:08 +0100 |
| commit | 6105b7219a90438deae71b0dc5a034c71ee30fc0 (patch) | |
| tree | 806f8aa904ee55927e6bed7b403d4746e73f1bbf | |
| parent | d85aa76115214183e7e3b7d65e950da61474959a (diff) | |
| download | ffmpeg-6105b7219a90438deae71b0dc5a034c71ee30fc0.tar.gz | |
avcodec/vp3: Clear context on reinitialization failure
Fixes null pointer dereference
Fixes: 1536b9b096a8f95b742bae9d3d761cc6/signal_sigsegv_294aaed_2039_8d1797aeb823ea43858d0fa45c9eb899.ogv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/vp3.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c index 1e5547443f..28f0569d55 100644 --- a/libavcodec/vp3.c +++ b/libavcodec/vp3.c @@ -2018,17 +2018,19 @@ static int vp3_decode_frame(AVCodecContext *avctx, vp3_decode_end(avctx); ret = theora_decode_header(avctx, &gb); + if (ret >= 0) + ret = vp3_decode_init(avctx); if (ret < 0) { vp3_decode_end(avctx); - } else - ret = vp3_decode_init(avctx); + } return ret; } else if (type == 2) { ret = theora_decode_tables(avctx, &gb); + if (ret >= 0) + ret = vp3_decode_init(avctx); if (ret < 0) { vp3_decode_end(avctx); - } else - ret = vp3_decode_init(avctx); + } return ret; } |