[FFmpeg-cvslog] avformat/avc: free buffer in ff_isom_write_avcc on failure

[James Almer]

ffmpeg | branch: master | James Almer <jamrial at gmail.com> | Fri Nov 24 20:26:08 2017 -0300| [d5af8afbe4698273b2ef9b57487489b40f7888b1] | committer: James Almer

avformat/avc: free buffer in ff_isom_write_avcc on failure

Reviewed-by: Michael Niedermayer <michael at niedermayer.cc>
Signed-off-by: James Almer <jamrial at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d5af8afbe4698273b2ef9b57487489b40f7888b1
---

 libavformat/avc.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/libavformat/avc.c b/libavformat/avc.c
index 85441df8f7..d989594bb0 100644
--- a/libavformat/avc.c
+++ b/libavformat/avc.c
@@ -145,8 +145,10 @@ int ff_isom_write_avcc(AVIOContext *pb, const uint8_t *data, int len)
         buf += size;
     }
 
-    if (!sps || !pps || sps_size < 4 || sps_size > UINT16_MAX || pps_size > UINT16_MAX)
-        return AVERROR_INVALIDDATA;
+    if (!sps || !pps || sps_size < 4 || sps_size > UINT16_MAX || pps_size > UINT16_MAX) {
+        ret = AVERROR_INVALIDDATA;
+        goto fail;
+    }
 
     avio_w8(pb, 1); /* version */
     avio_w8(pb, sps[1]); /* profile */
@@ -160,9 +162,11 @@ int ff_isom_write_avcc(AVIOContext *pb, const uint8_t *data, int len)
     avio_w8(pb, 1); /* number of pps */
     avio_wb16(pb, pps_size);
     avio_write(pb, pps, pps_size);
+
+fail:
     av_free(start);
 
-    return 0;
+    return ret;
 }
 
 int ff_avc_write_annexb_extradata(const uint8_t *in, uint8_t **buf, int *size)