Change free_sh_audio() to take demuxer and stream id as parameters

(same as new_sh_audio()) instead of sh_audio_t *, use those to remove
the pointer from demuxer->a_streams[] before freeing it.

Some demuxers use free_sh_audio() to undo the creation of an
already-allocated audio stream in case of error. These uses were unsafe
since free_sh_audio() freed the data structure but left the pointer in
demuxer->a_streams[], leading to double free later in free_demuxer()
(and perhaps use of the freed stream before that, I didn't check).


git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@18711 b3059339-0415-0410-9bf9-f77b7e298cf2

1 files changed, 2 insertions, 3 deletions

diff --git a/libmpdemux/demux_audio.c b/libmpdemux/demux_audio.c
index 393e485555..c1f2cecfbd 100644
--- a/libmpdemux/demux_audio.c
+++ b/libmpdemux/demux_audio.c
@@ -47,7 +47,6 @@ typedef struct mp3_hdr {
   struct mp3_hdr *next;
 } mp3_hdr_t;
 
-extern void free_sh_audio(sh_audio_t* sh);
 extern void print_wave_header(WAVEFORMATEX *h, int verbose_level);
 
 int hr_mp3_seek = 0;
@@ -412,12 +411,12 @@ static int demux_audio_open(demuxer_t* demuxer) {
     l = stream_read_dword_le(s);
     if(l < 16) {
       mp_msg(MSGT_DEMUX,MSGL_ERR,"[demux_audio] Bad wav header length: too short (%d)!!!\n",l);
-      free_sh_audio(sh_audio);
+      free_sh_audio(demuxer, 0);
       return 0;
     }
     if(l > MAX_WAVHDR_LEN) {
       mp_msg(MSGT_DEMUX,MSGL_ERR,"[demux_audio] Bad wav header length: too long (%d)!!!\n",l);
-      free_sh_audio(sh_audio);
+      free_sh_audio(demuxer, 0);
       return 0;
     }
     sh_audio->wf = w = (WAVEFORMATEX*)malloc(l > sizeof(WAVEFORMATEX) ? l : sizeof(WAVEFORMATEX));