Fixes: NULL pointer dereference Fixes: 59359/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-6726080594313216
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: James Almer <jamr...@gmail.com> --- libavcodec/cbs.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/libavcodec/cbs.c b/libavcodec/cbs.c index 504197e06d..ba134c1db2 100644 --- a/libavcodec/cbs.c +++ b/libavcodec/cbs.c @@ -249,8 +249,10 @@ static int cbs_read_data(CodedBitstreamContext *ctx, if (buf) { frag->data_ref = av_buffer_ref(buf); - if (!frag->data_ref) - return AVERROR(ENOMEM); + if (!frag->data_ref) { + err = AVERROR(ENOMEM); + goto end; + } frag->data = (uint8_t *)data; frag->data_size = size; @@ -258,14 +260,20 @@ static int cbs_read_data(CodedBitstreamContext *ctx, } else { err = cbs_fill_fragment_data(frag, data, size); if (err < 0) - return err; + goto end; } err = ctx->codec->split_fragment(ctx, frag, header); if (err < 0) - return err; + goto end; - return cbs_read_fragment_content(ctx, frag); + err = cbs_read_fragment_content(ctx, frag); + +end: + if (err < 0) + ff_cbs_fragment_reset(frag); + + return err; } int ff_cbs_read_extradata(CodedBitstreamContext *ctx, -- 2.40.1 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
