* [FFmpeg-devel] [PATCH 1/5] avcodec/utvideodec: fix leaks in decode_plane() and decode_plane10()
2025-06-29 6:45 [FFmpeg-devel] [PATCH 0/5] fix multiple memory leaks Lidong Yan
@ 2025-06-29 6:45 ` Lidong Yan
2025-06-29 6:45 ` [FFmpeg-devel] [PATCH 2/5] avformat/rtpdec_latm: fix leak in parse_fmtp_config() Lidong Yan
` (3 subsequent siblings)
4 siblings, 0 replies; 7+ messages in thread
From: Lidong Yan @ 2025-06-29 6:45 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: Lidong Yan
In decode_plane() and decode_plane10(), both of these two functions use
build_buff() which allocates memory in vlc and multi. And both of them
forget to release vlc and multi when build_buff report a symbol to fill
slices with. Add cleanup label and goto cleanup first before return 0.
Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
---
libavcodec/utvideodec.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/libavcodec/utvideodec.c b/libavcodec/utvideodec.c
index 4c0fa2ca67..f15d623462 100644
--- a/libavcodec/utvideodec.c
+++ b/libavcodec/utvideodec.c
@@ -179,7 +179,7 @@ static int decode_plane10(UtvideoContext *c, int plane_no,
dest += stride;
}
}
- return 0;
+ goto cleanup;
}
send = 0;
@@ -216,6 +216,7 @@ static int decode_plane10(UtvideoContext *c, int plane_no,
"%d bits left after decoding slice\n", get_bits_left(&gb));
}
+cleanup:
ff_vlc_free(&vlc);
ff_vlc_free_multi(&multi);
@@ -322,7 +323,7 @@ static int decode_plane(UtvideoContext *c, int plane_no,
dest += stride;
}
}
- return 0;
+ goto cleanup;
}
src += 256;
@@ -361,6 +362,7 @@ static int decode_plane(UtvideoContext *c, int plane_no,
"%d bits left after decoding slice\n", get_bits_left(&gb));
}
+cleanup:
ff_vlc_free(&vlc);
ff_vlc_free_multi(&multi);
--
2.50.0.106.gf0135a9047.dirty
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 7+ messages in thread* [FFmpeg-devel] [PATCH 2/5] avformat/rtpdec_latm: fix leak in parse_fmtp_config()
2025-06-29 6:45 [FFmpeg-devel] [PATCH 0/5] fix multiple memory leaks Lidong Yan
2025-06-29 6:45 ` [FFmpeg-devel] [PATCH 1/5] avcodec/utvideodec: fix leaks in decode_plane() and decode_plane10() Lidong Yan
@ 2025-06-29 6:45 ` Lidong Yan
2025-06-29 6:45 ` [FFmpeg-devel] [PATCH 3/5] swscale/graph: fix leak in adapt_colors() Lidong Yan
` (2 subsequent siblings)
4 siblings, 0 replies; 7+ messages in thread
From: Lidong Yan @ 2025-06-29 6:45 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: Lidong Yan
av_mallocz() allocates memory in config, but we forget to free it
if init_get_bits() failed. Replace return ret with goto end.
Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
---
libavformat/rtpdec_latm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/rtpdec_latm.c b/libavformat/rtpdec_latm.c
index 2b4478289e..74523c167d 100644
--- a/libavformat/rtpdec_latm.c
+++ b/libavformat/rtpdec_latm.c
@@ -104,7 +104,7 @@ static int parse_fmtp_config(AVStream *st, const char *value)
ff_hex_to_data(config, value);
ret = init_get_bits(&gb, config, len*8);
if (ret < 0)
- return ret;
+ goto end;
audio_mux_version = get_bits(&gb, 1);
same_time_framing = get_bits(&gb, 1);
skip_bits(&gb, 6); /* num_sub_frames */
--
2.50.0.106.gf0135a9047.dirty
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 7+ messages in thread* [FFmpeg-devel] [PATCH 3/5] swscale/graph: fix leak in adapt_colors()
2025-06-29 6:45 [FFmpeg-devel] [PATCH 0/5] fix multiple memory leaks Lidong Yan
2025-06-29 6:45 ` [FFmpeg-devel] [PATCH 1/5] avcodec/utvideodec: fix leaks in decode_plane() and decode_plane10() Lidong Yan
2025-06-29 6:45 ` [FFmpeg-devel] [PATCH 2/5] avformat/rtpdec_latm: fix leak in parse_fmtp_config() Lidong Yan
@ 2025-06-29 6:45 ` Lidong Yan
2025-06-29 6:45 ` [FFmpeg-devel] [PATCH 4/5] avcodec/sunrast: fix leak in sunrast_decode_frame() Lidong Yan
2025-06-29 6:45 ` [FFmpeg-devel] [PATCH 5/5] avformat/rtpdec_asf: fix leak in ff_wms_parse_sdp_a_line() Lidong Yan
4 siblings, 0 replies; 7+ messages in thread
From: Lidong Yan @ 2025-06-29 6:45 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: Lidong Yan
In adapt_colors(), ff_sws_lut3d_generate() allocates memory in lut.
