Browse Source

avformat/mxfdec: Fix memleak upon repeating tags

When parsing MXF encountering some tags leads to allocations. And when
these tags were encountered repeatedly, this could lead to memleaks,
because the pointer to the old data got simply overwritten with a
pointer to the new data (or to NULL on allocation failure). This has
been fixed.

Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
tags/n4.4
Andreas Rheinhardt 5 years ago
parent
commit
28ce651c6d
1 changed files with 1 additions and 2 deletions
  1. +1
    -2
      libavformat/mxfdec.c

+ 1
- 2
libavformat/mxfdec.c View File

@@ -850,6 +850,7 @@ static int mxf_read_cryptographic_context(void *arg, AVIOContext *pb, int tag, i
static int mxf_read_strong_ref_array(AVIOContext *pb, UID **refs, int *count) static int mxf_read_strong_ref_array(AVIOContext *pb, UID **refs, int *count)
{ {
*count = avio_rb32(pb); *count = avio_rb32(pb);
av_free(*refs);
*refs = av_calloc(*count, sizeof(UID)); *refs = av_calloc(*count, sizeof(UID));
if (!*refs) { if (!*refs) {
*count = 0; *count = 0;
@@ -903,10 +904,8 @@ static int mxf_read_content_storage(void *arg, AVIOContext *pb, int tag, int siz
case 0x1901: case 0x1901:
if (mxf->packages_refs) if (mxf->packages_refs)
av_log(mxf->fc, AV_LOG_VERBOSE, "Multiple packages_refs\n"); av_log(mxf->fc, AV_LOG_VERBOSE, "Multiple packages_refs\n");
av_free(mxf->packages_refs);
return mxf_read_strong_ref_array(pb, &mxf->packages_refs, &mxf->packages_count); return mxf_read_strong_ref_array(pb, &mxf->packages_refs, &mxf->packages_count);
case 0x1902: case 0x1902:
av_free(mxf->essence_container_data_refs);
return mxf_read_strong_ref_array(pb, &mxf->essence_container_data_refs, &mxf->essence_container_data_count); return mxf_read_strong_ref_array(pb, &mxf->essence_container_data_refs, &mxf->essence_container_data_count);
} }
return 0; return 0;


Loading…
Cancel
Save