Commit 60a45713 authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/interplayvideo: Check ff_get_buffer() for failure

Fixes: runtime error: division by zero
Fixes: 2408/clusterfuzz-testcase-minimized-5432734438653952
Fixes: 2415/clusterfuzz-testcase-minimized-4672827619803136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 0b180d20
......@@ -1155,6 +1155,7 @@ static void ipvideo_decode_format_11_opcodes(IpvideoContext *s, AVFrame *frame)
static av_cold int ipvideo_decode_init(AVCodecContext *avctx)
{
IpvideoContext *s = avctx->priv_data;
int ret;
s->avctx = avctx;
......@@ -1169,11 +1170,8 @@ static av_cold int ipvideo_decode_init(AVCodecContext *avctx)
s->prev_decode_frame = av_frame_alloc();
if (!s->last_frame || !s->second_last_frame ||
!s->cur_decode_frame || !s->prev_decode_frame) {
av_frame_free(&s->last_frame);
av_frame_free(&s->second_last_frame);
av_frame_free(&s->cur_decode_frame);
av_frame_free(&s->prev_decode_frame);
return AVERROR(ENOMEM);
ret = AVERROR(ENOMEM);
goto error;
}
s->cur_decode_frame->width = avctx->width;
......@@ -1183,10 +1181,21 @@ static av_cold int ipvideo_decode_init(AVCodecContext *avctx)
s->cur_decode_frame->format = avctx->pix_fmt;
s->prev_decode_frame->format = avctx->pix_fmt;
ff_get_buffer(avctx, s->cur_decode_frame, 0);
ff_get_buffer(avctx, s->prev_decode_frame, 0);
ret = ff_get_buffer(avctx, s->cur_decode_frame, 0);
if (ret < 0)
goto error;
ret = ff_get_buffer(avctx, s->prev_decode_frame, 0);
if (ret < 0)
goto error;
return 0;
error:
av_frame_free(&s->last_frame);
av_frame_free(&s->second_last_frame);
av_frame_free(&s->cur_decode_frame);
av_frame_free(&s->prev_decode_frame);
return ret;
}
static int ipvideo_decode_frame(AVCodecContext *avctx,
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment