RepoMirrors
/
mpv
mirror of https://github.com/mpv-player/mpv
1
0
Fork 0
Code Issues Releases Wiki Activity

demux_timeline: fix another cursed memory management issue 

The timeline stuff has messed up memory management because there are no
clear ownership rules between a some demuxer instances (master or
demux_timeline) and the timeline object itself.

This is another subtle problem that happened: apparently,
demux_timeline.open is supposed to take over ownership of timeline, but
only on success. If it fails, it's not supposed to free it. It didn't
follow this, which lead to a double-free if demux_timeline.open failed.
The failure path in demux.c calls both timeline_destroy() and
demux_timeline.close on failure.
This commit is contained in:
wm4 2020-02-15 14:07:46 +01:00
parent 64a03b03ea
commit 121bc6ad62
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
demux/demux_timeline.c
View File

@ -78,6 +78,7 @@ struct virtual_source {
struct priv {
struct timeline *tl;
bool owns_tl;
double duration;
@ -614,6 +615,7 @@ static int d_open(struct demuxer *demuxer, enum demux_check check)
reselect_streams(demuxer);
p->owns_tl = true;
return 0;
}
@ -629,9 +631,11 @@ static void d_close(struct demuxer *demuxer)
close_lazy_segments(demuxer, src);
}
struct demuxer *master = p->tl->demuxer;
timeline_destroy(p->tl);
demux_free(master);
if (p->owns_tl) {
struct demuxer *master = p->tl->demuxer;
timeline_destroy(p->tl);
demux_free(master);
}
}
static void d_switched_tracks(struct demuxer *demuxer)