avdemux/mux: Memory leak and possible crash in avio_alloc_context

https://bugzilla.gnome.org/show_bug.cgi?id=784735
This commit is contained in:
Satya Prakash Gupta 2017-07-11 11:34:03 +05:30 committed by Sebastian Dröge
parent 4284d791bc
commit 98cf1a7e2d

View file

@ -205,6 +205,9 @@ gst_ffmpegdata_close (AVIOContext * h)
{ {
GstProtocolInfo *info; GstProtocolInfo *info;
if (h == NULL)
return 0;
info = (GstProtocolInfo *) h->opaque; info = (GstProtocolInfo *) h->opaque;
if (info == NULL) if (info == NULL)
return 0; return 0;
@ -265,6 +268,11 @@ gst_ffmpegdata_open (GstPad * pad, int flags, AVIOContext ** context)
*context = *context =
avio_alloc_context (buffer, buffer_size, flags, (void *) info, avio_alloc_context (buffer, buffer_size, flags, (void *) info,
gst_ffmpegdata_read, gst_ffmpegdata_write, gst_ffmpegdata_seek); gst_ffmpegdata_read, gst_ffmpegdata_write, gst_ffmpegdata_seek);
if (*context == NULL) {
GST_WARNING ("Failed to allocate memory");
av_free (buffer);
return -ENOMEM;
}
(*context)->seekable = AVIO_SEEKABLE_NORMAL; (*context)->seekable = AVIO_SEEKABLE_NORMAL;
if (!(flags & AVIO_FLAG_WRITE)) { if (!(flags & AVIO_FLAG_WRITE)) {
(*context)->buf_ptr = (*context)->buf_end; (*context)->buf_ptr = (*context)->buf_end;
@ -318,6 +326,9 @@ gst_ffmpeg_pipe_close (AVIOContext * h)
{ {
GST_LOG ("Closing pipe"); GST_LOG ("Closing pipe");
if (h == NULL)
return 0;
h->opaque = NULL; h->opaque = NULL;
av_freep (&h->buffer); av_freep (&h->buffer);
av_free (h); av_free (h);
@ -343,6 +354,11 @@ gst_ffmpeg_pipe_open (GstFFMpegPipe * ffpipe, int flags, AVIOContext ** context)
*context = *context =
avio_alloc_context (buffer, buffer_size, 0, (void *) ffpipe, avio_alloc_context (buffer, buffer_size, 0, (void *) ffpipe,
gst_ffmpeg_pipe_read, NULL, NULL); gst_ffmpeg_pipe_read, NULL, NULL);
if (*context == NULL) {
GST_WARNING ("Failed to allocate memory");
av_free (buffer);
return -ENOMEM;
}
(*context)->seekable = 0; (*context)->seekable = 0;
(*context)->buf_ptr = (*context)->buf_end; (*context)->buf_ptr = (*context)->buf_end;