From 029cf99c5166b36f33381cd8ebfa5f1f1f463d1f Mon Sep 17 00:00:00 2001 From: Vittorio Giovara Date: Wed, 29 Jun 2016 12:03:59 -0400 Subject: [PATCH] mov: Save number of stsd elements after stream extradata allocation Avoid freeing an unallocated array in mov_read_close() in case of a malloc failure. Signed-off-by: Vittorio Giovara --- libavformat/mov.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index fe1f264463..0cb3271d44 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -1883,7 +1883,7 @@ static int mov_read_stsd(MOVContext *c, AVIOContext *pb, MOVAtom atom) { AVStream *st; MOVStreamContext *sc; - int ret; + int ret, entries; if (c->fc->nb_streams < 1) return 0; @@ -1892,13 +1892,14 @@ static int mov_read_stsd(MOVContext *c, AVIOContext *pb, MOVAtom atom) avio_r8(pb); /* version */ avio_rb24(pb); /* flags */ - sc->stsd_count = avio_rb32(pb); /* entries */ + entries = avio_rb32(pb); /* Prepare space for hosting multiple extradata. */ - sc->extradata = av_mallocz_array(sc->stsd_count, sizeof(*sc->extradata)); + sc->extradata = av_mallocz_array(entries, sizeof(*sc->extradata)); if (!sc->extradata) return AVERROR(ENOMEM); + sc->stsd_count = entries; sc->extradata_size = av_mallocz_array(sc->stsd_count, sizeof(sc->extradata_size)); if (!sc->extradata_size) return AVERROR(ENOMEM);