Michael Niedermayer:
> Fixes: CID 1403229 Dereference after null check
>
> Signed-off-by: Michael Niedermayer <[email protected]>
> ---
> libavfilter/signature_lookup.c | 25 ++++++++++++++-----------
> 1 file changed, 14 insertions(+), 11 deletions(-)
>
> diff --git a/libavfilter/signature_lookup.c b/libavfilter/signature_lookup.c
> index 86dd0c66754..6e45fde1b5a 100644
> --- a/libavfilter/signature_lookup.c
> +++ b/libavfilter/signature_lookup.c
> @@ -37,6 +37,14 @@
> #define STATUS_END_REACHED 1
> #define STATUS_BEGIN_REACHED 2
>
> +static void sll_free(MatchingInfo **sll)
> +{
> + while (*sll) {
> + sll = &(*sll)->next;
> + av_freep(sll);
> + }
> +}
> +
This will leak every element except the second (if existing) of the
linked list.
> static void fill_l1distlut(uint8_t lut[])
> {
> int i, j, tmp_i, tmp_j,count;
> @@ -290,6 +298,10 @@ static MatchingInfo*
> get_matching_parameters(AVFilterContext *ctx, SignatureCont
> av_log(ctx, AV_LOG_FATAL, "Could not allocate
> memory");
> c = c->next;
> }
> + if (!c) {
> + sll_free(&cands);
> + goto error;
> + }
> c->framerateratio = (i+1.0) / 30;
> c->score = hspace[i][j].score;
> c->offset = j-90;
> @@ -305,6 +317,7 @@ static MatchingInfo*
> get_matching_parameters(AVFilterContext *ctx, SignatureCont
> }
> }
> }
> + error:
> for (i = 0; i < MAX_FRAMERATE; i++) {
> av_freep(&hspace[i]);
> }
> @@ -520,16 +533,6 @@ static MatchingInfo evaluate_parameters(AVFilterContext
> *ctx, SignatureContext *
> return bestmatch;
> }
>
> -static void sll_free(MatchingInfo *sll)
> -{
> - void *tmp;
> - while (sll) {
> - tmp = sll;
> - sll = sll->next;
> - av_freep(&tmp);
> - }
> -}
> -
> static MatchingInfo lookup_signatures(AVFilterContext *ctx, SignatureContext
> *sc, StreamContext *first, StreamContext *second, int mode)
> {
> CoarseSignature *cs, *cs2;
> @@ -572,7 +575,7 @@ static MatchingInfo lookup_signatures(AVFilterContext
> *ctx, SignatureContext *sc
> "ratio %f, offset %d, score %d, %d frames matching\n",
> bestmatch.first->index, bestmatch.second->index,
> bestmatch.framerateratio, bestmatch.offset,
> bestmatch.score, bestmatch.matchframes);
> - sll_free(infos);
> + sll_free(&infos);
> }
> } while (find_next_coarsecandidate(sc, second->coarsesiglist, &cs, &cs2,
> 0) && !bestmatch.whole);
> return bestmatch;
_______________________________________________
ffmpeg-devel mailing list
[email protected]
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
[email protected] with subject "unsubscribe".
