Fix memleak, fixed CID123.

Originally committed as revision 13472 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavformat/nutdec.c b/libavformat/nutdec.c
index 0655d0f..fd7c893 100644 (file)
--- a/libavformat/nutdec.c
+++ b/libavformat/nutdec.c
@@ -500,6 +500,7 @@ static int find_and_decode_index(NUTContext *nut){
     int64_t filesize= url_fsize(bc);
     int64_t *syncpoints;
     int8_t *has_keyframe;
     int64_t filesize= url_fsize(bc);
     int64_t *syncpoints;
     int8_t *has_keyframe;

+    int ret= -1;

 
     url_fseek(bc, filesize-12, SEEK_SET);
     url_fseek(bc, filesize-get_be64(bc), SEEK_SET);
 
     url_fseek(bc, filesize-12, SEEK_SET);
     url_fseek(bc, filesize-get_be64(bc), SEEK_SET);


@@ -516,7 +517,9 @@ static int find_and_decode_index(NUTContext *nut){
     syncpoints= av_malloc(sizeof(int64_t)*syncpoint_count);
     has_keyframe= av_malloc(sizeof(int8_t)*(syncpoint_count+1));
     for(i=0; i<syncpoint_count; i++){
     syncpoints= av_malloc(sizeof(int64_t)*syncpoint_count);
     has_keyframe= av_malloc(sizeof(int8_t)*(syncpoint_count+1));
     for(i=0; i<syncpoint_count; i++){

-        GET_V(syncpoints[i], tmp>0)
+        syncpoints[i] = ff_get_v(bc);
+        if(syncpoints[i] <= 0)
+            goto fail;

         if(i)
             syncpoints[i] += syncpoints[i-1];
     }
         if(i)
             syncpoints[i] += syncpoints[i-1];
     }


@@ -533,7 +536,7 @@ static int find_and_decode_index(NUTContext *nut){
                 x>>=1;
                 if(n+x >= syncpoint_count + 1){
                     av_log(s, AV_LOG_ERROR, "index overflow A\n");
                 x>>=1;
                 if(n+x >= syncpoint_count + 1){
                     av_log(s, AV_LOG_ERROR, "index overflow A\n");

-                    return -1;
+                    goto fail;

                 }
                 while(x--)
                     has_keyframe[n++]= flag;
                 }
                 while(x--)
                     has_keyframe[n++]= flag;


@@ -542,7 +545,7 @@ static int find_and_decode_index(NUTContext *nut){
                 while(x != 1){
                     if(n>=syncpoint_count + 1){
                         av_log(s, AV_LOG_ERROR, "index overflow B\n");
                 while(x != 1){
                     if(n>=syncpoint_count + 1){
                         av_log(s, AV_LOG_ERROR, "index overflow B\n");

-                        return -1;
+                        goto fail;

                     }
                     has_keyframe[n++]= x&1;
                     x>>=1;
                     }
                     has_keyframe[n++]= x&1;
                     x>>=1;


@@ -550,7 +553,7 @@ static int find_and_decode_index(NUTContext *nut){
             }
             if(has_keyframe[0]){
                 av_log(s, AV_LOG_ERROR, "keyframe before first syncpoint in index\n");
             }
             if(has_keyframe[0]){
                 av_log(s, AV_LOG_ERROR, "keyframe before first syncpoint in index\n");

-                return -1;
+                goto fail;

             }
             assert(n<=syncpoint_count+1);
             for(; j<n && j<syncpoint_count; j++){
             }
             assert(n<=syncpoint_count+1);
             for(; j<n && j<syncpoint_count; j++){


@@ -577,9 +580,13 @@ static int find_and_decode_index(NUTContext *nut){
 
     if(skip_reserved(bc, end) || get_checksum(bc)){
         av_log(s, AV_LOG_ERROR, "index checksum mismatch\n");
 
     if(skip_reserved(bc, end) || get_checksum(bc)){
         av_log(s, AV_LOG_ERROR, "index checksum mismatch\n");

-        return -1;
+        goto fail;

     }
     }

-    return 0;
+    ret= 0;
+fail:
+    av_free(syncpoints);
+    av_free(has_keyframe);
+    return ret;

 }
 
 static int nut_read_header(AVFormatContext *s, AVFormatParameters *ap)
 }
 
 static int nut_read_header(AVFormatContext *s, AVFormatParameters *ap)