Recherche avancée

Sur d’autres sites (4052)

• avfilter/vf_overlay : Fix double-free of AVFilterFormats on error

  7 août 2020, par Andreas Rheinhardt

  avfilter/vf_overlay : Fix double-free of AVFilterFormats on error
  The query_formats function of the overlay filter tries to allocate
  
  two lists (only one in a special case) of formats which on success
  
  are attached to more permanent objects (AVFilterLinks) for storage
  
  afterwards. If attaching a list to an AVFilterLink succeeds, it is
  
  in turn owned by the AVFilterLink (or more exactly, the AVFilterLink
  
  becomes one of the common owners of the list). Yet if attaching a list
  
  to one of its links succeeds and an error happens lateron, both lists
  
  were manually freed, whic is wrong if the list is already owned by one
  
  or more links ; these links' pointers to their lists will become dangling
  
  and there will be a double-free/use-after-free when these links are
  
  cleaned up automatically.
  This commit fixes this by removing the custom freeing code ; this will
  
  temporarily add a leaking codepath (if attaching a list not already
  
  owned by a link to a link fails, the list will leak), but this will
  
  be fixed soon by making sure that an AVFilterFormats without owner will
  
  be automatically freed when attaching it to an AVFilterLink fails.
  
  Notice that at most one list leaks because a new list is only allocated
  
  after the old list has been successfully attached to a link.
  Reviewed-by : Nicolas George <george@nsup.org>
  
  Signed-off-by : Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
  

  • [DH] libavfilter/vf_overlay.c

• avfilter/vf_showpalette : Fix double-free of AVFilterFormats on error

  7 août 2020, par Andreas Rheinhardt

  avfilter/vf_showpalette : Fix double-free of AVFilterFormats on error
  The query_formats function of the showpalette filter tries to allocate
  
  two lists of formats which on success are attached to more permanent objects
  
  (AVFilterLinks) for storage afterwards. If attaching a list to an
  
  AVFilterLink succeeds, the link becomes one (in this case the only one)
  
  of the owners of the list. Yet if attaching the first list to its link
  
  succeeds and attaching the second list fails, both lists were manually
  
  freed, which means that the first link's pointer to the first list
  
  becomes dangling and there will be a double-free when the first link is
  
  cleaned up automatically.
  This commit fixes this by removing the custom free code ; this will
  
  temporarily add a leaking codepath (if attaching a list to a link fails,
  
  the list will leak), but this will be fixed shortly by making sure that
  
  an AVFilterFormats without owner will be automatically freed when
  
  attaching it to an AVFilterLink fails. Notice at most one list leaks
  
  because as of this commit a new list is only allocated after the old list
  
  has been successfully attached to a link.
  Reviewed-by : Nicolas George <george@nsup.org>
  
  Signed-off-by : Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
  

  • [DH] libavfilter/vf_showpalette.c

• avfilter/af_amix : Fix double-free of AVFilterChannelLayouts on error

  7 août 2020, par Andreas Rheinhardt

  avfilter/af_amix : Fix double-free of AVFilterChannelLayouts on error
  The query_formats function of the amix filter tries to allocate a list
  
  of channel layouts which are attached to more permanent objects
  
  (an AVFilter's links) for storage afterwards on success. If attaching
  
  a list to a link succeeds, the link becomes one of the common owners
  
  of the list. Yet if a list has been successfully attached to links (or if
  
  there were no links to attach it to in which case
  
  ff_set_common_channel_layouts() already frees the list) and an error
  
  happens lateron, the list was manually freed, which is wrong, because
  
  the list has either already been freed or it is owned by its links in
  
  which case these links' pointers to their list will become dangling and
  
  there will be double-frees/uses-after-free when these links are cleaned
  
  up automatically.
  This commit fixes this by removing the custom freeing code ; this is made
  
  possible by using the list in ff_set_common_channel_layouts() directly
  
  after its allocation (without anything that can fail in between).
  Notice that ff_set_common_channel_layouts() is buggy itself which can
  
  lead to double-frees on error. This is not fixed in this commit.
  Reviewed-by : Nicolas George <george@nsup.org>
  
  Signed-off-by : Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
  

  • [DH] libavfilter/af_amix.c