ffmpeg | branch: release/3.1 | James Almer <jamr...@gmail.com> | Sat Nov 19 12:38:44 2016 -0300| [c3f97bf54496ee15a848683c3ca8772367cba216] | committer: James Almer
avcodec/avpacket: fix leak on realloc in av_packet_add_side_data() If realloc fails, the pointer is overwritten and the previously allocated buffer is leaked, which goes against the expected behavior of keeping the packet unchanged in case of error. Michael Niedermayer <mich...@niedermayer.cc> Signed-off-by: James Almer <jamr...@gmail.com> (cherry picked from commit 574929d8b6de32ae712fcca7ab09f01a3e4616be) > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c3f97bf54496ee15a848683c3ca8772367cba216 --- libavcodec/avpacket.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/libavcodec/avpacket.c b/libavcodec/avpacket.c index bb0fc6c..443a19a 100644 --- a/libavcodec/avpacket.c +++ b/libavcodec/avpacket.c @@ -295,16 +295,17 @@ FF_ENABLE_DEPRECATION_WARNINGS int av_packet_add_side_data(AVPacket *pkt, enum AVPacketSideDataType type, uint8_t *data, size_t size) { + AVPacketSideData *tmp; int elems = pkt->side_data_elems; if ((unsigned)elems + 1 > INT_MAX / sizeof(*pkt->side_data)) return AVERROR(ERANGE); - pkt->side_data = av_realloc(pkt->side_data, - (elems + 1) * sizeof(*pkt->side_data)); - if (!pkt->side_data) + tmp = av_realloc(pkt->side_data, (elems + 1) * sizeof(*tmp)); + if (!tmp) return AVERROR(ENOMEM); + pkt->side_data = tmp; pkt->side_data[elems].data = data; pkt->side_data[elems].size = size; pkt->side_data[elems].type = type; _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
