RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/alsdec: Fix raw_mantissa memleak 

Fixes: 0cee183a09bff5aa5108429717c35a4d/asan_heap-oob_1d99eca_3702_9ef60e80de79082a778d3d9ce8ef3b64.mp4

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2016-09-08 18:11:30 +02:00
parent 837e72b016
commit f2192e0f03
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/alsdec.c
View File

@ -1887,6 +1887,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame_ptr,
static av_cold int decode_end(AVCodecContext *avctx) static av_cold int decode_end(AVCodecContext *avctx)
{ {
ALSDecContext *ctx = avctx->priv_data; ALSDecContext *ctx = avctx->priv_data;
int i;
av_freep(&ctx->sconf.chan_pos); av_freep(&ctx->sconf.chan_pos);
@ -1920,7 +1921,12 @@ static av_cold int decode_end(AVCodecContext *avctx)
av_freep(&ctx->last_acf_mantissa); av_freep(&ctx->last_acf_mantissa);
av_freep(&ctx->shift_value); av_freep(&ctx->shift_value);
av_freep(&ctx->last_shift_value); av_freep(&ctx->last_shift_value);
av_freep(&ctx->raw_mantissa); if (ctx->raw_mantissa) {
for (i = 0; i < avctx->channels; i++) {
av_freep(&ctx->raw_mantissa[i]);
}
av_freep(&ctx->raw_mantissa);
}
av_freep(&ctx->larray); av_freep(&ctx->larray);
av_freep(&ctx->nbits); av_freep(&ctx->nbits);
@ -2064,7 +2070,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
ctx->shift_value = av_malloc_array(avctx->channels, sizeof(*ctx->shift_value)); ctx->shift_value = av_malloc_array(avctx->channels, sizeof(*ctx->shift_value));
ctx->last_shift_value = av_malloc_array(avctx->channels, sizeof(*ctx->last_shift_value)); ctx->last_shift_value = av_malloc_array(avctx->channels, sizeof(*ctx->last_shift_value));
ctx->last_acf_mantissa = av_malloc_array(avctx->channels, sizeof(*ctx->last_acf_mantissa)); ctx->last_acf_mantissa = av_malloc_array(avctx->channels, sizeof(*ctx->last_acf_mantissa));
ctx->raw_mantissa = av_malloc_array(avctx->channels, sizeof(*ctx->raw_mantissa)); ctx->raw_mantissa = av_mallocz_array(avctx->channels, sizeof(*ctx->raw_mantissa));
ctx->larray = av_malloc_array(ctx->cur_frame_length * 4, sizeof(*ctx->larray)); ctx->larray = av_malloc_array(ctx->cur_frame_length * 4, sizeof(*ctx->larray));
ctx->nbits = av_malloc_array(ctx->cur_frame_length, sizeof(*ctx->nbits)); ctx->nbits = av_malloc_array(ctx->cur_frame_length, sizeof(*ctx->nbits));