avfilter/formats: guard against double free

diff --git a/libavfilter/formats.c b/libavfilter/formats.c
index 31ee445c494ee38fdd75b6e6517274ed70a31a6e..e6d27f45f32776b9a48482f756b158e91c7a6f81 100644 (file)
--- a/libavfilter/formats.c
+++ b/libavfilter/formats.c
@@ -456,7 +456,7 @@ do {                                        \
 do {                                                               \
     int idx = -1;                                                  \
                                                                    \
-    if (!*ref || !(*ref)->refs)                                    \
+    if (!ref || !*ref || !(*ref)->refs)                            \
         return;                                                    \
                                                                    \
     FIND_REF_INDEX(ref, idx);                                      \
@@ -518,7 +518,8 @@ void ff_formats_changeref(AVFilterFormats **oldref, AVFilterFormats **newref)
             int ret = ref_fn(fmts, &ctx->inputs[i]->out_fmts);      \
             if (ret < 0) {                                          \
                 unref_fn(&fmts);                                    \
-                av_freep(&fmts->list);                              \
+                if (fmts)                                           \
+                    av_freep(&fmts->list);                          \
                 av_freep(&fmts);                                    \
                 return ret;                                         \
             }                                                       \
@@ -530,7 +531,8 @@ void ff_formats_changeref(AVFilterFormats **oldref, AVFilterFormats **newref)
             int ret = ref_fn(fmts, &ctx->outputs[i]->in_fmts);      \
             if (ret < 0) {                                          \
                 unref_fn(&fmts);                                    \
-                av_freep(&fmts->list);                              \
+                if (fmts)                                           \
+                    av_freep(&fmts->list);                          \
                 av_freep(&fmts);                                    \
                 return ret;                                         \
             }                                                       \