From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 13 Jul 2015 11:46:10 +0000 (+0200)
Subject: avcodec/alac: Clear pointers in allocate_buffers()
X-Git-Tag: archive/raspbian/6%11.12-1_deb8u9+rpi1^2~57
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=aa4c72377c4f6f53507dd0f1d98882be10f71851;p=libav.git

avcodec/alac: Clear pointers in allocate_buffers()

avcodec/alac: Clear pointers in allocate_buffers()

Fixes: 06a4edb39ad8a9883175f9bd428334a2_signal_sigsegv_7ffff713351a_706_mov__alac__ALAC_6ch.mov

Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Gbp-Pq: Name CVE-2015-6823.patch
---

diff --git a/libavcodec/alac.c b/libavcodec/alac.c
index 0d25adc..eaf7bf6 100644
--- a/libavcodec/alac.c
+++ b/libavcodec/alac.c
@@ -482,6 +482,12 @@ static int allocate_buffers(ALACContext *alac)
     int ch;
     int buf_size = alac->max_samples_per_frame * sizeof(int32_t);
 
+    for (ch = 0; ch < 2; ch++) {
+        alac->predict_error_buffer[ch]  = NULL;
+        alac->output_samples_buffer[ch] = NULL;
+        alac->extra_bits_buffer[ch]     = NULL;
+    }
+
     for (ch = 0; ch < FFMIN(alac->channels, 2); ch++) {
         FF_ALLOC_OR_GOTO(alac->avctx, alac->predict_error_buffer[ch],
                          buf_size, buf_alloc_fail);