[libav-devel] [PATCH 1/3] faxcompr: Check malloc results and unify return path

[Alex Converse]

---
 libavcodec/faxcompr.c |   15 ++++++++++-----
 libavcodec/tiff.c     |    2 +-
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/libavcodec/faxcompr.c b/libavcodec/faxcompr.c
index a0fa825..077e740 100644
--- a/libavcodec/faxcompr.c
+++ b/libavcodec/faxcompr.c
@@ -275,12 +275,17 @@ int ff_ccitt_unpack(AVCodecContext *avctx,
 {
     int j;
     GetBitContext gb;
-    int *runs, *ref, *runend;
+    int *runs, *ref = NULL, *runend;
     int ret;
     int runsize= avctx->width + 2;
+    int err = 0;
 
     runs = av_malloc(runsize * sizeof(runs[0]));
     ref  = av_malloc(runsize * sizeof(ref[0]));
+    if (!runs || ! ref) {
+        err = AVERROR(ENOMEM);
+        goto fail;
+    }
     ref[0] = avctx->width;
     ref[1] = 0;
     ref[2] = 0;
@@ -290,9 +295,8 @@ int ff_ccitt_unpack(AVCodecContext *avctx,
         if(compr == TIFF_G4){
             ret = decode_group3_2d_line(avctx, &gb, avctx->width, runs, 
runend, ref);
             if(ret < 0){
-                av_free(runs);
-                av_free(ref);
-                return -1;
+                err = -1;
+                goto fail;
             }
         }else{
             int g3d1 = (compr == TIFF_G3) && !(opts & 1);
@@ -313,7 +317,8 @@ int ff_ccitt_unpack(AVCodecContext *avctx,
         }
         dst += stride;
     }
+fail:
     av_free(runs);
     av_free(ref);
-    return 0;
+    return err;
 }
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index cafd98b..cd00da4 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -137,7 +137,7 @@ static int tiff_unpack_strip(TiffContext *s, uint8_t* dst, 
int stride, const uin
     }
     if(s->compr == TIFF_CCITT_RLE || s->compr == TIFF_G3 || s->compr == 
TIFF_G4){
         int i, ret = 0;
-        uint8_t *src2 = av_malloc(size + FF_INPUT_BUFFER_PADDING_SIZE);
+        uint8_t *src2 = av_malloc((unsigned)size + 
FF_INPUT_BUFFER_PADDING_SIZE);
 
         if(!src2 || (unsigned)size + FF_INPUT_BUFFER_PADDING_SIZE < 
(unsigned)size){
             av_log(s->avctx, AV_LOG_ERROR, "Error allocating temporary 
buffer\n");
-- 
1.7.7.3

_______________________________________________
libav-devel mailing list
libav-devel@libav.org
https://lists.libav.org/mailman/listinfo/libav-devel