diff options
| author | Andreas Rheinhardt <andreas.rheinhardt@gmail.com> | 2020-07-20 22:44:42 +0200 |
|---|---|---|
| committer | Andreas Rheinhardt <andreas.rheinhardt@gmail.com> | 2021-02-27 07:20:58 +0100 |
| commit | 2d91ddd2dff1eae935f958135bf3658e7c56e341 (patch) | |
| tree | dcd0cd5383ff3dd113fd2845ced5b3eb595cda7b | |
| parent | 7b4ff1a19a1d7118d95612ef2950de712ce4ba0d (diff) | |
| download | ffmpeg-2d91ddd2dff1eae935f958135bf3658e7c56e341.tar.gz | |
avformat/rmdec: Fix potential crash on allocation failure
The RealMedia demuxer uses the priv_data of its streams to store a
structure containing an AVPacket. These packets are unreferenced in the
read_close function, yet said function simply presumed that the
priv_data has been successfully allocated. This implies that it mustn't
be called when an allocation of priv_data fails; but this can happen
since commit 35bbc1955a58ba74552c50d9161084644f00bbd3 if one has a
stream with multiple substreams (also exported as AVStream) and if
allocating the priv_data for one of these substreams fails.
This has been fixed by making sure that read_close can handle the case
in which priv_data has not been successfully allocated.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 5aafdb4e5fe3ca8a0d8b16498caf5899a8d68e2c)
| -rw-r--r-- | libavformat/rmdec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c index 0c52abd1ad..6b3ab47123 100644 --- a/libavformat/rmdec.c +++ b/libavformat/rmdec.c @@ -115,6 +115,9 @@ RMStream *ff_rm_alloc_rmstream (void) void ff_rm_free_rmstream (RMStream *rms) { + if (!rms) + return; + av_packet_unref(&rms->pkt); } |