[FFmpeg-cvslog] avcodec/vlc: Attempt to free buf after use in ff_vlc_init_multi_from_lengths()

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Thu Sep 14 01:47:33 2023 +0200| [2e04d35c69e6f8b4bdb46caa4a880c7c2ba3b141] | committer: Paul B Mahol

avcodec/vlc: Attempt to free buf after use in ff_vlc_init_multi_from_lengths()

Fixes: use after free
Fixes: 62153/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MAGICYUV_fuzzer-4702814909366272

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2e04d35c69e6f8b4bdb46caa4a880c7c2ba3b141
---

 libavcodec/vlc.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/libavcodec/vlc.c b/libavcodec/vlc.c
index 3b66c94354..e5ec325327 100644
--- a/libavcodec/vlc.c
+++ b/libavcodec/vlc.c
@@ -471,10 +471,13 @@ int ff_vlc_init_multi_from_lengths(VLC *vlc, VLC_MULTI *multi, int nb_bits, int
             goto fail;
         }
     }
-    ret = vlc_common_end(vlc, nb_bits, j, buf, flags, localbuf);
+    ret = vlc_common_end(vlc, nb_bits, j, buf, flags, buf);
     if (ret < 0)
         goto fail;
-    return vlc_multi_gen(multi->table, vlc, nb_elems, j, nb_bits, buf, logctx);
+    ret = vlc_multi_gen(multi->table, vlc, nb_elems, j, nb_bits, buf, logctx);
+    if (buf != localbuf)
+        av_free(buf);
+    return ret;
 fail:
     if (buf != localbuf)
         av_free(buf);