[FFmpeg-devel] [PATCH 0/2] fix multiple memory leaks

[FFmpeg-devel] [PATCH 0/2] fix multiple memory leaks

[Lidong Yan]

This patch improves code in
  https://ffmpeg.org/pipermail/ffmpeg-devel/2025-June/345435.html

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEaEpkmRYJKwYBBAHaRw8BAQdAGwGqH/Dwod+i6kR0/Rhn5GanJ7wK8mM9tWP/
W2qu8Ti0HTUwMjAyNDMzMDA1NkBzbWFpbC5uanUuZWR1LmNuiJkEExYKAEEWIQQC
zskBcOehk1y8GoKZR31bPD+6owUCaEpkmQIbAwUJBaOagAULCQgHAgIiAgYVCgkI
CwIEFgIDAQIeBwIXgAAKCRCZR31bPD+6o8wHAQCLomsA4XfTd8IdG983gGULUJe/
0432buy4nX7AsAc87QEA+/QIsWTR6XLJaLa1sLSQCsZkb86U3c17JzG9oivL8gW4
OARoSmSZEgorBgEEAZdVAQUBAQdAfYrEAWd+6bOXkKvHpFmMvKzxAtlhm6ZQKdAq
+MlJ7wQDAQgHiHgEGBYKACAWIQQCzskBcOehk1y8GoKZR31bPD+6owUCaEpkmQIb
DAAKCRCZR31bPD+6ozWxAQC9OFisWrP/hHXUfj8AnC39r5pf5fEBz7lHvFgWNk2b
XwD7Bl6kvIIW7ReqtgXvcl7u78vEo+e9YeTGTlmAogjpeQk=
=rP+W
-----END PGP PUBLIC KEY BLOCK-----

Lidong Yan (2):
  avfilter/asrc_sinc: fix leak in config_input()
  avformat/sapenc: fix leak in sap_write_header()

 libavfilter/asrc_sinc.c |  4 +++-
 libavformat/sapenc.c    | 35 +++++++++++++++++++----------------
 2 files changed, 22 insertions(+), 17 deletions(-)

-- 
2.50.0.108.g6ae0c543ae

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 1/2] avfilter/asrc_sinc: fix leak in config_input()

[Lidong Yan]

In config_input(), fir_to_phase() allocates memory in h[longer].
But if av_calloc() to s->coeffs failed, memory in h[longer] would
leak. Also noticed that after fir_to_phase() there are three return
point, two of them didn't free h[longer]. However, the first return
points means fir_to_phase() failed, which in turn means that memory
in h[longer] has not been allocated yet. To fix this leak, add
av_free(h[longer]) in av_calloc() failed branch would be enough.

Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
---
 libavfilter/asrc_sinc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libavfilter/asrc_sinc.c b/libavfilter/asrc_sinc.c
index 6ff3303316..198c322665 100644
--- a/libavfilter/asrc_sinc.c
+++ b/libavfilter/asrc_sinc.c
@@ -370,8 +370,10 @@ static int config_output(AVFilterLink *outlink)
     s->n = 1 << (av_log2(n) + 1);
     s->rdft_len = 1 << av_log2(n);
     s->coeffs = av_calloc(s->n, sizeof(*s->coeffs));
-    if (!s->coeffs)
+    if (!s->coeffs) {
+        av_free(h[longer]);
         return AVERROR(ENOMEM);
+    }
 
     for (i = 0; i < n; i++)
         s->coeffs[i] = h[longer][i];
-- 
2.50.0.108.g6ae0c543ae

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/2] avformat/sapenc: fix leak in sap_write_header()

[Lidong Yan]

In sap_write_header(), ff_format_set_url() assign new allocated new_url
to contexts[i]->url but forgot to free it later. Add for loop to free
contexts[i]->url before av_free(context).

To prevent from writing free-for-loop in every return point, replace
`return 0` with `ret = 0` so normal execution can fall through cleanup
code. Since normal code execution now go through code after fail label,
replace fail label with cleanup label.

Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
---
 libavformat/sapenc.c | 35 +++++++++++++++++++----------------
 1 file changed, 19 insertions(+), 16 deletions(-)

diff --git a/libavformat/sapenc.c b/libavformat/sapenc.c
index 87a834a8d8..810ba4adf6 100644
--- a/libavformat/sapenc.c
+++ b/libavformat/sapenc.c
@@ -113,7 +113,7 @@ static int sap_write_header(AVFormatContext *s)
         if (getaddrinfo(host, NULL, &hints, &ai)) {
             av_log(s, AV_LOG_ERROR, "Unable to resolve %s\n", host);
             ret = AVERROR(EIO);
-            goto fail;
+            goto cleanup;
         }
         if (ai->ai_family == AF_INET) {
             /* Also known as sap.mcast.net */
@@ -130,7 +130,7 @@ static int sap_write_header(AVFormatContext *s)
             av_log(s, AV_LOG_ERROR, "Host %s resolved to unsupported "
                                     "address family\n", host);
             ret = AVERROR(EIO);
-            goto fail;
+            goto cleanup;
         }
         freeaddrinfo(ai);
     }
@@ -138,7 +138,7 @@ static int sap_write_header(AVFormatContext *s)
     contexts = av_calloc(s->nb_streams, sizeof(*contexts));
     if (!contexts) {
         ret = AVERROR(ENOMEM);
-        goto fail;
+        goto cleanup;
     }
 
     if (s->start_time_realtime == 0  ||  s->start_time_realtime == AV_NOPTS_VALUE)
@@ -156,17 +156,17 @@ static int sap_write_header(AVFormatContext *s)
                                    s->protocol_whitelist, s->protocol_blacklist, NULL);
         if (ret) {
             ret = AVERROR(EIO);
-            goto fail;
+            goto cleanup;
         }
         ret = ff_rtp_chain_mux_open(&contexts[i], s, s->streams[i], fd, 0, i);
         if (ret < 0)
-            goto fail;
+            goto cleanup;
         s->streams[i]->priv_data = contexts[i];
         s->streams[i]->time_base = contexts[i]->streams[0]->time_base;
         new_url = av_strdup(url);
         if (!new_url) {
             ret = AVERROR(ENOMEM);
-            goto fail;
+            goto cleanup;
         }
         ff_format_set_url(contexts[i], new_url);
     }
@@ -181,13 +181,13 @@ static int sap_write_header(AVFormatContext *s)
                                s->protocol_whitelist, s->protocol_blacklist, NULL);
     if (ret) {
         ret = AVERROR(EIO);
-        goto fail;
+        goto cleanup;
     }
 
     udp_fd = ffurl_get_file_handle(sap->ann_fd);
     if (getsockname(udp_fd, (struct sockaddr*) &localaddr, &addrlen)) {
         ret = AVERROR(EIO);
-        goto fail;
+        goto cleanup;
     }
     if (localaddr.ss_family != AF_INET
 #if HAVE_STRUCT_SOCKADDR_IN6
@@ -196,13 +196,13 @@ static int sap_write_header(AVFormatContext *s)
         ) {
         av_log(s, AV_LOG_ERROR, "Unsupported protocol family\n");
         ret = AVERROR(EIO);
-        goto fail;
+        goto cleanup;
     }
     sap->ann_size = 8192;
     sap->ann = av_mallocz(sap->ann_size);
     if (!sap->ann) {
         ret = AVERROR(EIO);
-        goto fail;
+        goto cleanup;
     }
     sap->ann[pos] = (1 << 5);
 #if HAVE_STRUCT_SOCKADDR_IN6
@@ -231,9 +231,8 @@ static int sap_write_header(AVFormatContext *s)
     if (av_sdp_create(contexts, s->nb_streams, &sap->ann[pos],
                       sap->ann_size - pos)) {
         ret = AVERROR_INVALIDDATA;
-        goto fail;
+        goto cleanup;
     }
-    av_freep(&contexts);
     av_log(s, AV_LOG_VERBOSE, "SDP:\n%s\n", &sap->ann[pos]);
     pos += strlen(&sap->ann[pos]);
     sap->ann_size = pos;
@@ -241,14 +240,18 @@ static int sap_write_header(AVFormatContext *s)
     if (sap->ann_size > sap->ann_fd->max_packet_size) {
         av_log(s, AV_LOG_ERROR, "Announcement too large to send in one "
                                 "packet\n");
-        goto fail;
+        goto cleanup;
     }
 
-    return 0;
+    ret = 0;
 
-fail:
+cleanup:
+    for (i = 0; i < s->nb_streams; i++)
+        if (contexts[i])
+            av_free(contexts[i]->url);
     av_free(contexts);
-    sap_write_close(s);
+    if (ret < 0)
+        sap_write_close(s);
     return ret;
 }
 
-- 
2.50.0.108.g6ae0c543ae

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".