[FFmpeg-cvslog] avcodec/av1dec: reset the fragment on reading failure

[James Almer]

ffmpeg | branch: master | James Almer <jamrial at gmail.com> | Fri Jun  2 13:59:35 2023 -0300| [8c6b931f4ca08abdaff4896cb2707c38d8483d80] | committer: James Almer

avcodec/av1dec: reset the fragment on reading failure

Fixes: NULL pointer dereference
Fixes: 59359/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-6726080594313216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: James Almer <jamrial at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8c6b931f4ca08abdaff4896cb2707c38d8483d80
---

 libavcodec/av1dec.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libavcodec/av1dec.c b/libavcodec/av1dec.c
index 5cc5d87c64..d63e792113 100644
--- a/libavcodec/av1dec.c
+++ b/libavcodec/av1dec.c
@@ -1460,6 +1460,7 @@ static int av1_receive_frame(AVCodecContext *avctx, AVFrame *frame)
 
             ret = ff_cbs_read_packet(s->cbc, &s->current_obu, s->pkt);
             if (ret < 0) {
+                ff_cbs_fragment_reset(&s->current_obu);
                 av_packet_unref(s->pkt);
                 av_log(avctx, AV_LOG_ERROR, "Failed to read packet.\n");
                 return ret;