[FFmpeg-cvslog] avfilter/af_headphone: fix memory leak and overread

[Paul B Mahol]

ffmpeg | branch: master | Paul B Mahol <onemda at gmail.com> | Sat Apr 14 19:42:16 2018 +0200| [a56580b117362bf1b082cbbd6e3e573380c3aff8] | committer: Paul B Mahol

avfilter/af_headphone: fix memory leak and overread

Signed-off-by: Paul B Mahol <onemda at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a56580b117362bf1b082cbbd6e3e573380c3aff8
---

 libavfilter/af_headphone.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/libavfilter/af_headphone.c b/libavfilter/af_headphone.c
index edb1fac70f..8b34609a2f 100644
--- a/libavfilter/af_headphone.c
+++ b/libavfilter/af_headphone.c
@@ -747,15 +747,19 @@ static int request_frame(AVFilterLink *outlink)
     ret = ff_request_frame(ctx->inputs[0]);
     if (ret == AVERROR_EOF && av_audio_fifo_size(s->in[0].fifo) > 0 && s->have_hrirs) {
         int nb_samples = av_audio_fifo_size(s->in[0].fifo);
-        AVFrame *in = ff_get_audio_buffer(outlink, s->size - nb_samples);
+        AVFrame *in = ff_get_audio_buffer(ctx->inputs[0], s->size - nb_samples);
+
+        if (!in)
+            return AVERROR(ENOMEM);
 
         av_samples_set_silence(in->extended_data, 0,
                                in->nb_samples,
-                               outlink->channels,
-                               outlink->format);
+                               in->channels,
+                               in->format);
 
         ret = av_audio_fifo_write(s->in[0].fifo, (void **)in->extended_data,
                                   in->nb_samples);
+        av_frame_free(&in);
         if (ret < 0)
             return ret;
         ret = headphone_frame(s, outlink, nb_samples);