The error path frees all side data, but forgets to reset the side data
count. This can blow up later in av_frame_unref() and free_side_data().
---
libavutil/frame.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavutil/frame.c b/libavutil/frame.c
index 4ee0630..5c9aa29 100644
--- a/libavutil/frame.c
+++ b/libavutil/frame.c
@@ -503,6 +503,7 @@ int av_frame_copy_props(AVFrame *dst, const AVFrame *src)
free_side_data(&dst->side_data[i]);
}
av_freep(&dst->side_data);
+ dst->nb_side_data = 0;
return AVERROR(ENOMEM);
}
memcpy(sd_dst->data, sd_src->data, sd_src->size);
--
2.1.3
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
