[FFmpeg-devel] [PATCH 0/4] fix multiple memory leaks

[FFmpeg-devel] [PATCH 0/4] fix multiple memory leaks

[Lidong Yan]

This patch series fixes multiple memory leaks in the following files:
libavformat/rtmpproto.c, libavfilter/asrc_sinc.c, libavformat/sbgdec.c,
and libavformat/sapenc.c.

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEaEpkmRYJKwYBBAHaRw8BAQdAGwGqH/Dwod+i6kR0/Rhn5GanJ7wK8mM9tWP/
W2qu8Ti0HTUwMjAyNDMzMDA1NkBzbWFpbC5uanUuZWR1LmNuiJkEExYKAEEWIQQC
zskBcOehk1y8GoKZR31bPD+6owUCaEpkmQIbAwUJBaOagAULCQgHAgIiAgYVCgkI
CwIEFgIDAQIeBwIXgAAKCRCZR31bPD+6o8wHAQCLomsA4XfTd8IdG983gGULUJe/
0432buy4nX7AsAc87QEA+/QIsWTR6XLJaLa1sLSQCsZkb86U3c17JzG9oivL8gW4
OARoSmSZEgorBgEEAZdVAQUBAQdAfYrEAWd+6bOXkKvHpFmMvKzxAtlhm6ZQKdAq
+MlJ7wQDAQgHiHgEGBYKACAWIQQCzskBcOehk1y8GoKZR31bPD+6owUCaEpkmQIb
DAAKCRCZR31bPD+6ozWxAQC9OFisWrP/hHXUfj8AnC39r5pf5fEBz7lHvFgWNk2b
XwD7Bl6kvIIW7ReqtgXvcl7u78vEo+e9YeTGTlmAogjpeQk=
=rP+W
-----END PGP PUBLIC KEY BLOCK-----

Lidong Yan (4):
  libavformat/rtmpproto: fix rmtp packet leak in gen_connect()
  avfilter/asrc_sinc: fix leak in config_input()
  avformat/sbgdec: fix leak in sbg_read_header()
  avformat/sapenc: fix leak in sap_write_header()

 libavfilter/asrc_sinc.c | 4 +++-
 libavformat/rtmpproto.c | 2 ++
 libavformat/sapenc.c    | 6 ++++++
 libavformat/sbgdec.c    | 6 ++++--
 4 files changed, 15 insertions(+), 3 deletions(-)

-- 
2.50.0-rc1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 1/4] libavformat/rtmpproto: fix rmtp packet leak in gen_connect()

[Lidong Yan]

In libavformat/rtmpproto.c:gen_connect(), if check on string length
or check on codec fourcc failed, ff_rtmp_packet_create() allocated
data in pkt would leak. Add ff_rtmp_packet_destory before return error
code.

Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
---
 libavformat/rtmpproto.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c
index 846376e668..dd850f72ed 100644
--- a/libavformat/rtmpproto.c
+++ b/libavformat/rtmpproto.c
@@ -347,6 +347,7 @@ static int gen_connect(URLContext *s, RTMPContext *rt)
         if ((fourcc_str_len + 1) % 5 != 0) {
             av_log(s, AV_LOG_ERROR, "Malformed rtmp_enhanched_codecs, "
                    "should be of the form hvc1[,av01][,vp09][,...]\n");
+            ff_rtmp_packet_destroy(&pkt);
             return AVERROR(EINVAL);
         }
 
@@ -370,6 +371,7 @@ static int gen_connect(URLContext *s, RTMPContext *rt)
                     ff_amf_write_string(&p, fourcc);
             } else {
                     av_log(s, AV_LOG_ERROR, "Unsupported codec fourcc, %.*s\n", 4, fourcc_data);
+                    ff_rtmp_packet_destroy(&pkt);
                     return AVERROR_PATCHWELCOME;
             }
 
-- 
2.50.0-rc1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/4] avfilter/asrc_sinc: fix leak in config_input()

[Lidong Yan]

In config_input(), fir_to_phase() allocates memory in h[longer].
But if av_calloc() to s->coeffs failed, memory in h[longer] would
leak. Add av_free(h[longer]) in !s->coeffs path.

Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
---
 libavfilter/asrc_sinc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libavfilter/asrc_sinc.c b/libavfilter/asrc_sinc.c
index 6ff3303316..198c322665 100644
--- a/libavfilter/asrc_sinc.c
+++ b/libavfilter/asrc_sinc.c
@@ -370,8 +370,10 @@ static int config_output(AVFilterLink *outlink)
     s->n = 1 << (av_log2(n) + 1);
     s->rdft_len = 1 << av_log2(n);
     s->coeffs = av_calloc(s->n, sizeof(*s->coeffs));
-    if (!s->coeffs)
+    if (!s->coeffs) {
+        av_free(h[longer]);
         return AVERROR(ENOMEM);
+    }
 
     for (i = 0; i < n; i++)
         s->coeffs[i] = h[longer][i];
-- 
2.50.0-rc1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/4] avformat/sbgdec: fix leak in sbg_read_header()

[Lidong Yan]

In sbg_read_header(), if avformat_new_stream() failed, it returns
without cleanup, which may cause memory leaks. Replace return statement
with goto so that we would first clean up then return.

Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
---
 libavformat/sbgdec.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/libavformat/sbgdec.c b/libavformat/sbgdec.c
index bf319be228..4afb51b844 100644
--- a/libavformat/sbgdec.c
+++ b/libavformat/sbgdec.c
@@ -1434,8 +1434,10 @@ static av_cold int sbg_read_header(AVFormatContext *avf)
     }
 
     st = avformat_new_stream(avf, NULL);
-    if (!st)
-        return AVERROR(ENOMEM);
+    if (!st) {
+        r = AVERROR(ENOMEM);
+        goto fail;
+    }
     sti = ffstream(st);
     st->codecpar->codec_type     = AVMEDIA_TYPE_AUDIO;
     st->codecpar->codec_id       = AV_CODEC_ID_FFWAVESYNTH;
-- 
2.50.0-rc1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/4] avformat/sbgdec: fix leak in sbg_read_header()

[Nicolas George]

Lidong Yan (HE12025-06-17):
> In sbg_read_header(), if avformat_new_stream() failed, it returns
> without cleanup, which may cause memory leaks. Replace return statement
> with goto so that we would first clean up then return.
> 
> Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
> ---
>  libavformat/sbgdec.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)

LGTM, thanks.

Regards,

-- 
  Nicolas George
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 3/4] avformat/sbgdec: fix leak in sbg_read_header()

[James Almer]

[-- Attachment #1.1.1: Type: text/plain, Size: 498 bytes --]

On 6/17/2025 11:23 AM, Nicolas George wrote:
> Lidong Yan (HE12025-06-17):
>> In sbg_read_header(), if avformat_new_stream() failed, it returns
>> without cleanup, which may cause memory leaks. Replace return statement
>> with goto so that we would first clean up then return.
>>
>> Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
>> ---
>>   libavformat/sbgdec.c | 6 ++++--
>>   1 file changed, 4 insertions(+), 2 deletions(-)
> 
> LGTM, thanks.
> 
> Regards,

Pushed.


[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 4/4] avformat/sapenc: fix leak in sap_write_header()

[Lidong Yan]

In sap_write_header(), ff_format_set_url() assign new allocated new_url
to contexts[i]->url but forgot to free it later. Add two loops to free
contexts[i]->url before av_free(context).

Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
---
 libavformat/sapenc.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/libavformat/sapenc.c b/libavformat/sapenc.c
index 87a834a8d8..3ba7f16022 100644
--- a/libavformat/sapenc.c
+++ b/libavformat/sapenc.c
@@ -233,6 +233,9 @@ static int sap_write_header(AVFormatContext *s)
         ret = AVERROR_INVALIDDATA;
         goto fail;
     }
+    for (i = 0; i < s->nb_streams; i++)
+        if (contexts[i])
+            av_free(contexts[i]->url);
     av_freep(&contexts);
     av_log(s, AV_LOG_VERBOSE, "SDP:\n%s\n", &sap->ann[pos]);
     pos += strlen(&sap->ann[pos]);
@@ -247,6 +250,9 @@ static int sap_write_header(AVFormatContext *s)
     return 0;
 
 fail:
+    for (i = 0; i < s->nb_streams; i++)
+        if (contexts[i])
+            av_free(contexts[i]->url);
     av_free(contexts);
     sap_write_close(s);
     return ret;
-- 
2.50.0-rc1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".