The issue is that while decode_slice is guaranteed to never get called without start_frame, end_frame is not. Moreover, it is not guaranteed it won't be called twice. On a badly-broken sample, this is what happens, which leads to a segfault, as vp->slices_buf doesn't exist, as it has been handed off for decoding already and isn't owned by the frame. Return an error as it's indicative that it's a corrupt stream rather than just missing any slices. Prevents a segfault.pull/389/head
parent
10f1bbfe11
commit
c39e861a3d
1 changed files with 3 additions and 0 deletions
Loading…
Reference in new issue