[FFmpeg-cvslog] avcodec/psd: Move frame allocation after RLE processing

[Michael Niedermayer]

ffmpeg | branch: release/6.1 | Michael Niedermayer <michael at niedermayer.cc> | Thu Jun 19 23:02:25 2025 +0200| [6bd4df16a63617a6c18b97b3c95ad2cd91630827] | committer: Michael Niedermayer

avcodec/psd: Move frame allocation after RLE processing

Fixes: Timeout
Fixes: 410609448/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PSD_fuzzer-6267226128973824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 67559760c6636b9c1643e4870bfe8c98244803d1)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6bd4df16a63617a6c18b97b3c95ad2cd91630827
---

 libavcodec/psd.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavcodec/psd.c b/libavcodec/psd.c
index d3456e6b3d..b82ff6b372 100644
--- a/libavcodec/psd.c
+++ b/libavcodec/psd.c
@@ -417,9 +417,6 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *picture,
 
     s->uncompressed_size = s->line_size * s->height * s->channel_count;
 
-    if ((ret = ff_get_buffer(avctx, picture, 0)) < 0)
-        return ret;
-
     /* decode picture if need */
     if (s->compression == PSD_RLE) {
         s->tmp = av_malloc(s->uncompressed_size);
@@ -442,6 +439,9 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *picture,
         ptr_data = s->gb.buffer;
     }
 
+    if ((ret = ff_get_buffer(avctx, picture, 0)) < 0)
+        return ret;
+
     /* Store data */
     if ((avctx->pix_fmt == AV_PIX_FMT_YA8)||(avctx->pix_fmt == AV_PIX_FMT_YA16BE)){/* Interleaved */
         ptr = picture->data[0];