diff options
| author | Kacper Michajłow <kasper93@gmail.com> | 2024-01-27 23:26:14 +0100 |
|---|---|---|
| committer | Dudemanguy <random342@airmail.cc> | 2024-02-15 16:43:37 +0000 |
| commit | 4419e5c41b5f979d73b79912833ad1f4ac19dd7a (patch) | |
| tree | ec7bff901112bdb521e267911b5ca86a69dd8f86 /demux | |
| parent | 5c252715bd57ce9a3f0f8355f329bebcfe9331fb (diff) | |
| download | mpv-4419e5c41b5f979d73b79912833ad1f4ac19dd7a.tar.bz2 mpv-4419e5c41b5f979d73b79912833ad1f4ac19dd7a.tar.xz | |
demux_mkv: fix memory leak on invalid blocks
It is possible to have data with empty block that contains additions. In
which case the block would not be added and the additions would leak.
Found by fuzzing.
Diffstat (limited to 'demux')
| -rw-r--r-- | demux/demux_mkv.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/demux/demux_mkv.c b/demux/demux_mkv.c index e57cf13759..3b37c863ac 100644 --- a/demux/demux_mkv.c +++ b/demux/demux_mkv.c @@ -2979,20 +2979,22 @@ static int read_next_block_into_queue(demuxer_t *demuxer) if (end > mkv_d->cluster_end) goto find_next_cluster; int res = read_block_group(demuxer, end, &block); - if (res < 0) - goto find_next_cluster; if (res > 0) goto add_block; + free_block(&block); + if (res < 0) + goto find_next_cluster; break; } case MATROSKA_ID_SIMPLEBLOCK: { block = (struct block_info){ .simple = true }; int res = read_block(demuxer, mkv_d->cluster_end, &block); - if (res < 0) - goto find_next_cluster; if (res > 0) goto add_block; + free_block(&block); + if (res < 0) + goto find_next_cluster; break; } |