RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-29 02:42:21 +00:00
Code Issues Projects Releases Wiki Activity

avformat/avidec: Fix memleak with embedded GAB2 subtitles

Browse Source 
The code for GAB2 subtitles predates refcounting AVPackets. So in order
to transfer the ownership of a packet's data pkt->data was simply stored
and the packet zeroed; in the end (i.e. in the read_close-function) this
data was then simply freed with av_freep(). This of course leads to a leak
of an AVBufferRef and an AVBuffer. It has been fixed by keeping and
eventually unreferencing the packet's buf instead.

Additionally, the packet is now reset via av_packet_unref().

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
This commit is contained in:
Andreas Rheinhardt 2020-03-27 08:31:29 +01:00
parent de0b04551d
commit da44bbefaa
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libavformat/avidec.c
View File

@ -60,7 +60,7 @@ typedef struct AVIStream {
AVFormatContext *sub_ctx; AVFormatContext *sub_ctx;
AVPacket sub_pkt; AVPacket sub_pkt;
uint8_t *sub_buffer; AVBufferRef *sub_buffer;
int64_t seek_pos; int64_t seek_pos;
} AVIStream; } AVIStream;
@ -1116,8 +1116,9 @@ static int read_gab2_sub(AVFormatContext *s, AVStream *st, AVPacket *pkt)
time_base = ast->sub_ctx->streams[0]->time_base; time_base = ast->sub_ctx->streams[0]->time_base;
avpriv_set_pts_info(st, 64, time_base.num, time_base.den); avpriv_set_pts_info(st, 64, time_base.num, time_base.den);
} }
ast->sub_buffer = pkt->data; ast->sub_buffer = pkt->buf;
memset(pkt, 0, sizeof(*pkt)); pkt->buf = NULL;
av_packet_unref(pkt);
return 1; return 1;
error: error:
@ -1909,7 +1910,7 @@ static int avi_read_close(AVFormatContext *s)
av_freep(&ast->sub_ctx->pb); av_freep(&ast->sub_ctx->pb);
avformat_close_input(&ast->sub_ctx); avformat_close_input(&ast->sub_ctx);
} }
av_freep(&ast->sub_buffer); av_buffer_unref(&ast->sub_buffer);
av_packet_unref(&ast->sub_pkt); av_packet_unref(&ast->sub_pkt);
} }
} }