picture: fix empty allocation leak
authorRémi Denis-Courmont <remi@remlab.net>
Mon, 26 Feb 2018 21:32:45 +0000 (23:32 +0200)
committerRémi Denis-Courmont <remi@remlab.net>
Mon, 26 Feb 2018 21:34:41 +0000 (23:34 +0200)
If the picture has zero planes, pic->p->p_pixels is set to NULL rather
than the allocated (zero bytes) buffer, leading to a potential leak
depending on aligned_alloc() implementation.

src/misc/picture.c

index 8af4b25..69e7c92 100644 (file)
@@ -250,7 +250,11 @@ picture_t *picture_NewFromFormat(const video_format_t *restrict fmt)
     if (unlikely(priv == NULL))
         return NULL;
 
+    priv->gc.destroy = picture_Destroy;
+
     picture_t *pic = &priv->picture;
+    if (pic->i_planes == 0)
+        return NULL;
 
     /* Calculate how big the new image should be */
     size_t plane_sizes[PICTURE_PLANE_MAX];
@@ -269,7 +273,7 @@ picture_t *picture_NewFromFormat(const video_format_t *restrict fmt)
         goto error;
 
     uint8_t *buf = aligned_alloc(16, pic_size);
-    if (unlikely(pic_size > 0 && buf == NULL))
+    if (unlikely(buf == NULL))
         goto error;
 
     /* Fill the p_pixels field for each plane */
@@ -279,7 +283,6 @@ picture_t *picture_NewFromFormat(const video_format_t *restrict fmt)
         buf += plane_sizes[i];
     }
 
-    priv->gc.destroy = picture_Destroy;
     return pic;
 error:
     free(pic);