# HG changeset patch # User michael # Date 1260568170 0 # Node ID 158f0ea08e820b6623799ec8f528bf33be7d8c9a # Parent 2aab93afc8264d2afadc3b95e807426ae6eecc14 Make sure av_new_packet() initializes the data and destruct pointers. Some code does call av_free_packet() on failed av_new_packets(), this prevents the freeing of uninitialized pointers. diff -r 2aab93afc826 -r 158f0ea08e82 avpacket.c --- a/avpacket.c Thu Dec 10 23:06:23 2009 +0000 +++ b/avpacket.c Fri Dec 11 21:49:30 2009 +0000 @@ -47,18 +47,20 @@ int av_new_packet(AVPacket *pkt, int size) { - uint8_t *data; - if((unsigned)size > (unsigned)size + FF_INPUT_BUFFER_PADDING_SIZE) - return AVERROR(ENOMEM); + uint8_t *data= NULL; + if((unsigned)size < (unsigned)size + FF_INPUT_BUFFER_PADDING_SIZE) data = av_malloc(size + FF_INPUT_BUFFER_PADDING_SIZE); - if (!data) - return AVERROR(ENOMEM); + if (data){ memset(data + size, 0, FF_INPUT_BUFFER_PADDING_SIZE); + }else + size=0; av_init_packet(pkt); pkt->data = data; pkt->size = size; pkt->destruct = av_destruct_packet; + if(!data) + return AVERROR(ENOMEM); return 0; }