However if add_legacy_sws_pass() failed, lut leaks. free lut before
return ret.
Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
---
libswscale/graph.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/libswscale/graph.c b/libswscale/graph.c
index dc7784aa49..975a2b6065 100644
--- a/libswscale/graph.c
+++ b/libswscale/graph.c
@@ -523,8 +523,10 @@ static int adapt_colors(SwsGraph *graph, SwsFormat src, SwsFormat dst,
SwsFormat tmp = src;
tmp.format = fmt_in;
ret = add_legacy_sws_pass(graph, src, tmp, input, &input);
- if (ret < 0)
+ if (ret < 0) {
+ ff_sws_lut3d_free(&lut);
return ret;
+ }
}
ret = ff_sws_lut3d_generate(lut, fmt_in, fmt_out, &map);
--
2.50.0.106.gf0135a9047.dirty
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 7+ messages in thread* [FFmpeg-devel] [PATCH 4/5] avcodec/sunrast: fix leak in sunrast_decode_frame()
2025-06-29 6:45 [FFmpeg-devel] [PATCH 0/5] fix multiple memory leaks Lidong Yan
` (2 preceding siblings ...)
2025-06-29 6:45 ` [FFmpeg-devel] [PATCH 3/5] swscale/graph: fix leak in adapt_colors() Lidong Yan
@ 2025-06-29 6:45 ` Lidong Yan
2025-06-29 6:45 ` [FFmpeg-devel] [PATCH 5/5] avformat/rtpdec_asf: fix leak in ff_wms_parse_sdp_a_line() Lidong Yan
4 siblings, 0 replies; 7+ messages in thread
From: Lidong Yan @ 2025-06-29 6:45 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: Lidong Yan
In sunrast_decode_frame(), we use av_malloc_array() allocates memory
to ptr and ptr2. However if buf_end - buf < 1, this function returns
error code without freeing this memory thus cause a leak. Add av_freep()
before return.
Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
---
libavcodec/sunrast.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/libavcodec/sunrast.c b/libavcodec/sunrast.c
index 9e49c4f275..cc27838f5b 100644
--- a/libavcodec/sunrast.c
+++ b/libavcodec/sunrast.c
@@ -163,8 +163,10 @@ static int sunrast_decode_frame(AVCodecContext *avctx, AVFrame *p,
x = 0;
while (ptr != end && buf < buf_end) {
run = 1;
- if (buf_end - buf < 1)
+ if (buf_end - buf < 1) {
+ av_freep(&ptr2);
return AVERROR_INVALIDDATA;
+ }
if ((value = *buf++) == RLE_TRIGGER) {
run = *buf++ + 1;
--
2.50.0.106.gf0135a9047.dirty
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 7+ messages in thread* [FFmpeg-devel] [PATCH 5/5] avformat/rtpdec_asf: fix leak in ff_wms_parse_sdp_a_line()
2025-06-29 6:45 [FFmpeg-devel] [PATCH 0/5] fix multiple memory leaks Lidong Yan
` (3 preceding siblings ...)
2025-06-29 6:45 ` [FFmpeg-devel] [PATCH 4/5] avcodec/sunrast: fix leak in sunrast_decode_frame() Lidong Yan
@ 2025-06-29 6:45 ` Lidong Yan
4 siblings, 0 replies; 7+ messages in thread
From: Lidong Yan @ 2025-06-29 6:45 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: Lidong Yan
In ff_wms_parse_sdp_a_line(), it allocates memory in buf, but doesn't
free buf when avformat_alloc_context() failed. Add av_free(buf) before
return to prevent from leak.
Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
---
libavformat/rtpdec_asf.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/libavformat/rtpdec_asf.c b/libavformat/rtpdec_asf.c
index 9664623e57..b3b346f3cc 100644
--- a/libavformat/rtpdec_asf.c
+++ b/libavformat/rtpdec_asf.c
@@ -120,8 +120,10 @@ int ff_wms_parse_sdp_a_line(AVFormatContext *s, const char *p)
avformat_close_input(&rt->asf_ctx);
}
- if (!(iformat = av_find_input_format("asf")))
+ if (!(iformat = av_find_input_format("asf"))) {
+ av_free(buf);
return AVERROR_DEMUXER_NOT_FOUND;
+ }
rt->asf_ctx = avformat_alloc_context();
if (!rt->asf_ctx) {
--
2.50.0.106.gf0135a9047.dirty
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
^ permalink raw reply [flat|nested] 7+ messages in thread