From c56c01494d0ffce135343b7dbc8e5590cc028c29 Mon Sep 17 00:00:00 2001 From: Herman Chen Date: Thu, 11 Jun 2020 16:33:46 +0800 Subject: [PATCH] [h264d]: Fix heap-use-after-free issue in h264d Change-Id: I88dced3dbd0a3e6e4f34fee86d7f019bfc130d14 Signed-off-by: Herman Chen --- mpp/codec/dec/h264/h264d_dpb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mpp/codec/dec/h264/h264d_dpb.c b/mpp/codec/dec/h264/h264d_dpb.c index 76ff8f64..284cf223 100644 --- a/mpp/codec/dec/h264/h264d_dpb.c +++ b/mpp/codec/dec/h264/h264d_dpb.c @@ -1194,11 +1194,11 @@ static MPP_RET direct_output(H264dVideoCtx_t *p_Vid, H264_DpbBuf_t *p_Dpb, H264_ //!< we have a frame (or complementary field pair), so output it directly FUN_CHECK(ret = flush_direct_output(p_Vid)); write_picture(p, p_Vid); + p_Dpb->last_output_poc = p->poc; free_storable_picture(p_Vid->p_Dec, p); p_Dpb->last_picture = NULL; p_Vid->out_buffer.is_used = 0; p_Vid->out_buffer.is_directout = 0; - p_Dpb->last_output_poc = p->poc; goto __RETURN; }