diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-12-08 05:23:06 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-12-09 11:46:26 +0100 |
| commit | 9f92e590ba91faa1283b1a9a35dd7e43c5bd998b (patch) | |
| tree | 8825e3d3e9f7df3695894a4bccda3dc06ecefe24 /libavformat/mxfdec.c | |
| parent | 66dc3ba356e6651e85098e6aab048c6680ea2845 (diff) | |
| download | ffmpeg-9f92e590ba91faa1283b1a9a35dd7e43c5bd998b.tar.gz | |
mxfdec: fix double free
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/mxfdec.c')
| -rw-r--r-- | libavformat/mxfdec.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index 921dc427a3..a1884f1080 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -1499,8 +1499,9 @@ static int mxf_parse_structural_metadata(MXFContext *mxf) codec_ul = mxf_get_codec_ul(ff_mxf_codec_uls, &descriptor->essence_codec_ul); st->codec->codec_id = (enum AVCodecID)codec_ul->id; if (descriptor->extradata) { - st->codec->extradata = descriptor->extradata; - st->codec->extradata_size = descriptor->extradata_size; + st->codec->extradata = av_mallocz(descriptor->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE); + if (st->codec->extradata) + memcpy(st->codec->extradata, descriptor->extradata, descriptor->extradata_size); } if (st->codec->codec_type == AVMEDIA_TYPE_VIDEO) { source_track->intra_only = mxf_is_intra_only(descriptor); @@ -2224,6 +2225,9 @@ static int mxf_read_close(AVFormatContext *s) for (i = 0; i < mxf->metadata_sets_count; i++) { switch (mxf->metadata_sets[i]->type) { + case Descriptor: + av_freep(&((MXFDescriptor *)mxf->metadata_sets[i])->extradata); + break; case MultipleDescriptor: av_freep(&((MXFDescriptor *)mxf->metadata_sets[i])->sub_descriptors_refs); break; |