diff options
| author | Thilo Borgmann <thilo.borgmann@mail.de> | 2014-10-21 10:10:55 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-10-21 12:36:52 +0200 |
| commit | 6e6b79e7b8093189fd416670c4e0a7e399705cc1 (patch) | |
| tree | 3242fb857018f4dbb50e451459407956421f7fdb | |
| parent | 282c9354f13553399f83c026ec036321703578eb (diff) | |
| download | ffmpeg-6e6b79e7b8093189fd416670c4e0a7e399705cc1.tar.gz | |
lavf/mov.c: Prevent memory leak in case of invalid metadata reads.
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/mov.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index a7ec910595..80549eca54 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -355,16 +355,16 @@ static int mov_read_udta_string(MOVContext *c, AVIOContext *pb, MOVAtom atom) } #endif - str_size_alloc = str_size << 1; // worst-case requirement for output string in case of utf8 coded input - str = av_malloc(str_size_alloc); - if (!str) - return AVERROR(ENOMEM); - if (!key) return 0; if (atom.size < 0) return AVERROR_INVALIDDATA; + str_size_alloc = str_size << 1; // worst-case requirement for output string in case of utf8 coded input + str = av_malloc(str_size_alloc); + if (!str) + return AVERROR(ENOMEM); + if (parse) parse(c, pb, str_size, key); else { @@ -372,8 +372,10 @@ static int mov_read_udta_string(MOVContext *c, AVIOContext *pb, MOVAtom atom) mov_read_mac_string(c, pb, str_size, str, str_size_alloc); } else { int ret = avio_read(pb, str, str_size); - if (ret != str_size) + if (ret != str_size) { + av_freep(&str); return ret < 0 ? ret : AVERROR_INVALIDDATA; + } str[str_size] = 0; } c->fc->event_flags |= AVFMT_EVENT_FLAG_METADATA_UPDATED; |