Andreas Rheinhardt (12021-07-28):
> > -    if ((ret = avformat_open_input(&cat->avf, file->url, NULL, NULL)) < 0 
> > ||
> > +    ret = av_dict_copy(&options, file->options, 0);
> > +    if (ret < 0)
> > +        return ret;
> > +
> > +    if ((ret = avformat_open_input(&cat->avf, file->url, NULL, &options)) 
> > < 0 ||
> >          (ret = avformat_find_stream_info(cat->avf, NULL)) < 0) {
> >          av_log(avf, AV_LOG_ERROR, "Impossible to open '%s'\n", file->url);
> >          avformat_close_input(&cat->avf);
> >          return ret;
> 
> options would leak here.

Fixed.

> > +            if (!(key = av_get_token((const char **)&cursor, SPACE_CHARS)) 
> > ||
> > +                !(val = av_get_token((const char **)&cursor, 
> > SPACE_CHARS))) {
> > +                av_log(avf, AV_LOG_ERROR, "Line %d: key and val 
> > required\n", line);
> > +                FAIL(AVERROR_INVALIDDATA);
> 
> 1. key might leak here.
> 
> 2. The error message and the return code are wrong: av_get_token() only
> fails upon allocation error; it does not fail when *cursor == \0.

Fixed.

> (The code already suffers from this misconception.)

I intend to rewrite the parser entirely at some point.

> 
> > +            }
> > +            ret = av_dict_set(&file->options, key, val,
> > +                              AV_DICT_DONT_STRDUP_KEY | 
> > AV_DICT_DONT_STRDUP_VAL);
> > +            if (ret < 0) {
> > +                av_freep(&key);
> > +                av_freep(&val);
> 
> Double free.

Uh? Oh, I had the logic backwards. Fixed.

Will send a new series soon.

Regards,

-- 
  Nicolas George

Attachment: signature.asc
Description: PGP signature

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".

Reply via email to