[FFmpeg-devel] [PATCHv+ BUG REPORT] Various memory leaks

[Reimar Döffinger]

On Thu, Feb 18, 2010 at 11:25:43PM +0100, Vitor Sessak wrote:
> Index: libavformat/xa.c
> ===================================================================
> --- libavformat/xa.c	(revision 21872)
> +++ libavformat/xa.c	(working copy)
> @@ -106,8 +106,11 @@
>      packet_size = 15*st->codec->channels;
>  
>      ret = av_get_packet(pb, pkt, packet_size);
> -    if(ret != packet_size)
> +
> +    if(ret != packet_size) {
> +        av_free_packet(pkt);
>          return AVERROR(EIO);
> +    }

This should be changed to
if (ret < 0)
    return ret;
instead.

> Index: libavformat/dsicin.c
> ===================================================================
> --- libavformat/dsicin.c	(revision 21872)
> +++ libavformat/dsicin.c	(working copy)
> @@ -189,8 +189,10 @@
>          pkt->data[2] = hdr->pal_colors_count >> 8;
>          pkt->data[3] = hdr->video_frame_type;
>  
> -        if (get_buffer(pb, &pkt->data[4], pkt_size) != pkt_size)
> +        if (get_buffer(pb, &pkt->data[4], pkt_size) != pkt_size) {
> +            av_free_packet(pkt);
>              return AVERROR(EIO);
> +        }

This possibly should return partial data, at least it would be a good idea
if it at least returned the get_buffer return value unchanged if it was < 0;

> @@ -198,8 +200,10 @@
>      }
>  
>      /* audio packet */
> -    if (av_new_packet(pkt, cin->audio_buffer_size))
> +    if (av_new_packet(pkt, cin->audio_buffer_size)) {
> +        av_free_packet(pkt);
>          return AVERROR(ENOMEM);
> +    }

There's no leak here.
Though the check should be for < 0 and it should return the value from
av_new_packet unchanged, but that's somewhat minor.