@@ -101,10 +101,9 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_sub_ptr,
return AVERROR(ENOMEM);
sub->rects[0] = av_mallocz(sizeof(*sub->rects[0]));
- if (!sub->rects[0]) {
- av_freep(&sub->rects);
+ if (!sub->rects[0])
return AVERROR(ENOMEM);
- }
+ sub->num_rects = 1;
sub->rects[0]->x = x; sub->rects[0]->y = y;
sub->rects[0]->w = w; sub->rects[0]->h = h;
sub->rects[0]->type = SUBTITLE_BITMAP;
@@ -112,14 +111,8 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_sub_ptr,
sub->rects[0]->data[0] = av_malloc(w * h);
sub->rects[0]->nb_colors = 4;
sub->rects[0]->data[1] = av_mallocz(AVPALETTE_SIZE);
- if (!sub->rects[0]->data[0] || !sub->rects[0]->data[1]) {
- av_freep(&sub->rects[0]->data[1]);
- av_freep(&sub->rects[0]->data[0]);
- av_freep(&sub->rects[0]);
- av_freep(&sub->rects);
+ if (!sub->rects[0]->data[0] || !sub->rects[0]->data[1])
return AVERROR(ENOMEM);
- }
- sub->num_rects = 1;
// read palette
for (i = 0; i < sub->rects[0]->nb_colors; i++)
This is possible by incrementing the counter of allocated rects directly after said allocation succeeded. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> --- libavcodec/xsubdec.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-)