From 120b38b966b92a50dd36542190d35daba6730eb3 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 13 Oct 2012 02:08:59 +0200 Subject: avio: redesign ffio_rewind_with_probe_data() This prevents a double free Fixes CID718285 Signed-off-by: Michael Niedermayer --- libavformat/aviobuf.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) (limited to 'libavformat/aviobuf.c') diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c index dc09a071fc..6e060ba27c 100644 --- a/libavformat/aviobuf.c +++ b/libavformat/aviobuf.c @@ -726,27 +726,32 @@ static int url_resetbuf(AVIOContext *s, int flags) return 0; } -int ffio_rewind_with_probe_data(AVIOContext *s, unsigned char *buf, int buf_size) +int ffio_rewind_with_probe_data(AVIOContext *s, unsigned char **bufp, int buf_size) { int64_t buffer_start; int buffer_size; int overlap, new_size, alloc_size; + uint8_t *buf = *bufp; - if (s->write_flag) + if (s->write_flag) { + av_freep(bufp); return AVERROR(EINVAL); + } buffer_size = s->buf_end - s->buffer; /* the buffers must touch or overlap */ - if ((buffer_start = s->pos - buffer_size) > buf_size) + if ((buffer_start = s->pos - buffer_size) > buf_size) { + av_freep(bufp); return AVERROR(EINVAL); + } overlap = buf_size - buffer_start; new_size = buf_size + buffer_size - overlap; alloc_size = FFMAX(s->buffer_size, new_size); if (alloc_size > buf_size) - if (!(buf = av_realloc_f(buf, 1, alloc_size))) + if (!(buf = (*bufp) = av_realloc_f(buf, 1, alloc_size))) return AVERROR(ENOMEM); if (new_size > buf_size) { -- cgit v1.2.3