In mov_write_iacb_tag(), avio_open_dyn_buf() allocates a buffer but we forgot to free it when ff_iamf_write_descriptors() failed. Add cleanup code and goto cleanup if error happened.
In mov_preroll_write_stbl_atoms(), av_malloc_array() allocates an array and it leaks if packets distance > 32. Add av_free(sgpd_entries) before return. In mov_write_track_udta_tag(), avio_open_dyn_buf() allocates a buffer, and this buffer leaks if mov_write_track_kinds() failed. Add cleanup code and goto cleanup if error happened. Signed-off-by: Lidong Yan <502024330...@smail.nju.edu.cn> --- libavformat/movenc.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/libavformat/movenc.c b/libavformat/movenc.c index a651d6d618..c9a55c1817 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -337,14 +337,18 @@ static int mov_write_iacb_tag(AVFormatContext *s, AVIOContext *pb, MOVTrack *tra ret = ff_iamf_write_descriptors(track->iamf, dyn_bc, s); if (ret < 0) - return ret; + goto cleanup; dyn_size = avio_close_dyn_buf(dyn_bc, &dyn_buf); ffio_write_leb(pb, dyn_size); avio_write(pb, dyn_buf, dyn_size); - av_free(dyn_buf); + ret = update_size(pb, pos); - return update_size(pb, pos); +cleanup: + if (!dyn_buf) + avio_close_dyn_buf(dyn_bc, &dyn_buf); + av_free(dyn_buf); + return ret; } #endif @@ -3173,8 +3177,10 @@ static int mov_preroll_write_stbl_atoms(AVIOContext *pb, MOVTrack *track) if (roll_samples_remaining > 0) distance = 0; /* Verify distance is a maximum of 32 (2.5ms) packets. */ - if (distance > 32) + if (distance > 32) { + av_free(sgpd_entries); return AVERROR_INVALIDDATA; + } if (i && distance == sgpd_entries[entries].roll_distance) { sgpd_entries[entries].count++; } else { @@ -4186,7 +4192,7 @@ static int mov_write_track_udta_tag(AVIOContext *pb, MOVMuxContext *mov, if (mov->mode & MODE_MP4) { if ((ret = mov_write_track_kinds(pb_buf, st)) < 0) - return ret; + goto cleanup; } if ((size = avio_get_dyn_buf(pb_buf, &buf)) > 0) { @@ -4194,9 +4200,11 @@ static int mov_write_track_udta_tag(AVIOContext *pb, MOVMuxContext *mov, ffio_wfourcc(pb, "udta"); avio_write(pb, buf, size); } - ffio_free_dyn_buf(&pb_buf); + ret = 0; - return 0; +cleanup: + ffio_free_dyn_buf(&pb_buf); + return ret; } static int mov_write_trak_tag(AVFormatContext *s, AVIOContext *pb, MOVMuxContext *mov, -- 2.50.0.108.g6ae0c543ae _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".