Commit 574929d8 authored by James Almer's avatar James Almer

avcodec/avpacket: fix leak on realloc in av_packet_add_side_data()

If realloc fails, the pointer is overwritten and the previously allocated
buffer is leaked, which goes against the expected behavior of keeping the
packet unchanged in case of error.

Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: 's avatarJames Almer <jamrial@gmail.com>
parent 0ffea356
...@@ -295,16 +295,17 @@ FF_ENABLE_DEPRECATION_WARNINGS ...@@ -295,16 +295,17 @@ FF_ENABLE_DEPRECATION_WARNINGS
int av_packet_add_side_data(AVPacket *pkt, enum AVPacketSideDataType type, int av_packet_add_side_data(AVPacket *pkt, enum AVPacketSideDataType type,
uint8_t *data, size_t size) uint8_t *data, size_t size)
{ {
AVPacketSideData *tmp;
int elems = pkt->side_data_elems; int elems = pkt->side_data_elems;
if ((unsigned)elems + 1 > INT_MAX / sizeof(*pkt->side_data)) if ((unsigned)elems + 1 > INT_MAX / sizeof(*pkt->side_data))
return AVERROR(ERANGE); return AVERROR(ERANGE);
pkt->side_data = av_realloc(pkt->side_data, tmp = av_realloc(pkt->side_data, (elems + 1) * sizeof(*tmp));
(elems + 1) * sizeof(*pkt->side_data)); if (!tmp)
if (!pkt->side_data)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
pkt->side_data = tmp;
pkt->side_data[elems].data = data; pkt->side_data[elems].data = data;
pkt->side_data[elems].size = size; pkt->side_data[elems].size = size;
pkt->side_data[elems].type = type; pkt->side_data[elems].type = type;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment