[FFmpeg-devel] [PATCH] avcodec/cbs: reset the fragment on reading failure

[James Almer]

Fixes: NULL pointer dereference
Fixes: 59359/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-6726080594313216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: James Almer <jamrial at gmail.com>
---
 libavcodec/cbs.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/libavcodec/cbs.c b/libavcodec/cbs.c
index 504197e06d..ba134c1db2 100644
--- a/libavcodec/cbs.c
+++ b/libavcodec/cbs.c
@@ -249,8 +249,10 @@ static int cbs_read_data(CodedBitstreamContext *ctx,
 
     if (buf) {
         frag->data_ref = av_buffer_ref(buf);
-        if (!frag->data_ref)
-            return AVERROR(ENOMEM);
+        if (!frag->data_ref) {
+            err = AVERROR(ENOMEM);
+            goto end;
+        }
 
         frag->data      = (uint8_t *)data;
         frag->data_size = size;
@@ -258,14 +260,20 @@ static int cbs_read_data(CodedBitstreamContext *ctx,
     } else {
         err = cbs_fill_fragment_data(frag, data, size);
         if (err < 0)
-            return err;
+            goto end;
     }
 
     err = ctx->codec->split_fragment(ctx, frag, header);
     if (err < 0)
-        return err;
+        goto end;
 
-    return cbs_read_fragment_content(ctx, frag);
+    err = cbs_read_fragment_content(ctx, frag);
+
+end:
+    if (err < 0)
+        ff_cbs_fragment_reset(frag);
+
+    return err;
 }
 
 int ff_cbs_read_extradata(CodedBitstreamContext *ctx,
-- 
2.40.1