Mercurial > mplayer.hg
diff libmpdemux/demux_audio.c @ 18708:9e2b300db17b
Change free_sh_audio() to take demuxer and stream id as parameters
(same as new_sh_audio()) instead of sh_audio_t *, use those to remove
the pointer from demuxer->a_streams[] before freeing it.
Some demuxers use free_sh_audio() to undo the creation of an
already-allocated audio stream in case of error. These uses were unsafe
since free_sh_audio() freed the data structure but left the pointer in
demuxer->a_streams[], leading to double free later in free_demuxer()
(and perhaps use of the freed stream before that, I didn't check).
author | uau |
---|---|
date | Wed, 14 Jun 2006 14:05:59 +0000 |
parents | f72bc5754209 |
children | c528c6c518f1 |
line wrap: on
line diff
--- a/libmpdemux/demux_audio.c Wed Jun 14 13:47:11 2006 +0000 +++ b/libmpdemux/demux_audio.c Wed Jun 14 14:05:59 2006 +0000 @@ -47,7 +47,6 @@ struct mp3_hdr *next; } mp3_hdr_t; -extern void free_sh_audio(sh_audio_t* sh); extern void print_wave_header(WAVEFORMATEX *h, int verbose_level); int hr_mp3_seek = 0; @@ -412,12 +411,12 @@ l = stream_read_dword_le(s); if(l < 16) { mp_msg(MSGT_DEMUX,MSGL_ERR,"[demux_audio] Bad wav header length: too short (%d)!!!\n",l); - free_sh_audio(sh_audio); + free_sh_audio(demuxer, 0); return 0; } if(l > MAX_WAVHDR_LEN) { mp_msg(MSGT_DEMUX,MSGL_ERR,"[demux_audio] Bad wav header length: too long (%d)!!!\n",l); - free_sh_audio(sh_audio); + free_sh_audio(demuxer, 0); return 0; } sh_audio->wf = w = (WAVEFORMATEX*)malloc(l > sizeof(WAVEFORMATEX) ? l : sizeof(WAVEFORMATEX));