PR #24510 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24510
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24510.patch

Fixes: use after free
Fixes: 6f1DsDI0TxJu
Found-by: Zheng Yu @ Depthfirst



>From 3ea04939561e2e43dceb9139fa57e860e85b1dc8 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Tue, 15 Sep 2026 06:13:53 +0200
Subject: [PATCH] avcodec/h274: free the big endian pixel buffer before the
 context that holds it

Fixes: use after free
Fixes: 6f1DsDI0TxJu
Found-by: Zheng Yu @ Depthfirst
---
 libavcodec/h274.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/h274.c b/libavcodec/h274.c
index 93ad2d1014..e82e31489e 100644
--- a/libavcodec/h274.c
+++ b/libavcodec/h274.c
@@ -919,10 +919,10 @@ void ff_h274_hash_freep(H274HashContext **ctx)
         H274HashContext *c = *ctx;
         if (c->ctx)
             av_free(c->ctx);
-        av_freep(ctx);
 #if HAVE_BIGENDIAN
         av_freep(&c->buf);
 #endif
+        av_freep(ctx);
     }
 }
 
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to