Merge commit 'd68fb1475856cf93199e2bc4eee3063902c35df7'

* commit 'd68fb1475856cf93199e2bc4eee3063902c35df7':
  mjpegdec: Properly fail on malloc failure

Merged-by: Clément Bœsch <u@pkh.me>

diff --cc libavcodec/mjpegdec.c
index d77332905cf865f307d058c3e01c665640f09c8d,1f36b393a8e6e99064a1966aabe3d459f1855109..633a8f02c0afb00b85cacf6ac457eb7b10b7407c
--- 1/libavcodec/mjpegdec.c
--- 2/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@@ -1876,34 -1327,31 +1876,35 @@@ static int mjpeg_decode_com(MJpegDecode
  {
      int len = get_bits(&s->gb, 16);
      if (len >= 2 && 8 * len - 16 <= get_bits_left(&s->gb)) {
+         int i;
          char *cbuf = av_malloc(len - 1);
-         if (cbuf) {
-             int i;
-             for (i = 0; i < len - 2; i++)
-                 cbuf[i] = get_bits(&s->gb, 8);
-             if (i > 0 && cbuf[i - 1] == '\n')
-                 cbuf[i - 1] = 0;
-             else
-                 cbuf[i] = 0;
+         if (!cbuf)
+             return AVERROR(ENOMEM);
  
-             if (s->avctx->debug & FF_DEBUG_PICT_INFO)
-                 av_log(s->avctx, AV_LOG_INFO, "comment: '%s'\n", cbuf);
- 
-             /* buggy avid, it puts EOI only at every 10th frame */
-             if (!strncmp(cbuf, "AVID", 4)) {
-                 parse_avid(s, cbuf, len);
-             } else if (!strcmp(cbuf, "CS=ITU601"))
-                 s->cs_itu601 = 1;
-             else if ((!strncmp(cbuf, "Intel(R) JPEG Library, version 1", 32) && s->avctx->codec_tag) ||
-                      (!strncmp(cbuf, "Metasoft MJPEG Codec", 20)))
-                 s->flipped = 1;
-             else if (!strcmp(cbuf, "MULTISCOPE II")) {
-                 s->avctx->sample_aspect_ratio = (AVRational) { 1, 2 };
-                 s->multiscope = 2;
-             }
+         for (i = 0; i < len - 2; i++)
+             cbuf[i] = get_bits(&s->gb, 8);
+         if (i > 0 && cbuf[i - 1] == '\n')
+             cbuf[i - 1] = 0;
+         else
+             cbuf[i] = 0;
  
-             av_free(cbuf);
+         if (s->avctx->debug & FF_DEBUG_PICT_INFO)
 -            av_log(s->avctx, AV_LOG_INFO, "mjpeg comment: '%s'\n", cbuf);
++            av_log(s->avctx, AV_LOG_INFO, "comment: '%s'\n", cbuf);
+ 
+         /* buggy avid, it puts EOI only at every 10th frame */
 -        if (!strcmp(cbuf, "AVID")) {
 -            s->buggy_avid = 1;
++        if (!strncmp(cbuf, "AVID", 4)) {
++            parse_avid(s, cbuf, len);
+         } else if (!strcmp(cbuf, "CS=ITU601"))
+             s->cs_itu601 = 1;
 -        else if ((len > 20 && !strncmp(cbuf, "Intel(R) JPEG Library", 21)) ||
 -                 (len > 19 && !strncmp(cbuf, "Metasoft MJPEG Codec", 20)))
++        else if ((!strncmp(cbuf, "Intel(R) JPEG Library, version 1", 32) && s->avctx->codec_tag) ||
++                 (!strncmp(cbuf, "Metasoft MJPEG Codec", 20)))
+             s->flipped = 1;
++        else if (!strcmp(cbuf, "MULTISCOPE II")) {
++            s->avctx->sample_aspect_ratio = (AVRational) { 1, 2 };
++            s->multiscope = 2;
 +        }
+ 
+         av_free(cbuf);
      }
  
      return 0;
@@@ -2114,11 -1526,12 +2115,14 @@@ int ff_mjpeg_decode_frame(AVCodecContex
          else if (start_code >= APP0 && start_code <= APP15)
              mjpeg_decode_app(s);
              /* Comment */
-         else if (start_code == COM)
-             mjpeg_decode_com(s);
+         else if (start_code == COM) {
+             ret = mjpeg_decode_com(s);
+             if (ret < 0)
+                 return ret;
+         }
  
 +        ret = -1;
 +
          if (!CONFIG_JPEGLS_DECODER &&
              (start_code == SOF48 || start_code == LSE)) {
              av_log(avctx, AV_LOG_ERROR, "JPEG-LS support not enabled.\n");