LAV
/
FFmpeg
1
0
Fork 0
Code

avcodec/mpegvideo_dec: Don't zero context on init failure 

Up until now, ff_mpeg_update_thread_context() zeroes
the context to initialize on initialization failure.
This has been added in e1d7d4bd13.

Just as now, ff_mpeg_update_thread_context() simply
copied the src MpegEncContext over the dst MpegEncContext
to initialize it, but clear_context() was only added in
b160fc290c, so that cleaning up
on init failure was a minefield if performed.

It was not always performed, namely not before the first
allocation needed to be freed. In the fuzzer sample that
led to e1d7d4bd13, the call
to av_image_check_size() failed and before said commit,
the context contained lots of pointers from the src context,
leading to assert violations lateron.

Of course, the proper fix for this is resetting the pointers
(or even better, not copying them in the first place), so
this zeroing is unnecessary since commit
b160fc290c. It is also harmful,
because it makes initializing something only once during init
more complicated; See the h264chroma handling in the diff
for an example. Therefore it is removed.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This commit is contained in:
Andreas Rheinhardt 2023-10-01 18:23:23 +02:00
parent bc7de8b63c
commit d86f7603cf
1 changed files with 3 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libavcodec/mpegvideo_dec.c
View File

@ -76,6 +76,8 @@ int ff_mpeg_update_thread_context(AVCodecContext *dst,
int err;
memcpy(s, s1, sizeof(*s));
s->context_initialized = 0;
s->context_reinit = 0;
s->avctx = dst;
s->private_ctx = private_ctx;
s->bitstream_buffer = NULL;
@ -83,13 +85,8 @@ int ff_mpeg_update_thread_context(AVCodecContext *dst,
if (s1->context_initialized) {
ff_mpv_idct_init(s);
if ((err = ff_mpv_common_init(s)) < 0) {
memset(s, 0, sizeof(*s));
s->avctx = dst;
s->private_ctx = private_ctx;
memcpy(&s->h264chroma, &s1->h264chroma, sizeof(s->h264chroma));
if ((err = ff_mpv_common_init(s)) < 0)
return err;
}
}
}