diff mbox

[FFmpeg-devel] avformat/av1: Fix leak of dynamic buffer in case of parsing failure

Message ID 20191121061719.28878-1-andreas.rheinhardt@gmail.com
State Accepted
Commit 27c6c925344e00c1a72ba8bb2b5cdd32cb1a2655
Headers show

Commit Message

Andreas Rheinhardt Nov. 21, 2019, 6:17 a.m. UTC 
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
---
 libavformat/av1.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Comments

James Almer Nov. 22, 2019, 3:09 a.m. UTC | #1 
On 11/21/2019 3:17 AM, Andreas Rheinhardt wrote:
> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
> ---
>  libavformat/av1.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/libavformat/av1.c b/libavformat/av1.c
> index b36c5e44ba..03669dfd2a 100644
> --- a/libavformat/av1.c
> +++ b/libavformat/av1.c
> @@ -26,6 +26,7 @@
>  #include "libavcodec/put_bits.h"
>  #include "av1.h"
>  #include "avio.h"
> +#include "avio_internal.h"
>  
>  int ff_av1_filter_obus(AVIOContext *pb, const uint8_t *buf, int size)
>  {
> @@ -67,8 +68,10 @@ int ff_av1_filter_obus_buf(const uint8_t *buf, uint8_t **out, int *size)
>          return ret;
>  
>      ret = ff_av1_filter_obus(pb, buf, *size);
> -    if (ret < 0)
> +    if (ret < 0) {
> +        ffio_free_dyn_buf(&pb);
>          return ret;
> +    }
>  
>      av_freep(out);
>      *size = avio_close_dyn_buf(pb, out);

Applied, thanks.
diff mbox

Patch

diff --git a/libavformat/av1.c b/libavformat/av1.c
index b36c5e44ba..03669dfd2a 100644
--- a/libavformat/av1.c
+++ b/libavformat/av1.c
@@ -26,6 +26,7 @@ 
 #include "libavcodec/put_bits.h"
 #include "av1.h"
 #include "avio.h"
+#include "avio_internal.h"
 
 int ff_av1_filter_obus(AVIOContext *pb, const uint8_t *buf, int size)
 {
@@ -67,8 +68,10 @@  int ff_av1_filter_obus_buf(const uint8_t *buf, uint8_t **out, int *size)
         return ret;
 
     ret = ff_av1_filter_obus(pb, buf, *size);
-    if (ret < 0)
+    if (ret < 0) {
+        ffio_free_dyn_buf(&pb);
         return ret;
+    }
 
     av_freep(out);
     *size = avio_close_dyn_buf(pb, out);