openharmony/third_party_ffmpeg
1
0
Fork 0
mirror of https://gitee.com/openharmony/third_party_ffmpeg synced 2024-12-03 16:51:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

mxfdec: fix double free

Browse Source 
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-12-08 05:23:06 +01:00
parent 66dc3ba356
commit 9f92e590ba
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavformat/mxfdec.c
View File

@ -1499,8 +1499,9 @@ static int mxf_parse_structural_metadata(MXFContext *mxf)
codec_ul = mxf_get_codec_ul(ff_mxf_codec_uls, &descriptor->essence_codec_ul); codec_ul = mxf_get_codec_ul(ff_mxf_codec_uls, &descriptor->essence_codec_ul);
st->codec->codec_id = (enum AVCodecID)codec_ul->id; st->codec->codec_id = (enum AVCodecID)codec_ul->id;
if (descriptor->extradata) { if (descriptor->extradata) {
st->codec->extradata = descriptor->extradata; st->codec->extradata = av_mallocz(descriptor->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE);
st->codec->extradata_size = descriptor->extradata_size; if (st->codec->extradata)
memcpy(st->codec->extradata, descriptor->extradata, descriptor->extradata_size);
} }
if (st->codec->codec_type == AVMEDIA_TYPE_VIDEO) { if (st->codec->codec_type == AVMEDIA_TYPE_VIDEO) {
source_track->intra_only = mxf_is_intra_only(descriptor); source_track->intra_only = mxf_is_intra_only(descriptor);
@ -2224,6 +2225,9 @@ static int mxf_read_close(AVFormatContext *s)
for (i = 0; i < mxf->metadata_sets_count; i++) { for (i = 0; i < mxf->metadata_sets_count; i++) {
switch (mxf->metadata_sets[i]->type) { switch (mxf->metadata_sets[i]->type) {
case Descriptor:
av_freep(&((MXFDescriptor *)mxf->metadata_sets[i])->extradata);
break;
case MultipleDescriptor: case MultipleDescriptor:
av_freep(&((MXFDescriptor *)mxf->metadata_sets[i])->sub_descriptors_refs); av_freep(&((MXFDescriptor *)mxf->metadata_sets[i])->sub_descriptors_refs);
break; break;