File ffmpeg-CVE-2024-31578.patch of Package ffmpeg-4.34059
commit 3bb00c0a420c3ce83c6fafee30270d69622ccad7 (20240220_CVE-2024-31578_3bb00c0a420c3ce83c6fafee30270d69622ccad7)
Author: Zhao Zhili <quinkblack@foxmail.com>
Date: Tue Feb 20 20:08:55 2024 +0800
avutil/hwcontext: Don't assume frames_uninit is reentrant
Fix heap use after free when vulkan_frames_init failed.
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
diff -Nura ffmpeg-4.4/libavutil/hwcontext.c ffmpeg-4.4_new/libavutil/hwcontext.c
--- ffmpeg-4.4/libavutil/hwcontext.c 2020-07-11 18:39:30.000000000 +0800
+++ ffmpeg-4.4_new/libavutil/hwcontext.c 2024-04-23 01:11:42.412338443 +0800
@@ -362,7 +362,7 @@
if (ctx->internal->hw_type->frames_init) {
ret = ctx->internal->hw_type->frames_init(ctx);
if (ret < 0)
- goto fail;
+ return ret;
}
if (ctx->internal->pool_internal && !ctx->pool)
@@ -372,14 +372,10 @@
if (ctx->initial_pool_size > 0) {
ret = hwframe_pool_prealloc(ref);
if (ret < 0)
- goto fail;
+ return ret;
}
return 0;
-fail:
- if (ctx->internal->hw_type->frames_uninit)
- ctx->internal->hw_type->frames_uninit(ctx);
- return ret;
}
int av_hwframe_transfer_get_formats(AVBufferRef *hwframe_ref,