RepoMirrors
/
mpv
mirror of https://github.com/mpv-player/mpv
1
0
Fork 0
Code Issues Releases Wiki Activity

demuxer: fix crash with demux_rawvideo 

rawvideo is a rather primitive demuxer that doesn't implement track
switching. The problem was that during track switching the demuxer
implementations normally set the stream IDs in order to do the switch,
and since rawvideo obviously didn't do that, so the current stream in
ds->sh / demuxer->video->sh was set to NULL. (The frontend always
assumes track switching is successful, which is a reasonable
assumption - failing due to missing video codecs etc. is in separate
codepaths.) Later, demux_rawvideo_fill_buffer() in demux_rawvideo.c
tried to dereference the NULL stream and crashed.

Other trivial single-stream demuxers worked fine, because they didn't
try to access ds->sh.
This commit is contained in:
wm4 2012-09-23 14:59:36 +02:00
parent 397eb9364b
commit b2ba73c7b6
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libmpdemux/demuxer.c
View File

@ -1223,9 +1223,13 @@ void demuxer_switch_track(struct demuxer *demuxer, enum stream_type type,
assert(!stream || stream->type == type);
int index = stream ? stream->tid : -2;
if (type == STREAM_AUDIO) {
demux_control(demuxer, DEMUXER_CTRL_SWITCH_AUDIO, &index);
if (demux_control(demuxer, DEMUXER_CTRL_SWITCH_AUDIO, &index)
== DEMUXER_CTRL_NOTIMPL)
demuxer->audio->id = index;
} else if (type == STREAM_VIDEO) {
demux_control(demuxer, DEMUXER_CTRL_SWITCH_VIDEO, &index);
if (demux_control(demuxer, DEMUXER_CTRL_SWITCH_VIDEO, &index)
== DEMUXER_CTRL_NOTIMPL)
demuxer->video->id = index;
} else if (type == STREAM_SUB) {
int index2 = stream ? stream->stream_index : -2;
if (demuxer->ds[type]->id != index2)