[FFmpeg-devel] Re: [PATCH 3/3] nutdec: fix various memleaks on failure

[Andreas Cadhalpun]

On 23.05.2015 01:36, Michael Niedermayer wrote:
> On Fri, May 22, 2015 at 11:36:55PM +0200, Andreas Cadhalpun wrote:
>> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
>> ---
>>  libavformat/nutdec.c | 77 +++++++++++++++++++++++++++++++++++++---------------
>>  1 file changed, 55 insertions(+), 22 deletions(-)
>>
>> +fail:
>> +    av_freep(&nut->time_base);
>> +    for (i = 1; i < nut->header_count; i++) {
>> +        av_freep(&nut->header[i]);
>> +    }
> 
> header_count should be reset here too

Fixed.

>> +    return ret;
>>  }
>>  
>>  static int decode_stream_header(NUTContext *nut)
>> @@ -377,9 +394,9 @@ static int decode_stream_header(NUTContext *nut)
>>      AVFormatContext *s = nut->avf;
>>      AVIOContext *bc    = s->pb;
>>      StreamContext *stc;
>> -    int class, stream_id;
>> +    int class, stream_id, ret;
>>      uint64_t tmp, end;
>> -    AVStream *st;
>> +    AVStream *st = 0;
> 
> nitpick: NULL

Fixed.

>>      stc->time_base = &nut->time_base[stc->time_base_id];
>>      avpriv_set_pts_info(s->streams[stream_id], 63, stc->time_base->num,
>>                          stc->time_base->den);
>>      return 0;
>> +fail:
>> +    if (st && st->codec)
>> +        av_freep(&st->codec->extradata);
> 
> extradata_size should maybe be reset here too

Yes, never change extradata without updating extradata_size.

> [...]
>> @@ -1095,10 +1121,14 @@ static int decode_frame(NUTContext *nut, AVPacket *pkt, int frame_code)
>>      pkt->pos = avio_tell(bc); // FIXME
>>      if (stc->last_flags & FLAG_SM_DATA) {
>>          int sm_size;
>> -        if (read_sm_data(s, bc, pkt, 0, pkt->pos + size) < 0)
>> -            return AVERROR_INVALIDDATA;
>> -        if (read_sm_data(s, bc, pkt, 1, pkt->pos + size) < 0)
>> -            return AVERROR_INVALIDDATA;
>> +        if (read_sm_data(s, bc, pkt, 0, pkt->pos + size) < 0) {
>> +            ret = AVERROR_INVALIDDATA;
>> +            goto fail;
>> +        }
>> +        if (read_sm_data(s, bc, pkt, 1, pkt->pos + size) < 0) {
>> +            ret = AVERROR_INVALIDDATA;
>> +            goto fail;
>> +        }
> 
> it seems this function is missing a int ret

It was added in commit af7ca6ea.

But the ret in decode_info_header needs to be initialized now, because it is always used.
I updated the patch accordingly.

Best regards,
Andreas


-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-nutdec-fix-various-memleaks-on-failure.patch
Type: text/x-diff
Size: 8421 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20150523/9312d24c/attachment.bin>