avcodec/mpeg4videodec: Fix integer overflow in num_sprite_warping_points=2 case

[ffmpeg] / libavcodec / mediacodec_wrapper.c

diff --git a/libavcodec/mediacodec_wrapper.c b/libavcodec/mediacodec_wrapper.c
index 43fbb511fddca5566c99fc344d7a0d17365c3e3b..4a37cd7cd7a72deb3cc9d23eb665ff418a630a97 100644 (file)
--- a/libavcodec/mediacodec_wrapper.c
+++ b/libavcodec/mediacodec_wrapper.c
@@ -66,7 +66,7 @@ struct JNIAMediaCodecListFields {
     jfieldID hevc_profile_main10_id;
     jfieldID hevc_profile_main10_hdr10_id;
 
-} JNIAMediaCodecListFields;
+};
 
 static const struct FFJniField jni_amediacodeclist_mapping[] = {
     { "android/media/MediaCodecList", NULL, NULL, FF_JNI_CLASS, offsetof(struct JNIAMediaCodecListFields, mediacodec_list_class), 1 },
@@ -125,7 +125,7 @@ struct JNIAMediaFormatFields {
 
     jmethodID to_string_id;
 
-} JNIAMediaFormatFields;
+};
 
 static const struct FFJniField jni_amediaformat_mapping[] = {
     { "android/media/MediaFormat", NULL, NULL, FF_JNI_CLASS, offsetof(struct JNIAMediaFormatFields, mediaformat_class), 1 },
@@ -210,7 +210,7 @@ struct JNIAMediaCodecFields {
     jfieldID presentation_time_us_id;
     jfieldID size_id;
 
-} JNIAMediaCodecFields;
+};
 
 static const struct FFJniField jni_amediacodec_mapping[] = {
     { "android/media/MediaCodec", NULL, NULL, FF_JNI_CLASS, offsetof(struct JNIAMediaCodecFields, mediacodec_class), 1 },
@@ -608,6 +608,7 @@ FFAMediaFormat *ff_AMediaFormat_new(void)
 {
     JNIEnv *env = NULL;
     FFAMediaFormat *format = NULL;
+    jobject object = NULL;
 
     format = av_mallocz(sizeof(FFAMediaFormat));
     if (!format) {
@@ -625,23 +626,27 @@ FFAMediaFormat *ff_AMediaFormat_new(void)
         goto fail;
     }
 
-    format->object = (*env)->NewObject(env, format->jfields.mediaformat_class, format->jfields.init_id);
-    if (!format->object) {
+    object = (*env)->NewObject(env, format->jfields.mediaformat_class, format->jfields.init_id);
+    if (!object) {
         goto fail;
     }
 
-    format->object = (*env)->NewGlobalRef(env, format->object);
+    format->object = (*env)->NewGlobalRef(env, object);
     if (!format->object) {
         goto fail;
     }
 
-    return format;
 fail:
-    ff_jni_reset_jfields(env, &format->jfields, jni_amediaformat_mapping, 1, format);
+    if (object) {
+        (*env)->DeleteLocalRef(env, object);
+    }
 
-    av_freep(&format);
+    if (!format->object) {
+        ff_jni_reset_jfields(env, &format->jfields, jni_amediaformat_mapping, 1, format);
+        av_freep(&format);
+    }
 
-    return NULL;
+    return format;
 }
 
 static FFAMediaFormat *ff_AMediaFormat_newFromObject(void *object)
@@ -1562,6 +1567,7 @@ uint8_t* ff_AMediaCodec_getInputBuffer(FFAMediaCodec* codec, size_t idx, size_t
     JNIEnv *env = NULL;
 
     jobject buffer = NULL;
+    jobject input_buffers = NULL;
 
     JNI_GET_ENV_OR_RETURN(env, codec, NULL);
 
@@ -1572,12 +1578,12 @@ uint8_t* ff_AMediaCodec_getInputBuffer(FFAMediaCodec* codec, size_t idx, size_t
         }
     } else {
         if (!codec->input_buffers) {
-            codec->input_buffers = (*env)->CallObjectMethod(env, codec->object, codec->jfields.get_input_buffers_id);
+            input_buffers = (*env)->CallObjectMethod(env, codec->object, codec->jfields.get_input_buffers_id);
             if (ff_jni_exception_check(env, 1, codec) < 0) {
                 goto fail;
             }
 
-            codec->input_buffers = (*env)->NewGlobalRef(env, codec->input_buffers);
+            codec->input_buffers = (*env)->NewGlobalRef(env, input_buffers);
             if (ff_jni_exception_check(env, 1, codec) < 0) {
                 goto fail;
             }
@@ -1596,6 +1602,10 @@ fail:
         (*env)->DeleteLocalRef(env, buffer);
     }
 
+    if (input_buffers) {
+        (*env)->DeleteLocalRef(env, input_buffers);
+    }
+
     return ret;
 }
 
@@ -1605,6 +1615,7 @@ uint8_t* ff_AMediaCodec_getOutputBuffer(FFAMediaCodec* codec, size_t idx, size_t
     JNIEnv *env = NULL;
 
     jobject buffer = NULL;
+    jobject output_buffers = NULL;
 
     JNI_GET_ENV_OR_RETURN(env, codec, NULL);
 
@@ -1615,12 +1626,12 @@ uint8_t* ff_AMediaCodec_getOutputBuffer(FFAMediaCodec* codec, size_t idx, size_t
         }
     } else {
         if (!codec->output_buffers) {
-            codec->output_buffers = (*env)->CallObjectMethod(env, codec->object, codec->jfields.get_output_buffers_id);
+            output_buffers = (*env)->CallObjectMethod(env, codec->object, codec->jfields.get_output_buffers_id);
             if (ff_jni_exception_check(env, 1, codec) < 0) {
                 goto fail;
             }
 
-            codec->output_buffers = (*env)->NewGlobalRef(env, codec->output_buffers);
+            codec->output_buffers = (*env)->NewGlobalRef(env, output_buffers);
             if (ff_jni_exception_check(env, 1, codec) < 0) {
                 goto fail;
             }
@@ -1639,6 +1650,10 @@ fail:
         (*env)->DeleteLocalRef(env, buffer);
     }
 
+    if (output_buffers) {
+        (*env)->DeleteLocalRef(env, output_buffers);
+    }
+
     return ret;
 }