Avoid freeing an unallocated array in mov_read_close() in case of a malloc failure.
Signed-off-by: Vittorio Giovara <[email protected]> --- libavformat/mov.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index fe1f264..f800bfa 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -1883,7 +1883,7 @@ static int mov_read_stsd(MOVContext *c, AVIOContext *pb, MOVAtom atom) { AVStream *st; MOVStreamContext *sc; - int ret; + int ret, entries; if (c->fc->nb_streams < 1) return 0; @@ -1892,18 +1892,18 @@ static int mov_read_stsd(MOVContext *c, AVIOContext *pb, MOVAtom atom) avio_r8(pb); /* version */ avio_rb24(pb); /* flags */ - sc->stsd_count = avio_rb32(pb); /* entries */ + entries = avio_rb32(pb); /* Prepare space for hosting multiple extradata. */ - sc->extradata = av_mallocz_array(sc->stsd_count, sizeof(*sc->extradata)); + sc->extradata = av_mallocz_array(entries, sizeof(*sc->extradata)); if (!sc->extradata) return AVERROR(ENOMEM); - sc->extradata_size = av_mallocz_array(sc->stsd_count, sizeof(sc->extradata_size)); + sc->extradata_size = av_mallocz_array(entries, sizeof(sc->extradata_size)); if (!sc->extradata_size) return AVERROR(ENOMEM); - ret = ff_mov_read_stsd_entries(c, pb, sc->stsd_count); + ret = ff_mov_read_stsd_entries(c, pb, entries); if (ret < 0) return ret; @@ -1915,6 +1915,7 @@ static int mov_read_stsd(MOVContext *c, AVIOContext *pb, MOVAtom atom) return AVERROR(ENOMEM); memcpy(st->codecpar->extradata, sc->extradata[0], sc->extradata_size[0]); + sc->stsd_count = entries; return 0; } -- 2.9.0 _______________________________________________ libav-devel mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-devel
