dec_sub: always copy packet for new segments

Since 062104d16e34f348ffd9324ca4c997b6b0f487d4, we started saving cached
packets for subtitles. However, these can point to the same address as
what is stored in sub->new_segment. When a segment is updated, the
packet is potentially freed. Later during decoding, this can lead to a
double free since the cached packets will naturally try to free itself
and update. Fix this by simply always making sub->new_segment a full
copy of the packet so its lifetime doesn't have to be tied to the cached
packet stuff.

1 files changed, 1 insertions, 1 deletions

diff --git a/sub/dec_sub.c b/sub/dec_sub.c
index 9de37d7523..18d826e8b5 100644
--- a/sub/dec_sub.c
+++ b/sub/dec_sub.c
@@ -321,7 +321,7 @@ bool sub_read_packets(struct dec_sub *sub, double video_pts, bool force)
         sub->last_pkt_pts = pkt->pts;
 
         if (is_new_segment(sub, pkt)) {
-            sub->new_segment = pkt;
+            sub->new_segment = demux_copy_packet(pkt);
             // Note that this can be delayed to a much later point in time.
             update_segment(sub);
             break;