diff mbox series

[FFmpeg-devel,4/4] avfilter/af_aiir: Avoid unchecked allocation

Message ID GV1P250MB0737EE60A2A8EC559EC02D568FF52@GV1P250MB0737.EURP250.PROD.OUTLOOK.COM
State Accepted
Commit 21bfc62642cb16fc3d867999db341d3c67e03404
Headers show
Series [FFmpeg-devel,1/4] avfilter/vf_signalstats: Use 64bit for processing histogram | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 success Make fate finished
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Andreas Rheinhardt May 24, 2024, 8:05 a.m. UTC 
W has not been checked at all; allocate it jointly with M
to fix this.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
---
 libavfilter/af_aiir.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)
diff mbox series

Patch

diff --git a/libavfilter/af_aiir.c b/libavfilter/af_aiir.c
index 324fc367a3..7bd9e37e43 100644
--- a/libavfilter/af_aiir.c
+++ b/libavfilter/af_aiir.c
@@ -828,17 +828,17 @@  static int convert_serial2parallel(AVFilterContext *ctx, int channels)
         double *impulse = av_calloc(length, sizeof(*impulse));
         double *y = av_calloc(length, sizeof(*y));
         double *resp = av_calloc(length, sizeof(*resp));
-        double *M = av_calloc((length - 1) * 2 * nb_biquads, sizeof(*M));
-        double *W = av_calloc((length - 1) * 2 * nb_biquads, sizeof(*W));
+        double *M = av_calloc((length - 1) * nb_biquads, 2 * 2 * sizeof(*M));
+        double *W;
 
         if (!impulse || !y || !resp || !M) {
             av_free(impulse);
             av_free(y);
             av_free(resp);
             av_free(M);
-            av_free(W);
             return AVERROR(ENOMEM);
         }
+        W = M + (length - 1) * 2 * nb_biquads;
 
         impulse[0] = 1.;
 
@@ -877,7 +877,6 @@  static int convert_serial2parallel(AVFilterContext *ctx, int channels)
         av_free(y);
         av_free(resp);
         av_free(M);
-        av_free(W);
     }
 
     return 0;