avcodec/pthread_frame: check avctx on deallocation
authorMichael Niedermayer <michael@niedermayer.cc>
Mon, 13 Jul 2015 19:19:04 +0000 (21:19 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Mon, 13 Jul 2015 20:09:50 +0000 (22:09 +0200)
Fixes null pointer dereferences
Fixes: af1a5a33e67e479f439239097bd0d4fd_signal_sigsegv_7ffff713351a_152_Dolby_Rain_Logo.pmp with memlimit of 8388608

Found-by: Samuel GroƟ, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/pthread_frame.c

index a8789ae..df372e0 100644 (file)
@@ -583,7 +583,7 @@ void ff_frame_thread_free(AVCodecContext *avctx, int thread_count)
             pthread_join(p->thread, NULL);
         p->thread_init=0;
 
-        if (codec->close)
+        if (codec->close && p->avctx)
             codec->close(p->avctx);
 
         release_delayed_buffers(p);
@@ -601,12 +601,13 @@ void ff_frame_thread_free(AVCodecContext *avctx, int thread_count)
         av_packet_unref(&p->avpkt);
         av_freep(&p->released_buffers);
 
-        if (i) {
+        if (i && p->avctx) {
             av_freep(&p->avctx->priv_data);
             av_freep(&p->avctx->slice_offset);
         }
 
-        av_freep(&p->avctx->internal);
+        if (p->avctx)
+            av_freep(&p->avctx->internal);
         av_freep(&p->avctx);
     }