| Message ID | 20240205025823.4259-2-michael@niedermayer.cc |
|---|---|
| State | New |
| Headers | show |
| Series | [FFmpeg-devel,1/2] avcodec/ac3enc_template: add fbw_channels assert | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
Michael Niedermayer: > Fixes: CID 1403229 Dereference after null check > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavfilter/signature_lookup.c | 25 ++++++++++++++----------- > 1 file changed, 14 insertions(+), 11 deletions(-) > > diff --git a/libavfilter/signature_lookup.c b/libavfilter/signature_lookup.c > index 86dd0c66754..6e45fde1b5a 100644 > --- a/libavfilter/signature_lookup.c > +++ b/libavfilter/signature_lookup.c > @@ -37,6 +37,14 @@ > #define STATUS_END_REACHED 1 > #define STATUS_BEGIN_REACHED 2 > > +static void sll_free(MatchingInfo **sll) > +{ > + while (*sll) { > + sll = &(*sll)->next; > + av_freep(sll); > + } > +} > + This will leak every element except the second (if existing) of the linked list. > static void fill_l1distlut(uint8_t lut[]) > { > int i, j, tmp_i, tmp_j,count; > @@ -290,6 +298,10 @@ static MatchingInfo* get_matching_parameters(AVFilterContext *ctx, SignatureCont > av_log(ctx, AV_LOG_FATAL, "Could not allocate memory"); > c = c->next; > } > + if (!c) { > + sll_free(&cands); > + goto error; > + } > c->framerateratio = (i+1.0) / 30; > c->score = hspace[i][j].score; > c->offset = j-90; > @@ -305,6 +317,7 @@ static MatchingInfo* get_matching_parameters(AVFilterContext *ctx, SignatureCont > } > } > } > + error: > for (i = 0; i < MAX_FRAMERATE; i++) { > av_freep(&hspace[i]); > } > @@ -520,16 +533,6 @@ static MatchingInfo evaluate_parameters(AVFilterContext *ctx, SignatureContext * > return bestmatch; > } > > -static void sll_free(MatchingInfo *sll) > -{ > - void *tmp; > - while (sll) { > - tmp = sll; > - sll = sll->next; > - av_freep(&tmp); > - } > -} > - > static MatchingInfo lookup_signatures(AVFilterContext *ctx, SignatureContext *sc, StreamContext *first, StreamContext *second, int mode) > { > CoarseSignature *cs, *cs2; > @@ -572,7 +575,7 @@ static MatchingInfo lookup_signatures(AVFilterContext *ctx, SignatureContext *sc > "ratio %f, offset %d, score %d, %d frames matching\n", > bestmatch.first->index, bestmatch.second->index, > bestmatch.framerateratio, bestmatch.offset, bestmatch.score, bestmatch.matchframes); > - sll_free(infos); > + sll_free(&infos); > } > } while (find_next_coarsecandidate(sc, second->coarsesiglist, &cs, &cs2, 0) && !bestmatch.whole); > return bestmatch;
On Mon, Feb 05, 2024 at 11:35:54AM +0100, Andreas Rheinhardt wrote: > Michael Niedermayer: > > Fixes: CID 1403229 Dereference after null check > > > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavfilter/signature_lookup.c | 25 ++++++++++++++----------- > > 1 file changed, 14 insertions(+), 11 deletions(-) > > > > diff --git a/libavfilter/signature_lookup.c b/libavfilter/signature_lookup.c > > index 86dd0c66754..6e45fde1b5a 100644 > > --- a/libavfilter/signature_lookup.c > > +++ b/libavfilter/signature_lookup.c > > @@ -37,6 +37,14 @@ > > #define STATUS_END_REACHED 1 > > #define STATUS_BEGIN_REACHED 2 > > > > +static void sll_free(MatchingInfo **sll) > > +{ > > + while (*sll) { > > + sll = &(*sll)->next; > > + av_freep(sll); > > + } > > +} > > + > > This will leak every element except the second (if existing) of the > linked list. ill post a better and split patch thx [...]
diff --git a/libavfilter/signature_lookup.c b/libavfilter/signature_lookup.c index 86dd0c66754..6e45fde1b5a 100644 --- a/libavfilter/signature_lookup.c +++ b/libavfilter/signature_lookup.c @@ -37,6 +37,14 @@ #define STATUS_END_REACHED 1 #define STATUS_BEGIN_REACHED 2 +static void sll_free(MatchingInfo **sll) +{ + while (*sll) { + sll = &(*sll)->next; + av_freep(sll); + } +} + static void fill_l1distlut(uint8_t lut[]) { int i, j, tmp_i, tmp_j,count; @@ -290,6 +298,10 @@ static MatchingInfo* get_matching_parameters(AVFilterContext *ctx, SignatureCont av_log(ctx, AV_LOG_FATAL, "Could not allocate memory"); c = c->next; } + if (!c) { + sll_free(&cands); + goto error; + } c->framerateratio = (i+1.0) / 30; c->score = hspace[i][j].score; c->offset = j-90; @@ -305,6 +317,7 @@ static MatchingInfo* get_matching_parameters(AVFilterContext *ctx, SignatureCont } } } + error: for (i = 0; i < MAX_FRAMERATE; i++) { av_freep(&hspace[i]); } @@ -520,16 +533,6 @@ static MatchingInfo evaluate_parameters(AVFilterContext *ctx, SignatureContext * return bestmatch; } -static void sll_free(MatchingInfo *sll) -{ - void *tmp; - while (sll) { - tmp = sll; - sll = sll->next; - av_freep(&tmp); - } -} - static MatchingInfo lookup_signatures(AVFilterContext *ctx, SignatureContext *sc, StreamContext *first, StreamContext *second, int mode) { CoarseSignature *cs, *cs2; @@ -572,7 +575,7 @@ static MatchingInfo lookup_signatures(AVFilterContext *ctx, SignatureContext *sc "ratio %f, offset %d, score %d, %d frames matching\n", bestmatch.first->index, bestmatch.second->index, bestmatch.framerateratio, bestmatch.offset, bestmatch.score, bestmatch.matchframes); - sll_free(infos); + sll_free(&infos); } } while (find_next_coarsecandidate(sc, second->coarsesiglist, &cs, &cs2, 0) && !bestmatch.whole); return bestmatch;
Fixes: CID 1403229 Dereference after null check Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavfilter/signature_lookup.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-)