Opened 7 years ago
Closed 7 years ago
#7075 closed defect (fixed)
Do not use av_free() to free avformat_alloc_context() return value in ff_rtp_chain_mux_open()
Reported by: | PanBian | Owned by: | |
---|---|---|---|
Priority: | normal | Component: | avformat |
Version: | git-master | Keywords: | |
Cc: | Blocked By: | ||
Blocking: | Reproduced by developer: | no | |
Analyzed by developer: | no |
Description
File: libavformat/rtpenc_chain.c
Function: ff_rtp_chain_mux_open()
Details: In ff_rtp_chain_mux_open(), the return value of avformat_alloc_context() (called at line 44) is freed with av_free() (at line 104). I think the expected paired function is avformat_free_context() (as the one called at line 96). For your convenience, I paste related bugs as follows:
28 int ff_rtp_chain_mux_open(AVFormatContext **out, AVFormatContext *s, 29 AVStream *st, URLContext *handle, int packet_size, 30 int idx) 31 { 32 AVFormatContext *rtpctx = NULL; 33 int ret; 34 AVOutputFormat *rtp_format = av_guess_format("rtp", NULL, NULL); 35 uint8_t *rtpflags; 36 AVDictionary *opts = NULL; 37 38 if (!rtp_format) { 39 ret = AVERROR(ENOSYS); 40 goto fail; 41 } 42 43 /* Allocate an AVFormatContext for each output stream */ 44 rtpctx = avformat_alloc_context(); 45 if (!rtpctx) { 46 ret = AVERROR(ENOMEM); 47 goto fail; 48 } 49 50 rtpctx->oformat = rtp_format; 51 if (!avformat_new_stream(rtpctx, NULL)) { 52 ret = AVERROR(ENOMEM); 53 goto fail; 54 } ... 90 if (ret) { 91 if (handle && rtpctx->pb) { 92 avio_closep(&rtpctx->pb); 93 } else if (rtpctx->pb) { 94 ffio_free_dyn_buf(&rtpctx->pb); 95 } 96 avformat_free_context(rtpctx); 97 return ret; 98 } 99 100 *out = rtpctx; 101 return 0; 102 103 fail: 104 av_free(rtpctx); 105 if (handle) 106 ffurl_close(handle); 107 return ret; 108 }
Thanks!
Change History (1)
comment:1 by , 7 years ago
Component: | undetermined → avformat |
---|---|
Resolution: | → fixed |
Status: | new → closed |
Note:
See TracTickets
for help on using tickets.
Fixed in 3eff98c9278804b4b664bad3853e5e60184c6a54