[FFmpeg-trac] #4908(avformat:new): Memory leak in ff_img_read_header() with custom io
FFmpeg
trac at avcodec.org
Tue Oct 6 01:48:21 CEST 2015
#4908: Memory leak in ff_img_read_header() with custom io
-------------------------------------+-------------------------------------
Reporter: | Type: defect
personalmountains | Priority: normal
Status: new | Version:
Component: avformat | unspecified
Keywords: memory leak | Blocked By:
Blocking: | Reproduced by developer: 0
Analyzed by developer: 0 |
-------------------------------------+-------------------------------------
[https://github.com/FFmpeg/FFmpeg/commit/726e253b004de9511f63625ce95feee4d9aeaff0
This patch] changed `probe_buffer` from an array to a pointer allocated
with `av_realloc()`. It was correctly freed at the end of the block.
However,
[https://github.com/FFmpeg/FFmpeg/commit/6691eee48c7f08caf479ce3562a1c83447529ab9
that one] buried the `av_free()` call into
`ffio_rewind_with_probe_data()`.
Unsurprisingly,
[https://github.com/FFmpeg/FFmpeg/commit/e6e8cc8ce9c2a398fbb51254a5067f4bd3c4fa8a
a subsequent patch] made it so this call is skipped in the case of custom
io, so the buffer is never freed. A simple `av_free()` after the call to
`avio_seek()` on
[https://github.com/FFmpeg/FFmpeg/blob/master/libavformat/img2dec.c#L346
img2dec.c:346] might do the job.
{{{
int probe_buffer_size = 2048;
uint8_t *probe_buffer = av_realloc(NULL, probe_buffer_size +
AVPROBE_PADDING_SIZE);
// ...
if (s1->flags & AVFMT_FLAG_CUSTOM_IO) {
// this leaks probe_buffer because av_free() isn't called
avio_seek(s1->pb, 0, SEEK_SET);
} else
ffio_rewind_with_probe_data(s1->pb, &probe_buffer, probe_buffer_size);
}}}
--
Ticket URL: <https://trac.ffmpeg.org/ticket/4908>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker
More information about the FFmpeg-trac
mailing list