[FFmpeg-devel] [PATCH] flacdec: fix memleaks

[Paul B Mahol]

Signed-off-by: Paul B Mahol <onemda at gmail.com>
---
 libavformat/flacdec.c |   18 ++++++++++++++----
 1 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/libavformat/flacdec.c b/libavformat/flacdec.c
index 08bf538..14379b4 100644
--- a/libavformat/flacdec.c
+++ b/libavformat/flacdec.c
@@ -231,25 +231,35 @@ static int flac_read_header(AVFormatContext *s)
             uint64_t start;
             const uint8_t *offset;
             int i, chapters, track, ti;
-            if (metadata_size < 431)
+            if (metadata_size < 431) {
+                av_freep(&buffer);
                 return AVERROR_INVALIDDATA;
+            }
             offset = buffer + 395;
             chapters = bytestream_get_byte(&offset) - 1;
-            if (chapters <= 0)
+            if (chapters <= 0) {
+                av_freep(&buffer);
                 return AVERROR_INVALIDDATA;
+            }
             for (i = 0; i < chapters; i++) {
-                if (offset + 36 - buffer > metadata_size)
+                if (offset + 36 - buffer > metadata_size) {
+                    av_freep(&buffer);
                     return AVERROR_INVALIDDATA;
+                }
                 start = bytestream_get_be64(&offset);
                 track = bytestream_get_byte(&offset);
                 bytestream_get_buffer(&offset, isrc, 12);
                 isrc[12] = 0;
                 offset += 14;
                 ti = bytestream_get_byte(&offset);
-                if (ti <= 0) return AVERROR_INVALIDDATA;
+                if (ti <= 0) {
+                    av_freep(&buffer);
+                    return AVERROR_INVALIDDATA;
+                }
                 offset += ti * 12;
                 avpriv_new_chapter(s, track, st->time_base, start, AV_NOPTS_VALUE, isrc);
             }
+            av_freep(&buffer);
         } else if (metadata_type == FLAC_METADATA_TYPE_PICTURE) {
             ret = parse_picture(s, buffer, metadata_size);
             av_freep(&buffer);
-- 
1.7.7