mirror of https://github.com/mpv-player/mpv
Change free_sh_audio() to take demuxer and stream id as parameters
(same as new_sh_audio()) instead of sh_audio_t *, use those to remove the pointer from demuxer->a_streams[] before freeing it. Some demuxers use free_sh_audio() to undo the creation of an already-allocated audio stream in case of error. These uses were unsafe since free_sh_audio() freed the data structure but left the pointer in demuxer->a_streams[], leading to double free later in free_demuxer() (and perhaps use of the freed stream before that, I didn't check). git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@18711 b3059339-0415-0410-9bf9-f77b7e298cf2
This commit is contained in:
parent
a4850512c0
commit
7022f65d0c
|
@ -47,7 +47,6 @@ typedef struct mp3_hdr {
|
||||||
struct mp3_hdr *next;
|
struct mp3_hdr *next;
|
||||||
} mp3_hdr_t;
|
} mp3_hdr_t;
|
||||||
|
|
||||||
extern void free_sh_audio(sh_audio_t* sh);
|
|
||||||
extern void print_wave_header(WAVEFORMATEX *h, int verbose_level);
|
extern void print_wave_header(WAVEFORMATEX *h, int verbose_level);
|
||||||
|
|
||||||
int hr_mp3_seek = 0;
|
int hr_mp3_seek = 0;
|
||||||
|
@ -412,12 +411,12 @@ static int demux_audio_open(demuxer_t* demuxer) {
|
||||||
l = stream_read_dword_le(s);
|
l = stream_read_dword_le(s);
|
||||||
if(l < 16) {
|
if(l < 16) {
|
||||||
mp_msg(MSGT_DEMUX,MSGL_ERR,"[demux_audio] Bad wav header length: too short (%d)!!!\n",l);
|
mp_msg(MSGT_DEMUX,MSGL_ERR,"[demux_audio] Bad wav header length: too short (%d)!!!\n",l);
|
||||||
free_sh_audio(sh_audio);
|
free_sh_audio(demuxer, 0);
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
if(l > MAX_WAVHDR_LEN) {
|
if(l > MAX_WAVHDR_LEN) {
|
||||||
mp_msg(MSGT_DEMUX,MSGL_ERR,"[demux_audio] Bad wav header length: too long (%d)!!!\n",l);
|
mp_msg(MSGT_DEMUX,MSGL_ERR,"[demux_audio] Bad wav header length: too long (%d)!!!\n",l);
|
||||||
free_sh_audio(sh_audio);
|
free_sh_audio(demuxer, 0);
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
sh_audio->wf = w = (WAVEFORMATEX*)malloc(l > sizeof(WAVEFORMATEX) ? l : sizeof(WAVEFORMATEX));
|
sh_audio->wf = w = (WAVEFORMATEX*)malloc(l > sizeof(WAVEFORMATEX) ? l : sizeof(WAVEFORMATEX));
|
||||||
|
|
|
@ -1837,7 +1837,7 @@ demux_mkv_open_audio (demuxer_t *demuxer, mkv_track_t *track)
|
||||||
mp_msg (MSGT_DEMUX, MSGL_WARN, "[mkv] Unknown/unsupported audio "
|
mp_msg (MSGT_DEMUX, MSGL_WARN, "[mkv] Unknown/unsupported audio "
|
||||||
"codec ID '%s' for track %u or missing/faulty private "
|
"codec ID '%s' for track %u or missing/faulty private "
|
||||||
"codec data.\n", track->codec_id, track->tnum);
|
"codec data.\n", track->codec_id, track->tnum);
|
||||||
free_sh_audio (sh_a);
|
free_sh_audio(demuxer, track->tnum);
|
||||||
return 1;
|
return 1;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -2061,7 +2061,7 @@ demux_mkv_open_audio (demuxer_t *demuxer, mkv_track_t *track)
