In the file ffmpeg_mux_init.c located at /FFmpeg/fftools/, a pointer variable
named pts is defined at line 2830. At line 2836, this pointer is allocated a
dynamic memory area using the function av_malloc_array. When the if statement
at line 2852 evaluates to true, there are two possible scenarios. The first
scenario is when nb_ch > INT_MAX - size. In this case, the program should
release the dynamic memory area pointed to by pts before returning. The second
scenario is when the realloc operation for the pts pointer fails. In this case,
since the av_realloc_f function releases the original memory in case of
reallocation failure, there is no need to release the memory area pointed to by
pts. Because the handling of these two scenarios differs, to fix the memory
leak issue caused by the first scenario, my patch separates the treatment of
these cases.
Signed-off-by: LuMingYin <lumingyindet...@163.com>
---
fftools/ffmpeg_mux_init.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/fftools/ffmpeg_mux_init.c b/fftools/ffmpeg_mux_init.c
index 6d8bd5bcdf..1f27e4e4f4 100644
--- a/fftools/ffmpeg_mux_init.c
+++ b/fftools/ffmpeg_mux_init.c
@@ -2849,8 +2849,12 @@ static int parse_forced_key_frames(void *log,
KeyframeForceCtx *kf,
unsigned int nb_ch = mux->fc->nb_chapters;
int j;
- if (nb_ch > INT_MAX - size ||
- !(pts = av_realloc_f(pts, size += nb_ch - 1,
+ if (nb_ch > INT_MAX - size) {
+ av_freep(&pts);
+ return AVERROR(ENOMEM);
+ }
+
+ if (!(pts = av_realloc_f(pts, size += nb_ch - 1,
sizeof(*pts))))
return AVERROR(ENOMEM);
--
2.25.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
