utils: fix avcodec_flush_buffers pre-reference counting compatibility

The to_free AVframe must be freed just like the other ones.
Indeed, the calling application may expect all frames to be
released.

(This regression caused use-after-free in VLC with hwaccel.)

Signed-off-by: Rémi Denis-Courmont <remi@remlab.net>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

diff --git a/libavcodec/utils.c b/libavcodec/utils.c
index accb6b3..3dddafc 100644 (file)
--- a/libavcodec/utils.c
+++ b/libavcodec/utils.c
@@ -1804,6 +1804,9 @@ void avcodec_flush_buffers(AVCodecContext *avctx)
         ff_thread_flush(avctx);
     else if (avctx->codec->flush)
         avctx->codec->flush(avctx);
+
+    if (!avctx->refcounted_frames)
+        av_frame_unref(&avctx->internal->to_free);
 }
 
 int av_get_exact_bits_per_sample(enum AVCodecID codec_id)