[FFmpeg-cvslog] dvbsubdec: Free subrect memory on allocation error

[Vittorio Giovara]

ffmpeg | branch: master | Vittorio Giovara <vittorio.giovara at gmail.com> | Tue Jun 13 11:35:16 2017 -0400| [a594f17f83a1ffdc1eec18818208fe39487dd5d7] | committer: Vittorio Giovara

dvbsubdec: Free subrect memory on allocation error

Signed-off-by: Vittorio Giovara <vittorio.giovara at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a594f17f83a1ffdc1eec18818208fe39487dd5d7
---

 libavcodec/dvbsubdec.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/libavcodec/dvbsubdec.c b/libavcodec/dvbsubdec.c
index 63523b765e..b97ff8027b 100644
--- a/libavcodec/dvbsubdec.c
+++ b/libavcodec/dvbsubdec.c
@@ -1293,6 +1293,10 @@ static int dvbsub_display_end_segment(AVCodecContext *avctx, const uint8_t *buf,
         for (i = 0; i < sub->num_rects; i++) {
             sub->rects[i] = av_mallocz(sizeof(*sub->rects[i]));
             if (!sub->rects[i]) {
+                int j;
+                for (j = 0; j < i; j ++)
+                    av_free(sub->rects[j]);
+                av_free(sub->rects);
                 return AVERROR(ENOMEM);
             }
         }
@@ -1335,6 +1339,8 @@ static int dvbsub_display_end_segment(AVCodecContext *avctx, const uint8_t *buf,
 
         rect->data[1] = av_mallocz(AVPALETTE_SIZE);
         if (!rect->data[1]) {
+            for (i = 0; i < sub->num_rects; i++)
+                av_free(sub->rects[i]);
             av_free(sub->rects);
             return AVERROR(ENOMEM);
         }
@@ -1343,6 +1349,8 @@ static int dvbsub_display_end_segment(AVCodecContext *avctx, const uint8_t *buf,
         rect->data[0] = av_malloc(region->buf_size);
         if (!rect->data[0]) {
             av_free(rect->data[1]);
+            for (i = 0; i < sub->num_rects; i++)
+                av_free(sub->rects[i]);
             av_free(sub->rects);
             return AVERROR(ENOMEM);
         }