From 7022f65d0cc4edcb001a39f8836940f8a34ea029 Mon Sep 17 00:00:00 2001 From: uau Date: Wed, 14 Jun 2006 14:05:59 +0000 Subject: Change free_sh_audio() to take demuxer and stream id as parameters (same as new_sh_audio()) instead of sh_audio_t *, use those to remove the pointer from demuxer->a_streams[] before freeing it. Some demuxers use free_sh_audio() to undo the creation of an already-allocated audio stream in case of error. These uses were unsafe since free_sh_audio() freed the data structure but left the pointer in demuxer->a_streams[], leading to double free later in free_demuxer() (and perhaps use of the freed stream before that, I didn't check). git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@18711 b3059339-0415-0410-9bf9-f77b7e298cf2 --- libmpdemux/demuxer.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'libmpdemux/demuxer.c') diff --git a/libmpdemux/demuxer.c b/libmpdemux/demuxer.c index a95b453e87..ae4826e332 100644 --- a/libmpdemux/demuxer.c +++ b/libmpdemux/demuxer.c @@ -229,7 +229,9 @@ sh_audio_t* new_sh_audio(demuxer_t *demuxer,int id){ return demuxer->a_streams[id]; } -void free_sh_audio(sh_audio_t* sh){ +void free_sh_audio(demuxer_t *demuxer, int id) { + sh_audio_t *sh = demuxer->a_streams[id]; + demuxer->a_streams[id] = NULL; mp_msg(MSGT_DEMUXER,MSGL_DBG2,"DEMUXER: freeing sh_audio at %p\n",sh); if(sh->wf) free(sh->wf); free(sh); @@ -270,11 +272,9 @@ void free_demuxer(demuxer_t *demuxer){ goto skip_streamfree; // free streams: for(i = 0; i < MAX_A_STREAMS; i++) - if(demuxer->a_streams[i]) free_sh_audio(demuxer->a_streams[i]); + if(demuxer->a_streams[i]) free_sh_audio(demuxer, i); for(i = 0; i < MAX_V_STREAMS; i++) if(demuxer->v_streams[i]) free_sh_video(demuxer->v_streams[i]); - //if(sh_audio) free_sh_audio(sh_audio); - //if(sh_video) free_sh_video(sh_video); // free demuxers: free_demuxer_stream(demuxer->audio); free_demuxer_stream(demuxer->video); -- cgit v1.2.3