Commit 714f5ab5 authored by Janne Grunau's avatar Janne Grunau

vc1dec: prevent memory leak on av_realloc error

parent 1afd7a11
...@@ -5364,9 +5364,10 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data, ...@@ -5364,9 +5364,10 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data,
break; break;
case VC1_CODE_FIELD: { case VC1_CODE_FIELD: {
int buf_size3; int buf_size3;
slices = av_realloc(slices, sizeof(*slices) * (n_slices+1)); tmp = av_realloc(slices, sizeof(*slices) * (n_slices+1));
if (!slices) if (!tmp)
goto err; goto err;
slices = tmp;
slices[n_slices].buf = av_mallocz(buf_size + FF_INPUT_BUFFER_PADDING_SIZE); slices[n_slices].buf = av_mallocz(buf_size + FF_INPUT_BUFFER_PADDING_SIZE);
if (!slices[n_slices].buf) if (!slices[n_slices].buf)
goto err; goto err;
...@@ -5388,9 +5389,10 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data, ...@@ -5388,9 +5389,10 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data,
break; break;
case VC1_CODE_SLICE: { case VC1_CODE_SLICE: {
int buf_size3; int buf_size3;
slices = av_realloc(slices, sizeof(*slices) * (n_slices+1)); tmp = av_realloc(slices, sizeof(*slices) * (n_slices+1));
if (!slices) if (!tmp)
goto err; goto err;
slices = tmp;
slices[n_slices].buf = av_mallocz(buf_size + FF_INPUT_BUFFER_PADDING_SIZE); slices[n_slices].buf = av_mallocz(buf_size + FF_INPUT_BUFFER_PADDING_SIZE);
if (!slices[n_slices].buf) if (!slices[n_slices].buf)
goto err; goto err;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment