diff mbox

[FFmpeg-devel,mov] Increment stsd_count while processing stsd data; avoids leaks.

Message ID CAPUDrwdRJoR-_F2oK0y=9f5GcFr5Oi_RQGdk7sxA8wyBJ=ky7A@mail.gmail.com
State New
Headers show

Commit Message

Dale Curtis Nov. 21, 2017, 11:42 p.m. UTC 
In the event of ff_mov_read_stsd_entries() failure, sc->stsd_count
is not updated, even if the function allocates extradata memory.
Instead update the sc->stsd_count as entries are parsed so that
mov_read_close() can do the right thing.

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>

Comments

Michael Niedermayer Nov. 22, 2017, 12:05 p.m. UTC | #1 
On Tue, Nov 21, 2017 at 03:42:40PM -0800, Dale Curtis wrote:
> In the event of ff_mov_read_stsd_entries() failure, sc->stsd_count
> is not updated, even if the function allocates extradata memory.
> Instead update the sc->stsd_count as entries are parsed so that
> mov_read_close() can do the right thing.
> 
> Signed-off-by: Dale Curtis <dalecurtis@chromium.org>

>  mov.c |    7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 4e5dd3d8a96401f9e1e79008ed4655d8896dbd21  fix_stsd_leak_v1.patch
> From 3c69f724173582f48189a92c3116a6783e078961 Mon Sep 17 00:00:00 2001
> From: Dale Curtis <dalecurtis@chromium.org>
> Date: Tue, 21 Nov 2017 15:40:22 -0800
> Subject: [PATCH] [mov] Increment stsd_count while processing stsd data; avoids
>  leaks.
> 
> In the event of ff_mov_read_stsd_entries() failure, sc->stsd_count
> is not updated, even if the function allocates extradata memory.
> Instead update the sc->stsd_count as entries are parsed so that
> mov_read_close() can do the right thing.
> 
> Signed-off-by: Dale Curtis <dalecurtis@chromium.org>

applied

thx

[...]
diff mbox

Patch

From 3c69f724173582f48189a92c3116a6783e078961 Mon Sep 17 00:00:00 2001
From: Dale Curtis <dalecurtis@chromium.org>
Date: Tue, 21 Nov 2017 15:40:22 -0800
Subject: [PATCH] [mov] Increment stsd_count while processing stsd data; avoids
 leaks.

In the event of ff_mov_read_stsd_entries() failure, sc->stsd_count
is not updated, even if the function allocates extradata memory.
Instead update the sc->stsd_count as entries are parsed so that
mov_read_close() can do the right thing.

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
---
 libavformat/mov.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index b6cdf3a52a..9e876efc8c 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -2464,8 +2464,10 @@  int ff_mov_read_stsd_entries(MOVContext *c, AVIOContext *pb, int entries)
         }
 
         if (mov_skip_multiple_stsd(c, pb, st->codecpar->codec_tag, format,
-                                   size - (avio_tell(pb) - start_pos)))
+                                   size - (avio_tell(pb) - start_pos))) {
+            sc->stsd_count++;
             continue;
+        }
 
         sc->pseudo_stream_id = st->codecpar->codec_tag ? -1 : pseudo_stream_id;
         sc->dref_id= dref_id;
@@ -2517,6 +2519,7 @@  int ff_mov_read_stsd_entries(MOVContext *c, AVIOContext *pb, int entries)
             av_freep(&st->codecpar->extradata);
             st->codecpar->extradata_size = 0;
         }
+        sc->stsd_count++;
     }
 
     if (pb->eof_reached)
@@ -2566,8 +2569,6 @@  static int mov_read_stsd(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     if (ret < 0)
         goto fail;
 
-    sc->stsd_count = entries;
-
     /* Restore back the primary extradata. */
     av_freep(&st->codecpar->extradata);
     st->codecpar->extradata_size = sc->extradata_size[0];
-- 
2.15.0.448.gf294e3d99a-goog