RepoMirrors
/
mpv
mirror of https://github.com/mpv-player/mpv
1
0
Fork 0
Code Issues Releases Wiki Activity

tl_matroska: fix use-after-free with --cache 

If cache was enabled, using ordered chapters could easily crash. The
reason is that enable_cache() reopens the demuxer and closes the old
one. The code after that (reading m->ordered_chapters etc.) then
accessed freed data.

This commit also avoids enabling cache for files which are not used
(which would make opening much slower).
This commit is contained in:
wm4 2013-10-19 22:58:02 +02:00
parent d2d0bc31bf
commit f50b105d06
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
mpvcore/timeline/tl_matroska.c
View File

@ -195,9 +195,6 @@ static bool check_file_seg(struct MPContext *mpctx, struct demuxer ***sources,
mp_msg(MSGT_CPLAYER, MSGL_INFO, "Match for source %d: %s\n", mp_msg(MSGT_CPLAYER, MSGL_INFO, "Match for source %d: %s\n",
i, d->filename); i, d->filename);
if (enable_cache(mpctx, &s, &d, &params) < 0)
continue;
for (int j = 0; j < m->num_ordered_chapters; j++) { for (int j = 0; j < m->num_ordered_chapters; j++) {
struct matroska_chapter *c = m->ordered_chapters + j; struct matroska_chapter *c = m->ordered_chapters + j;
@ -215,6 +212,9 @@ static bool check_file_seg(struct MPContext *mpctx, struct demuxer ***sources,
MP_TARRAY_APPEND(NULL, *sources, *num_sources, NULL); MP_TARRAY_APPEND(NULL, *sources, *num_sources, NULL);
} }
if (enable_cache(mpctx, &s, &d, &params) < 0)
continue;
(*sources)[i] = d; (*sources)[i] = d;
return true; return true;
} }