From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 16 Jul 2015 07:52:33 +0000 (+0200)
Subject: avcodec/pthread_frame: clear priv_data, avoid stale pointer in error case
X-Git-Tag: archive/raspbian/6%11.12-1_deb8u6+rpi1^2~41
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=bac8e6d4bdeb59cbbbe3d42d4d7ad1fe6515ac46;p=libav.git

avcodec/pthread_frame: clear priv_data, avoid stale pointer in error case

avcodec/pthread_frame: clear priv_data, avoid stale pointer in error case

Fixes: b4b47bc2b3fb7ca710bfffe5aa969e37_signal_sigabrt_7ffff70eccc9_744_nc_sample2.avi with memlimit of 4194304

Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Gbp-Pq: Name CVE-2015-6825.patch
---

diff --git a/libavcodec/pthread_frame.c b/libavcodec/pthread_frame.c
index a658f3e..f1ec265 100644
--- a/libavcodec/pthread_frame.c
+++ b/libavcodec/pthread_frame.c
@@ -616,6 +616,7 @@ int ff_frame_thread_init(AVCodecContext *avctx)
 
         copy->internal = av_malloc(sizeof(AVCodecInternal));
         if (!copy->internal) {
+            copy->priv_data = NULL;
             err = AVERROR(ENOMEM);
             goto error;
         }