[FFmpeg-devel] [PATCH 4/4] avformat/sapenc: fix leak in sap_write_header()

[Michael Niedermayer]

On Tue, Jun 17, 2025 at 10:14:16PM +0800, Lidong Yan wrote:
> In sap_write_header(), ff_format_set_url() assign new allocated new_url
> to contexts[i]->url but forgot to free it later. Add two loops to free
> contexts[i]->url before av_free(context).
> 
> Signed-off-by: Lidong Yan <502024330056 at smail.nju.edu.cn>
> ---
>  libavformat/sapenc.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/libavformat/sapenc.c b/libavformat/sapenc.c
> index 87a834a8d8..3ba7f16022 100644
> --- a/libavformat/sapenc.c
> +++ b/libavformat/sapenc.c
> @@ -233,6 +233,9 @@ static int sap_write_header(AVFormatContext *s)
>          ret = AVERROR_INVALIDDATA;
>          goto fail;
>      }
> +    for (i = 0; i < s->nb_streams; i++)
> +        if (contexts[i])
> +            av_free(contexts[i]->url);
>      av_freep(&contexts);
>      av_log(s, AV_LOG_VERBOSE, "SDP:\n%s\n", &sap->ann[pos]);
>      pos += strlen(&sap->ann[pos]);
> @@ -247,6 +250,9 @@ static int sap_write_header(AVFormatContext *s)
>      return 0;
>  
>  fail:
> +    for (i = 0; i < s->nb_streams; i++)
> +        if (contexts[i])
> +            av_free(contexts[i]->url);
>      av_free(contexts);
>      sap_write_close(s);
>      return ret;

this can be factored like:

like
+    ret = 0;
     fail:
+    for (i = 0; i < s->nb_streams; i++)
+        if (contexts[i])
+            av_free(contexts[i]->url);
    av_free(contexts);
+   if (ret < 0)
        sap_write_close(s);


[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Some people wanted to paint the bikeshed green, some blue and some pink.
People argued and fought, when they finally agreed, only rust was left.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20250623/35c7a976/attachment.sig>