Skip to content

Commit

Permalink
check meta pointer before calling avifMetaDestroy (#2065)
Browse files Browse the repository at this point in the history
fixes a NULL dereference should avifMetaCreate() fail and
avifDecoderDataDestroy() is called to clean up.

Found by Nallocfuzz (https://github.com/catenacyber/nallocfuzz).
Reported by Philippe Antoine (p.antoine <at> catenacyber.fr).
  • Loading branch information
jzern authored Mar 19, 2024
1 parent 1c92dbb commit 70503d7
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion src/read.c
Original file line number Diff line number Diff line change
Expand Up @@ -993,7 +993,9 @@ static void avifDecoderDataClearTiles(avifDecoderData * data)

static void avifDecoderDataDestroy(avifDecoderData * data)
{
avifMetaDestroy(data->meta);
if (data->meta) {
avifMetaDestroy(data->meta);
}
for (uint32_t i = 0; i < data->tracks.count; ++i) {
avifTrack * track = &data->tracks.track[i];
if (track->sampleTable) {
Expand Down

0 comments on commit 70503d7

Please sign in to comment.