diff mbox series

[FFmpeg-devel,04/10] avformat/segment: Fix segfault when error happens and segment list is output

Message ID 20200907024952.11697-4-andreas.rheinhardt@gmail.com
State Accepted
Commit 936d967871562e36e307126b59e4e6bbb3a3bab7
Headers show
Series [FFmpeg-devel,01/10] avformat/segment: Don't overwrite AVCodecParameters after init | expand

Checks

Context Check Description
andriy/default pending
andriy/make success Make finished
andriy/make_fate success Make fate finished

Commit Message

Andreas Rheinhardt Sept. 7, 2020, 2:49 a.m. UTC 
The segment muxer has an option to output a file containing a list of
the segments written. The AVIOContext used for writing this file is
opened via the main AVFormatContext's io_open callback; seg_free()
meanwhile unconditionally closes this AVIOContext by calling
ff_format_io_close() with the child muxer (the one for the actual output
format) as AVFormatContext.

The problem hereby is that the child AVFormatContext need not exist,
even when the AVIOContext does. This leads to a segfault in
ff_format_io_close() when the child muxer's io_close callback is called.

Situations in which the AVFormatContext can be NULL range from an
invalid reference stream parameter to an unavailable/bogus/unsupported
output format to inability to allocate the AVFormatContext.

The solution is to simply close the AVIOContext with the AVFormatContext
that was used to open it: The main AVFormatContext.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
---
 libavformat/segment.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/libavformat/segment.c b/libavformat/segment.c
index 9fafec0e35..e30e47b62e 100644
--- a/libavformat/segment.c
+++ b/libavformat/segment.c
@@ -660,7 +660,7 @@  static int select_reference_stream(AVFormatContext *s)
 static void seg_free(AVFormatContext *s)
 {
     SegmentContext *seg = s->priv_data;
-    ff_format_io_close(seg->avf, &seg->list_pb);
+    ff_format_io_close(s, &seg->list_pb);
     avformat_free_context(seg->avf);
     seg->avf = NULL;
     av_freep(&seg->times);