rawdec: fix memleak

Fixes fate-lavf-flm under valgrind

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 10 insertions, 3 deletions

diff --git a/libavcodec/rawdec.c b/libavcodec/rawdec.c
index 00730dc6f7..f45ff4c3fa 100644
--- a/libavcodec/rawdec.c
+++ b/libavcodec/rawdec.c
@@ -230,12 +230,15 @@ static int raw_decode(AVCodecContext *avctx, void *data, int *got_frame,
     len = context->frame_size - (avctx->pix_fmt==AV_PIX_FMT_PAL8 ? AVPALETTE_SIZE : 0);
     if (buf_size < len) {
         av_log(avctx, AV_LOG_ERROR, "Invalid buffer size, packet size %d < expected frame_size %d\n", buf_size, len);
+        av_buffer_unref(&frame->buf[0]);
         return AVERROR(EINVAL);
     }
 
     if ((res = avpicture_fill(picture, buf, avctx->pix_fmt,
-                              avctx->width, avctx->height)) < 0)
+                              avctx->width, avctx->height)) < 0) {
+        av_buffer_unref(&frame->buf[0]);
         return res;
+    }
 
     if (avctx->pix_fmt == AV_PIX_FMT_PAL8) {
         const uint8_t *pal = av_packet_get_side_data(avpkt, AV_PKT_DATA_PALETTE,
@@ -244,8 +247,10 @@ static int raw_decode(AVCodecContext *avctx, void *data, int *got_frame,
         if (pal) {
             av_buffer_unref(&context->palette);
             context->palette = av_buffer_alloc(AVPALETTE_SIZE);
-            if (!context->palette)
+            if (!context->palette) {
+                av_buffer_unref(&frame->buf[0]);
                 return AVERROR(ENOMEM);
+            }
             memcpy(context->palette->data, pal, AVPALETTE_SIZE);
             frame->palette_has_changed = 1;
         }
@@ -273,8 +278,10 @@ static int raw_decode(AVCodecContext *avctx, void *data, int *got_frame,
     if ((avctx->pix_fmt == AV_PIX_FMT_PAL8 && buf_size < context->frame_size) ||
         (desc->flags & PIX_FMT_PSEUDOPAL)) {
         frame->buf[1]  = av_buffer_ref(context->palette);
-        if (!frame->buf[1])
+        if (!frame->buf[1]) {
+            av_buffer_unref(&frame->buf[0]);
             return AVERROR(ENOMEM);
+        }
         frame->data[1] = frame->buf[1]->data;
     }