|
||||||
}
|
}
|
||||||
else if (!track->ms_compat || (track->private_size < sizeof(WAVEFORMATEX)))
|
else if (!track->ms_compat || (track->private_size < sizeof(WAVEFORMATEX)))
|
||||||
{
|
{
|
||||||
free_sh_audio (sh_a);
|
free_sh_audio(demuxer, track->tnum);
|
||||||
return 1;
|
return 1;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -663,7 +663,7 @@ if (demuxer->audio->id >= -1){
|
||||||
{
|
{
|
||||||
mp_msg(MSGT_DEMUX, MSGL_ERR, "VIVO: Not support audio codec (%d)\n",
|
mp_msg(MSGT_DEMUX, MSGL_ERR, "VIVO: Not support audio codec (%d)\n",
|
||||||
priv->audio_codec);
|
priv->audio_codec);
|
||||||
free_sh_audio(sh);
|
free_sh_audio(demuxer, 1);
|
||||||
goto nosound;
|
goto nosound;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -229,7 +229,9 @@ sh_audio_t* new_sh_audio(demuxer_t *demuxer,int id){
|
||||||
return demuxer->a_streams[id];
|
return demuxer->a_streams[id];
|
||||||
}
|
}
|
||||||
|
|
||||||
void free_sh_audio(sh_audio_t* sh){
|
void free_sh_audio(demuxer_t *demuxer, int id) {
|
||||||
|
sh_audio_t *sh = demuxer->a_streams[id];
|
||||||
|
demuxer->a_streams[id] = NULL;
|
||||||
mp_msg(MSGT_DEMUXER,MSGL_DBG2,"DEMUXER: freeing sh_audio at %p\n",sh);
|
mp_msg(MSGT_DEMUXER,MSGL_DBG2,"DEMUXER: freeing sh_audio at %p\n",sh);
|
||||||
if(sh->wf) free(sh->wf);
|
if(sh->wf) free(sh->wf);
|
||||||
free(sh);
|
free(sh);
|
||||||
|
@ -270,11 +272,9 @@ void free_demuxer(demuxer_t *demuxer){
|
||||||
goto skip_streamfree;
|
goto skip_streamfree;
|
||||||
// free streams:
|
// free streams:
|
||||||
for(i = 0; i < MAX_A_STREAMS; i++)
|
for(i = 0; i < MAX_A_STREAMS; i++)
|
||||||
if(demuxer->a_streams[i]) free_sh_audio(demuxer->a_streams[i]);
|
if(demuxer->a_streams[i]) free_sh_audio(demuxer, i);
|
||||||
for(i = 0; i < MAX_V_STREAMS; i++)
|
for(i = 0; i < MAX_V_STREAMS; i++)
|
||||||
if(demuxer->v_streams[i]) free_sh_video(demuxer->v_streams[i]);
|
if(demuxer->v_streams[i]) free_sh_video(demuxer->v_streams[i]);
|
||||||
//if(sh_audio) free_sh_audio(sh_audio);
|
|
||||||
//if(sh_video) free_sh_video(sh_video);
|
|
||||||
// free demuxers:
|
// free demuxers:
|
||||||
free_demuxer_stream(demuxer->audio);
|
free_demuxer_stream(demuxer->audio);
|
||||||
free_demuxer_stream(demuxer->video);
|
free_demuxer_stream(demuxer->video);
|
||||||
|
|
|
@ -89,7 +89,7 @@ typedef struct {
|
||||||
// demuxer.c:
|
// demuxer.c:
|
||||||
sh_audio_t* new_sh_audio(demuxer_t *demuxer,int id);
|
sh_audio_t* new_sh_audio(demuxer_t *demuxer,int id);
|
||||||
sh_video_t* new_sh_video(demuxer_t *demuxer,int id);
|
sh_video_t* new_sh_video(demuxer_t *demuxer,int id);
|
||||||
void free_sh_audio(sh_audio_t *sh);
|
void free_sh_audio(demuxer_t *demuxer, int id);
|
||||||
void free_sh_video(sh_video_t *sh);
|
void free_sh_video(sh_video_t *sh);
|
||||||
|
|
||||||
// video.c:
|
// video.c:
|
||||||
|
|
Loading…
Reference in New Issue