diff mbox

[FFmpeg-devel,v2,2/2] avcodec/mpeg12dec: ensure a53_caption_size is reset on malloc failures

Message ID 20170315195304.94885-2-ffmpeg@tmm1.net
State Superseded
Headers show

Commit Message

Aman Gupta March 15, 2017, 7:53 p.m. UTC
From: Aman Gupta <aman@tmm1.net>

---
 libavcodec/mpeg12dec.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

Comments

Michael Niedermayer March 15, 2017, 9:06 p.m. UTC | #1
On Wed, Mar 15, 2017 at 12:53:04PM -0700, Aman Gupta wrote:
> From: Aman Gupta <aman@tmm1.net>
> 
> ---
>  libavcodec/mpeg12dec.c | 13 ++++++++++---
>  1 file changed, 10 insertions(+), 3 deletions(-)

LGTM

thx

[...]
diff mbox

Patch

diff --git a/libavcodec/mpeg12dec.c b/libavcodec/mpeg12dec.c
index cea8963..f71f207 100644
--- a/libavcodec/mpeg12dec.c
+++ b/libavcodec/mpeg12dec.c
@@ -2255,8 +2255,11 @@  static int mpeg_decode_a53_cc(AVCodecContext *avctx,
             av_freep(&s1->a53_caption);
             s1->a53_caption_size = cc_count * 3;
             s1->a53_caption      = av_malloc(s1->a53_caption_size);
-            if (s1->a53_caption)
+            if (!s1->a53_caption) {
+                s1->a53_caption_size = 0;
+            } else {
                 memcpy(s1->a53_caption, p + 7, s1->a53_caption_size);
+            }
             avctx->properties |= FF_CODEC_PROPERTY_CLOSED_CAPTIONS;
         }
         return 1;
@@ -2273,7 +2276,9 @@  static int mpeg_decode_a53_cc(AVCodecContext *avctx,
             av_freep(&s1->a53_caption);
             s1->a53_caption_size = cc_count * 3;
             s1->a53_caption      = av_malloc(s1->a53_caption_size);
-            if (s1->a53_caption) {
+            if (!s1->a53_caption) {
+                s1->a53_caption_size = 0;
+            } else {
                 uint8_t field, cc1, cc2;
                 uint8_t *cap = s1->a53_caption;
                 for (i = 0; i < cc_count; i++) {
@@ -2337,7 +2342,9 @@  static int mpeg_decode_a53_cc(AVCodecContext *avctx,
             av_freep(&s1->a53_caption);
             s1->a53_caption_size = cc_count * 6;
             s1->a53_caption      = av_malloc(s1->a53_caption_size);
-            if (s1->a53_caption) {
+            if (!s1->a53_caption) {
+                s1->a53_caption_size = 0;
+            } else {
                 uint8_t field1 = !!(p[4] & 0x80);
                 uint8_t *cap = s1->a53_caption;
                 p += 5;