avcodec/pthread_frame: clear priv_data, avoid stale pointer in error case

avcodec/pthread_frame: clear priv_data, avoid stale pointer in error case

Fixes: b4b47bc2b3fb7ca710bfffe5aa969e37_signal_sigabrt_7ffff70eccc9_744_nc_sample2.avi with memlimit of 4194304
Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-6825.patch

diff --git a/libavcodec/pthread_frame.c b/libavcodec/pthread_frame.c
index a658f3eb7b3e8113f7e20e14a8bba853bbb13b7e..f1ec265ecadeaed9fbb633b15e32094e97d3115b 100644 (file)
--- a/libavcodec/pthread_frame.c
+++ b/libavcodec/pthread_frame.c
@@ -616,6 +616,7 @@ int ff_frame_thread_init(AVCodecContext *avctx)
 
         copy->internal = av_malloc(sizeof(AVCodecInternal));
         if (!copy->internal) {
+            copy->priv_data = NULL;
             err = AVERROR(ENOMEM);
             goto error;
         }