diff options
| author | sfan5 <sfan5@live.de> | 2021-04-05 22:55:20 +0200 |
|---|---|---|
| committer | Jan Ekström <jeebjp@gmail.com> | 2021-04-08 23:47:35 +0300 |
| commit | 6be613c178d96c60ca0ae08a32946a5c4ce02989 (patch) | |
| tree | 76a76ff7de9a552490be1e3916f9fe6a7e60507c | |
| parent | 6479646f418c943a0488b4569709fb95ae318376 (diff) | |
| download | mpv-6be613c178d96c60ca0ae08a32946a5c4ce02989.tar.bz2 mpv-6be613c178d96c60ca0ae08a32946a5c4ce02989.tar.xz | |
stream_slice: fix use-after-free if inner stream fails to open
The args struct is reused to attempt opening an URL with
different stream layers, overwriting args->url not only
breaks this but also causes the freed buffer to be used again.
| -rw-r--r-- | stream/stream_slice.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/stream/stream_slice.c b/stream/stream_slice.c index d7d0a6bf05..8bf80943eb 100644 --- a/stream/stream_slice.c +++ b/stream/stream_slice.c @@ -151,8 +151,9 @@ static int open2(struct stream *stream, struct stream_open_args *args) return parse_ret; } - args->url = stream->path; - int inner_ret = stream_create_with_args(args, &p->inner); + struct stream_open_args args2 = *args; + args2.url = stream->path; + int inner_ret = stream_create_with_args(&args2, &p->inner); if (inner_ret != STREAM_OK) { return inner_ret; } |