Module: libav Branch: release/0.8 Commit: 211badf0689d3972c08790c6776d99a1b12cb935
Author: Luca Barbato <[email protected]> Committer: Reinhard Tartler <[email protected]> Date: Fri Dec 14 09:55:04 2012 +0100 vp56: release frames on error Fixes CVE-2012-2783 CC: [email protected] (cherry picked from commit f33b5ba63eee96c9d1c7f0e568169cb0c3694238) Signed-off-by: Reinhard Tartler <[email protected]> --- libavcodec/vp56.c | 8 +++++++- 1 files changed, 7 insertions(+), 1 deletions(-) diff --git a/libavcodec/vp56.c b/libavcodec/vp56.c index 0ad468c..7767461 100644 --- a/libavcodec/vp56.c +++ b/libavcodec/vp56.c @@ -513,8 +513,14 @@ int ff_vp56_decode_frame(AVCodecContext *avctx, void *data, int *data_size, s->modelp = &s->models[is_alpha]; res = s->parse_header(s, buf, remaining_buf_size, &golden_frame); - if (res < 0) + if (res < 0) { + int i; + for (i = 0; i < 4; i++) { + if (s->frames[i].data[0]) + avctx->release_buffer(avctx, &s->frames[i]); + } return res; + } if (res == VP56_SIZE_CHANGE) { int i; _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
