diff mbox series

[FFmpeg-devel] libavformat/avidec: check memory allocation

Message ID 20201013032225.97512-1-chris@miceli.net.au
State Accepted
Commit 0c90377a402d10279a4133034d8dd66c1809d42c
Headers show
Series [FFmpeg-devel] libavformat/avidec: check memory allocation | expand

Checks

Context Check Description
andriy/x86_make success Make finished
andriy/x86_make_fate success Make fate finished
andriy/PPC64_make warning Make failed

Commit Message

Chris Miceli Oct. 13, 2020, 3:22 a.m. UTC 
Memory allocation for AVIOContext should be checked. In this code,
all error conditions are sent to the "goto error".
---
 libavformat/avidec.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

Comments

Michael Niedermayer Oct. 15, 2020, 4:43 p.m. UTC | #1 
On Tue, Oct 13, 2020 at 02:22:25PM +1100, Chris Miceli wrote:
> Memory allocation for AVIOContext should be checked. In this code,
> all error conditions are sent to the "goto error".
> ---
>  libavformat/avidec.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)

will apply

thx

[...]
diff mbox series

Patch

diff --git a/libavformat/avidec.c b/libavformat/avidec.c
index 9765e5e7b2..33e50e9878 100644
--- a/libavformat/avidec.c
+++ b/libavformat/avidec.c
@@ -1072,11 +1072,15 @@  static int read_gab2_sub(AVFormatContext *s, AVStream *st, AVPacket *pkt)
         ff_const59 AVInputFormat *sub_demuxer;
         AVRational time_base;
         int size;
+        AVProbeData pd;
+        unsigned int desc_len;
         AVIOContext *pb = avio_alloc_context(pkt->data + 7,
                                              pkt->size - 7,
                                              0, NULL, NULL, NULL, NULL);
-        AVProbeData pd;
-        unsigned int desc_len = avio_rl32(pb);
+        if (!pb)
+            goto error;
+
+        desc_len = avio_rl32(pb);
 
         if (desc_len > pb->buf_end - pb->buf_ptr)
             goto error;