[FFmpeg-devel] [PATCH] avformat/demux: Fix segfault due to avcodec_open2 failure

[Pavel Koshevoy]

On Mon, Jun 9, 2025 at 8:58 PM Andreas Rheinhardt <
andreas.rheinhardt at outlook.com> wrote:

> Pavel Koshevoy:
> > Fixes 'ffprobe 1_poc.mp4' segfault introduced with
> > commit 0021484d05f9b0f032fa319399de6e24eea0c04f
> > ---
> >  libavformat/demux.c | 10 ++++++++--
> >  1 file changed, 8 insertions(+), 2 deletions(-)
> >
> > diff --git a/libavformat/demux.c b/libavformat/demux.c
> > index ecd4f40da9..d74d51e169 100644
> > --- a/libavformat/demux.c
> > +++ b/libavformat/demux.c
> > @@ -2078,8 +2078,8 @@ static int has_codec_parameters(const AVStream
> *st, const char **errmsg_ptr)
> >  static int try_decode_frame(AVFormatContext *s, AVStream *st,
> >                              const AVPacket *pkt, AVDictionary **options)
> >  {
> > -    FFStream *const sti = ffstream(st);
> > -    AVCodecContext *const avctx = sti->avctx;
> > +    FFStream *sti = ffstream(st);
> > +    AVCodecContext *avctx = sti->avctx;
> >      const AVCodec *codec;
> >      int got_picture = 1, ret = 0;
> >      AVFrame *frame = av_frame_alloc();
> > @@ -2104,6 +2104,12 @@ static int try_decode_frame(AVFormatContext *s,
> AVStream *st,
> >              goto fail;
> >          }
> >
> > +        if (avctx && avctx->codec != codec) {
> > +          avcodec_free_context(&avctx);
> > +          avctx = avcodec_alloc_context3(codec);
> > +          sti->avctx = avctx;
> > +        }
> > +
> >          /* Force thread count to 1 since the H.264 decoder will not
> extract
> >           * SPS and PPS to extradata during multi-threaded decoding. */
> >          av_dict_set(options ? options : &thread_opt, "threads", "1", 0);
>
> 1. Unchecked allocation.
> 2. This AVCodecContext will be mostly blank; it does not inherit
> available extradata and other parameters. See codec_close().
>
>
I'll be submitting a v2 of the patch that modifies codec_close instead ...
this one broke a lot of fate tests.

Thank you,
    Pavel