highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/interplayvideo: Check ff_get_buffer() for failure

Browse Source 
Fixes: runtime error: division by zero
Fixes: 2408/clusterfuzz-testcase-minimized-5432734438653952
Fixes: 2415/clusterfuzz-testcase-minimized-4672827619803136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-06-30 03:31:54 +02:00
parent 0b180d2066
commit 60a45713e7
1 changed files with 16 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
libavcodec/interplayvideo.c
View File

@ -1155,6 +1155,7 @@ static void ipvideo_decode_format_11_opcodes(IpvideoContext *s, AVFrame *frame)
static av_cold int ipvideo_decode_init(AVCodecContext *avctx)
{
IpvideoContext *s = avctx->priv_data;
int ret;
s->avctx = avctx;
@ -1169,11 +1170,8 @@ static av_cold int ipvideo_decode_init(AVCodecContext *avctx)
s->prev_decode_frame = av_frame_alloc();
if (!s->last_frame || !s->second_last_frame ||
!s->cur_decode_frame || !s->prev_decode_frame) {
av_frame_free(&s->last_frame);
av_frame_free(&s->second_last_frame);
av_frame_free(&s->cur_decode_frame);
av_frame_free(&s->prev_decode_frame);
return AVERROR(ENOMEM);
ret = AVERROR(ENOMEM);
goto error;
}
s->cur_decode_frame->width = avctx->width;
@ -1183,10 +1181,21 @@ static av_cold int ipvideo_decode_init(AVCodecContext *avctx)
s->cur_decode_frame->format = avctx->pix_fmt;
s->prev_decode_frame->format = avctx->pix_fmt;
ff_get_buffer(avctx, s->cur_decode_frame, 0);
ff_get_buffer(avctx, s->prev_decode_frame, 0);
ret = ff_get_buffer(avctx, s->cur_decode_frame, 0);
if (ret < 0)
goto error;
ret = ff_get_buffer(avctx, s->prev_decode_frame, 0);
if (ret < 0)
goto error;
return 0;
error:
av_frame_free(&s->last_frame);
av_frame_free(&s->second_last_frame);
av_frame_free(&s->cur_decode_frame);
av_frame_free(&s->prev_decode_frame);
return ret;
}
static int ipvideo_decode_frame(AVCodecContext *avctx,