Commit 5b220e1e authored by Diego Biurrun's avatar Diego Biurrun

mpegts: Fix memory leaks and related crashes in mpegs_write_header()

parent f8ab9f2f
...@@ -430,9 +430,15 @@ static MpegTSService *mpegts_add_service(MpegTSWrite *ts, int sid, ...@@ -430,9 +430,15 @@ static MpegTSService *mpegts_add_service(MpegTSWrite *ts, int sid,
return NULL; return NULL;
service->pmt.pid = ts->pmt_start_pid + ts->nb_services; service->pmt.pid = ts->pmt_start_pid + ts->nb_services;
service->sid = sid; service->sid = sid;
service->pcr_pid = 0x1fff;
service->provider_name = av_strdup(provider_name); service->provider_name = av_strdup(provider_name);
service->name = av_strdup(name); service->name = av_strdup(name);
service->pcr_pid = 0x1fff; if (!service->provider_name || !service->name) {
free(service->provider_name);
free(service->name);
free(service);
return NULL;
}
dynarray_add(&ts->services, &ts->nb_services, service); dynarray_add(&ts->services, &ts->nb_services, service);
return service; return service;
} }
...@@ -474,6 +480,9 @@ static int mpegts_write_header(AVFormatContext *s) ...@@ -474,6 +480,9 @@ static int mpegts_write_header(AVFormatContext *s)
service = mpegts_add_service(ts, ts->service_id, service = mpegts_add_service(ts, ts->service_id,
provider_name, service_name); provider_name, service_name);
if (!service)
return AVERROR(ENOMEM);
service->pmt.write_packet = section_write_packet; service->pmt.write_packet = section_write_packet;
service->pmt.opaque = s; service->pmt.opaque = s;
service->pmt.cc = 15; service->pmt.cc = 15;
...@@ -491,8 +500,10 @@ static int mpegts_write_header(AVFormatContext *s) ...@@ -491,8 +500,10 @@ static int mpegts_write_header(AVFormatContext *s)
ts->sdt.opaque = s; ts->sdt.opaque = s;
pids = av_malloc(s->nb_streams * sizeof(*pids)); pids = av_malloc(s->nb_streams * sizeof(*pids));
if (!pids) if (!pids) {
av_free(service);
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
}
/* assign pids to each stream */ /* assign pids to each stream */
for (i = 0; i < s->nb_streams; i++) { for (i = 0; i < s->nb_streams; i++) {
...@@ -564,7 +575,10 @@ static int mpegts_write_header(AVFormatContext *s) ...@@ -564,7 +575,10 @@ static int mpegts_write_header(AVFormatContext *s)
ret = AVERROR(EINVAL); ret = AVERROR(EINVAL);
goto fail; goto fail;
} }
ast = avformat_new_stream(ts_st->amux, NULL); if (!(ast = avformat_new_stream(ts_st->amux, NULL))) {
ret = AVERROR(ENOMEM);
goto fail;
}
ret = avcodec_copy_context(ast->codec, st->codec); ret = avcodec_copy_context(ast->codec, st->codec);
if (ret != 0) if (ret != 0)
goto fail; goto fail;
...@@ -633,6 +647,7 @@ static int mpegts_write_header(AVFormatContext *s) ...@@ -633,6 +647,7 @@ static int mpegts_write_header(AVFormatContext *s)
return 0; return 0;
fail: fail:
av_free(service);
av_free(pids); av_free(pids);
for (i = 0; i < s->nb_streams; i++) { for (i = 0; i < s->nb_streams; i++) {
st = s->streams[i]; st = s->streams[i];
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment