vp56dec: avoid freeing the returned frame before returning it.
authorMichael Niedermayer <michaelni@gmx.at>
Sat, 24 Mar 2012 04:21:39 +0000 (05:21 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 24 Mar 2012 04:21:39 +0000 (05:21 +0100)
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/vp56.c

index 63b844e..c6e32af 100644 (file)
@@ -621,7 +621,7 @@ int ff_vp56_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
 
     next:
         if (p->key_frame || golden_frame) {
-            if (s->framep[VP56_FRAME_GOLDEN]->data[0] &&
+            if (s->framep[VP56_FRAME_GOLDEN]->data[0] && s->framep[VP56_FRAME_GOLDEN] != p &&
                 s->framep[VP56_FRAME_GOLDEN] != s->framep[VP56_FRAME_GOLDEN2])
                 avctx->release_buffer(avctx, s->framep[VP56_FRAME_GOLDEN]);
             s->framep[VP56_FRAME_GOLDEN] = p;