[FFmpeg-devel] [PATCH] avfilter/avfilter: check for allocation failure in ff_insert_pad()

[Michael Niedermayer]

On Fri, Sep 13, 2013 at 10:21:48AM +0000, Paul B Mahol wrote:
> Signed-off-by: Paul B Mahol <onemda at gmail.com>
> ---
>  libavfilter/avfilter.c | 19 ++++++++++++++++---
>  libavfilter/internal.h | 11 ++++++-----
>  2 files changed, 22 insertions(+), 8 deletions(-)
> 
> diff --git a/libavfilter/avfilter.c b/libavfilter/avfilter.c
> index 765b37a..1627409 100644
> --- a/libavfilter/avfilter.c
> +++ b/libavfilter/avfilter.c
> @@ -94,16 +94,27 @@ void ff_command_queue_pop(AVFilterContext *filter)
>      av_free(c);
>  }
>  
> -void ff_insert_pad(unsigned idx, unsigned *count, size_t padidx_off,
> +int ff_insert_pad(unsigned idx, unsigned *count, size_t padidx_off,
>                     AVFilterPad **pads, AVFilterLink ***links,
>                     AVFilterPad *newpad)
>  {
> +    AVFilterLink **newlinks;
> +    AVFilterPad *newpads;
>      unsigned i;
>  
>      idx = FFMIN(idx, *count);
>  
> -    *pads  = av_realloc(*pads,  sizeof(AVFilterPad)   * (*count + 1));
> -    *links = av_realloc(*links, sizeof(AVFilterLink*) * (*count + 1));
> +    newpads  = av_realloc_array(*pads,  *count + 1, sizeof(AVFilterPad));
> +    newlinks = av_realloc_array(*links, *count + 1, sizeof(AVFilterLink*));
> +    if (!newpads || !newlinks) {
> +        av_free(newpads);
> +        av_free(newlinks);

if one succeeds and the other fails then this will leave 1 stale
pointer


> +        return AVERROR(ENOMEM);
> +    }
> +
> +    *pads  = newpads;
> +    *links = newlinks;
> +
>      memmove(*pads  + idx + 1, *pads  + idx, sizeof(AVFilterPad)   * (*count - idx));
>      memmove(*links + idx + 1, *links + idx, sizeof(AVFilterLink*) * (*count - idx));
>      memcpy(*pads + idx, newpad, sizeof(AVFilterPad));
> @@ -113,6 +124,8 @@ void ff_insert_pad(unsigned idx, unsigned *count, size_t padidx_off,
>      for (i = idx + 1; i < *count; i++)
>          if (*links[i])
>              (*(unsigned *)((uint8_t *) *links[i] + padidx_off))++;
> +
> +    return 0;
>  }
>  
>  int avfilter_link(AVFilterContext *src, unsigned srcpad,
> diff --git a/libavfilter/internal.h b/libavfilter/internal.h
> index eede4f7..a01116e 100644
> --- a/libavfilter/internal.h
> +++ b/libavfilter/internal.h
> @@ -249,16 +249,17 @@ void ff_tlog_link(void *ctx, AVFilterLink *link, int end);
>   * @param pads Pointer to the pointer to the beginning of the list of pads
>   * @param links Pointer to the pointer to the beginning of the list of links
>   * @param newpad The new pad to add. A copy is made when adding.
> + * @return 0 in case of success, a negative AVERROR code on error
>   */
> -void ff_insert_pad(unsigned idx, unsigned *count, size_t padidx_off,
> +int ff_insert_pad(unsigned idx, unsigned *count, size_t padidx_off,
>                     AVFilterPad **pads, AVFilterLink ***links,
>                     AVFilterPad *newpad);
>  
>  /** Insert a new input pad for the filter. */
> -static inline void ff_insert_inpad(AVFilterContext *f, unsigned index,
> +static inline int ff_insert_inpad(AVFilterContext *f, unsigned index,
>                                     AVFilterPad *p)
>  {
> -    ff_insert_pad(index, &f->nb_inputs, offsetof(AVFilterLink, dstpad),
> +    return ff_insert_pad(index, &f->nb_inputs, offsetof(AVFilterLink, dstpad),
>                    &f->input_pads, &f->inputs, p);
>  #if FF_API_FOO_COUNT
>  FF_DISABLE_DEPRECATION_WARNINGS

this and the next hunk break the code following the return as it
is no longer executed

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

There will always be a question for which you do not know the correct answer.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20130914/87010327/attachment.asc>