Browse Source

aacdec: set ac->output_elements upon channel element free

The issue is that ac->output_elements is populated from
ac->che, which may be freed, leaving dangling pointers in this
list.

Should fix clusterfuzz.
Lynne 7 months ago
parent
commit
b1b69ccbc0
1 changed files with 1 additions and 0 deletions
  1. 1 0
      libavcodec/aac/aacdec.c

+ 1 - 0
libavcodec/aac/aacdec.c

@@ -166,6 +166,7 @@ static av_cold int che_configure(AACDecContext *ac,
             ac->proc.sbr_ctx_close(ac->che[type][id]);
         }
         av_freep(&ac->che[type][id]);
+        memset(ac->output_element, 0, sizeof(ac->output_element));
     }
     return 0;
 }