From patchwork Sun Sep 20 07:43:45 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Rheinhardt X-Patchwork-Id: 22510 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 4FBDB447DAE for ; Sun, 20 Sep 2020 10:44:04 +0300 (EEST) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 25CA568B6CC; Sun, 20 Sep 2020 10:44:04 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-wr1-f66.google.com (mail-wr1-f66.google.com [209.85.221.66]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id BBDB968B603 for ; Sun, 20 Sep 2020 10:43:57 +0300 (EEST) Received: by mail-wr1-f66.google.com with SMTP id k15so9582623wrn.10 for ; Sun, 20 Sep 2020 00:43:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:reply-to:mime-version :content-transfer-encoding; bh=JSGDkCoCA2ZrKu65fKy3j8mO1unj2IgbnJ5MIn2kmmE=; b=Iu55vD1wRCwxPVwTzd0rsNQtzrfeUla3YSISOXoRODivaayKvpNBoUR7pCNOXE4aA0 5Iv+r3Olpp0mmidgeE/m4JbUTN3mw0acnlikh6MZOZeKvrKaMhZTUdQW+iKeKOjBvavM vWiESccWiXaujzsJBmEAWVIBBT9Mla2ALHO7T4W0sWmmYZzX3Jc9pBbB2WitMc8rEy6a MBp4wTFZIFkJrU+YLFQeMEDmcLNARt3FZ11BULyOlDYB9mEVi7baKY5nyudUP8g7DJT3 Lr4oQNx1ft2kuGBrJhohhYDGAndRg6w8fOvRZAA1uOOBWsWSWDrpq1Bvpgj49oPEhdjF tLyg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :mime-version:content-transfer-encoding; bh=JSGDkCoCA2ZrKu65fKy3j8mO1unj2IgbnJ5MIn2kmmE=; b=uJE63MNRxycFABmrZsNvz+VKqfdxtqhKYMss42WWyWJDc6Rz2ONdGkzhCnjRng22yW rOfa9DB2p9BnnESB9jUe7Pwi4MutzUeD19zQsIEDQ54TfBBw2NwshpONhEsphZ8/utxA pCdPSL2iWwrBpcnDG6BVzHM9niayAQr2aitMNuSqoEU70Sgh3l1mjx1CvYru2EjZHrwc 5asWiVy+iD0pBoRBrswsw3LpMZ++dM3no41ihOya1vlZK+PS6LiWoFtRGM0jrUFyPQwN /t00lRO+binTiG7dcwnv1d1O+U9YuVUoYgSicLnyZXhfyjTiA6U5ntieIdLDaNF5gv6N NtpA== X-Gm-Message-State: AOAM532MR9l87vodcuQP6GdC189xIrC9XpTV+HMSa5JwY1POcpWjFyvb Qrrh7hLjGhM9e+iVlXnVqFVDyk18qSc= X-Google-Smtp-Source: ABdhPJzp1NlZdxhoQ5noHmHb/Uj9yZ3EWB90aOE9Zgj8yjUSn4ij4kcFiUupw8dF4A7FHbT2djm2aA== X-Received: by 2002:a5d:6a45:: with SMTP id t5mr49859230wrw.58.1600587836854; Sun, 20 Sep 2020 00:43:56 -0700 (PDT) Received: from sblaptop.fritz.box (ipbcc1fb0f.dynamic.kabel-deutschland.de. [188.193.251.15]) by smtp.gmail.com with ESMTPSA id b188sm26357124wmb.2.2020.09.20.00.43.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 20 Sep 2020 00:43:56 -0700 (PDT) From: Andreas Rheinhardt To: ffmpeg-devel@ffmpeg.org Date: Sun, 20 Sep 2020 09:43:45 +0200 Message-Id: <20200920074346.1517571-1-andreas.rheinhardt@gmail.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH 1/2] avformat/swfenc: Fix memleak upon write_header error X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Andreas Rheinhardt Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" The SWF muxer accepts at most one mp3 audio and at most one VP6F, FLV1 or MJPEG stream. Upon encountering an mp3 stream, a fifo is allocated that leaks if one of the subsequent streams is incompliant with the restrictions mentioned above or if the framerate or samplerate are invalid. This is fixed by adding a deinit function to free said fifo. Signed-off-by: Andreas Rheinhardt --- libavformat/swfenc.c | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/libavformat/swfenc.c b/libavformat/swfenc.c index 9da4aad959..750ec56ec1 100644 --- a/libavformat/swfenc.c +++ b/libavformat/swfenc.c @@ -482,24 +482,13 @@ static int swf_write_trailer(AVFormatContext *s) { SWFContext *swf = s->priv_data; AVIOContext *pb = s->pb; - AVCodecParameters *par, *video_par; - int file_size, i; - - video_par = NULL; - for(i=0;inb_streams;i++) { - par = s->streams[i]->codecpar; - if (par->codec_type == AVMEDIA_TYPE_VIDEO) - video_par = par; - else { - av_fifo_freep(&swf->audio_fifo); - } - } + int file_size; put_swf_tag(s, TAG_END); put_swf_end_tag(s); /* patch file size and number of frames if not streamed */ - if ((s->pb->seekable & AVIO_SEEKABLE_NORMAL) && video_par) { + if ((s->pb->seekable & AVIO_SEEKABLE_NORMAL) && swf->video_par) { file_size = avio_tell(pb); avio_seek(pb, 4, SEEK_SET); avio_wl32(pb, file_size); @@ -514,6 +503,13 @@ static int swf_write_trailer(AVFormatContext *s) return 0; } +static void swf_deinit(AVFormatContext *s) +{ + SWFContext *swf = s->priv_data; + + av_fifo_freep(&swf->audio_fifo); +} + #if CONFIG_SWF_MUXER AVOutputFormat ff_swf_muxer = { .name = "swf", @@ -526,6 +522,7 @@ AVOutputFormat ff_swf_muxer = { .write_header = swf_write_header, .write_packet = swf_write_packet, .write_trailer = swf_write_trailer, + .deinit = swf_deinit, .flags = AVFMT_TS_NONSTRICT, }; #endif @@ -540,6 +537,7 @@ AVOutputFormat ff_avm2_muxer = { .write_header = swf_write_header, .write_packet = swf_write_packet, .write_trailer = swf_write_trailer, + .deinit = swf_deinit, .flags = AVFMT_TS_NONSTRICT, }; #endif