RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-28 02:12:28 +00:00
Code Issues Projects Releases Wiki Activity

avcodec/vlc: Attempt to free buf after use in ff_vlc_init_multi_from_lengths()

Browse Source 
Fixes: use after free
Fixes: 62153/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_fuzzer-4702814909366272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2023-09-14 01:47:33 +02:00 committed by Paul B Mahol
parent 8d5db120c2
commit 2e04d35c69
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/vlc.c
View File

@ -471,10 +471,13 @@ int ff_vlc_init_multi_from_lengths(VLC *vlc, VLC_MULTI *multi, int nb_bits, int
goto fail;
}
}
ret = vlc_common_end(vlc, nb_bits, j, buf, flags, localbuf);
ret = vlc_common_end(vlc, nb_bits, j, buf, flags, buf);
if (ret < 0)
goto fail;
return vlc_multi_gen(multi->table, vlc, nb_elems, j, nb_bits, buf, logctx);
ret = vlc_multi_gen(multi->table, vlc, nb_elems, j, nb_bits, buf, logctx);
if (buf != localbuf)
av_free(buf);
return ret;
fail:
if (buf != localbuf)
av_free(buf);