From: Steven Liu <liuq...@kuaishou.com> Because the s->buffer has been freed by av_freep in avio_closep. It should not av_freep the buffer in label fail after avio_closep. Then just move the av_freep before avio_closep and remove the label fail.
Reported-by: TOTE Robot <os...@tsinghua.edu.cn> Signed-off-by: Steven Liu <liuq...@kuaishou.com> --- libavformat/aviobuf.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c index 5da4dea7b6..3fbb942e76 100644 --- a/libavformat/aviobuf.c +++ b/libavformat/aviobuf.c @@ -977,18 +977,19 @@ int ffio_fdopen(AVIOContext **s, URLContext *h) (int (*)(void *, uint8_t *, int)) ffurl_read, (int (*)(void *, uint8_t *, int)) ffurl_write, (int64_t (*)(void *, int64_t, int))ffurl_seek); - if (!*s) - goto fail; - + if (!*s) { + av_freep(&buffer); + return AVERROR(ENOMEM); + } (*s)->protocol_whitelist = av_strdup(h->protocol_whitelist); if (!(*s)->protocol_whitelist && h->protocol_whitelist) { avio_closep(s); - goto fail; + return AVERROR(ENOMEM); } (*s)->protocol_blacklist = av_strdup(h->protocol_blacklist); if (!(*s)->protocol_blacklist && h->protocol_blacklist) { avio_closep(s); - goto fail; + return AVERROR(ENOMEM); } (*s)->direct = h->flags & AVIO_FLAG_DIRECT; @@ -1006,9 +1007,6 @@ int ffio_fdopen(AVIOContext **s, URLContext *h) ((FFIOContext*)(*s))->short_seek_get = (int (*)(void *))ffurl_get_short_seek; (*s)->av_class = &ff_avio_class; return 0; -fail: - av_freep(&buffer); - return AVERROR(ENOMEM); } URLContext* ffio_geturlcontext(AVIOContext *s) -- 2.25.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".