diff options
| author | James Almer <jamrial@gmail.com> | 2016-11-19 15:33:58 -0300 |
|---|---|---|
| committer | Anton Khirnov <anton@khirnov.net> | 2016-11-23 13:17:52 +0100 |
| commit | aa498c3183236a93206b4a0e8225b9db0660b50d (patch) | |
| tree | bf668357a29a421f220738cab79f4d2560bcd5de | |
| parent | c7ab0eb3050acdd3b8cab2c55fc9c1b2e8610a65 (diff) | |
avpacket: fix leak on realloc in av_packet_add_side_data()
If realloc fails, the pointer is overwritten and the previously allocated buffer
is leaked, which goes against the expected functionality of keeping the packet
unchanged in case of error.
Signed-off-by: James Almer <jamrial@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
| -rw-r--r-- | libavcodec/avpacket.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/libavcodec/avpacket.c b/libavcodec/avpacket.c index f2b0a296b8..93e9eb6ae7 100644 --- a/libavcodec/avpacket.c +++ b/libavcodec/avpacket.c @@ -240,16 +240,17 @@ FF_ENABLE_DEPRECATION_WARNINGS int av_packet_add_side_data(AVPacket *pkt, enum AVPacketSideDataType type, uint8_t *data, size_t size) { + AVPacketSideData *tmp; int elems = pkt->side_data_elems; if ((unsigned)elems + 1 > INT_MAX / sizeof(*pkt->side_data)) return AVERROR(ERANGE); - pkt->side_data = av_realloc(pkt->side_data, - (elems + 1) * sizeof(*pkt->side_data)); - if (!pkt->side_data) + tmp = av_realloc(pkt->side_data, (elems + 1) * sizeof(*tmp)); + if (!tmp) return AVERROR(ENOMEM); + pkt->side_data = tmp; pkt->side_data[elems].data = data; pkt->side_data[elems].size = size; pkt->side_data[elems].type = type; |