diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-05-10 01:18:12 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-05-10 01:40:24 +0200 |
| commit | 500220a8e84acb952e8a62d88505c5fb6a51843a (patch) | |
| tree | 33dbd1fbfee289c852570c73ddd927b0f3a5f8f1 /libavcodec/mimic.c | |
| parent | 8ef453ff830b40f635b94099d1debad3d809847f (diff) | |
mimic: Fix race condition
Fixes access after free.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/mimic.c')
| -rw-r--r-- | libavcodec/mimic.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/mimic.c b/libavcodec/mimic.c index 8985f6b470..e2c9369860 100644 --- a/libavcodec/mimic.c +++ b/libavcodec/mimic.c @@ -175,7 +175,7 @@ static int mimic_decode_update_thread_context(AVCodecContext *avctx, const AVCod for (i = 0; i < FF_ARRAY_ELEMS(dst->frames); i++) { ff_thread_release_buffer(avctx, &dst->frames[i]); - if (src->frames[i].f->data[0]) { + if (i != src->next_cur_index && src->frames[i].f->data[0]) { ret = ff_thread_ref_frame(&dst->frames[i], &src->frames[i]); if (ret < 0) return ret; |