On 3/5/2018 10:04 PM, Matthew Wolenetz wrote: > Perhaps true, but there are a ton of paths to ff_alloc_extradata that are > not included in Chromium. Such a wider, general, fix seems more appropriate > to land upstream first with more testing.
The function allocates a buffer and overwrites the pointer without bothering to make sure it was NULL beforehand, so it's a latent source of leaks if given improper usage. I've sent a patchset to make it do a proper cleaning before allocating new extradata, to see what other developers think. > For now, this is a particular known case that's occurring in Chromium that > needs fixing. > > On Mon, Mar 5, 2018 at 2:10 PM, James Almer <jamr...@gmail.com> wrote: > >> On 3/5/2018 6:54 PM, Matthew Wolenetz wrote: >>> >>> 0001-lavf-oggparseflac-Free-flac-extradata-before-realloc.patch >>> >>> >>> From 5d28b92d9d164b104e9a47b8183cd7ddedfde366 Mon Sep 17 00:00:00 2001 >>> From: Matt Wolenetz <wolen...@chromium.org> >>> Date: Mon, 5 Mar 2018 12:36:28 -0800 >>> Subject: [PATCH] lavf/oggparseflac: Free flac extradata before >> reallocating. >>> >>> Otherwise ff_alloc_extradata() just leaks any existing allocated >>> memory. >> >> Maybe ff_alloc_extradata() is the one that should free any existing >> extradata instead of littering the tree with av_freep() calls before >> every ff_alloc_extradata() call. Otherwise you'll keep patching up >> demuxers as your fuzzer generates files for them. >> >>> >>> BUG=789835 >>> >>> Change-Id: I8e1c21a16749d28c7f050f5f5d8bffda3b419638 >>> Reviewed-on: https://chromium-review.googlesource.com/949415 >>> Reviewed-by: Xiaohan Wang <xhw...@chromium.org> >>> --- >>> libavformat/oggparseflac.c | 1 + >>> 1 file changed, 1 insertion(+) >>> >>> diff --git a/libavformat/oggparseflac.c b/libavformat/oggparseflac.c >>> index b5f1416a3c..6cb3468022 100644 >>> --- a/libavformat/oggparseflac.c >>> +++ b/libavformat/oggparseflac.c >>> @@ -61,6 +61,7 @@ flac_header (AVFormatContext * s, int idx) >>> st->codecpar->codec_id = AV_CODEC_ID_FLAC; >>> st->need_parsing = AVSTREAM_PARSE_HEADERS; >>> >>> + av_freep(&st->codecpar->extradata); >>> if (ff_alloc_extradata(st->codecpar, FLAC_STREAMINFO_SIZE) < 0) >>> return AVERROR(ENOMEM); >>> memcpy(st->codecpar->extradata, streaminfo_start, >> st->codecpar->extradata_size); >>> -- 2.16.2.395.g2e18187dfd-goog >>> >>> >>> >>> _______________________________________________ >>> ffmpeg-devel mailing list >>> ffmpeg-devel@ffmpeg.org >>> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel >>> >> >> _______________________________________________ >> ffmpeg-devel mailing list >> ffmpeg-devel@ffmpeg.org >> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel >> > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > http://ffmpeg.org/mailman/listinfo/ffmpeg-devel > _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
