Fixes clusterfuzz-testcase-minimized-fuzzer_loadfile-5365661771825152.
Unified · Split
| @@ -5406,7 +5406,7 @@ static int heif_add_stream(MOVContext *c, HEIFItem *item) · 5405 unmodified lines | ||
| 5406 | 5406 | return AVERROR(ENOMEM); |
| 5407 | 5407 | sc = av_mallocz(sizeof(MOVStreamContext)); |
| 5408 | 5408 | if (!sc) |
| 5409 | − return AVERROR(ENOMEM); | |
| 5409 | + goto fail; | |
| 5410 | 5410 | |
| 5411 | 5411 | item->st = st; |
| 5412 | 5412 | st->id = item->item_id; |
| @@ -5430,27 +5430,33 @@ static int heif_add_stream(MOVContext *c, HEIFItem *item) · 17 unmodified lines | ||
| 5430 | 5430 | sc->stsc_count = 1; |
| 5431 | 5431 | sc->stsc_data = av_malloc_array(1, sizeof(*sc->stsc_data)); |
| 5432 | 5432 | if (!sc->stsc_data) |
| 5433 | − return AVERROR(ENOMEM); | |
| 5433 | + goto fail; | |
| 5434 | 5434 | sc->stsc_data[0].first = 1; |
| 5435 | 5435 | sc->stsc_data[0].count = 1; |
| 5436 | 5436 | sc->stsc_data[0].id = 1; |
| 5437 | 5437 | sc->chunk_offsets = av_malloc_array(1, sizeof(*sc->chunk_offsets)); |
| 5438 | 5438 | if (!sc->chunk_offsets) |
| 5439 | − return AVERROR(ENOMEM); | |
| 5439 | + goto fail; | |
| 5440 | 5440 | sc->chunk_count = 1; |
| 5441 | 5441 | sc->sample_sizes = av_malloc_array(1, sizeof(*sc->sample_sizes)); |
| 5442 | 5442 | if (!sc->sample_sizes) |
| 5443 | − return AVERROR(ENOMEM); | |
| 5443 | + goto fail; | |
| 5444 | 5444 | sc->sample_count = 1; |
| 5445 | 5445 | sc->stts_data = av_malloc_array(1, sizeof(*sc->stts_data)); |
| 5446 | 5446 | if (!sc->stts_data) |
| 5447 | − return AVERROR(ENOMEM); | |
| 5447 | + goto fail; | |
| 5448 | 5448 | sc->stts_count = 1; |
| 5449 | 5449 | sc->stts_data[0].count = 1; |
| 5450 | 5450 | // Not used for still images. But needed by mov_build_index. |
| 5451 | 5451 | sc->stts_data[0].duration = 0; |
| 5452 | 5452 | |
| 5453 | 5453 | return 0; |
| 5454 | +fail: | |
| 5455 | + mov_free_stream_context(c->fc, st); | |
| 5456 | + ff_remove_stream(c->fc, st); | |
| 5457 | + item->st = NULL; | |
| 5458 | + | |
| 5459 | + return AVERROR(ENOMEM); | |
| 5454 | 5460 | } |
| 5455 | 5461 | |
| 5456 | 5462 | static int mov_read_meta(MOVContext *c, AVIOContext *pb, MOVAtom atom) |
| @@ -9001,12 +9007,6 @@ fail: · 3544 unmodified lines | ||
| 9001 | 9007 | continue; |
| 9002 | 9008 | |
| 9003 | 9009 | av_freep(&item->name); |
| 9004 | − if (!item->st) | |
| 9005 | − continue; | |
| 9006 | − | |
| 9007 | − mov_free_stream_context(c->fc, item->st); | |
| 9008 | − ff_remove_stream(c->fc, item->st); | |
| 9009 | − item->st = NULL; | |
| 9010 | 9010 | } |
| 9011 | 9011 | return ret; |
| 9012 | 9012 | } |