lavfi: fix use-after-free in ff_filter_frame.
authorNicolas George <nicolas.george@normalesup.org>
Tue, 8 Jan 2013 11:46:13 +0000 (12:46 +0100)
committerNicolas George <nicolas.george@normalesup.org>
Tue, 8 Jan 2013 12:31:33 +0000 (13:31 +0100)
Unlike the original ff_start_frame code, the incoming reference
may be freed before that point.

Fix CID966654.

libavfilter/avfilter.c

index 4edd5be..8c06173 100644 (file)
@@ -706,7 +706,7 @@ static int ff_filter_frame_framed(AVFilterLink *link, AVFilterBufferRef *frame)
     } else
         out = frame;
 
-    while(cmd && cmd->time <= frame->pts * av_q2d(link->time_base)){
+    while(cmd && cmd->time <= out->pts * av_q2d(link->time_base)){
         av_log(link->dst, AV_LOG_DEBUG,
                "Processing command time:%f command:%s arg:%s\n",
                cmd->time, cmd->command, cmd->arg);