Fix some memory leaks in parse_avc.c and mkmux.c

src/htsbuf.c

@@ -51,6 +51,15 @@ htsbuf_queue_alloc(unsigned int maxsize)
   return hq;
 }
 
+/**
+ *
+ */
+void
+htsbuf_queue_free(htsbuf_queue_t *hq)
+{
+  htsbuf_queue_flush(hq);
+  free(hq);
+}
 
 /**
  *

src/htsbuf.h

@@ -45,6 +45,8 @@ void htsbuf_queue_init(htsbuf_queue_t *hq, unsigned int maxsize);
 
 htsbuf_queue_t *htsbuf_queue_alloc(unsigned int maxsize);
 
+void htsbuf_queue_free(htsbuf_queue_t *hq);
+
 void htsbuf_queue_flush(htsbuf_queue_t *hq);
 
 void htsbuf_vqprintf(htsbuf_queue_t *hq, const char *fmt, va_list ap);

src/muxer/muxer_tvh.c

@@ -210,7 +210,7 @@ tvh_muxer_destroy(muxer_t *m)
   tvh_muxer_t *tm = (tvh_muxer_t*)m;
 
   if(tm->tm_ref)
-    free(tm->tm_ref);
+    mk_mux_destroy(tm->tm_ref);
 
   free(tm);
 }

src/muxer/tvh/mkmux.c

@@ -514,7 +514,10 @@ mk_build_segment_header(int64_t size)
 static void
 mk_write_segment_header(mk_mux_t *mkm, int64_t size)
 {
-  mk_write_queue(mkm, mk_build_segment_header(size));
+  htsbuf_queue_t *q;
+  q = mk_build_segment_header(size);
+  mk_write_queue(mkm, q);
+  htsbuf_queue_free(q);
 }
 
 
@@ -1064,7 +1067,7 @@ mk_mux_open_file(mk_mux_t *mkm, const char *filename)
 int
 mk_mux_init(mk_mux_t *mkm, const char *title, const streaming_start_t *ss)
 {
-  htsbuf_queue_t q;
+  htsbuf_queue_t q, *a;
 
   getuuid(mkm->uuid);
 
@@ -1081,10 +1084,14 @@ mk_mux_init(mk_mux_t *mkm, const char *title, const streaming_start_t *ss)
   ebml_append_master(&q, 0x1a45dfa3, mk_build_ebmlheader(mkm));
   
   mkm->segment_header_pos = q.hq_size;
-  htsbuf_appendq(&q, mk_build_segment_header(0));
+  a = mk_build_segment_header(0);
+  htsbuf_appendq(&q, a);
+  htsbuf_queue_free(a);
 
   mkm->segment_pos = q.hq_size;
-  htsbuf_appendq(&q, mk_build_segment(mkm, ss));
+  a = mk_build_segment(mkm, ss);
+  htsbuf_appendq(&q, a);
+  htsbuf_queue_free(a);
  
   mk_write_queue(mkm, &q);
 

src/parsers/parser_avc.c

@@ -27,7 +27,7 @@ avc_find_startcode(const uint8_t *p, const uint8_t *end)
   int i;
 	
   uint32_t sc=0xFFFFFFFF;
-  size_t len = (end -p)+1;
+  size_t len = end - p;
   for (i=0;i<len;i++)
     {
       sc = (sc <<8) | p[i];
@@ -138,10 +138,14 @@ isom_write_avcc(sbuf_t *sb, const uint8_t *data, int len)
       }
       if(!sps_count || !pps_count) {
 	free(start);
-	if (sps_count)
+	if (sps_count) {
 	  free(sps_array);
-	if (pps_count)
+          free(sps_size_array);
+        }
+	if (pps_count) {
 	  free(pps_array);
+          free(pps_size_array);
+        }
 	return -1;
       }
 
@@ -163,10 +167,14 @@ isom_write_avcc(sbuf_t *sb, const uint8_t *data, int len)
       }
       free(start);
 
-      if (sps_count)
+      if (sps_count) {
 	free(sps_array);
-      if (pps_count)
+        free(sps_size_array);
+      }
+      if (pps_count) {
 	free(pps_array);
+        free(pps_size_array);
+      }
     } else {
       sbuf_append(sb, data, len);
     }