This is an automated email from the git hooks/post-receive script.

Git pushed a commit to branch master
in repository ffmpeg.

The following commit(s) were added to refs/heads/master by this push:
     new 2f4ad2497e avformat/movenc: fix dynamic buffer leaks on error paths
2f4ad2497e is described below

commit 2f4ad2497e932b739a2f9b7f27ff08dcf47dca56
Author:     jiangjie <[email protected]>
AuthorDate: Sat May 9 19:23:46 2026 +0800
Commit:     jiangjie <[email protected]>
CommitDate: Sat May 9 19:27:17 2026 +0800

    avformat/movenc: fix dynamic buffer leaks on error paths
    
    In mov_write_iacb_tag(), the dynamic buffer dyn_bc was leaked when
    ff_iamf_write_descriptors() failed.
    
    In mov_write_track_udta_tag(), the dynamic buffer pb_buf was leaked
    when mov_write_track_kinds() failed, as the error path returned
    directly instead of going through cleanup.
    
    Fix both by ensuring ffio_free_dyn_buf() is called on all error paths.
---
 libavformat/movenc.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/libavformat/movenc.c b/libavformat/movenc.c
index 8157b5e277..83f65f3417 100644
--- a/libavformat/movenc.c
+++ b/libavformat/movenc.c
@@ -352,8 +352,10 @@ static int mov_write_iacb_tag(AVFormatContext *s, 
AVIOContext *pb, MOVTrack *tra
     avio_w8(pb, 1); // configurationVersion
 
     ret = ff_iamf_write_descriptors(track->iamf, dyn_bc, s);
-    if (ret < 0)
+    if (ret < 0) {
+        ffio_free_dyn_buf(&dyn_bc);
         return ret;
+    }
 
     dyn_size = avio_close_dyn_buf(dyn_bc, &dyn_buf);
     ffio_write_leb(pb, dyn_size);
@@ -4346,7 +4348,7 @@ static int mov_write_track_udta_tag(AVIOContext *pb, 
MOVMuxContext *mov,
 
     if (mov->mode & MODE_MP4) {
         if ((ret = mov_write_track_kinds(pb_buf, st)) < 0)
-            return ret;
+            goto end;
     }
 
     if ((size = avio_get_dyn_buf(pb_buf, &buf)) > 0) {
@@ -4354,9 +4356,10 @@ static int mov_write_track_udta_tag(AVIOContext *pb, 
MOVMuxContext *mov,
         ffio_wfourcc(pb, "udta");
         avio_write(pb, buf, size);
     }
+end:
     ffio_free_dyn_buf(&pb_buf);
 
-    return 0;
+    return ret;
 }
 
 static int mov_write_trak_tag(AVFormatContext *s, AVIOContext *pb, 
MOVMuxContext *mov,

_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to