diff libmpdemux/stheader.h @ 18708:9e2b300db17b

Change free_sh_audio() to take demuxer and stream id as parameters (same as new_sh_audio()) instead of sh_audio_t *, use those to remove the pointer from demuxer->a_streams[] before freeing it. Some demuxers use free_sh_audio() to undo the creation of an already-allocated audio stream in case of error. These uses were unsafe since free_sh_audio() freed the data structure but left the pointer in demuxer->a_streams[], leading to double free later in free_demuxer() (and perhaps use of the freed stream before that, I didn't check).

--- a/libmpdemux/stheader.h	Wed Jun 14 13:47:11 2006 +0000
+++ b/libmpdemux/stheader.h	Wed Jun 14 14:05:59 2006 +0000
@@ -89,7 +89,7 @@
 // demuxer.c:
 sh_audio_t* new_sh_audio(demuxer_t *demuxer,int id);
 sh_video_t* new_sh_video(demuxer_t *demuxer,int id);
-void free_sh_audio(sh_audio_t *sh);
+void free_sh_audio(demuxer_t *demuxer, int id);
 void free_sh_video(sh_video_t *sh);
 
 // video.c: