From ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5 Mon Sep 17 00:00:00 2001 From: Andreas Rheinhardt Date: Mon, 25 Mar 2024 16:54:25 +0100 Subject: [PATCH] fftools/ffmpeg_mux_init: Fix double-free on error MATCH_PER_STREAM_OPT iterates over all options of a given OptionDef and tests whether they apply to the current stream; if so, they are set to ost->apad, otherwise, the code errors out. If no error happens, ost->apad is av_strdup'ed in order to take ownership of this pointer. But this means that setting it originally was premature, as it leads to double-frees when an error happens lateron. This can simply be reproduced with ffmpeg -filter_complex anullsrc -apad bar -apad:n baz -f null - This is a regression since 83ace80bfd80fcdba2c65fa1d554923ea931d5bd. Fix this by using a temporary variable instead of directly setting ost->apad. Also only strdup the string if it actually is != NULL. Reviewed-by: Marth64 Signed-off-by: Andreas Rheinhardt --- fftools/ffmpeg_mux_init.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/fftools/ffmpeg_mux_init.c b/fftools/ffmpeg_mux_init.c index 818d76acda..d3d7d022ff 100644 --- a/fftools/ffmpeg_mux_init.c +++ b/fftools/ffmpeg_mux_init.c @@ -832,6 +832,7 @@ static int new_stream_audio(Muxer *mux, const OptionsContext *o, int channels = 0; char *layout = NULL; char *sample_fmt = NULL; + const char *apad = NULL; MATCH_PER_STREAM_OPT(audio_channels, i, channels, oc, st); if (channels) { @@ -854,8 +855,12 @@ static int new_stream_audio(Muxer *mux, const OptionsContext *o, MATCH_PER_STREAM_OPT(audio_sample_rate, i, audio_enc->sample_rate, oc, st); - MATCH_PER_STREAM_OPT(apad, str, ost->apad, oc, st); - ost->apad = av_strdup(ost->apad); + MATCH_PER_STREAM_OPT(apad, str, apad, oc, st); + if (apad) { + ost->apad = av_strdup(apad); + if (!ost->apad) + return AVERROR(ENOMEM); + } } return 0;