From d5af8afbe4698273b2ef9b57487489b40f7888b1 Mon Sep 17 00:00:00 2001 From: James Almer Date: Fri, 24 Nov 2017 20:26:08 -0300 Subject: [PATCH] avformat/avc: free buffer in ff_isom_write_avcc on failure Reviewed-by: Michael Niedermayer Signed-off-by: James Almer --- libavformat/avc.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/libavformat/avc.c b/libavformat/avc.c index 85441df8f7..d989594bb0 100644 --- a/libavformat/avc.c +++ b/libavformat/avc.c @@ -145,8 +145,10 @@ int ff_isom_write_avcc(AVIOContext *pb, const uint8_t *data, int len) buf += size; } - if (!sps || !pps || sps_size < 4 || sps_size > UINT16_MAX || pps_size > UINT16_MAX) - return AVERROR_INVALIDDATA; + if (!sps || !pps || sps_size < 4 || sps_size > UINT16_MAX || pps_size > UINT16_MAX) { + ret = AVERROR_INVALIDDATA; + goto fail; + } avio_w8(pb, 1); /* version */ avio_w8(pb, sps[1]); /* profile */ @@ -160,9 +162,11 @@ int ff_isom_write_avcc(AVIOContext *pb, const uint8_t *data, int len) avio_w8(pb, 1); /* number of pps */ avio_wb16(pb, pps_size); avio_write(pb, pps, pps_size); + +fail: av_free(start); - return 0; + return ret; } int ff_avc_write_annexb_extradata(const uint8_t *in, uint8_t **buf, int *size)