[FFmpeg-devel] [PATCH] avoid double-free on ffmdec open fail

[Reimar Döffinger]

On Sat, Jul 24, 2010 at 02:17:46PM -0700, Baptiste Coudurier wrote:
> On 7/24/10 8:25 AM, Reimar D?ffinger wrote:
> >Hello,
> >currently ffmdec for some reason tries to free the streams it created
> >on its own, which causes issues like double frees etc. when the
> >av_close_input_stream does the same.
> >This patch removes the useless and wrong code and also uses more
> >appropriate return values.
> 
> Patch look ok assuming calling av_close_input_file when open
> returned an error is the right thing to do.

No it isn't and it actually isn't what happens...
What actually happens is that av_open_input_stream has
special code to free all streams, which is a very good
idea since it avoids a lot of ugly code in the demuxers.
However it does not call the close function, which is also
think is a reasonable thing to do.
However that means that something like below should actually
be correct, avoiding leaking the rc_eq in the failure case.
This concerns issue 2003 btw.
And testing welcome....

Index: ffmdec.c
===================================================================
--- ffmdec.c    (revision 24481)
+++ ffmdec.c    (working copy)
@@ -252,6 +252,8 @@
 }
 
 
+static int ffm_close(AVFormatContext *s);
+
 static int ffm_read_header(AVFormatContext *s, AVFormatParameters *ap)
 {
     FFMContext *ffm = s->priv_data;
@@ -381,12 +383,7 @@
     ffm->first_packet = 1;
     return 0;
  fail:
-    for(i=0;i<s->nb_streams;i++) {
-        st = s->streams[i];
-        if (st) {
-            av_free(st);
-        }
-    }
+    ffm_close();
     return -1;
 }