[PR] avformat/movenc: free sgpd_entries on the roll-distance error path (PR #23648)

PR #23648 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23648
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23648.patch

Found-by: Ao Xijie
Signed-off-by: Michael Niedermayer <[email protected]>



>From f93e65b01ed394545433a0af873912d974158f43 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Mon, 29 Jun 2026 01:35:05 +0200
Subject: [PATCH] avformat/movenc: free sgpd_entries on the roll-distance error
 path

Found-by: Ao Xijie
Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavformat/movenc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libavformat/movenc.c b/libavformat/movenc.c
index c14f05ecc8..66752f35dc 100644
--- a/libavformat/movenc.c
+++ b/libavformat/movenc.c
@@ -3345,8 +3345,10 @@ static int mov_preroll_write_stbl_atoms(AVIOContext *pb, MOVTrack *track)
             if (roll_samples_remaining > 0)
                 distance = 0;
             /* Verify distance is a maximum of 32 (2.5ms) packets. */
-            if (distance > 32)
+            if (distance > 32) {
+                av_freep(&sgpd_entries);
                 return AVERROR_INVALIDDATA;
+            }
             if (i && distance == sgpd_entries[entries].roll_distance) {
                 sgpd_entries[entries].count++;
             } else {
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]