From 31a0ffb5dcbd753dbc54a3569f50680b10b86456 Mon Sep 17 00:00:00 2001
From: Jaroslav Kysela <perex@perex.cz>
Date: Fri, 14 Mar 2014 21:01:49 +0100
Subject: [PATCH] Fix some memory leaks in parse_avc.c and mkmux.c

---
 src/htsbuf.c             |  9 +++++++++
 src/htsbuf.h             |  2 ++
 src/muxer/muxer_tvh.c    |  2 +-
 src/muxer/tvh/mkmux.c    | 15 +++++++++++----
 src/parsers/parser_avc.c | 18 +++++++++++++-----
 5 files changed, 36 insertions(+), 10 deletions(-)

diff --git a/src/htsbuf.c b/src/htsbuf.c
index 045fa071..f1b9bbae 100644
--- a/src/htsbuf.c
+++ b/src/htsbuf.c
@@ -51,6 +51,15 @@ htsbuf_queue_alloc(unsigned int maxsize)
   return hq;
 }
 
+/**
+ *
+ */
+void
+htsbuf_queue_free(htsbuf_queue_t *hq)
+{
+  htsbuf_queue_flush(hq);
+  free(hq);
+}
 
 /**
  *
diff --git a/src/htsbuf.h b/src/htsbuf.h
index ae9a1322..b355ce1f 100644
--- a/src/htsbuf.h
+++ b/src/htsbuf.h
@@ -45,6 +45,8 @@ void htsbuf_queue_init(htsbuf_queue_t *hq, unsigned int maxsize);
 
 htsbuf_queue_t *htsbuf_queue_alloc(unsigned int maxsize);
 
+void htsbuf_queue_free(htsbuf_queue_t *hq);
+
 void htsbuf_queue_flush(htsbuf_queue_t *hq);
 
 void htsbuf_vqprintf(htsbuf_queue_t *hq, const char *fmt, va_list ap);
diff --git a/src/muxer/muxer_tvh.c b/src/muxer/muxer_tvh.c
index 1049c847..cffc9069 100644
--- a/src/muxer/muxer_tvh.c
+++ b/src/muxer/muxer_tvh.c
@@ -210,7 +210,7 @@ tvh_muxer_destroy(muxer_t *m)
   tvh_muxer_t *tm = (tvh_muxer_t*)m;
 
   if(tm->tm_ref)
-    free(tm->tm_ref);
+    mk_mux_destroy(tm->tm_ref);
 
   free(tm);
 }
diff --git a/src/muxer/tvh/mkmux.c b/src/muxer/tvh/mkmux.c
index 4925039d..4c9366c4 100644
--- a/src/muxer/tvh/mkmux.c
+++ b/src/muxer/tvh/mkmux.c
@@ -514,7 +514,10 @@ mk_build_segment_header(int64_t size)
 static void
 mk_write_segment_header(mk_mux_t *mkm, int64_t size)
 {
-  mk_write_queue(mkm, mk_build_segment_header(size));
+  htsbuf_queue_t *q;
+  q = mk_build_segment_header(size);
+  mk_write_queue(mkm, q);
+  htsbuf_queue_free(q);
 }
 
 
@@ -1064,7 +1067,7 @@ mk_mux_open_file(mk_mux_t *mkm, const char *filename)
 int
 mk_mux_init(mk_mux_t *mkm, const char *title, const streaming_start_t *ss)
 {
-  htsbuf_queue_t q;
+  htsbuf_queue_t q, *a;
 
   getuuid(mkm->uuid);
 
@@ -1081,10 +1084,14 @@ mk_mux_init(mk_mux_t *mkm, const char *title, const streaming_start_t *ss)
   ebml_append_master(&q, 0x1a45dfa3, mk_build_ebmlheader(mkm));
   
   mkm->segment_header_pos = q.hq_size;
-  htsbuf_appendq(&q, mk_build_segment_header(0));
+  a = mk_build_segment_header(0);
+  htsbuf_appendq(&q, a);
+  htsbuf_queue_free(a);
 
   mkm->segment_pos = q.hq_size;
-  htsbuf_appendq(&q, mk_build_segment(mkm, ss));
+  a = mk_build_segment(mkm, ss);
+  htsbuf_appendq(&q, a);
+  htsbuf_queue_free(a);
  
   mk_write_queue(mkm, &q);
 
diff --git a/src/parsers/parser_avc.c b/src/parsers/parser_avc.c
index 1093dcab..54a08917 100644
--- a/src/parsers/parser_avc.c
+++ b/src/parsers/parser_avc.c
@@ -27,7 +27,7 @@ avc_find_startcode(const uint8_t *p, const uint8_t *end)
   int i;
 	
   uint32_t sc=0xFFFFFFFF;
-  size_t len = (end -p)+1;
+  size_t len = end - p;
   for (i=0;i<len;i++)
     {
       sc = (sc <<8) | p[i];
@@ -138,10 +138,14 @@ isom_write_avcc(sbuf_t *sb, const uint8_t *data, int len)
       }
       if(!sps_count || !pps_count) {
 	free(start);
-	if (sps_count)
+	if (sps_count) {
 	  free(sps_array);
-	if (pps_count)
+          free(sps_size_array);
+        }
+	if (pps_count) {
 	  free(pps_array);
+          free(pps_size_array);
+        }
 	return -1;
       }
 
@@ -163,10 +167,14 @@ isom_write_avcc(sbuf_t *sb, const uint8_t *data, int len)
       }
       free(start);
 
-      if (sps_count)
+      if (sps_count) {
 	free(sps_array);
-      if (pps_count)
+        free(sps_size_array);
+      }
+      if (pps_count) {
 	free(pps_array);
+        free(pps_size_array);
+      }
     } else {
       sbuf_append(sb, data, len);
     }