From 9f92e590ba91faa1283b1a9a35dd7e43c5bd998b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 8 Dec 2012 05:23:06 +0100 Subject: [PATCH] mxfdec: fix double free Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavformat/mxfdec.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index 921dc427a3..a1884f1080 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -1499,8 +1499,9 @@ static int mxf_parse_structural_metadata(MXFContext *mxf) codec_ul = mxf_get_codec_ul(ff_mxf_codec_uls, &descriptor->essence_codec_ul); st->codec->codec_id = (enum AVCodecID)codec_ul->id; if (descriptor->extradata) { - st->codec->extradata = descriptor->extradata; - st->codec->extradata_size = descriptor->extradata_size; + st->codec->extradata = av_mallocz(descriptor->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE); + if (st->codec->extradata) + memcpy(st->codec->extradata, descriptor->extradata, descriptor->extradata_size); } if (st->codec->codec_type == AVMEDIA_TYPE_VIDEO) { source_track->intra_only = mxf_is_intra_only(descriptor); @@ -2224,6 +2225,9 @@ static int mxf_read_close(AVFormatContext *s) for (i = 0; i < mxf->metadata_sets_count; i++) { switch (mxf->metadata_sets[i]->type) { + case Descriptor: + av_freep(&((MXFDescriptor *)mxf->metadata_sets[i])->extradata); + break; case MultipleDescriptor: av_freep(&((MXFDescriptor *)mxf->metadata_sets[i])->sub_descriptors_refs); break;