[FFmpeg-cvslog] avformat/dashdec: check copy_init_section memory alloc result

[Steven Liu]

ffmpeg | branch: master | Steven Liu <lq at chinaffmpeg.org> | Fri Jun 14 16:59:07 2019 +0800| [665759c3c803c34e17db2678af4daa86565f0f33] | committer: Steven Liu

avformat/dashdec: check copy_init_section memory alloc result

Signed-off-by: Steven Liu <lq at chinaffmpeg.org>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=665759c3c803c34e17db2678af4daa86565f0f33
---

 libavformat/dashdec.c | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/libavformat/dashdec.c b/libavformat/dashdec.c
index 6b73da62fa..5727d13a51 100644
--- a/libavformat/dashdec.c
+++ b/libavformat/dashdec.c
@@ -2008,13 +2008,19 @@ static int is_common_init_section_exist(struct representation **pls, int n_pls)
     return 1;
 }
 
-static void copy_init_section(struct representation *rep_dest, struct representation *rep_src)
+static int copy_init_section(struct representation *rep_dest, struct representation *rep_src)
 {
     rep_dest->init_sec_buf = av_mallocz(rep_src->init_sec_buf_size);
+    if (!rep_dest->init_sec_buf) {
+        av_log(rep_dest->ctx, AV_LOG_WARNING, "Cannot alloc memory for init_sec_buf\n");
+        return AVERROR(ENOMEM);
+    }
     memcpy(rep_dest->init_sec_buf, rep_src->init_sec_buf, rep_src->init_sec_data_len);
     rep_dest->init_sec_buf_size = rep_src->init_sec_buf_size;
     rep_dest->init_sec_data_len = rep_src->init_sec_data_len;
     rep_dest->cur_timestamp = rep_src->cur_timestamp;
+
+    return 0;
 }
 
 
@@ -2048,7 +2054,9 @@ static int dash_read_header(AVFormatContext *s)
     for (i = 0; i < c->n_videos; i++) {
         struct representation *cur_video = c->videos[i];
         if (i > 0 && c->is_init_section_common_video) {
-            copy_init_section(cur_video,c->videos[0]);
+            ret = copy_init_section(cur_video,c->videos[0]);
+            if (ret < 0)
+                goto fail;
         }
         ret = open_demux_for_component(s, cur_video);
 
@@ -2064,7 +2072,9 @@ static int dash_read_header(AVFormatContext *s)
     for (i = 0; i < c->n_audios; i++) {
         struct representation *cur_audio = c->audios[i];
         if (i > 0 && c->is_init_section_common_audio) {
-            copy_init_section(cur_audio,c->audios[0]);
+            ret = copy_init_section(cur_audio,c->audios[0]);
+            if (ret < 0)
+                goto fail;
         }
         ret = open_demux_for_component(s, cur_audio);
 
@@ -2080,7 +2090,9 @@ static int dash_read_header(AVFormatContext *s)
     for (i = 0; i < c->n_subtitles; i++) {
         struct representation *cur_subtitle = c->subtitles[i];
         if (i > 0 && c->is_init_section_common_audio) {
-            copy_init_section(cur_subtitle,c->subtitles[0]);
+            ret = copy_init_section(cur_subtitle,c->subtitles[0]);
+            if (ret < 0)
+                goto fail;
         }
         ret = open_demux_for_component(s, cur_subtitle);