Fixes clusterfuzz-testcase-minimized-fuzzer_loadfile-5365661771825152.
Unified · Split
| @@ -5406,7 +5406,7 @@ static int heif_add_stream(MOVContext *c, HEIFItem *item) · 5405 unmodified lines | |||
| 5406 | return AVERROR(ENOMEM); | 5406 | return AVERROR(ENOMEM); |
| 5407 | sc = av_mallocz(sizeof(MOVStreamContext)); | 5407 | sc = av_mallocz(sizeof(MOVStreamContext)); |
| 5408 | if (!sc) | 5408 | if (!sc) |
| 5409 | return AVERROR(ENOMEM); | 5409 | goto fail; |
| 5410 | 5410 | ||
| 5411 | item->st = st; | 5411 | item->st = st; |
| 5412 | st->id = item->item_id; | 5412 | st->id = item->item_id; |
| @@ -5430,27 +5430,33 @@ static int heif_add_stream(MOVContext *c, HEIFItem *item) · 17 unmodified lines | |||
| 5430 | sc->stsc_count = 1; | 5430 | sc->stsc_count = 1; |
| 5431 | sc->stsc_data = av_malloc_array(1, sizeof(*sc->stsc_data)); | 5431 | sc->stsc_data = av_malloc_array(1, sizeof(*sc->stsc_data)); |
| 5432 | if (!sc->stsc_data) | 5432 | if (!sc->stsc_data) |
| 5433 | return AVERROR(ENOMEM); | 5433 | goto fail; |
| 5434 | sc->stsc_data[0].first = 1; | 5434 | sc->stsc_data[0].first = 1; |
| 5435 | sc->stsc_data[0].count = 1; | 5435 | sc->stsc_data[0].count = 1; |
| 5436 | sc->stsc_data[0].id = 1; | 5436 | sc->stsc_data[0].id = 1; |
| 5437 | sc->chunk_offsets = av_malloc_array(1, sizeof(*sc->chunk_offsets)); | 5437 | sc->chunk_offsets = av_malloc_array(1, sizeof(*sc->chunk_offsets)); |
| 5438 | if (!sc->chunk_offsets) | 5438 | if (!sc->chunk_offsets) |
| 5439 | return AVERROR(ENOMEM); | 5439 | goto fail; |
| 5440 | sc->chunk_count = 1; | 5440 | sc->chunk_count = 1; |
| 5441 | sc->sample_sizes = av_malloc_array(1, sizeof(*sc->sample_sizes)); | 5441 | sc->sample_sizes = av_malloc_array(1, sizeof(*sc->sample_sizes)); |
| 5442 | if (!sc->sample_sizes) | 5442 | if (!sc->sample_sizes) |
| 5443 | return AVERROR(ENOMEM); | 5443 | goto fail; |
| 5444 | sc->sample_count = 1; | 5444 | sc->sample_count = 1; |
| 5445 | sc->stts_data = av_malloc_array(1, sizeof(*sc->stts_data)); | 5445 | sc->stts_data = av_malloc_array(1, sizeof(*sc->stts_data)); |
| 5446 | if (!sc->stts_data) | 5446 | if (!sc->stts_data) |
| 5447 | return AVERROR(ENOMEM); | 5447 | goto fail; |
| 5448 | sc->stts_count = 1; | 5448 | sc->stts_count = 1; |
| 5449 | sc->stts_data[0].count = 1; | 5449 | sc->stts_data[0].count = 1; |
| 5450 | // Not used for still images. But needed by mov_build_index. | 5450 | // Not used for still images. But needed by mov_build_index. |
| 5451 | sc->stts_data[0].duration = 0; | 5451 | sc->stts_data[0].duration = 0; |
| 5452 | 5452 | ||
| 5453 | return 0; | 5453 | return 0; |
| 5454 | fail: | ||
| 5455 | mov_free_stream_context(c->fc, st); | ||
| 5456 | ff_remove_stream(c->fc, st); | ||
| 5457 | item->st = NULL; | ||
| 5458 | |||
| 5459 | return AVERROR(ENOMEM); | ||
| 5454 | } | 5460 | } |
| 5455 | 5461 | ||
| 5456 | static int mov_read_meta(MOVContext *c, AVIOContext *pb, MOVAtom atom) | 5462 | static int mov_read_meta(MOVContext *c, AVIOContext *pb, MOVAtom atom) |
| @@ -9001,12 +9007,6 @@ fail: · 3544 unmodified lines | |||
| 9001 | continue; | 9007 | continue; |
| 9002 | 9008 | ||
| 9003 | av_freep(&item->name); | 9009 | av_freep(&item->name); |
| 9004 | if (!item->st) | ||
| 9005 | continue; | ||
| 9006 | |||
| 9007 | mov_free_stream_context(c->fc, item->st); | ||
| 9008 | ff_remove_stream(c->fc, item->st); | ||
| 9009 | item->st = NULL; | ||
| 9010 | } | 9010 | } |
| 9011 | return ret; | 9011 | return ret; |
| 9012 | } | 9012 | } |