From d003a0cd2e587a47627fd328f9fc5a484adc29f2 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 22 Mar 2014 01:26:48 +0100 Subject: [PATCH] avformat/mp3enc: use av_copy_packet() Fixes double free Fixes Ticket3476 Signed-off-by: Michael Niedermayer --- libavformat/mp3enc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavformat/mp3enc.c b/libavformat/mp3enc.c index adf6a32572..2ae74f9afb 100644 --- a/libavformat/mp3enc.c +++ b/libavformat/mp3enc.c @@ -417,14 +417,14 @@ static int mp3_write_packet(AVFormatContext *s, AVPacket *pkt) if (mp3->pics_to_write) { /* buffer audio packets until we get all the pictures */ AVPacketList *pktl = av_mallocz(sizeof(*pktl)); + int ret; if (!pktl) return AVERROR(ENOMEM); - pktl->pkt = *pkt; - pktl->pkt.buf = av_buffer_ref(pkt->buf); - if (!pktl->pkt.buf) { + ret = av_copy_packet(&pktl->pkt, pkt); + if (ret < 0) { av_freep(&pktl); - return AVERROR(ENOMEM); + return ret; } if (mp3->queue_end)