ogg: fix double free when finding length of small chained oggs.
authorRonald S. Bultje <rsbultje@gmail.com>
Wed, 29 Jun 2011 05:24:21 +0000 (22:24 -0700)
committerRonald S. Bultje <rsbultje@gmail.com>
Wed, 29 Jun 2011 16:45:52 +0000 (09:45 -0700)
ogg_save() copies streams[], but doesn't keep track of free()'ed
struct members. Thus, if in between a call to ogg_save() and
ogg_restore(), streams[].private was free()'ed, this would result
in a double free -> crash, which happened when e.g. playing small
chained ogg fragments.

libavformat/oggdec.c

index f1ad630..998a33b 100644 (file)
@@ -238,7 +238,8 @@ static int ogg_read_page(AVFormatContext *s, int *str)
 
             for (n = 0; n < ogg->nstreams; n++) {
                 av_freep(&ogg->streams[n].buf);
-                av_freep(&ogg->streams[n].private);
+                if (!ogg->state || ogg->state->streams[n].private != ogg->streams[n].private)
+                    av_freep(&ogg->streams[n].private);
             }
             ogg->curidx   = -1;
             ogg->nstreams = 0;