[FFmpeg-devel] [PATCH 1/2] avcodec/mjpegdec: Fix av_frame_unref(NULL)

[Andreas Rheinhardt]

The smv_frame is only allocated for the SMV decoder, yet
it is unreferenced in the other decoders' flush functions, too.
av_frame_unref(NULL) is not documented to be allowed, it just
happens to work. Avoid it by using a dedicated flush function
for SMV.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt at outlook.com>
---
 libavcodec/mjpegdec.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 1481a7f285..ac2698a3c4 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -2977,9 +2977,6 @@ static void decode_flush(AVCodecContext *avctx)
 {
     MJpegDecodeContext *s = avctx->priv_data;
     s->got_picture = 0;
-
-    s->smv_next_frame = 0;
-    av_frame_unref(s->smv_frame);
 }
 
 #if CONFIG_MJPEG_DECODER
@@ -3044,6 +3041,16 @@ const FFCodec ff_thp_decoder = {
 #endif
 
 #if CONFIG_SMVJPEG_DECODER
+static av_cold void smv_flush(AVCodecContext *avctx)
+{
+    MJpegDecodeContext *s = avctx->priv_data;
+
+    decode_flush(avctx);
+
+    s->smv_next_frame = 0;
+    av_frame_unref(s->smv_frame);
+}
+
 // SMV JPEG just stacks several output frames into one JPEG picture
 // we handle that by setting up the cropping parameters appropriately
 static void smv_process_frame(AVCodecContext *avctx, AVFrame *frame)
@@ -3112,7 +3119,7 @@ const FFCodec ff_smvjpeg_decoder = {
     .init           = ff_mjpeg_decode_init,
     .close          = ff_mjpeg_decode_end,
     FF_CODEC_RECEIVE_FRAME_CB(smvjpeg_receive_frame),
-    .flush          = decode_flush,
+    .flush          = smv_flush,
     .p.capabilities = AV_CODEC_CAP_DR1,
     .caps_internal  = FF_CODEC_CAP_EXPORTS_CROPPING |
                       FF_CODEC_CAP_INIT_CLEANUP,
-- 
2.40.1