[FFmpeg-devel] [PATCH 0/4] fix multiple memory leaks

[FFmpeg-devel] [PATCH 0/4] fix multiple memory leaks

[Lidong Yan]

This patch series fixes multiple memory leaks in the following files:
libavformat/rtmpproto.c, libavfilter/asrc_sinc.c, libavformat/sbgdec.c,
and libavformat/sapenc.c.

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEaEpkmRYJKwYBBAHaRw8BAQdAGwGqH/Dwod+i6kR0/Rhn5GanJ7wK8mM9tWP/
W2qu8Ti0HTUwMjAyNDMzMDA1NkBzbWFpbC5uanUuZWR1LmNuiJkEExYKAEEWIQQC
zskBcOehk1y8GoKZR31bPD+6owUCaEpkmQIbAwUJBaOagAULCQgHAgIiAgYVCgkI
CwIEFgIDAQIeBwIXgAAKCRCZR31bPD+6o8wHAQCLomsA4XfTd8IdG983gGULUJe/
0432buy4nX7AsAc87QEA+/QIsWTR6XLJaLa1sLSQCsZkb86U3c17JzG9oivL8gW4
OARoSmSZEgorBgEEAZdVAQUBAQdAfYrEAWd+6bOXkKvHpFmMvKzxAtlhm6ZQKdAq
+MlJ7wQDAQgHiHgEGBYKACAWIQQCzskBcOehk1y8GoKZR31bPD+6owUCaEpkmQIb
DAAKCRCZR31bPD+6ozWxAQC9OFisWrP/hHXUfj8AnC39r5pf5fEBz7lHvFgWNk2b
XwD7Bl6kvIIW7ReqtgXvcl7u78vEo+e9YeTGTlmAogjpeQk=
=rP+W
-----END PGP PUBLIC KEY BLOCK-----

Lidong Yan (4):
  libavformat/rtmpproto: fix rmtp packet leak in gen_connect()
  avfilter/asrc_sinc: fix leak in config_input()
  avformat/sbgdec: fix leak in sbg_read_header()
  avformat/sapenc: fix leak in sap_write_header()

 libavfilter/asrc_sinc.c | 4 +++-
 libavformat/rtmpproto.c | 2 ++
 libavformat/sapenc.c    | 6 ++++++
 libavformat/sbgdec.c    | 6 ++++--
 4 files changed, 15 insertions(+), 3 deletions(-)

-- 
2.50.0-rc1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 1/4] libavformat/rtmpproto: fix rmtp packet leak in gen_connect()

[Lidong Yan]

In libavformat/rtmpproto.c:gen_connect(), if check on string length
or check on codec fourcc failed, ff_rtmp_packet_create() allocated
data in pkt would leak. Add ff_rtmp_packet_destory before return error
code.

Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
---
 libavformat/rtmpproto.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c
index 846376e668..dd850f72ed 100644
--- a/libavformat/rtmpproto.c
+++ b/libavformat/rtmpproto.c
@@ -347,6 +347,7 @@ static int gen_connect(URLContext *s, RTMPContext *rt)
         if ((fourcc_str_len + 1) % 5 != 0) {
             av_log(s, AV_LOG_ERROR, "Malformed rtmp_enhanched_codecs, "
                    "should be of the form hvc1[,av01][,vp09][,...]\n");
+            ff_rtmp_packet_destroy(&pkt);
             return AVERROR(EINVAL);
         }
 
@@ -370,6 +371,7 @@ static int gen_connect(URLContext *s, RTMPContext *rt)
                     ff_amf_write_string(&p, fourcc);
             } else {
                     av_log(s, AV_LOG_ERROR, "Unsupported codec fourcc, %.*s\n", 4, fourcc_data);
+                    ff_rtmp_packet_destroy(&pkt);
                     return AVERROR_PATCHWELCOME;
             }
 
-- 
2.50.0-rc1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/4] avfilter/asrc_sinc: fix leak in config_input()

[Lidong Yan]

In config_input(), fir_to_phase() allocates memory in h[longer].
But if av_calloc() to s->coeffs failed, memory in h[longer] would
leak. Add av_free(h[longer]) in !s->coeffs path.

Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
---
 libavfilter/asrc_sinc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libavfilter/asrc_sinc.c b/libavfilter/asrc_sinc.c
index 6ff3303316..198c322665 100644
--- a/libavfilter/asrc_sinc.c
+++ b/libavfilter/asrc_sinc.c
@@ -370,8 +370,10 @@ static int config_output(AVFilterLink *outlink)
     s->n = 1 << (av_log2(n) + 1);
     s->rdft_len = 1 << av_log2(n);
     s->coeffs = av_calloc(s->n, sizeof(*s->coeffs));
-    if (!s->coeffs)
+    if (!s->coeffs) {
+        av_free(h[longer]);
         return AVERROR(ENOMEM);
+    }
 
     for (i = 0; i < n; i++)
         s->coeffs[i] = h[longer][i];
-- 
2.50.0-rc1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/4] avformat/sbgdec: fix leak in sbg_read_header()

[Lidong Yan]

In sbg_read_header(), if avformat_new_stream() failed, it returns
without cleanup, which may cause memory leaks. Replace return statement
with goto so that we would first clean up then return.

Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
---
 libavformat/sbgdec.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/libavformat/sbgdec.c b/libavformat/sbgdec.c
index bf319be228..4afb51b844 100644
--- a/libavformat/sbgdec.c
+++ b/libavformat/sbgdec.c
@@ -1434,8 +1434,10 @@ static av_cold int sbg_read_header(AVFormatContext *avf)
     }
 
     st = avformat_new_stream(avf, NULL);
-    if (!st)
-        return AVERROR(ENOMEM);
+    if (!st) {
+        r = AVERROR(ENOMEM);
+        goto fail;
+    }
     sti = ffstream(st);
     st->codecpar->codec_type     = AVMEDIA_TYPE_AUDIO;
     st->codecpar->codec_id       = AV_CODEC_ID_FFWAVESYNTH;
-- 
2.50.0-rc1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 4/4] avformat/sapenc: fix leak in sap_write_header()

[Lidong Yan]

In sap_write_header(), ff_format_set_url() assign new allocated new_url
to contexts[i]->url but forgot to free it later. Add two loops to free
contexts[i]->url before av_free(context).

Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
---
 libavformat/sapenc.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/libavformat/sapenc.c b/libavformat/sapenc.c
index 87a834a8d8..3ba7f16022 100644
--- a/libavformat/sapenc.c
+++ b/libavformat/sapenc.c
@@ -233,6 +233,9 @@ static int sap_write_header(AVFormatContext *s)
         ret = AVERROR_INVALIDDATA;
         goto fail;
     }
+    for (i = 0; i < s->nb_streams; i++)
+        if (contexts[i])
+            av_free(contexts[i]->url);
     av_freep(&contexts);
     av_log(s, AV_LOG_VERBOSE, "SDP:\n%s\n", &sap->ann[pos]);
     pos += strlen(&sap->ann[pos]);
@@ -247,6 +250,9 @@ static int sap_write_header(AVFormatContext *s)
     return 0;
 
 fail:
+    for (i = 0; i < s->nb_streams; i++)
+        if (contexts[i])
+            av_free(contexts[i]->url);
     av_free(contexts);
     sap_write_close(s);
     return ret;
-- 
2.50.0-rc1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/4] avformat/sbgdec: fix leak in sbg_read_header()

[Nicolas George]

Lidong Yan (HE12025-06-17):
> In sbg_read_header(), if avformat_new_stream() failed, it returns
> without cleanup, which may cause memory leaks. Replace return statement
> with goto so that we would first clean up then return.
> 
> Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
> ---
>  libavformat/sbgdec.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)

LGTM, thanks.

