aboutsummaryrefslogtreecommitdiffstats
path: root/libavfilter/af_channelmap.c
diff options
context:
space:
mode:
authorAndreas Rheinhardt <andreas.rheinhardt@gmail.com>2020-08-07 15:04:41 +0200
committerAndreas Rheinhardt <andreas.rheinhardt@gmail.com>2020-08-23 23:31:15 +0200
commitfd1a2a54a478462212b25753e7106c13af1e33c6 (patch)
treeb767fb87c5c72df5f0e589421c6ea9f0a6eb29f4 /libavfilter/af_channelmap.c
parenta86ee5fd79840dc4af3e3f5c90ff8ce19b9ae993 (diff)
downloadffmpeg-fd1a2a54a478462212b25753e7106c13af1e33c6.tar.gz
avfilter/vf_alphamerge: Fix double-free of AVFilterFormats on error
The query_formats function of the alphamerge filter tries to allocate two lists of formats which on success are attached to more permanent objects (AVFilterLinks) for storage afterwards. If attaching a list to an AVFilterLink succeeds, the link becomes one of the owners of the list. Yet if attaching a list to one of its links succeeds and an error happens lateron, both lists were manually freed, which is wrong if the list is already owned by one or more links; these links' pointers to their lists will become dangling and there will be a double-free/use- after-free when these links are cleaned up automatically. This commit fixes this by removing the custom freeing code; this will temporarily add a leaking codepath (if attaching a list not already owned by a link to a link fails, the list will leak), but this will be fixed soon by making sure that an AVFilterFormats without owner will be automatically freed when attaching it to an AVFilterLink fails. At most one list leaks because as of this commit a new list is only allocated after the old list has been successfully attached to a link. Reviewed-by: Nicolas George <george@nsup.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Diffstat (limited to 'libavfilter/af_channelmap.c')
0 files changed, 0 insertions, 0 deletions