[libav-devel] [PATCH] rm: check memory allocations

[Nidhi Makhijani]

---
 libavformat/rmdec.c | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index eb0f3c5..5d67143 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -91,8 +91,11 @@ static int rm_read_extradata(AVIOContext *pb, AVCodecContext 
*avctx, unsigned si
         return AVERROR(ENOMEM);
     avctx->extradata_size = avio_read(pb, avctx->extradata, size);
     memset(avctx->extradata + avctx->extradata_size, 0, 
FF_INPUT_BUFFER_PADDING_SIZE);
-    if (avctx->extradata_size != size)
+    if (avctx->extradata_size != size) {
+        av_free(avctx->extradata);
+        avctx->extradata_size = 0;
         return AVERROR(EIO);
+    }
     return 0;
 }
 
@@ -110,6 +113,8 @@ static void rm_read_metadata(AVFormatContext *s, 
AVIOContext *pb, int wide)
 RMStream *ff_rm_alloc_rmstream (void)
 {
     RMStream *rms = av_mallocz(sizeof(RMStream));
+    if (!rms)
+        return NULL;
     rms->curpic_num = -1;
     return rms;
 }
@@ -417,6 +422,10 @@ static int rm_read_header_old(AVFormatContext *s)
     if (!st)
         return -1;
     st->priv_data = ff_rm_alloc_rmstream();
+    if (!st->priv_data) {
+        avformat_free_context(s);
+        return AVERROR(ENOMEM);
+    }
     return rm_read_audio_stream_info(s, s->pb, st, st->priv_data, 1);
 }
 
@@ -494,9 +503,16 @@ static int rm_read_header(AVFormatContext *s)
             get_str8(pb, buf, sizeof(buf)); /* mimetype */
             st->codec->codec_type = AVMEDIA_TYPE_DATA;
             st->priv_data = ff_rm_alloc_rmstream();
+            if (!st->priv_data) {
+                avformat_free_context(s);
+                return AVERROR(ENOMEM);
+            }
             if (ff_rm_read_mdpr_codecdata(s, s->pb, st, st->priv_data,
-                                          avio_rb32(pb)) < 0)
+                                          avio_rb32(pb)) < 0) {
+                ff_rm_free_rmstream(st->priv_data);
+                avformat_free_context(s);
                 return -1;
+            }
             break;
         case MKTAG('D', 'A', 'T', 'A'):
             goto header_end;
@@ -655,8 +671,10 @@ static int rm_assemble_video_frame(AVFormatContext *s, 
AVIOContext *pb,
         vst->slices = ((hdr & 0x3F) << 1) + 1;
         vst->videobufsize = len2 + 8*vst->slices + 1;
         av_free_packet(&vst->pkt); //FIXME this should be output.
-        if(av_new_packet(&vst->pkt, vst->videobufsize) < 0)
+        if(av_new_packet(&vst->pkt, vst->videobufsize) < 0) {
+            av_free_packet(pkt);
             return AVERROR(ENOMEM);
+        }
         vst->videobufpos = 8*vst->slices + 1;
         vst->cur_slice = 0;
         vst->curpic_num = pic_num;
-- 
1.9.1

_______________________________________________
libav-devel mailing list
libav-devel@libav.org
https://lists.libav.org/mailman/listinfo/libav-devel