Re: [FFmpeg-devel] [PATCH] libavformat/whip: Add av_freep() to avoid potential memory leak

Re: [FFmpeg-devel] [PATCH] libavformat/whip: Add av_freep() to avoid potential memory leak

[Jiasheng Jiang]

Nicolas George (HE12025-08-07)
> Jiasheng Jiang (HE12025-08-07):
>> Add av_freep() if avio_alloc_context() fails to avoid potential memory leak.
>> 
>> Fixes: 167e343bbe ("avformat/whip: Add WHIP muxer support for subsecond latency streaming")
>> Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
>> ---
>>  libavformat/whip.c | 1 +
>>  1 file changed, 1 insertion(+)
>> 
>> diff --git a/libavformat/whip.c b/libavformat/whip.c
>> index 256ea14d2c..82a5a51029 100644
>> --- a/libavformat/whip.c
>> +++ b/libavformat/whip.c
>> @@ -1553,6 +1553,7 @@ static int create_rtp_muxer(AVFormatContext *s)
>>  
>>          rtp_ctx->pb = avio_alloc_context(buffer, buffer_size, 1, s, NULL, on_rtp_write_packet, NULL);
>>          if (!rtp_ctx->pb) {
>
>> +            av_freep(&buffer);
>>              ret = AVERROR(ENOMEM);
>>              goto end;
>
> That belong to after end, otherwise you need to make the change
> everywhere.
>
>>          }
>
> Regards,

I found that after the success of avio_alloc_context(), buffer is assigned to rtp_ctx->pb->buffer and will be freed in whip_deinit(). Therefore, I think moving av_freep() after end would cause a double free.

- Jiasheng
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] libavformat/whip: Add av_freep() to avoid potential memory leak

[Nicolas George]

Jiasheng Jiang (HE12025-08-08):
> I found that after the success of avio_alloc_context(), buffer is
> assigned to rtp_ctx->pb->buffer and will be freed in whip_deinit().
> Therefore, I think moving av_freep() after end would cause a double
> free.

Indeed, you are right, I had not checked that.

With your change, if somebody adds an extra operation that might fail
between allocating the buffer and using it in the avio context. It might
be better to free the buffer at the end and set it to NULL if
avio_alloc_context() succeeds to avoid the double free, but that is very
minor.

So no objection to the patch, just take half a second considering my
suggestion.

Regards,

-- 
  Nicolas George
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] Re: [PATCH] libavformat/whip: Add av_freep() to avoid potential memory leak

[Jack Lau via ffmpeg-devel]

> On Aug 8, 2025, at 19:07, Nicolas George <george@nsup.org> wrote:
> 
> Jiasheng Jiang (HE12025-08-08):
>> I found that after the success of avio_alloc_context(), buffer is
>> assigned to rtp_ctx->pb->buffer and will be freed in whip_deinit().
>> Therefore, I think moving av_freep() after end would cause a double
>> free.
> 
> Indeed, you are right, I had not checked that.
> 
> With your change, if somebody adds an extra operation that might fail
> between allocating the buffer and using it in the avio context. It might
> be better to free the buffer at the end and set it to NULL if
> avio_alloc_context() succeeds to avoid the double free, but that is very
> minor.
Hi Nicolas,

I guess this patch https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21069 is what you described.

Thanks for your helpful suggestion!

> 
> So no objection to the patch, just take half a second considering my
> suggestion.
> 
> Regards,
> 
> -- 
>  Nicolas George
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Best Regards,
Jack

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org