diff options
| author | Dudemanguy <random342@airmail.cc> | 2023-10-01 15:35:57 -0500 |
|---|---|---|
| committer | Dudemanguy <random342@airmail.cc> | 2023-10-01 16:11:06 -0500 |
| commit | d50de74c1ee79ada5d27b465a9074b0ebf87cedf (patch) | |
| tree | b172823bb93f0f9a789f08e61eac7680fbfdad4e | |
| parent | 0070a5820e9f182bb37620d3bddbdfde26ce00a3 (diff) | |
| download | mpv-d50de74c1ee79ada5d27b465a9074b0ebf87cedf.tar.bz2 mpv-d50de74c1ee79ada5d27b465a9074b0ebf87cedf.tar.xz | |
Revert "demux: constify a struct member"
Some demuxers actually close the stream right after they are finished
opening like cue. Since the stream->url is no longer copied with this
commit, that means it gets thrown away after the stream closes. This
leads to a use after free. We still need to allocate stream->url so fix
this another way.
This reverts commit 3e85df3b2d89d6a27806d677b6b8a99055cb1fcc.
| -rw-r--r-- | demux/demux.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/demux/demux.c b/demux/demux.c index 955f84cb81..2b1e670b28 100644 --- a/demux/demux.c +++ b/demux/demux.c @@ -3245,7 +3245,7 @@ struct parent_stream_info { bool is_streaming; int stream_origin; struct mp_cancel *cancel; - const char *filename; + char *filename; }; static struct demuxer *open_given_type(struct mpv_global *global, @@ -3415,7 +3415,7 @@ static struct demuxer *demux_open(struct stream *stream, .is_streaming = stream->streaming, .stream_origin = stream->stream_origin, .cancel = cancel, - .filename = stream->url, + .filename = talloc_strdup(NULL, stream->url), }; // Test demuxers from first to last, one pass for each check_levels[] entry @@ -3437,6 +3437,7 @@ static struct demuxer *demux_open(struct stream *stream, } done: + talloc_free(sinfo.filename); talloc_free(log); return demuxer; } |