From patchwork Mon Jul 20 06:15:45 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Rheinhardt X-Patchwork-Id: 21199 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 58A3C447C4E for ; Mon, 20 Jul 2020 09:16:17 +0300 (EEST) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 38F6B68B9E8; Mon, 20 Jul 2020 09:16:17 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-ed1-f67.google.com (mail-ed1-f67.google.com [209.85.208.67]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 6928568B9D5 for ; Mon, 20 Jul 2020 09:16:10 +0300 (EEST) Received: by mail-ed1-f67.google.com with SMTP id b15so11923184edy.7 for ; Sun, 19 Jul 2020 23:16:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=9psSG8yPzE2qIj7gC+dzo0yv6eKFNN/nWcXdnsm73Rg=; b=tX2EruV0+FbCF6nPshEFjPBEn4UMZ9Ox0IPR8cXiOYOAiItXZ7KAxzt8nO3q37r0ZE WFywt/DuQkyQxtNCBs9qEQxLN/tpDjxnZTgFv5lx1kfpncdyV2vxJ8HKx27IPNSDQbE1 Z98kxEjqZcSJ/m5eYsqRvQnqsV5nku6tgd+BfZHZt6lq2EXw65dgGo+Hry2Dt5gFWPul Jp8zaGmNIIzMjCeL8OilIUt5M07hV3ADcPnwwUSJ788yc+llgt1TGC+cjPuGkNeO+6FD YabcNxvnMAn+OHyi3BHCKYuoAIFUP1fMzkcT6iFNiF92SwB/BVT1uv8wQmsubvZBbSnw Q8eg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=9psSG8yPzE2qIj7gC+dzo0yv6eKFNN/nWcXdnsm73Rg=; b=KaLnP+2aLaF4DeM7k+WiWcBrZUqQ0qbEp4+7Bgc//3A59t+nX8bK8V7UZA1Tyskz4s eXXegz4EJnxh6lzfw9zvvo9v4/N1R0wIjiFob+S5jKxj/JVgbieRdEBK1LXjgFJWquA2 XU893c7bnGopmvZlHK0dZC6mYGw2NkiB8hjhe3Qz4Jo29kIlpk2NuHWHIytjXND+hK7N 7uE+8Aq25QNVcxHJCtqY0ZKOvLJxAjk/iAj/olQaWWrhP5K5m+reKl+tTG/kaQI2EV2T nhoCiBkE6jDydT9HqrQ+amfsIdxRceEKU/+vw5wsAJUQjVb4ZnmOYHpdjKXev1Fmh6/q 1Kow== X-Gm-Message-State: AOAM531qUfS5gJkCqcp4S0+gsYB3+s2iG2+hPZQStIyP8hTG2IvQvy7l f6uNtky57cEAjwBkmDGDb6ZItNN+ X-Google-Smtp-Source: ABdhPJzK/v4A3vx/Dr/f5gGgo5JttP24OmZS80tj/lAzq+x69aUVTmACpAQcwyIgJcgx9LuFv31vVQ== X-Received: by 2002:a50:c88d:: with SMTP id d13mr20479119edh.104.1595225769588; Sun, 19 Jul 2020 23:16:09 -0700 (PDT) Received: from sblaptop.fritz.box (ipbcc10296.dynamic.kabel-deutschland.de. [188.193.2.150]) by smtp.gmail.com with ESMTPSA id y21sm14044773ejo.4.2020.07.19.23.16.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 19 Jul 2020 23:16:08 -0700 (PDT) From: Andreas Rheinhardt To: ffmpeg-devel@ffmpeg.org Date: Mon, 20 Jul 2020 08:15:45 +0200 Message-Id: <20200720061545.18854-3-andreas.rheinhardt@gmail.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200720061545.18854-1-andreas.rheinhardt@gmail.com> References: <20200720061545.18854-1-andreas.rheinhardt@gmail.com> MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH 3/3] avformat/mxfdec: Fix memleak upon repeating tags X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Andreas Rheinhardt Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" When parsing MXF encountering some tags leads to allocations. And when these tags were encountered repeatedly, this could lead to memleaks, because the pointer to the old data got simply overwritten with a pointer to the new data (or to NULL on allocation failure). This has been fixed. Signed-off-by: Andreas Rheinhardt --- libavformat/mxfdec.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index 3016885e75..f0975f409e 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -850,6 +850,7 @@ static int mxf_read_cryptographic_context(void *arg, AVIOContext *pb, int tag, i static int mxf_read_strong_ref_array(AVIOContext *pb, UID **refs, int *count) { *count = avio_rb32(pb); + av_free(*refs); *refs = av_calloc(*count, sizeof(UID)); if (!*refs) { *count = 0; @@ -903,10 +904,8 @@ static int mxf_read_content_storage(void *arg, AVIOContext *pb, int tag, int siz case 0x1901: if (mxf->packages_refs) av_log(mxf->fc, AV_LOG_VERBOSE, "Multiple packages_refs\n"); - av_free(mxf->packages_refs); return mxf_read_strong_ref_array(pb, &mxf->packages_refs, &mxf->packages_count); case 0x1902: - av_free(mxf->essence_container_data_refs); return mxf_read_strong_ref_array(pb, &mxf->essence_container_data_refs, &mxf->essence_container_data_count); } return 0;