Browse Source

avformat/avidec: Fix memleak with embedded GAB2 subtitles

The code for GAB2 subtitles predates refcounting AVPackets. So in order
to transfer the ownership of a packet's data pkt->data was simply stored
and the packet zeroed; in the end (i.e. in the read_close-function) this
data was then simply freed with av_freep(). This of course leads to a leak
of an AVBufferRef and an AVBuffer. It has been fixed by keeping and
eventually unreferencing the packet's buf instead.

Additionally, the packet is now reset via av_packet_unref().

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit da44bbefaa)
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
tags/n4.0.6
Andreas Rheinhardt 5 years ago
parent
commit
f9f3fd9387
1 changed files with 5 additions and 4 deletions
  1. +5
    -4
      libavformat/avidec.c

+ 5
- 4
libavformat/avidec.c View File

@@ -61,7 +61,7 @@ typedef struct AVIStream {

AVFormatContext *sub_ctx;
AVPacket sub_pkt;
uint8_t *sub_buffer;
AVBufferRef *sub_buffer;

int64_t seek_pos;
} AVIStream;
@@ -1118,8 +1118,9 @@ static int read_gab2_sub(AVFormatContext *s, AVStream *st, AVPacket *pkt)
time_base = ast->sub_ctx->streams[0]->time_base;
avpriv_set_pts_info(st, 64, time_base.num, time_base.den);
}
ast->sub_buffer = pkt->data;
memset(pkt, 0, sizeof(*pkt));
ast->sub_buffer = pkt->buf;
pkt->buf = NULL;
av_packet_unref(pkt);
return 1;

error:
@@ -1906,7 +1907,7 @@ static int avi_read_close(AVFormatContext *s)
av_freep(&ast->sub_ctx->pb);
avformat_close_input(&ast->sub_ctx);
}
av_freep(&ast->sub_buffer);
av_buffer_unref(&ast->sub_buffer);
av_packet_unref(&ast->sub_pkt);
}
}


Loading…
Cancel
Save