comparison libmpdemux/demux_audio.c @ 18708:9e2b300db17b

Change free_sh_audio() to take demuxer and stream id as parameters (same as new_sh_audio()) instead of sh_audio_t *, use those to remove the pointer from demuxer->a_streams[] before freeing it. Some demuxers use free_sh_audio() to undo the creation of an already-allocated audio stream in case of error. These uses were unsafe since free_sh_audio() freed the data structure but left the pointer in demuxer->a_streams[], leading to double free later in free_demuxer() (and perhaps use of the freed stream before that, I didn't check).
author uau
date Wed, 14 Jun 2006 14:05:59 +0000
parents f72bc5754209
children c528c6c518f1
comparison
equal deleted inserted replaced
18707:60a60dbf7a88 18708:9e2b300db17b
45 int mpa_br; 45 int mpa_br;
46 int cons_hdrs; // if this reaches MIN_MP3_HDRS we accept as MP3 file 46 int cons_hdrs; // if this reaches MIN_MP3_HDRS we accept as MP3 file
47 struct mp3_hdr *next; 47 struct mp3_hdr *next;
48 } mp3_hdr_t; 48 } mp3_hdr_t;
49 49
50 extern void free_sh_audio(sh_audio_t* sh);
51 extern void print_wave_header(WAVEFORMATEX *h, int verbose_level); 50 extern void print_wave_header(WAVEFORMATEX *h, int verbose_level);
52 51
53 int hr_mp3_seek = 0; 52 int hr_mp3_seek = 0;
54 53
55 /** 54 /**
410 WAVEFORMATEX* w; 409 WAVEFORMATEX* w;
411 int l; 410 int l;
412 l = stream_read_dword_le(s); 411 l = stream_read_dword_le(s);
413 if(l < 16) { 412 if(l < 16) {
414 mp_msg(MSGT_DEMUX,MSGL_ERR,"[demux_audio] Bad wav header length: too short (%d)!!!\n",l); 413 mp_msg(MSGT_DEMUX,MSGL_ERR,"[demux_audio] Bad wav header length: too short (%d)!!!\n",l);
415 free_sh_audio(sh_audio); 414 free_sh_audio(demuxer, 0);
416 return 0; 415 return 0;
417 } 416 }
418 if(l > MAX_WAVHDR_LEN) { 417 if(l > MAX_WAVHDR_LEN) {
419 mp_msg(MSGT_DEMUX,MSGL_ERR,"[demux_audio] Bad wav header length: too long (%d)!!!\n",l); 418 mp_msg(MSGT_DEMUX,MSGL_ERR,"[demux_audio] Bad wav header length: too long (%d)!!!\n",l);
420 free_sh_audio(sh_audio); 419 free_sh_audio(demuxer, 0);
421 return 0; 420 return 0;
422 } 421 }
423 sh_audio->wf = w = (WAVEFORMATEX*)malloc(l > sizeof(WAVEFORMATEX) ? l : sizeof(WAVEFORMATEX)); 422 sh_audio->wf = w = (WAVEFORMATEX*)malloc(l > sizeof(WAVEFORMATEX) ? l : sizeof(WAVEFORMATEX));
424 w->wFormatTag = sh_audio->format = stream_read_word_le(s); 423 w->wFormatTag = sh_audio->format = stream_read_word_le(s);
425 w->nChannels = sh_audio->channels = stream_read_word_le(s); 424 w->nChannels = sh_audio->channels = stream_read_word_le(s);