From a4a71b5e9d7d69cb6e3a9534dbcde69bcfa79ba7 Mon Sep 17 00:00:00 2001 From: Lidong Yan Date: Mon, 30 Jun 2025 23:01:12 +0800 Subject: [PATCH] avfilter/asrc_sinc: fix leak in config_input() In config_input(), fir_to_phase() allocates memory in h[longer], which would leak if av_calloc() to s->coeffs failed. lpf() allocates memory in h[0] and h[1], which would leak if fir_to_phase() failed. To fix this leak, add av_free(h[longer]) in as cleanup code, and replace return AVERROR* with goto cleanup to prevent from leaks. Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn> Signed-off-by: Michael Niedermayer --- libavfilter/asrc_sinc.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/libavfilter/asrc_sinc.c b/libavfilter/asrc_sinc.c index 6ff3303316..05cf53fed8 100644 --- a/libavfilter/asrc_sinc.c +++ b/libavfilter/asrc_sinc.c @@ -329,7 +329,7 @@ static int config_output(AVFilterLink *outlink) SincContext *s = ctx->priv; float Fn = s->sample_rate * .5f; float *h[2]; - int i, n, post_peak, longer; + int i, n, post_peak, longer, ret; outlink->sample_rate = s->sample_rate; s->pts = 0; @@ -360,9 +360,9 @@ static int config_output(AVFilterLink *outlink) } if (s->phase != 50.f) { - int ret = fir_to_phase(s, &h[longer], &n, &post_peak, s->phase); + ret = fir_to_phase(s, &h[longer], &n, &post_peak, s->phase); if (ret < 0) - return ret; + goto cleanup; } else { post_peak = n >> 1; } @@ -370,17 +370,21 @@ static int config_output(AVFilterLink *outlink) s->n = 1 << (av_log2(n) + 1); s->rdft_len = 1 << av_log2(n); s->coeffs = av_calloc(s->n, sizeof(*s->coeffs)); - if (!s->coeffs) - return AVERROR(ENOMEM); + if (!s->coeffs) { + ret = AVERROR(ENOMEM); + goto cleanup; + } for (i = 0; i < n; i++) s->coeffs[i] = h[longer][i]; - av_free(h[longer]); av_tx_uninit(&s->tx); av_tx_uninit(&s->itx); + ret = 0; - return 0; +cleanup: + av_free(h[longer]); + return ret; } static av_cold void uninit(AVFilterContext *ctx)