avcodec/snow: fix null pointer dereference in cleanup after allocation failure
authorMichael Niedermayer <michaelni@gmx.at>
Mon, 11 Aug 2014 13:36:22 +0000 (15:36 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Mon, 11 Aug 2014 13:45:42 +0000 (15:45 +0200)
Fixes: snowf.avi
Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9a162146ca6cc12ef7ad4a15164349482885962c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/snow.c

index 711d1a4..f7629c5 100644 (file)
@@ -713,7 +713,7 @@ av_cold void ff_snow_common_end(SnowContext *s)
     for(i=0; i<MAX_REF_FRAMES; i++){
         av_freep(&s->ref_mvs[i]);
         av_freep(&s->ref_scores[i]);
     for(i=0; i<MAX_REF_FRAMES; i++){
         av_freep(&s->ref_mvs[i]);
         av_freep(&s->ref_scores[i]);
-        if(s->last_picture[i]->data[0]) {
+        if(s->last_picture[i] && s->last_picture[i]->data[0]) {
             av_assert0(s->last_picture[i]->data[0] != s->current_picture->data[0]);
         }
         av_frame_free(&s->last_picture[i]);
             av_assert0(s->last_picture[i]->data[0] != s->current_picture->data[0]);
         }
         av_frame_free(&s->last_picture[i]);