lavfi: check refcount before merging.
authorNicolas George <george@nsup.org>
Tue, 15 Jul 2014 17:26:52 +0000 (19:26 +0200)
committerNicolas George <george@nsup.org>
Thu, 17 Jul 2014 16:12:34 +0000 (18:12 +0200)
When merging the formats around the automatically inserted
convert filters, the refcount of the format lists can not be 0.
Coverity does not detect it, and suspects a memory leak,
because if refcount is 0 the newly allocated lists are not
stored anywhere. That gives CIDs 12242821224283 and 1224284.
Lists with refcount 0 are used in can_merge_formats(), so the
asserts can not be moved inside the merge functions.

libavfilter/avfiltergraph.c

index f12491e..9178939 100644 (file)
@@ -562,6 +562,20 @@ static int query_formats(AVFilterGraph *graph, AVClass *log_ctx)
                 filter_query_formats(convert);
                 inlink  = convert->inputs[0];
                 outlink = convert->outputs[0];
+                av_assert0( inlink-> in_formats->refcount > 0);
+                av_assert0( inlink->out_formats->refcount > 0);
+                av_assert0(outlink-> in_formats->refcount > 0);
+                av_assert0(outlink->out_formats->refcount > 0);
+                if (outlink->type == AVMEDIA_TYPE_AUDIO) {
+                    av_assert0( inlink-> in_samplerates->refcount > 0);
+                    av_assert0( inlink->out_samplerates->refcount > 0);
+                    av_assert0(outlink-> in_samplerates->refcount > 0);
+                    av_assert0(outlink->out_samplerates->refcount > 0);
+                    av_assert0( inlink-> in_channel_layouts->refcount > 0);
+                    av_assert0( inlink->out_channel_layouts->refcount > 0);
+                    av_assert0(outlink-> in_channel_layouts->refcount > 0);
+                    av_assert0(outlink->out_channel_layouts->refcount > 0);
+                }
                 if (!ff_merge_formats( inlink->in_formats,  inlink->out_formats,  inlink->type) ||
                     !ff_merge_formats(outlink->in_formats, outlink->out_formats, outlink->type))
                     ret = AVERROR(ENOSYS);