mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2026-11-06 05:17:42 +00:00
avfilter/vf_curves: unmap the psfile with the mapped pointer and size
parse_psfile() advances buf and decrements size while reading the file, and then passed these to av_file_unmap() instead of what av_file_map() returned. With mmap, munmap() then fails with EINVAL because the pointer is no longer page aligned, so the mapping leaks on every init and every psfile command; on builds without mmap, av_free() is called on a pointer into the middle of the buffer. Keep the mapped pointer and size and unmap those. Signed-off-by: Martin Mirchev <mmirchev@comp.nus.edu.sg>
This commit is contained in:
1 parent
c1a03c29ed
commit
cc30be196d
1 file changed
+6
-4
@@ -586,17 +586,19 @@ end:
|
||||
static int parse_psfile(AVFilterContext *ctx, const char *fname)
|
||||
{
|
||||
CurvesContext *curves = ctx->priv;
|
||||
uint8_t *buf;
|
||||
size_t size;
|
||||
uint8_t *map, *buf;
|
||||
size_t map_size, size;
|
||||
int i, ret, version av_unused, nb_curves;
|
||||
AVBPrint ptstr;
|
||||
static const int comp_ids[] = {3, 0, 1, 2};
|
||||
|
||||
av_bprint_init(&ptstr, 0, AV_BPRINT_SIZE_AUTOMATIC);
|
||||
|
||||
ret = av_file_map(fname, &buf, &size, 0, NULL);
|
||||
ret = av_file_map(fname, &map, &map_size, 0, NULL);
|
||||
if (ret < 0)
|
||||
return ret;
|
||||
buf = map;
|
||||
size = map_size;
|
||||
|
||||
#define READ16(dst) do { \
|
||||
if (size < 2) { \
|
||||
@@ -635,7 +637,7 @@ static int parse_psfile(AVFilterContext *ctx, const char *fname)
|
||||
}
|
||||
end:
|
||||
av_bprint_finalize(&ptstr, NULL);
|
||||
av_file_unmap(buf, size);
|
||||
av_file_unmap(map, map_size);
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
||||
Reference in new issue
Block a user