From cc30be196d7d081ca07464fc7df6d0ebb6a93bc4 Mon Sep 17 00:00:00 2001 From: Martin Mirchev Date: Wed, 21 Oct 2026 18:24:22 +0800 Subject: [PATCH] avfilter/vf_curves: unmap the psfile with the mapped pointer and size parse_psfile() advances buf and decrements size while reading the file, and then passed these to av_file_unmap() instead of what av_file_map() returned. With mmap, munmap() then fails with EINVAL because the pointer is no longer page aligned, so the mapping leaks on every init and every psfile command; on builds without mmap, av_free() is called on a pointer into the middle of the buffer. Keep the mapped pointer and size and unmap those. Signed-off-by: Martin Mirchev --- libavfilter/vf_curves.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/libavfilter/vf_curves.c b/libavfilter/vf_curves.c index 4a7a51a3db..69e9c5257c 100644 --- a/libavfilter/vf_curves.c +++ b/libavfilter/vf_curves.c @@ -586,17 +586,19 @@ end: static int parse_psfile(AVFilterContext *ctx, const char *fname) { CurvesContext *curves = ctx->priv; - uint8_t *buf; - size_t size; + uint8_t *map, *buf; + size_t map_size, size; int i, ret, version av_unused, nb_curves; AVBPrint ptstr; static const int comp_ids[] = {3, 0, 1, 2}; av_bprint_init(&ptstr, 0, AV_BPRINT_SIZE_AUTOMATIC); - ret = av_file_map(fname, &buf, &size, 0, NULL); + ret = av_file_map(fname, &map, &map_size, 0, NULL); if (ret < 0) return ret; + buf = map; + size = map_size; #define READ16(dst) do { \ if (size < 2) { \ @@ -635,7 +637,7 @@ static int parse_psfile(AVFilterContext *ctx, const char *fname) } end: av_bprint_finalize(&ptstr, NULL); - av_file_unmap(buf, size); + av_file_unmap(map, map_size); return ret; }