PR #23647 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23647 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23647.patch
Found-by: Ao Xijie Signed-off-by: Michael Niedermayer <[email protected]> >From 54d4abb2a9aaab67f020ebae0702cfdf08961296 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 29 Jun 2026 01:35:05 +0200 Subject: [PATCH] avfilter/vf_removelogo: free the whole mask on allocation failure Found-by: Ao Xijie Signed-off-by: Michael Niedermayer <[email protected]> --- libavfilter/vf_removelogo.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/libavfilter/vf_removelogo.c b/libavfilter/vf_removelogo.c index 1da5f5d0c7..7285f5336a 100644 --- a/libavfilter/vf_removelogo.c +++ b/libavfilter/vf_removelogo.c @@ -311,22 +311,18 @@ static av_cold int init(AVFilterContext *ctx) the filter is applied, the mask size is determined on a pixel by pixel basis, with pixels nearer the edge of the logo getting smaller mask sizes. */ - mask = (int ***)av_malloc_array(s->max_mask_size + 1, sizeof(int **)); + mask = av_calloc(s->max_mask_size + 1, sizeof(*mask)); if (!mask) return AVERROR(ENOMEM); for (a = 0; a <= s->max_mask_size; a++) { - mask[a] = (int **)av_malloc_array((a * 2) + 1, sizeof(int *)); - if (!mask[a]) { - av_free(mask); - return AVERROR(ENOMEM); - } + mask[a] = av_calloc((a * 2) + 1, sizeof(*mask[a])); + if (!mask[a]) + goto mask_fail; for (b = -a; b <= a; b++) { - mask[a][b + a] = (int *)av_malloc_array((a * 2) + 1, sizeof(int)); - if (!mask[a][b + a]) { - av_free(mask); - return AVERROR(ENOMEM); - } + mask[a][b + a] = av_malloc_array((a * 2) + 1, sizeof(*mask[a][b + a])); + if (!mask[a][b + a]) + goto mask_fail; for (c = -a; c <= a; c++) { if ((b * b) + (c * c) <= (a * a)) /* Circular 0/1 mask. */ mask[a][b + a][c + a] = 1; @@ -351,6 +347,16 @@ static av_cold int init(AVFilterContext *ctx) SHOW_LOGO_INFO(half); return 0; + +mask_fail: + for (a = 0; a <= s->max_mask_size; a++) { + if (mask[a]) + for (b = 0; b < (a * 2) + 1; b++) + av_free(mask[a][b]); + av_free(mask[a]); + } + av_free(mask); + return AVERROR(ENOMEM); } static int config_props_input(AVFilterLink *inlink) -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
