Message ID | 20201105231110.7772-4-michael@niedermayer.cc |
---|---|
State | Accepted |
Commit | d16974c3dd3a05900aa080ea0729284aea358d10 |
Headers | show |
Series | [FFmpeg-devel,1/7,RFC] Revert "avcodec/adpcm_swf: support decoding multiple fixed-sized blocks at once" | expand |
Context | Check | Description |
---|---|---|
andriy/x86_make | success | Make finished |
andriy/x86_make_fate | success | Make fate finished |
Michael Niedermayer: > Fixes: memleak > Fixes: 26841/clusterfuzz-testcase-minimized-ffmpeg_dem_AU_fuzzer-5174166309044224 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/au.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/libavformat/au.c b/libavformat/au.c > index b4eb4f8477..4f2b81119f 100644 > --- a/libavformat/au.c > +++ b/libavformat/au.c > @@ -84,8 +84,11 @@ static int au_read_annotation(AVFormatContext *s, int size) > av_bprint_init(&bprint, 64, AV_BPRINT_SIZE_UNLIMITED); > > while (size-- > 0) { > - if (avio_feof(pb)) > + if (avio_feof(pb)) { > + av_bprint_finalize(&bprint, NULL); > + av_freep(&key); > return AVERROR_EOF; > + } > c = avio_r8(pb); > switch(state) { > case PARSE_KEY: > You could reuse the ordinary freeing code at the end of the function. LGTM either way. (That's a regression since e680d50eb4feddafb2d8575b21fc5fc8764f4801, isn't it?) - Andreas
On Fri, Nov 06, 2020 at 12:29:37AM +0100, Andreas Rheinhardt wrote: > Michael Niedermayer: > > Fixes: memleak > > Fixes: 26841/clusterfuzz-testcase-minimized-ffmpeg_dem_AU_fuzzer-5174166309044224 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavformat/au.c | 5 ++++- > > 1 file changed, 4 insertions(+), 1 deletion(-) > > > > diff --git a/libavformat/au.c b/libavformat/au.c > > index b4eb4f8477..4f2b81119f 100644 > > --- a/libavformat/au.c > > +++ b/libavformat/au.c > > @@ -84,8 +84,11 @@ static int au_read_annotation(AVFormatContext *s, int size) > > av_bprint_init(&bprint, 64, AV_BPRINT_SIZE_UNLIMITED); > > > > while (size-- > 0) { > > - if (avio_feof(pb)) > > + if (avio_feof(pb)) { > > + av_bprint_finalize(&bprint, NULL); > > + av_freep(&key); > > return AVERROR_EOF; > > + } > > c = avio_r8(pb); > > switch(state) { > > case PARSE_KEY: > > > You could reuse the ordinary freeing code at the end of the function. > LGTM either way. (That's a regression since > e680d50eb4feddafb2d8575b21fc5fc8764f4801, isn't it?) will add a note about the regression an will apply thx [...]
diff --git a/libavformat/au.c b/libavformat/au.c index b4eb4f8477..4f2b81119f 100644 --- a/libavformat/au.c +++ b/libavformat/au.c @@ -84,8 +84,11 @@ static int au_read_annotation(AVFormatContext *s, int size) av_bprint_init(&bprint, 64, AV_BPRINT_SIZE_UNLIMITED); while (size-- > 0) { - if (avio_feof(pb)) + if (avio_feof(pb)) { + av_bprint_finalize(&bprint, NULL); + av_freep(&key); return AVERROR_EOF; + } c = avio_r8(pb); switch(state) { case PARSE_KEY:
Fixes: memleak Fixes: 26841/clusterfuzz-testcase-minimized-ffmpeg_dem_AU_fuzzer-5174166309044224 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/au.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)