From patchwork Thu Jan 23 16:08:29 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Rheinhardt X-Patchwork-Id: 17492 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 6933844BAAD for ; Thu, 23 Jan 2020 18:08:56 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 5800468B43F; Thu, 23 Jan 2020 18:08:56 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-wr1-f68.google.com (mail-wr1-f68.google.com [209.85.221.68]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 5D0BB68B098 for ; Thu, 23 Jan 2020 18:08:48 +0200 (EET) Received: by mail-wr1-f68.google.com with SMTP id w15so3720637wru.4 for ; Thu, 23 Jan 2020 08:08:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=T2M+A50ragfZ3zMkXykZ1DbKxwm0td2wVCemQVeu0IA=; b=bbGya995jckyOl5UjVPyI8rergP6npE6Fr2G/k4rNzBqEtlhhgB3y7sVZd5en0m1Cp 2QezswTkmZ0oibiI1ETVS4f/kbU/6BR73+wvUXE0nM2Ke7PA3gDOeQTqc1mAVBxFMa2a Y+Geeb9ZeG2MXOdBc9724Pb5nB47EhFvIIgnd95kAOo+hf+YiKCyf8h8tLNw/XOsjd07 G+p7AvOIjh9vZgt3WEoSeXRpsoQVyDGXl4sj5wvPWejSd4VYTR5vjVsKLHUPgTYCM11l 0l70UDEnRF+JJ2Fg9WcHLPA9wNTgtilzePD4xWLurWUqOjExIeS1MPQeCRsPUMBFugDS n74w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=T2M+A50ragfZ3zMkXykZ1DbKxwm0td2wVCemQVeu0IA=; b=YOSpHKwingnwVjoNexRVAF2QOZqojeIBirKzWWQuhuKoNxlbrVedLlenQ+Ef2Cp9yn 0VhBhQv6qFRHd1VFBiW72paM49WB2j81DwF3M/Qzn/xrFZsbS9m+tS4NU9PbtoGMySOH INfvyrlaotL/YiPogUk2RXKa+M4qS4jHU956ah71cv24ujSF/srpWpYMnngRtaE20rD3 6PgrS/ueoMeE8djeck6Hod/X+3zeMcIJvfzVXGxX+D0OmB/LMR3OjYd86iMF2JBhs8lw S15LL5OHlyszTe0G2+10YVqZCSylK3tHHE6KHeSN4jr1ysgN5jdWuOrXfW4FCE835LG8 38sQ== X-Gm-Message-State: APjAAAWzwo5xHeTXUZFapfFvSyxA6IVU6YFQHDUgDw4W1hxColQYC0zU aVhD+i255NDJbTf71JOgurvXyxji X-Google-Smtp-Source: APXvYqxIz4rv3kkhnVo7OIFnLI9celwa5zoucKBZpEG1L27JGhXQLJ3TLaQ0S5xmHmTUQnQkCxJ7mA== X-Received: by 2002:adf:90e7:: with SMTP id i94mr17510366wri.47.1579795727687; Thu, 23 Jan 2020 08:08:47 -0800 (PST) Received: from sblaptop.fritz.box (ipbcc08bbf.dynamic.kabel-deutschland.de. [188.192.139.191]) by smtp.gmail.com with ESMTPSA id o187sm3678419wme.36.2020.01.23.08.08.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jan 2020 08:08:47 -0800 (PST) From: Andreas Rheinhardt To: ffmpeg-devel@ffmpeg.org Date: Thu, 23 Jan 2020 17:08:29 +0100 Message-Id: <20200123160832.2020-3-andreas.rheinhardt@gmail.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200123160832.2020-1-andreas.rheinhardt@gmail.com> References: <20200123160832.2020-1-andreas.rheinhardt@gmail.com> MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH 3/6] avformat/hevc: Fix potential leak in case of ff_hevc_annexb2mp4_buf failure X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Andreas Rheinhardt Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" ff_hevc_annexb2mp4_buf() could indicate an error, yet leave cleaning after itself to the caller, so that a caller could not simply return the error, but had to free the buffer first. (Given that all current callers have set filter_ps = 0, this error can currently not be triggered.) Signed-off-by: Andreas Rheinhardt --- libavformat/hevc.c | 6 ++++++ libavformat/hevc.h | 8 ++++---- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/libavformat/hevc.c b/libavformat/hevc.c index c7c4be3441..db931d2017 100644 --- a/libavformat/hevc.c +++ b/libavformat/hevc.c @@ -25,6 +25,7 @@ #include "libavutil/intreadwrite.h" #include "avc.h" #include "avio.h" +#include "avio_internal.h" #include "hevc.h" #define MAX_SPATIAL_SEGMENTATION 4096 // max. value of u(12) field @@ -1054,6 +1055,11 @@ int ff_hevc_annexb2mp4_buf(const uint8_t *buf_in, uint8_t **buf_out, return ret; ret = ff_hevc_annexb2mp4(pb, buf_in, *size, filter_ps, ps_count); + if (ret < 0) { + ffio_free_dyn_buf(&pb); + return ret; + } + *size = avio_close_dyn_buf(pb, buf_out); return ret; diff --git a/libavformat/hevc.h b/libavformat/hevc.h index 796eaf40b1..1e355cd34a 100644 --- a/libavformat/hevc.h +++ b/libavformat/hevc.h @@ -60,13 +60,13 @@ int ff_hevc_annexb2mp4(AVIOContext *pb, const uint8_t *buf_in, * If filter_ps is non-zero, any HEVC parameter sets found in the input will be * discarded, and *ps_count will be set to the number of discarded PS NAL units. * - * On output, *size holds the size (in bytes) of the output data buffer. + * On success, *size holds the size (in bytes) of the output data buffer. * * @param buf_in address of the buffer holding the input data * @param size address of the variable holding the size (in bytes) of the input - * buffer (on input) and of the output buffer (on output) - * @param buf_out address of the variable holding the address of the output - * buffer + * buffer (on input) and of the output buffer (on success) + * @param buf_out on success, address of the variable holding the address of + * the output buffer * @param filter_ps whether to write parameter set NAL units to the output (0) * or to discard them (non-zero) * @param ps_count address of the variable where the number of discarded