In sunrast_decode_frame(), we use av_malloc_array() allocates memory to ptr and ptr2. However if buf_end - buf < 1, this function returns error code without freeing this memory thus cause a leak. Add av_freep() before return.
Unified · Split
| @@ -163,8 +163,10 @@ static int sunrast_decode_frame(AVCodecContext *avctx, AVFrame *p, · 162 unmodified lines | ||
| 163 | 163 | x = 0; |
| 164 | 164 | while (ptr != end && buf < buf_end) { |
| 165 | 165 | run = 1; |
| 166 | − if (buf_end - buf < 1) | |
| 166 | + if (buf_end - buf < 1) { | |
| 167 | + av_freep(&ptr2); | |
| 167 | 168 | return AVERROR_INVALIDDATA; |
| 169 | + } | |
| 168 | 170 | |
| 169 | 171 | if ((value = *buf++) == RLE_TRIGGER) { |
| 170 | 172 | run = *buf++ + 1; |