vp56: release frames on error

Fixes CVE-2012-2783 CC: libav-stable@libav.org
margro · Dec 14, 2012 · f33b5ba · f33b5ba
1 parent bb675d3
commit f33b5ba
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/libavcodec/vp56.c b/libavcodec/vp56.c
@@ -514,8 +514,14 @@ int ff_vp56_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
         s->modelp = &s->models[is_alpha];
 
         res = s->parse_header(s, buf, remaining_buf_size, &golden_frame);
-        if (res < 0)
+        if (res < 0) {
+            int i;
+            for (i = 0; i < 4; i++) {
+                if (s->frames[i].data[0])
+                    avctx->release_buffer(avctx, &s->frames[i]);
+            }
             return res;
+        }
 
         if (res == VP56_SIZE_CHANGE) {
             int i;