> On Dec 1, 2021, at 11:25 AM, Steven Liu <l...@chinaffmpeg.org> wrote:
>
> From: Steven Liu <liuq...@kuaishou.com>
>
> Because the s->buffer has been freed by av_freep in avio_closep.
> It should not av_freep the buffer in label fail after avio_closep.
> Then just move the av_freep before avio_closep and remove the label fail.
The patch LGTM, but the subject should be changed to reflect the
key point of the patch: fix double free.
>
> Reported-by: TOTE Robot <os...@tsinghua.edu.cn>
> Signed-off-by: Steven Liu <liuq...@kuaishou.com>
> ---
> libavformat/aviobuf.c | 14 ++++++--------
> 1 file changed, 6 insertions(+), 8 deletions(-)
>
> diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
> index 5da4dea7b6..3fbb942e76 100644
> --- a/libavformat/aviobuf.c
> +++ b/libavformat/aviobuf.c
> @@ -977,18 +977,19 @@ int ffio_fdopen(AVIOContext **s, URLContext *h)
> (int (*)(void *, uint8_t *, int)) ffurl_read,
> (int (*)(void *, uint8_t *, int)) ffurl_write,
> (int64_t (*)(void *, int64_t, int))ffurl_seek);
> - if (!*s)
> - goto fail;
> -
> + if (!*s) {
> + av_freep(&buffer);
> + return AVERROR(ENOMEM);
> + }
> (*s)->protocol_whitelist = av_strdup(h->protocol_whitelist);
> if (!(*s)->protocol_whitelist && h->protocol_whitelist) {
> avio_closep(s);
> - goto fail;
> + return AVERROR(ENOMEM);
> }
> (*s)->protocol_blacklist = av_strdup(h->protocol_blacklist);
> if (!(*s)->protocol_blacklist && h->protocol_blacklist) {
> avio_closep(s);
> - goto fail;
> + return AVERROR(ENOMEM);
> }
> (*s)->direct = h->flags & AVIO_FLAG_DIRECT;
>
> @@ -1006,9 +1007,6 @@ int ffio_fdopen(AVIOContext **s, URLContext *h)
> ((FFIOContext*)(*s))->short_seek_get = (int (*)(void
> *))ffurl_get_short_seek;
> (*s)->av_class = &ff_avio_class;
> return 0;
> -fail:
> - av_freep(&buffer);
> - return AVERROR(ENOMEM);
> }
>
> URLContext* ffio_geturlcontext(AVIOContext *s)
> --
> 2.25.0
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
