On 8/13/2021 2:48 PM, Michael Niedermayer wrote:
Fixes: MemLeak Fixes: 8281 Fixes: PoC_option158.jpg Fixes: CVE-2020-22037Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> --- libavcodec/frame_thread_encoder.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/libavcodec/frame_thread_encoder.c b/libavcodec/frame_thread_encoder.c index 9cabfc495f..25a308173d 100644 --- a/libavcodec/frame_thread_encoder.c +++ b/libavcodec/frame_thread_encoder.c @@ -126,7 +126,7 @@ int ff_frame_thread_encoder_init(AVCodecContext *avctx) { int i=0; ThreadContext *c; - + AVCodecContext *thread_avctx = NULL;if( !(avctx->thread_type & FF_THREAD_FRAME)|| !(avctx->codec->capabilities & AV_CODEC_CAP_FRAME_THREADS)) @@ -202,16 +202,16 @@ int ff_frame_thread_encoder_init(AVCodecContext *avctx) for(i=0; i<avctx->thread_count ; i++){ int ret; void *tmpv; - AVCodecContext *thread_avctx = avcodec_alloc_context3(avctx->codec); + thread_avctx = avcodec_alloc_context3(avctx->codec); if(!thread_avctx) goto fail; tmpv = thread_avctx->priv_data; *thread_avctx = *avctx; + thread_avctx->priv_data = tmpv; + thread_avctx->internal = NULL; ret = av_opt_copy(thread_avctx, avctx); if (ret < 0) goto fail; - thread_avctx->priv_data = tmpv; - thread_avctx->internal = NULL; if (avctx->codec->priv_class) { int ret = av_opt_copy(thread_avctx->priv_data, avctx->priv_data); if (ret < 0) @@ -233,6 +233,8 @@ int ff_frame_thread_encoder_init(AVCodecContext *avctx)return 0;fail: + avcodec_close(thread_avctx); + av_freep(&thread_avctx); avctx->thread_count = i; av_log(avctx, AV_LOG_ERROR, "ff_frame_thread_encoder_init failed\n"); ff_frame_thread_encoder_free(avctx);
Should be ok. _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
