From d554aabdaf81fc3ea99783aca42649b43013e796 Mon Sep 17 00:00:00 2001 From: Andreas Rheinhardt Date: Sun, 20 Sep 2020 08:05:58 +0200 Subject: avformat/swfenc: Fix memleak upon write_header error The SWF muxer accepts at most one mp3 audio and at most one VP6F, FLV1 or MJPEG stream. Upon encountering an mp3 stream, a fifo is allocated that leaks if one of the subsequent streams is incompliant with the restrictions mentioned above or if the framerate or samplerate are invalid. This is fixed by adding a deinit function to free said fifo. Reviewed-by: Paul B Mahol Signed-off-by: Andreas Rheinhardt --- libavformat/swfenc.c | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) (limited to 'libavformat/swfenc.c') diff --git a/libavformat/swfenc.c b/libavformat/swfenc.c index 9da4aad959..750ec56ec1 100644 --- a/libavformat/swfenc.c +++ b/libavformat/swfenc.c @@ -482,24 +482,13 @@ static int swf_write_trailer(AVFormatContext *s) { SWFContext *swf = s->priv_data; AVIOContext *pb = s->pb; - AVCodecParameters *par, *video_par; - int file_size, i; - - video_par = NULL; - for(i=0;inb_streams;i++) { - par = s->streams[i]->codecpar; - if (par->codec_type == AVMEDIA_TYPE_VIDEO) - video_par = par; - else { - av_fifo_freep(&swf->audio_fifo); - } - } + int file_size; put_swf_tag(s, TAG_END); put_swf_end_tag(s); /* patch file size and number of frames if not streamed */ - if ((s->pb->seekable & AVIO_SEEKABLE_NORMAL) && video_par) { + if ((s->pb->seekable & AVIO_SEEKABLE_NORMAL) && swf->video_par) { file_size = avio_tell(pb); avio_seek(pb, 4, SEEK_SET); avio_wl32(pb, file_size); @@ -514,6 +503,13 @@ static int swf_write_trailer(AVFormatContext *s) return 0; } +static void swf_deinit(AVFormatContext *s) +{ + SWFContext *swf = s->priv_data; + + av_fifo_freep(&swf->audio_fifo); +} + #if CONFIG_SWF_MUXER AVOutputFormat ff_swf_muxer = { .name = "swf", @@ -526,6 +522,7 @@ AVOutputFormat ff_swf_muxer = { .write_header = swf_write_header, .write_packet = swf_write_packet, .write_trailer = swf_write_trailer, + .deinit = swf_deinit, .flags = AVFMT_TS_NONSTRICT, }; #endif @@ -540,6 +537,7 @@ AVOutputFormat ff_avm2_muxer = { .write_header = swf_write_header, .write_packet = swf_write_packet, .write_trailer = swf_write_trailer, + .deinit = swf_deinit, .flags = AVFMT_TS_NONSTRICT, }; #endif -- cgit v1.2.3