avformat/mp3enc: use av_copy_packet()

Fixes double free
Fixes Ticket3476

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2014-03-22 01:26:48 +01:00
parent 1b4f2fb165
commit d003a0cd2e
1 changed files with 4 additions and 4 deletions

View File

@ -417,14 +417,14 @@ static int mp3_write_packet(AVFormatContext *s, AVPacket *pkt)
if (mp3->pics_to_write) {
/* buffer audio packets until we get all the pictures */
AVPacketList *pktl = av_mallocz(sizeof(*pktl));
int ret;
if (!pktl)
return AVERROR(ENOMEM);
pktl->pkt = *pkt;
pktl->pkt.buf = av_buffer_ref(pkt->buf);
if (!pktl->pkt.buf) {
ret = av_copy_packet(&pktl->pkt, pkt);
if (ret < 0) {
av_freep(&pktl);
return AVERROR(ENOMEM);
return ret;
}
if (mp3->queue_end)