PR #23059 opened by jiangjie URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23059 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23059.patch
In mov_write_iacb_tag(), the dynamic buffer dyn_bc was leaked when ff_iamf_write_descriptors() failed. In mov_write_track_udta_tag(), the dynamic buffer pb_buf was leaked when mov_write_track_kinds() failed, as the error path returned directly instead of going through cleanup. Fix both by ensuring ffio_free_dyn_buf() is called on all error paths. >From 2f4ad2497e932b739a2f9b7f27ff08dcf47dca56 Mon Sep 17 00:00:00 2001 From: jiangjie <[email protected]> Date: Sat, 9 May 2026 19:23:46 +0800 Subject: [PATCH] avformat/movenc: fix dynamic buffer leaks on error paths In mov_write_iacb_tag(), the dynamic buffer dyn_bc was leaked when ff_iamf_write_descriptors() failed. In mov_write_track_udta_tag(), the dynamic buffer pb_buf was leaked when mov_write_track_kinds() failed, as the error path returned directly instead of going through cleanup. Fix both by ensuring ffio_free_dyn_buf() is called on all error paths. --- libavformat/movenc.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/libavformat/movenc.c b/libavformat/movenc.c index 8157b5e277..83f65f3417 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -352,8 +352,10 @@ static int mov_write_iacb_tag(AVFormatContext *s, AVIOContext *pb, MOVTrack *tra avio_w8(pb, 1); // configurationVersion ret = ff_iamf_write_descriptors(track->iamf, dyn_bc, s); - if (ret < 0) + if (ret < 0) { + ffio_free_dyn_buf(&dyn_bc); return ret; + } dyn_size = avio_close_dyn_buf(dyn_bc, &dyn_buf); ffio_write_leb(pb, dyn_size); @@ -4346,7 +4348,7 @@ static int mov_write_track_udta_tag(AVIOContext *pb, MOVMuxContext *mov, if (mov->mode & MODE_MP4) { if ((ret = mov_write_track_kinds(pb_buf, st)) < 0) - return ret; + goto end; } if ((size = avio_get_dyn_buf(pb_buf, &buf)) > 0) { @@ -4354,9 +4356,10 @@ static int mov_write_track_udta_tag(AVIOContext *pb, MOVMuxContext *mov, ffio_wfourcc(pb, "udta"); avio_write(pb, buf, size); } +end: ffio_free_dyn_buf(&pb_buf); - return 0; + return ret; } static int mov_write_trak_tag(AVFormatContext *s, AVIOContext *pb, MOVMuxContext *mov, -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
