Commit c2bbf2b83d for ffmpeg

commit c2bbf2b83d064313ca3739f81c651553cfbb26fb
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Tue Oct 13 06:40:15 2026 +0200

    avcodec/nvdec: attach the hw_frames_ctx before the unmap buffer owns the mapped frame

    This is not a security issue.

    Fixes: DPSu3J80jQZN
    Fixes: swarm-NULL-deref-in-nvdec_unmap_mapped_frame-when-av_buffer_replace-fails-5c28b7
    Regression since: 767f53533a
    NULL pointer dereference Replicated through Modified FFmpeg with ASAN (av_buffer_replace() made to fail for one frame)
    Found-by: zhang xingxing <2388969553@qq.com>
    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavcodec/nvdec.c b/libavcodec/nvdec.c
index f0ae2130c2..d2c176e4f9 100644
--- a/libavcodec/nvdec.c
+++ b/libavcodec/nvdec.c
@@ -922,6 +922,10 @@ static int nvdec_retrieve_data(void *logctx, AVFrame *frame)
     if (ret < 0)
         goto finish;

+    ret = av_buffer_replace(&frame->hw_frames_ctx, decoder->real_hw_frames_ref);
+    if (ret < 0)
+        goto copy_fail;
+
     unmap_data = av_mallocz(sizeof(*unmap_data));
     if (!unmap_data) {
         ret = AVERROR(ENOMEM);
@@ -936,10 +940,6 @@ static int nvdec_retrieve_data(void *logctx, AVFrame *frame)
         goto copy_fail;
     }

-    ret = av_buffer_replace(&frame->hw_frames_ctx, decoder->real_hw_frames_ref);
-    if (ret < 0)
-        goto copy_fail;
-
     unmap_data->idx = cf->idx;
     unmap_data->decoder = av_refstruct_ref(cf->decoder);

@@ -953,12 +953,8 @@ static int nvdec_retrieve_data(void *logctx, AVFrame *frame)
     goto finish;

 copy_fail:
-    if (!frame->buf[1]) {
-        CHECK_CU(decoder->cvdl->cuvidUnmapVideoFrame(decoder->decoder, devptr));
-        av_freep(&unmap_data);
-    } else {
-        av_buffer_unref(&frame->buf[1]);
-    }
+    CHECK_CU(decoder->cvdl->cuvidUnmapVideoFrame(decoder->decoder, devptr));
+    av_freep(&unmap_data);

 finish:
     CHECK_CU(decoder->cudl->cuCtxPopCurrent(&dummy));