vp9: fix memory corruption if header decoding fails after size change.

diff --git a/libavcodec/vp9.c b/libavcodec/vp9.c
index ec6ceb010df27133257cd7c41d1e31019fdc0be4..29653949d58dc1b63240c76a54fddb8c094b4d20 100644 (file)
--- a/libavcodec/vp9.c
+++ b/libavcodec/vp9.c
@@ -3772,7 +3772,8 @@ static int vp9_decode_update_thread_context(AVCodecContext *dst, const AVCodecCo
     VP9Context *s = dst->priv_data, *ssrc = src->priv_data;
 
     // detect size changes in other threads
-    if (s->above_partition_ctx && (s->cols != ssrc->cols || s->rows != ssrc->rows)) {
+    if (s->above_partition_ctx &&
+        (!ssrc->above_partition_ctx || s->cols != ssrc->cols || s->rows != ssrc->rows)) {
         free_buffers(s);
     }