avcodec/mimic: set up the bit reader before publishing the frame

Fixes: ZiiTReozL7KE
Fixes: AISLE-2026-0150-00435
Fixes: deadlock
Deadlock Replicated through UnModified FFmpeg with timeout (AVI with a
268435476 byte Mimic intra frame followed by inter frames; ffmpeg with
frame threading never exits)

Found-by: Joshua Rogers (AISLE)
This commit is contained in:
Michael Niedermayer authored and michaelni committed 2026-11-05 23:27:36 +00:00
1 parent 0bfa350291
commit db77b0b831
1 file changed
+11 -11
+11 -11
View File
@@ -385,6 +385,17 @@ static int mimic_decode_frame(AVCodecContext *avctx, AVFrame *rframe,
return AVERROR_INVALIDDATA;
}
av_fast_padded_malloc(&ctx->swap_buf, &ctx->swap_buf_size, swap_buf_size);
if (!ctx->swap_buf)
return AVERROR(ENOMEM);
ctx->bbdsp.bswap_buf(ctx->swap_buf,
(const uint32_t *) (buf + MIMIC_HEADER_SIZE),
swap_buf_size >> 2);
res = init_get_bits8(&ctx->gb, ctx->swap_buf, swap_buf_size);
if (res < 0)
return res;
ff_progress_frame_unref(&ctx->frames[ctx->cur_index]);
res = ff_progress_frame_get_buffer(avctx, &ctx->frames[ctx->cur_index],
AV_GET_BUFFER_FLAG_REF);
@@ -398,17 +409,6 @@ static int mimic_decode_frame(AVCodecContext *avctx, AVFrame *rframe,
ff_thread_finish_setup(avctx);
av_fast_padded_malloc(&ctx->swap_buf, &ctx->swap_buf_size, swap_buf_size);
if (!ctx->swap_buf)
return AVERROR(ENOMEM);
ctx->bbdsp.bswap_buf(ctx->swap_buf,
(const uint32_t *) (buf + MIMIC_HEADER_SIZE),
swap_buf_size >> 2);
res = init_get_bits8(&ctx->gb, ctx->swap_buf, swap_buf_size);
if (res < 0)
return res;
res = decode(ctx, quality, num_coeffs, !is_pframe);
ff_progress_frame_report(&ctx->frames[ctx->cur_index], INT_MAX);
if (res < 0) {