From 2b202900618d82030384d46c8d9c3dbf3fe1d7ed Mon Sep 17 00:00:00 2001 From: Rodger Combs Date: Fri, 20 Jan 2017 20:15:03 -0600 Subject: [PATCH] lavf/segment: fix crash when failing to open segment list This happens because segment_end() returns an error, so seg_write_packet never proceeds to segment_start(), and seg->avf->pb is never re-set, so we crash with a null pb when av_write_trailer flushes the packet queue. This doesn't seem to be clearly recoverable, so I'm just failing more gracefully. Repro: ffmpeg -i input.ts -f segment -c copy -segment_list /noaxx.m3u8 test-%05d.ts (assuming you don't have write access to /) --- libavformat/segment.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavformat/segment.c b/libavformat/segment.c index 9b3dc178eb..9d471483b3 100644 --- a/libavformat/segment.c +++ b/libavformat/segment.c @@ -354,6 +354,9 @@ static int segment_end(AVFormatContext *s, int write_trailer, int is_last) int i; int err; + if (!oc || !oc->pb) + return AVERROR(EINVAL); + av_write_frame(oc, NULL); /* Flush any buffered data (fragmented mp4) */ if (write_trailer) ret = av_write_trailer(oc); @@ -850,7 +853,7 @@ static int seg_write_packet(AVFormatContext *s, AVPacket *pkt) int64_t usecs; int64_t wrapped_val; - if (!seg->avf) + if (!seg->avf || !seg->avf->pb) return AVERROR(EINVAL); calc_times: