[FFmpeg-devel] [PATCH] graphparser: fix logic for updating the open_inputs/outputs in avfilter_graph_parse()

[Stefano Sabatini]

In particular, fix possible NULL pointer derefences, in case
open_inputs/outputs is NULL.
---
 libavfilter/graphparser.c |   20 ++++++++++++--------
 1 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/libavfilter/graphparser.c b/libavfilter/graphparser.c
index 5178eea..62fa1a1 100644
--- a/libavfilter/graphparser.c
+++ b/libavfilter/graphparser.c
@@ -333,20 +333,22 @@ static int parse_outputs(const char **buf, AVFilterInOut **curr_inputs,
 }
 
 int avfilter_graph_parse(AVFilterGraph *graph, const char *filters,
-                         AVFilterInOut **open_inputs, AVFilterInOut **open_outputs,
+                         AVFilterInOut **open_inputs_ptr, AVFilterInOut **open_outputs_ptr,
                          void *log_ctx)
 {
     int index = 0, ret;
     char chr = 0;
 
     AVFilterInOut *curr_inputs = NULL;
+    AVFilterInOut *open_inputs  = open_inputs_ptr  ? *open_inputs_ptr  : NULL;
+    AVFilterInOut *open_outputs = open_outputs_ptr ? *open_outputs_ptr : NULL;
 
     do {
         AVFilterContext *filter;
         const char *filterchain = filters;
         filters += strspn(filters, WHITESPACES);
 
-        if ((ret = parse_inputs(&filters, &curr_inputs, open_outputs, log_ctx)) < 0)
+        if ((ret = parse_inputs(&filters, &curr_inputs, &open_outputs, log_ctx)) < 0)
             goto fail;
 
         if ((ret = parse_filter(&filter, &filters, graph, index, log_ctx)) < 0)
@@ -355,14 +357,14 @@ int avfilter_graph_parse(AVFilterGraph *graph, const char *filters,
         if (filter->input_count == 1 && !curr_inputs && !index) {
             /* First input can be omitted if it is "[in]" */
             const char *tmp = "[in]";
-            if ((ret = parse_inputs(&tmp, &curr_inputs, open_outputs, log_ctx)) < 0)
+            if ((ret = parse_inputs(&tmp, &curr_inputs, &open_outputs, log_ctx)) < 0)
                 goto fail;
         }
 
-        if ((ret = link_filter_inouts(filter, &curr_inputs, open_inputs, log_ctx)) < 0)
+        if ((ret = link_filter_inouts(filter, &curr_inputs, &open_inputs, log_ctx)) < 0)
             goto fail;
 
-        if ((ret = parse_outputs(&filters, &curr_inputs, open_inputs, open_outputs,
+        if ((ret = parse_outputs(&filters, &curr_inputs, &open_inputs, &open_outputs,
                                  log_ctx)) < 0)
             goto fail;
 
@@ -390,7 +392,7 @@ int avfilter_graph_parse(AVFilterGraph *graph, const char *filters,
     if (open_inputs && *open_inputs && !strcmp((*open_inputs)->name, "out") && curr_inputs) {
         /* Last output can be omitted if it is "[out]" */
         const char *tmp = "[out]";
-        if ((ret = parse_outputs(&tmp, &curr_inputs, open_inputs, open_outputs,
+        if ((ret = parse_outputs(&tmp, &curr_inputs, &open_inputs, &open_outputs,
                                  log_ctx)) < 0)
             goto fail;
     }
@@ -401,8 +403,10 @@ int avfilter_graph_parse(AVFilterGraph *graph, const char *filters,
     for (; graph->filter_count > 0; graph->filter_count--)
         avfilter_free(graph->filters[graph->filter_count - 1]);
     av_freep(&graph->filters);
-    avfilter_inout_free(open_inputs);
-    avfilter_inout_free(open_outputs);
+    if (!open_inputs_ptr)
+        avfilter_inout_free(&open_inputs);
+    if (!open_outputs_ptr)
+        avfilter_inout_free(&open_outputs);
     avfilter_inout_free(&curr_inputs);
     return ret;
 }
-- 
1.7.2.5