lavc/smvjpegdec: fix mem leak in case of init failure

Signed-off-by: Lukasz Marek <lukasz.m.luki2@gmail.com>

1 files changed, 19 insertions, 15 deletions

diff --git a/libavcodec/smvjpegdec.c b/libavcodec/smvjpegdec.c
index 69327cd798..375c9d91c3 100644
--- a/libavcodec/smvjpegdec.c
+++ b/libavcodec/smvjpegdec.c
@@ -75,6 +75,20 @@ static inline void smv_img_pnt(uint8_t *dst_data[4], uint8_t *src_data[4],
         dst_data[1] = src_data[1];
 }
 
+static av_cold int smvjpeg_decode_end(AVCodecContext *avctx)
+{
+    SMVJpegDecodeContext *s = avctx->priv_data;
+    MJpegDecodeContext *jpg = &s->jpg;
+    int ret;
+
+    jpg->picture_ptr = NULL;
+    av_frame_free(&s->picture[0]);
+    av_frame_free(&s->picture[1]);
+    ret = avcodec_close(s->avctx);
+    av_freep(&s->avctx);
+    return ret;
+}
+
 static av_cold int smvjpeg_decode_init(AVCodecContext *avctx)
 {
     SMVJpegDecodeContext *s = avctx->priv_data;
@@ -89,8 +103,10 @@ static av_cold int smvjpeg_decode_init(AVCodecContext *avctx)
         return AVERROR(ENOMEM);
 
     s->picture[1] = av_frame_alloc();
-    if (!s->picture[1])
+    if (!s->picture[1]) {
+        av_frame_free(&s->picture[0]);
         return AVERROR(ENOMEM);
+    }
 
     s->jpg.picture_ptr      = s->picture[0];
 
@@ -120,6 +136,8 @@ static av_cold int smvjpeg_decode_init(AVCodecContext *avctx)
     }
     av_dict_free(&thread_opt);
 
+    if (ret < 0)
+        smvjpeg_decode_end(avctx);
     return ret;
 }
 
@@ -176,20 +194,6 @@ static int smvjpeg_decode_frame(AVCodecContext *avctx, void *data, int *data_siz
     return ret;
 }
 
-static av_cold int smvjpeg_decode_end(AVCodecContext *avctx)
-{
-    SMVJpegDecodeContext *s = avctx->priv_data;
-    MJpegDecodeContext *jpg = &s->jpg;
-    int ret;
-
-    jpg->picture_ptr = NULL;
-    av_frame_free(&s->picture[0]);
-    av_frame_free(&s->picture[1]);
-    ret = avcodec_close(s->avctx);
-    av_freep(&s->avctx);
-    return ret;
-}
-
 static const AVClass smvjpegdec_class = {
     .class_name = "SMVJPEG decoder",
     .item_name  = av_default_item_name,