virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

avcodec/truemotion2: Avoid duplicating array, fix memleak

Browse Source 
TrueMotion 2.0 uses Huffmann trees. To parse them, the decoder allocates
arrays for the codes, their lengths and their value; afterwards a VLC
table is initialized using these values. If everything up to this point
succeeds, a new buffer of the same size as the already allocated arrays
for the values is allocated and upon success the values are copied into
the new array; all the old arrays are then freed. Yet if allocating the
new array fails, the old arrays get freed, but the VLC table doesn't.

This leak is fixed by not allocating a new array at all; instead the old
array is simply reused, ensuring that nothing can fail after the
creation of the VLC table.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
This commit is contained in:
Andreas Rheinhardt 2020-08-29 09:40:39 +02:00
parent abd58a4192
commit 5ff2ff6bd9
1 changed files with 2 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libavcodec/truemotion2.c
View File

@ -200,8 +200,6 @@ static int tm2_build_huff_table(TM2Context *ctx, TM2Codes *code)
/* convert codes to vlc_table */ /* convert codes to vlc_table */
if (res >= 0) { if (res >= 0) {
int i;
res = init_vlc(&code->vlc, huff.max_bits, huff.max_num, res = init_vlc(&code->vlc, huff.max_bits, huff.max_num,
huff.lens, sizeof(int), sizeof(int), huff.lens, sizeof(int), sizeof(int),
huff.bits, sizeof(uint32_t), sizeof(uint32_t), 0); huff.bits, sizeof(uint32_t), sizeof(uint32_t), 0);
@ -210,13 +208,8 @@ static int tm2_build_huff_table(TM2Context *ctx, TM2Codes *code)
else { else {
code->bits = huff.max_bits; code->bits = huff.max_bits;
code->length = huff.max_num; code->length = huff.max_num;
code->recode = av_malloc_array(code->length, sizeof(int)); code->recode = huff.nums;
if (!code->recode) { huff.nums = NULL;
res = AVERROR(ENOMEM);
goto out;
}
for (i = 0; i < code->length; i++)
code->recode[i] = huff.nums[i];
} }
} }