RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avfilter/af_aiir: Fix segfault and leak upon allocation failure 

The aiir filter adds output pads in its init function. Each of these
output pads had a name which was allocated and to be freed in the uninit
function. Given that the aiir filter has between one and two outputs,
one output pad's name was freed unconditionally and a second was freed
conditionally.

Yet if adding output pads fails, there are no output pads at all and
trying to free a nonexistent pad's name will lead to a segfault.

Furthermore, if the name could be successfully allocated, yet adding the
new pad fails, the name would leak.

This commit fixes this by not allocating the pads' names at all any
more: They are constant anyway. This allows to remove the code to free
them and hence fixes the aforementioned bugs.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
This commit is contained in:
Andreas Rheinhardt 2020-08-22 04:47:14 +02:00
parent 281b8187e3
commit 97b1a2c564
1 changed files with 2 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libavfilter/af_aiir.c
View File

@ -1159,26 +1159,21 @@ static av_cold int init(AVFilterContext *ctx)
}
pad = (AVFilterPad){
.name = av_strdup("default"),
.name = "default",
.type = AVMEDIA_TYPE_AUDIO,
.config_props = config_output,
};
if (!pad.name)
return AVERROR(ENOMEM);
ret = ff_insert_outpad(ctx, 0, &pad);
if (ret < 0)
return ret;
if (s->response) {
vpad = (AVFilterPad){
.name = av_strdup("filter_response"),
.name = "filter_response",
.type = AVMEDIA_TYPE_VIDEO,
.config_props = config_video,
};
if (!vpad.name)
return AVERROR(ENOMEM);
ret = ff_insert_outpad(ctx, 1, &vpad);
if (ret < 0)
@ -1205,9 +1200,6 @@ static av_cold void uninit(AVFilterContext *ctx)
}
av_freep(&s->iir);
av_freep(&ctx->output_pads[0].name);
if (s->response)
av_freep(&ctx->output_pads[1].name);
av_frame_free(&s->video);
}