Commit 4f8f4458 authored by Luca Barbato's avatar Luca Barbato Committed by Reinhard Tartler

vp56: release frames on error

Fixes CVE-2012-2783

CC: libav-stable@libav.org

(cherry picked from commit f33b5ba6)
Signed-off-by: 's avatarReinhard Tartler <siretart@tauware.de>
(cherry picked from commit 7fd79501)

Conflicts:

	libavcodec/vp56.c
parent 9def5c46
......@@ -516,8 +516,14 @@ int vp56_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
s->modelp = &s->models[is_alpha];
res = s->parse_header(s, buf, remaining_buf_size, &golden_frame);
if (!res)
return -1;
if (!res) {
int i;
for (i = 0; i < 4; i++) {
if (s->frames[i].data[0])
avctx->release_buffer(avctx, &s->frames[i]);
}
return res;
}
if (!is_alpha) {
p->reference = 1;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment