PR #25275 opened by JunoSat URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25275 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25275.patch
Fixes a small memory leak in the MOV demuxer. Found by running FFmpeg's existing demuxer fuzz target (tools/target_dem_fuzzer) over the FATE sample files with ASan/LeakSanitizer. Reproduce on current master with ASan: ASAN_OPTIONS=detect_leaks=1 ffprobe fate-suite/mov/spherical-vexu-orientation.mp4 which reports a 36 byte leak allocated in mov_read_sv3d(). Cause: the file has both an sv3d box and a vexu box with a proj child in the same sample description. Both handlers assign sc->spherical without freeing the existing one, so the first allocation is lost. Fix: av_freep(&sc->spherical) before each allocation. The last box still wins. Tested: the leak is gone with the patch; ffprobe -show_streams output is identical before/after on this file and on all 246 .mp4/.mov/.m4a/.3gp files in the FATE suite. Severity is low (a few dozen bytes per file opened). >From 467946d7ba68a9956e94842102c02d730f57744b Mon Sep 17 00:00:00 2001 From: Sathvik Prabhu <[email protected]> Date: Wed, 21 Oct 2026 03:55:50 +0530 Subject: [PATCH] avformat/mov: fix memleak when spherical info is parsed more than once mov_read_sv3d() and mov_read_vexu_proj() unconditionally assign sc->spherical, leaking the previous allocation when a sample description contains both an sv3d box and a vexu box with a proj child, as in spherical-vexu-orientation.mp4 from the FATE suite. Free any existing structure before allocating a new one. The last box still wins, as before. Signed-off-by: Sathvik Prabhu <[email protected]> --- libavformat/mov.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/mov.c b/libavformat/mov.c index bb4c112f55c..608271809f6 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -7343,6 +7343,7 @@ static int mov_read_sv3d(MOVContext *c, AVIOContext *pb, MOVAtom atom) return 0; } + av_freep(&sc->spherical); sc->spherical = av_spherical_alloc(&sc->spherical_size); if (!sc->spherical) return AVERROR(ENOMEM); @@ -7427,6 +7428,7 @@ static int mov_read_vexu_proj(MOVContext *c, AVIOContext *pb, MOVAtom atom) return AVERROR_INVALIDDATA; } + av_freep(&sc->spherical); sc->spherical = av_spherical_alloc(&sc->spherical_size); if (!sc->spherical) return AVERROR(ENOMEM); -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
