From a53700e4a3820ad929e2b8c79d10e46abef62575 Mon Sep 17 00:00:00 2001 From: James Zern Date: Mon, 26 Jun 2023 19:06:51 -0700 Subject: [PATCH] vp9_alloccommon: clear allocation sizes on free This fixes reallocations (and avoids potential crashes) if any allocations fails and the application continues to call vpx_codec_decode(). Found with vpx_dec_fuzzer_vp9 & Nallocfuzz (https://github.com/catenacyber/nallocfuzz). Bug: webm:1807 Change-Id: If5dc96b73c02efc94ec84c25eb50d10ad6b645a6 (cherry picked from commit 02ab555e992c191e5c509ed87b3cc48ed915b447) --- vp9/common/vp9_alloccommon.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/vp9/common/vp9_alloccommon.c b/vp9/common/vp9_alloccommon.c index faad657..e53883f 100644 --- a/vp9/common/vp9_alloccommon.c +++ b/vp9/common/vp9_alloccommon.c @@ -65,6 +65,7 @@ static void free_seg_map(VP9_COMMON *cm) { vpx_free(cm->seg_map_array[i]); cm->seg_map_array[i] = NULL; } + cm->seg_map_alloc_size = 0; cm->current_frame_seg_map = NULL; cm->last_frame_seg_map = NULL; @@ -108,6 +109,7 @@ void vp9_free_context_buffers(VP9_COMMON *cm) { cm->above_context = NULL; vpx_free(cm->above_seg_context); cm->above_seg_context = NULL; + cm->above_context_alloc_cols = 0; vpx_free(cm->lf.lfm); cm->lf.lfm = NULL; } -- 2.7.4