OSDN Git Service

ogg: fix double free when finding length of small chained oggs.
authorRonald S. Bultje <rsbultje@gmail.com>
Wed, 29 Jun 2011 05:24:21 +0000 (22:24 -0700)
committerRonald S. Bultje <rsbultje@gmail.com>
Wed, 29 Jun 2011 16:45:52 +0000 (09:45 -0700)
commit9ed6cbc3ee2ae3e7472fb25192a7e36fd7b15533
treed34a3f23609113cd1fabf61c3c65a15c2b870a5a
parentef1ee362b36893cd1cc1e9c7de378e9cb239b0e8
ogg: fix double free when finding length of small chained oggs.

ogg_save() copies streams[], but doesn't keep track of free()'ed
struct members. Thus, if in between a call to ogg_save() and
ogg_restore(), streams[].private was free()'ed, this would result
in a double free -> crash, which happened when e.g. playing small
chained ogg fragments.
libavformat/oggdec.c