diff options
| author | Wan-Teh Chang <wtc@google.com> | 2023-03-24 11:32:36 -0700 |
|---|---|---|
| committer | James Zern <jzern@google.com> | 2023-05-04 22:08:21 -0700 |
| commit | 3d6b86e7045481c55b35d0daa4f19202bbe99dc1 (patch) | |
| tree | 194c6ab0b6492a2328d10494d0139567d4d8c8ad /vpx | |
| parent | 8e47341b0ea4bf2a37f968cf260d6dbfd1f0062a (diff) | |
| download | libvpx-3d6b86e7045481c55b35d0daa4f19202bbe99dc1.tar.gz | |
Overwrite cm->error->detail before freeing
Help detect use after free of the return value of
vpx_codec_error_detail(). If vpx_codec_error_detail() is called after
vpx_codec_encode() fails, the return value may be equal to
cm->error->detail, which is freed when vpx_codec_destroy() is called.
Document the lifetime of the string returned by
vpx_codec_error_detail().
Change-Id: I8089e90a4499b4f3cc5b9cfdbb25d72368faa319
Diffstat (limited to 'vpx')
| -rw-r--r-- | vpx/vpx_codec.h | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/vpx/vpx_codec.h b/vpx/vpx_codec.h index ca18d90cb..0d61b0738 100644 --- a/vpx/vpx_codec.h +++ b/vpx/vpx_codec.h @@ -323,7 +323,9 @@ const char *vpx_codec_error(const vpx_codec_ctx_t *ctx); /*!\brief Retrieve detailed error information for codec context * * Returns a human readable string providing detailed information about - * the last error. + * the last error. The returned string is only valid until the next + * vpx_codec_* function call (except vpx_codec_error and + * vpx_codec_error_detail) on the codec context. * * \param[in] ctx Pointer to this instance's context. * |