From b553b810c460e484f70a7368ed7abbdcecbe845b Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 29 Jun 2026 01:35:05 +0200
Subject: [PATCH] avformat/movenc: free sgpd_entries on the roll-distance error
 path

Found-by: Ao Xijie
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/movenc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libavformat/movenc.c b/libavformat/movenc.c
index 536b16a152..b1ec603eb6 100644
--- a/libavformat/movenc.c
+++ b/libavformat/movenc.c
@@ -3364,8 +3364,10 @@ static int mov_preroll_write_stbl_atoms(AVIOContext *pb, MOVTrack *track)
             if (roll_samples_remaining > 0)
                 distance = 0;
             /* Verify distance is a maximum of 32 (2.5ms) packets. */
-            if (distance > 32)
+            if (distance > 32) {
+                av_freep(&sgpd_entries);
                 return AVERROR_INVALIDDATA;
+            }
             if (i && distance == sgpd_entries[entries].roll_distance) {
                 sgpd_entries[entries].count++;
             } else {