virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-10 06:10:52 +02:00
Code Issues Releases Activity

avutil/dict: Fix memleak when using AV_DICT_APPEND

Browse Source 
If a key already exists in an AVDictionary and the AV_DICT_APPEND flag
is set, the old entry is at first discarded from the dictionary, but
a pointer to the value is kept. Lateron enough memory to store the
appended string is allocated; should this allocation fail, the old string
is not freed and hence leaks. This commit changes this by moving
creating the combined value to an earlier point in the function,
which also ensures that the AVDictionary is unchanged in case of errors.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This commit is contained in:
Andreas Rheinhardt
2022-09-13 20:57:05 +02:00
parent f976ed7fcf
commit c15dd31d2a
1 changed files with 12 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
libavutil/dict.c
View File

@@ -73,7 +73,7 @@ int av_dict_set(AVDictionary **pm, const char *key, const char *value,
{
AVDictionary *m = *pm;
AVDictionaryEntry *tag = NULL;
char *oldval = NULL, *copy_key = NULL, *copy_value = NULL;
char *copy_key = NULL, *copy_value = NULL;
if (!(flags & AV_DICT_MULTIKEY)) {
tag = av_dict_get(m, key, NULL, flags);
@@ -97,9 +97,16 @@ int av_dict_set(AVDictionary **pm, const char *key, const char *value,
av_free(copy_value);
return 0;
}
if (flags & AV_DICT_APPEND)
oldval = tag->value;
else
if (copy_value && flags & AV_DICT_APPEND) {
size_t len = strlen(tag->value) + strlen(copy_value) + 1;
char *newval = av_mallocz(len);
if (!newval)
goto err_out;
av_strlcat(newval, tag->value, len);
av_strlcat(newval, copy_value, len);
av_freep(&copy_value);
copy_value = newval;
}
av_free(tag->value);
av_free(tag->key);
*tag = m->elems[--m->count];
@@ -113,17 +120,6 @@ int av_dict_set(AVDictionary **pm, const char *key, const char *value,
if (copy_value) {
m->elems[m->count].key = copy_key;
m->elems[m->count].value = copy_value;
if (oldval && flags & AV_DICT_APPEND) {
size_t len = strlen(oldval) + strlen(copy_value) + 1;
char *newval = av_mallocz(len);
if (!newval)
goto err_out;
av_strlcat(newval, oldval, len);
av_freep(&oldval);
av_strlcat(newval, copy_value, len);
m->elems[m->count].value = newval;
av_freep(&copy_value);
}
m->count++;
} else {
if (!m->count) {