RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

segment: Fix the failure paths 

A failure in segment_end() or segment_start() would lead to freeing
a dangling pointer and in general further calls to seg_write_packet()
or to seg_write_trailer() would have the same faulty behaviour.

CC: libav-stable@libav.org
Reported-By: luodalongde@gmail.com
(cherry picked from commit b3f0465736)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This commit is contained in:
Luca Barbato 2015-01-05 10:40:41 +01:00
parent 3280b86c85
commit f6c82b34a3
1 changed files with 20 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
libavformat/segment.c
View File

@ -183,6 +183,13 @@ static void close_null_ctx(AVIOContext *pb)
av_free(pb);
}
static void seg_free_context(SegmentContext *seg)
{
avio_closep(&seg->pb);
avformat_free_context(seg->avf);
seg->avf = NULL;
}
static int seg_write_header(AVFormatContext *s)
{
SegmentContext *seg = s->priv_data;
@ -264,12 +271,9 @@ static int seg_write_header(AVFormatContext *s)
}
fail:
if (ret) {
if (seg->list)
avio_close(seg->pb);
if (seg->avf)
avformat_free_context(seg->avf);
}
if (ret < 0)
seg_free_context(seg);
return ret;
}
@ -281,6 +285,9 @@ static int seg_write_packet(AVFormatContext *s, AVPacket *pkt)
int64_t end_pts = seg->recording_time * seg->number;
int ret, can_split = 1;
if (!oc)
return AVERROR(EINVAL);
if (seg->has_video) {
can_split = st->codec->codec_type == AVMEDIA_TYPE_VIDEO &&
pkt->flags & AV_PKT_FLAG_KEY;
@ -321,11 +328,8 @@ static int seg_write_packet(AVFormatContext *s, AVPacket *pkt)
ret = ff_write_chained(oc, pkt->stream_index, pkt, s);
fail:
if (ret < 0) {
if (seg->list)
avio_close(seg->pb);
avformat_free_context(oc);
}
if (ret < 0)
seg_free_context(seg);
return ret;
}
@ -334,7 +338,11 @@ static int seg_write_trailer(struct AVFormatContext *s)
{
SegmentContext *seg = s->priv_data;
AVFormatContext *oc = seg->avf;
int ret;
int ret = 0;
if (!oc)
goto fail;
if (!seg->write_header_trailer) {
if ((ret = segment_end(oc, 0)) < 0)
goto fail;