#4908: Memory leak in ff_img_read_header() with custom io -------------------------------------+------------------------------------- Reporter: | Type: defect personalmountains | Priority: normal Status: new | Version: Component: avformat | unspecified Keywords: memory leak | Blocked By: Blocking: | Reproduced by developer: 0 Analyzed by developer: 0 | -------------------------------------+------------------------------------- [https://github.com/FFmpeg/FFmpeg/commit/726e253b004de9511f63625ce95feee4d9ae... This patch] changed `probe_buffer` from an array to a pointer allocated with `av_realloc()`. It was correctly freed at the end of the block. However, [https://github.com/FFmpeg/FFmpeg/commit/6691eee48c7f08caf479ce3562a1c8344752... that one] buried the `av_free()` call into `ffio_rewind_with_probe_data()`. Unsurprisingly, [https://github.com/FFmpeg/FFmpeg/commit/e6e8cc8ce9c2a398fbb51254a5067f4bd3c4... a subsequent patch] made it so this call is skipped in the case of custom io, so the buffer is never freed. A simple `av_free()` after the call to `avio_seek()` on [https://github.com/FFmpeg/FFmpeg/blob/master/libavformat/img2dec.c#L346 img2dec.c:346] might do the job. {{{ int probe_buffer_size = 2048; uint8_t *probe_buffer = av_realloc(NULL, probe_buffer_size + AVPROBE_PADDING_SIZE); // ... if (s1->flags & AVFMT_FLAG_CUSTOM_IO) { // this leaks probe_buffer because av_free() isn't called avio_seek(s1->pb, 0, SEEK_SET); } else ffio_rewind_with_probe_data(s1->pb, &probe_buffer, probe_buffer_size); }}} -- Ticket URL: <https://trac.ffmpeg.org/ticket/4908> FFmpeg <https://ffmpeg.org> FFmpeg issue tracker