[libav-commits] vp56: release frames on error

Luca Barbato git at libav.org
Sat Jan 12 20:10:22 CET 2013


Module: libav
Branch: release/0.7
Commit: 7fd7950174f9f2935fbf5bf1435fd0dc37be5c61

Author:    Luca Barbato <lu_zero at gentoo.org>
Committer: Reinhard Tartler <siretart at tauware.de>
Date:      Fri Dec 14 09:55:04 2012 +0100

vp56: release frames on error

Fixes CVE-2012-2783

CC: libav-stable at libav.org

(cherry picked from commit f33b5ba63eee96c9d1c7f0e568169cb0c3694238)

Signed-off-by: Reinhard Tartler <siretart at tauware.de>

---

 libavcodec/vp56.c |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/libavcodec/vp56.c b/libavcodec/vp56.c
index 96f40a1..b06ea7a 100644
--- a/libavcodec/vp56.c
+++ b/libavcodec/vp56.c
@@ -511,8 +511,14 @@ int ff_vp56_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
         s->modelp = &s->models[is_alpha];
 
         res = s->parse_header(s, buf, remaining_buf_size, &golden_frame);
-        if (res < 0)
+        if (res < 0) {
+            int i;
+            for (i = 0; i < 4; i++) {
+                if (s->frames[i].data[0])
+                    avctx->release_buffer(avctx, &s->frames[i]);
+            }
             return res;
+        }
 
         if (res == VP56_SIZE_CHANGE) {
             int i;



More information about the libav-commits mailing list