diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-12-31 15:18:47 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-01-08 00:23:49 +0100 |
| commit | 69aa3d5b88ecb1e57d1d1f508f1f141514bc7526 (patch) | |
| tree | 3b0cf343d21c8dfa0672756eb50775709c7ad20b /libavcodec/hevc.c | |
| parent | dcecca07585fce8716bdf73dab034a05dadb58cb (diff) | |
| download | android_external_ffmpeg-69aa3d5b88ecb1e57d1d1f508f1f141514bc7526.tar.gz android_external_ffmpeg-69aa3d5b88ecb1e57d1d1f508f1f141514bc7526.tar.bz2 android_external_ffmpeg-69aa3d5b88ecb1e57d1d1f508f1f141514bc7526.zip | |
avcodec/hevc: clear HEVClc when its deallocated in hevc_decode_free()
Fixes reading freed memory
Fixes: asan_heap-uaf_1abf8ef_3987_NUT_A_ericsson_4.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 21a2fb7e0579703fdea96f659498ef8b1f243289)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/hevc.c')
| -rw-r--r-- | libavcodec/hevc.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/hevc.c b/libavcodec/hevc.c index 2f7c5b6df1..a16b045a35 100644 --- a/libavcodec/hevc.c +++ b/libavcodec/hevc.c @@ -2624,6 +2624,8 @@ static av_cold int hevc_decode_free(AVCodecContext *avctx) av_freep(&s->sList[i]); } } + if (s->HEVClc == s->HEVClcList[0]) + s->HEVClc = NULL; av_freep(&s->HEVClcList[0]); for (i = 0; i < s->nals_allocated; i++) |