get_content_url() allocates two buffers for temporary strings and when one of them couldn't be allocated, it simply returns, although one of the two allocations could have succeeded and would leak in this scenario. This can be fixed by avoiding one of the temporary buffers.
Signed-off-by: Andreas Rheinhardt <[email protected]> --- libavformat/dashdec.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c index 73740eb061..be67192b14 100644 --- a/libavformat/dashdec.c +++ b/libavformat/dashdec.c @@ -472,11 +472,9 @@ static char *get_content_url(xmlNodePtr *baseurl_nodes, char *text; char *url = NULL; char *tmp_str = av_mallocz(max_url_size); - char *tmp_str_2 = av_mallocz(max_url_size); - if (!tmp_str || !tmp_str_2) { + if (!tmp_str) return NULL; - } for (i = 0; i < n_baseurl_nodes; ++i) { if (baseurl_nodes[i] && @@ -485,9 +483,7 @@ static char *get_content_url(xmlNodePtr *baseurl_nodes, text = xmlNodeGetContent(baseurl_nodes[i]->children); if (text) { memset(tmp_str, 0, max_url_size); - memset(tmp_str_2, 0, max_url_size); - ff_make_absolute_url(tmp_str_2, max_url_size, tmp_str, text); - av_strlcpy(tmp_str, tmp_str_2, max_url_size); + ff_make_absolute_url(tmp_str, max_url_size, "", text); xmlFree(text); } } @@ -513,7 +509,6 @@ static char *get_content_url(xmlNodePtr *baseurl_nodes, } end: av_free(tmp_str); - av_free(tmp_str_2); return url; } -- 2.25.1 _______________________________________________ ffmpeg-devel mailing list [email protected] https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email [email protected] with subject "unsubscribe".
