Commit c42b62d1 authored by Mark Thompson's avatar Mark Thompson

h264_metadata: Fix double-free

Whether the udu string should be freed depends on whether the SEI it
gets added to was created internally by cbs or externally by the bsf.
The current code frees it twice in the former case.
parent e7f64191
...@@ -293,7 +293,7 @@ static int h264_metadata_filter(AVBSFContext *bsf, AVPacket *out) ...@@ -293,7 +293,7 @@ static int h264_metadata_filter(AVBSFContext *bsf, AVPacket *out)
H264RawSEI *sei; H264RawSEI *sei;
H264RawSEIPayload *payload; H264RawSEIPayload *payload;
H264RawSEIUserDataUnregistered *udu; H264RawSEIUserDataUnregistered *udu;
int sei_pos; int sei_pos, sei_new;
for (i = 0; i < au->nb_units; i++) { for (i = 0; i < au->nb_units; i++) {
if (au->units[i].type == H264_NAL_SEI || if (au->units[i].type == H264_NAL_SEI ||
...@@ -305,8 +305,10 @@ static int h264_metadata_filter(AVBSFContext *bsf, AVPacket *out) ...@@ -305,8 +305,10 @@ static int h264_metadata_filter(AVBSFContext *bsf, AVPacket *out)
if (sei_pos < au->nb_units && if (sei_pos < au->nb_units &&
au->units[sei_pos].type == H264_NAL_SEI) { au->units[sei_pos].type == H264_NAL_SEI) {
sei_new = 0;
sei = au->units[sei_pos].content; sei = au->units[sei_pos].content;
} else { } else {
sei_new = 1;
sei = &ctx->sei_nal; sei = &ctx->sei_nal;
memset(sei, 0, sizeof(*sei)); memset(sei, 0, sizeof(*sei));
...@@ -354,6 +356,12 @@ static int h264_metadata_filter(AVBSFContext *bsf, AVPacket *out) ...@@ -354,6 +356,12 @@ static int h264_metadata_filter(AVBSFContext *bsf, AVPacket *out)
payload->payload_size = 16 + udu->data_length; payload->payload_size = 16 + udu->data_length;
if (!sei_new) {
// This will be freed by the existing internal
// reference in fragment_uninit().
sei_udu_string = NULL;
}
} else { } else {
invalid_user_data: invalid_user_data:
av_log(bsf, AV_LOG_ERROR, "Invalid user data: " av_log(bsf, AV_LOG_ERROR, "Invalid user data: "
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment