RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-23 07:42:51 +00:00
Code Issues Projects Releases Wiki Activity

avfilter/vf_unsharp: Don't dereference NULL

Browse Source 
The unsharp filter uses an array of arrays of uint32_t, each of which is
separately allocated. These arrays also need to freed separately; but
before doing so, one needs to check whether the array of arrays has
actually been allocated, otherwise one would dereference a NULL pointer.
This fixes #8408.

Furthermore, the array of arrays needs to be zero-initialized so that
no uninitialized pointer will be freed in case an allocation of one of
the individual arrays fails.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Andreas Rheinhardt 2019-12-01 10:56:26 +01:00 committed by Michael Niedermayer
parent 968c4cbf22
commit 710ab13693
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavfilter/vf_unsharp.c
View File

@ -218,7 +218,7 @@ static int init_filter_param(AVFilterContext *ctx, UnsharpFilterParam *fp, const
effect, effect_type, fp->msize_x, fp->msize_y, fp->amount / 65535.0); effect, effect_type, fp->msize_x, fp->msize_y, fp->amount / 65535.0);
fp->sr = av_malloc_array((MAX_MATRIX_SIZE - 1) * s->nb_threads, sizeof(uint32_t)); fp->sr = av_malloc_array((MAX_MATRIX_SIZE - 1) * s->nb_threads, sizeof(uint32_t));
fp->sc = av_malloc_array(2 * fp->steps_y * s->nb_threads, sizeof(uint32_t **)); fp->sc = av_mallocz_array(2 * fp->steps_y * s->nb_threads, sizeof(uint32_t *));
if (!fp->sr || !fp->sc) if (!fp->sr || !fp->sc)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
@ -258,9 +258,11 @@ static void free_filter_param(UnsharpFilterParam *fp, int nb_threads)
{ {
int z; int z;
for (z = 0; z < 2 * fp->steps_y * nb_threads; z++) if (fp->sc) {
av_freep(&fp->sc[z]); for (z = 0; z < 2 * fp->steps_y * nb_threads; z++)
av_freep(&fp->sc); av_freep(&fp->sc[z]);
av_freep(&fp->sc);
}
av_freep(&fp->sr); av_freep(&fp->sr);
} }