From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 7E2B749E1F for ; Fri, 12 Apr 2024 13:41:36 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 1857A68D26F; Fri, 12 Apr 2024 16:41:33 +0300 (EEST) Received: from mail-pf1-f180.google.com (mail-pf1-f180.google.com [209.85.210.180]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 982B868CB86 for ; Fri, 12 Apr 2024 16:41:26 +0300 (EEST) Received: by mail-pf1-f180.google.com with SMTP id d2e1a72fcca58-6ed5109d924so846966b3a.0 for ; Fri, 12 Apr 2024 06:41:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1712929284; x=1713534084; darn=ffmpeg.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:to:subject:user-agent:mime-version:date:message-id:from :to:cc:subject:date:message-id:reply-to; bh=QqXN5HUZGdRDqAB13B9C2rq8xqF7Eei/vaYhX4NrJS8=; b=YiSYsamN14SAW4CS9c9zNpDsEAryrtlonH2Sztb3bo6jMbjGF3EwQIunRyc27p2fvS MKisLOaXd7KILJtRmDl+FVp7Jr+ZaPHjX9gtewFwafj4AxDclqTaQmBu5vD9x/Hp5Q2k OOxp6K1eqc6E+dTKYON9c4xe9JFYY9Hpr4pmvFSB8XGZNvYI/JkrGUCzt6vKBLwXqOeh 8KSOw8fH/JUrL4Co3vYP+3cWQTr/n95jHT/GAeK/xaGeRihU75Ng0B7sPvulKuPBpxGr Dew3qeAVM5eo4gxpUk9v80cK/cVUzQ0JU6ee9kn9C1P75Qwn2bwG81+FTPUG7Bjrb5jM wc8Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1712929284; x=1713534084; h=content-transfer-encoding:in-reply-to:from:content-language :references:to:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=QqXN5HUZGdRDqAB13B9C2rq8xqF7Eei/vaYhX4NrJS8=; b=HheX0EuD7ceLYIQMGdVEgJFL9zwIqdv8qiNOOvy/HCeBPo54MgsMc0LxMiz1+TSXnq MUnPXI8BiN6f1YaKVj5OruOpP0qUVsjBfVtb4/WzQSI4ERyDgXIeVsJhDWt/l5UtrHqT BhVwYJ3+sb7f8+YuEp9yR9w00QhPvtJD0M0Pwv+Zlgus2tObdRc5PK6kg4FGODMkhE2U /KHoiLBAKl6M6+gdcX2Ua8VwGtJSryPol5sekQ3j4EFwAjw0ScecQJKutqPO1Dwse3To 3DyyS6OtSyaIlPXiZOpADZ0fYYu9QLWXF7HaEts3zTjtjypdSdQo1wORDNeShUURSY0K y0AQ== X-Gm-Message-State: AOJu0YzHEHCH2oIlzk4Ffsl3vrbtyUE0y6TDxmhNpUmpFwzwMf7IOkLH +TaCN0nRCtdmTS33RSlO4u5c82nJGrxMlJAi4GfL0ftDt/hkEU4OFOgknQ== X-Google-Smtp-Source: AGHT+IEr0vqKyf+HoaNIDvS+0n7FyAT5AIApcuI/4RmFqK7KLGBBwd+2sF5DY90/1AOEQ1MLlO9PmA== X-Received: by 2002:a17:902:f688:b0:1e2:6165:8086 with SMTP id l8-20020a170902f68800b001e261658086mr2899930plg.61.1712929283544; Fri, 12 Apr 2024 06:41:23 -0700 (PDT) Received: from [192.168.0.16] ([190.194.167.233]) by smtp.gmail.com with ESMTPSA id l16-20020a170903121000b001e2a42a4c9bsm2990099plh.16.2024.04.12.06.41.21 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 12 Apr 2024 06:41:22 -0700 (PDT) Message-ID: <405113c3-a170-4a69-9b20-3a98292f6b60@gmail.com> Date: Fri, 12 Apr 2024 10:41:25 -0300 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird To: ffmpeg-devel@ffmpeg.org References: <20240412130935.1368867-1-lumingyindetect@163.com> Content-Language: en-US From: James Almer In-Reply-To: <20240412130935.1368867-1-lumingyindetect@163.com> Subject: Re: [FFmpeg-devel] [PATCH] fftools/ffmpeg_mux_init: fix a memory leak in ffmpeg_mux_init.c X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: On 4/12/2024 10:09 AM, LuMingYin wrote: > In the file ffmpeg_mux_init.c located at /FFmpeg/fftools/, a pointer variable named pts is defined at line 2830. At line 2836, this pointer is allocated a dynamic memory area using the function av_malloc_array. When the if statement at line 2852 evaluates to true, there are two possible scenarios. The first scenario is when nb_ch > INT_MAX - size. In this case, the program should release the dynamic memory area pointed to by pts before returning. The second scenario is when the realloc operation for the pts pointer fails. In this case, since the av_realloc_f function releases the original memory in case of reallocation failure, there is no need to release the memory area pointed to by pts. Because the handling of these two scenarios differs, to fix the memory leak issue caused by the first scenario, my patch separates the treatment of these cases. > > Signed-off-by: LuMingYin > --- > fftools/ffmpeg_mux_init.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/fftools/ffmpeg_mux_init.c b/fftools/ffmpeg_mux_init.c > index 6d8bd5bcdf..1f27e4e4f4 100644 > --- a/fftools/ffmpeg_mux_init.c > +++ b/fftools/ffmpeg_mux_init.c > @@ -2849,8 +2849,12 @@ static int parse_forced_key_frames(void *log, KeyframeForceCtx *kf, > unsigned int nb_ch = mux->fc->nb_chapters; > int j; > > - if (nb_ch > INT_MAX - size || > - !(pts = av_realloc_f(pts, size += nb_ch - 1, > + if (nb_ch > INT_MAX - size) { > + av_freep(&pts); > + return AVERROR(ENOMEM); There's a fail label at the end that frees pts. You should set ret to AVERROR(ENOMEM) and goto it. An alternative could be something like > diff --git a/fftools/ffmpeg_mux_init.c b/fftools/ffmpeg_mux_init.c > index 1d0a210450..0d93f0eff2 100644 > --- a/fftools/ffmpeg_mux_init.c > +++ b/fftools/ffmpeg_mux_init.c > @@ -2959,10 +2959,11 @@ static int parse_forced_key_frames(void *log, KeyframeForceCtx *kf, > unsigned int nb_ch = mux->fc->nb_chapters; > int j; > > - if (nb_ch > INT_MAX - size || > - !(pts = av_realloc_f(pts, size += nb_ch - 1, > - sizeof(*pts)))) > - return AVERROR(ENOMEM); > + if (nb_ch > (INT_MAX - size) / sizeof(*pts) || > + av_reallocp(&pts, (size += nb_ch - 1) * sizeof(*pts))) { > + ret = AVERROR(ENOMEM); > + goto fail; > + } > > if (p[8]) { > ret = av_parse_time(&t, p + 8, 1); Where av_reallocp() will set pts to NULL after freeing, so the free in the fail label will be a no-op, and we always jump to fail on failure in case it's extended to do further cleaning. _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".