generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

vf_pullup: simplify, fix double free error

Browse Source 
The memory allocation for f->diffs was freed multiple times in some
corner cases. Simplify the code so that this doesn't happen.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
wm4 2014-03-25 13:53:11 +01:00 committed by Michael Niedermayer
parent 54e2e9fbc1
commit 5b0ce5d4e3
1 changed files with 13 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
libavfilter/vf_pullup.c
View File

@ -126,20 +126,20 @@ static int alloc_metrics(PullupContext *s, PullupField *f)
return 0; return 0;
} }
static void free_field_queue(PullupField *head, PullupField **last) static void free_field_queue(PullupField *head)
{ {
PullupField *f = head; PullupField *f = head;
while (f) { do {
PullupField *next;
if (!f)
break;
av_free(f->diffs); av_free(f->diffs);
av_free(f->combs); av_free(f->combs);
av_free(f->vars); av_free(f->vars);
if (f == *last) { next = f->next;
av_freep(last); av_free(f);
break; f = next;
} } while (f != head);
f = f->next;
av_freep(&f->prev);
};
} }
static PullupField *make_field_queue(PullupContext *s, int len) static PullupField *make_field_queue(PullupContext *s, int len)
@ -158,14 +158,14 @@ static PullupField *make_field_queue(PullupContext *s, int len)
for (; len > 0; len--) { for (; len > 0; len--) {
f->next = av_mallocz(sizeof(*f->next)); f->next = av_mallocz(sizeof(*f->next));
if (!f->next) { if (!f->next) {
free_field_queue(head, &f); free_field_queue(head);
return NULL; return NULL;
} }
f->next->prev = f; f->next->prev = f;
f = f->next; f = f->next;
if (alloc_metrics(s, f) < 0) { if (alloc_metrics(s, f) < 0) {
free_field_queue(head, &f); free_field_queue(head);
return NULL; return NULL;
} }
} }
@ -736,7 +736,8 @@ static av_cold void uninit(AVFilterContext *ctx)
PullupContext *s = ctx->priv; PullupContext *s = ctx->priv;
int i; int i;
free_field_queue(s->head, &s->last); free_field_queue(s->head);
s->last = NULL;
for (i = 0; i < FF_ARRAY_ELEMS(s->buffers); i++) { for (i = 0; i < FF_ARRAY_ELEMS(s->buffers); i++) {
av_freep(&s->buffers[i].planes[0]); av_freep(&s->buffers[i].planes[0]);