GitList

Browse code

lavu/frame: fix malloc error path in av_frame_copy_props()

The error path frees all side data, but forgets to reset the side data
count. This can blow up later in av_frame_unref() and free_side_data().

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a400edbb6d00c0211de38e4f1b4f593681db91d8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

wm4 authored on 2014/12/15 12:32:58
Showing 1 changed files

libavutil/frame.c index 747aa79..32a41fb 100644

libavutil/frame.c

History View file @ b9510b3

@@ -487,6 +487,7 @@ int av_frame_copy_props(AVFrame *dst, const AVFrame *src)
                 av_dict_free(&dst->side_data[i]->metadata);
             }
             av_freep(&dst->side_data);
+            dst->nb_side_data = 0;
             return AVERROR(ENOMEM);
         }
         memcpy(sd_dst->data, sd_src->data, sd_src->size);

...	...	@@ -487,6 +487,7 @@ int av_frame_copy_props(AVFrame dst, const AVFrame src)
487	487	av_dict_free(&dst->side_data[i]->metadata);
488	488	}
489	489	av_freep(&dst->side_data);
	490	+ dst->nb_side_data = 0;
490	491	return AVERROR(ENOMEM);
491	492	}
492	493	memcpy(sd_dst->data, sd_src->data, sd_src->size);