generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

lavf/mov.c: Prevent memory leak in case of invalid metadata reads.

Browse Source 
Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Thilo Borgmann 2014-10-21 10:10:55 +02:00 committed by Michael Niedermayer
parent 282c9354f1
commit 6e6b79e7b8
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
libavformat/mov.c
View File

@ -355,16 +355,16 @@ static int mov_read_udta_string(MOVContext *c, AVIOContext *pb, MOVAtom atom)
} }
#endif #endif
str_size_alloc = str_size << 1; // worst-case requirement for output string in case of utf8 coded input
str = av_malloc(str_size_alloc);
if (!str)
return AVERROR(ENOMEM);
if (!key) if (!key)
return 0; return 0;
if (atom.size < 0) if (atom.size < 0)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
str_size_alloc = str_size << 1; // worst-case requirement for output string in case of utf8 coded input
str = av_malloc(str_size_alloc);
if (!str)
return AVERROR(ENOMEM);
if (parse) if (parse)
parse(c, pb, str_size, key); parse(c, pb, str_size, key);
else { else {
@ -372,8 +372,10 @@ static int mov_read_udta_string(MOVContext *c, AVIOContext *pb, MOVAtom atom)
mov_read_mac_string(c, pb, str_size, str, str_size_alloc); mov_read_mac_string(c, pb, str_size, str, str_size_alloc);
} else { } else {
int ret = avio_read(pb, str, str_size); int ret = avio_read(pb, str, str_size);
if (ret != str_size) if (ret != str_size) {
av_freep(&str);
return ret < 0 ? ret : AVERROR_INVALIDDATA; return ret < 0 ? ret : AVERROR_INVALIDDATA;
}
str[str_size] = 0; str[str_size] = 0;
} }
c->fc->event_flags |= AVFMT_EVENT_FLAG_METADATA_UPDATED; c->fc->event_flags |= AVFMT_EVENT_FLAG_METADATA_UPDATED;