pngdec: do not release buffer on failure instead report full progress
authorPaul B Mahol <onemda@gmail.com>
Fri, 23 Aug 2013 18:55:55 +0000 (18:55 +0000)
committerPaul B Mahol <onemda@gmail.com>
Fri, 23 Aug 2013 21:08:32 +0000 (21:08 +0000)
Should fix heap-use-after-free as reported by Address Sanitizer.

Signed-off-by: Paul B Mahol <onemda@gmail.com>
libavcodec/pngdec.c

index c8897b9..436e798 100644 (file)
@@ -868,8 +868,8 @@ static int decode_frame(AVCodecContext *avctx,
     return ret;
  fail:
     av_dict_free(&metadata);
+    ff_thread_report_progress(&s->picture, INT_MAX, 0);
     ret = AVERROR_INVALIDDATA;
-    ff_thread_release_buffer(avctx, &s->picture);
     goto the_end;
 }