Commit b5ada68e authored by Dale Curtis's avatar Dale Curtis Committed by Michael Niedermayer

matroska: Fix leaking memory allocated for laces.

During error conditions matroska_parse_block may exit without
freeing the memory allocated for laces.

Found via valgrind: http://pastebin.com/E54k8QFUSigned-off-by: 's avatarDale Curtis <dalecurtis@chromium.org>
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent fd165a0b
...@@ -1940,6 +1940,7 @@ static int matroska_parse_block(MatroskaDemuxContext *matroska, uint8_t *data, ...@@ -1940,6 +1940,7 @@ static int matroska_parse_block(MatroskaDemuxContext *matroska, uint8_t *data,
if (size < cfs * h / 2) { if (size < cfs * h / 2) {
av_log(matroska->ctx, AV_LOG_ERROR, av_log(matroska->ctx, AV_LOG_ERROR,
"Corrupt int4 RM-style audio packet size\n"); "Corrupt int4 RM-style audio packet size\n");
av_free(lace_size);
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
for (x=0; x<h/2; x++) for (x=0; x<h/2; x++)
...@@ -1949,6 +1950,7 @@ static int matroska_parse_block(MatroskaDemuxContext *matroska, uint8_t *data, ...@@ -1949,6 +1950,7 @@ static int matroska_parse_block(MatroskaDemuxContext *matroska, uint8_t *data,
if (size < w) { if (size < w) {
av_log(matroska->ctx, AV_LOG_ERROR, av_log(matroska->ctx, AV_LOG_ERROR,
"Corrupt sipr RM-style audio packet size\n"); "Corrupt sipr RM-style audio packet size\n");
av_free(lace_size);
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
memcpy(track->audio.buf + y*w, data, w); memcpy(track->audio.buf + y*w, data, w);
...@@ -1956,6 +1958,7 @@ static int matroska_parse_block(MatroskaDemuxContext *matroska, uint8_t *data, ...@@ -1956,6 +1958,7 @@ static int matroska_parse_block(MatroskaDemuxContext *matroska, uint8_t *data,
if (size < sps * w / sps) { if (size < sps * w / sps) {
av_log(matroska->ctx, AV_LOG_ERROR, av_log(matroska->ctx, AV_LOG_ERROR,
"Corrupt generic RM-style audio packet size\n"); "Corrupt generic RM-style audio packet size\n");
av_free(lace_size);
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
for (x=0; x<w/sps; x++) for (x=0; x<w/sps; x++)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment