| Message ID | 20171106162933.5128-1-jamrial@gmail.com |
|---|---|
| State | Accepted |
| Commit | f7c01ff24d706e2c7d645944227a5242e0f1203f |
| Headers | show |
2017-11-06 17:29 GMT+01:00 James Almer <jamrial@gmail.com>: > Don't free the buffer allocated in ff_wms_parse_sdp_a_line() after > calling avformat_open_input(), as it may free it and replace it with > another one. > > Should fix ticket #6808 I can confirm that the patch fixes the issue, consider using av_freep. Thank you, Carl Eugen
On 11/6/2017 3:54 PM, Carl Eugen Hoyos wrote: > 2017-11-06 17:29 GMT+01:00 James Almer <jamrial@gmail.com>: >> Don't free the buffer allocated in ff_wms_parse_sdp_a_line() after >> calling avformat_open_input(), as it may free it and replace it with >> another one. >> >> Should fix ticket #6808 > > I can confirm that the patch fixes the issue, consider using av_freep. No point, the AVIOContext is local and the av_free() call happens right before returning from the function. Pushed, thanks.
diff --git a/libavformat/rtpdec_asf.c b/libavformat/rtpdec_asf.c index 2c09fda10b..09f214a71c 100644 --- a/libavformat/rtpdec_asf.c +++ b/libavformat/rtpdec_asf.c @@ -139,12 +139,12 @@ int ff_wms_parse_sdp_a_line(AVFormatContext *s, const char *p) ret = avformat_open_input(&rt->asf_ctx, "", iformat, &opts); av_dict_free(&opts); if (ret < 0) { - av_free(buf); + av_free(pb.buffer); return ret; } av_dict_copy(&s->metadata, rt->asf_ctx->metadata, 0); rt->asf_pb_pos = avio_tell(&pb); - av_free(buf); + av_free(pb.buffer); rt->asf_ctx->pb = NULL; } return ret;
Don't free the buffer allocated in ff_wms_parse_sdp_a_line() after calling avformat_open_input(), as it may free it and replace it with another one. Should fix ticket #6808 Signed-off-by: James Almer <jamrial@gmail.com> --- Untested. libavformat/rtpdec_asf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)