mplayer: fix crash when muted and audio codec fails

When audio codec initialization fails, reinit_audio_chain() will call
uninit_player() to close the AO. mpctx->ao is set, but mpctx->mixer.ao
is still NULL. uninit_player() assumes both variables are always the
same, and calls mixer_uninit(), even though mpctx->mixer.ao is NULL.
That function tries to access the ao without NULL check if mute was
enabled.

Fix this in mplayer.c by not relying on the assumption that
mpctx->ao == mpctx->mixer.ao. Also, add a check for NULL to mixer.c
(function muxer_uninit()). One of the checks is redundant and only one
of them is needed, but we add both for general robustness.

2 files changed, 5 insertions, 2 deletions

diff --git a/mixer.c b/mixer.c
index 8b52145d62..425e0fcd37 100644
--- a/mixer.c
+++ b/mixer.c
@@ -271,6 +271,9 @@ void mixer_reinit(struct mixer *mixer, struct ao *ao)
  */
 void mixer_uninit(struct mixer *mixer)
 {
+    if (!mixer->ao)
+        return;
+
     checkvolume(mixer);
     if (mixer->muted_by_us) {
         /* Current audio output API combines playing the remaining buffered
diff --git a/mplayer.c b/mplayer.c
index b62cb524ee..65c9731c53 100644
--- a/mplayer.c
+++ b/mplayer.c
@@ -692,10 +692,10 @@ void uninit_player(struct MPContext *mpctx, unsigned int mask)
 
     if (mask & INITIALIZED_AO) {
         mpctx->initialized_flags &= ~INITIALIZED_AO;
-        if (mpctx->ao) {
+        if (mpctx->mixer.ao)
             mixer_uninit(&mpctx->mixer);
+        if (mpctx->ao)
             ao_uninit(mpctx->ao, mpctx->stop_play != AT_END_OF_FILE);
-        }
         mpctx->ao = NULL;
         mpctx->mixer.ao = NULL;
     }