Change free_sh_audio() to take demuxer and stream id as parameters

(same as new_sh_audio()) instead of sh_audio_t *, use those to remove
the pointer from demuxer->a_streams[] before freeing it.

Some demuxers use free_sh_audio() to undo the creation of an
already-allocated audio stream in case of error. These uses were unsafe
since free_sh_audio() freed the data structure but left the pointer in
demuxer->a_streams[], leading to double free later in free_demuxer()
(and perhaps use of the freed stream before that, I didn't check).


git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@18711 b3059339-0415-0410-9bf9-f77b7e298cf2

5 files changed, 10 insertions, 11 deletions

diff --git a/libmpdemux/demux_audio.c b/libmpdemux/demux_audio.c
index 393e485555..c1f2cecfbd 100644
--- a/libmpdemux/demux_audio.c
+++ b/libmpdemux/demux_audio.c
@@ -47,7 +47,6 @@ typedef struct mp3_hdr {
   struct mp3_hdr *next;
 } mp3_hdr_t;
 
-extern void free_sh_audio(sh_audio_t* sh);
 extern void print_wave_header(WAVEFORMATEX *h, int verbose_level);
 
 int hr_mp3_seek = 0;
@@ -412,12 +411,12 @@ static int demux_audio_open(demuxer_t* demuxer) {
     l = stream_read_dword_le(s);
     if(l < 16) {
       mp_msg(MSGT_DEMUX,MSGL_ERR,"[demux_audio] Bad wav header length: too short (%d)!!!\n",l);
-      free_sh_audio(sh_audio);
+      free_sh_audio(demuxer, 0);
       return 0;
     }
     if(l > MAX_WAVHDR_LEN) {
       mp_msg(MSGT_DEMUX,MSGL_ERR,"[demux_audio] Bad wav header length: too long (%d)!!!\n",l);
-      free_sh_audio(sh_audio);
+      free_sh_audio(demuxer, 0);
       return 0;
     }
     sh_audio->wf = w = (WAVEFORMATEX*)malloc(l > sizeof(WAVEFORMATEX) ? l : sizeof(WAVEFORMATEX));
diff --git a/libmpdemux/demux_mkv.c b/libmpdemux/demux_mkv.c
index bc9bfa2731..a9cd8be4aa 100644
--- a/libmpdemux/demux_mkv.c
+++ b/libmpdemux/demux_mkv.c
@@ -1837,7 +1837,7 @@ demux_mkv_open_audio (demuxer_t *demuxer, mkv_track_t *track)
           mp_msg (MSGT_DEMUX, MSGL_WARN, "[mkv] Unknown/unsupported audio "
                   "codec ID '%s' for track %u or missing/faulty private "
                   "codec data.\n", track->codec_id, track->tnum);
-          free_sh_audio (sh_a);
+          free_sh_audio(demuxer, track->tnum);
           return 1;
         }
     }
@@ -2061,7 +2061,7 @@ demux_mkv_open_audio (demuxer_t *demuxer, mkv_track_t *track)
     }
   else if (!track->ms_compat || (track->private_size < sizeof(WAVEFORMATEX)))
     {
-      free_sh_audio (sh_a);
+      free_sh_audio(demuxer, track->tnum);
       return 1;
     }
 
diff --git a/libmpdemux/demux_viv.c b/libmpdemux/demux_viv.c
index 206e310d7c..87dca62326 100644
--- a/libmpdemux/demux_viv.c
+++ b/libmpdemux/demux_viv.c
@@ -663,7 +663,7 @@ if (demuxer->audio->id >= -1){
 		{
 		    mp_msg(MSGT_DEMUX, MSGL_ERR, "VIVO: Not support audio codec (%d)\n",
 			priv->audio_codec);
-		    free_sh_audio(sh);
+		    free_sh_audio(demuxer, 1);
 		    goto nosound;
 		}
 
diff --git a/libmpdemux/demuxer.c b/libmpdemux/demuxer.c
index a95b453e87..ae4826e332 100644
--- a/libmpdemux/demuxer.c
+++ b/libmpdemux/demuxer.c
@@ -229,7 +229,9 @@ sh_audio_t* new_sh_audio(demuxer_t *demuxer,int id){
     return demuxer->a_streams[id];
 }
 
-void free_sh_audio(sh_audio_t* sh){
+void free_sh_audio(demuxer_t *demuxer, int id) {
+    sh_audio_t *sh = demuxer->a_streams[id];
+    demuxer->a_streams[id] = NULL;
     mp_msg(MSGT_DEMUXER,MSGL_DBG2,"DEMUXER: freeing sh_audio at %p\n",sh);
     if(sh->wf) free(sh->wf);
     free(sh);
@@ -270,11 +272,9 @@ void free_demuxer(demuxer_t *demuxer){
       goto skip_streamfree;
     // free streams:
     for(i = 0; i < MAX_A_STREAMS; i++)
-	if(demuxer->a_streams[i]) free_sh_audio(demuxer->a_streams[i]);
+	if(demuxer->a_streams[i]) free_sh_audio(demuxer, i);
     for(i = 0; i < MAX_V_STREAMS; i++)
 	if(demuxer->v_streams[i]) free_sh_video(demuxer->v_streams[i]);
-    //if(sh_audio) free_sh_audio(sh_audio);
-    //if(sh_video) free_sh_video(sh_video);
     // free demuxers:
     free_demuxer_stream(demuxer->audio);
     free_demuxer_stream(demuxer->video);
diff --git a/libmpdemux/stheader.h b/libmpdemux/stheader.h
index 145f288d3d..74a43f9262 100644
--- a/libmpdemux/stheader.h
+++ b/libmpdemux/stheader.h
@@ -89,7 +89,7 @@ typedef struct {
 // demuxer.c:
 sh_audio_t* new_sh_audio(demuxer_t *demuxer,int id);
 sh_video_t* new_sh_video(demuxer_t *demuxer,int id);
-void free_sh_audio(sh_audio_t *sh);
+void free_sh_audio(demuxer_t *demuxer, int id);
 void free_sh_video(sh_video_t *sh);
 
 // video.c: