[FFmpeg-cvslog] avcodec/ivi: Avoid mbs memleak

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Thu Dec 13 03:16:04 2018 +0100| [80cce5998c10ff5d93c7b52f303d83ad20fb3a11] | committer: Michael Niedermayer

avcodec/ivi: Avoid mbs memleak

Fixes: 11696/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO5_fuzzer-5740319635668992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=80cce5998c10ff5d93c7b52f303d83ad20fb3a11
---

 libavcodec/ivi.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/libavcodec/ivi.c b/libavcodec/ivi.c
index b23d4af27e..71bf0e6e1c 100644
--- a/libavcodec/ivi.c
+++ b/libavcodec/ivi.c
@@ -437,6 +437,14 @@ av_cold int ff_ivi_init_tiles(IVIPlaneDesc *planes,
 
         for (b = 0; b < planes[p].num_bands; b++) {
             band = &planes[p].bands[b];
+
+            if (band->tiles) {
+                int t;
+                for (t = 0; t < band->num_tiles; t++) {
+                    av_freep(&band->tiles[t].mbs);
+                }
+            }
+
             x_tiles = IVI_NUM_TILES(band->width, t_width);
             y_tiles = IVI_NUM_TILES(band->height, t_height);
             band->num_tiles = x_tiles * y_tiles;