PR #25563 opened by Ratnaker URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25563 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25563.patch
parse_fmtp() in libavformat/rtpdec_mpeg4.c stores av_strdup(value) for a string attribute over the previous pointer. When an SDP for an mpeg4-generic AAC stream sets mode more than once, as in "a=fmtp:96 mode=AAC-hbr;mode=AAC-hbr", the earlier copy is lost and close_context() frees only the last one. The same leak occurs when two streams share a payload type and each sets mode once, because rtsp.c applies every fmtp line to all streams with that payload type. The review of #25160 noted this leak. It is independent of that change and occurs on master. The patch frees the old string once the new copy is allocated, so an allocation failure keeps the old value. I tested it with a reduced ASan build of ffprobe on master (58584087cf). For the fmtp line above, LeakSanitizer reports a direct leak of 8 bytes from av_strdup() in parse_fmtp() at rtpdec_mpeg4.c:331. With the patch none of these cases leaks, and the ffprobe output for a single mode assignment is unchanged. When the second av_strdup() is made to fail, parse_fmtp() returns AVERROR(ENOMEM) and keeps the first value. fate-libavformat, including fate-rtpdec, and fate-rtsp pass on this build. >From 3937773fd3386e9e490bf76159883c2f5562f1b7 Mon Sep 17 00:00:00 2001 From: Ratnaker Gautam <[email protected]> Date: Tue, 27 Oct 2026 22:15:00 +0100 Subject: [PATCH] avformat/rtpdec_mpeg4: fix leak on repeated mode attribute parse_fmtp() stores a copy of each string attribute value over the previous pointer. When an SDP sets mode more than once, in one fmtp line or across several, every copy except the last is leaked, because close_context() frees only the stored one. Free the previous string once the new copy has been allocated, so an allocation failure still leaves the old value in place. Fixes: memleak Signed-off-by: Ratnaker Gautam <[email protected]> --- libavformat/rtpdec_mpeg4.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavformat/rtpdec_mpeg4.c b/libavformat/rtpdec_mpeg4.c index 2a9ee9908ad..59379f6ae0b 100644 --- a/libavformat/rtpdec_mpeg4.c +++ b/libavformat/rtpdec_mpeg4.c @@ -331,6 +331,7 @@ static int parse_fmtp(AVFormatContext *s, char *val = av_strdup(value); if (!val) return AVERROR(ENOMEM); + av_freep((char *)data + attr_names[i].offset); *(char **)((char *)data+ attr_names[i].offset) = val; } -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
