diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-06-30 03:31:54 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-06-30 03:34:58 +0200 |
| commit | 60a45713e7bc94b079f8cd39cfaa300e9c381f62 (patch) | |
| tree | e1bab712676c7e94abf988886de084cbf940bf97 /libavcodec | |
| parent | 0b180d2066edd2e550069fab7dc254f26003baa8 (diff) | |
| download | ffmpeg-60a45713e7bc94b079f8cd39cfaa300e9c381f62.tar.gz | |
avcodec/interplayvideo: Check ff_get_buffer() for failure
Fixes: runtime error: division by zero
Fixes: 2408/clusterfuzz-testcase-minimized-5432734438653952
Fixes: 2415/clusterfuzz-testcase-minimized-4672827619803136
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/interplayvideo.c | 23 |
1 files changed, 16 insertions, 7 deletions
diff --git a/libavcodec/interplayvideo.c b/libavcodec/interplayvideo.c index 56ce38b042..d6f484aa09 100644 --- a/libavcodec/interplayvideo.c +++ b/libavcodec/interplayvideo.c @@ -1155,6 +1155,7 @@ static void ipvideo_decode_format_11_opcodes(IpvideoContext *s, AVFrame *frame) static av_cold int ipvideo_decode_init(AVCodecContext *avctx) { IpvideoContext *s = avctx->priv_data; + int ret; s->avctx = avctx; @@ -1169,11 +1170,8 @@ static av_cold int ipvideo_decode_init(AVCodecContext *avctx) s->prev_decode_frame = av_frame_alloc(); if (!s->last_frame || !s->second_last_frame || !s->cur_decode_frame || !s->prev_decode_frame) { - av_frame_free(&s->last_frame); - av_frame_free(&s->second_last_frame); - av_frame_free(&s->cur_decode_frame); - av_frame_free(&s->prev_decode_frame); - return AVERROR(ENOMEM); + ret = AVERROR(ENOMEM); + goto error; } s->cur_decode_frame->width = avctx->width; @@ -1183,10 +1181,21 @@ static av_cold int ipvideo_decode_init(AVCodecContext *avctx) s->cur_decode_frame->format = avctx->pix_fmt; s->prev_decode_frame->format = avctx->pix_fmt; - ff_get_buffer(avctx, s->cur_decode_frame, 0); - ff_get_buffer(avctx, s->prev_decode_frame, 0); + ret = ff_get_buffer(avctx, s->cur_decode_frame, 0); + if (ret < 0) + goto error; + + ret = ff_get_buffer(avctx, s->prev_decode_frame, 0); + if (ret < 0) + goto error; return 0; +error: + av_frame_free(&s->last_frame); + av_frame_free(&s->second_last_frame); + av_frame_free(&s->cur_decode_frame); + av_frame_free(&s->prev_decode_frame); + return ret; } static int ipvideo_decode_frame(AVCodecContext *avctx, |