[FFmpeg-devel] [PATCH 2/2] avfilter/signature_lookup: Do not dereference NULL pointers after malloc failure

[Andreas Rheinhardt]

Michael Niedermayer:
> Fixes: CID 1403229 Dereference after null check
> 
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavfilter/signature_lookup.c | 25 ++++++++++++++-----------
>  1 file changed, 14 insertions(+), 11 deletions(-)
> 
> diff --git a/libavfilter/signature_lookup.c b/libavfilter/signature_lookup.c
> index 86dd0c66754..6e45fde1b5a 100644
> --- a/libavfilter/signature_lookup.c
> +++ b/libavfilter/signature_lookup.c
> @@ -37,6 +37,14 @@
>  #define STATUS_END_REACHED 1
>  #define STATUS_BEGIN_REACHED 2
>  
> +static void sll_free(MatchingInfo **sll)
> +{
> +    while (*sll) {
> +        sll = &(*sll)->next;
> +        av_freep(sll);
> +    }
> +}
> +

This will leak every element except the second (if existing) of the
linked list.

>  static void fill_l1distlut(uint8_t lut[])
>  {
>      int i, j, tmp_i, tmp_j,count;
> @@ -290,6 +298,10 @@ static MatchingInfo* get_matching_parameters(AVFilterContext *ctx, SignatureCont
>                              av_log(ctx, AV_LOG_FATAL, "Could not allocate memory");
>                          c = c->next;
>                      }
> +                    if (!c) {
> +                        sll_free(&cands);
> +                        goto error;
> +                    }
>                      c->framerateratio = (i+1.0) / 30;
>                      c->score = hspace[i][j].score;
>                      c->offset = j-90;
> @@ -305,6 +317,7 @@ static MatchingInfo* get_matching_parameters(AVFilterContext *ctx, SignatureCont
>              }
>          }
>      }
> +    error:
>      for (i = 0; i < MAX_FRAMERATE; i++) {
>          av_freep(&hspace[i]);
>      }
> @@ -520,16 +533,6 @@ static MatchingInfo evaluate_parameters(AVFilterContext *ctx, SignatureContext *
>      return bestmatch;
>  }
>  
> -static void sll_free(MatchingInfo *sll)
> -{
> -    void *tmp;
> -    while (sll) {
> -        tmp = sll;
> -        sll = sll->next;
> -        av_freep(&tmp);
> -    }
> -}
> -
>  static MatchingInfo lookup_signatures(AVFilterContext *ctx, SignatureContext *sc, StreamContext *first, StreamContext *second, int mode)
>  {
>      CoarseSignature *cs, *cs2;
> @@ -572,7 +575,7 @@ static MatchingInfo lookup_signatures(AVFilterContext *ctx, SignatureContext *sc
>                     "ratio %f, offset %d, score %d, %d frames matching\n",
>                     bestmatch.first->index, bestmatch.second->index,
>                     bestmatch.framerateratio, bestmatch.offset, bestmatch.score, bestmatch.matchframes);
> -            sll_free(infos);
> +            sll_free(&infos);
>          }
>      } while (find_next_coarsecandidate(sc, second->coarsesiglist, &cs, &cs2, 0) && !bestmatch.whole);
>      return bestmatch;