[FFmpeg-devel] [PATCH V2] avformat/dashdec: fix pointer being freed was not allocated

[Steven Liu]

> 在 2019年9月14日，02:01，vectronic <hello.vectronic at gmail.com> 写道：
> 
> prevent attempt to call xmlFree if val was not allocated
> 
> fixes: 8135
> Signed-off-by: vectronic <hello.vectronic at gmail.com>
> ---
> libavformat/dashdec.c | 1 +
> 1 file changed, 1 insertion(+)
> 
> diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
> index 4f725ba09a..4753477fd9 100644
> --- a/libavformat/dashdec.c
> +++ b/libavformat/dashdec.c
> @@ -1185,6 +1185,7 @@ static int parse_programinformation(AVFormatContext *s, xmlNodePtr node)
> 
>     node = xmlFirstElementChild(node);
>     while (node) {
> +        val = NULL;
>         if (!av_strcasecmp(node->name, "Title")) {
>             val = xmlNodeGetContent(node);
>             if (val) {
> -- 
> 2.20.1 (Apple Git-117)
> 
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe”.


What about add it here:

1174 static int parse_programinformation(AVFormatContext *s, xmlNodePtr node)
1175 {
1176     xmlChar *val = NULL;
1177
1178     node = xmlFirstElementChild(node);
1179     while (node) {
1180         if (!av_strcasecmp(node->name, "Title")) {
1181             val = xmlNodeGetContent(node);
1182             if (val) {
1183                 av_dict_set(&s->metadata, "Title", val, 0);
1184             }
1185         } else if (!av_strcasecmp(node->name, "Source")) {
1186             val = xmlNodeGetContent(node);
1187             if (val) {
1188                 av_dict_set(&s->metadata, "Source", val, 0);
1189             }
1190         } else if (!av_strcasecmp(node->name, "Copyright")) {
1191             val = xmlNodeGetContent(node);
1192             if (val) {
1193                 av_dict_set(&s->metadata, "Copyright", val, 0);
1194             }
1195         }
1196         node = xmlNextElementSibling(node);
1197         xmlFree(val);
+ 1198         val = NULL;
1199     }
1200     return 0;
1201 }

Thanks
Steven