[FFmpeg-devel] [PATCH] avformat/aviobuf: remove unnecessary label in ffio_fdopen

["zhilizhao(赵志立)"]

> On Dec 1, 2021, at 11:25 AM, Steven Liu <lq at chinaffmpeg.org> wrote:
> 
> From: Steven Liu <liuqi05 at kuaishou.com>
> 
> Because the s->buffer has been freed by av_freep in avio_closep.
> It should not av_freep the buffer in label fail after avio_closep.
> Then just move the av_freep before avio_closep and remove the label fail.

The patch LGTM, but the subject should be changed to reflect the
key point of the patch: fix double free.

> 
> Reported-by: TOTE Robot <oslab at tsinghua.edu.cn>
> Signed-off-by: Steven Liu <liuqi05 at kuaishou.com>
> ---
> libavformat/aviobuf.c | 14 ++++++--------
> 1 file changed, 6 insertions(+), 8 deletions(-)
> 
> diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
> index 5da4dea7b6..3fbb942e76 100644
> --- a/libavformat/aviobuf.c
> +++ b/libavformat/aviobuf.c
> @@ -977,18 +977,19 @@ int ffio_fdopen(AVIOContext **s, URLContext *h)
>                             (int (*)(void *, uint8_t *, int))  ffurl_read,
>                             (int (*)(void *, uint8_t *, int))  ffurl_write,
>                             (int64_t (*)(void *, int64_t, int))ffurl_seek);
> -    if (!*s)
> -        goto fail;
> -
> +    if (!*s) {
> +        av_freep(&buffer);
> +        return AVERROR(ENOMEM);
> +    }
>     (*s)->protocol_whitelist = av_strdup(h->protocol_whitelist);
>     if (!(*s)->protocol_whitelist && h->protocol_whitelist) {
>         avio_closep(s);
> -        goto fail;
> +        return AVERROR(ENOMEM);
>     }
>     (*s)->protocol_blacklist = av_strdup(h->protocol_blacklist);
>     if (!(*s)->protocol_blacklist && h->protocol_blacklist) {
>         avio_closep(s);
> -        goto fail;
> +        return AVERROR(ENOMEM);
>     }
>     (*s)->direct = h->flags & AVIO_FLAG_DIRECT;
> 
> @@ -1006,9 +1007,6 @@ int ffio_fdopen(AVIOContext **s, URLContext *h)
>     ((FFIOContext*)(*s))->short_seek_get = (int (*)(void *))ffurl_get_short_seek;
>     (*s)->av_class = &ff_avio_class;
>     return 0;
> -fail:
> -    av_freep(&buffer);
> -    return AVERROR(ENOMEM);
> }
> 
> URLContext* ffio_geturlcontext(AVIOContext *s)
> -- 
> 2.25.0
> 
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".