> On Dec 1, 2021, at 11:25 AM, Steven Liu <[email protected]> wrote:
>
> From: Steven Liu <[email protected]>
>
> Because the s->buffer has been freed by av_freep in avio_closep.
> It should not av_freep the buffer in label fail after avio_closep.
> Then just move the av_freep before avio_closep and remove the label fail.
The patch LGTM, but the subject should be changed to reflect the
key point of the patch: fix double free.
>
> Reported-by: TOTE Robot <[email protected]>
> Signed-off-by: Steven Liu <[email protected]>
> ---
> libavformat/aviobuf.c | 14 ++++++--------
> 1 file changed, 6 insertions(+), 8 deletions(-)
>
> diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
> index 5da4dea7b6..3fbb942e76 100644
> --- a/libavformat/aviobuf.c
> +++ b/libavformat/aviobuf.c
> @@ -977,18 +977,19 @@ int ffio_fdopen(AVIOContext **s, URLContext *h)
> (int (*)(void *, uint8_t *, int)) ffurl_read,
> (int (*)(void *, uint8_t *, int)) ffurl_write,
> (int64_t (*)(void *, int64_t, int))ffurl_seek);
> - if (!*s)
> - goto fail;
> -
> + if (!*s) {
> + av_freep(&buffer);
> + return AVERROR(ENOMEM);
> + }
> (*s)->protocol_whitelist = av_strdup(h->protocol_whitelist);
> if (!(*s)->protocol_whitelist && h->protocol_whitelist) {
> avio_closep(s);
> - goto fail;
> + return AVERROR(ENOMEM);
> }
> (*s)->protocol_blacklist = av_strdup(h->protocol_blacklist);
> if (!(*s)->protocol_blacklist && h->protocol_blacklist) {
> avio_closep(s);
> - goto fail;
> + return AVERROR(ENOMEM);
> }
> (*s)->direct = h->flags & AVIO_FLAG_DIRECT;
>
> @@ -1006,9 +1007,6 @@ int ffio_fdopen(AVIOContext **s, URLContext *h)
> ((FFIOContext*)(*s))->short_seek_get = (int (*)(void
> *))ffurl_get_short_seek;
> (*s)->av_class = &ff_avio_class;
> return 0;
> -fail:
> - av_freep(&buffer);
> - return AVERROR(ENOMEM);
> }
>
> URLContext* ffio_geturlcontext(AVIOContext *s)
> --
> 2.25.0
>
> _______________________________________________
> ffmpeg-devel mailing list
> [email protected]
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> [email protected] with subject "unsubscribe".
_______________________________________________
ffmpeg-devel mailing list
[email protected]
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
[email protected] with subject "unsubscribe".
