[FFmpeg-devel] [PATCH] avcodec/vp9: fix leaked cbs fragment AVBufferRef (PR #20205)

[Leo Izen]

PR #20205 opened by Leo Izen (Traneptora)
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20205
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20205.patch

When this function returns, the fragment is never reset, so
current_frag->data_ref is never unref-ed, which ends up leaking it.
We call ff_cbs_reset_fragment to release the reference on its buffer.

Signed-off-by: Leo Izen <leo.izen at gmail.com>


From 8e15de6ceaa3c4599f6b47db68f478aa10299195 Mon Sep 17 00:00:00 2001
From: Leo Izen <leo.izen at gmail.com>
Date: Sat, 9 Aug 2025 22:41:22 -0400
Subject: [PATCH] avcodec/vp9: fix leaked cbs fragment AVBufferRef

When this function returns, the fragment is never reset, so
current_frag->data_ref is never unref-ed, which ends up leaking it.
We call ff_cbs_reset_fragment to release the reference on its buffer.

Signed-off-by: Leo Izen <leo.izen at gmail.com>
---
 libavcodec/vp9.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/vp9.c b/libavcodec/vp9.c
index 47fabf98e3..d0d0238c2c 100644
--- a/libavcodec/vp9.c
+++ b/libavcodec/vp9.c
@@ -1679,8 +1679,6 @@ static int vp9_decode_frame(AVCodecContext *avctx, AVFrame *frame,
                                   &s->s.frames[CUR_FRAME] : &s->s.ref_frames[i]);
         }
 
-        ff_cbs_fragment_reset(&s->current_frag);
-
         goto finish;
     }
 
@@ -1805,6 +1803,8 @@ static int vp9_decode_frame(AVCodecContext *avctx, AVFrame *frame,
     }
 
 finish:
+    ff_cbs_fragment_reset(&s->current_frag);
+
     ff_progress_frame_report(&s->s.frames[CUR_FRAME].tf, INT_MAX);
     // ref frame setup
     for (int i = 0; i < 8; i++)
-- 
2.49.1