1 files changed, 27 insertions, 15 deletions

diff --git a/chromium/third_party/ffmpeg/libavfilter/vf_pullup.c b/chromium/third_party/ffmpeg/libavfilter/vf_pullup.c
index 69e1e917193..13e06253c7f 100644
--- a/chromium/third_party/ffmpeg/libavfilter/vf_pullup.c
+++ b/chromium/third_party/ffmpeg/libavfilter/vf_pullup.c
@@ -126,6 +126,23 @@ static int alloc_metrics(PullupContext *s, PullupField *f)
     return 0;
 }
 
+static void free_field_queue(PullupField *head)
+{
+    PullupField *f = head;
+    do {
+        PullupField *next;
+        if (!f)
+            break;
+        av_free(f->diffs);
+        av_free(f->combs);
+        av_free(f->vars);
+        next = f->next;
+        memset(f, 0, sizeof(*f)); // clear all pointers to avoid stale ones
+        av_free(f);
+        f = next;
+    } while (f != head);
+}
+
 static PullupField *make_field_queue(PullupContext *s, int len)
 {
     PullupField *head, *f;
@@ -141,13 +158,17 @@ static PullupField *make_field_queue(PullupContext *s, int len)
 
     for (; len > 0; len--) {
         f->next = av_mallocz(sizeof(*f->next));
-        if (!f->next)
+        if (!f->next) {
+            free_field_queue(head);
             return NULL;
+        }
 
         f->next->prev = f;
         f = f->next;
-        if (alloc_metrics(s, f) < 0)
+        if (alloc_metrics(s, f) < 0) {
+            free_field_queue(head);
             return NULL;
+        }
     }
 
     f->next = head;
@@ -235,6 +256,8 @@ static int alloc_buffer(PullupContext *s, PullupBuffer *b)
     for (i = 0; i < s->nb_planes; i++) {
         b->planes[i] = av_malloc(s->planeheight[i] * s->planewidth[i]);
     }
+    if (s->nb_planes == 1)
+        b->planes[1] = av_malloc(4*256);
 
     return 0;
 }
@@ -714,21 +737,10 @@ end:
 static av_cold void uninit(AVFilterContext *ctx)
 {
     PullupContext *s = ctx->priv;
-    PullupField *f;
     int i;
 
-    f = s->head;
-    while (f) {
-        av_free(f->diffs);
-        av_free(f->combs);
-        av_free(f->vars);
-        if (f == s->last) {
-            av_freep(&s->last);
-            break;
-        }
-        f = f->next;
-        av_freep(&f->prev);
-    };
+    free_field_queue(s->head);
+    s->last = NULL;
 
     for (i = 0; i < FF_ARRAY_ELEMS(s->buffers); i++) {
         av_freep(&s->buffers[i].planes[0]);