diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-07-19 16:20:53 +0300 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-10-05 22:28:08 +0300 |
| commit | a4945989fe9a5fcad7695f59bcead6afc4eb6cf0 (patch) | |
| tree | c0e732607761615fcf91c34df488e3fb0fb23e0f /libavformat/wc3movie.c | |
| parent | 2b1e1c2d03b2cef1e77e88d3035e4445a37f40ac (diff) | |
avformat/wc3movie: Cleanup on wc3_read_header() failure
Fixes: memleak
Fixes: 23660/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6007508031504384
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b78860e769876d9a18fc4f82dd8e808316d8e682)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat/wc3movie.c')
| -rw-r--r-- | libavformat/wc3movie.c | 36 |
1 files changed, 25 insertions, 11 deletions
diff --git a/libavformat/wc3movie.c b/libavformat/wc3movie.c index e31807e3c8..9dcc54e934 100644 --- a/libavformat/wc3movie.c +++ b/libavformat/wc3movie.c @@ -138,10 +138,14 @@ static int wc3_read_header(AVFormatContext *s) case BNAM_TAG: /* load up the name */ buffer = av_malloc(size+1); - if (!buffer) - return AVERROR(ENOMEM); - if ((ret = avio_read(pb, buffer, size)) != size) - return AVERROR(EIO); + if (!buffer) { + ret = AVERROR(ENOMEM); + goto fail; + } + if ((ret = avio_read(pb, buffer, size)) != size) { + ret = AVERROR(EIO); + goto fail; + } buffer[size] = 0; av_dict_set(&s->metadata, "title", buffer, AV_DICT_DONT_STRDUP_VAL); @@ -162,21 +166,26 @@ static int wc3_read_header(AVFormatContext *s) default: av_log(s, AV_LOG_ERROR, "unrecognized WC3 chunk: %s\n", av_fourcc2str(fourcc_tag)); - return AVERROR_INVALIDDATA; + ret = AVERROR_INVALIDDATA; + goto fail; } fourcc_tag = avio_rl32(pb); /* chunk sizes are 16-bit aligned */ size = (avio_rb32(pb) + 1) & (~1); - if (avio_feof(pb)) - return AVERROR(EIO); + if (avio_feof(pb)) { + ret = AVERROR(EIO); + goto fail; + } } while (fourcc_tag != BRCH_TAG); /* initialize the decoder streams */ st = avformat_new_stream(s, NULL); - if (!st) - return AVERROR(ENOMEM); + if (!st) { + ret = AVERROR(ENOMEM); + goto fail; + } avpriv_set_pts_info(st, 33, 1, WC3_FRAME_FPS); wc3->video_stream_index = st->index; st->codecpar->codec_type = AVMEDIA_TYPE_VIDEO; @@ -186,8 +195,10 @@ static int wc3_read_header(AVFormatContext *s) st->codecpar->height = wc3->height; st = avformat_new_stream(s, NULL); - if (!st) - return AVERROR(ENOMEM); + if (!st) { + ret = AVERROR(ENOMEM); + goto fail; + } avpriv_set_pts_info(st, 33, 1, WC3_FRAME_FPS); wc3->audio_stream_index = st->index; st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO; @@ -202,6 +213,9 @@ static int wc3_read_header(AVFormatContext *s) st->codecpar->block_align = WC3_AUDIO_BITS * WC3_AUDIO_CHANNELS; return 0; +fail: + wc3_read_close(s); + return ret; } static int wc3_read_packet(AVFormatContext *s, |