Commit 250303c2a5 for ffmpeg
commit 250303c2a59a71bfc544a6b583bc17b6cf0ca903
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat Oct 24 05:48:38 2026 +0200
avcodec/libxevd: free the access unit packet when no picture keeps it
Packets stored in pictures that are still buffered when the decoder is
closed are not covered by this and remain leaked, see ebin21hUoZTa.
Fixes: memleak
Fixes: AkIti8GalyUg (AISLE-2026-0150-00007)
Memleak Replicated through UnModified FFmpeg with ASAN
Found-by: Joshua Rogers <joshua.rogers@aisle.com>
diff --git a/libavcodec/libxevd.c b/libavcodec/libxevd.c
index 3913e223d0..4aad67af6f 100644
--- a/libavcodec/libxevd.c
+++ b/libavcodec/libxevd.c
@@ -331,6 +331,7 @@ static int libxevd_receive_frame(AVCodecContext *avctx, AVFrame *frame)
if (pkt->size > 0) {
int bs_read_pos = 0;
+ int pkt_au_retained = 0;
XEVD_STAT stat;
XEVD_BITB bitb;
int nalu_size;
@@ -394,6 +395,7 @@ static int libxevd_receive_frame(AVCodecContext *avctx, AVFrame *frame)
// stat.fnum - has negative value if the decoded data is not frame
if (stat.fnum >= 0) {
+ pkt_au_retained = 1;
// store stat.stype into the bitb.pdata[1] that will be retrieved in an image
*(int*)bitb.pdata[1] = stat.stype;
@@ -427,6 +429,8 @@ static int libxevd_receive_frame(AVCodecContext *avctx, AVFrame *frame)
}
}
}
+ if (!pkt_au_retained)
+ av_packet_free(&pkt_au);
} else { // decoder draining mode handling
while (1) {