RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-01-15 20:01:42 +00:00
Code Issues Projects Releases Wiki Activity

avformat/wc3movie: Cleanup on wc3_read_header() failure

Browse Source 
Fixes: memleak
Fixes: 23660/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6007508031504384

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2020-07-19 15:20:53 +02:00
parent 0c635f2ce6
commit b78860e769
1 changed files with 23 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
libavformat/wc3movie.c
View File

@ -139,10 +139,14 @@ static int wc3_read_header(AVFormatContext *s)
/* load up the name */ /* load up the name */
buffer = av_malloc(size+1); buffer = av_malloc(size+1);
if (!buffer) if (!buffer)
return AVERROR(ENOMEM); if (!buffer) {
ret = AVERROR(ENOMEM);
goto fail;
}
if ((ret = avio_read(pb, buffer, size)) != size) { if ((ret = avio_read(pb, buffer, size)) != size) {
av_freep(&buffer); av_freep(&buffer);
return AVERROR(EIO); ret = AVERROR(EIO);
goto fail;
} }
buffer[size] = 0; buffer[size] = 0;
av_dict_set(&s->metadata, "title", buffer, av_dict_set(&s->metadata, "title", buffer,
@ -164,21 +168,26 @@ static int wc3_read_header(AVFormatContext *s)
default: default:
av_log(s, AV_LOG_ERROR, "unrecognized WC3 chunk: %s\n", av_log(s, AV_LOG_ERROR, "unrecognized WC3 chunk: %s\n",
av_fourcc2str(fourcc_tag)); av_fourcc2str(fourcc_tag));
return AVERROR_INVALIDDATA; ret = AVERROR_INVALIDDATA;
goto fail;
} }
fourcc_tag = avio_rl32(pb); fourcc_tag = avio_rl32(pb);
/* chunk sizes are 16-bit aligned */ /* chunk sizes are 16-bit aligned */
size = (avio_rb32(pb) + 1) & (~1); size = (avio_rb32(pb) + 1) & (~1);
if (avio_feof(pb)) if (avio_feof(pb)) {
return AVERROR(EIO); ret = AVERROR(EIO);
goto fail;
}
} while (fourcc_tag != BRCH_TAG); } while (fourcc_tag != BRCH_TAG);
/* initialize the decoder streams */ /* initialize the decoder streams */
st = avformat_new_stream(s, NULL); st = avformat_new_stream(s, NULL);
if (!st) if (!st) {
return AVERROR(ENOMEM); ret = AVERROR(ENOMEM);
goto fail;
}
avpriv_set_pts_info(st, 33, 1, WC3_FRAME_FPS); avpriv_set_pts_info(st, 33, 1, WC3_FRAME_FPS);
wc3->video_stream_index = st->index; wc3->video_stream_index = st->index;
st->codecpar->codec_type = AVMEDIA_TYPE_VIDEO; st->codecpar->codec_type = AVMEDIA_TYPE_VIDEO;
@ -188,8 +197,10 @@ static int wc3_read_header(AVFormatContext *s)
st->codecpar->height = wc3->height; st->codecpar->height = wc3->height;
st = avformat_new_stream(s, NULL); st = avformat_new_stream(s, NULL);
if (!st) if (!st) {
return AVERROR(ENOMEM); ret = AVERROR(ENOMEM);
goto fail;
}
avpriv_set_pts_info(st, 33, 1, WC3_FRAME_FPS); avpriv_set_pts_info(st, 33, 1, WC3_FRAME_FPS);
wc3->audio_stream_index = st->index; wc3->audio_stream_index = st->index;
st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO; st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
@ -204,6 +215,9 @@ static int wc3_read_header(AVFormatContext *s)
st->codecpar->block_align = WC3_AUDIO_BITS * WC3_AUDIO_CHANNELS; st->codecpar->block_align = WC3_AUDIO_BITS * WC3_AUDIO_CHANNELS;
return 0; return 0;
fail:
wc3_read_close(s);
return ret;
} }
static int wc3_read_packet(AVFormatContext *s, static int wc3_read_packet(AVFormatContext *s,