From b95c0d93fff06c695c074e512c4bce8788f9ff56 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 27 Feb 2024 23:47:07 +0100 Subject: [PATCH] avcodec/vvc/vvcdec: allow vvc_decode_close() on failed open Fixes: division by 0 Fixes: 67008/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-5873503163187200 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/vvc/vvcdec.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/libavcodec/vvc/vvcdec.c b/libavcodec/vvc/vvcdec.c index f024cbd067..570e2aa513 100644 --- a/libavcodec/vvc/vvcdec.c +++ b/libavcodec/vvc/vvcdec.c @@ -950,13 +950,14 @@ static av_cold void vvc_decode_flush(AVCodecContext *avctx) { VVCContext *s = avctx->priv_data; int got_output = 0; - VVCFrameContext *last; while (s->nb_delayed) wait_delayed_frame(s, NULL, &got_output); - last = get_frame_context(s, s->fcs, s->nb_frames - 1); - ff_vvc_flush_dpb(last); + if (s->fcs) { + VVCFrameContext *last = get_frame_context(s, s->fcs, s->nb_frames - 1); + ff_vvc_flush_dpb(last); + } s->eos = 1; }