Message ID | AS8P250MB0744C05F96CC8C560B9C4A728FF8A@AS8P250MB0744.EURP250.PROD.OUTLOOK.COM |
---|---|
State | Accepted |
Commit | 378f1b6a393e7bf0ceb50a9454e3664a599d84d1 |
Headers | show |
Series | [FFmpeg-devel] avcodec/evc_ps: Fix leak on error | expand |
Context | Check | Description |
---|---|---|
andriy/make_x86 | success | Make finished |
andriy/make_fate_x86 | success | Make fate finished |
Andreas Rheinhardt: > Regression since 4565747056a11356210ed8edcecb920105e40b60. > Fixes Coverity ticket #1545072. > > Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> > --- > libavcodec/evc_ps.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/libavcodec/evc_ps.c b/libavcodec/evc_ps.c > index 6f93f5b373..64d60f44e2 100644 > --- a/libavcodec/evc_ps.c > +++ b/libavcodec/evc_ps.c > @@ -243,8 +243,10 @@ int ff_evc_parse_sps(GetBitContext *gb, EVCParamSets *ps) > sps->max_num_tid0_ref_pics = get_ue_golomb_31(gb); > else { > sps->sps_max_dec_pic_buffering_minus1 = get_ue_golomb_long(gb); > - if ((unsigned)sps->sps_max_dec_pic_buffering_minus1 > 16 - 1) > - return AVERROR_INVALIDDATA; > + if ((unsigned)sps->sps_max_dec_pic_buffering_minus1 > 16 - 1) { > + ret = AVERROR_INVALIDDATA; > + goto fail; > + } > sps->long_term_ref_pic_flag = get_bits1(gb); > sps->rpl1_same_as_rpl0_flag = get_bits1(gb); > sps->num_ref_pic_list_in_sps[0] = get_ue_golomb(gb); Will apply. - Andreas
diff --git a/libavcodec/evc_ps.c b/libavcodec/evc_ps.c index 6f93f5b373..64d60f44e2 100644 --- a/libavcodec/evc_ps.c +++ b/libavcodec/evc_ps.c @@ -243,8 +243,10 @@ int ff_evc_parse_sps(GetBitContext *gb, EVCParamSets *ps) sps->max_num_tid0_ref_pics = get_ue_golomb_31(gb); else { sps->sps_max_dec_pic_buffering_minus1 = get_ue_golomb_long(gb); - if ((unsigned)sps->sps_max_dec_pic_buffering_minus1 > 16 - 1) - return AVERROR_INVALIDDATA; + if ((unsigned)sps->sps_max_dec_pic_buffering_minus1 > 16 - 1) { + ret = AVERROR_INVALIDDATA; + goto fail; + } sps->long_term_ref_pic_flag = get_bits1(gb); sps->rpl1_same_as_rpl0_flag = get_bits1(gb); sps->num_ref_pic_list_in_sps[0] = get_ue_golomb(gb);
Regression since 4565747056a11356210ed8edcecb920105e40b60. Fixes Coverity ticket #1545072. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> --- libavcodec/evc_ps.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)