In sunrast_decode_frame(), we use av_malloc_array() allocates memory to ptr and ptr2. However if buf_end - buf < 1, this function returns error code without freeing this memory thus cause a leak. Add av_freep() before return.
Unified · Split
| @@ -163,8 +163,10 @@ static int sunrast_decode_frame(AVCodecContext *avctx, AVFrame *p, · 162 unmodified lines | |||
| 163 | x = 0; | 163 | x = 0; |
| 164 | while (ptr != end && buf < buf_end) { | 164 | while (ptr != end && buf < buf_end) { |
| 165 | run = 1; | 165 | run = 1; |
| 166 | if (buf_end - buf < 1) | 166 | if (buf_end - buf < 1) { |
| 167 | av_freep(&ptr2); | ||
| 167 | return AVERROR_INVALIDDATA; | 168 | return AVERROR_INVALIDDATA; |
| 169 | } | ||
| 168 | 170 | ||
| 169 | if ((value = *buf++) == RLE_TRIGGER) { | 171 | if ((value = *buf++) == RLE_TRIGGER) { |
| 170 | run = *buf++ + 1; | 172 | run = *buf++ + 1; |