PR #25260 opened by Forgejo_Fairy URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25260 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25260.patch
LLM-GPT-5.6-SOL-assisted fix for #24186. The APNG muxer ignored both `av_packet_ref()` failures used to maintain its buffered packet. Propagate those errors and free the empty packet object so trailer cleanup does not attempt to flush invalid state. Verified with the issue's public-API OOM reproducer, a two-frame variant covering the later replacement-reference path, and the `fate-apng` and `fate-lavf-apng` test sets under ASan/UBSan. >From 986d4a2d02866917a33c1865c172a28643b79704 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 30 Sep 2026 19:43:53 +0000 Subject: [PATCH] avformat/apngenc: Propagate packet reference failures Free the empty buffered packet after av_packet_ref() fails so that trailer cleanup does not try to flush it. Fixes: ticket #24186 Assisted-by: Fairy --- libavformat/apngenc.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/libavformat/apngenc.c b/libavformat/apngenc.c index 0d56d784f23..6b4eab65b24 100644 --- a/libavformat/apngenc.c +++ b/libavformat/apngenc.c @@ -114,6 +114,7 @@ static int flush_packet(AVFormatContext *format_context, AVPacket *packet) AVStream *codec_stream = format_context->streams[0]; uint8_t *side_data = NULL; size_t side_data_size; + int ret; av_assert0(apng->prev_packet); @@ -223,8 +224,13 @@ static int flush_packet(AVFormatContext *format_context, AVPacket *packet) ++apng->frame_number; av_packet_unref(apng->prev_packet); - if (packet) - av_packet_ref(apng->prev_packet, packet); + if (packet) { + ret = av_packet_ref(apng->prev_packet, packet); + if (ret < 0) { + av_packet_free(&apng->prev_packet); + return ret; + } + } return 0; } @@ -238,7 +244,11 @@ static int apng_write_packet(AVFormatContext *format_context, AVPacket *packet) if (!apng->prev_packet) return AVERROR(ENOMEM); - av_packet_ref(apng->prev_packet, packet); + ret = av_packet_ref(apng->prev_packet, packet); + if (ret < 0) { + av_packet_free(&apng->prev_packet); + return ret; + } } else { ret = flush_packet(format_context, packet); if (ret < 0) -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
