avfilter/vf_curves: unmap the psfile with the mapped pointer and size

parse_psfile() advances buf and decrements size while reading the
file, and then passed these to av_file_unmap() instead of what
av_file_map() returned. With mmap, munmap() then fails with EINVAL
because the pointer is no longer page aligned, so the mapping leaks on
every init and every psfile command; on builds without mmap, av_free()
is called on a pointer into the middle of the buffer.

Keep the mapped pointer and size and unmap those.

Signed-off-by: Martin Mirchev <mmirchev@comp.nus.edu.sg>
This commit is contained in:
Martin Mirchev authored and michaelni committed 2026-11-06 03:25:05 +00:00
1 parent c1a03c29ed
commit cc30be196d
1 file changed
+6 -4
+6 -4
View File
@@ -586,17 +586,19 @@ end:
static int parse_psfile(AVFilterContext *ctx, const char *fname)
{
CurvesContext *curves = ctx->priv;
uint8_t *buf;
size_t size;
uint8_t *map, *buf;
size_t map_size, size;
int i, ret, version av_unused, nb_curves;
AVBPrint ptstr;
static const int comp_ids[] = {3, 0, 1, 2};
av_bprint_init(&ptstr, 0, AV_BPRINT_SIZE_AUTOMATIC);
ret = av_file_map(fname, &buf, &size, 0, NULL);
ret = av_file_map(fname, &map, &map_size, 0, NULL);
if (ret < 0)
return ret;
buf = map;
size = map_size;
#define READ16(dst) do { \
if (size < 2) { \
@@ -635,7 +637,7 @@ static int parse_psfile(AVFilterContext *ctx, const char *fname)
}
end:
av_bprint_finalize(&ptstr, NULL);
av_file_unmap(buf, size);
av_file_unmap(map, map_size);
return ret;
}