Opened 7 months ago

Closed 7 months ago

#7075 closed defect (fixed)

Do not use av_free() to free avformat_alloc_context() return value in ff_rtp_chain_mux_open()

Reported by: PanBian Owned by:
Priority: normal Component: avformat
Version: git-master Keywords:
Cc: Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no

Description

File: libavformat/rtpenc_chain.c
Function: ff_rtp_chain_mux_open()

Details: In ff_rtp_chain_mux_open(), the return value of avformat_alloc_context() (called at line 44) is freed with av_free() (at line 104). I think the expected paired function is avformat_free_context() (as the one called at line 96). For your convenience, I paste related bugs as follows:

 28 int ff_rtp_chain_mux_open(AVFormatContext **out, AVFormatContext *s,
 29                           AVStream *st, URLContext *handle, int packet_size,
 30                           int idx)
 31 {
 32     AVFormatContext *rtpctx = NULL;
 33     int ret;
 34     AVOutputFormat *rtp_format = av_guess_format("rtp", NULL, NULL);
 35     uint8_t *rtpflags;
 36     AVDictionary *opts = NULL;
 37 
 38     if (!rtp_format) {
 39         ret = AVERROR(ENOSYS);
 40         goto fail;
 41     }
 42 
 43     /* Allocate an AVFormatContext for each output stream */
 44     rtpctx = avformat_alloc_context();
 45     if (!rtpctx) {
 46         ret = AVERROR(ENOMEM);
 47         goto fail;
 48     }
 49 
 50     rtpctx->oformat = rtp_format;
 51     if (!avformat_new_stream(rtpctx, NULL)) {
 52         ret = AVERROR(ENOMEM);
 53         goto fail;
 54     }
        ...
 90     if (ret) {
 91         if (handle && rtpctx->pb) {
 92             avio_closep(&rtpctx->pb);
 93         } else if (rtpctx->pb) {
 94             ffio_free_dyn_buf(&rtpctx->pb);
 95         }
 96         avformat_free_context(rtpctx);
 97         return ret;
 98     }
 99 
100     *out = rtpctx;
101     return 0;
102 
103 fail:
104     av_free(rtpctx);
105     if (handle)
106         ffurl_close(handle);
107     return ret;
108 }

Thanks!

Change History (1)

comment:1 Changed 7 months ago by jamrial

  • Component changed from undetermined to avformat
  • Resolution set to fixed
  • Status changed from new to closed
Note: See TracTickets for help on using tickets.