[Libquicktime-devel] Invalid free in udta atom

[Erik J. <eri...@gm...>]

Hi,

I found that there is a bug reading udta atoms when an invalid
@cmt-atom occurs after a valid @cmt-atom has been read, in a context
where have_ilst is set.

The memory allocated for the valid @cmt-atom will be free'ed, but
udta->comment_len and udta->comment will remain set, causing an
invalid call to free() for udta->comment on close.

Some DJI-drones creates .m4v-files affected by this problem.

Patch attached.

Thanks,
Erik