diff options
| author | James Almer <jamrial@gmail.com> | 2019-05-22 03:04:38 +0200 |
|---|---|---|
| committer | Mark Thompson <sw@jkqxz.net> | 2019-05-29 00:16:41 +0100 |
| commit | d903c09d9a5c641223f0810d24161520e977544a (patch) | |
| tree | bf6870c9a5cee0d8aba6579f7d6464c2705b67cc | |
| parent | 1759a9e5b52de524fa9f3f4d115087132744176b (diff) | |
| download | ffmpeg-d903c09d9a5c641223f0810d24161520e977544a.tar.gz | |
avcodec/cbs_mpeg2: fix leak of extra_information_slice buffer in cbs_mpeg2_read_slice_header()
cbs_mpeg2_free_slice() calls av_buffer_unref() on extra_information_ref,
meaning allocating with av_malloc() was not the intention.
Signed-off-by: James Almer <jamrial@gmail.com>
| -rw-r--r-- | libavcodec/cbs_mpeg2_syntax_template.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/libavcodec/cbs_mpeg2_syntax_template.c b/libavcodec/cbs_mpeg2_syntax_template.c index d753cdc901..e0cf716874 100644 --- a/libavcodec/cbs_mpeg2_syntax_template.c +++ b/libavcodec/cbs_mpeg2_syntax_template.c @@ -377,10 +377,11 @@ static int FUNC(slice_header)(CodedBitstreamContext *ctx, RWContext *rw, current->extra_information_length = k; if (k > 0) { *rw = start; - current->extra_information = - av_malloc(current->extra_information_length); - if (!current->extra_information) + current->extra_information_ref = + av_buffer_alloc(current->extra_information_length); + if (!current->extra_information_ref) return AVERROR(ENOMEM); + current->extra_information = current->extra_information_ref->data; for (k = 0; k < current->extra_information_length; k++) { xui(1, extra_bit_slice, bit, 1, 1, 0); xui(8, extra_information_slice[k], |