From b40d91cad92f2f694045a6a7b69f117b3dcfa19c Mon Sep 17 00:00:00 2001 From: huanghuihui0904 <625173@qq.com> Date: Mon, 16 Mar 2026 17:07:48 +0800 Subject: [PATCH] avformat: avoid potential tmp_opts leak in ffurl_connect() When options is NULL, ffurl_connect() creates a temporary dictionary (tmp_opts). If the protocol_blacklist av_dict_set() fails after the whitelist entry was inserted, the function returns without freeing this dictionary. Ensure tmp_opts is freed on this error path. Signed-off-by: Huihui_Huang Co-Authored-By: Claude Opus 4.6 (1M context) --- libavformat/avio.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/libavformat/avio.c b/libavformat/avio.c index c685e0ab71..1e26092f79 100644 --- a/libavformat/avio.c +++ b/libavformat/avio.c @@ -239,7 +239,7 @@ int ffurl_connect(URLContext *uc, AVDictionary **options) if ((err = av_dict_set(options, "protocol_whitelist", uc->protocol_whitelist, 0)) < 0) return err; if ((err = av_dict_set(options, "protocol_blacklist", uc->protocol_blacklist, 0)) < 0) - return err; + goto fail; err = uc->prot->url_open2 ? uc->prot->url_open2(uc, @@ -260,6 +260,11 @@ int ffurl_connect(URLContext *uc, AVDictionary **options) if (!uc->is_streamed && ffurl_seek(uc, 0, SEEK_SET) < 0) uc->is_streamed = 1; return 0; + +fail: + if (options == &tmp_opts) + av_dict_free(&tmp_opts); + return err; } int ffurl_accept(URLContext *s, URLContext **c)