diff options
| author | wm4 <wm4@nowhere> | 2019-09-21 21:59:09 +0200 |
|---|---|---|
| committer | wm4 <wm4@nowhere> | 2019-09-21 21:59:09 +0200 |
| commit | 5858e3cdbd6fbae3ed80366912dd5df0af4fa126 (patch) | |
| tree | 164a82cede5b20d12f72af823600af3f8a6486c0 /wscript | |
| parent | fc7decde738378b0ea5ecc1163c6b8d65a73672d (diff) | |
| download | mpv-5858e3cdbd6fbae3ed80366912dd5df0af4fa126.tar.bz2 mpv-5858e3cdbd6fbae3ed80366912dd5df0af4fa126.tar.xz | |
audio: fix use-after-free with fuzzed file
reinit_audio_filters_and_output() can fully shutdown the audio chain on
failure. Specifically, it will deallocate mpctx->ao_chain. The value of
that field was cached in ao_c. The code after the call did not account
that the audio chain can be shutdown, and used the stale ao_c value.
Fixes: #6808
Diffstat (limited to 'wscript')
0 files changed, 0 insertions, 0 deletions