On 8/13/2021 2:48 PM, Michael Niedermayer wrote:
Fixes: MemLeak
Fixes: 8281
Fixes: PoC_option158.jpg
Fixes: CVE-2020-22037
Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
---
libavcodec/frame_thread_encoder.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/libavcodec/frame_thread_encoder.c
b/libavcodec/frame_thread_encoder.c
index 9cabfc495f..25a308173d 100644
--- a/libavcodec/frame_thread_encoder.c
+++ b/libavcodec/frame_thread_encoder.c
@@ -126,7 +126,7 @@ int ff_frame_thread_encoder_init(AVCodecContext *avctx)
{
int i=0;
ThreadContext *c;
-
+ AVCodecContext *thread_avctx = NULL;
if( !(avctx->thread_type & FF_THREAD_FRAME)
|| !(avctx->codec->capabilities & AV_CODEC_CAP_FRAME_THREADS))
@@ -202,16 +202,16 @@ int ff_frame_thread_encoder_init(AVCodecContext *avctx)
for(i=0; i<avctx->thread_count ; i++){
int ret;
void *tmpv;
- AVCodecContext *thread_avctx = avcodec_alloc_context3(avctx->codec);
+ thread_avctx = avcodec_alloc_context3(avctx->codec);
if(!thread_avctx)
goto fail;
tmpv = thread_avctx->priv_data;
*thread_avctx = *avctx;
+ thread_avctx->priv_data = tmpv;
+ thread_avctx->internal = NULL;
ret = av_opt_copy(thread_avctx, avctx);
if (ret < 0)
goto fail;
- thread_avctx->priv_data = tmpv;
- thread_avctx->internal = NULL;
if (avctx->codec->priv_class) {
int ret = av_opt_copy(thread_avctx->priv_data, avctx->priv_data);
if (ret < 0)
@@ -233,6 +233,8 @@ int ff_frame_thread_encoder_init(AVCodecContext *avctx)
return 0;
fail:
+ avcodec_close(thread_avctx);
+ av_freep(&thread_avctx);
avctx->thread_count = i;
av_log(avctx, AV_LOG_ERROR, "ff_frame_thread_encoder_init failed\n");
ff_frame_thread_encoder_free(avctx);
Should be ok.
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".