[FFmpeg-devel] [PATCH 4/5] avformat/avc: free buffer in ff_isom_write_avcc on failure

[Michael Niedermayer]

On Tue, Nov 28, 2017 at 10:43:02PM -0300, James Almer wrote:
> Signed-off-by: James Almer <jamrial at gmail.com>
> ---
>  libavformat/avc.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
> 
> diff --git a/libavformat/avc.c b/libavformat/avc.c
> index 7542db684b..6ef6e08778 100644
> --- a/libavformat/avc.c
> +++ b/libavformat/avc.c
> @@ -145,8 +145,10 @@ int ff_isom_write_avcc(AVIOContext *pb, const uint8_t *data, int len)
>          buf += size;
>      }
>  
> -    if (!sps || !pps || sps_size < 4 || sps_size > UINT16_MAX || pps_size > UINT16_MAX)
> -        return AVERROR_INVALIDDATA;
> +    if (!sps || !pps || sps_size < 4 || sps_size > UINT16_MAX || pps_size > UINT16_MAX) {
> +        ret = AVERROR_INVALIDDATA;
> +        goto fail;
> +    }
>  
>      avio_w8(pb, 1); /* version */
>      avio_w8(pb, sps[1]); /* profile */
> @@ -160,9 +162,11 @@ int ff_isom_write_avcc(AVIOContext *pb, const uint8_t *data, int len)
>      avio_w8(pb, 1); /* number of pps */
>      avio_wb16(pb, pps_size);
>      avio_write(pb, pps, pps_size);
> +
> +fail:
>      av_free(start);

LGTM, but please set start = NULL at th top so "goto fail" is safe
at any point not just the current points

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Avoid a single point of failure, be that a person or equipment.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20171130/004742fb/attachment.sig>