har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix double free on error in Deluxe Paint Animation demuxer.

Browse Source 
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Laurent Aimar 2011-10-01 00:44:57 +02:00 committed by Michael Niedermayer
parent 7afe9e5638
commit d39d7122e3
1 changed files with 8 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
libavformat/anm.c
View File

@ -134,18 +134,17 @@ static int read_header(AVFormatContext *s,
/* color cycling and palette data */ /* color cycling and palette data */
st->codec->extradata_size = 16*8 + 4*256; st->codec->extradata_size = 16*8 + 4*256;
st->codec->extradata = av_mallocz(st->codec->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE); st->codec->extradata = av_mallocz(st->codec->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE);
if (!st->codec->extradata) { if (!st->codec->extradata)
ret = AVERROR(ENOMEM); return AVERROR(ENOMEM);
goto close_and_return;
}
ret = avio_read(pb, st->codec->extradata, st->codec->extradata_size); ret = avio_read(pb, st->codec->extradata, st->codec->extradata_size);
if (ret < 0) if (ret < 0)
goto close_and_return; return ret;
/* read page table */ /* read page table */
ret = avio_seek(pb, anm->page_table_offset, SEEK_SET); ret = avio_seek(pb, anm->page_table_offset, SEEK_SET);
if (ret < 0) if (ret < 0)
goto close_and_return; return ret;
for (i = 0; i < MAX_PAGES; i++) { for (i = 0; i < MAX_PAGES; i++) {
Page *p = &anm->pt[i]; Page *p = &anm->pt[i];
@ -156,21 +155,15 @@ static int read_header(AVFormatContext *s,
/* find page of first frame */ /* find page of first frame */
anm->page = find_record(anm, 0); anm->page = find_record(anm, 0);
if (anm->page < 0) { if (anm->page < 0)
ret = anm->page; return anm->page;
goto close_and_return;
}
anm->record = -1; anm->record = -1;
return 0; return 0;
invalid: invalid:
av_log_ask_for_sample(s, NULL); av_log_ask_for_sample(s, NULL);
ret = AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
close_and_return:
av_close_input_stream(s);
return ret;
} }
static int read_packet(AVFormatContext *s, static int read_packet(AVFormatContext *s,