diff options
| author | Luca Barbato <lu_zero@gentoo.org> | 2012-12-14 12:55:04 +0400 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2012-12-14 16:21:59 +0400 |
| commit | f33b5ba63eee96c9d1c7f0e568169cb0c3694238 (patch) | |
| tree | 1f6b5b94af40f2269c5c04ed95acbdd03fd83bd8 /libavcodec/vp56.c | |
| parent | bb675d3ac6d722d5e117ae9042a996b55ca05b1d (diff) | |
vp56: release frames on error
Fixes CVE-2012-2783
CC: libav-stable@libav.org
Diffstat (limited to 'libavcodec/vp56.c')
| -rw-r--r-- | libavcodec/vp56.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/libavcodec/vp56.c b/libavcodec/vp56.c index 6779ffb6dc..5bd0a1abef 100644 --- a/libavcodec/vp56.c +++ b/libavcodec/vp56.c @@ -514,8 +514,14 @@ int ff_vp56_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, s->modelp = &s->models[is_alpha]; res = s->parse_header(s, buf, remaining_buf_size, &golden_frame); - if (res < 0) + if (res < 0) { + int i; + for (i = 0; i < 4; i++) { + if (s->frames[i].data[0]) + avctx->release_buffer(avctx, &s->frames[i]); + } return res; + } if (res == VP56_SIZE_CHANGE) { int i; |