Merge remote-tracking branch 'cigaes/master'

* cigaes/master:
  lavu/frame: use channels rather than channel_layout.
  lavf: avformat_seek_file(): validate stream_index.
  lavf/concatdec: fix possible leak in case of malloc failure.
  lavfi/buffersink: check av_frame_ref() failure.

Merged-by: Michael Niedermayer <michaelni@gmx.at>

2 files changed, 13 insertions, 5 deletions

diff --git a/libavformat/concatdec.c b/libavformat/concatdec.c
index a9fcc76a03..380ad4383f 100644
--- a/libavformat/concatdec.c
+++ b/libavformat/concatdec.c
@@ -82,25 +82,26 @@ static int add_file(AVFormatContext *avf, char *filename, ConcatFile **rfile,
 {
     ConcatContext *cat = avf->priv_data;
     ConcatFile *file;
-    char *url;
+    char *url = NULL;
     size_t url_len;
+    int ret;
 
     if (cat->safe > 0 && !safe_filename(filename)) {
         av_log(avf, AV_LOG_ERROR, "Unsafe file name '%s'\n", filename);
-        return AVERROR(EPERM);
+        FAIL(AVERROR(EPERM));
     }
     url_len = strlen(avf->filename) + strlen(filename) + 16;
     if (!(url = av_malloc(url_len)))
-        return AVERROR(ENOMEM);
+        FAIL(AVERROR(ENOMEM));
     ff_make_absolute_url(url, url_len, avf->filename, filename);
-    av_free(filename);
+    av_freep(&filename);
 
     if (cat->nb_files >= *nb_files_alloc) {
         size_t n = FFMAX(*nb_files_alloc * 2, 16);
         ConcatFile *new_files;
         if (n <= cat->nb_files || n > SIZE_MAX / sizeof(*cat->files) ||
             !(new_files = av_realloc(cat->files, n * sizeof(*cat->files))))
-            return AVERROR(ENOMEM);
+            FAIL(AVERROR(ENOMEM));
         cat->files = new_files;
         *nb_files_alloc = n;
     }
@@ -114,6 +115,11 @@ static int add_file(AVFormatContext *avf, char *filename, ConcatFile **rfile,
     file->duration   = AV_NOPTS_VALUE;
 
     return 0;
+
+fail:
+    av_free(url);
+    av_free(filename);
+    return ret;
 }
 
 static int open_file(AVFormatContext *avf, unsigned fileno)
diff --git a/libavformat/utils.c b/libavformat/utils.c
index 5cf3d9cd47..a43238bd20 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -2137,6 +2137,8 @@ int avformat_seek_file(AVFormatContext *s, int stream_index, int64_t min_ts, int
 {
     if(min_ts > ts || max_ts < ts)
         return -1;
+    if (stream_index < -1 || stream_index >= (int)s->nb_streams)
+        return AVERROR(EINVAL);
 
     if(s->seek2any>0)
         flags |= AVSEEK_FLAG_ANY;