mpegts: Fix memory leaks and related crashes in mpegs_write_header()

1 files changed, 18 insertions, 3 deletions

diff --git a/libavformat/mpegtsenc.c b/libavformat/mpegtsenc.c
index cbd3aabc76..67bc7ebf3e 100644
--- a/libavformat/mpegtsenc.c
+++ b/libavformat/mpegtsenc.c
@@ -430,9 +430,15 @@ static MpegTSService *mpegts_add_service(MpegTSWrite *ts, int sid,
         return NULL;
     service->pmt.pid       = ts->pmt_start_pid + ts->nb_services;
     service->sid           = sid;
+    service->pcr_pid       = 0x1fff;
     service->provider_name = av_strdup(provider_name);
     service->name          = av_strdup(name);
-    service->pcr_pid       = 0x1fff;
+    if (!service->provider_name || !service->name) {
+        free(service->provider_name);
+        free(service->name);
+        free(service);
+        return NULL;
+    }
     dynarray_add(&ts->services, &ts->nb_services, service);
     return service;
 }
@@ -474,6 +480,9 @@ static int mpegts_write_header(AVFormatContext *s)
     service       = mpegts_add_service(ts, ts->service_id,
                                        provider_name, service_name);
 
+    if (!service)
+        return AVERROR(ENOMEM);
+
     service->pmt.write_packet = section_write_packet;
     service->pmt.opaque       = s;
     service->pmt.cc           = 15;
@@ -491,8 +500,10 @@ static int mpegts_write_header(AVFormatContext *s)
     ts->sdt.opaque       = s;
 
     pids = av_malloc(s->nb_streams * sizeof(*pids));
-    if (!pids)
+    if (!pids) {
+        av_free(service);
         return AVERROR(ENOMEM);
+    }
 
     /* assign pids to each stream */
     for (i = 0; i < s->nb_streams; i++) {
@@ -564,7 +575,10 @@ static int mpegts_write_header(AVFormatContext *s)
                 ret = AVERROR(EINVAL);
                 goto fail;
             }
-            ast = avformat_new_stream(ts_st->amux, NULL);
+            if (!(ast = avformat_new_stream(ts_st->amux, NULL))) {
+                ret = AVERROR(ENOMEM);
+                goto fail;
+            }
             ret = avcodec_copy_context(ast->codec, st->codec);
             if (ret != 0)
                 goto fail;
@@ -633,6 +647,7 @@ static int mpegts_write_header(AVFormatContext *s)
     return 0;
 
 fail:
+    av_free(service);
     av_free(pids);
     for (i = 0; i < s->nb_streams; i++) {
         st    = s->streams[i];