[FFmpeg-cvslog] avformat/au: cleanup on EOF return in au_read_annotation()

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Thu Nov  5 20:23:54 2020 +0100| [d16974c3dd3a05900aa080ea0729284aea358d10] | committer: Michael Niedermayer

avformat/au: cleanup on EOF return in au_read_annotation()

Fixes: memleak
Fixes: 26841/clusterfuzz-testcase-minimized-ffmpeg_dem_AU_fuzzer-5174166309044224
Regression since: e680d50eb4feddafb2d8575b21fc5fc8764f4801
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt at gmail.com>

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d16974c3dd3a05900aa080ea0729284aea358d10
---

 libavformat/au.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libavformat/au.c b/libavformat/au.c
index b4eb4f8477..4f2b81119f 100644
--- a/libavformat/au.c
+++ b/libavformat/au.c
@@ -84,8 +84,11 @@ static int au_read_annotation(AVFormatContext *s, int size)
     av_bprint_init(&bprint, 64, AV_BPRINT_SIZE_UNLIMITED);
 
     while (size-- > 0) {
-        if (avio_feof(pb))
+        if (avio_feof(pb)) {
+            av_bprint_finalize(&bprint, NULL);
+            av_freep(&key);
             return AVERROR_EOF;
+        }
         c = avio_r8(pb);
         switch(state) {
         case PARSE_KEY: