RepoMirrors
/
mpv
mirror of https://github.com/mpv-player/mpv
1
0
Fork 0
Code Issues Releases Wiki Activity

stream_slice: fix use-after-free if inner stream fails to open 

The args struct is reused to attempt opening an URL with
different stream layers, overwriting args->url not only
breaks this but also causes the freed buffer to be used again.
This commit is contained in:
sfan5 2021-04-05 22:55:20 +02:00 committed by Jan Ekström
parent 6479646f41
commit 6be613c178
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
stream/stream_slice.c
View File

@ -151,8 +151,9 @@ static int open2(struct stream *stream, struct stream_open_args *args)
return parse_ret; return parse_ret;
} }
args->url = stream->path; struct stream_open_args args2 = *args;
int inner_ret = stream_create_with_args(args, &p->inner); args2.url = stream->path;
int inner_ret = stream_create_with_args(&args2, &p->inner);
if (inner_ret != STREAM_OK) { if (inner_ret != STREAM_OK) {
return inner_ret; return inner_ret;
} }