Skip to content

Commit

Permalink
webmdec: fix double free
Browse files Browse the repository at this point in the history
when no frames were decoded, for example due to a decoder initialization
failure, an orphan buffer pointer from webm_guess_framerate() via
webm_read_frame() would have been freed during cleanup

Change-Id: I6ea3defdd13dd75427f79c516e207b682391e4fa
  • Loading branch information
jzern committed Apr 19, 2022
1 parent 6ea4ef1 commit 665f6a3
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions webmdec.cc
Original file line number Diff line number Diff line change
Expand Up @@ -210,6 +210,8 @@ int webm_guess_framerate(struct WebmInputContext *webm_ctx,
vpx_ctx->framerate.denominator =
static_cast<int>(webm_ctx->timestamp_ns / 1000);
delete[] buffer;
// webm_ctx->buffer is assigned to the buffer pointer in webm_read_frame().
webm_ctx->buffer = nullptr;

get_first_cluster(webm_ctx);
webm_ctx->block = nullptr;
Expand Down

0 comments on commit 665f6a3

Please sign in to comment.