virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-15 14:13:16 +02:00
Code Issues Releases Activity

avcodec/avpacket: fix leak on realloc in av_packet_add_side_data()

Browse Source 
If realloc fails, the pointer is overwritten and the previously allocated
buffer is leaked, which goes against the expected behavior of keeping the
packet unchanged in case of error.

Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
This commit is contained in:
James Almer
2016-11-19 12:38:44 -03:00
parent 0ffea35657
commit 574929d8b6
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/avpacket.c
View File

@@ -295,16 +295,17 @@ FF_ENABLE_DEPRECATION_WARNINGS
int av_packet_add_side_data(AVPacket *pkt, enum AVPacketSideDataType type, int av_packet_add_side_data(AVPacket *pkt, enum AVPacketSideDataType type,
uint8_t *data, size_t size) uint8_t *data, size_t size)
{ {
AVPacketSideData *tmp;
int elems = pkt->side_data_elems; int elems = pkt->side_data_elems;
if ((unsigned)elems + 1 > INT_MAX / sizeof(*pkt->side_data)) if ((unsigned)elems + 1 > INT_MAX / sizeof(*pkt->side_data))
return AVERROR(ERANGE); return AVERROR(ERANGE);
pkt->side_data = av_realloc(pkt->side_data, tmp = av_realloc(pkt->side_data, (elems + 1) * sizeof(*tmp));
(elems + 1) * sizeof(*pkt->side_data)); if (!tmp)
if (!pkt->side_data)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
pkt->side_data = tmp;
pkt->side_data[elems].data = data; pkt->side_data[elems].data = data;
pkt->side_data[elems].size = size; pkt->side_data[elems].size = size;
pkt->side_data[elems].type = type; pkt->side_data[elems].type = type;