[PR] avfilter/vf_removelogo: free the whole mask on allocation failure (PR #23647)

PR #23647 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23647
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23647.patch

Found-by: Ao Xijie
Signed-off-by: Michael Niedermayer <[email protected]>



>From 54d4abb2a9aaab67f020ebae0702cfdf08961296 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Mon, 29 Jun 2026 01:35:05 +0200
Subject: [PATCH] avfilter/vf_removelogo: free the whole mask on allocation
 failure

Found-by: Ao Xijie
Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavfilter/vf_removelogo.c | 28 +++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/libavfilter/vf_removelogo.c b/libavfilter/vf_removelogo.c
index 1da5f5d0c7..7285f5336a 100644
--- a/libavfilter/vf_removelogo.c
+++ b/libavfilter/vf_removelogo.c
@@ -311,22 +311,18 @@ static av_cold int init(AVFilterContext *ctx)
        the filter is applied, the mask size is determined on a pixel
        by pixel basis, with pixels nearer the edge of the logo getting
        smaller mask sizes. */
-    mask = (int ***)av_malloc_array(s->max_mask_size + 1, sizeof(int **));
+    mask = av_calloc(s->max_mask_size + 1, sizeof(*mask));
     if (!mask)
         return AVERROR(ENOMEM);
 
     for (a = 0; a <= s->max_mask_size; a++) {
-        mask[a] = (int **)av_malloc_array((a * 2) + 1, sizeof(int *));
-        if (!mask[a]) {
-            av_free(mask);
-            return AVERROR(ENOMEM);
-        }
+        mask[a] = av_calloc((a * 2) + 1, sizeof(*mask[a]));
+        if (!mask[a])
+            goto mask_fail;
         for (b = -a; b <= a; b++) {
-            mask[a][b + a] = (int *)av_malloc_array((a * 2) + 1, sizeof(int));
-            if (!mask[a][b + a]) {
-                av_free(mask);
-                return AVERROR(ENOMEM);
-            }
+            mask[a][b + a] = av_malloc_array((a * 2) + 1, sizeof(*mask[a][b + a]));
+            if (!mask[a][b + a])
+                goto mask_fail;
             for (c = -a; c <= a; c++) {
                 if ((b * b) + (c * c) <= (a * a)) /* Circular 0/1 mask. */
                     mask[a][b + a][c + a] = 1;
@@ -351,6 +347,16 @@ static av_cold int init(AVFilterContext *ctx)
     SHOW_LOGO_INFO(half);
 
     return 0;
+
+mask_fail:
+    for (a = 0; a <= s->max_mask_size; a++) {
+        if (mask[a])
+            for (b = 0; b < (a * 2) + 1; b++)
+                av_free(mask[a][b]);
+        av_free(mask[a]);
+    }
+    av_free(mask);
+    return AVERROR(ENOMEM);
 }
 
 static int config_props_input(AVFilterLink *inlink)
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]