demux_mkv_timeline: fix potential issue when enabling cache

If the cache is enabled, the demuxer is closed and opened again (because
currently, the cache can not be enabled atfer data was already read).
The call for opening a new demuxer uses the same params struct, which
references the ctx->uids array. But there is a MP_TARRAY_GROW()
invocation somewhere on the way, which can reallocate the ctx->uids
array, making params.uids a dangling pointer.

This issue probably existed for a longer time, probably since 5cd33853
(slightly more obvious since f50b105d).

1 files changed, 1 insertions, 0 deletions

diff --git a/demux/demux_mkv_timeline.c b/demux/demux_mkv_timeline.c
index 1ef90f04cf..3326362226 100644
--- a/demux/demux_mkv_timeline.c
+++ b/demux/demux_mkv_timeline.c
@@ -214,6 +214,7 @@ static bool check_file_seg(struct tl_ctx *ctx, char *filename, int segment)
             {
                 free_demuxer_and_stream(d);
                 params.disable_cache = false;
+                params.matroska_wanted_uids = ctx->uids; // potentially reallocated, same data
                 d = demux_open_url(filename, &params, cancel, ctx->global);
                 if (!d)
                     continue;