Regards,

-- 
  Nicolas George
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/4] avformat/sbgdec: fix leak in sbg_read_header()

[James Almer]

[-- Attachment #1.1.1: Type: text/plain, Size: 498 bytes --]

On 6/17/2025 11:23 AM, Nicolas George wrote:
> Lidong Yan (HE12025-06-17):
>> In sbg_read_header(), if avformat_new_stream() failed, it returns
>> without cleanup, which may cause memory leaks. Replace return statement
>> with goto so that we would first clean up then return.
>>
>> Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
>> ---
>>   libavformat/sbgdec.c | 6 ++++--
>>   1 file changed, 4 insertions(+), 2 deletions(-)
> 
> LGTM, thanks.
> 
> Regards,

Pushed.


[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/4] avfilter/asrc_sinc: fix leak in config_input()

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 567 bytes --]

Hi

On Tue, Jun 17, 2025 at 10:14:14PM +0800, Lidong Yan wrote:
> In config_input(), fir_to_phase() allocates memory in h[longer].
> But if av_calloc() to s->coeffs failed, memory in h[longer] would
> leak. Add av_free(h[longer]) in !s->coeffs path.

does the other return in config_output() not need this free too?

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Some people wanted to paint the bikeshed green, some blue and some pink.
People argued and fought, when they finally agreed, only rust was left.

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 4/4] avformat/sapenc: fix leak in sap_write_header()

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 1735 bytes --]

On Tue, Jun 17, 2025 at 10:14:16PM +0800, Lidong Yan wrote:
> In sap_write_header(), ff_format_set_url() assign new allocated new_url
> to contexts[i]->url but forgot to free it later. Add two loops to free
> contexts[i]->url before av_free(context).
> 
> Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
> ---
>  libavformat/sapenc.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/libavformat/sapenc.c b/libavformat/sapenc.c
> index 87a834a8d8..3ba7f16022 100644
> --- a/libavformat/sapenc.c
> +++ b/libavformat/sapenc.c
> @@ -233,6 +233,9 @@ static int sap_write_header(AVFormatContext *s)
>          ret = AVERROR_INVALIDDATA;
>          goto fail;
>      }
> +    for (i = 0; i < s->nb_streams; i++)
> +        if (contexts[i])
> +            av_free(contexts[i]->url);
>      av_freep(&contexts);
>      av_log(s, AV_LOG_VERBOSE, "SDP:\n%s\n", &sap->ann[pos]);
>      pos += strlen(&sap->ann[pos]);
> @@ -247,6 +250,9 @@ static int sap_write_header(AVFormatContext *s)
>      return 0;
>  
>  fail:
> +    for (i = 0; i < s->nb_streams; i++)
> +        if (contexts[i])
> +            av_free(contexts[i]->url);
>      av_free(contexts);
>      sap_write_close(s);
>      return ret;

this can be factored like:

like
+    ret = 0;
     fail:
+    for (i = 0; i < s->nb_streams; i++)
+        if (contexts[i])
+            av_free(contexts[i]->url);
    av_free(contexts);
+   if (ret < 0)
        sap_write_close(s);


[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Some people wanted to paint the bikeshed green, some blue and some pink.
People argued and fought, when they finally agreed, only rust was left.

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/4] avfilter/asrc_sinc: fix leak in config_input()

[ld y]

Michael Niedermayer <michael@niedermayer.cc> writes：

> does the other return in config_output() not need this free too?
>

I believe all the other return behind fir_to_phase() has called
av_free(h[longer])
already. I would love to add this message to my next patch series.

Thanks,
Lidong
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 4/4] avformat/sapenc: fix leak in sap_write_header()

[ld y]

Michael Niedermayer <michael@niedermayer.cc> writes:

> this can be factored like:
>
> like
> +    ret = 0;
>      fail:
> +    for (i = 0; i < s->nb_streams; i++)
> +        if (contexts[i])
> +            av_free(contexts[i]->url);
>     av_free(contexts);
> +   if (ret < 0)
>         sap_write_close(s);
>

Yeah this looks much better. I will use it in my v2 patch.

One more question, would it be ok to rename fail label to end label.
I'm not sure if it's worth the change, though.

Thanks,
Lidong
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".