Browse Source

Fix double free on error in Deluxe Paint Animation demuxer.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
tags/n0.9
Laurent Aimar Michael Niedermayer 13 years ago
parent
commit
d39d7122e3
1 changed files with 8 additions and 15 deletions
  1. +8
    -15
      libavformat/anm.c

+ 8
- 15
libavformat/anm.c View File

@@ -134,18 +134,17 @@ static int read_header(AVFormatContext *s,
/* color cycling and palette data */ /* color cycling and palette data */
st->codec->extradata_size = 16*8 + 4*256; st->codec->extradata_size = 16*8 + 4*256;
st->codec->extradata = av_mallocz(st->codec->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE); st->codec->extradata = av_mallocz(st->codec->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE);
if (!st->codec->extradata) {
ret = AVERROR(ENOMEM);
goto close_and_return;
}
if (!st->codec->extradata)
return AVERROR(ENOMEM);

ret = avio_read(pb, st->codec->extradata, st->codec->extradata_size); ret = avio_read(pb, st->codec->extradata, st->codec->extradata_size);
if (ret < 0) if (ret < 0)
goto close_and_return;
return ret;


/* read page table */ /* read page table */
ret = avio_seek(pb, anm->page_table_offset, SEEK_SET); ret = avio_seek(pb, anm->page_table_offset, SEEK_SET);
if (ret < 0) if (ret < 0)
goto close_and_return;
return ret;


for (i = 0; i < MAX_PAGES; i++) { for (i = 0; i < MAX_PAGES; i++) {
Page *p = &anm->pt[i]; Page *p = &anm->pt[i];
@@ -156,21 +155,15 @@ static int read_header(AVFormatContext *s,


/* find page of first frame */ /* find page of first frame */
anm->page = find_record(anm, 0); anm->page = find_record(anm, 0);
if (anm->page < 0) {
ret = anm->page;
goto close_and_return;
}
if (anm->page < 0)
return anm->page;


anm->record = -1; anm->record = -1;
return 0; return 0;


invalid: invalid:
av_log_ask_for_sample(s, NULL); av_log_ask_for_sample(s, NULL);
ret = AVERROR_INVALIDDATA;

close_and_return:
av_close_input_stream(s);
return ret;
return AVERROR_INVALIDDATA;
} }


static int read_packet(AVFormatContext *s, static int read_packet(AVFormatContext *s,


Loading…
Cancel
Save