Change free_sh_audio() to take demuxer and stream id as parameters

(same as new_sh_audio()) instead of sh_audio_t *, use those to remove
the pointer from demuxer->a_streams[] before freeing it.

Some demuxers use free_sh_audio() to undo the creation of an
already-allocated audio stream in case of error. These uses were unsafe
since free_sh_audio() freed the data structure but left the pointer in
demuxer->a_streams[], leading to double free later in free_demuxer()
(and perhaps use of the freed stream before that, I didn't check).


git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@18711 b3059339-0415-0410-9bf9-f77b7e298cf2

1 files changed, 4 insertions, 4 deletions

diff --git a/libmpdemux/demuxer.c b/libmpdemux/demuxer.c
index a95b453e87..ae4826e332 100644
--- a/libmpdemux/demuxer.c
+++ b/libmpdemux/demuxer.c
@@ -229,7 +229,9 @@ sh_audio_t* new_sh_audio(demuxer_t *demuxer,int id){
     return demuxer->a_streams[id];
 }
 
-void free_sh_audio(sh_audio_t* sh){
+void free_sh_audio(demuxer_t *demuxer, int id) {
+    sh_audio_t *sh = demuxer->a_streams[id];
+    demuxer->a_streams[id] = NULL;
     mp_msg(MSGT_DEMUXER,MSGL_DBG2,"DEMUXER: freeing sh_audio at %p\n",sh);
     if(sh->wf) free(sh->wf);
     free(sh);
@@ -270,11 +272,9 @@ void free_demuxer(demuxer_t *demuxer){
       goto skip_streamfree;
     // free streams:
     for(i = 0; i < MAX_A_STREAMS; i++)
-	if(demuxer->a_streams[i]) free_sh_audio(demuxer->a_streams[i]);
+	if(demuxer->a_streams[i]) free_sh_audio(demuxer, i);
     for(i = 0; i < MAX_V_STREAMS; i++)
 	if(demuxer->v_streams[i]) free_sh_video(demuxer->v_streams[i]);
-    //if(sh_audio) free_sh_audio(sh_audio);
-    //if(sh_video) free_sh_video(sh_video);
     // free demuxers:
     free_demuxer_stream(demuxer->audio);
     free_demuxer_stream(demuxer->video);