aboutsummaryrefslogtreecommitdiffstats
path: root/libavutil/frame.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2017-02-23 15:19:31 +0100
committerMichael Niedermayer <michael@niedermayer.cc>2017-02-25 22:02:23 +0100
commit5804201cbac2de8824013a8294e381e93bbe45f2 (patch)
treeb20994ea09617767524c9ea93b1a582c0b9ea81b /libavutil/frame.c
parent58f3469cc6df323ce82456e97cf584cbe70d6895 (diff)
downloadffmpeg-5804201cbac2de8824013a8294e381e93bbe45f2.tar.gz
avutil/frame: Reimplement av_frame_new_side_data() without size=0 special case
The size 0 special case causes side data to be created which is different and a special case if for any reasons size = 0 is passed Fixes: multiple runtime error: null pointer passed as argument 1, which is declared to never be null Fixes: 653/clusterfuzz-testcase-5773837415219200 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavutil/frame.c')
-rw-r--r--libavutil/frame.c55
1 files changed, 29 insertions, 26 deletions
diff --git a/libavutil/frame.c b/libavutil/frame.c
index 2913982e91..8811dcdcfe 100644
--- a/libavutil/frame.c
+++ b/libavutil/frame.c
@@ -26,6 +26,11 @@
#include "mem.h"
#include "samplefmt.h"
+
+static AVFrameSideData *frame_new_side_data(AVFrame *frame,
+ enum AVFrameSideDataType type,
+ AVBufferRef *buf);
+
MAKE_ACCESSORS(AVFrame, frame, int64_t, best_effort_timestamp)
MAKE_ACCESSORS(AVFrame, frame, int64_t, pkt_duration)
MAKE_ACCESSORS(AVFrame, frame, int64_t, pkt_pos)
@@ -344,20 +349,11 @@ FF_ENABLE_DEPRECATION_WARNINGS
}
memcpy(sd_dst->data, sd_src->data, sd_src->size);
} else {
- sd_dst = av_frame_new_side_data(dst, sd_src->type, 0);
+ sd_dst = frame_new_side_data(dst, sd_src->type, av_buffer_ref(sd_src->buf));
if (!sd_dst) {
wipe_side_data(dst);
return AVERROR(ENOMEM);
}
- if (sd_src->buf) {
- sd_dst->buf = av_buffer_ref(sd_src->buf);
- if (!sd_dst->buf) {
- wipe_side_data(dst);
- return AVERROR(ENOMEM);
- }
- sd_dst->data = sd_dst->buf->data;
- sd_dst->size = sd_dst->buf->size;
- }
}
av_dict_copy(&sd_dst->metadata, sd_src->metadata, 0);
}
@@ -633,40 +629,47 @@ AVBufferRef *av_frame_get_plane_buffer(AVFrame *frame, int plane)
return NULL;
}
-AVFrameSideData *av_frame_new_side_data(AVFrame *frame,
- enum AVFrameSideDataType type,
- int size)
+static AVFrameSideData *frame_new_side_data(AVFrame *frame,
+ enum AVFrameSideDataType type,
+ AVBufferRef *buf)
{
AVFrameSideData *ret, **tmp;
- if (frame->nb_side_data > INT_MAX / sizeof(*frame->side_data) - 1)
+ if (!buf)
return NULL;
+ if (frame->nb_side_data > INT_MAX / sizeof(*frame->side_data) - 1)
+ goto fail;
+
tmp = av_realloc(frame->side_data,
(frame->nb_side_data + 1) * sizeof(*frame->side_data));
if (!tmp)
- return NULL;
+ goto fail;
frame->side_data = tmp;
ret = av_mallocz(sizeof(*ret));
if (!ret)
- return NULL;
-
- if (size > 0) {
- ret->buf = av_buffer_alloc(size);
- if (!ret->buf) {
- av_freep(&ret);
- return NULL;
- }
+ goto fail;
- ret->data = ret->buf->data;
- ret->size = size;
- }
+ ret->buf = buf;
+ ret->data = ret->buf->data;
+ ret->size = buf->size;
ret->type = type;
frame->side_data[frame->nb_side_data++] = ret;
return ret;
+fail:
+ av_buffer_unref(&buf);
+ return NULL;
+}
+
+AVFrameSideData *av_frame_new_side_data(AVFrame *frame,
+ enum AVFrameSideDataType type,
+ int size)
+{
+
+ return frame_new_side_data(frame, type, av_buffer_alloc(size));
}
AVFrameSideData *av_frame_get_side_data(const AVFrame *frame,