avformat/mp3enc: use av_copy_packet()

Fixes double free
Fixes Ticket3476

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d003a0cd2e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2014-03-22 01:26:48 +01:00
parent 946810d1da
commit 4201c74545

View File

@ -414,14 +414,14 @@ static int mp3_write_packet(AVFormatContext *s, AVPacket *pkt)
if (mp3->pics_to_write) {
/* buffer audio packets until we get all the pictures */
AVPacketList *pktl = av_mallocz(sizeof(*pktl));
int ret;
if (!pktl)
return AVERROR(ENOMEM);
pktl->pkt = *pkt;
pktl->pkt.buf = av_buffer_ref(pkt->buf);
if (!pktl->pkt.buf) {
ret = av_copy_packet(&pktl->pkt, pkt);
if (ret < 0) {
av_freep(&pktl);
return AVERROR(ENOMEM);
return ret;
}
if (mp3->queue_end)