If allocation fails earlier on, and thd next frame is processed,
the slice buffer could be left in a state where line and data_stack
have already been freed, or are otherwise null pointers.
Signed-off-by: Derek Buitenhuis derek.buitenh...@gmail.com
---
libavcodec/snow_dwt.c | 9 +++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/libavcodec/snow_dwt.c b/libavcodec/snow_dwt.c
index 5b890e0..986a6b9 100644
--- a/libavcodec/snow_dwt.c
+++ b/libavcodec/snow_dwt.c
@@ -91,6 +91,10 @@ void ff_slice_buffer_release(slice_buffer *buf, int line)
void ff_slice_buffer_flush(slice_buffer *buf)
{
int i;
+
+if (!buf-line)
+return;
+
for (i = 0; i buf-line_count; i++)
if (buf-line[i])
ff_slice_buffer_release(buf, i);
@@ -101,8 +105,9 @@ void ff_slice_buffer_destroy(slice_buffer *buf)
int i;
ff_slice_buffer_flush(buf);
-for (i = buf-data_count - 1; i = 0; i--)
-av_freep(buf-data_stack[i]);
+if (buf-data_stack)
+for (i = buf-data_count - 1; i = 0; i--)
+av_freep(buf-data_stack[i]);
av_freep(buf-data_stack);
av_freep(buf-line);
}
--
2.1.3
___
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
